Law / United States / 
Texas
Texas electronic health records: storage in the United States, access limits and safeguards
Tex. Health & Safety Code sec. 183.002
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Security, Prohibition
- Audit expectation
- none
As of .
What it requires
- If you are a covered entity under Health and Safety Code chapter 181 or a health care practitioner, ensure that electronic health records under your control that contain patient information are physically maintained in the United States or a territory of the United States, including records held by a third-party or subcontracted computing facility or cloud computing service (Tex. Health & Safety Code sec. 183.002(a)).
- Ensure that the electronic health record information of Texas residents, other than open data, is accessible only to individuals who require it to perform duties within the scope of their employment related to treatment, payment or health care operations (Tex. Health & Safety Code sec. 183.002(b)).
- Implement reasonable and appropriate administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of electronic health record information (Tex. Health & Safety Code sec. 183.002(c)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Tex. Health & Safety Code sec. 183.011(b): the attorney general may seek civil penalties against a covered entity that may not exceed $5,000 for each violation committed negligently that occurs in a single year, $25,000 for each such violation committed knowingly or intentionally, or $250,000 for each violation in which the covered entity knowingly or intentionally used protected health information for financial gain.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 250,000
Who enforces it
Enforcement body
Texas attorney general, who may institute an action for injunctive relief and an action for civil penalties against a covered entity (Tex. Health & Safety Code sec. 183.011(a), (b)).
What this law does
In chapter 183 a covered entity has the meaning section 181.001 assigns and includes a health care practitioner, but does not include a home and community support services agency, a nursing facility, a continuing care facility, an assisted living facility, an intermediate care facility, a day activity and health services facility, or a provider under the Texas home living or home and community-based services waiver program.
A covered entity must ensure that electronic health records under its control that contain patient information are physically maintained in the United States or a territory of the United States, including records stored by a third-party or subcontracted computing facility or cloud computing service and records stored using a technology through which patient information may be retrieved, accessed or transmitted.
A covered entity must ensure that the electronic health record information of this state's residents, other than open data, is accessible only to individuals who require it to perform duties within the scope of their employment related to treatment, payment or health care operations. Each covered entity must implement reasonable and appropriate administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of electronic health record information.
The attorney general may institute an action for injunctive relief to restrain a violation of chapter 183. The attorney general may institute an action for civil penalties against a covered entity, which may not exceed $5,000 for each negligent violation in a single year, $25,000 for each knowing or intentional violation in a single year, or $250,000 for each violation in which the covered entity knowingly or intentionally used protected health information for financial gain.
The appropriate regulatory agency may take disciplinary action against a covered entity that violates chapter 183 three or more times in the same manner as if the covered entity violated an applicable licensing or regulatory law. Chapter 183 was added by Acts 2025, 89th Legislature, chapter 1002 (Senate Bill 1188), effective .
Section 2(b) of the Act that added chapter 183 provides that section 183.002 applies to the storage of an electronic health record on or after , regardless of the date on which the record was prepared.
When LexLint raises it
When your app profile says your app handles health records.