What Is Texas HB 300 and Who Must Comply?

Texas House Bill 300 is a state health privacy law, codified mainly in Chapter 181 of the Texas Health and Safety Code, that extends HIPAA-style protections to a far broader group of organizations and adds requirements federal law does not impose. If your business, agency, school, or website touches a Texas resident’s protected health information in any way, Texas HB 300 almost certainly applies to you — and it reaches well past doctors and hospitals. The law requires employee training, faster patient access to electronic records, patient authorization before most electronic disclosures, and an outright ban on selling health data. Violations can cost up to $1.5 million per year.

Who Has to Comply

Chapter 181 defines a “covered entity” much more broadly than federal law. In Texas, a covered entity is any person or organization that assembles, collects, analyzes, stores, or transmits protected health information, whether for commercial gain, professional fees, nonprofit purposes, or pro bono work.¹ Free clinics, research universities, and volunteer groups fall within scope just as hospitals do.

The statute spells out examples: business associates, health care payers, government agencies, IT management companies, schools, health researchers, clinics, and operators of websites that handle medical data.¹ Employees, agents, and contractors of those organizations are independently covered to the extent they create, receive, or maintain protected health information. Possession of the data is the trigger. You do not need to be in the healthcare industry.

How HB 300 Works With Federal HIPAA

Section 181.004 requires every entity that qualifies as a covered entity under the federal HIPAA definition at 45 C.F.R. Section 160.103 to comply with both HIPAA and Chapter 181.² HIPAA sets the floor. Texas law stacks on top. When both laws address the same issue, the rule that gives the patient stronger protection controls.

That matters for any organization operating across state lines. Multi-state entities handling Texas residents’ data need to layer the Texas requirements onto their existing HIPAA compliance program rather than assume federal compliance is enough. Several HB 300 provisions go further than federal standards, and those are the places where organizations get caught.

Employee Training Deadlines and Scope

Every covered entity must train its employees on state and federal health privacy law, and the training must be tailored to each employee’s actual job duties rather than a one-size overview.³ A billing clerk and a nurse both need training. They don’t need the same training.

New employees must complete training within 90 days of their hire date.³ Documentation of training dates is exactly the kind of evidence the Texas Attorney General examines during an investigation, so keep records.

The statute does not set a fixed interval for refresher training. Annual refreshers are the widely accepted practice, and retraining should also happen whenever job duties change, internal privacy policies are updated, or a security incident reveals gaps.

Patient Access to Electronic Health Records

When a patient submits a written request for their electronic health records, the provider must deliver those records electronically within 15 business days, as long as the provider’s system can fulfill the request.⁴ The patient can agree to another format, but the default is electronic.

Providers are not required to release information that falls under the exceptions in 45 C.F.R. Section 164.524.⁴ Those federal exceptions cover psychotherapy notes, information compiled for legal proceedings, and certain lab results under the Clinical Laboratory Improvements Amendments. If a provider denies part of a request under one of those exceptions, the patient can request a review under federal rules.

Authorization Before Electronic Disclosures

Section 181.154 goes meaningfully beyond federal requirements. Before electronically disclosing a patient’s protected health information to anyone, a covered entity must obtain a separate authorization for each disclosure. The authorization can be written, electronic, or oral if the entity documents it in writing.⁵ A single blanket consent form does not satisfy this requirement.

The law carves out exceptions for disclosures to another covered entity for treatment, payment, or health care operations, and for disclosures required by state or federal law.⁵ A hospital sending records to a specialist for a referral does not need fresh authorization each time. An entity sending data to a marketing vendor, an analytics firm, or anyone outside those narrow lanes does.

Covered entities must also post notice, in their office, on their website, or wherever affected patients are likely to see it, stating that electronic disclosures of health information may occur.⁵ Failing to post it is itself a violation.

The Ban on Selling Health Information

Section 181.153 prohibits selling a patient’s protected health information. A covered entity cannot disclose health data to another person in exchange for direct or indirect payment.⁶ This is one of the places Texas law is clearly stricter than HIPAA, which allows certain authorized data sales.

Two narrow exceptions exist. A covered entity may share health data with another covered entity for treatment, payment, health care operations, or certain insurance functions, but any payment received for performing an insurance function cannot exceed the reasonable cost of preparing or transmitting the data.⁶ Disclosures required or authorized by other state or federal laws remain permissible. Outside those two lanes, monetizing patient health data is illegal in Texas.

Data Breach Notification Deadlines

When a breach occurs, the Texas Business and Commerce Code imposes two notification tracks with different deadlines. Affected individuals must be notified no later than 60 days after the entity determines a breach occurred. If the breach affects at least 250 Texas residents, the entity must also notify the Attorney General within 30 days.⁷ Many compliance teams track the 60-day individual clock and miss the shorter AG deadline entirely.

A law enforcement agency can request a delay if notification would interfere with a criminal investigation, but the entity must send notice as soon as the agency clears it.⁷ Notification can go by mail, by electronic notice compliant with federal e-sign rules, or by substitute notice (such as website posting and major media) if the cost of direct notice exceeds $250,000, more than 500,000 people are affected, or the entity lacks sufficient contact information.

Entities that merely maintain data they do not own have a separate obligation: they must notify the data owner or license holder immediately after discovering the breach.⁷ If you are a third-party vendor storing health data on behalf of a hospital, the clock starts the moment you discover the breach, not when you finish your internal investigation.

Civil Penalties for Violations

The Texas Attorney General can seek injunctive relief and civil penalties against any covered entity that violates Chapter 181. Section 181.201 sets a tiered penalty structure based on the violator’s mental state and the nature of the conduct:⁸

Negligent violations: up to $5,000 per violation per year, regardless of how long the violation continues during that year.
Knowing or intentional violations: up to $25,000 per violation per year.
Using health data for financial gain: up to $250,000 per violation when the entity knowingly or intentionally used protected health information to make money.
Pattern or practice of violations: the cap rises to $1.5 million per year when a court finds violations frequent enough to constitute a pattern.

The $250,000 cap pairs directly with the Section 181.153 sales ban. The $1.5 million pattern-or-practice cap gives the Attorney General leverage against repeat offenders.⁸

A limited safe harbor applies to violations of Section 181.154, the electronic disclosure authorization requirement. If the disclosure went only to another covered entity for a permitted purpose and the entity had encryption in place, the recipient never used the data, or the entity maintained strong security policies including employee training, the court may cap total penalties at $250,000 annually for those specific violations.⁸ The safe harbor rewards organizations that invested in encryption and training, but it only applies to that narrow category of violations.

1
State of Texas. Texas Health and Safety Code 181.001 – Definitions
2
State of Texas. Texas Health and Safety Code 181.004 – Applicability of State and Federal Law
3
State of Texas. Texas Health and Safety Code 181.101 – Training Required
4
State of Texas. Texas Health and Safety Code 181.102 – Consumer Access to Electronic Health Records
5
State of Texas. Texas Health and Safety Code 181.154
6
State of Texas. Texas Health and Safety Code 181.153 – Sale of Protected Health Information Prohibited; Exceptions
7
State of Texas. Texas Business and Commerce Code 521.053 – Notification Required Following Breach of Security of Computerized Data
8
State of Texas. Texas Health and Safety Code 181.201 – Injunctive Relief; Civil Penalty