Texas SB 1188 Electronic Health Records

Overview

Texas S.B. No. 1188, from the 89th Legislature, Regular Session, concerns electronic health record requirements and authorizes civil penalties. Section 1 of the engrossed bill would add Chapter 183, Electronic Health Records, to Subtitle I, Title 2 of the Texas Health and Safety Code. The provisions described here are those of that version. The legislature also published an enrolled version.

The chapter combines domestic record-storage requirements, employment-related access controls, information-security safeguards, clinical record-content rules, diagnostic artificial intelligence oversight, access to minors' records, and public enforcement. It directly addresses health care practitioners and covered entities using electronic records, including records maintained through outsourced computing facilities or cloud services. Its focus is electronic health records rather than general-purpose AI or telecommunications infrastructure. The engrossed bill specifies September 1, 2025 as its general effective date and January 1, 2026 as the date for applying Section 183.002 to stored records regardless of their preparation date.

Definitions and Coverage

Section 183.001 incorporates the meaning of covered entity from Health and Safety Code Section 181.001 and expressly includes a health care practitioner. A practitioner is an individual licensed, certified, or otherwise authorized to provide health care services in Texas. Coverage therefore depends on the incorporated definition together with Chapter 183's express inclusions and exclusions.

The chapter excludes home and community support services agencies, nursing facilities, continuing care facilities, assisted living facilities, intermediate care facilities, day activity and health services facilities, and providers under the Texas home living or home and community-based services waiver programs. These exclusions are tied to the statutory chapters or programs identified in the bill, rather than a general exemption for every long-term care or community-based service.

Biological sex is defined as the biological trait determining whether a sexually reproducing organism produces male or female gametes. Female and male are defined by reproductive systems developed to produce ova and sperm, respectively. A sexual development disorder is a congenital condition associated with atypical development of internal or external genital structures, including chromosomal, gonadal, and anatomic abnormalities. For Section 183.006, a minor is an individual aged 17 or younger whose disabilities of minority have not been removed for general purposes.

Storage, Access Controls, and Security

Section 183.002 requires covered entities to ensure that electronic health records containing patient information and under their control are physically maintained in the United States or a United States territory. The requirement expressly extends to third-party or subcontracted computing facilities, cloud services, and storage technologies through which information can be retrieved, accessed, or transmitted. Outsourcing storage therefore does not remove the location requirement for records within a covered entity's control.

For information in Texas residents' electronic health records other than open data, access is limited to individuals who need the information to perform employment duties related to treatment, payment, or health care operations. This is a separate obligation from domestic hosting. A record's physical location addresses the storage duty, while an individual's employment-related need addresses the access duty.

The same section requires reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of records. Reviewing hosting locations, subcontracting arrangements, access permissions, and security controls provides a practical way to assess these obligations. Such reviews are implementation methods rather than independently mandated assessment documents. Domestic storage, appropriate access, and effective safeguards each require separate attention when configuring an electronic record system.

Clinical Record Functions and Diagnostic AI

Section 183.003 requires electronic health records to provide an option for health care practitioners to collect and record communications between covered entities concerning metabolic health and diet in the treatment of chronic disease or illness. The requirement concerns a record-system capability to capture these communications. Section 183.004 prohibits collecting, storing, or sharing an individual's credit-score or voter-registration information in that individual's electronic health record.

Section 183.005 addresses practitioners who use artificial intelligence for diagnostic purposes, including recommendations concerning diagnosis or treatment based on a patient's medical record. Those practitioners must review all records created by the AI to ensure accuracy and proper management. They must also disclose the described diagnostic AI use to their patients. These duties place practitioner oversight and patient disclosure within the clinical workflow.

A practical diagnostic AI workflow can connect generated records to practitioner review and provide a patient-facing disclosure step. Checking that review and disclosure occur can support compliance assessment, while maintaining evidence of those activities can assist responses to investigations. These operational methods are distinct from the express statutory duties. The AI provisions are targeted obligations associated with electronic health records and diagnostic use, rather than a general AI approval or certification system.

Minors' Access and Biological-Sex Documentation

Section 183.006 requires complete and unrestricted access to a minor's electronic health record immediately upon request by the minor's parent, managing conservator, or guardian. Access remains subject to restrictions imposed by state law, federal law, or a court order. Implementing this provision therefore involves recognizing the requesting person's legal relationship to the minor and applying the relevant legal exceptions.

Section 183.007 requires separate spaces in an electronic health record for biological sex based on practitioner observation recorded at birth and for sexual development disorders. Any included algorithm or decision-assistance tool used to make medical treatment decisions must include the biological sex recorded in the prescribed field. The commission, Texas Medical Board, and Texas Department of Insurance are assigned joint responsibility for ensuring compliance with these documentation and decision-support requirements.

The prescribed biological-sex information may be amended only to correct a clerical error or, following diagnosis of a sexual development disorder, to change the listed sex to the opposite sex. An amendment based on that diagnosis requires documentation of the sexual development disorder. These requirements address the content and amendment of specified record fields as well as the use of that information in relevant treatment tools.

Governance, Investigations, and Monitoring

Section 183.012 requires the executive commissioner, Texas Medical Board, Texas Department of Licensing and Regulation, Texas Department of Insurance, and each regulatory agency subject to the chapter to enter into a memorandum of understanding and adopt implementing rules as necessary. The framework distributes implementation responsibilities among existing institutions rather than establishing a new AI regulator. Section 183.007 separately assigns joint institutional duties concerning biological-sex documentation and decision-support requirements.

Under Section 183.009, the commission or appropriate regulatory agency must investigate any credible allegation that a covered entity violated the chapter. Investigations must comply with applicable state and federal law, expressly including the Health Insurance Portability and Accountability Act of 1996. The investigation requirement is the chapter's principal express monitoring mechanism.

Internal checks can support compliance by reviewing hosting locations, matching access permissions to employment duties, confirming required record fields and functions, and checking practitioner review and patient disclosure of diagnostic AI use. These checks are recommended administrative methods, not additional statutory reporting or audit duties. The public-enforcement framework separates agency investigation and regulatory discipline from the attorney general's court-based enforcement powers.

Implementation and Relationships to Other Laws

Implementation begins with determining entity coverage and mapping the relevant record systems. An organization can assess the incorporated covered-entity definition, identify any express exclusion, and review its own systems together with cloud infrastructure and subcontracted storage. Clinical configuration can then address metabolic-health communication functionality, prohibited information, access to minors' records, prescribed biological-sex fields, sexual-development-disorder documentation, and AI-related review and disclosure.

The bill's direct statutory relationship is to the Texas Health and Safety Code. It adds Chapter 183, incorporates a definition from Chapter 181, and uses specified licensing chapters and waiver programs to delimit exclusions. Its disciplinary provision relies on the applicable licensing or regulatory mechanisms of the relevant agencies. Section 183.007 begins with a notwithstanding-any-other-law clause for the joint institutional duties concerning biological-sex record requirements; that clause operates in the context of those duties.

Federal requirements remain expressly relevant to implementation. Investigations must comply with applicable federal law, including HIPAA, and access to minors' records is subject to federal as well as state restrictions and court orders. Section 3 permits an affected state agency to request a necessary federal waiver or authorization and delay implementation of the relevant provision until authorization is granted. This provision supplies an agency-specific authorization pathway rather than an unrestricted extension for private entities.

Penalties and Regulatory Discipline

Section 183.011 authorizes the attorney general to bring an action for injunctive relief restraining a violation and an action for civil penalties against a covered entity. The maximum civil penalty is $5,000 for each negligent violation occurring in a single year and $25,000 for each knowing or intentional violation occurring in a single year, regardless of how long the violation continues during that year.

A separate maximum of $250,000 applies to each violation in which a covered entity knowingly or intentionally uses protected health information for financial gain. These amounts are ceilings rather than automatic assessments. The annual wording attached to negligent and knowing or intentional violations is distinct from the wording of the financial-gain category.

Section 183.010 separately permits regulatory disciplinary action when a covered entity violates the chapter three or more times. The appropriate agency may proceed as it would for a violation of an applicable licensing or regulatory law, including suspension or revocation of a license, registration, or certification for a period the agency determines appropriate. The three-violation threshold applies to this disciplinary authority, rather than serving as a prerequisite for investigations, injunctions, or civil penalties. The enforcement mechanisms therefore combine corrective court orders, financial consequences, and potential effects on authorization to practice or operate.

Domestic Storage and International Operations

The geographic element of Section 183.002 is its requirement that patient-containing electronic health records under a covered entity's control be physically maintained in the United States or a United States territory. Because the provision expressly includes cloud services and subcontracted computing facilities, global service arrangements require attention to the physical location of covered record storage. Reviewing outsourced hosting and storage arrangements is a practical implementation measure.

The location duty and the employment-related access duty address different aspects of record handling. The geographic requirement concerns where records are physically maintained. The access requirement concerns whether an individual needs Texas residents' non-open-data record information for employment duties related to treatment, payment, or health care operations. The chapter is consequently a Texas electronic health record framework with a domestic-storage component, rather than an international AI governance arrangement.

Implementation Timeline

Compliance Checklist

Sources and References