Texas HB 300 in 2026: What Medical Practices Owe Beyond HIPAA

What HB 300 is

HB 300 took effect in 2012 and amended Chapter 181 of the Texas Health and Safety Code, along with related breach notification provisions in the Business and Commerce Code. It did not replace HIPAA. It layered stricter state requirements on top, and later legislative sessions have tightened parts of it further — most notably the breach notification deadlines. This article summarises the obligations; for legal questions about your specific situation, talk to a Texas healthcare attorney.

Who counts as a covered entity in Texas

HIPAA covers health plans, clearinghouses and providers that bill electronically. Texas defines a covered entity far more broadly: essentially anyone who assembles, collects, analyses, uses, stores or transmits protected health information, or who comes into possession of it. That can pull in cash-only practices, some business associates, and others that assume HIPAA does not reach them.

• →Cash-pay and concierge practices that never bill insurance electronically
• →Vendors and contractors who handle patient information
• →Anyone who obtains or stores protected health information, even incidentally

Mandatory workforce training

HB 300 requires covered entities to train employees on both state and federal privacy law as it relates to the employee's role. New hires must be trained within 90 days, and staff must be retrained when their responsibilities change materially or when the law changes. Employees must sign, electronically or in writing, that they attended, and the practice must keep those records. Many practices retrain everyone annually because it is simpler than tracking every role change.

Faster electronic record access

When a patient requests an electronic copy of a record kept electronically, Texas law requires the practice to provide it within 15 business days of a written request. That is tighter than the federal timeline, and it means your EHR export process, identity verification and request log need to work reliably.

Breach notification to Texans and the Attorney General

Texas requires notice to affected individuals within 60 days of determining a breach occurred. If a breach affects 250 or more Texas residents, the Texas Attorney General must also be notified, currently no later than 30 days after that determination. That runs alongside your HIPAA notifications to individuals and HHS, so your incident response plan needs both sets of deadlines written down.

Penalties and the sale of health information

Texas can impose its own civil penalties, separate from federal ones, scaled to intent: lower amounts for negligent violations and far higher amounts for knowing, intentional or financially motivated violations, with larger annual totals for a pattern of violations. HB 300 also prohibits selling protected health information and restricts electronic disclosure for marketing without authorization. When setting penalties, the state considers whether the practice was taking reasonable steps — which is what good documentation shows.

A practical 2026 checklist

Most HB 300 gaps are documentation gaps. These are the items we check in every Texas engagement.

• →Privacy and security policies cite Texas law, not just HIPAA
• →Training covers Texas requirements, with signed attendance for every employee
• →New-hire training is tracked against the 90-day deadline
• →Electronic record requests are logged and fulfilled within 15 business days
• →The incident response plan includes Texas individual and Attorney General deadlines
• →Vendors that handle patient data know they may be covered under Texas law