Texas HB300 Readiness and a 71% Drop in Phishing Clicks at a Behavioral Health Provider
Behavioral health records carry heightened sensitivity and Texas HB300 adds obligations on top of federal HIPAA. Training and process changes moved both the compliance record and the human risk.
At a glance
2 locations · 9 clinicians · 19 staff
The challenge
The provider handles substance use and mental health records, where a disclosure does more damage than almost any other record type. A baseline phishing simulation returned a 34% click rate. Separately, the practice was fulfilling electronic records requests on the federal 30-day timeline, not the 15 business days Texas HB300 requires.
- 34% click rate on the baseline phishing simulation
- Electronic access requests fulfilled on a 30-day clock, not HB300's 15 business days
- Training delivered at hire only, with no 2-year refresh cycle
- Heightened sensitivity of behavioral health records raises breach impact
What we did
- 1
HB300 gap analysis on top of federal HIPAA
We mapped the three places Texas law goes beyond federal HIPAA — training timing, 15-business-day electronic access, and authorisation for sale of PHI — and rewrote the affected procedures.
- 2
Access request workflow rebuild
A tracked intake-to-fulfilment workflow with an internal 10-business-day target, so the statutory 15-day deadline is met with margin and every request is evidenced.
- 3
Role-specific training, not a generic video
Front desk, clinicians, and billing each received scenarios drawn from their own workflows, delivered on the HB300 cycle: within 90 days of hire, then every two years.
- 4
Monthly phishing simulations with same-day coaching
Clicks triggered a short coaching module immediately rather than a report to management — the measure that moved the number fastest.
- 5
Reporting culture as the real metric
We tracked report rate alongside click rate. A workforce that reports a suspicious message in minutes shortens every future incident timeline.
The outcome
The provider now meets both federal HIPAA and Texas HB300 obligations with an evidence trail for each, and the human attack surface — the vector behind most healthcare breaches — is measurably smaller.
The coaching happening the moment someone clicked, instead of in a quarterly report, is what actually changed behaviour.
Services used in this engagement
More case studies
Client identities are protected under our Business Associate Agreements. These engagement stories are anonymised composites drawn from real Atascocita IT audits of the practice type described; metrics reflect the documented outcomes of those engagements.