Question 1

What is Texas HB300?

Accepted Answer

HB300 amended the Texas Medical Records Privacy Act to impose privacy obligations that go beyond federal HIPAA. It applies to any person or entity in Texas that assembles, collects, analyses, uses, evaluates, stores, or transmits protected health information — a broader definition than the federal Covered Entity and Business Associate framework, which catches organisations that assume HIPAA does not apply to them.

Question 2

How is HB300 different from federal HIPAA?

Accepted Answer

Three differences matter most in practice. Training must be completed within 90 days of hire and refreshed at least every two years, where federal HIPAA sets no timetable at all. Electronic access requests must be fulfilled within 15 business days, against the federal 30 days. And the sale of PHI requires written patient authorisation, on terms broader than the federal marketing rule.

Question 3

Do we have to notify the Texas Attorney General about a breach?

Accepted Answer

Texas law requires notification to the Attorney General for breaches affecting 250 or more Texas residents, and that obligation runs separately from your federal HHS reporting. Practices routinely handle the federal notification correctly and miss the state one, so build both into the same procedure with the thresholds written out.

Question 4

What are the penalties under HB300?

Accepted Answer

The Texas Attorney General may pursue civil penalties up to $1.5 million per year per violation category, with the amount influenced by whether the conduct was knowing or intentional and whether the entity has a compliance programme. The practical point is that the Texas AG has shown willingness to enforce against small clinics, which makes state exposure real rather than theoretical for a practice of any size.

Question 5

We are a small practice — does HB300 really apply to us?

Accepted Answer

Yes. HB300 has no small-entity exemption, and its definition of a covered entity is deliberately broad. If your practice handles PHI in Texas, the training cadence, the 15-business-day access requirement, and the sale-of-PHI authorisation rule apply regardless of headcount.

Question 6

How do we prove we meet the training requirement?

Accepted Answer

A training log that reconciles against your HR records: each staff member, their hire date, their training completion date within 90 days of it, and the two-year refreshes since. Each completion needs a written or electronic attestation. A curriculum with no attendance record proves nothing, and a training platform report that does not reconcile to your actual roster is the most common gap we find.

Texas HB300 and State Requirements

6 questions on texas & hb300

Next steps

Other FAQ sections

How ready is your practice? Find out in 2 minutes.

Ready for a free HIPAA consultation?