Texas HB300 Explained for Medical Practices
Texas HB300 imposes stricter privacy requirements than federal HIPAA — and Texas AG enforcement is more aggressive than OCR. Here's what your practice actually has to do.
March 2, 20266 min read
Who HB300 applies to
HB300 covers any person or entity that assembles, collects, analyzes, uses, evaluates, stores, or transmits protected health information in Texas — a broader definition than federal HIPAA's Covered Entity / Business Associate framework.
Three key differences from federal HIPAA
Most practices already comply with federal HIPAA; HB300 adds a few obligations on top.
- →Training within 90 days of hire, refreshed every 2 years (federal HIPAA sets no timeline)
- →Electronic access requests fulfilled within 15 business days (federal: 30 days)
- →Sale of PHI requires written patient authorization (broader than HIPAA's marketing rule)
Enforcement teeth
The Texas Attorney General can pursue civil penalties up to $1.5M per year per violation category — and unlike OCR, has demonstrated willingness to enforce against small clinics.
More resources
The 2026 HIPAA Compliance Checklist for Medical Practices
The 2026 HIPAA Security Rule NPRM is the biggest change to HIPAA in a decade. Here's what medical practices in Northeast Houston must do to stay compliant.
How to Prepare for an OCR HIPAA Audit
OCR sends an initial data request with 10 business days to respond. Here's exactly what they ask for — and how to have it ready before you ever get the letter.