Texas practices sometimes assume HIPAA is the whole rulebook. Texas law layers on three things that matter in practice:
- It covers more organizations. HB 300 defines "covered entity" more broadly than HIPAA: essentially anyone who comes into possession of protected health information in Texas, including businesses that would not be HIPAA-covered on their own. Vendors and partners who touch your records are in scope.
- It requires privacy training. Texas requires employees who handle PHI to be trained on state and federal privacy law soon after hire, with refresher training on an ongoing basis, and the training must be documented. An untrained new hire is a compliance gap in Texas in a way plain HIPAA does not spell out.
- Breach deadlines are concrete. Under Texas breach notification law, affected individuals must be notified within 60 days, and when a breach affects 250 or more Texas residents, the Texas Attorney General must be notified within 30 days. The AG publishes reported breaches publicly, which is worth knowing before an incident, not after.
For IT, the practical consequence is evidence: training records, access logs, risk assessments, and vendor agreements that cover the Texas definitions, not just the federal ones.