HIPAA compliance for chiropractic practices in Texas

Texas keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Texas has 6 recorded rules that apply to chiropractic practices differently from other businesses in the state — set out below with their conditions and sources.

Texas jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Texas's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Chiropractic practices that electronically bill health plans, check eligibility, request authorization, or have a billing service do so are HIPAA covered entities. Medicare participation and electronic claims make coverage straightforward for many practices. Once covered, the duties below are required.

State — how Texas law interacts with HIPAA

Texas substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Chiropractic practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Chapter 521 applies alongside HIPAA. Compliance with one does not necessarily satisfy the other's timing, threshold, or regulator-notification requirements. Texas also maintains the Texas Medical Records Privacy Act (Tex. Health & Safety Code Ch. 181), which imposes additional state-law obligations on covered entities.

What Texas adds for chiropractic practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Texas's general breach law, which applies the same way to every business in the state.

How long records must be kept

Duty to keep an accurate record

A licensee shall ensure a patient record SUPPORTS ALL DIAGNOSES, TREATMENTS, SERVICES AND BILLING, and shall ensure a patient record is timely created, accurately dated, LEGIBLE, SIGNED OR INITIALLED BY THE INDIVIDUAL WHO ACTUALLY PERFORMED the treatment or service, and CONTAINS A KEY TO ABBREVIATIONS. At a minimum a licensee shall include the following in all patient records created during an INITIAL VISIT: patient history; description of symptoms or purpose of the visit; findings of examinations, including imaging and laboratory records; assessment; diagnosis; prognosis; treatment plan, recommendations and orders; and treatment or service provided and the patient's response. Other than consultations, reports of findings or non-therapeutic contacts, a licensee shall include in all records of a SUBSEQUENT VISIT: an updated history since last visit, if any; the purpose of visit and changes in symptoms since last visit; an examination of the area involved in the diagnosis; an assessment of any change in the patient's condition; the treatment or service provided and the patient's response; and change in treatment plan or planned referrals if indicated. A patient record means any record regularly used, created or stored by a licensee or other person pertaining to a patient's history, diagnosis, treatment, prognosis or BILLING, including records of OTHER HEALTH CARE PROVIDERS, currently or having been in the possession or custody of the licensee or other person.

Provider class: chiropractic licensees

What this means operationally

Three requirements here are unusual enough to be worth checking against an actual chart. The record must be signed or initialled by whoever ACTUALLY PERFORMED the service, which does not permit a supervising licensee to sign for work done by another. It must contain a KEY TO ABBREVIATIONS, a documentation artefact most practices do not maintain at all. And the definition of patient record expressly reaches BILLING records and records received from OTHER PROVIDERS, so the duty is not confined to clinical notes the practice authored. The initial-visit and subsequent-visit lists are different and the subsequent-visit list carries its own carve-out for consultations, reports of findings and non-therapeutic contacts.

Applies when

A chiropractic licensee creates or holds a patient record

Exceptions

The subsequent-visit content list does not apply to consultations, reports of findings, or non-therapeutic contacts with a patient

State regulation22 Tex. Admin. Code § 76.1Chiropractic patients and their legally authorized representativesVerified 2026-08-30

Patient access to records

Prerequisite before the authority may be used

A patient may request patient records be disclosed to another person, and SHALL MAKE THE REQUEST IN WRITING. The written request shall include the SPECIFIC INFORMATION OR RECORDS to be disclosed and the PERSON TO WHOM the records are to be disclosed, and shall be SIGNED by the patient or other person legally authorized to act on the patient's behalf. A patient MAY WITHDRAW CONSENT to disclosure in writing at any time; withdrawal does not affect any information disclosed before the withdrawal. A licensee or other person MAY honor an ORAL request for disclosure if the licensee or other person documents the patient's identity by valid government identification or legal documents identifying a person as the patient's legal representative, together with the information required for a written request.

Provider class: chiropractic licensees

What this means operationally

The written request is the default and the oral route is permissive, not equivalent — a practice that takes records requests by phone has to create a documentation record proving identity by government ID or legal representative documents, and capture the same specificity a written request requires. Two other points bite in practice: consent is withdrawable at any time in writing, so a standing authorization is not durable, and withdrawal operates prospectively only, which protects a disclosure already made.

Applies when

A patient asks that chiropractic records be disclosed to another person

Exceptions

An oral request may be honoured where identity and the required content are documented

State regulation22 Tex. Admin. Code § 76.2(a)-(g)Chiropractic patients and their legally authorized representativesVerified 2026-08-30

Deadline to respond to an access request

A licensee or other person shall disclose patient records, AFTER RECEIVING ANY APPLICABLE FEES for the records, WITHIN 15 BUSINESS DAYS from the date of the request, unless the request is denied under the harm provision.

Provider class: chiropractic licensees

What this means operationally

Fifteen BUSINESS days, and the clock is expressly conditioned on the fee having been received — which is a materially different structure from the physician rule, where the copying cost may gate release but the deadline is not written as running from payment. Read with the fee rule, the practice owes fee notice within five business days of the request, so a practice that delays quoting the fee compresses nothing: its own disclosure clock has not started, but the patient's wait grows. This section does not supersede Texas Health and Safety Code chapter 181 or any other applicable state or federal law.

Applies when

A compliant request for chiropractic records has been made and any applicable fee received

Exceptions

Unless the request is denied on the harm ground under § 76.2(j)
Does not supersede Tex. Health & Safety Code ch. 181 or any other applicable state or federal law

State regulation22 Tex. Admin. Code § 76.2(h), (q)Chiropractic patients and their legally authorized representativesVerified 2026-08-30

Parental right of access

A licensee or other person MAY NOT DENY a patient's request for records for a PAST DUE ACCOUNT for care or treatment previously rendered to the patient, or for the LACK OF A LETTER OF PROTECTION or any other similar document. A SUBPOENA MAY NOT BE REQUIRED for the release of patient records under this section.

Provider class: chiropractic licensees

What this means operationally

The letter-of-protection limb is specific to this profession and has no physician equivalent in the Texas corpus. Letters of protection are common where chiropractic care is delivered against a pending personal-injury claim, and the rule forecloses conditioning release on one — a practice cannot hold a file until an attorney guarantees payment. The past-due-account and no-subpoena limbs mirror the physician rule, so on these two points a Texas chiropractic and a Texas medical practice answer the same way.

Applies when

A request for chiropractic records has been made under § 76.2

State regulation22 Tex. Admin. Code § 76.2(i), (o)Chiropractic patients and their legally authorized representativesVerified 2026-08-30

Prerequisite before the authority may be used

A licensee or other person MAY NOT DISCLOSE information in a patient record if a licensee determines that disclosure would HARM the physical, mental or emotional health of the patient. If a licensee determines that disclosure would be harmful, the licensee shall DOCUMENT IN WRITING THE REASONS WHY; NOTIFY THE PATIENT WITHIN 15 DAYS of the date of the patient's request; and REQUEST IN WRITING A SECOND OPINION FROM ANOTHER LICENSEE within 15 days of the patient's request. A licensee who receives a request for a second opinion shall provide a WRITTEN OPINION to the requesting licensee WITHIN 15 DAYS of the request. A licensee shall disclose all information in a patient's record ONLY IF the licensee receives a written second opinion from another licensee stating that disclosure would not be harmful. A licensee shall disclose only REDACTED NON-HARMFUL information if the second opinion states there is potential harm to the patient if disclosed.

Provider class: chiropractic licensees

What this means operationally

Texas chiropractic does not leave a harm-based refusal to the treating licensee. A second licensee's written opinion is a MANDATORY step, and the outcome is determined by it: a clean second opinion compels full disclosure, and an adverse one permits only redacted non-harmful information. That makes an outright permanent refusal unavailable on this ground — every route ends in some disclosure. Note the units differ from the disclosure deadline: notification, the second-opinion request and the second opinion itself all run in PLAIN days while the disclosure duty runs in BUSINESS days, so a practice tracking one clock for the whole section will miss.

Applies when

A licensee determines that disclosing a patient record would harm the patient’s physical, mental or emotional health

State regulation22 Tex. Admin. Code § 76.2(j)-(n)Chiropractic patients and their legally authorized representativesVerified 2026-08-30

Copy fees, format and delivery

Limit on copy fees, format or delivery

A licensee or other person MAY CHARGE a reasonable administrative fee not to exceed $50 for providing routine patient records in a DIGITAL-ONLY format; not to exceed $25 for the FIRST PAGE of paper-only copies of routine patient records, plus $0.25 per additional page; and not to exceed $50 for the first page of non-digital copies of routine FILMS or other static diagnostic imaging studies, plus $1.00 per additional page. An ADDITIONAL reasonable fee may be charged for digital records if the records are VOLUMINOUS AND NOT ROUTINE and the licensee provides a WRITTEN EXPLANATION of the need for the fee. A separate fee may be charged for the actual costs of mailing, shipping, notarising documents or delivery. A licensee SHALL NOTIFY the requestor of any fee WITHIN FIVE BUSINESS DAYS of receipt of the request, and if the fee is not received within TEN BUSINESS DAYS after notification the licensee shall notify the requestor of the need for payment. A licensee MAY DEMAND ADVANCE PAYMENT except from another health care provider where the request was made because of an emergency or acute medical situation. A fee not exceeding $25 may be charged for completing a CUSTODIAN OF RECORDS AFFIDAVIT, and a reasonable fee may be charged in advance to answer a DEPOSITION BY WRITTEN QUESTION.

Provider class: chiropractic licensees
Record class: digital, paper and diagnostic imaging records

What this means operationally

The digital tier is flat — $50 covers a routine digital record regardless of size — which inverts the usual per-page economics and makes electronic delivery the cheaper route for the practice as well as the patient. Two duties run on the practice rather than the requestor and are easy to miss: fee notice within FIVE business days of the request, and a second notice if payment has not arrived within ten business days of the first. Since the disclosure clock does not start until the fee is received, those notices are what keeps the process moving. The advance-payment right has one carve-out worth building into triage: it cannot be exercised against another health care provider requesting because of an emergency or acute medical situation.

Applies when

A chiropractic licensee responds to a request for patient records

Exceptions

Advance payment may not be demanded from another health care provider where the request was made because of an emergency or acute medical situation
No charge is permitted where charging is prohibited by Tex. Health & Safety Code ch. 181

State regulation22 Tex. Admin. Code § 76.3Chiropractic patients and their legally authorized representativesVerified 2026-08-30

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Texas breach obligations

These apply to businesses generally rather than to chiropractic practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Texasbreach data →

Individual notice deadline

As quickly as possible and, unless certain law-enforcement or scope-determination exceptions apply, no later than 60 days after determining that the breach occurred.

The outer bound of 60 days aligns with HIPAA's 60-day individual-notice window in duration, but federal and state duties apply independently and may impose different content, recipient, or trigger requirements.

State regulator notice

Required at 250+ residents

The Attorney General must be notified when a breach involves at least 250 Texas residents. Notification is made through the online form maintained by the AG's office.

Source: Tex. Bus. & Com. Code § 521.053(b)

Statewide rules that also reach chiropractic practices

Minor may consent

Where the person with the right to consent cannot be contacted and has given no actual notice to the contrary, a grandparent, adult sibling, adult aunt or uncle, an educational institution the child attends holding written authorization, an adult with actual care, control and possession of the child holding written authorization, a court with jurisdiction over a suit affecting the parent-child relationship, an adult responsible for a child under juvenile court jurisdiction, or a peace officer who has lawfully taken custody and reasonably believes the minor needs immediate treatment, may consent to medical, dental, psychological and surgical treatment. That consent must be in writing, signed, and given to the practitioner or facility administering treatment, and must state the child's name, the parents' names if known along with any managing conservator or guardian, the consenting person's name and relationship to the child, the nature of the treatment, and the date treatment is to begin.

What this means operationally

Texas answers the personal-representative question with a ranked list and a document, which is unusually concrete. Two conditions do the work and both are easy to lose at the desk: the person with the right to consent must be uncontactable, and they must not have said no. So the record has to show the attempt to reach the parent, not merely the relative's signature. The five required contents of the form are a checklist a practice can actually hold itself to.

Applies when

The person with the right to consent cannot be contacted
That person has not given actual notice to the contrary
The consenting person falls within the enumerated list

Exceptions

The section does not apply to consent for the immunization of a child, which runs under § 32.101 instead
Consent for a child committed to the Texas Juvenile Justice Department, or for whom the Department of Family and Protective Services is managing conservator, is governed separately

StatewideTex. Fam. Code §§ 32.001, 32.002Children whose parent or guardian cannot be reachedVerified 2026-08-29

What applies to chiropractic practices everywhere

Chiropractic practices combine medical records, high patient volume, imaging, insurance claims, open treatment environments, workers' compensation, and personal-injury documentation. Each creates a different pathway through which PHI can be exposed.

The EHR or practice-management system and all workforce access roles

Digital X-ray and other imaging equipment, storage, transmission, specialist review, and backup

Claims, clearinghouse, Medicare, workers' compensation, and personal-injury workflows

Open treatment areas, front-desk conversations, sign-in processes, paper records, and workstation visibility

Patient portals, intake forms, email, texting, e-fax, scheduling, and home-care communication

Wellness, supplement, exercise, or ancillary-service systems when they connect activity to identifiable patients

Full chiropractorscompliance guide →

Knowing the Texas rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Texas rules on this page.

Start the risk assessment