HIPAA compliance for dental practices in Texas

Texas keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Texas has 9 recorded rules that apply to dental practices differently from other businesses in the state — set out below with their conditions and sources.

Texas jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Texas's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Dental practices that electronically submit claims, check eligibility, request authorization, or have a billing service conduct those standard transactions on their behalf are HIPAA covered entities. Most modern dental practices meet that definition. Once covered, the duties below are required.

State — how Texas law interacts with HIPAA

Texas substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Dental practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Chapter 521 applies alongside HIPAA. Compliance with one does not necessarily satisfy the other's timing, threshold, or regulator-notification requirements. Texas also maintains the Texas Medical Records Privacy Act (Tex. Health & Safety Code Ch. 181), which imposes additional state-law obligations on covered entities.

What Texas adds for dental practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Texas's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Minor may consent

A child may consent to medical, dental, psychological and surgical treatment by a licensed physician or dentist in enumerated circumstances: on active duty with the armed services; at least 16, living separate from parents or guardian and managing their own financial affairs regardless of income source; consenting to diagnosis and treatment of an infectious, contagious or communicable disease; unmarried and pregnant, consenting to treatment related to the pregnancy other than abortion; consenting to examination and treatment for drug or chemical addiction or dependency or a condition directly related to drug or chemical use; unmarried, a parent with actual custody, consenting for their own child; or serving a term of confinement in a Texas Department of Criminal Justice facility.

Provider class: a licensed physician or dentist
Service: medical, dental, psychological and surgical treatment
Patient population: minors

What this means operationally

Two gates, not one. The minor's circumstances have to fall inside the enumerated list, and the treatment has to be delivered by a licensed physician or dentist — a practice whose clinicians hold neither credential cannot rely on this section at all. Intake therefore has to capture the minor's status, and the practice has to know which of its own clinicians the section reaches.

Applies when

The treatment is by a licensed physician or dentist
One or more of the enumerated circumstances in § 32.003(a) applies

Exceptions

Pregnancy-related consent does not extend to abortion
Consent under the section is not subject to disaffirmance because of minority (§ 32.003(b))
A provider remains liable for the provider's own acts of negligence (§ 32.003(e))

State statuteTex. Fam. Code § 32.003(a)–(c)All minors under 18Verified 2026-08-29

Left to professional judgment

A physician, dentist or psychologist with reasonable grounds to believe a child's physical or mental condition has been adversely affected by abuse or neglect may examine the child without the consent of the child, the child's parents, or any other person authorized to consent. The examination may include X-rays, blood tests, photographs, and penetration of tissue necessary to accomplish those tests. The practitioner may not examine a child 16 or older who refuses to consent, or a child for whom a court order prohibits consent, unless consent is obtained as otherwise allowed by law.

Provider class: a physician, dentist or psychologist
Service: examination where abuse or neglect is suspected

What this means operationally

The one place in Texas where a dentist has the same statutory authority as a physician, and the age rule runs backwards from every other provision in the chapter: turning 16 gives the child a veto here rather than a capacity. A practice that treats 16 as the age things get easier will get this exactly wrong.

Applies when

The practitioner is a physician, dentist or psychologist
There are reasonable grounds to believe abuse or neglect has adversely affected the child

Exceptions

A child 16 or older who refuses to consent may not be examined
A child for whom consent is prohibited by court order may not be examined

State statuteTex. Fam. Code § 32.005Children suspected of having been abused or neglectedVerified 2026-08-29

Limit on liability

A physician, dentist, psychologist, hospital or medical facility may rely on the written statement of the child containing the grounds on which the child has capacity to consent to the child's medical treatment, and is not liable for the examination and treatment of a child under § 32.003 except for its own acts of negligence.

Provider class: a physician, dentist, psychologist, hospital or medical facility

What this means operationally

The safety valve that makes § 32.003 usable, and it is built around a document. The statute says a practice may rely on the child's WRITTEN statement of the grounds for capacity — so a determination taken verbally leaves the practice without the protection the legislature offered. Note the provider list here is not the same as the one in § 32.004: counsellors and social workers appear there and not here.

Applies when

The child furnished a written statement of the grounds for capacity under § 32.003

Exceptions

Reliance does not extend to the provider's own acts of negligence

State statuteTex. Fam. Code § 32.003(f), (e)Minors consenting under § 32.003Verified 2026-08-29

Provider disclosure to a parent

Provider may disclose

A licensed physician, dentist or psychologist may, with or without the consent of a child who is a patient, advise the child's parents, managing conservator or guardian of the treatment given to or needed by the child.

Provider class: a licensed physician, dentist or psychologist
Service: treatment consented to by the child under § 32.003
Patient population: minors who consented to their own care

What this means operationally

This is a permission held by the clinician, not a right held by the parent and not an obligation on the practice. Nothing here entitles a parent to the record, and a release workflow that treats it as an access right is answering a different question from the one the statute settles.

Applies when

The child was treated under § 32.003

State statuteTex. Fam. Code § 32.003(d)Minors treated under § 32.003Verified 2026-08-29

How long records must be kept

How long the record must be kept

A Texas dental licensee practicing dentistry in Texas shall make, maintain and keep adequate dental records for and upon each dental patient. Records shall be kept for a period of NOT LESS THAN FIVE YEARS from the last date of treatment by the dentist. If a patient was younger than 18 years of age when last treated, the records shall be maintained until the patient reaches age 21 or for five years from the date of last treatment, WHICHEVER IS LONGER. Dentists shall retain records for a longer period when mandated by other federal or state statute or regulation.

Provider class: Texas dental licensees
Record class: dental records

What this means operationally

Five years from last treatment, so the clock restarts on each visit and an active patient's file does not age out. The minor rule needs both limbs applied rather than just the age: for a seventeen-year-old the five-year floor runs past 21 and governs, while for a young child the age-21 endpoint is the longer one. The definition of dental records in the same section is unusually broad — it expressly includes study models, casts and impressions, dental laboratory prescriptions, appointment records and billing and payment records — so the retention duty reaches material a practice may not think of as clinical.

Applies when

A Texas dental licensee holds dental records for a patient

Exceptions

A longer period mandated by other federal or state statute or regulation prevails
Records of orthodontic device sales or services carry a separate seven-year rule under § 108.8(d)

State regulation22 Tex. Admin. Code § 108.8(b)Dental patients, adult and minorVerified 2026-08-29

How long the record must be kept

Before selling an orthodontic device to a patient or providing a service related to the design or manufacture of an orthodontic device, a dentist must follow the documentation requirements in Health and Safety Code § 431.024, including: maintaining a WRITTEN ACKNOWLEDGMENT OF COUNSEL signed by the patient regarding available orthodontic treatment options and the risks associated with those treatments; and maintaining records for NOT LESS THAN SEVEN YEARS after the date of sale or provision of orthodontic services. If a patient was younger than 18 when last treated, the records shall be maintained until the patient reaches age 21 or for seven years from the date of last treatment, whichever is longer.

Provider class: Texas dental licensees selling orthodontic devices or providing design or manufacture services
Record class: records of the sale or provision of orthodontic services
Service: sale of an orthodontic device, or a service related to its design or manufacture

What this means operationally

New in 2026 and easy to miss because it sits inside the general records rule. Two things separate it from ordinary dental retention: the period is seven years rather than five, and the clock runs from the SALE or provision of the orthodontic service rather than from the last treatment date — so for a device sold early in a long course of care the two clocks start at different times on the same patient. It also creates a document that must exist before the sale: a signed acknowledgment that the patient was counselled on options and risks. Implements House Bill 4070 of the 89th Legislature.

Applies when

A dentist sells an orthodontic device to a patient, or provides a service related to its design or manufacture

State regulation22 Tex. Admin. Code § 108.8(d)Orthodontic patients, adult and minorVerified 2026-08-29

Patient access to records

Deadline to respond to an access request

A dentist shall furnish copies of dental records to a patient who requests them. AT THE PATIENT'S OPTION the copies may be submitted to the patient directly or to another Texas dental licensee who will provide treatment to the patient. Requested copies, including radiographs, shall be furnished WITHIN 30 DAYS of the date of the request. Records SHALL NOT BE WITHHELD BASED ON A PAST DUE ACCOUNT for dental care or treatment previously rendered to the patient.

Provider class: Texas dental licensees
Record class: dental records including radiographs

What this means operationally

Thirty days, and two provisions cut against common practice. The destination is the PATIENT'S choice, including direct transmission to a treating dentist, so a practice cannot insist on handing records only to the patient. And records may not be withheld over an unpaid treatment account — while the copying cost itself may be required first, which is a fine distinction a front desk has to hold: the copying fee may gate release, the outstanding balance may not.

Applies when

A patient requests copies of dental records

Exceptions

Copies may be withheld until copying costs have been paid

State regulation22 Tex. Admin. Code § 108.8(h)Dental patientsVerified 2026-08-29

Copy fees, format and delivery

Limit on copy fees, format or delivery

A dentist providing copies of patient dental records is entitled to a reasonable copying fee of NO MORE THAN $25 for the first 20 pages and $0.15 per page thereafter. Radiographs copied by a duplicating service may be charged at actual cost verified by invoice. Radiographs duplicated by other means may not exceed: a full mouth series $15.00; a panoramic radiograph $15.00; a lateral cephalometric radiograph $15.00; a single extra-oral radiograph $5.00; a single intra-oral radiograph $5.00; and a CBCT scan $30.00. Copies may be withheld until copying costs have been paid. Copies must be LEGIBLE and all copies of dental x-rays must be of DIAGNOSTIC QUALITY; non-diagnostic quality x-ray copies do not fulfill the requirement.

Provider class: Texas dental licensees
Record class: dental records including radiographs

What this means operationally

One of the few itemised imaging fee schedules in the corpus, and the diagnostic-quality standard is the operationally binding half: a compressed or downscaled x-ray copy does not discharge the duty however promptly it was sent, so image export settings are a compliance setting. The per-page schedule is capped at $25 for the first twenty pages, which for a typical dental file means the fee is effectively fixed rather than proportional.

Applies when

A patient requests copies of dental records

Exceptions

Copies may be withheld until copying costs are paid
State agencies and institutions follow their own applicable agency rules and directives

State regulation22 Tex. Admin. Code § 108.8(h)(1)-(4)Dental patientsVerified 2026-08-29

Closure, transfer and custody of records

Custody on closure or transfer

A dentist who leaves a location or practice — whether by retirement, sale, transfer, termination of employment or otherwise — shall MAINTAIN all dental records belonging to them, MAKE A WRITTEN TRANSFER of records to the succeeding dentist, or MAKE A WRITTEN AGREEMENT for the maintenance of records. A dentist entering a records transfer agreement shall notify the State Board of Dental Examiners in writing WITHIN FIFTEEN DAYS, identifying the dentists, the locations and specifically what records are involved; that agreement transfers OWNERSHIP. A dentist entering a records maintenance agreement shall likewise notify the Board within fifteen days with the same particulars; a maintenance agreement does NOT transfer ownership, must require the records to be maintained under Texas law and Board rules, must give the dentist who performed the services access to and control of the records for copying and recording, and the transferring dentist must keep a copy of the records involved.

Provider class: Texas dental licensees
Setting: a dentist leaving a location or practice by retirement, sale, transfer, termination of employment or otherwise

What this means operationally

Three routes, and the choice between the two agreement types has consequences a practice sale often gets wrong. A TRANSFER agreement moves ownership; a MAINTENANCE agreement does not, and obliges the departing dentist to retain a copy and preserve the treating dentist's access and control. Either way the Board must be told within fifteen days, with the records specifically identified — a general statement that records were handed over does not satisfy it. Note the trigger is broader than closure: termination of employment is enough, so an associate leaving a group is inside this rule.

Applies when

A dentist leaves a location or practice by retirement, sale, transfer, termination of employment or otherwise

State regulation22 Tex. Admin. Code § 108.8(f)Patients of a departing dentistVerified 2026-08-29

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Texas breach obligations

These apply to businesses generally rather than to dental practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Texasbreach data →

Individual notice deadline

As quickly as possible and, unless certain law-enforcement or scope-determination exceptions apply, no later than 60 days after determining that the breach occurred.

The outer bound of 60 days aligns with HIPAA's 60-day individual-notice window in duration, but federal and state duties apply independently and may impose different content, recipient, or trigger requirements.

State regulator notice

Required at 250+ residents

The Attorney General must be notified when a breach involves at least 250 Texas residents. Notification is made through the online form maintained by the AG's office.

Source: Tex. Bus. & Com. Code § 521.053(b)

Statewide rules that also reach dental practices

Minor may consent

Where the person with the right to consent cannot be contacted and has given no actual notice to the contrary, a grandparent, adult sibling, adult aunt or uncle, an educational institution the child attends holding written authorization, an adult with actual care, control and possession of the child holding written authorization, a court with jurisdiction over a suit affecting the parent-child relationship, an adult responsible for a child under juvenile court jurisdiction, or a peace officer who has lawfully taken custody and reasonably believes the minor needs immediate treatment, may consent to medical, dental, psychological and surgical treatment. That consent must be in writing, signed, and given to the practitioner or facility administering treatment, and must state the child's name, the parents' names if known along with any managing conservator or guardian, the consenting person's name and relationship to the child, the nature of the treatment, and the date treatment is to begin.

What this means operationally

Texas answers the personal-representative question with a ranked list and a document, which is unusually concrete. Two conditions do the work and both are easy to lose at the desk: the person with the right to consent must be uncontactable, and they must not have said no. So the record has to show the attempt to reach the parent, not merely the relative's signature. The five required contents of the form are a checklist a practice can actually hold itself to.

Applies when

The person with the right to consent cannot be contacted
That person has not given actual notice to the contrary
The consenting person falls within the enumerated list

Exceptions

The section does not apply to consent for the immunization of a child, which runs under § 32.101 instead
Consent for a child committed to the Texas Juvenile Justice Department, or for whom the Department of Family and Protective Services is managing conservator, is governed separately

StatewideTex. Fam. Code §§ 32.001, 32.002Children whose parent or guardian cannot be reachedVerified 2026-08-29

What applies to dental practices everywhere

Dental ePHI does not live in one system. It moves through the practice management system, digital imaging equipment, operatories, front-desk workstations, insurance transactions, laboratories, referral workflows, mobile devices, cloud backups, patient communication, and third-party support systems.

The practice management system and every user with administrative, clinical, scheduling, or billing access

Panoramic, CBCT, intraoral, and other imaging systems — including how images move between devices, workstations, laboratories, specialists, and storage

Electronic claims, eligibility verification, payment, and clearinghouse workflows

Patient portals, digital forms, e-fax, email, text messaging, appointment reminders, and referral tools

Office servers, workstations, laptops, tablets, phones, removable media, network equipment, and cloud backups

Every vendor that stores, maintains, transmits, or can remotely access the practice's ePHI

Full dentistscompliance guide →

Knowing the Texas rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Texas rules on this page.

Start the risk assessment