HIPAA compliance for dermatology practices in Texas

Texas keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Texas has 17 recorded rules that apply to dermatology practices differently from other businesses in the state — set out below with their conditions and sources.

Texas jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Texas's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Dermatology practices that electronically bill, check eligibility, request authorization, or conduct other adopted transactions are HIPAA covered entities. Once covered, the duties below apply to records, photographs, pathology, teledermatology, devices, people, and vendors — not just the EHR.

State — how Texas law interacts with HIPAA

Texas substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Dermatology practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Chapter 521 applies alongside HIPAA. Compliance with one does not necessarily satisfy the other's timing, threshold, or regulator-notification requirements. Texas also maintains the Texas Medical Records Privacy Act (Tex. Health & Safety Code Ch. 181), which imposes additional state-law obligations on covered entities.

What Texas adds for dermatology practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Texas's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Minor may consent

A child may consent to medical, dental, psychological and surgical treatment by a licensed physician or dentist in enumerated circumstances: on active duty with the armed services; at least 16, living separate from parents or guardian and managing their own financial affairs regardless of income source; consenting to diagnosis and treatment of an infectious, contagious or communicable disease; unmarried and pregnant, consenting to treatment related to the pregnancy other than abortion; consenting to examination and treatment for drug or chemical addiction or dependency or a condition directly related to drug or chemical use; unmarried, a parent with actual custody, consenting for their own child; or serving a term of confinement in a Texas Department of Criminal Justice facility.

Provider class: a licensed physician or dentist
Service: medical, dental, psychological and surgical treatment
Patient population: minors

What this means operationally

Two gates, not one. The minor's circumstances have to fall inside the enumerated list, and the treatment has to be delivered by a licensed physician or dentist — a practice whose clinicians hold neither credential cannot rely on this section at all. Intake therefore has to capture the minor's status, and the practice has to know which of its own clinicians the section reaches.

Applies when

The treatment is by a licensed physician or dentist
One or more of the enumerated circumstances in § 32.003(a) applies

Exceptions

Pregnancy-related consent does not extend to abortion
Consent under the section is not subject to disaffirmance because of minority (§ 32.003(b))
A provider remains liable for the provider's own acts of negligence (§ 32.003(e))

State statuteTex. Fam. Code § 32.003(a)–(c)All minors under 18Verified 2026-08-29

Provider disclosure to a parent

Provider may disclose

A licensed physician, dentist or psychologist may, with or without the consent of a child who is a patient, advise the child's parents, managing conservator or guardian of the treatment given to or needed by the child.

Provider class: a licensed physician, dentist or psychologist
Service: treatment consented to by the child under § 32.003
Patient population: minors who consented to their own care

What this means operationally

This is a permission held by the clinician, not a right held by the parent and not an obligation on the practice. Nothing here entitles a parent to the record, and a release workflow that treats it as an access right is answering a different question from the one the statute settles.

Applies when

The child was treated under § 32.003

State statuteTex. Fam. Code § 32.003(d)Minors treated under § 32.003Verified 2026-08-29

How long records must be kept

Duty to keep an accurate record

The medical record must be a COMPLETE, CONTEMPORANEOUS and LEGIBLE documented account of each patient encounter by a physician or delegate. To the extent applicable, a medical record must include at a minimum: a reason for the encounter, relevant history, physical examination findings (ensuring any PRE-POPULATED FIELDS contain current and accurate patient information) and any diagnostic test results; an assessment, clinical impression and diagnosis; a plan for care, treatments and medications including amount, frequency, number of refills and dosage; LATE ENTRIES, if any, indicating the time and date entered and the identity of the person who made the late entry; a summary or documentation of communications with the patient; sufficient documentation of requests for records from other providers and any records received; and documentation of a review of the patient's Texas Prescription Monitoring Program (PMP) prescribing history.

Provider class: physicians and their delegates

What this means operationally

Two requirements here are software configuration decisions rather than clinical habits. Pre-populated fields must contain current and accurate information, which makes EHR templates and carried-forward histories a stated compliance risk rather than a convenience. And late entries must carry their own time, date and author, so an EHR that silently backdates or attributes an entry to the session owner does not satisfy the rule. The PMP element was added at the Texas Medical Association's request as a non-substantive change and is qualified by the section's opening 'to the extent applicable'.

Applies when

A physician or delegate documents a patient encounter

Exceptions

Each listed element is required only TO THE EXTENT APPLICABLE to the encounter

State regulation22 Tex. Admin. Code § 163.1(a), (b)(1)-(6), (b)(8)Patients of a Texas physicianVerified 2026-08-30

How long the record must be kept

Medical records must be retained by a physician or a physician's employer, including group practices, professional associations and non-profit health organizations. The STANDARD RETENTION PERIOD is AT LEAST SEVEN YEARS from the DATE OF LAST TREATMENT by the physician, or longer if required by other federal or state law. The retention period for a patient UNDER 18 years old is until the patient reaches age 21 or seven years from the date of last treatment, WHICHEVER IS LONGER.

Provider class: physicians, and physician employers including group practices, professional associations and non-profit health organizations

What this means operationally

Seven years from last treatment, so the clock restarts with each episode of care and an active patient's file never ages out. The minor rule needs both limbs applied rather than just the age: for a seventeen-year-old the seven-year period runs past 21 and governs, while for a young child the age-21 endpoint is the longer one. Note who the duty binds — the rule names the physician's EMPLOYER alongside the physician, including group practices and non-profit health organizations, so a practice entity cannot treat retention as the individual clinician's problem.

Applies when

A physician or physician employer holds a medical record

Exceptions

A longer period required by other federal or state law prevails
Forensic medical examinations for sexual assault carry a twenty-year rule under § 163.2(d) and Occ. Code § 153.003(b)

State regulation22 Tex. Admin. Code § 163.2(a), (c)Patients of a Texas physicianVerified 2026-08-30

Duty to keep an accurate record

Providers must MAINTAIN ACCESS to medical records for the DURATION of the required retention period.

Provider class: physicians and physician employers

What this means operationally

A short sentence that decides several expensive questions. Retention is not satisfied by possession alone — the records have to remain reachable for the full seven years, which makes an EHR migration, a vendor contract lapse, a discontinued product or an unreadable legacy format a compliance failure rather than an IT inconvenience. Practices switching systems should read this as a requirement that the outgoing data stay retrievable, not merely archived, and should treat the end of a software contract as a records event.

Applies when

A record is within its required retention period

State regulation22 Tex. Admin. Code § 163.2(b)Patients of a Texas physicianVerified 2026-08-30

How long the record must be kept

Forensic medical examinations for sexual assault must be retained in accordance with § 153.003 of the Act. The rules adopted under that section must PROHIBIT A PHYSICIAN FROM DESTROYING a medical record from the forensic medical examination of a sexual assault victim conducted under subchapter G, chapter 56A, Code of Criminal Procedure, UNTIL THE 20TH ANNIVERSARY OF THE DATE THE RECORD WAS CREATED.

Record class: records of a forensic medical examination of a sexual assault victim
Provider class: physicians

What this means operationally

Twenty years, and the clock is different from every other Texas period: it runs from the DATE THE RECORD WAS CREATED, not from last treatment. A practice applying the ordinary seven-year rule to a forensic examination would destroy the record thirteen years early and would measure from the wrong event. The obligation is also expressed as a prohibition on destruction rather than as a duty to keep, which matters where a records-destruction schedule is automated: the exclusion has to be built into the deletion rule, not into a retention policy document.

Applies when

A physician holds the record of a forensic medical examination of a sexual assault victim conducted under subch. G, ch. 56A, Code of Criminal Procedure

State regulation22 Tex. Admin. Code § 163.2(d); Tex. Occ. Code § 153.003(b)Patients of a Texas physicianVerified 2026-08-30

Patient access to records

Deadline to respond to an access request

Upon receipt of a request for medical records that complies with § 159.005 of the Act, a physician must provide the information WITHIN 15 DAYS of the request AND IN ACCORDANCE WITH CHAPTER 159 of the Act.

Provider class: physicians

More than one provision may apply

Two current primary authorities state a response deadline for the same request and neither states which governs. Occ. Code § 159.006(d) says the information must be provided NOT LATER THAN THE 15TH BUSINESS DAY after receipt. 22 TAC § 163.3(a) says the physician must provide the information WITHIN 15 DAYS of the request AND IN ACCORDANCE WITH CHAPTER 159 OF THE ACT. Fifteen plain days is the shorter of the two in every case, because fifteen business days spans at least three calendar weeks and more across holidays. The rule contains no notwithstanding clause and does not adopt the statutory formula; the statute contains no delegation of the deadline to board rule. The Board's adoption preamble, its section-by-section summary and its published comment responses at 50 TexReg 334-335 do not address the divergence, and no commenter raised it. NO PRIMARY AUTHORITY WAS FOUND THAT RESOLVES THE RELATIONSHIP. Both propositions are therefore carried, and neither is presented as displacing the other. A practice asking what it must do has an answerable question even though the corpus does not: responding within fifteen calendar days satisfies both readings. That is an observation about the intersection of two stated deadlines, NOT a finding that the shorter one legally controls. The divergence bites in a narrow window: WHERE a physician responds after the fifteenth CALENDAR day but on or before the fifteenth BUSINESS day, one authority has been met and the other has not. Inside fifteen calendar days both are satisfied; past the fifteenth business day both are breached. Outside that window the two authorities agree, which is why this is a bounded open question rather than a permanent conflict.

What this means operationally

Read this alongside Occ. Code § 159.006(d), which sets fifteen BUSINESS days, and note that the corpus does not treat either as displacing the other — see the interaction note. The trigger is also worth holding precisely: the clock starts on a request that COMPLIES WITH § 159.005, so a request that is not a proper written consent does not start it, and a practice that treats every inbound message as day zero will over-report its own lateness.

Applies when

A request for medical records complying with Tex. Occ. Code § 159.005 is received

State regulation22 Tex. Admin. Code § 163.3(a)Patients of a Texas physician, and requestors acting for themVerified 2026-08-30

Parental right of access

A provider CANNOT DENY a request for medical records due to a DELINQUENT ACCOUNT or amounts owed to the provider. A provider CANNOT REQUIRE A SUBPOENA for the records if a proper request is made in accordance with § 159.005 of the Act.

Provider class: physicians

What this means operationally

Two barriers a practice is expressly forbidden to raise. The money limit is narrower than it looks: the rule bars withholding the RECORDS over a delinquent treatment account, and it does not disturb the separate copying fee, which the fee schedule permits the practice to charge and collect. The subpoena limit closes a common front-desk practice — once a compliant § 159.005 request arrives, demanding legal process instead is itself the violation, and this reaches requests from attorneys and insurers as much as from patients.

Applies when

A request complying with Tex. Occ. Code § 159.005 has been made

Exceptions

The permitted copying fee under § 163.3(c) is unaffected; this bars withholding over a treatment account, not over the cost of copying

State regulation22 Tex. Admin. Code § 163.3(d), (e)Patients of a Texas physician, and requestors acting for themVerified 2026-08-30

Copy fees, format and delivery

Limit on copy fees, format or delivery

Allowable charges for records: PAPER records - the maximum fee may be $25.00 for the first twenty pages and $0.50 per page thereafter. ELECTRONIC records - the maximum fee may be $25.00 for 500 pages or less and $50.00 for more than 500 pages. HYBRID records, part paper and part electronic - the fee for each different format may be utilized, including diagnostic studies. If an AFFIDAVIT is requested for the records, the maximum fee may be $15.00. If a NARRATIVE is provided in lieu of records, the maximum fee may be $20.00. Where a requestor asks that all records be in PAPER FORMAT even though they are available as electronic records, the paper record fee may be charged. If records are MAILED to the requestor, actual postage cost may be charged.

Provider class: physicians
Record class: paper, electronic, hybrid and diagnostic imaging records

What this means operationally

This is the schedule that Occ. Code § 159.008 delegates to the Board, so it is the operative figure a Texas physician practice charges. The electronic tier is the one that changes behavior: $25 covers up to 500 pages and $50 covers anything above, so electronic delivery of a large chart is dramatically cheaper for the requestor than the paper tier, where 500 pages would reach $265. Two limits protect the practice rather than the patient — a requestor who insists on paper when electronic exists can be charged the paper rate, and actual postage is recoverable. Note these are MAXIMA, not fixed prices.

Applies when

A physician responds to a request for medical records or diagnostic imaging

State regulation22 Tex. Admin. Code § 163.3(c)(1)-(7)Patients of a Texas physician, and requestors acting for themVerified 2026-08-30

Prerequisite before the authority may be used

Requests for DIAGNOSTIC IMAGING, including static films, non-static films and imaging studies, MUST SPECIFY whether a COPY or the ORIGINAL of the study is sought.

Record class: diagnostic imaging, including static films, non-static films and imaging studies

What this means operationally

A specification requirement that sits on the requestor rather than the practice, and it gives a practice a defensible reason to seek clarification before releasing imaging. It matters most where the original is the only diagnostic-quality artefact: releasing an original when a copy was intended can strip the practice of the record it is separately required to retain for seven years. Build it into the records-request form rather than handling it case by case.

Applies when

A request seeks diagnostic imaging rather than, or in addition to, chart records

State regulation22 Tex. Admin. Code § 163.3(b)Patients of a Texas physician, and requestors acting for themVerified 2026-08-30

Amendment or correction of a record

Duty to keep an accurate record

A medical record must include clear identification of ANY AMENDMENT OR CORRECTION to the medical record, including the date it was amended or corrected and the identity of the author of the amendment or correction, WITH THE ORIGINAL TEXT REMAINING LEGIBLE.

Provider class: physicians and their delegates
Record class: amended or corrected medical records

What this means operationally

The operative words are 'remaining legible'. Texas does not permit a correction to replace what it corrects: the original text has to survive the amendment in readable form, which rules out overwriting a note, deleting and re-entering it, or any EHR correction workflow that renders the prior version unavailable. Three things must be recoverable afterwards — the original words, the date of the change and who made it. A practice evaluating an EHR should treat non-destructive amendment as a procurement requirement, because the rule cannot be satisfied by policy if the software cannot do it.

Applies when

An entry in a medical record is amended or corrected

State regulation22 Tex. Admin. Code § 163.1(b)(7)Patients of a Texas physicianVerified 2026-08-30

Destruction and disposition

Destruction or disposition requirement

A records custodian must RETAIN the medical records in accordance with state and federal law for AT LEAST 90 DAYS BEFORE DESTROYING any records, INCLUDING THE 30-DAY NOTICE PERIOD.

Provider class: record custodians appointed for a physician’s records

What this means operationally

Ninety days is a floor on destruction, not a license to destroy at ninety-one. The rule opens by requiring retention in accordance with state and federal law, which keeps the seven-year physician period and the twenty-year forensic-examination period in force — a custodian who destroys at ninety days records still inside those periods has complied with this sentence and breached the retention rule. Read the parenthetical carefully too: the thirty-day notice period counts INSIDE the ninety days rather than being added to it, so notice given on day one leaves sixty days, and notice given late shortens what the patient actually gets.

Applies when

A records custodian proposes to destroy records in their custody

Exceptions

Retention periods required by other state and federal law continue to apply and are not displaced by the ninety-day floor

State regulation22 Tex. Admin. Code § 163.5(b)(3)Patients of a physician who has died, become incapacitated, or abandoned recordsVerified 2026-08-30

Closure, transfer and custody of records

Custody on closure or transfer

Upon RETIREMENT, TERMINATION OF EMPLOYMENT, or LEAVING a medical practice, a physician must provide patients reasonable notice to obtain copies of their records or arrange for the transfer of their medical records by: LETTER OR EMAIL to each patient seen IN THE LAST TWO YEARS by the departing physician; AND posting a notice in a conspicuous location in the physician's or practice office AND on the practice website AT LEAST 30 DAYS PRIOR to the termination, leaving, or sale or relocation of practice. The notice must include: the date of the termination, retirement or departure; instructions as to how patients may obtain or transfer their medical records; the name and location of the new practice, if any; and the name of another licensed physician, practice or custodian if OWNERSHIP OF RECORDS IS CHANGING.

Provider class: physicians leaving, retiring from or terminating employment at a practice

What this means operationally

Both channels are required, not alternatives — individual letter or email to every patient seen in the past two years, and a posted notice in the office and on the website. The website limb is the one most often missed, and the thirty-day lead time runs to the departure date, so the notice work starts a month before the last day rather than on it. The fourth content element is the one with legal consequence: if ownership of the records is changing, the notice must name who is taking them, which forces the custody question to be settled before the physician leaves rather than after.

Applies when

A physician retires, terminates employment, or otherwise leaves a medical practice, or the practice is sold or relocated

Exceptions

A locum tenens physician at a practice location for less than six months is exempt
A physician who only treated the patient in a hospital as defined under § 157.051(6) of the Act, an emergency room, a birthing center or an ambulatory surgery center is exempt
A physician who only provided anesthesia, radiology or pathology is exempt

State regulation22 Tex. Admin. Code § 163.4(a), (b), (d)Patients of a Texas physician, and requestors acting for themVerified 2026-08-30

Custody on closure or transfer

If the physician's license is SURRENDERED OR REVOKED, the notice must be provided IMMEDIATELY in accordance with this section.

Provider class: physicians whose license is surrendered or revoked

What this means operationally

The thirty-day advance notice is impossible where a license ends abruptly, and the Board replaced it with an immediate duty rather than dropping it. The Texas Medical Association asked during the comment period for a thirty-day timeframe instead of 'immediately' and the Board expressly DECLINED, reasoning that patients should not wait thirty days to learn of a potential loss of access. That refusal is on the record, so the word is deliberate and should not be read down to mean promptly or reasonably.

Applies when

A physician’s license is surrendered or revoked

State regulation22 Tex. Admin. Code § 163.4(c)Patients of a Texas physician, and requestors acting for themVerified 2026-08-30

Custody on closure or transfer

A physician, physician group, or PRACTICE must provide a LIST OF PATIENTS seen by the departing physician in the last two years for the purposes of providing notice to patients. A departing physician's group or practice is NOT REQUIRED to provide the requisite notice to patients. If the departing physician's group or practice AGREES to provide the requisite notices, they must do so in accordance with this section. NO PHYSICIAN REMAINING at the group or practice may PREVENT OR INTERFERE WITH the departing physician's duties to provide notices described by this section.

Setting: physician groups and practices from which a physician departs

What this means operationally

This is the provision that makes the departure-notice duty enforceable in practice, and it binds the entity rather than the individual. The practice must hand over the two-year patient list — the departing physician usually cannot extract it themselves — but the practice does not inherit the notice duty unless it agrees to. The non-interference rule is the operative one in a contested exit: a restrictive covenant, a withheld list or a blocked mailing is an independent violation by the remaining physicians, not merely a contract dispute. Employment and separation agreements should be read against it.

Applies when

A physician departs from a group or practice

Exceptions

The group or practice is not required to give the notice itself unless it agrees to do so

State regulation22 Tex. Admin. Code § 163.4(e)Patients of a Texas physician, and requestors acting for themVerified 2026-08-30

Custody on closure or transfer

In accordance with § 159.0061 of the Act, a custodian of records is as follows: PHYSICIAN DEATH - the administrator, executor of the estate, or other court appointed individual, UNLESS part of a group practice or pre-existing appointments or instructions are in place; PHYSICIAN MENTAL OR PHYSICAL INCAPACITY - the individual with Power of Attorney, a court appointed individual, or a legally appointed representative of the physician; OTHER CIRCUMSTANCES OR ABANDONMENT OF RECORDS - the custodian is determined ON A CASE-BY-CASE BASIS.

Provider class: physicians
Setting: death, incapacity or abandonment of records

What this means operationally

The death limb carries the planning point: the estate's administrator or executor becomes custodian by default, but only UNLESS the physician was part of a group practice or had put appointments or instructions in place beforehand. A solo physician who names a custodian in advance displaces the default and keeps the records out of probate administration; one who does not leaves them with an executor who may have no clinical or HIPAA context. The third limb is honest about its own indeterminacy — abandonment is resolved case by case, which is a reason to have settled the question in advance rather than a rule a practice can rely on.

Applies when

A physician dies, becomes mentally or physically incapacitated, or abandons medical records

Exceptions

The death default does not apply where the physician was part of a group practice, or where pre-existing appointments or instructions are in place

State regulation22 Tex. Admin. Code § 163.5(a)Patients of a physician who has died, become incapacitated, or abandoned recordsVerified 2026-08-30

Duty to keep an accurate record

A records custodian must MAINTAIN THE CONFIDENTIALITY of the medical records, and WITHIN 30 DAYS OF APPOINTMENT provide notice of the custodianship of the records TO THE BOARD AND TO PATIENTS by: posting visible notice in the physician's or practice office, if accessible; OR posting notice on a physician or practice website, if accessible; OR posting notice in a NEWSPAPER OF GREATEST GENERAL CIRCULATION in the county where the physician practice was located. The notice must include: the name of the custodian and contact information; instructions as to how patients can obtain or request transfer of medical records to another provider; all applicable fees to be charged for the records in accordance with this chapter, INCLUDING AN ADDITIONAL $25.00 CUSTODIAL FEE as applicable; and a statement that the records MAY BE DESTROYED after 90 days, together with the destruction date.

Provider class: record custodians appointed for a physician’s records

What this means operationally

Thirty days from appointment, and unlike the departure rule the three notice channels are alternatives rather than cumulative — the newspaper route exists precisely because a closed office and a dead website are the common case. Two contents deserve attention. The custodian may add a $25.00 custodial fee on top of the ordinary copying schedule, which is the only place that charge appears. And the notice must state a DESTRUCTION DATE, so it doubles as the formal start of the clock a patient has to act on; a notice that omits the date does not start it cleanly.

Applies when

A person is appointed custodian of a Texas physician’s medical records

State regulation22 Tex. Admin. Code § 163.5(b)(1), (2), (4)Patients of a physician who has died, become incapacitated, or abandoned recordsVerified 2026-08-30

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Texas breach obligations

These apply to businesses generally rather than to dermatology practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Texasbreach data →

Individual notice deadline

As quickly as possible and, unless certain law-enforcement or scope-determination exceptions apply, no later than 60 days after determining that the breach occurred.

The outer bound of 60 days aligns with HIPAA's 60-day individual-notice window in duration, but federal and state duties apply independently and may impose different content, recipient, or trigger requirements.

State regulator notice

Required at 250+ residents

The Attorney General must be notified when a breach involves at least 250 Texas residents. Notification is made through the online form maintained by the AG's office.

Source: Tex. Bus. & Com. Code § 521.053(b)

Statewide rules that also reach dermatology practices

Minor may consent

Where the person with the right to consent cannot be contacted and has given no actual notice to the contrary, a grandparent, adult sibling, adult aunt or uncle, an educational institution the child attends holding written authorization, an adult with actual care, control and possession of the child holding written authorization, a court with jurisdiction over a suit affecting the parent-child relationship, an adult responsible for a child under juvenile court jurisdiction, or a peace officer who has lawfully taken custody and reasonably believes the minor needs immediate treatment, may consent to medical, dental, psychological and surgical treatment. That consent must be in writing, signed, and given to the practitioner or facility administering treatment, and must state the child's name, the parents' names if known along with any managing conservator or guardian, the consenting person's name and relationship to the child, the nature of the treatment, and the date treatment is to begin.

What this means operationally

Texas answers the personal-representative question with a ranked list and a document, which is unusually concrete. Two conditions do the work and both are easy to lose at the desk: the person with the right to consent must be uncontactable, and they must not have said no. So the record has to show the attempt to reach the parent, not merely the relative's signature. The five required contents of the form are a checklist a practice can actually hold itself to.

Applies when

The person with the right to consent cannot be contacted
That person has not given actual notice to the contrary
The consenting person falls within the enumerated list

Exceptions

The section does not apply to consent for the immunization of a child, which runs under § 32.101 instead
Consent for a child committed to the Texas Juvenile Justice Department, or for whom the Department of Family and Protective Services is managing conservator, is governed separately

StatewideTex. Fam. Code §§ 32.001, 32.002Children whose parent or guardian cannot be reachedVerified 2026-08-29

What applies to dermatology practices everywhere

Clinical photography makes dermatology unusually exposed. Images can contain a face, tattoo, body location, embedded metadata, patient identifier, or clinical context. The SRA must follow those images from capture through storage, treatment use, disclosure, marketing, retention, and deletion.

Every device used to capture clinical photographs, dermoscopy images, wound documentation, and treatment-progress images

Camera rolls, automatic cloud synchronization, local storage, image upload, EHR attachment, backup, and deletion

The EHR, practice-management system, portal, teledermatology platform, imaging tools, and photo-management systems

Dermatopathology, laboratory, biopsy, Mohs, referral, and specialist data flows

Email, text, e-fax, patient forms, scheduling, and delivery of images or results

Before-and-after photography used for treatment documentation, education, websites, advertising, or social media

Full dermatologycompliance guide →

Knowing the Texas rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Texas rules on this page.

Start the risk assessment