HIPAA compliance for independent medical practices in Texas

Texas keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Texas has 26 recorded rules that apply to independent medical practices differently from other businesses in the state — set out below with their conditions and sources.

Texas jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Texas's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Medical practices that electronically submit claims, check eligibility, request authorization, or conduct another adopted transaction are HIPAA covered entities. That describes the overwhelming majority of modern medical practices. The duties below are required; an EHR does not perform them for the practice.

State — how Texas law interacts with HIPAA

Texas substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Independent medical practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Chapter 521 applies alongside HIPAA. Compliance with one does not necessarily satisfy the other's timing, threshold, or regulator-notification requirements. Texas also maintains the Texas Medical Records Privacy Act (Tex. Health & Safety Code Ch. 181), which imposes additional state-law obligations on covered entities.

What Texas adds for independent medical practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Texas's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Minor may consent

A child may consent to medical, dental, psychological and surgical treatment by a licensed physician or dentist in enumerated circumstances: on active duty with the armed services; at least 16, living separate from parents or guardian and managing their own financial affairs regardless of income source; consenting to diagnosis and treatment of an infectious, contagious or communicable disease; unmarried and pregnant, consenting to treatment related to the pregnancy other than abortion; consenting to examination and treatment for drug or chemical addiction or dependency or a condition directly related to drug or chemical use; unmarried, a parent with actual custody, consenting for their own child; or serving a term of confinement in a Texas Department of Criminal Justice facility.

Provider class: a licensed physician or dentist
Service: medical, dental, psychological and surgical treatment
Patient population: minors

What this means operationally

Two gates, not one. The minor's circumstances have to fall inside the enumerated list, and the treatment has to be delivered by a licensed physician or dentist — a practice whose clinicians hold neither credential cannot rely on this section at all. Intake therefore has to capture the minor's status, and the practice has to know which of its own clinicians the section reaches.

Applies when

The treatment is by a licensed physician or dentist
One or more of the enumerated circumstances in § 32.003(a) applies

Exceptions

Pregnancy-related consent does not extend to abortion
Consent under the section is not subject to disaffirmance because of minority (§ 32.003(b))
A provider remains liable for the provider's own acts of negligence (§ 32.003(e))

State statuteTex. Fam. Code § 32.003(a)–(c)All minors under 18Verified 2026-08-29

Left to professional judgment

A physician, dentist or psychologist with reasonable grounds to believe a child's physical or mental condition has been adversely affected by abuse or neglect may examine the child without the consent of the child, the child's parents, or any other person authorized to consent. The examination may include X-rays, blood tests, photographs, and penetration of tissue necessary to accomplish those tests. The practitioner may not examine a child 16 or older who refuses to consent, or a child for whom a court order prohibits consent, unless consent is obtained as otherwise allowed by law.

Provider class: a physician, dentist or psychologist
Service: examination where abuse or neglect is suspected

What this means operationally

The one place in Texas where a dentist has the same statutory authority as a physician, and the age rule runs backwards from every other provision in the chapter: turning 16 gives the child a veto here rather than a capacity. A practice that treats 16 as the age things get easier will get this exactly wrong.

Applies when

The practitioner is a physician, dentist or psychologist
There are reasonable grounds to believe abuse or neglect has adversely affected the child

Exceptions

A child 16 or older who refuses to consent may not be examined
A child for whom consent is prohibited by court order may not be examined

State statuteTex. Fam. Code § 32.005Children suspected of having been abused or neglectedVerified 2026-08-29

Minor may consent

Notwithstanding § 32.003 or § 32.101, a child may consent to the child's own immunization for a disease if the child is pregnant, or is the parent of a child and has actual custody of that child, and the Centers for Disease Control and Prevention recommend or authorize the initial dose of an immunization for that disease to be administered before seven years of age. The consent must meet the written-form requirement of § 32.002(a), is not subject to disaffirmance because of minority, and a provider may rely on the child's written statement of the grounds for capacity. To the extent of any conflict between this section and § 32.003, this section controls.

Service: immunization for a disease whose initial dose the CDC recommends before age seven
Patient population: children who are pregnant, or who are a parent with actual custody

What this means operationally

Worth contrasting with the overlaps elsewhere in this corpus that have to be flagged as unresolved: here the legislature said which provision wins. Section 32.1011(e) declares that it controls over § 32.003, so there is no judgment call to make. The trigger is also more specific than it first looks — it is not any vaccine, but one the CDC schedules with an initial dose before age seven.

Applies when

The child is pregnant, or is a parent with actual custody of their child
The CDC recommends or authorises the initial dose of that immunization before age seven

State statuteTex. Fam. Code § 32.1011Pregnant or parenting minors presenting for immunizationVerified 2026-08-29

Limit on liability

A physician, dentist, psychologist, hospital or medical facility may rely on the written statement of the child containing the grounds on which the child has capacity to consent to the child's medical treatment, and is not liable for the examination and treatment of a child under § 32.003 except for its own acts of negligence.

Provider class: a physician, dentist, psychologist, hospital or medical facility

What this means operationally

The safety valve that makes § 32.003 usable, and it is built around a document. The statute says a practice may rely on the child's WRITTEN statement of the grounds for capacity — so a determination taken verbally leaves the practice without the protection the legislature offered. Note the provider list here is not the same as the one in § 32.004: counsellors and social workers appear there and not here.

Applies when

The child furnished a written statement of the grounds for capacity under § 32.003

Exceptions

Reliance does not extend to the provider's own acts of negligence

State statuteTex. Fam. Code § 32.003(f), (e)Minors consenting under § 32.003Verified 2026-08-29

Limit on liability

Absent wilful misconduct or gross negligence, a health care provider who accepts the health history and other information given during immunization informed-consent counseling by a person delegated authority to consent is not liable for an adverse reaction or other injury to the child resulting from factual errors in that history. A consenting person, physician, nurse, other provider, clinic, hospital or facility is not liable for damages arising from an immunization authorized under this subchapter except for its own acts of negligence.

Service: immunization of a child

What this means operationally

The counterpart to the broad consent list in § 32.101: a practice can take a history from a grandparent or primary caregiver without carrying the risk that the history is wrong. What it does not cover is the practice's own negligence, so the protection attaches to the information received rather than to the care delivered.

Applies when

The provider accepted a health history during immunization informed-consent counseling

Exceptions

No protection for wilful misconduct or gross negligence
No protection for the provider's own acts of negligence

State statuteTex. Fam. Code § 32.103Children being immunizedVerified 2026-08-29

Provider disclosure to a parent

Provider may disclose

A licensed physician, dentist or psychologist may, with or without the consent of a child who is a patient, advise the child's parents, managing conservator or guardian of the treatment given to or needed by the child.

Provider class: a licensed physician, dentist or psychologist
Service: treatment consented to by the child under § 32.003
Patient population: minors who consented to their own care

What this means operationally

This is a permission held by the clinician, not a right held by the parent and not an obligation on the practice. Nothing here entitles a parent to the record, and a release workflow that treats it as an access right is answering a different question from the one the statute settles.

Applies when

The child was treated under § 32.003

State statuteTex. Fam. Code § 32.003(d)Minors treated under § 32.003Verified 2026-08-29

Provider must disclose

As part of the counseling for informed consent, the health care provider shall inform the person authorized to consent to immunization of the procedures available under the National Childhood Vaccine Injury Act of 1986 to seek possible recovery for unreimbursed expenses for certain injuries arising out of the administration of certain vaccines. The provider's responsibility to inform the consenting person is the same as its responsibility to a parent, and the consenting person need not be present if a consent form meeting § 32.002 has been given to the provider.

Service: immunization of a child

What this means operationally

An affirmative disclosure duty attached to every childhood immunization, owed to whoever is consenting rather than to the parent specifically. The provision that the consenting adult need not be present is the practical one: it means the form, not the conversation at the desk, is what has to carry the required content.

Applies when

A child is being immunized

State statuteTex. Fam. Code § 32.102Children being immunizedVerified 2026-08-29

Who may act for the patient

Minor may consent

In addition to those authorized under Chapters 151 and 153, a guardian or a person authorized under another state's law or a court order may consent to a child's immunization. If those persons are unavailable, consent may be given by a grandparent, adult sibling, adult aunt or uncle, stepparent, an educational institution or other adult holding written authorization, a court with jurisdiction, an adult with care of the child under juvenile court order, or an adult who is the child's primary caregiver. None of them may consent if they have actual knowledge that a person entitled to consent has expressly refused, has told them not to consent, or has withdrawn a prior written authorization. The consenting person must give the provider sufficient and accurate health history for the risks and benefits to be assessed, and the consent must meet the written-form requirement of § 32.002(a).

Service: immunization of a child

What this means operationally

Immunization runs on its own consent list, which is why § 32.001 says in terms that it does not apply here. The list is broader than the general one — it adds stepparents and, at the end, any adult who is the child's primary caregiver. The disqualifier is what a practice has to be able to capture: actual knowledge that someone entitled to consent has refused. That is a question to ask, not a box to assume.

Applies when

The service is the immunization of a child

Exceptions

No one on the list may consent where they know a person entitled to consent has refused, countermanded, or withdrawn written authorization

State statuteTex. Fam. Code § 32.101Children presenting for immunizationVerified 2026-08-29

How long records must be kept

Duty to keep an accurate record

The medical record must be a COMPLETE, CONTEMPORANEOUS and LEGIBLE documented account of each patient encounter by a physician or delegate. To the extent applicable, a medical record must include at a minimum: a reason for the encounter, relevant history, physical examination findings (ensuring any PRE-POPULATED FIELDS contain current and accurate patient information) and any diagnostic test results; an assessment, clinical impression and diagnosis; a plan for care, treatments and medications including amount, frequency, number of refills and dosage; LATE ENTRIES, if any, indicating the time and date entered and the identity of the person who made the late entry; a summary or documentation of communications with the patient; sufficient documentation of requests for records from other providers and any records received; and documentation of a review of the patient's Texas Prescription Monitoring Program (PMP) prescribing history.

Provider class: physicians and their delegates

What this means operationally

Two requirements here are software configuration decisions rather than clinical habits. Pre-populated fields must contain current and accurate information, which makes EHR templates and carried-forward histories a stated compliance risk rather than a convenience. And late entries must carry their own time, date and author, so an EHR that silently backdates or attributes an entry to the session owner does not satisfy the rule. The PMP element was added at the Texas Medical Association's request as a non-substantive change and is qualified by the section's opening 'to the extent applicable'.

Applies when

A physician or delegate documents a patient encounter

Exceptions

Each listed element is required only TO THE EXTENT APPLICABLE to the encounter

State regulation22 Tex. Admin. Code § 163.1(a), (b)(1)-(6), (b)(8)Patients of a Texas physicianVerified 2026-08-30

How long the record must be kept

Medical records must be retained by a physician or a physician's employer, including group practices, professional associations and non-profit health organizations. The STANDARD RETENTION PERIOD is AT LEAST SEVEN YEARS from the DATE OF LAST TREATMENT by the physician, or longer if required by other federal or state law. The retention period for a patient UNDER 18 years old is until the patient reaches age 21 or seven years from the date of last treatment, WHICHEVER IS LONGER.

Provider class: physicians, and physician employers including group practices, professional associations and non-profit health organizations

What this means operationally

Seven years from last treatment, so the clock restarts with each episode of care and an active patient's file never ages out. The minor rule needs both limbs applied rather than just the age: for a seventeen-year-old the seven-year period runs past 21 and governs, while for a young child the age-21 endpoint is the longer one. Note who the duty binds — the rule names the physician's EMPLOYER alongside the physician, including group practices and non-profit health organizations, so a practice entity cannot treat retention as the individual clinician's problem.

Applies when

A physician or physician employer holds a medical record

Exceptions

A longer period required by other federal or state law prevails
Forensic medical examinations for sexual assault carry a twenty-year rule under § 163.2(d) and Occ. Code § 153.003(b)

State regulation22 Tex. Admin. Code § 163.2(a), (c)Patients of a Texas physicianVerified 2026-08-30

Duty to keep an accurate record

Providers must MAINTAIN ACCESS to medical records for the DURATION of the required retention period.

Provider class: physicians and physician employers

What this means operationally

A short sentence that decides several expensive questions. Retention is not satisfied by possession alone — the records have to remain reachable for the full seven years, which makes an EHR migration, a vendor contract lapse, a discontinued product or an unreadable legacy format a compliance failure rather than an IT inconvenience. Practices switching systems should read this as a requirement that the outgoing data stay retrievable, not merely archived, and should treat the end of a software contract as a records event.

Applies when

A record is within its required retention period

State regulation22 Tex. Admin. Code § 163.2(b)Patients of a Texas physicianVerified 2026-08-30

How long the record must be kept

Forensic medical examinations for sexual assault must be retained in accordance with § 153.003 of the Act. The rules adopted under that section must PROHIBIT A PHYSICIAN FROM DESTROYING a medical record from the forensic medical examination of a sexual assault victim conducted under subchapter G, chapter 56A, Code of Criminal Procedure, UNTIL THE 20TH ANNIVERSARY OF THE DATE THE RECORD WAS CREATED.

Record class: records of a forensic medical examination of a sexual assault victim
Provider class: physicians

What this means operationally

Twenty years, and the clock is different from every other Texas period: it runs from the DATE THE RECORD WAS CREATED, not from last treatment. A practice applying the ordinary seven-year rule to a forensic examination would destroy the record thirteen years early and would measure from the wrong event. The obligation is also expressed as a prohibition on destruction rather than as a duty to keep, which matters where a records-destruction schedule is automated: the exclusion has to be built into the deletion rule, not into a retention policy document.

Applies when

A physician holds the record of a forensic medical examination of a sexual assault victim conducted under subch. G, ch. 56A, Code of Criminal Procedure

State regulation22 Tex. Admin. Code § 163.2(d); Tex. Occ. Code § 153.003(b)Patients of a Texas physicianVerified 2026-08-30

Patient access to records

Deadline to respond to an access request

Unless the physician determines that access would be HARMFUL to the physical, mental or emotional health of the patient, a physician who receives a written consent for release shall furnish copies of the requested billing or medical records, or a summary or narrative, including records received from another physician or provider involved in the patient's care. The physician may delete confidential information about another patient or a family member who has not consented. On written request by a SUBSEQUENT OR CONSULTING physician, the requested physician shall furnish a copy of the COMPLETE billing or medical records, and that duty MAY NOT BE NULLIFIED BY CONTRACT. The information must be provided not later than the 15TH BUSINESS DAY after receipt. If the physician denies the request in whole or in part, the physician shall furnish the patient a signed and dated written statement giving the reason for the denial and place a copy of that statement in the patient's billing or medical records as applicable.

Provider class: physicians
Record class: billing or medical records

More than one provision may apply

The statutory deadline here and the Medical Board deadline at 22 TAC § 163.3(a) are stated in different units for the same request, and no primary authority resolves which governs. This section says NOT LATER THAN THE 15TH BUSINESS DAY; the rule says WITHIN 15 DAYS and in accordance with this chapter. The divergence bites in a narrow window: WHERE a physician responds after the fifteenth calendar day but on or before the fifteenth business day, one authority has been met and the other has not. Both propositions are carried and neither is presented as displacing the other. See texas-physician-board-deadline-1 for the full adjudication record.

What this means operationally

Fifteen BUSINESS days, not calendar days, which is the detail most likely to be mis-implemented — with holidays it can run past three calendar weeks, and a system counting calendar days will report breaches that have not happened. Two further features matter. A denial is not silence: it requires a signed, dated written statement of reasons that must itself be filed in the record, so a refusal creates a document. And the duty to send complete records to a subsequent or consulting physician cannot be contracted away, which forecloses the arrangement a practice sale or group agreement might otherwise create.

Applies when

A written consent for release under § 159.005 is received, or a written request from a subsequent or consulting physician

Exceptions

Access may be withheld where the physician determines it would be harmful to the patient's physical, mental or emotional health
Confidential information about another patient or a non-consenting family member may be deleted

State statuteTex. Occ. Code § 159.006Patients and subsequent or consulting physiciansVerified 2026-08-29

Deadline to respond to an access request

Upon receipt of a request for medical records that complies with § 159.005 of the Act, a physician must provide the information WITHIN 15 DAYS of the request AND IN ACCORDANCE WITH CHAPTER 159 of the Act.

Provider class: physicians

More than one provision may apply

Two current primary authorities state a response deadline for the same request and neither states which governs. Occ. Code § 159.006(d) says the information must be provided NOT LATER THAN THE 15TH BUSINESS DAY after receipt. 22 TAC § 163.3(a) says the physician must provide the information WITHIN 15 DAYS of the request AND IN ACCORDANCE WITH CHAPTER 159 OF THE ACT. Fifteen plain days is the shorter of the two in every case, because fifteen business days spans at least three calendar weeks and more across holidays. The rule contains no notwithstanding clause and does not adopt the statutory formula; the statute contains no delegation of the deadline to board rule. The Board's adoption preamble, its section-by-section summary and its published comment responses at 50 TexReg 334-335 do not address the divergence, and no commenter raised it. NO PRIMARY AUTHORITY WAS FOUND THAT RESOLVES THE RELATIONSHIP. Both propositions are therefore carried, and neither is presented as displacing the other. A practice asking what it must do has an answerable question even though the corpus does not: responding within fifteen calendar days satisfies both readings. That is an observation about the intersection of two stated deadlines, NOT a finding that the shorter one legally controls. The divergence bites in a narrow window: WHERE a physician responds after the fifteenth CALENDAR day but on or before the fifteenth BUSINESS day, one authority has been met and the other has not. Inside fifteen calendar days both are satisfied; past the fifteenth business day both are breached. Outside that window the two authorities agree, which is why this is a bounded open question rather than a permanent conflict.

What this means operationally

Read this alongside Occ. Code § 159.006(d), which sets fifteen BUSINESS days, and note that the corpus does not treat either as displacing the other — see the interaction note. The trigger is also worth holding precisely: the clock starts on a request that COMPLIES WITH § 159.005, so a request that is not a proper written consent does not start it, and a practice that treats every inbound message as day zero will over-report its own lateness.

Applies when

A request for medical records complying with Tex. Occ. Code § 159.005 is received

State regulation22 Tex. Admin. Code § 163.3(a)Patients of a Texas physician, and requestors acting for themVerified 2026-08-30

Parental right of access

A provider CANNOT DENY a request for medical records due to a DELINQUENT ACCOUNT or amounts owed to the provider. A provider CANNOT REQUIRE A SUBPOENA for the records if a proper request is made in accordance with § 159.005 of the Act.

Provider class: physicians

What this means operationally

Two barriers a practice is expressly forbidden to raise. The money limit is narrower than it looks: the rule bars withholding the RECORDS over a delinquent treatment account, and it does not disturb the separate copying fee, which the fee schedule permits the practice to charge and collect. The subpoena limit closes a common front-desk practice — once a compliant § 159.005 request arrives, demanding legal process instead is itself the violation, and this reaches requests from attorneys and insurers as much as from patients.

Applies when

A request complying with Tex. Occ. Code § 159.005 has been made

Exceptions

The permitted copying fee under § 163.3(c) is unaffected; this bars withholding over a treatment account, not over the cost of copying

State regulation22 Tex. Admin. Code § 163.3(d), (e)Patients of a Texas physician, and requestors acting for themVerified 2026-08-30

Copy fees, format and delivery

Limit on copy fees, format or delivery

A physician may charge a reasonable fee, AS PRESCRIBED BY BOARD RULE, for copying billing or medical records, and is not required to permit examination or copying until the fee is paid unless there is a medical emergency. A physician may not charge a fee to the extent it is prohibited under Subchapter M, Chapter 161, Health and Safety Code. A copy, summary or narrative may be provided on paper or using any other appropriate medium TO WHICH THE PROVIDING AND RECEIVING PERSONS AGREE.

Provider class: physicians
Record class: billing or medical records

What this means operationally

The amount is not in the statute — it is whatever the board has prescribed, so a practice cannot answer the fee question from chapter 159 alone and must check the current board rule. Payment may precede production, which sits awkwardly against a fifteen-business-day clock and means invoicing has to happen immediately rather than at the end. Format is by AGREEMENT between sender and recipient rather than by patient election, which is a materially weaker electronic-delivery right than Illinois grants.

Applies when

Copies of billing or medical records are requested from a physician

Exceptions

No withholding for non-payment where there is a medical emergency
No fee to the extent prohibited under Subchapter M, Chapter 161, Health and Safety Code

State statuteTex. Occ. Code §§ 159.007, 159.008Patients and authorized requestersVerified 2026-08-29

Limit on copy fees, format or delivery

Allowable charges for records: PAPER records - the maximum fee may be $25.00 for the first twenty pages and $0.50 per page thereafter. ELECTRONIC records - the maximum fee may be $25.00 for 500 pages or less and $50.00 for more than 500 pages. HYBRID records, part paper and part electronic - the fee for each different format may be utilized, including diagnostic studies. If an AFFIDAVIT is requested for the records, the maximum fee may be $15.00. If a NARRATIVE is provided in lieu of records, the maximum fee may be $20.00. Where a requestor asks that all records be in PAPER FORMAT even though they are available as electronic records, the paper record fee may be charged. If records are MAILED to the requestor, actual postage cost may be charged.

Provider class: physicians
Record class: paper, electronic, hybrid and diagnostic imaging records

What this means operationally

This is the schedule that Occ. Code § 159.008 delegates to the Board, so it is the operative figure a Texas physician practice charges. The electronic tier is the one that changes behavior: $25 covers up to 500 pages and $50 covers anything above, so electronic delivery of a large chart is dramatically cheaper for the requestor than the paper tier, where 500 pages would reach $265. Two limits protect the practice rather than the patient — a requestor who insists on paper when electronic exists can be charged the paper rate, and actual postage is recoverable. Note these are MAXIMA, not fixed prices.

Applies when

A physician responds to a request for medical records or diagnostic imaging

State regulation22 Tex. Admin. Code § 163.3(c)(1)-(7)Patients of a Texas physician, and requestors acting for themVerified 2026-08-30

Prerequisite before the authority may be used

Requests for DIAGNOSTIC IMAGING, including static films, non-static films and imaging studies, MUST SPECIFY whether a COPY or the ORIGINAL of the study is sought.

Record class: diagnostic imaging, including static films, non-static films and imaging studies

What this means operationally

A specification requirement that sits on the requestor rather than the practice, and it gives a practice a defensible reason to seek clarification before releasing imaging. It matters most where the original is the only diagnostic-quality artefact: releasing an original when a copy was intended can strip the practice of the record it is separately required to retain for seven years. Build it into the records-request form rather than handling it case by case.

Applies when

A request seeks diagnostic imaging rather than, or in addition to, chart records

State regulation22 Tex. Admin. Code § 163.3(b)Patients of a Texas physician, and requestors acting for themVerified 2026-08-30

Amendment or correction of a record

Duty to keep an accurate record

A medical record must include clear identification of ANY AMENDMENT OR CORRECTION to the medical record, including the date it was amended or corrected and the identity of the author of the amendment or correction, WITH THE ORIGINAL TEXT REMAINING LEGIBLE.

Provider class: physicians and their delegates
Record class: amended or corrected medical records

What this means operationally

The operative words are 'remaining legible'. Texas does not permit a correction to replace what it corrects: the original text has to survive the amendment in readable form, which rules out overwriting a note, deleting and re-entering it, or any EHR correction workflow that renders the prior version unavailable. Three things must be recoverable afterwards — the original words, the date of the change and who made it. A practice evaluating an EHR should treat non-destructive amendment as a procurement requirement, because the rule cannot be satisfied by policy if the software cannot do it.

Applies when

An entry in a medical record is amended or corrected

State regulation22 Tex. Admin. Code § 163.1(b)(7)Patients of a Texas physicianVerified 2026-08-30

Destruction and disposition

Destruction or disposition requirement

A records custodian must RETAIN the medical records in accordance with state and federal law for AT LEAST 90 DAYS BEFORE DESTROYING any records, INCLUDING THE 30-DAY NOTICE PERIOD.

Provider class: record custodians appointed for a physician’s records

What this means operationally

Ninety days is a floor on destruction, not a license to destroy at ninety-one. The rule opens by requiring retention in accordance with state and federal law, which keeps the seven-year physician period and the twenty-year forensic-examination period in force — a custodian who destroys at ninety days records still inside those periods has complied with this sentence and breached the retention rule. Read the parenthetical carefully too: the thirty-day notice period counts INSIDE the ninety days rather than being added to it, so notice given on day one leaves sixty days, and notice given late shortens what the patient actually gets.

Applies when

A records custodian proposes to destroy records in their custody

Exceptions

Retention periods required by other state and federal law continue to apply and are not displaced by the ninety-day floor

State regulation22 Tex. Admin. Code § 163.5(b)(3)Patients of a physician who has died, become incapacitated, or abandoned recordsVerified 2026-08-30

Closure, transfer and custody of records

Custody on closure or transfer

The board by rule shall establish conditions under which it may TEMPORARILY OR PERMANENTLY APPOINT a person as custodian of a physician's billing or medical records. In adopting those rules the board shall consider the death of a physician, the mental or physical incapacitation of a physician, and the ABANDONMENT of billing or medical records by a physician. The rules must provide for release of the records by the appointed custodian in compliance with chapter 159, and for a fee charged by the custodian IN ADDITION TO the copying fee under § 159.008.

Provider class: physicians
Record class: billing or medical records

What this means operationally

Texas approaches the closure problem from the opposite end to Michigan. Michigan obliges the licensee or their estate to arrange custody and notify the department; Texas empowers the BOARD to appoint a custodian, including where records have simply been abandoned. For a practice that means there is no statutory checklist to follow on closing — the exposure is that the board steps in — and for patients it means records may end up with an appointed custodian who can charge an ADDITIONAL fee on top of the ordinary copying charge.

Applies when

A physician has died, become incapacitated, or abandoned billing or medical records

State statuteTex. Occ. Code § 159.0061Patients of a deceased, incapacitated or absent physicianVerified 2026-08-29

Custody on closure or transfer

Upon RETIREMENT, TERMINATION OF EMPLOYMENT, or LEAVING a medical practice, a physician must provide patients reasonable notice to obtain copies of their records or arrange for the transfer of their medical records by: LETTER OR EMAIL to each patient seen IN THE LAST TWO YEARS by the departing physician; AND posting a notice in a conspicuous location in the physician's or practice office AND on the practice website AT LEAST 30 DAYS PRIOR to the termination, leaving, or sale or relocation of practice. The notice must include: the date of the termination, retirement or departure; instructions as to how patients may obtain or transfer their medical records; the name and location of the new practice, if any; and the name of another licensed physician, practice or custodian if OWNERSHIP OF RECORDS IS CHANGING.

Provider class: physicians leaving, retiring from or terminating employment at a practice

What this means operationally

Both channels are required, not alternatives — individual letter or email to every patient seen in the past two years, and a posted notice in the office and on the website. The website limb is the one most often missed, and the thirty-day lead time runs to the departure date, so the notice work starts a month before the last day rather than on it. The fourth content element is the one with legal consequence: if ownership of the records is changing, the notice must name who is taking them, which forces the custody question to be settled before the physician leaves rather than after.

Applies when

A physician retires, terminates employment, or otherwise leaves a medical practice, or the practice is sold or relocated

Exceptions

A locum tenens physician at a practice location for less than six months is exempt
A physician who only treated the patient in a hospital as defined under § 157.051(6) of the Act, an emergency room, a birthing center or an ambulatory surgery center is exempt
A physician who only provided anesthesia, radiology or pathology is exempt

State regulation22 Tex. Admin. Code § 163.4(a), (b), (d)Patients of a Texas physician, and requestors acting for themVerified 2026-08-30

Custody on closure or transfer

If the physician's license is SURRENDERED OR REVOKED, the notice must be provided IMMEDIATELY in accordance with this section.

Provider class: physicians whose license is surrendered or revoked

What this means operationally

The thirty-day advance notice is impossible where a license ends abruptly, and the Board replaced it with an immediate duty rather than dropping it. The Texas Medical Association asked during the comment period for a thirty-day timeframe instead of 'immediately' and the Board expressly DECLINED, reasoning that patients should not wait thirty days to learn of a potential loss of access. That refusal is on the record, so the word is deliberate and should not be read down to mean promptly or reasonably.

Applies when

A physician’s license is surrendered or revoked

State regulation22 Tex. Admin. Code § 163.4(c)Patients of a Texas physician, and requestors acting for themVerified 2026-08-30

Custody on closure or transfer

A physician, physician group, or PRACTICE must provide a LIST OF PATIENTS seen by the departing physician in the last two years for the purposes of providing notice to patients. A departing physician's group or practice is NOT REQUIRED to provide the requisite notice to patients. If the departing physician's group or practice AGREES to provide the requisite notices, they must do so in accordance with this section. NO PHYSICIAN REMAINING at the group or practice may PREVENT OR INTERFERE WITH the departing physician's duties to provide notices described by this section.

Setting: physician groups and practices from which a physician departs

What this means operationally

This is the provision that makes the departure-notice duty enforceable in practice, and it binds the entity rather than the individual. The practice must hand over the two-year patient list — the departing physician usually cannot extract it themselves — but the practice does not inherit the notice duty unless it agrees to. The non-interference rule is the operative one in a contested exit: a restrictive covenant, a withheld list or a blocked mailing is an independent violation by the remaining physicians, not merely a contract dispute. Employment and separation agreements should be read against it.

Applies when

A physician departs from a group or practice

Exceptions

The group or practice is not required to give the notice itself unless it agrees to do so

State regulation22 Tex. Admin. Code § 163.4(e)Patients of a Texas physician, and requestors acting for themVerified 2026-08-30

Custody on closure or transfer

In accordance with § 159.0061 of the Act, a custodian of records is as follows: PHYSICIAN DEATH - the administrator, executor of the estate, or other court appointed individual, UNLESS part of a group practice or pre-existing appointments or instructions are in place; PHYSICIAN MENTAL OR PHYSICAL INCAPACITY - the individual with Power of Attorney, a court appointed individual, or a legally appointed representative of the physician; OTHER CIRCUMSTANCES OR ABANDONMENT OF RECORDS - the custodian is determined ON A CASE-BY-CASE BASIS.

Provider class: physicians
Setting: death, incapacity or abandonment of records

What this means operationally

The death limb carries the planning point: the estate's administrator or executor becomes custodian by default, but only UNLESS the physician was part of a group practice or had put appointments or instructions in place beforehand. A solo physician who names a custodian in advance displaces the default and keeps the records out of probate administration; one who does not leaves them with an executor who may have no clinical or HIPAA context. The third limb is honest about its own indeterminacy — abandonment is resolved case by case, which is a reason to have settled the question in advance rather than a rule a practice can rely on.

Applies when

A physician dies, becomes mentally or physically incapacitated, or abandons medical records

Exceptions

The death default does not apply where the physician was part of a group practice, or where pre-existing appointments or instructions are in place

State regulation22 Tex. Admin. Code § 163.5(a)Patients of a physician who has died, become incapacitated, or abandoned recordsVerified 2026-08-30

Duty to keep an accurate record

A records custodian must MAINTAIN THE CONFIDENTIALITY of the medical records, and WITHIN 30 DAYS OF APPOINTMENT provide notice of the custodianship of the records TO THE BOARD AND TO PATIENTS by: posting visible notice in the physician's or practice office, if accessible; OR posting notice on a physician or practice website, if accessible; OR posting notice in a NEWSPAPER OF GREATEST GENERAL CIRCULATION in the county where the physician practice was located. The notice must include: the name of the custodian and contact information; instructions as to how patients can obtain or request transfer of medical records to another provider; all applicable fees to be charged for the records in accordance with this chapter, INCLUDING AN ADDITIONAL $25.00 CUSTODIAL FEE as applicable; and a statement that the records MAY BE DESTROYED after 90 days, together with the destruction date.

Provider class: record custodians appointed for a physician’s records

What this means operationally

Thirty days from appointment, and unlike the departure rule the three notice channels are alternatives rather than cumulative — the newspaper route exists precisely because a closed office and a dead website are the common case. Two contents deserve attention. The custodian may add a $25.00 custodial fee on top of the ordinary copying schedule, which is the only place that charge appears. And the notice must state a DESTRUCTION DATE, so it doubles as the formal start of the clock a patient has to act on; a notice that omits the date does not start it cleanly.

Applies when

A person is appointed custodian of a Texas physician’s medical records

State regulation22 Tex. Admin. Code § 163.5(b)(1), (2), (4)Patients of a physician who has died, become incapacitated, or abandoned recordsVerified 2026-08-30

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Texas breach obligations

These apply to businesses generally rather than to independent medical practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Texasbreach data →

Individual notice deadline

As quickly as possible and, unless certain law-enforcement or scope-determination exceptions apply, no later than 60 days after determining that the breach occurred.

The outer bound of 60 days aligns with HIPAA's 60-day individual-notice window in duration, but federal and state duties apply independently and may impose different content, recipient, or trigger requirements.

State regulator notice

Required at 250+ residents

The Attorney General must be notified when a breach involves at least 250 Texas residents. Notification is made through the online form maintained by the AG's office.

Source: Tex. Bus. & Com. Code § 521.053(b)

Statewide rules that also reach independent medical practices

Minor may consent

Where the person with the right to consent cannot be contacted and has given no actual notice to the contrary, a grandparent, adult sibling, adult aunt or uncle, an educational institution the child attends holding written authorization, an adult with actual care, control and possession of the child holding written authorization, a court with jurisdiction over a suit affecting the parent-child relationship, an adult responsible for a child under juvenile court jurisdiction, or a peace officer who has lawfully taken custody and reasonably believes the minor needs immediate treatment, may consent to medical, dental, psychological and surgical treatment. That consent must be in writing, signed, and given to the practitioner or facility administering treatment, and must state the child's name, the parents' names if known along with any managing conservator or guardian, the consenting person's name and relationship to the child, the nature of the treatment, and the date treatment is to begin.

What this means operationally

Texas answers the personal-representative question with a ranked list and a document, which is unusually concrete. Two conditions do the work and both are easy to lose at the desk: the person with the right to consent must be uncontactable, and they must not have said no. So the record has to show the attempt to reach the parent, not merely the relative's signature. The five required contents of the form are a checklist a practice can actually hold itself to.

Applies when

The person with the right to consent cannot be contacted
That person has not given actual notice to the contrary
The consenting person falls within the enumerated list

Exceptions

The section does not apply to consent for the immunization of a child, which runs under § 32.101 instead
Consent for a child committed to the Texas Juvenile Justice Department, or for whom the Department of Family and Protective Services is managing conservator, is governed separately

StatewideTex. Fam. Code §§ 32.001, 32.002Children whose parent or guardian cannot be reachedVerified 2026-08-29

What applies to independent medical practices everywhere

Independent medical practices often have the broadest technology and data surface: EHRs, portals, laboratories, e-prescribing, imaging, claims, referrals, fax, remote access, and dozens of vendors. The SRA must cover the whole environment — not merely the primary EHR.

The complete inventory of systems that create, receive, maintain, or transmit ePHI

EHR access, administrative privileges, audit logging, integrations, APIs, and patient-portal connections

Laboratory, imaging, e-prescribing, pharmacy, hospital, specialist, and referral data flows

Claims, eligibility, prior authorization, clearinghouse, billing, and payment workflows

Email, text, e-fax, forms, telehealth, call recording, voicemail, and patient messaging

Workstations, servers, laptops, tablets, phones, network equipment, remote access, cloud storage, and backup

Full medical practicescompliance guide →

Knowing the Texas rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Texas rules on this page.

Start the risk assessment