HIPAA compliance for physical therapy practices in Texas

Texas keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Patient Protect has not recorded any Texas rule that applies to physical therapy practices differently from other providers in the state — the statewide rules below are the ones that reach you.

Texas jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Texas's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Physical therapy practices that electronically submit claims, check benefits, request authorization, or have those transactions conducted on their behalf are HIPAA covered entities. Once covered, the duties below are required across every location and workflow handling PHI.

State — how Texas law interacts with HIPAA

Texas substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Physical therapy practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Chapter 521 applies alongside HIPAA. Compliance with one does not necessarily satisfy the other's timing, threshold, or regulator-notification requirements. Texas also maintains the Texas Medical Records Privacy Act (Tex. Health & Safety Code Ch. 181), which imposes additional state-law obligations on covered entities.

What Texas adds for physical therapy practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Texas's general breach law, which applies the same way to every business in the state.

No verified intersection rules recorded

Patient Protect has not recorded any Texas rule that applies to physical therapy practices differently from any other practice in the state. Where that is the case, the federal obligations and the Texas rules below are the whole picture, and the physical therapists guidance that applies nationally is the better starting point.

HIPAA compliance for physical therapy practices→

Texas breach obligations

These apply to businesses generally rather than to physical therapy practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Texasbreach data →

Individual notice deadline

As quickly as possible and, unless certain law-enforcement or scope-determination exceptions apply, no later than 60 days after determining that the breach occurred.

The outer bound of 60 days aligns with HIPAA's 60-day individual-notice window in duration, but federal and state duties apply independently and may impose different content, recipient, or trigger requirements.

State regulator notice

Required at 250+ residents

The Attorney General must be notified when a breach involves at least 250 Texas residents. Notification is made through the online form maintained by the AG's office.

Source: Tex. Bus. & Com. Code § 521.053(b)

Statewide rules that also reach physical therapy practices

Minor may consent

Where the person with the right to consent cannot be contacted and has given no actual notice to the contrary, a grandparent, adult sibling, adult aunt or uncle, an educational institution the child attends holding written authorization, an adult with actual care, control and possession of the child holding written authorization, a court with jurisdiction over a suit affecting the parent-child relationship, an adult responsible for a child under juvenile court jurisdiction, or a peace officer who has lawfully taken custody and reasonably believes the minor needs immediate treatment, may consent to medical, dental, psychological and surgical treatment. That consent must be in writing, signed, and given to the practitioner or facility administering treatment, and must state the child's name, the parents' names if known along with any managing conservator or guardian, the consenting person's name and relationship to the child, the nature of the treatment, and the date treatment is to begin.

What this means operationally

Texas answers the personal-representative question with a ranked list and a document, which is unusually concrete. Two conditions do the work and both are easy to lose at the desk: the person with the right to consent must be uncontactable, and they must not have said no. So the record has to show the attempt to reach the parent, not merely the relative's signature. The five required contents of the form are a checklist a practice can actually hold itself to.

Applies when

The person with the right to consent cannot be contacted
That person has not given actual notice to the contrary
The consenting person falls within the enumerated list

Exceptions

The section does not apply to consent for the immunization of a child, which runs under § 32.101 instead
Consent for a child committed to the Texas Juvenile Justice Department, or for whom the Department of Family and Protective Services is managing conservator, is governed separately

StatewideTex. Fam. Code §§ 32.001, 32.002Children whose parent or guardian cannot be reachedVerified 2026-08-29

What applies to physical therapy practices everywhere

Physical therapy moves treatment beyond the exam room. Home visits, mobile documentation, progress photography, exercise platforms, temporary staffing, workers' compensation, and frequent communication all expand the practice's ePHI surface.

The EHR, scheduling, billing, claims, and patient-portal systems

Home-exercise and patient-engagement platforms that receive identifiable treatment information

Progress photos and videos — including how they are captured, uploaded, stored, accessed, retained, and removed from devices

Laptops, tablets, and phones used in the clinic, during home visits, or while staff work remotely

Telehealth, secure messaging, email, text, e-fax, referral, and care-coordination workflows

Workers' compensation, employer, insurer, case-manager, and attorney disclosure processes

Full physical therapistscompliance guide →

Federal obligations still have to be evidenced for physical therapy practices in Texas.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Texas rules on this page.

Start the risk assessment