HIPAA compliance for telehealth practices in Texas

Texas keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Texas has 2 recorded rules that apply to telehealth practices differently from other businesses in the state — set out below with their conditions and sources.

Texas jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Texas's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Telehealth does not change the covered-entity test. A clinician or practice that electronically conducts an adopted transaction — or has one conducted on its behalf — is covered just as an in-person practice would be. Once covered, the duties below apply to the full remote-care environment.

State — how Texas law interacts with HIPAA

Texas substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Telehealth practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Chapter 521 applies alongside HIPAA. Compliance with one does not necessarily satisfy the other's timing, threshold, or regulator-notification requirements. Texas also maintains the Texas Medical Records Privacy Act (Tex. Health & Safety Code Ch. 181), which imposes additional state-law obligations on covered entities.

What Texas adds for telehealth practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Texas's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Minor may consent

A child may consent to medical, dental, psychological and surgical treatment by a licensed physician or dentist in enumerated circumstances: on active duty with the armed services; at least 16, living separate from parents or guardian and managing their own financial affairs regardless of income source; consenting to diagnosis and treatment of an infectious, contagious or communicable disease; unmarried and pregnant, consenting to treatment related to the pregnancy other than abortion; consenting to examination and treatment for drug or chemical addiction or dependency or a condition directly related to drug or chemical use; unmarried, a parent with actual custody, consenting for their own child; or serving a term of confinement in a Texas Department of Criminal Justice facility.

Provider class: a licensed physician or dentist
Service: medical, dental, psychological and surgical treatment
Patient population: minors

Reaches this practice type when the treating clinician is a licensed physician.

What this means operationally

Two gates, not one. The minor's circumstances have to fall inside the enumerated list, and the treatment has to be delivered by a licensed physician or dentist — a practice whose clinicians hold neither credential cannot rely on this section at all. Intake therefore has to capture the minor's status, and the practice has to know which of its own clinicians the section reaches.

Applies when

The treatment is by a licensed physician or dentist
One or more of the enumerated circumstances in § 32.003(a) applies

Exceptions

Pregnancy-related consent does not extend to abortion
Consent under the section is not subject to disaffirmance because of minority (§ 32.003(b))
A provider remains liable for the provider's own acts of negligence (§ 32.003(e))

State statuteTex. Fam. Code § 32.003(a)–(c)All minors under 18Verified 2026-08-29

Provider disclosure to a parent

Provider may disclose

A licensed physician, dentist or psychologist may, with or without the consent of a child who is a patient, advise the child's parents, managing conservator or guardian of the treatment given to or needed by the child.

Provider class: a licensed physician, dentist or psychologist
Service: treatment consented to by the child under § 32.003
Patient population: minors who consented to their own care

Reaches this practice type when the treating clinician is a licensed physician or psychologist.

What this means operationally

This is a permission held by the clinician, not a right held by the parent and not an obligation on the practice. Nothing here entitles a parent to the record, and a release workflow that treats it as an access right is answering a different question from the one the statute settles.

Applies when

The child was treated under § 32.003

State statuteTex. Fam. Code § 32.003(d)Minors treated under § 32.003Verified 2026-08-29

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Texas breach obligations

These apply to businesses generally rather than to telehealth practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Texasbreach data →

Individual notice deadline

As quickly as possible and, unless certain law-enforcement or scope-determination exceptions apply, no later than 60 days after determining that the breach occurred.

The outer bound of 60 days aligns with HIPAA's 60-day individual-notice window in duration, but federal and state duties apply independently and may impose different content, recipient, or trigger requirements.

State regulator notice

Required at 250+ residents

The Attorney General must be notified when a breach involves at least 250 Texas residents. Notification is made through the online form maintained by the AG's office.

Source: Tex. Bus. & Com. Code § 521.053(b)

Statewide rules that also reach telehealth practices

Minor may consent

Where the person with the right to consent cannot be contacted and has given no actual notice to the contrary, a grandparent, adult sibling, adult aunt or uncle, an educational institution the child attends holding written authorization, an adult with actual care, control and possession of the child holding written authorization, a court with jurisdiction over a suit affecting the parent-child relationship, an adult responsible for a child under juvenile court jurisdiction, or a peace officer who has lawfully taken custody and reasonably believes the minor needs immediate treatment, may consent to medical, dental, psychological and surgical treatment. That consent must be in writing, signed, and given to the practitioner or facility administering treatment, and must state the child's name, the parents' names if known along with any managing conservator or guardian, the consenting person's name and relationship to the child, the nature of the treatment, and the date treatment is to begin.

What this means operationally

Texas answers the personal-representative question with a ranked list and a document, which is unusually concrete. Two conditions do the work and both are easy to lose at the desk: the person with the right to consent must be uncontactable, and they must not have said no. So the record has to show the attempt to reach the parent, not merely the relative's signature. The five required contents of the form are a checklist a practice can actually hold itself to.

Applies when

The person with the right to consent cannot be contacted
That person has not given actual notice to the contrary
The consenting person falls within the enumerated list

Exceptions

The section does not apply to consent for the immunization of a child, which runs under § 32.101 instead
Consent for a child committed to the Texas Juvenile Justice Department, or for whom the Department of Family and Protective Services is managing conservator, is governed separately

StatewideTex. Fam. Code §§ 32.001, 32.002Children whose parent or guardian cannot be reachedVerified 2026-08-29

What applies to telehealth practices everywhere

Telehealth distributes the clinical environment across platforms, homes, devices, networks, recordings, messaging, and multiple states. Every one of those locations and systems becomes part of the practice's security and privacy responsibility.

The telehealth platform, its configuration, administrative access, integrations, waiting-room controls, chat, metadata, and recording features

Every clinician device, home-office environment, local network, headset, camera, screen, and physical privacy condition

EHR, intake, scheduling, patient portal, e-prescribing, laboratory, billing, and payment systems

Session recordings, transcripts, chat logs, uploaded documents, asynchronous messages, and cloud storage

Email, text, support, after-hours communication, and patient identity-verification workflows

Remote workforce onboarding, access changes, device loss, account compromise, and termination

Full telehealthcompliance guide →

Knowing the Texas rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Texas rules on this page.

Start the risk assessment