HIPAA compliance for therapy practices in Texas

Texas keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Texas has 10 recorded rules that apply to therapy practices differently from other businesses in the state — set out below with their conditions and sources.

Texas jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Texas's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

A therapy practice is a HIPAA covered entity when it or a service acting for it electronically conducts an HHS-adopted standard transaction, such as a claim or eligibility inquiry. Cash-pay status alone does not answer the question. Covered practices must complete every duty below; non-covered practices may still be governed by state mental-health privacy, professional, and contractual requirements.

State — how Texas law interacts with HIPAA

Texas substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Therapy practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Chapter 521 applies alongside HIPAA. Compliance with one does not necessarily satisfy the other's timing, threshold, or regulator-notification requirements. Texas also maintains the Texas Medical Records Privacy Act (Tex. Health & Safety Code Ch. 181), which imposes additional state-law obligations on covered entities.

What Texas adds for therapy practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Texas's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Minor may consent

A child may consent to counseling for suicide prevention, chemical addiction or dependency, or sexual, physical or emotional abuse. A licensed or certified physician, psychologist, counselor or social worker having reasonable grounds to believe that a child has been sexually, physically or emotionally abused, is contemplating suicide, or is suffering from a chemical or drug addiction or dependency may counsel the child without parental consent.

Service: counseling
Provider class: a licensed or certified physician, psychologist, counselor or social worker
Patient population: minors presenting with suicidality, chemical dependency, or abuse

What this means operationally

The authority opens on a clinical belief about one of three specified conditions, so the record needs to show the reasonable grounds that opened it. This is not a general age-based counseling consent — a practice cannot rely on it for counseling outside those three categories, and the presenting concern therefore has to be documented before the consent is.

Applies when

The counseling concerns suicide prevention, chemical addiction or dependency, or sexual, physical or emotional abuse
The counselor is a licensed or certified physician, psychologist, counselor or social worker
The professional has reasonable grounds to believe one of the specified conditions is present

State statuteTex. Fam. Code § 32.004(a)–(b)Minors presenting with suicidality, chemical dependency, or abuseVerified 2026-08-29

Payment liability

A parent, managing conservator or guardian who has not consented to counseling treatment of the child is not obligated to compensate the physician, psychologist, counsellor or social worker for counseling services rendered under § 32.004.

Service: counseling for suicide prevention, chemical addiction or dependency, or sexual, physical or emotional abuse

What this means operationally

Texas allocates cost the same way Maryland does and the opposite way from Minnesota, which is why this cannot be generalised across states: bill the non-consenting parent in Texas and the practice is pursuing someone the statute says does not owe it. Because § 32.004 counseling is exactly the care a minor is most likely to want kept private, the billing decision and the confidentiality decision are the same decision.

Applies when

The counseling was rendered under § 32.004 without the parent's consent

Exceptions

A parent who did consent to the counseling is not relieved of the obligation

State statuteTex. Fam. Code § 32.004(e)Minors receiving counseling under § 32.004Verified 2026-08-29

Minor confidentiality

Release prohibited

Communications between a patient and a professional, and records of the identity, diagnosis, evaluation or treatment of a patient created or maintained by a professional, are confidential and may not be disclosed except as provided by §§ 611.004, 611.0041 or 611.0045. No exception to the privilege of confidentiality under § 611.004 may be construed to create an independent duty or requirement to disclose the information to which the exception applies. The section applies regardless of when the patient received services.

Service: diagnosis, evaluation or treatment of a mental or emotional condition, including alcoholism or drug addiction
Provider class: a professional as defined in § 611.001

What this means operationally

Subsection (b-1) is the sentence to build policy around, and it was added in 2021. A permitted disclosure is not a required one — so a parent who points at a statutory exception is establishing that the practice MAY release, never that it must. That distinction is what lets a Texas behavioral-health practice hold a line without being in breach, and it is the exact place staff most often concede.

Applies when

The record concerns the diagnosis, evaluation or treatment of a mental or emotional condition

Exceptions

Disclosure is permitted under §§ 611.004, 611.0041 and 611.0045

State statuteTex. Health & Safety Code § 611.002Patients of a mental-health professional, minors includedVerified 2026-08-29

Parental access to records

Parental right of access

A patient is entitled to have access to the content of a confidential mental health record made about the patient, except as otherwise provided by the section. The professional may deny access to any portion of a record if the professional determines that release of that portion would be harmful to the patient's physical, mental, or emotional health. The content shall be made available to a person acting on the patient's behalf, including a parent where the patient is a minor.

Provider class: the professional holding the mental health record
Service: confidential mental health records under chapter 611

What this means operationally

The right belongs to the PATIENT. A parent reaches the record under § 611.0045(f) as a person listed by § 611.004(a)(4) ACTING ON THE PATIENT'S BEHALF, which is not the same as a parental right of access in their own name — the acting-on-behalf condition has to hold. The brake is then portion-by-portion: access may be denied to any part whose release would be harmful, with written reasons and re-evaluation on a subsequent request, and the remainder must still be produced. A release workflow that can only grant or deny in full cannot implement this, and a blanket refusal is not what the section contemplates.

Applies when

The record is a confidential mental health record under chapter 611
The person seeking access is listed by § 611.004(a)(4) or (5) and is acting on the patient's behalf

Exceptions

The professional may deny access to any portion whose release would be harmful to the patient's physical, mental or emotional health, with written reasons and re-evaluation on a subsequent request
The remainder of the record must still be made available

State statuteTex. Health & Safety Code §§ 611.0045, 611.004(a)(4)Minors with confidential mental health recordsVerified 2026-08-29

Provider may disclose, subject to a test

A professional may disclose confidential mental health information to a person who has the written consent of the patient, or of a parent if the patient is a minor, or of a guardian if the patient has been adjudicated incompetent to manage their personal affairs. The privilege of confidentiality may be claimed by the patient, by such a person acting on the patient's behalf, or by the professional on the patient's behalf, and the professional's authority to claim it is presumed absent evidence to the contrary.

Service: mental health records
Patient population: minors

What this means operationally

Texas and Maryland answer the same question in opposite directions. Maryland routes record access through whoever gave consent for the treatment; Texas names the parent as the consent-giver for a minor's mental-health record directly, without asking who consented to the care. So a Texas practice cannot reason from the consent route to the access answer the way a Maryland one can. What it has instead is § 611.003's presumption that the professional may claim the privilege on the patient's behalf, and § 611.0045(b)'s harm-based denial.

Applies when

A disclosure of a minor's mental health record is sought on written consent

Exceptions

§ 611.0045(b) still allows the professional to deny access to a portion whose release would be harmful to the patient
An exception to confidentiality does not create a duty to disclose

State statuteTex. Health & Safety Code §§ 611.003, 611.004(a)(4)Minors with a Texas mental-health recordVerified 2026-08-29

Provider disclosure to a parent

Provider may disclose

A licensed or certified physician, psychologist, counsellor or social worker counseling a child under § 32.004 may, with or without the consent of the child who is a client, advise the child's parents or, if applicable, managing conservator or guardian of the treatment given to or needed by the child. Unless consent is obtained as otherwise allowed by law, such a practitioner may not counsel a child if consent is prohibited by a court order.

Service: counseling under § 32.004
Provider class: a physician, psychologist, counselor or social worker
Patient population: minors counseled under § 32.004

What this means operationally

A permission running one way and a bar running the other, both addressed to the same practitioner. The disclosure permission is unusually wide — it survives the child's objection — while the court-order bar removes the counseling authority altogether rather than merely limiting what may be said. Because the bar is external to anything the practice can observe, the operational question is whether intake has a route to learn that an order exists.

Applies when

The counseling was provided under § 32.004

Exceptions

A practitioner may not counsel the child where consent is prohibited by a court order, unless consent is obtained as otherwise allowed by law

State statuteTex. Fam. Code § 32.004(b)(2), (c)Minors counseled under § 32.004Verified 2026-08-29

Psychotherapy and mental-health records

Parental right of access

A patient is entitled to examine or copy all or part of the patient's recorded mental health care information on written request to the professional.

Service: recorded mental health care information

What this means operationally

The entitlement itself, separated from the fifteen-day deadline and the fee condition that the same section attaches to it. Kept apart because they change different parts of a workflow: whether the patient may have the record at all, when the answer is owed, and what may be charged before it is handed over.

Applies when

A patient makes a written request for their mental health care information

State statuteTex. Health & Safety Code § 611.008, access entitlementPatients requesting their own mental health recordVerified 2026-08-29

Left to professional judgment

A patient or a patient's legally authorized representative may revoke a disclosure consent at any time, and the revocation is valid only if written, dated and signed by the patient or representative. A patient may not revoke a disclosure that is required for purposes of making payment to the professional for mental health care services provided. A patient may not maintain an action against a professional for a disclosure made in good-faith reliance on an authorization where the professional did not have notice of the revocation.

Service: disclosure of mental health information on consent

What this means operationally

Good-faith reliance protects the practice only up to the moment it has notice, so the operational requirement is a defined point at which a revocation is received and recorded — a revocation sitting unopened still starts the clock on notice arguments. The payment carve-out is the one a patient is most likely to be surprised by, and it is worth saying plainly at the point consent is taken rather than at the point it is revoked.

Applies when

A patient or legally authorized representative revokes a disclosure consent

Exceptions

Payment-related disclosures cannot be revoked
A revocation is valid only if written, dated and signed

State statuteTex. Health & Safety Code § 611.007Patients who consented to a disclosureVerified 2026-08-29

Patient access to records

Deadline to respond to an access request

On receipt of a written request from a patient to examine or copy all or part of the patient's recorded mental health care information, the professional shall, as promptly as required under the circumstances but not later than the 15th day after the date of receiving the request, make the information available for examination during regular business hours and provide a copy if requested, or inform the patient that the information does not exist or cannot be found.

Service: recorded mental health care information

What this means operationally

Fifteen days, and the clock starts on receipt of the written request rather than on any internal triage. The branch practices most often miss is the second one: telling the patient the record does not exist or cannot be found is itself a compliant response within the deadline, which means silence is not, and a search that comes up empty still has to be answered in writing on time.

Applies when

A patient makes a written request for their mental health care information

State statuteTex. Health & Safety Code § 611.008(a)Patients requesting their own mental health recordVerified 2026-08-29

Copy fees, format and delivery

Limit on copy fees, format or delivery

Unless provided for by other state law, the professional may charge a reasonable fee for retrieving or copying mental health care information and is not required to permit examination or copying until the fee is paid, unless there is a medical emergency. A professional may not charge a fee for copying mental health care information to the extent the fee is prohibited under Subchapter M, Chapter 161.

Service: retrieving or copying mental health care information

What this means operationally

Payment may be made a precondition of access here, which is unusual and cuts against the instinct that a records request must be answered first and billed after. Two limits keep it from being absolute: a medical emergency defeats it entirely, and Subchapter M of Chapter 161 bars the fee outright in the cases it covers. Because withholding for non-payment sits alongside a fifteen-day deadline, a practice needs to invoice immediately rather than at the end of the period.

Applies when

A patient requests retrieval or copying of mental health care information

Exceptions

No withholding where there is a medical emergency
No fee where prohibited under Subchapter M, Chapter 161

State statuteTex. Health & Safety Code § 611.008(b), (c)Patients requesting their own mental health recordVerified 2026-08-29

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Texas breach obligations

These apply to businesses generally rather than to therapy practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Texasbreach data →

Individual notice deadline

As quickly as possible and, unless certain law-enforcement or scope-determination exceptions apply, no later than 60 days after determining that the breach occurred.

The outer bound of 60 days aligns with HIPAA's 60-day individual-notice window in duration, but federal and state duties apply independently and may impose different content, recipient, or trigger requirements.

State regulator notice

Required at 250+ residents

The Attorney General must be notified when a breach involves at least 250 Texas residents. Notification is made through the online form maintained by the AG's office.

Source: Tex. Bus. & Com. Code § 521.053(b)

Statewide rules that also reach therapy practices

Minor may consent

Where the person with the right to consent cannot be contacted and has given no actual notice to the contrary, a grandparent, adult sibling, adult aunt or uncle, an educational institution the child attends holding written authorization, an adult with actual care, control and possession of the child holding written authorization, a court with jurisdiction over a suit affecting the parent-child relationship, an adult responsible for a child under juvenile court jurisdiction, or a peace officer who has lawfully taken custody and reasonably believes the minor needs immediate treatment, may consent to medical, dental, psychological and surgical treatment. That consent must be in writing, signed, and given to the practitioner or facility administering treatment, and must state the child's name, the parents' names if known along with any managing conservator or guardian, the consenting person's name and relationship to the child, the nature of the treatment, and the date treatment is to begin.

What this means operationally

Texas answers the personal-representative question with a ranked list and a document, which is unusually concrete. Two conditions do the work and both are easy to lose at the desk: the person with the right to consent must be uncontactable, and they must not have said no. So the record has to show the attempt to reach the parent, not merely the relative's signature. The five required contents of the form are a checklist a practice can actually hold itself to.

Applies when

The person with the right to consent cannot be contacted
That person has not given actual notice to the contrary
The consenting person falls within the enumerated list

Exceptions

The section does not apply to consent for the immunization of a child, which runs under § 32.101 instead
Consent for a child committed to the Texas Juvenile Justice Department, or for whom the Department of Family and Protective Services is managing conservator, is governed separately

StatewideTex. Fam. Code §§ 32.001, 32.002Children whose parent or guardian cannot be reachedVerified 2026-08-29

What applies to therapy practices everywhere

Behavioral health practices hold information whose exposure can affect a patient's employment, family relationships, safety, custody matters, reputation, and willingness to continue treatment. The SRA must reflect the sensitivity and the actual way therapy is delivered.

The EHR or practice-management system and the access available to clinicians, supervisors, billing personnel, and administrative staff

Telehealth platforms, clinician home offices, personal or practice-issued devices, local networks, waiting rooms, chat logs, and recordings

Patient portals, scheduling tools, intake forms, email, text messaging, and after-hours communication

The creation, separation, storage, access, and disclosure of psychotherapy notes when the practice maintains them

Supervision, peer consultation, case-review, and group-therapy documentation workflows

Billing services, payment systems, cloud storage, backup, transcription, and other vendors that handle PHI on the practice's behalf

Full therapistscompliance guide →

Knowing the Texas rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Texas rules on this page.

Start the risk assessment