SB1188

SB1188 creates a Texas electronic-health-record framework covering storage, access, specified record fields, diagnostic AI and enforcement. It uses the broad state-law definition of “covered entity,” which can reach health-information businesses, payers, government units, providers and specified employees or contractors—not just doctors. It expressly includes health care practitioners but excludes the specified home/community-support agencies, nursing facilities, continuing-care facilities, assisted-living facilities, intermediate-care facilities and day-activity/health-services facilities licensed or regulated under the listed statutes, plus Texas Home Living or Home and Community-based Services waiver providers. The exclusions are tied to the statutes/programs named in the act. Final law, section 183.001; Referenced covered-entity definition.

Storage and access: Covered entities must physically maintain controlled electronic health records containing patient information in the United States or a U.S. territory, including third-party, subcontracted and cloud storage. Texas residents’ record information, other than open data, must be accessible only to people needing it for employment duties related to treatment, payment or health-care operations. Entities must use reasonable and appropriate administrative, physical and technical safeguards for confidentiality, integrity and availability. The final law uses a work-related access test; it does not retain the introduced bill’s blanket prohibition on access by anyone outside the United States. Final law, section 183.002.

Record content and AI: Records must offer practitioners an option to collect and record communications between covered entities about metabolic health and diet in treating chronic disease or illness. Entities may not collect, store or share credit-score or voter-registration information in the electronic health record. Practitioners may use AI diagnostically only within their professional authorization, where that use is not otherwise prohibited or restricted by state or federal law, and with review of all AI-created records consistent with Texas Medical Board medical-record standards. They must disclose that diagnostic AI use to patients. This is not permission for an unlicensed AI system to practice medicine. Final law, sections 183.003–183.005.

Minors: Record systems must allow a parent—or the applicable managing conservator or guardian—immediate, complete and unrestricted access, unless state law, federal law or a court order restricts access to all or part of the record. The provision covers people 17 or younger who have not had the disabilities of minority removed for general purposes; it is not an override of every confidentiality exception. Final law, section 183.006.

Sex-related fields: The designated state agencies must jointly ensure records have a separate space to document male or female biological sex based on the practitioner’s observation recorded at birth, plus information about a “sexual development disorder” identified at birth or later. The act defines that term as a congenital condition involving atypical development of internal or external genital structures, including a chromosomal, gonadal or anatomic abnormality; its male/female definitions refer to reproductive systems developed to produce sperm/ova. Record-based algorithms and decision-assistance tools must include the designated biological-sex information. Other spaces for biological-sex or gender-identity information remain permitted. The designated birth-based field can be amended only to correct a clerical error, or following a sexual-development-disorder diagnosis to the opposite listed sex; in the latter case, the disorder information must be recorded in its designated space. Final law, sections 183.001 and 183.007–183.008.

Enforcement: State regulators must investigate credible allegations while complying with applicable state and federal law, including HIPAA. Regulatory discipline, potentially including suspension or revocation, is authorized after three or more violations. Separately, the attorney general may seek an injunction or civil penalties: up to $5,000 per negligent violation occurring in a single year or $25,000 per knowing/intentional violation occurring in a single year, regardless of its duration within that year; or up to $250,000 per violation involving knowing/intentional use of protected health information for financial gain. Those are caps, not automatic fines, and the civil-action provision does not require three prior violations. The relevant agencies must enter an implementation memorandum and adopt rules as necessary. Final law, sections 183.009–183.012.

Signed June 20, 2025, the act took effect September 1, 2025. Generally, it applies to electronic health records prepared from that date forward. Section 183.002 applies to storage from January 1, 2026, regardless of when the record was prepared. If an agency determines federal permission is needed before implementing a provision, it must request it and may delay that provision until permission is granted; this is not an automatic delay of the entire act. Final law, sections 2–4; Official history.