2025 Texas sessionsRegular and both called sessions have ended. This index covers House and Senate bills, not resolutions. Statuses come from official reports.

2025 · Regular session · Senate bill

SB672

SB672 requires covered hospitals to send the Texas Health and Human Services Commission a written summary of how they plan to divert emergency patients during a cyberattack or electrical power outage.

Read bill highlights ↓

Official caption: Relating to a requirement that certain hospitals submit a summary of parts of their emergency operations plans to the Health and Human Services Commission.

Signed by governorSource-checked explanation published

Official report lists Senate author(s): Hughes. This does not identify sponsors or amendment drafters.

Report an error ↗

Bill explanation published · Version and amendment review scope is stated below · Individual amendment records may not be separately annotated.

Bill highlights

Selected points from the published explanation. Follow each point to its source-linked context; conditions and limits may matter.

SB672 requires covered hospitals to send the Texas Health and Human Services Commission a written summary of how they plan to divert emergency patients during a cyberattack or electrical power outage.
For this requirement, an emergency operations plan is the hospital’s process for temporarily routing emergency patients elsewhere when its emergency-service capacity is significantly diminished and sending patients there would likely cause substantially delayed care and worse outcomes than routing them to another hospital or health facility.
When that part of the plan changes, the hospital must update its summary and submit it within 30 days after its governing body adopts the changes or the appropriate administrator otherwise approves them.

Read the full explanation ↓

What does it do?

SB672 requires covered hospitals to send the Texas Health and Human Services Commission a written summary of how they plan to divert emergency patients during a cyberattack or electrical power outage. It applies only to hospitals licensed under Health and Safety Code Chapter 241 that have an emergency department or otherwise regularly provide emergency services—not every health care facility. New Section 311.025(a)–(c); Chapter 241 exemptions; Hospital licensing requirement.

For this requirement, an emergency operations plan is the hospital’s process for temporarily routing emergency patients elsewhere when its emergency-service capacity is significantly diminished and sending patients there would likely cause substantially delayed care and worse outcomes than routing them to another hospital or health facility. The required submission is the summary of the plan’s emergency-department diversion provisions for the two specified disruptions, not the hospital’s entire emergency plan. Section 311.025(a)(2) and (c).

When that part of the plan changes, the hospital must update its summary and submit it within 30 days after its governing body adopts the changes or the appropriate administrator otherwise approves them. The submitted summary is confidential and exempt from public disclosure under the Public Information Act; the provision does not declare every hospital record confidential. Signed June 20, 2025, the law took effect September 1, 2025, with initial compliance required by December 1, 2025. Section 311.025(d)–(e) and Sections 2–3; Official history.

What changed along the way?

The introduced bill called the document a “diversion plan” and titled the provision around emergency-department diversion plans. The Senate substitute renamed it an “emergency operations plan,” including the heading and submission requirement. A complete comparison shows no other operative change: the patient-routing definition, cyberattack and outage focus, 30-day update deadline, confidentiality and compliance dates stayed the same. The Senate committee, engrossed, House committee and enrolled operative texts match. The amendment index lists no floor amendments, and the House committee reported without amendments. Introduced proposal; Senate substitute; All versions; Amendment index.

This is a new submission and update duty. The act does not itself require a particular backup generator, cybersecurity product or patient-routing decision, and it does not establish an HHSC plan-approval process. Chapter 241’s licensing framework already applies to private and covered local-government hospitals, while exempting specified other facilities. Scope of the new requirement; Existing exemptions; Existing licensing framework.

For the full amendment record, open the official amendment index.

Official bill versions

Compare the published text versions in the official text index. A change is not attributed to a specific amendment here without a verified record.

Who could benefit—and who could bear the costs?

The commission gains a record of covered hospitals’ diversion arrangements for two disruptions that can affect emergency care. Hospitals must prepare summaries and track changes; confidentiality limits public access to the submitted summaries. These are potential preparedness and administrative effects, not evidence that the act prevents cyberattacks, ensures uninterrupted power or improves patient outcomes in a measured amount. The reviewed sources do not establish whether every hospital met the December 2025 deadline. Reporting, update and confidentiality provisions.

All three fiscal notes—April 21 for the introduced bill, April 26 for the substitute and May 15 for the engrossed bill—anticipate no significant fiscal impact to the state or local governments. State costs are assumed absorbable with existing resources. That is not a finding that hospitals incur no paperwork costs; the notes give no quantified private-hospital cost or patient benefit. The act makes no appropriation. Introduced fiscal note; Substitute fiscal note; Engrossed fiscal note.

Official sources

Catalog report retrieved 2026-10-25. Check the official record for corrections or later changes.