New Texas Electronic Health Record Law Exceeds HIPAA Requirements

Texas covered entities (health care providers, health insurers and clearinghouses) and other entities that use and disclose PHI of Texas residents using electronic health records (EHRs) face new risks and stringent requirements under HB300, a new Texas privacy law.

The new law, which is effective September 1, 2012, is more stringent than HIPAA, and imposes a variety of new requirements on Texas covered entities and others. Highlights include the following:

• Covered entities must provide patients with electronic access to their EHRs within 15 business days of a written request
• Initial HIPAA training must be provided to an entity's entire workforce and repeated at least once very two years.