A covered entity shall ensure that electronic health records under the control of the entity that contain patient information are physically maintained in the United States or a territory of the United States. This subsection applies to: (1) electronic health records that are stored by a third-party or subcontracted computing facility or an entity that provides cloud computing services; and (2) electronic health records that are stored using a technology through which patient information may be electronically retrieved, accessed, or transmitted.

(b) A covered entity shall ensure that the electronic health record information of this state's residents, other than open data, is accessible only to individuals who require the information to perform duties within the scope of the individual's employment related to treatment, payment, or health care operations. (c) Each covered entity shall implement reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic health record information.

A covered entity shall ensure each electronic health record maintained for an individual includes the option for a health care practitioner to collect and record communications between two or more covered entities related to the individual's metabolic health and diet in the treatment of a chronic disease or illness.

A covered entity may not collect, store, or share any information regarding an individual's credit score or voter registration status in the individual's electronic health record.

A health care practitioner may use artificial intelligence for diagnostic purposes, including the use of artificial intelligence for recommendations on a diagnosis or course of treatment based on a patient's medical record, if: (1) the practitioner is acting within the scope of the practitioner's license, certification, or other authorization to provide health care services in this state, regardless of the use of artificial intelligence; (2) the particular use of artificial intelligence is not otherwise restricted or prohibited by state or federal law; and (3) the practitioner reviews all records created with artificial intelligence in a manner that is consistent with medical records standards developed by the Texas Medical Board.

A health care practitioner who uses artificial intelligence for diagnostic purposes as described by Subsection (a) must disclose the practitioner's use of that technology to the practitioner's patients.

(a) In this section, "minor" means an individual 17 years of age or younger who has not had the disabilities of minority removed for general purposes. (b) A covered entity shall ensure each electronic health record system the entity uses to store electronic health records of minors allows a minor's parent or, if applicable, the minor's managing conservator or guardian to obtain complete and unrestricted access to the minor's electronic health record immediately, unless access to all or part of the record is restricted under state or federal law or by a court order.

(a) Notwithstanding any other law, the commission, the Texas Medical Board, and the Texas Department of Insurance shall jointly ensure that: (1) each electronic health record prepared or maintained by a covered entity in this state includes a separate space for the entity to document: (A) an individual's biological sex as either male or female based on the individual's observed biological sex recorded by a health care practitioner at birth; and (B) information on any sexual development disorder of the individual, whether identified at birth or later in the individual's life; and (2) any algorithm or decision assistance tool included in an electronic health record to assist a health care practitioner in making medical treatment decisions includes an individual's biological sex as recorded in the space described by Subdivision (1)(A). (b) This section does not prohibit an electronic health record from including spaces for recording other information related to an individual's biological sex or gender identity.

(a) A covered entity may amend on an electronic health record an individual's biological sex as recorded in the space described by Section 183.007(a)(1)(A) only if: (1) the amendment is to correct a clerical error; or (2) the individual is diagnosed with a sexual development disorder and the amendment changes the individual's listed biological sex to the opposite biological sex. (b) If an individual's biological sex is amended under Subsection (a)(2), the covered entity shall include in the individual's electronic health record information on the individual's sexual development disorder in the space described by Section 183.007(a)(1)(B).

The commission or the appropriate regulatory agency shall conduct an investigation of any credible allegation of a violation of this chapter by a covered entity. The commission or agency shall ensure the investigation is conducted in compliance with all applicable state and federal laws, including the Health Insurance Portability and Accountability Act of 1996 (Pub. L. No. 104-191).

The appropriate regulatory agency may take disciplinary action against a covered entity that violates this chapter three or more times in the same manner as if the covered entity violated an applicable licensing or regulatory law. The disciplinary action may include license, registration, or certification suspension or revocation for a period the agency determines appropriate.

(a) The attorney general may institute an action for injunctive relief to restrain a violation of this chapter. (b) In addition to the injunctive relief provided by Subsection (a), the attorney general may institute an action for civil penalties against a covered entity for a violation of this chapter. A civil penalty assessed under this section may not exceed: (1) $5,000 for each violation that is committed negligently and that occurs in a single year, regardless of how long the violation continues during that year; (2) $25,000 for each violation that is committed knowingly or intentionally and that occurs in a single year, regardless of how long the violation continues during that year; or (3) $250,000 for each violation in which the covered entity knowingly or intentionally used protected health information for financial gain.

The executive commissioner, the Texas Medical Board, the Texas Department of Licensing and Regulation, the Texas Department of Insurance, and each regulatory agency subject to this chapter shall enter into a memorandum of understanding and, as necessary, adopt rules to implement this chapter.