Regulon — TX-SB-1188 · TX SB 1188 (Electronic Health Records & AI Diagnostics)

WHAT THIS BILL REGULATES · 2 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

The attorney general may institute actions for injunctive relief and civil penalties. The appropriate regulatory agency (including the Texas Medical Board) may take disciplinary action against covered entities that violate the chapter three or more times. The commission or appropriate regulatory agency must investigate credible allegations of violations. No private right of action is created.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

Civil penalties assessed by the attorney general: up to $5,000 per negligent violation per year; up to $25,000 per knowing or intentional violation per year; up to $250,000 per violation involving knowing or intentional use of protected health information for financial gain. Injunctive relief is also available. Regulatory agencies may take disciplinary action including license, registration, or certification suspension or revocation for three or more violations.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Health & Safety Code § 183.001

Definitions

In this chapter: (1) "Biological sex" means the biological trait that determines whether a sexually reproducing organism produces male or female gametes. (2) "Covered entity" has the meaning assigned by Section 181.001. The term includes a health care practitioner. The term does not include: (A) a home and community support services agency licensed under Chapter 142; (B) a nursing facility licensed under Chapter 242; (C) a continuing care facility regulated under Chapter 246; (D) an assisted living facility licensed under Chapter 247; (E) an intermediate care facility licensed under Chapter 252; (F) a day activity and health services facility licensed under Chapter 103, Human Resources Code; or (G) a provider under the Texas home living (TxHmL) or home and community-based services (HCS) waiver program. (3) "Female" means an individual whose reproductive system is developed to produce ova. (4) "Health care practitioner" means an individual who is licensed, certified, or otherwise authorized to provide health care services in this state. (5) "Male" means an individual whose reproductive system is developed to produce sperm. (6) "Sexual development disorder" means a congenital condition associated with atypical development of internal or external genital structures. The term includes a chromosomal, gonadal, or anatomic abnormality.

Section 183.001 establishes the defined terms used throughout Chapter 183. The key term is covered entity, which incorporates the existing Section 181.001 definition and adds health care practitioners while carving out several facility types including nursing facilities, assisted living facilities, and certain home- and community-based service providers.

Health & Safety Code § 183.002

Requirements for electronic health record storage

Deployer

(a) 1 A covered entity shall ensure that electronic health records under the control of the entity that contain patient information are physically maintained in the United States or a territory of the United States. This subsection applies to: (1) electronic health records that are stored by a third-party or subcontracted computing facility or an entity that provides cloud computing services; and (2) electronic health records that are stored using a technology through which patient information may be electronically retrieved, accessed, or transmitted.

(b) 2 A covered entity shall ensure that the electronic health record information of this state's residents, other than open data, is accessible only to individuals who require the information to perform duties within the scope of the individual's employment related to treatment, payment, or health care operations.

(c) 3 Each covered entity shall implement reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic health record information.

Section 183.002 imposes three data governance requirements on covered entities: (1) EHRs must be physically stored within the United States or its territories, including records held by third-party cloud providers; (2) access to resident EHR data (other than open data) must be restricted to individuals who need the information for treatment, payment, or health care operations; and (3) covered entities must implement reasonable administrative, physical, and technical safeguards for EHR confidentiality, integrity, and availability.

These obligations are general health data governance requirements rather than AI-specific obligations. They apply to all electronic health records regardless of whether AI is involved.

Compliance actions 3 items

Covered entities must ensure that all electronic health records containing patient information are physically stored within the United States or a U.S. territory, including records stored by third-party computing facilities, cloud services providers, or any technology through which patient information may be electronically retrieved, accessed, or transmitted.

—

Covered entities must ensure that electronic health record information of Texas residents (other than open data) is accessible only to individuals who require the information to perform duties within the scope of their employment related to treatment, payment, or health care operations.

—

Covered entities must implement reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic health record information.

—

Health & Safety Code § 183.003

Required medical history information in electronic health record

Deployer

4 A covered entity shall ensure each electronic health record maintained for an individual includes the option for a health care practitioner to collect and record communications between two or more covered entities related to the individual's metabolic health and diet in the treatment of a chronic disease or illness.

Section 183.003 requires covered entities to ensure each EHR includes the option for a health care practitioner to collect and record inter-entity communications related to a patient's metabolic health and diet in the treatment of chronic disease or illness. This is a record-keeping requirement with no AI dimension.

Compliance actions 1 item

Covered entities must ensure each electronic health record includes the option for a health care practitioner to collect and record inter-entity communications related to the individual's metabolic health and diet in the treatment of a chronic disease or illness.

—

Health & Safety Code § 183.004

Information restrictions in electronic health record

Deployer

5 A covered entity may not collect, store, or share any information regarding an individual's credit score or voter registration status in the individual's electronic health record.

Section 183.004 prohibits covered entities from collecting, storing, or sharing an individual's credit score or voter registration status in an electronic health record. This is a data prohibition with no AI dimension.

Compliance actions 1 item

Covered entities must not collect, store, or share any information regarding an individual's credit score or voter registration status in the individual's electronic health record.

—

Health & Safety Code § 183.005

Artificial intelligence in electronic health record

Professional

(a) 6 A health care practitioner may use artificial intelligence for diagnostic purposes, including the use of artificial intelligence for recommendations on a diagnosis or course of treatment based on a patient's medical record, if: (1) the practitioner is acting within the scope of the practitioner's license, certification, or other authorization to provide health care services in this state, regardless of the use of artificial intelligence; (2) the particular use of artificial intelligence is not otherwise restricted or prohibited by state or federal law; and (3) the practitioner reviews all records created with artificial intelligence in a manner that is consistent with medical records standards developed by the Texas Medical Board.

(b) 7 A health care practitioner who uses artificial intelligence for diagnostic purposes as described by Subsection (a) must disclose the practitioner's use of that technology to the practitioner's patients.

Section 183.005 is the bill's AI-specific provision. It permits health care practitioners to use AI for diagnostic purposes — including diagnosis recommendations and treatment course recommendations based on patient records — subject to three conditions: the practitioner must be acting within their license scope, the AI use must not be otherwise prohibited, and the practitioner must review all AI-created records consistent with Texas Medical Board standards.

Subsection (b) requires practitioners using AI for diagnostics to disclose that use to their patients. This creates both a human oversight obligation (practitioner review of AI records) and a transparency obligation (patient disclosure of AI use).

Compliance actions 2 items

Health care practitioners may use AI for diagnostic purposes (including AI-generated recommendations on diagnosis or course of treatment based on a patient's medical record) only if: (1) the practitioner is acting within the scope of their license, certification, or other authorization to provide health care services in Texas; (2) the particular AI use is not otherwise restricted or prohibited by state or federal law; and (3) the practitioner reviews all records created with AI in a manner consistent with medical records standards developed by the Texas Medical Board.

HC-02.1

Health care practitioners who use AI for diagnostic purposes must disclose their use of AI technology to their patients.

HC-01.6

Health & Safety Code § 183.006

Access to electronic health record of minor

Deployer

(a)–(b) 8 In this section, "minor" means an individual 17 years of age or younger who has not had the disabilities of minority removed for general purposes. (b) A covered entity shall ensure each electronic health record system the entity uses to store electronic health records of minors allows a minor's parent or, if applicable, the minor's managing conservator or guardian to obtain complete and unrestricted access to the minor's electronic health record immediately, unless access to all or part of the record is restricted under state or federal law or by a court order.

Section 183.006 requires covered entities to ensure their EHR systems allow a minor's parent, managing conservator, or guardian to obtain complete and unrestricted access to the minor's electronic health record immediately, unless access is restricted by state or federal law or a court order. This is a parental access right with no AI dimension.

Compliance actions 1 item

Covered entities must ensure their EHR systems allow a minor's parent, managing conservator, or guardian to obtain complete and unrestricted immediate access to the minor's electronic health record, unless access is restricted by state or federal law or court order.

—

Health & Safety Code § 183.007

Electronic health record requirements regarding biological sex

DeployerDeveloper

(a)(1) 9 Notwithstanding any other law, the commission, the Texas Medical Board, and the Texas Department of Insurance shall jointly ensure that: (1) each electronic health record prepared or maintained by a covered entity in this state includes a separate space for the entity to document: (A) an individual's biological sex as either male or female based on the individual's observed biological sex recorded by a health care practitioner at birth; and (B) information on any sexual development disorder of the individual, whether identified at birth or later in the individual's life;

(a)(2) 10 and (2) any algorithm or decision assistance tool included in an electronic health record to assist a health care practitioner in making medical treatment decisions includes an individual's biological sex as recorded in the space described by Subdivision (1)(A).

(b) This section does not prohibit an electronic health record from including spaces for recording other information related to an individual's biological sex or gender identity.

Section 183.007 mandates that every EHR maintained by a covered entity include a separate space for documenting biological sex (male or female, as observed at birth) and any sexual development disorder. Critically for AI compliance, subsection (a)(2) requires that any algorithm or decision assistance tool included in an electronic health record to assist a practitioner in medical treatment decisions must incorporate the individual's recorded biological sex. This creates an AI data-input mandate for clinical decision-support tools.

Compliance actions 2 items

Covered entities must ensure each electronic health record includes a separate space to document: (1) the individual's biological sex as either male or female based on the observed biological sex recorded by a health care practitioner at birth, and (2) information on any sexual development disorder of the individual, whether identified at birth or later in life.

—

Any algorithm or decision assistance tool included in an electronic health record to assist a health care practitioner in making medical treatment decisions must include the individual's biological sex as recorded in the EHR.

HC-01.3

Health & Safety Code § 183.008

Amending certain biological sex information in electronic health records

Deployer

(a)–(b) 11 A covered entity may amend on an electronic health record an individual's biological sex as recorded in the space described by Section 183.007(a)(1)(A) only if: (1) the amendment is to correct a clerical error; or (2) the individual is diagnosed with a sexual development disorder and the amendment changes the individual's listed biological sex to the opposite biological sex. (b) If an individual's biological sex is amended under Subsection (a)(2), the covered entity shall include in the individual's electronic health record information on the individual's sexual development disorder in the space described by Section 183.007(a)(1)(B).

Section 183.008 restricts amendments to the biological sex field in EHRs. The biological sex recorded under § 183.007(a)(1)(A) may only be amended to correct a clerical error or when the individual is diagnosed with a sexual development disorder and the amendment changes the listed sex to the opposite sex. If amended for a sexual development disorder, the entity must also document the disorder in the designated field. This is a record integrity provision with no AI dimension.

Compliance actions 1 item

Covered entities may amend an individual's biological sex in the EHR only to correct a clerical error or when the individual is diagnosed with a sexual development disorder and the amendment changes the listed sex to the opposite sex. If amended due to a sexual development disorder, the entity must document the disorder in the designated EHR field.

—

Health & Safety Code § 183.009

Investigation by commission or regulatory agency

The commission or the appropriate regulatory agency shall conduct an investigation of any credible allegation of a violation of this chapter by a covered entity. The commission or agency shall ensure the investigation is conducted in compliance with all applicable state and federal laws, including the Health Insurance Portability and Accountability Act of 1996 (Pub. L. No. 104-191).

Section 183.009 requires the commission or appropriate regulatory agency to investigate credible allegations of chapter violations, with investigations conducted in compliance with state and federal law including HIPAA. This is an enforcement mechanism provision.

Health & Safety Code § 183.010

Disciplinary action by regulatory agency

The appropriate regulatory agency may take disciplinary action against a covered entity that violates this chapter three or more times in the same manner as if the covered entity violated an applicable licensing or regulatory law. The disciplinary action may include license, registration, or certification suspension or revocation for a period the agency determines appropriate.

Section 183.010 authorizes regulatory agencies to take disciplinary action — including license, registration, or certification suspension or revocation — against covered entities that violate the chapter three or more times. This is an enforcement provision that creates no independent compliance obligation.

Health & Safety Code § 183.011

Injunctive relief; civil penalty

(a)–(b) The attorney general may institute an action for injunctive relief to restrain a violation of this chapter. (b) In addition to the injunctive relief provided by Subsection (a), the attorney general may institute an action for civil penalties against a covered entity for a violation of this chapter. A civil penalty assessed under this section may not exceed: (1) $5,000 for each violation that is committed negligently and that occurs in a single year, regardless of how long the violation continues during that year; (2) $25,000 for each violation that is committed knowingly or intentionally and that occurs in a single year, regardless of how long the violation continues during that year; or (3) $250,000 for each violation in which the covered entity knowingly or intentionally used protected health information for financial gain.

Section 183.011 authorizes the attorney general to seek injunctive relief and civil penalties for violations of the chapter. Civil penalties are tiered by culpability: up to $5,000 per negligent violation per year, up to $25,000 per knowing or intentional violation per year, and up to $250,000 per violation involving knowing or intentional use of protected health information for financial gain. This is an enforcement provision.

Health & Safety Code § 183.012

Memorandum of understanding; rules

The executive commissioner, the Texas Medical Board, the Texas Department of Licensing and Regulation, the Texas Department of Insurance, and each regulatory agency subject to this chapter shall enter into a memorandum of understanding and, as necessary, adopt rules to implement this chapter.

Section 183.012 requires specified state agencies to enter into a memorandum of understanding and adopt rules to implement the chapter. This is an administrative implementation provision directed at regulators, not at covered entities.

Healthcare Clinical AI · provider oversight

3 items

HC-02.1

HC-01.6

Health care practitioners who use AI for diagnostic purposes must disclose their use of AI technology to their patients.

HC-01.3

—

Other

8 items

—

Beginning Jan 1, 2026 Covered entities must ensure that all electronic health records containing patient information are physically stored within the United States or a U.S. territory, including records stored by third-party computing facilities, cloud services providers, or any technology through which patient information may be electronically retrieved, accessed, or transmitted.

—

Beginning Jan 1, 2026 Covered entities must ensure that electronic health record information of Texas residents (other than open data) is accessible only to individuals who require the information to perform duties within the scope of their employment related to treatment, payment, or health care operations.

—

Beginning Jan 1, 2026 Covered entities must implement reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic health record information.

—

Covered entities must not collect, store, or share any information regarding an individual's credit score or voter registration status in the individual's electronic health record.

—

Passage Likelihood

Enacted

Status Enacted

Legislative History

No history on file

Sources

Full Text ↗

Entry Last Reviewed

2026-05-04

AI generated