Health record rights in Texas: what state law adds
In Texas, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a copy of your record faster than HIPAA requires, and free in some cases; the health information exchange offers no general choice; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue over misuse of your records; breach notices must cover medical and health insurance information; and two of the three rules we look for on AI in care are in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general. Same answer in 11 of the 50 states, counting this one.
Are there rules for AI used in your care?Two of the three rules are in force. You must be told when AI is used in your care. A licensed clinician decides, not AI alone. Same answer in 6 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
TDPSA requires consent to process sensitive data, including health diagnosis. HSC 181.154 also requires authorization for electronic disclosure by broadly defined covered entities. Texas has no dedicated consumer health data law, so level 3 is not met.
"Level" is the step on our rulebook's scale for this question. 0 means nothing beyond HIPAA. Higher means the law gives you more here.
Texas Data Privacy and Security Act: controller duties (consent for sensitive data). Tex. Bus. & Com. Code § 541.101(b)(4)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
process the sensitive data of a consumer without obtaining the consumer's consent, or, in the case of processing the sensitive data of a known child, without processing that data in accordance with the Children's Online Privacy Protection Act of 1998
Who it binds, in our words: "is not a small business as defined by the United States Small Business Administration, except to the extent that Section 541.107 applies" (§ 541.002(a)(3)); HIPAA covered entities and business associates are excluded (§ 541.002(b)(3)).
Texas Data Privacy and Security Act: definition of sensitive data. Tex. Bus. & Com. Code § 541.001(29)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, or citizenship or immigration status
Who it binds, in our words: Same as § 541.002.
Texas Data Privacy and Security Act: small businesses selling sensitive data. Tex. Bus. & Com. Code § 541.107(a)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
A person described by Section 541.002 (a)(3) may not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer.
Who it binds, in our words: Small businesses as defined by the SBA, for sale of sensitive data only.
Medical Records Privacy Act: authorization for electronic disclosure. Tex. Health & Safety Code § 181.154(b)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
a covered entity may not electronically disclose an individual's protected health information to any person without a separate authorization from the individual or the individual's legally authorized representative for each disclosure.
Who it binds, in our words: Covered entity in § 181.001(b)(2) includes any person who handles protected health information, including "health researcher, health care facility, clinic, health care provider, or person who maintains an Internet site". Exceptions for treatment, payment and operations in § 181.154(c).
Medical Records Privacy Act: sale of protected health information prohibited. Tex. Health & Safety Code § 181.153(a)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
A covered entity may not disclose an individual's protected health information to any other person in exchange for direct or indirect remuneration
Who it binds, in our words: Covered entities as defined in § 181.001(b)(2).
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
Yes, both. A deadline shorter than 30 days, and a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Beyond the federal floor: a free copy for disability benefit claims and appeals, including for a representative, and 15-day or 15-business-day deadlines for hospitals, physicians and EHR providers. Per-page hospital caps are recorded as facts only.
Deadline in the law: 15 days.
Free copy: Records requested by the patient or representative to support a disability benefits application or appeal under listed state and federal programs (HSC 161.202(a))
Free copy: Hospital: no fee for a patient to examine the patient's own health care information (HSC 241.154(d)(2))
Free copy: Hospital: no fee for records relating to treatment for which workers' compensation benefits are being sought (HSC 241.154(d)(4))
Fee rule: Hospital (HSC 241.154(b)): paper retrieval fee up to $30 including first 10 pages; $1 per page for pages 11 to 60; 50 cents for pages 61 to 400; 25 cents after; plus delivery cost
Fee rule: Hospital microform: up to $45 including first 10 pages, then $1 per page
Fee rule: Hospital electronic copy: retrieval or processing fee up to $75 plus delivery cost
Fee rule: Physician (Occ. Code 159.008): reasonable fee as prescribed by Texas Medical Board rule, except where HSC 161.202 bars a fee
Goes beyond the federal floor: yes.
Free records for disability benefit claims. Tex. Health & Safety Code § 161.202(a)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
A health care provider or health care facility may not charge a fee for a medical or mental health record requested by a patient or former patient, or by an attorney or other authorized representative of the patient or former patient, for use in supporting an application for disability benefits
Who it binds, in our words: Any health care provider or health care facility; benefits under listed programs including Social Security Titles II, XVI, XVIII, Medicaid and veterans benefits.
Consumer access to electronic health records. Tex. Health & Safety Code § 181.102(a)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
not later than the 15th business day after the date the health care provider receives a written request from a person for the person's electronic health record, shall provide the requested record to the person in electronic form
Who it binds, in our words: "if a health care provider is using an electronic health records system that is capable of fulfilling the request"
Physician: deadline to furnish records. Tex. Occ. Code § 159.006(d)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
not later than the 15th business day after the date of receipt of the written consent for release under Subsection (a) or the written request under Subsection (c)
Who it binds, in our words: Physicians.
Hospital: deadline and fees for copies. Tex. Health & Safety Code § 241.154(a), (b), (d)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
as promptly as required under the circumstances but not later than the 15th day after the date the request and payment authorized under Subsection (b) are received
Who it binds, in our words: Licensed hospitals and their agents. Clock runs from receipt of request and payment.
Physician fees for records. Tex. Occ. Code § 159.008
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
A physician may not charge a fee for copying billing or medical records under Subsection (a) to the extent the fee is prohibited under Subchapter M, Chapter 161, Health and Safety Code.
Who it binds, in our words: Physicians.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
No general choice. Sharing through the exchange follows HIPAA's rules, and no state rule or exchange policy offers a general choice.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
HSC 181.154(c) lets covered entities disclose electronically for treatment without authorization. Chapter 182 sets no patient consent rule. The THSA HIETexas page shows no patient opt-out. Regional HIE policies were not reviewed.
Set by state law.
Designated exchange: Texas Health Services Authority (HIETexas), created under Tex. Health & Safety Code ch. 182.
Some sensitive records need your consent even where routine records do not.
Electronic disclosure without authorization for treatment, payment and operations. Tex. Health & Safety Code § 181.154(c)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
The authorization for electronic disclosure of protected health information described by Subsection (b) is not required if the disclosure is made: (1) to another covered entity, as that term is defined by Section 181.001,
Who it binds, in our words: Covered entities under § 181.001; purposes of treatment, payment, health care operations and listed insurance functions.
Texas Health Services Authority: privacy of information. Tex. Health & Safety Code § 182.103(b)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
The corporation shall comply with all state and federal laws and rules relating to the transmission of health information, including Chapter 181, and rules adopted under that chapter,
Who it binds, in our words: Texas Health Services Authority.
Tex. Occ. Code § 58.102(b)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
A person who holds genetic information about an individual may not disclose or be compelled to disclose, by subpoena or otherwise, that information unless the disclosure is specifically authorized as provided by Section 58.104.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The rule covers abortion reports and records held by the department, with listed exceptions. No separate rule for provider-held reproductive health records was found in the chapters read.
Abortion facility reporting: confidentiality of department records. Tex. Health & Safety Code § 245.011(d)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
all information and records held by the department under this chapter are confidential and are not open records for the purposes of Chapter 552, Government Code. That information may not be released or made public on subpoena or otherwise,
Who it binds, in our words: Information and records held by the state health department under Chapter 245 (abortion facility reports).
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure is limited to the exceptions in sections 611.004, 611.0041 and 611.0045.
Confidentiality of mental health information. Tex. Health & Safety Code § 611.002(a)-(b)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
Communications between a patient and a professional, and records of the identity, diagnosis, evaluation, or treatment of a patient that are created or maintained by a professional, are confidential.
Who it binds, in our words: Mental health professionals as defined in chapter 611.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Release is limited to the recipients listed in section 81.103(b).
Confidentiality of HIV and AIDS test results. Tex. Health & Safety Code § 81.103(a)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
A test result is confidential. A person that possesses or has knowledge of a test result may not release or disclose the test result or allow the test result to become known except as provided by this section.
Who it binds, in our words: Any person holding a "test result", defined in § 81.101 as a statement that an identifiable individual has or has not been tested for AIDS or HIV infection.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Section 58.104 requires a written authorization naming the information, recipient and purpose. Exceptions are in section 58.103.
Confidentiality of genetic information. Tex. Occ. Code § 58.102
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
A person who holds genetic information about an individual may not disclose or be compelled to disclose, by subpoena or otherwise, that information unless the disclosure is specifically authorized as provided by Section 58.104.
Who it binds, in our words: Any person holding genetic information, including secondary recipients (§ 58.102(c)).
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Patients may sue hospitals and physicians for unauthorized release of medical records generally. Separate rights cover mental health and HIV records. The TDPSA and chapter 181 have no private right.
Damages a court may award: HIV test results (HSC 81.104): actual damages plus civil penalty up to $5,000 if negligent, $5,000 to $10,000 if wilful, plus costs and attorney's fees. Hospital, physician and mental health records: injunctive relief and damages, no fixed statutory amount.
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
A patient aggrieved by a violation of this subchapter relating to the unauthorized release of confidential health care information may bring an action for: (1) appropriate injunctive relief; and (2) damages resulting from the release.
Who it binds, in our words: Hospitals licensed under chapter 241.
Physician records: cause of action for unauthorized release. Tex. Occ. Code § 159.009
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
A person aggrieved by a violation of this chapter relating to the unauthorized release of confidential and privileged communications may petition the district court
Who it binds, in our words: Physicians; § 159.002(b) makes physician records of identity, diagnosis, evaluation or treatment confidential. § 159.009(b): "The aggrieved person may prove a cause of action for civil damages."
Mental health records: legal remedies. Tex. Health & Safety Code § 611.005
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
A person aggrieved by the improper disclosure of or failure to disclose confidential communications or records in violation of this chapter may petition the district court of the county in which the person resides for appropriate relief, including injunctive relief.
Who it binds, in our words: Mental health professionals under chapter 611.
HIV test results: injunction and civil liability. Tex. Health & Safety Code § 81.104
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
A person may bring an action to restrain a violation or threatened violation of Section 81.102 or 81.103.
Who it binds, in our words: Any person who releases an HIV test result in violation of § 81.103.
TDPSA: no private right of action. Tex. Bus. & Com. Code § 541.156
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
This chapter may not be construed as providing a basis for, or being subject to, a private right of action for a violation of this chapter or any other law.
Who it binds, in our words: TDPSA. Medical Records Privacy Act (HSC ch. 181) is enforced by the attorney general under § 181.201.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The definition's clause on payment for health care is counted as health insurance information.
Deadline to tell people: Without unreasonable delay and not later than 60 days after the person determines the breach occurred.
The attorney general or a regulator must also be told.
Definition of sensitive personal information. Tex. Bus. & Com. Code § 521.002(a)(2)(B)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
information that identifies an individual and relates to: (i) the physical or mental health or condition of the individual; (ii) the provision of health care to the individual; or (iii) payment for the provision of health care to the individual.
Who it binds, in our words: Persons who conduct business in Texas and own or license computerized data that includes sensitive personal information.
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
The disclosure shall be made without unreasonable delay and in each case not later than the 60th day after the date on which the person determines that the breach occurred,
Who it binds, in our words: Persons who conduct business in Texas and own or license computerized data with sensitive personal information.
Breach notice to the attorney general. Tex. Bus. & Com. Code § 521.053(i)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
shall notify the attorney general of that breach as soon as practicable and not later than the 30th day after the date on which the person determines that the breach occurred if the breach involves at least 250 residents of this state.
Who it binds, in our words: Breaches involving at least 250 Texas residents.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
Two of the three rules are in force. You must be told when AI is used in your care. A licensed clinician decides, not AI alone.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure: HSC 183.005(b) and BCC 552.051(f). Clinician decides: HSC 183.005(a)(3) review, and Ins. Code 4201.156 bars automated adverse determinations. No AI-specific human review or contact right was found.
You must be told when AI is used in your care: in force.
A licensed clinician decides, not AI alone: in force.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): Tex. Ins. Code § 4201.156(a): "A utilization review agent may not use an automated decision system to make, wholly or partly, an adverse determination."
AI in electronic health record: practitioner disclosure. Tex. Health & Safety Code § 183.005(b)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
A health care practitioner who uses artificial intelligence for diagnostic purposes as described by Subsection (a) must disclose the practitioner's use of that technology to the practitioner's patients.
Who it binds, in our words: Licensed health care practitioners using AI for diagnostic purposes (S.B. 1188).
AI in electronic health record: practitioner review. Tex. Health & Safety Code § 183.005(a)(3)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
the practitioner reviews all records created with artificial intelligence in a manner that is consistent with medical records standards developed by the Texas Medical Board.
Who it binds, in our words: Licensed health care practitioners using AI for diagnosis or treatment recommendations.
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
A utilization review agent may not use an automated decision system to make, wholly or partly, an adverse determination.
Who it binds, in our words: Utilization review agents; "automated decision system" includes an algorithm incorporating an artificial intelligence system (§ 4201.002(1-c)) (S.B. 815).
Texas Responsible AI Governance Act: disclosure in health care. Tex. Bus. & Com. Code § 552.051(f)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
If an artificial intelligence system is used in relation to health care service or treatment, the provider of the service or treatment shall provide the disclosure under Subsection (b) to the recipient of the service or treatment or the recipient's personal representative
Who it binds, in our words: Providers of health care services or treatment (H.B. 149). Enforced by the attorney general only (§ 552.101).
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
19.1%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
94.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
88.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
11.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$73,035 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.3%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
5.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
35.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
8.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. In force It offers no state way to ask brokers to delete your data.
Data broker registration with the secretary of state. Tex. Bus. & Com. Code §§ 510.005, 510.006 (formerly ch. 509)
In force · effective · read October 3, 2026 · source(tcss.legis.texas.gov)
To conduct business in this state, a data broker to which this chapter applies shall register with the secretary of state by filing a registration statement and paying a registration fee of $300.
Who it binds, in our words: Data brokers meeting the revenue tests in § 510.003.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
