New Texas health information legislation that began to go into effect on Sept. 1 includes several noteworthy provisions, including requirements affecting artificial intelligence and also health record data storage, said regulatory attorney Rachel Rose, who explains the significance of the new state law.
Texas Senate Bill 1188 was signed into law by Texas Gov. Greg Abbott on June 20, so the effective date of Sept. 1 for some provisions, including those involving AI, means that regulated organizations needed to act quickly to ensure compliance.
As the new law relates to artificial intelligence, healthcare practitioners must disclose to their patients their use of AI, she said. “Specifically, they’re looking at generative AI for diagnostic purposes, including recommendations on a diagnosis or course of treatment based on a patient’s medical record,” she said.
“The states have been on the forefront of adopting AI laws even before the federal government does, so it’s not surprising that we would see this come into play,” she said in an interview with Information Security Media Group.
When it comes to the storage of health information, the new Texas law requires covered organizations to ensure that patients’ electronic health records are physically maintained in the United States. “The law requires that individually identifiable health information be maintained in either the continental United States or one of its territories, or Alaska or Hawaii,” she said. “This really isn’t unsurprising, because a lot of federal government contracts and state government contracts already require this, including Arizona,” she said.
Nonetheless, if a healthcare provider uses offshore experts to read medical images, or uses other remote services, such as cloud computing, this new requirement – which doesn’t become effective until January 2026 – needs to be carefully evaluated, she said.
“Every organization should know where their data is,” she said. “Are they contracting with a third party overseas to read radiology reports, for example? That’s very common. So, just being aware of where your data is stored and also created and transmitted is going to be vital.”
The new law permits the Texas Attorney General to seek injunctive relief and impose civil penalties ranging between $5,000 and $250,000 per violation. “So, that’s something that may end up being very significant,” she said.
In this audio interview with Information Security Media Group (see audio link below photo), Rose also discussed:
- How Texas’ state law compares with requirements of HIPAA and other states’ health information-related regulations, and what providers need to consider for compliance;
- The implications of a Texas S.B. 1188 requirement for a patient’s “biological sex” as it relates to the gametes that an individual is born with, to be documented in medical records;
- Significant Texas legal cases and other developments to watch involving health information privacy and security matters, including HIPAA.
Rose, licensed in Texas, is a fellow of the Federal Bar Association and serves as a director on the FBA’s national board. She is a member of and the immediate past chair of the Federal Bar Association’s Government Relations Committee and an advisory board member of its Qui Tam Section.