Read the full stored bill text
89(R) HB 4503 - House Committee Report version - Bill Text
89R23762 EAS-D
By: Bonnen, Metcalf, et al.
H.B. No. 4503
Substitute the following for H.B. No. 4503:
By: King
C.S.H.B. No. 4503
A BILL TO BE ENTITLED
AN ACT
relating to electronic health record requirements; authorizing a
civil penalty.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1. Subtitle I, Title 2, Health and Safety Code, is
amended by adding Chapter 183 to read as follows:
CHAPTER 183.
ELECTRONIC HEALTH RECORDS
Sec. 183.001. DEFINITIONS. In this chapter:
(1)
"Biological sex" means the biological trait that
determines whether a sexually reproducing organism produces male or
female gametes.
(2)
"Covered entity"
has the meaning assigned by
Section 181.001.
The term includes a health care practitioner.
The
term does not include:
(A)
a home and community support services agency
licensed under Chapter 142;
(B)
a nursing facility licensed under Chapter
242;
(C)
a continuing care facility regulated under
Chapter 246;
(D)
an assisted living facility licensed under
Chapter 247;
(E)
an intermediate care facility licensed under
Chapter 252;
(F)
a day activity and health services facility
licensed under Chapter 103, Human Resources Code; or
(G)
a provider under the Texas home living
(TxHmL) or home and community-based services (HCS) waiver program.
(3)
"Female" means an individual whose reproductive
system is developed to produce ova.
(4)
"Health care practitioner" means an individual who
is licensed, certified, or otherwise authorized to provide health
care services in this state.
(5)
"Male" means an individual whose reproductive
system is developed to produce sperm.
(6)
"Sexual development disorder" means a congenital
condition associated with atypical development of internal or
external genital structures.
The term includes a chromosomal,
gonadal, and anatomic abnormality.
Sec.
183.002.
REQUIREMENTS FOR ELECTRONIC HEALTH RECORD
STORAGE.
(a)
A covered entity shall ensure that electronic health
records under the control of the entity that contain patient
information are physically maintained in the United States or a
territory of the United States.
This subsection applies to:
(1)
electronic health records that are stored by a
third-party or subcontracted computing facility or an entity that
provides cloud computing services; and
(2)
electronic health records that are stored using a
technology through which patient information may be electronically
retrieved, accessed, or transmitted.
(b)
A covered entity shall ensure that the electronic health
record information of this state's residents, other than open data,
is accessible only to individuals who require the information to
perform duties within the scope of the individual's employment
related to treatment, payment, or health care operations.
(c)
Each covered entity shall implement reasonable and
appropriate administrative, physical, and technical safeguards to
protect the confidentiality, integrity, and availability of
electronic health record information.
Sec.
183.003.
REQUIRED MEDICAL HISTORY INFORMATION IN
ELECTRONIC HEALTH RECORD. A covered entity shall ensure each
electronic health record maintained for an individual includes the
option for a health care practitioner to collect and record
communications between two or more covered entities related to the
individual's metabolic health and diet in the treatment of a
chronic disease or illness.
Sec.
183.004.
INFORMATION RESTRICTIONS IN ELECTRONIC
HEALTH RECORD. A covered entity may not collect, store, or share
any information regarding an individual's credit score or voter
registration status in the individual's electronic health record.
Sec.
183.005.
ARTIFICIAL INTELLIGENCE IN ELECTRONIC HEALTH
RECORD. (a)
A health care practitioner who uses artificial
intelligence for diagnostic purposes, including the use of
artificial intelligence for recommendations on a diagnosis or
course of treatment based on a patient's medical record, shall
review all records created with artificial intelligence to ensure
that the data is accurate and properly managed.
(b)
A health care practitioner who uses artificial
intelligence for diagnostic purposes as described by Subsection (a)
must disclose the practitioner's use of that technology to the
practitioner's patients.
Sec.
183.006.
ACCESS TO ELECTRONIC HEALTH RECORD OF MINOR.
(a)
In this section, "minor" means an individual 17 years of age or
younger who has not had the disabilities of minority removed for
general purposes.
(b)
A covered entity shall ensure each electronic health
record system the entity uses to store electronic health records of
minors allows a minor's parent or, if applicable, the minor's
managing conservator or guardian to obtain complete and
unrestricted access to the minor's electronic health record
immediately upon request, unless access to all or part of the record
is restricted under state or federal law or by a court order.
Sec.
183.007.
ELECTRONIC HEALTH RECORD REQUIREMENTS
REGARDING BIOLOGICAL SEX.
(a)
Notwithstanding any other law, the
commission, the Texas Medical Board, and the Texas Department of
Insurance shall jointly ensure that:
(1)
each electronic health record prepared or
maintained by a covered entity in this state includes a separate
space for the entity to document:
(A)
an individual's biological sex as either male
or female based on the individual's observed biological sex
recorded by a health care practitioner at birth; and
(B)
information on any sexual development
disorder of the individual, whether identified at birth or later in
the individual's life; and
(2)
any algorithm or decision assistance tool included
in an electronic health record to assist a health care practitioner
in making medical treatment decisions includes an individual's
biological sex as recorded in the space described by Subdivision
(1)(A).
(b)
This section does not prohibit an electronic health
record from including spaces for recording other information
related to an individual's biological sex or gender identity.
Sec.
183.008.
AMENDING CERTAIN BIOLOGICAL SEX INFORMATION
IN ELECTRONIC HEALTH RECORDS.
(a)
A covered entity may amend on an
electronic health record an individual's biological sex as recorded
in the space described by Section 183.007(a)(1)(A) only if:
(1) the amendment is to correct a clerical error; or
(2)
the individual is diagnosed with a sexual
development disorder and the amendment changes the individual's
listed biological sex to the opposite biological sex.
(b)
If an individual's biological sex is amended under
Subsection (a)(2), the covered entity shall include in the
individual's electronic health record information on the
individual's sexual development disorder in the space described by
Section 183.007(a)(1)(B).
Sec.
183.009.
INVESTIGATION BY COMMISSION OR REGULATORY
AGENCY. The commission or the appropriate regulatory agency shall
conduct an investigation of any credible allegation of a violation
of this chapter by a covered entity.
The commission or agency shall
ensure the investigation is conducted in compliance with all
applicable state and federal laws, including the Health Insurance
Portability and Accountability Act of 1996 (Pub. L. No.
104-191).
Sec.
183.010.
DISCIPLINARY ACTION BY REGULATORY AGENCY.
The appropriate regulatory agency may take disciplinary action
against a covered entity that violates this chapter three or more
times in the same manner as if the covered entity violated an
applicable licensing or regulatory law.
The disciplinary action
may include license, registration, or certification suspension or
revocation for a period the agency determines appropriate.
Sec.
183.011.
INJUNCTIVE RELIEF; CIVIL PENALTY.
(a)
The
attorney general may institute an action for injunctive relief to
restrain a violation of this chapter.
(b)
In addition to the injunctive relief provided by
Subsection (a), the attorney general may institute an action for
civil penalties against a covered entity for a violation of this
chapter.
A civil penalty assessed under this section may not
exceed:
(1)
$5,000 for each violation that is committed
negligently and that occurs in a single year, regardless of how long
the violation continues during that year;
(2)
$25,000 for each violation that is committed
knowingly or intentionally and that occurs in a single year,
regardless of how long the violation continues during that year; or
(3)
$250,000 for each violation in which the covered
entity knowingly or intentionally used protected health
information for financial gain.
Sec.
183.012.
MEMORANDUM OF UNDERSTANDING; RULES. The
executive commissioner, the Texas Medical Board, the Texas
Department of Licensing and Regulation, the Texas Department of
Insurance, and each regulatory agency subject to this chapter shall
enter into a memorandum of understanding and, as necessary, adopt
rules to implement this chapter.
SECTION 2. (a) Except as provided by Subsection (b) of this
section, Chapter 183, Health and Safety Code, as added by this Act,
applies only to an electronic health record prepared on or after the
effective date of this Act.
(b) Section 183.002, Health and Safety Code, as added by
this Act, applies to the storage of an electronic health record on
or after January 1, 2026, regardless of the date on which the
electronic health record was prepared.
SECTION 3. This Act takes effect September 1, 2025.