What are the Texas HB 300 Rules on Electronic Disclosure of PHI?

DISCLAIMER: The information provided in this article, other knowledge base articles, and the Compliancy Group website do not, and are not intended to, constitute legal advice. All information, content, and materials in the Knowledge Base and on the Compliancy Group website are for general informational purposes only.

Note: Compliancy Group cannot advise prospects or clients as to whether HB 300 applies to them. This issue is a question of law, and clients and prospects should consult a qualified attorney before proceeding.

Must Individuals be Given Notice by HB 300-Covered Entities That Their PHI Will be Disclosed Electronically?
Yes. Texas HB 300 requires that HB 300-covered entities provide individuals for whom these covered entities create or receive PHI, with appropriate notice that their PHI will be disclosed electronically.

An HB 300-covered entity may provide general notice by:

(1)  posting a written notice in the covered entity's place of business;

(2)  posting a notice on the covered entity's Internet website; or

(3)  posting a notice in any other place where individuals whose protected health information is subject to electronic disclosure are likely to see the notice.

Must Electronic Disclosures be Accompanied by an Authorization?
Yes. In general, an HB 300-covered entity may not electronically disclose an individual's protected health information to any person without a separate authorization from the individual or the individual's legally authorized representative for each disclosure. Authorizations, whether made in written form, electronic form, or verbally, must be documented in writing by the HB 300-covered entity.

There are two exceptions to this authorization requirement. 

Under the first exception, the authorization is not required if the disclosure is made to an HB 300 or Texas Insurance Code "covered entity", for treatment, payment, healthcare operation, or for purposes of performing a Texas Insurance Code insurance or HMO function. 

Under the second exception, authorization is not required if the disclosure is permitted or required by state law or federal law.