On June 20, 2025, Gov. Abbott signed SB 1188 into law. The new law relates to electronic health records and requires that electronic health records under the control of a covered entity that contain patient information must be physically maintained in the U.S. or a U.S. territory, and that electronic health record information is accessible only to those who require the information to perform duties within their employment related to treatment, payment, or healthcare operations. A covered entity is any entity that engages in the practice of assembling, collecting, analyzing, using, evaluating, storing, or transmitting protected health information. The new law takes effect on September 1, 2025. The storage requirements outlined in the new law apply to the storage of an electronic health record on or after January 1, 2026, regardless of the date on which the electronic health record was prepared.
The definition of “covered entity” appears to be broad enough to include any entity (whether inside or outside Texas) that maintains PHI for Texas residents. Employers with plans that cover Texas residents should consult with their attorneys to determine if they fit into this definition and, if so, to ensure they are following this law. Employers with fully insured plans should also consult with their carriers to determine whether they are complying with this law.
Read the full legislation: SB 1188.