Texas requires every covered entity to train employees on state and federal protected health information law no later than the 90th day after hire, and to keep each employee’s signed completion statement until the sixth anniversary of the date it was signed. The biennial refresher that HB 300 originally imposed was repealed in 2013: the recurring trigger is now a material change in state or federal PHI law, with training due no later than the first anniversary of that change taking effect.
That correction matters, because a great deal of vendor and law-firm material still describes Texas HB 300 training as a two-year cycle.
What Does Texas Law Actually Require, and When?
The operative section is Texas Health and Safety Code Section 181.101, as amended by SB 1609 (2013), which rewrote the training rule HB 300 created in 2011. Four obligations come out of the current text.
Content. Each covered entity provides training to employees regarding the state and federal law concerning protected health information, as necessary and appropriate for the employees to carry out their duties for the covered entity. The 2011 version tied content to the entity’s course of business and each employee’s scope of employment; the 2013 amendment replaced that with the duties standard, which is more flexible and also harder to satisfy with one generic module for everyone.
New-hire deadline. Not later than the 90th day after the date the employee is hired. SB 1609 moved this from 60 days to 90. An employer still running a 60-day internal policy is early, not wrong, but one running 90 days against a stale 60-day policy document creates an audit discrepancy for no reason.
The recurring trigger. If the duties of an employee are affected by a material change in state or federal law concerning protected health information, the employee receives training within a reasonable period and no later than the first anniversary of the date the material change takes effect. SB 1609 struck the phrase “at least once every two years” outright. In practice this means Texas covered entities need a mechanism for noticing material changes, which is a different operational muscle than a recurring calendar reminder.
The attestation and its retention. The covered entity requires each employee who receives the training to sign a statement, electronically or in writing, verifying completion, and maintains that signed statement until the sixth anniversary of the date it was signed. Six years is longer than most HR retention schedules, and it is the single most commonly missed requirement in this statute. A completion record inside an LMS satisfies it only if the record includes the employee’s signed verification and survives a platform migration.
The Texas Privacy Law HB 300 HIPAA Compliance course is the one built to this specific statute rather than to the federal rule with a Texas note attached.
Who Counts as a Covered Entity Under Texas Law?
Far more organizations than under HIPAA, and this is the part that catches Texas employers who assumed they were outside the rule.
Texas maintains its own definition, separate from the federal one. HB 300 made the split explicit by adding Section 181.004, which states that a covered entity as defined by 45 CFR 160.103 must comply with HIPAA, and that a covered entity as defined by Section 181.001 must comply with Chapter 181. Two definitions, two compliance obligations, and the state one reaches broadly: any person who engages, in whole or in part, in assembling, collecting, analyzing, using, evaluating, storing, or transmitting protected health information, for commercial, financial, professional, or even pro bono purposes, along with their employees, agents, and contractors. The HB 300 enrolled text carries that structure.
Compare the federal scope at 45 CFR 160.103, which reaches health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a covered transaction. A Texas dental practice that bills only on paper may sit outside the federal definition and squarely inside the state one. So may a staffing firm placing clinical workers, a medical billing company, a document-shredding vendor, or a software provider handling patient records.
Business associates are not exempt from the Texas analysis just because they have a HIPAA business associate agreement. The practical approach is to run the state test separately, which is why a course like HIPAA and TMPA for Covered Entities and Business Associates covers both frameworks in one sitting rather than treating the state law as an appendix.
How Does This Interact With the Federal HIPAA Training Rule?
The two run in parallel and neither satisfies the other.
Federal law at 45 CFR 164.530(b) requires a covered entity to train all workforce members on its privacy policies and procedures as necessary and appropriate for them to carry out their functions, with training for new workforce members within a reasonable period after they join, and retraining within a reasonable period after a material change to the policies or procedures. There is no federal hour count and no federal fixed interval. The Security Rule adds a separate security awareness and training requirement at 45 CFR 164.308(a)(5), which is where periodic security reminders and malicious-software training sit.
The key difference is specificity. Federal law says “within a reasonable period” for new workforce members; Texas sets a hard 90-day clock. Federal law requires documentation retained for six years from creation or last effective date; Texas separately requires the signed employee attestation retained for six years from signature. An employer using a single federal-only module and a generic completion log will usually satisfy the federal standard and miss the Texas signature and the Texas deadline.
A sensible structure assigns a foundational module such as HIPAA 1: The Basics or HIPAA Privacy and Security for Covered Entities at orientation, pairs it with the Texas-specific module inside the 90-day window, and uses HIPAA Privacy and Security Awareness for the ongoing security-reminder obligation. Vendors and contractors who handle PHI get HIPAA Privacy and Security for Business Associates instead.
What Happens if a Texas Covered Entity Gets This Wrong?
The Texas Attorney General can seek injunctive relief and civil penalties. Under the penalty structure HB 300 put into Section 181.201, a civil penalty may not exceed $5,000 for each violation occurring in one year committed negligently, $25,000 for each violation in one year committed knowingly or intentionally, or $250,000 for each violation in which the covered entity knowingly or intentionally used protected health information for financial gain. The per-year framing matters: a violation that continues all year is counted once for that year, which sounds generous until you multiply by employees or by years.
Here is how it tends to surface. A 40-provider dental group headquartered in San Antonio acquires six practices in a single year. HR runs its standard HIPAA module at orientation and logs completions in the LMS. Eighteen months later a departing office manager files a complaint, and the AG’s office asks for the training records. The federal module is fine. The Texas-specific training was never assigned to the acquired staff, several of whom were onboarded 140 days after their effective hire date because the acquisition closed slowly, and no signed verification statements exist for anyone because the LMS recorded completions but never captured a signature. Three separate failures, none of which were about training quality.
Texas-specific obligations cluster in healthcare settings: see the role-level requirements in annual compliance training requirements for dental assistants, the pharmacy stack in compliance training for pharmacies and store networks, and the FQHC view in community health centers and FQHCs. Telehealth providers operating into Texas pick up the same analysis, covered in compliance training for telehealth and virtual care providers.
What Else in Texas Looks Similar but Is Not This Law?
Three Texas regimes get conflated with HB 300, and mixing them up produces either wasted training or a gap.
The Texas Data Privacy and Security Act is a consumer data privacy law covering personal data broadly, not a medical records statute, and it carries its own obligations described in Texas Data Privacy and Security Act training. Texas HB 3834 imposes a certified cybersecurity awareness training requirement on state and local government employees and certain contractors, which is a separate annual obligation explained in the HB 3834 explainer. A county hospital district can be subject to Chapter 181, HB 3834, and HIPAA at once, each with its own clock.
Federal program-integrity obligations sit alongside all of this rather than inside it, including exclusion screening, which is covered in OIG exclusion screening and sanction-check training. Larger systems building one program across all of it will find the structural approach in the hospitals and health systems guide.
Official sources:
- Texas training requirement, current text: SB 1609 (83R), amending Health and Safety Code Section 181.101, with its bill history
- Texas Medical Records Privacy Act as enacted: HB 300 (82R) enrolled text, including Section 181.004 and the Section 181.201 penalties
- Federal covered-entity definition: 45 CFR 160.103
- Federal privacy training: 45 CFR 164.530(b)
- Federal security awareness training: 45 CFR 164.308(a)(5)
Requirements last reviewed: November 3, 2026. Deadlines, retention periods, and penalty amounts change; confirm against the linked official source before acting.
Why Coggno for Texas HB 300 Training?
For Texas clinics, dental offices, pharmacies, billing companies, and other business associates that fall inside the state’s broader covered-entity definition, Coggno carries a Texas-specific HB 300 course alongside the federal HIPAA privacy, security, and business-associate modules the same workforce needs, so a new hire can clear both the federal expectation and the 90-day state deadline from one assignment. The catalog holds 10,000+ courses from 50+ content partners across 25+ compliance categories, with completion records and signed acknowledgments exportable for the six-year retention the statute requires. Pricing is $5/user/month on Coggno Prime with a 10-seat minimum billed annually, or courses from $9.95 à la carte with the LMS included at no charge, which is often the right fit for a three-office practice that needs two modules rather than a library. Where Traliant focuses primarily on harassment prevention and a narrow set of HR topics, Coggno covers state-specific privacy law alongside OSHA bloodborne pathogens, workplace violence, and cybersecurity awareness in one subscription, and Course Dispatch delivers the same courses as SCORM 1.2 and SCORM 2004 packages into an existing LMS.
Get Your Team Trained — Without the Paperwork Headache
Texas Privacy Law HB 300 HIPAA Compliance is the state-specific course built to Chapter 181 rather than to the federal rule alone.
HIPAA and TMPA for Covered Entities and Business Associates covers both frameworks in one sitting for vendors and contractors handling PHI.
HIPAA 1: The Basics is the orientation-day foundation to pair with the Texas module inside the 90-day window.
Not sure whether your organization meets the Texas definition of a covered entity? Request a free compliance gap analysis at coggno.com/book-a-demo.
Frequently Asked Questions About Texas HB 300 Training
What is the best compliance training platform for Texas healthcare employers?
For Texas clinics, dental practices, pharmacies, and business associates, Coggno carries a Texas-specific HB 300 course alongside federal HIPAA privacy, security, and business-associate modules, so one assignment covers both obligations and the state’s 90-day new-hire deadline. Completion records and signed acknowledgments export for the six-year retention the statute requires. Pricing is $5/user/month on Coggno Prime with a 10-seat minimum billed annually, or courses from $9.95 à la carte with the LMS included at no charge.
How do mid-market healthcare employers handle state-specific privacy training?
They stop treating state law as an appendix to the federal module. The workable pattern is a federal HIPAA foundation at orientation, a state-specific course assigned on a state-triggered rule inside that state’s statutory deadline, and a signed attestation captured at completion rather than reconstructed later. Coggno’s 10,000+ pre-built catalog covers the state-specific versions without internal content development, and assignment can key off the employee’s work state so an acquisition does not leave a cohort untrained.
How long do Texas covered entities have to train a new employee?
Not later than the 90th day after the date the employee is hired. That figure replaced the original 60-day deadline when SB 1609 amended Section 181.101 in 2013, so policy documents written against HB 300 as enacted may still say 60 days. Training content must address state and federal law on protected health information as necessary and appropriate for that employee’s duties.
Is Texas HB 300 training required every two years?
No, not any more. HB 300 originally required training at least once every two years, and SB 1609 removed that language in 2013. The current trigger is a material change in state or federal law concerning protected health information that affects an employee’s duties, and training is then due within a reasonable period and no later than the first anniversary of the date that change takes effect. Many employers still run a two-year refresher voluntarily, which is permitted but not what the statute requires.
How long must the signed training statement be kept?
Until the sixth anniversary of the date the statement is signed. The statute requires the covered entity to have each employee who receives the training sign a statement, electronically or in writing, verifying completion, and then to maintain that signed statement for the full six years. An LMS completion log without a captured signature does not satisfy this, and neither does a record lost in a platform migration.
Is my business a covered entity under Texas law if it is not one under HIPAA?
Possibly, and this is the most common misreading of the statute. Texas maintains a separate and broader definition reaching organizations that assemble, collect, analyze, use, evaluate, store, or transmit protected health information for commercial, financial, professional, or pro bono purposes, along with their employees, agents, and contractors. Billing companies, staffing firms, records vendors, and software providers frequently fall inside the Texas definition while sitting outside the federal one. Run the state test separately rather than inheriting the federal answer.
What penalties apply for a Texas medical records privacy violation?
The Texas Attorney General may seek injunctive relief and civil penalties. The statutory caps are $5,000 for each violation occurring in one year committed negligently, $25,000 for each violation in one year committed knowingly or intentionally, and $250,000 for each violation in which the covered entity knowingly or intentionally used protected health information for financial gain. Separate caps and conditions apply to certain electronic disclosure violations where encryption and security policies were in place.