In Texas, staff who handle patient health information have 90 days from hire to finish privacy training.
Texas House Bill 300 reaches more businesses than HIPAA, including clinics, vendors, and others that handle patient health information. Each employee must finish training on the Texas and federal privacy law their job needs within 90 days of hire, and again when a material change in the law affects their duties.
Each person you assign gets a training statement to sign online after they pass. You keep the records.
Start your free trialIf you operate in Texas, HB 300 (Health & Safety Code Chapter 181) imposes privacy training requirements stricter than federal HIPAA.
Course Details
20 minutes
State
Texas Law
Online, self-paced
October 2026
What your team will learn
- How HB 300 and HIPAA work together (HIPAA is the floor, Texas law adds on top)
- The expanded Texas covered entity definition (broader than federal)
- Training deadlines: 90 days from hire, and again when a material change in state or federal law affects an employee's duties
- What role-based training actually means under Texas law
- The graduated civil penalties and how they escalate
- Enforcement, patient rights, and the absence of a private right of action
- Texas-specific consent rules for marketing uses of PHI
Who needs this training?
If you operate in Texas, HB 300 applies to all covered entities under Texas Health & Safety Code Chapter 181. The definition is broader than federal HIPAA. R = Required by regulation. S = Strongly recommended.
| Practice Type | Status | Authority |
|---|---|---|
| Physician Practices & Medical Groups | Required (if TX) | TX H&S Code Ch. 181 |
| Dental Offices | Required (if TX) | TX H&S Code Ch. 181 |
| Urgent Care Centers | Required (if TX) | TX H&S Code Ch. 181 |
| Home Health Agencies | Required (if TX) | TX H&S Code Ch. 181 |
| Behavioral Health & SUD Treatment | Required (if TX) | TX H&S Code Ch. 181 |
| Chiropractic Offices | Required (if TX) | TX H&S Code Ch. 181 |
| Physical Therapy & Rehab Clinics | Required (if TX) | TX H&S Code Ch. 181 |
| Ambulatory Surgery Centers (ASCs) | Required (if TX) | TX H&S Code Ch. 181 |
| Pharmacies | Required (if TX) | TX H&S Code Ch. 181 |
| Mental Health Private Practices | Required (if TX) | TX H&S Code Ch. 181 |
| Community Health Centers (FQHCs) | Required (if TX) | TX H&S Code Ch. 181 |
| Telehealth Providers | Required (if TX) | TX H&S Code Ch. 181 |
Which roles must complete this training?
If you operate in Texas, all employees who handle PHI must be trained within 90 days of hire:
- All staff with PHI access: Training within 90 days of hire is mandatory under Texas law
- Clinical staff (physicians, nurses, MAs, therapists): Role-based training on their specific PHI access patterns
- Administrative and billing staff: Training tailored to their PHI access responsibilities
- New hires: Must complete training before the 90-day deadline, not just at the next convenient opportunity
Texas law also requires retraining when a material change in state or federal law affects an employee's duties.
Each trained employee must also sign a statement, electronically or in writing, that they completed the training, and you must keep it for six years. In EZBunny, each person you assign this course to gets the statement to sign online right after they pass. Your Training Report shows who has signed. Download each signed statement as a PDF from your Team page and keep it in your own records.
Common Texas HB 300 training questions
How is Texas HB 300 different from HIPAA?
HB 300 expands who counts as a covered entity beyond HIPAA's definition. It requires training within 90 days of hire (HIPAA sets no fixed day count), requires retraining when a material change in state or federal law affects an employee's duties, adds Texas-specific marketing consent rules, and sets its own civil penalties, separate from federal HIPAA penalties.
What is the 90-day training requirement?
Texas law requires covered entities to provide privacy training to employees within 90 days of hire. Training must also be provided when a material change in state or federal law affects an employee's duties, within a reasonable period and no later than one year after the change takes effect. Each trained employee must sign a statement, electronically or in writing, verifying completion, and the covered entity must keep it for six years. Federal HIPAA sets no fixed day count: it requires training within a reasonable period of time after a person joins the workforce.
Can my team sign the Texas training statement in EZBunny?
Yes. Each person you assign this course to gets the statement to sign online right after they pass. Your Training Report shows who has signed, and you can download each signed statement as a PDF from your Team page. Texas law requires a covered entity to keep each signed statement for six years from the date it is signed, so keep your own copies.
What are the penalties for HB 300 violations?
Texas HB 300 sets graduated civil penalties per violation. Up to $5,000 for a negligent violation, up to $25,000 for a knowing or intentional violation, and up to $250,000 when a covered entity knowingly or intentionally used PHI for financial gain. If a court finds the violations happen often enough to be a pattern or practice, it may assess up to $1.5 million per year. For an entity licensed by a Texas licensing agency, the Attorney General can sue for a civil penalty only when that agency refers the violation. These are separate from federal HIPAA penalties.
Does HB 300 give patients a private right of action?
No. Unlike California's CMIA, Texas HB 300 does not provide a private right of action. Enforcement is handled by the Texas Attorney General. However, patients can still bring claims under other state law theories (negligence, breach of fiduciary duty).
If you operate in Texas, get your team trained within the 90-day deadline
About 20 minutes per person, with a certificate on completion. Setup takes about 5 minutes. Try it free for 14 days. Not charged until day 15.
Start your free trial$449/yr is the founder rate for up to 50 people, locked for 2 years from signup. After that, the standard rate is $699/yr.
Regulatory Disclaimer
Training requirements vary by organization type, size, state, payer mix, and accreditation. This guide reflects common federal and state requirements as of April 2026 and is not legal advice. Consult your compliance officer or legal counsel for requirements specific to your organization. EZBunny provides state privacy-law training for California, Texas, and New York. Our state-specific safety and harassment courses are awareness training and may not, on their own, satisfy your state's specific mandate. Other states may have requirements not covered here. Last reviewed: April 2026.