JD Key Consulting Logo
Signed Into Law
Signed June 20, 2025Effective 2025-06-20
HB3233

Regular Session

Relating to patient data maintained by pharmacy benefit managers.

Government Affairs & Regulatory Compliance Analysis

HB3233: Government Affairs Overview

Texas has enacted a strict data sovereignty mandate prohibiting Pharmacy Benefit Managers (PBMs) from storing or processing patient data outside the United States or its territories. This law effectively bans the use of offshore IT support, international call centers, and non-U. S.

Rep. Cody Harris·House Bill·Regular Session

Critical
High Cost
Effective:2025-06-20
Business Impact

Who HB3233 Affects

This legislation has regulatory implications for the following Texas businesses and organizations:

Regulatory Priority: critical

Significant regulatory changes (effective 2025-06-20). Review with your legal and compliance teams to understand implications.

🏥

Healthcare

Affected business types:

  • Hospitals
  • Healthcare systems
  • Medical practices
  • Health insurance providers
View all healthcare legislation

Key Operational Considerations

  • 1Client Agreements: Prepare compliance addendums for Health Plans and Self-Insured Employers warranting that their member data will remain on U.S. soil.

Estimated Cost Impact

highSignificant operational investment may be required.

Enforcing Agencies

Need Government Relations Support?

JD Key Consulting provides government affairs and regulatory strategy services. We help businesses navigate Texas agencies, understand legislative impacts, and advocate for their interests.

Need Help Navigating This Legislation?

JD Key Consulting provides strategic guidance on Texas regulatory compliance and legislative impact for your business.

HB3233
Relating to patient data maintained by pharmacy benefit managers.
Critical Urgency
Unanimous Passage
House Vote141 - 0
YEA
100% in favor141 voting
Senate Vote31 - 0
YEA
100% in favor31 voting
Cost Impact
High
Effective
2025-06-20
Enforcing Agencies
Texas Department of Insurance
Primary Author: Rep. Cody Harris
89th Texas Legislature
jdkey.com
01

Compliance Analysis

Key implementation requirements and action items for compliance with this legislation

Implementation Timeline

  • Effective Date: June 20, 2025 (Immediate effect due to supermajority vote).
  • Compliance Deadline: Compliance is triggered by contract execution. You must be compliant the moment you enter into or renew a contract on or after June 20, 2025. Existing contracts are grandfathered until their next renewal date.
  • Agency Rulemaking: The Texas Department of Insurance (TDI) is not explicitly required to issue rules by a specific date, creating a regulatory gray zone. Expect TDI to clarify definitions through enforcement actions or bulletins in late 2025.

Immediate Action Plan

  • Immediate Audit: Map all data flows to identify any storage or processing occurring outside the U.S.
  • Geofence Data: Configure cloud environments to restrict data replication solely to U.S. regions.
  • Review Renewals: Identify all contracts expiring between June 2025 and December 2025; renew them immediately (before June 20) to utilize the grandfather clause.
  • Update MSAs: Draft and deploy mandatory Data Sovereignty amendments for all downstream vendors.

Operational Changes Required

Contracts

  • Vendor Agreements (Cloud/IT): You must amend Master Services Agreements (MSAs) with cloud providers (AWS, Azure, etc.) and third-party administrators. Insert a "Data Sovereignty" clause strictly limiting data residency to the U.S. and its territories.
  • Client Agreements: Prepare compliance addendums for Health Plans and Self-Insured Employers warranting that their member data will remain on U.S. soil.
  • Strategic Renewals: Identify vendor contracts set to renew shortly *after* June 20, 2025. Execute early renewals *before* this date to lock in current terms and delay compliance requirements for the duration of the new term.

Hiring/Training

  • Access Revocation: IT security teams must revoke credentials for offshore support teams (e.g., India, Philippines) regarding Texas data. "Processing" includes remote viewing; therefore, "follow-the-sun" support models using international teams are now prohibited for this data.
  • Staffing Shifts: You may need to increase U.S.-based headcount or contract with U.S.-based support vendors to replace offshore capacity, likely at a higher labor cost.

Reporting & Record-Keeping

  • Data Flow Mapping: Create and maintain visual documentation proving the lifecycle of patient data (entry, storage, backup, processing) remains within the U.S.
  • Audit Logs: Configure server logs to flag and report any IP address accessing patient data from outside the U.S. for internal audit purposes.

Fees & Costs

  • Infrastructure Costs: Migrating data from international redundancy zones to U.S.-only availability zones will incur egress fees and potentially higher storage rates.
  • Labor Costs: Replacing offshore IT/Customer Support with domestic equivalents will significantly increase operational overhead.

Strategic Ambiguities & Considerations

  • Definition of "Process": The statute does not explicitly define "process." In regulatory contexts, this typically includes "viewing" or "consulting" data, even if not downloaded. Assume the strictest interpretation: If a support agent in a foreign country can see the screen, you are in violation.
  • Scope of "Patient Data": The law does not distinguish between PII/PHI and de-identified or aggregated data. Until TDI rules otherwise, treat *all* data derived from Texas patients as restricted.
  • "Territories": While Puerto Rico and Guam are compliant storage locations, proximity does not equal compliance. Data stored in nearby non-territory nations (e.g., Bahamas, Dominican Republic) is prohibited.

Need Compliance Guidance on This Legislation?

JD Key Consulting specializes in Texas regulatory compliance strategy. Work directly with James Dickey—former Chairman of the Republican Party of Texas—to understand this bill's impact on your operations and develop an actionable compliance plan.

Schedule a Consultation

Information presented is for general knowledge only and is provided without warranty, express or implied. Consult qualified government affairs professionals and legal counsel before making compliance decisions.

02

Legislative Timeline

This bill's path through the Texas Legislature

Filed
Feb 24, 2025
Passed House
May 12, 2025
Passed Senate
May 25, 2025
Signed
Jun 20, 2025
Effective
Jun 20, 2025
TopicsElectronic Information SystemsHealth Care ProvidersHealthHealth--privacy/use of InformationInsuranceInsurance--health & AccidentPatient Rights & ProtectionPharmacy Benefit Managers
03

House Authors

Rep. Cody HarrisRepublican · Primary Author

Senate Sponsor

Sen. Lois KolkhorstRepublican · Primary Sponsor

Bill Text(with markup)

View bill text in multiple formats on Texas Legislature website

Fiscal NoteView Original

Related Legislation

Explore more bills from this author and on related topics

More from Rep. Cody Harris

View all bills by Rep. Cody Harris

Related by Topic

View more Electronic Information Systems legislation
Quick Reference

Frequently Asked Questions

Common questions about HB3233

Q

What does Texas HB3233 do?

Texas has enacted a strict data sovereignty mandate prohibiting Pharmacy Benefit Managers (PBMs) from storing or processing patient data outside the United States or its territories. This law effectively bans the use of offshore IT support, international call centers, and non-U. S.

Q

Who authored HB3233?

HB3233 was authored by Texas Representative Cody Harris during the Regular Session.

Q

When was HB3233 signed into law?

HB3233 was signed into law by Governor Greg Abbott on June 20, 2025.

Q

Which agencies enforce HB3233?

HB3233 is enforced by Texas Department of Insurance.

Q

How significant are the changes in HB3233?

The regulatory priority for HB3233 is rated as "critical". Businesses and organizations should review the legislation to understand potential impacts.

Q

What is the cost impact of HB3233?

The cost impact of HB3233 is estimated as "high". This may vary based on industry and implementation requirements.

Q

What topics does HB3233 address?

HB3233 addresses topics including electronic information systems, health care providers, health, health--privacy/use of information and insurance.

Q

What are the key dates for HB3233?

Key dates for HB3233: Effective date is 2025-06-20. Consult with legal counsel regarding applicability.

Q

What are the penalties under HB3233?

HB3233 establishes the following penalties: administrative penalty of Subject to standard Texas Department of Insurance sanctions (fines, license revocation) for Storing or processing Texas resident patient data in a location outside of the United States or its territories.. Consult with legal counsel for specific applicability to your situation.

Q

Which Texas businesses are affected by HB3233?

HB3233 primarily affects healthcare providers and medical facilities, insurance companies and financial institutions. These businesses should review the legislation with their legal and compliance teams to understand potential impacts.

Need Strategic Guidance on This Legislation?

JD Key Consulting is an Austin, Texas-based government affairs firm led by James Dickey, former Chairman of the Republican Party of Texas. We specialize in Texas regulatory compliance and legislative strategy for data centers, energy, banking, and manufacturing.

Legislative data provided by LegiScanLast updated: January 11, 2026