Relating to electronic health record requirements; authorizing a civil penalty.
CriticalImmediate action required
High Cost
Effective:2025-09-01
Enforcing Agencies
Texas Attorney General (Injunctive relief and civil penalties) • Texas Medical Board • Health and Human Services Commission (HHSC) • Texas Department of Insurance • Texas Department of Licensing and Regulation
01
Compliance Analysis
Key implementation requirements and action items for compliance with this legislation
Implementation Timeline
Effective Date: September 1, 2025 (General Provisions and Record Formatting).
Compliance Deadline:
September 1, 2025: New patient records must utilize mandated data fields; AI disclosures must commence; parental access portals must be unrestricted.
January 1, 2026:Hard Stop for Data Residency. All electronic health records (historical and current) must be physically stored within the United States.
Agency Rulemaking: HHSC, the Texas Medical Board, TDLR, and TDI must enter a memorandum of understanding and adopt rules defining specific data standards prior to September 1, 2025. Expect a regulatory "gray zone" in Summer 2025 as agencies rush to define technical specifications for "Biological Sex" and "AI" definitions.
Immediate Action Plan
1.Audit Data Residency: Immediately demand a "Data Residency Report" from your IT/EHR vendor to confirm current physical storage locations.
2.Update Liability Insurance: Review Cyber and E&O policies to ensure coverage for "regulatory fines and penalties" related to state privacy laws.
3.Purge Prohibited Fields: Remove data entry fields for credit scores and voter registration from all intake forms and software interfaces.
4.Draft AI Disclosures: Create a patient consent addendum disclosing the use of AI-assisted diagnostic tools for use starting Sept 1, 2025.
5.Vendor Demand Letter: Send formal notice to your EHR vendor citing SB1188, requiring a roadmap for the implementation of "Biological Sex" and "Sexual Development Disorder" fields.
Operational Changes Required
Contracts
Vendor Certification: You must immediately amend Master Service Agreements (MSAs) with EHR vendors and cloud providers (e.g., AWS, Azure) to mandate data sovereignty. The contract must guarantee that data is never stored, processed, or backed up on servers outside the United States.
Indemnification: Update vendor contracts to include indemnification for civil penalties resulting from the vendor's failure to provide compliant data fields or domestic storage.
Subcontractors: Require vendors to certify that their downstream subcontractors also comply with the US-only residency requirement.
Hiring/Training
Clinical Staff: Providers must be trained to document "Human in the Loop" review. They cannot simply sign off on an AI diagnostic recommendation; they must affirmatively document their independent review.
Intake Staff: Train front-desk personnel to stop collecting credit scores or voter registration status. If these fields exist in current workflows, they must be disabled.
AI Disclosure: Staff must be trained to present and secure signatures on AI usage disclosure forms at the point of care.
Reporting & Record-Keeping
Mandatory Data Fields: Your EHR must be reconfigured to capture "Biological Sex" (defined strictly as Male/Female based on gamete production) and a separate field for "Sexual Development Disorder."
Parental Access: IT teams must disable automatic "adolescent privacy" filters in patient portals. Parents must have "complete, unrestricted, and immediate" access to minor records unless a court order exists.
Metabolic Health: Configure the EHR to allow specific recording of diet and metabolic health communications for chronic disease management.
Fees & Costs
Civil Penalties: The law introduces a tiered penalty structure: up to $5,000 for negligent violations, $25,000 for knowing violations, and $250,000 for violations involving financial gain.
IT Remediation: Expect significant one-time costs for EHR reconfiguration and potential data migration fees to move storage to US-based servers.
Strategic Ambiguities & Considerations
Definition of "Artificial Intelligence": The statute is broad regarding what constitutes AI in a diagnostic context. It is unclear if standard clinical decision support tools (e.g., drug interaction checkers) trigger the disclosure requirement. Watch TMB rulemaking closely for this definition.
"Immediate" Access: The requirement for "immediate" parental access is technically undefined. Agencies may interpret this as real-time API access, which many legacy systems cannot support.
Metabolic Health Communications: The requirement to record communications regarding diet is vague on format. It is unclear if this requires structured data (CCDA) or if free-text notes suffice.
Need Help Understanding Implementation?
Our government affairs experts can walk you through this bill's specific impact on your operations.
Information presented is for general knowledge only and is provided without warranty, express or implied. Consult qualified government affairs professionals and legal counsel before making compliance decisions.
Medical records provide vital patient information to healthcare providers, informing patient care. Therefore, it is imperative that these records are secure, accessible to relevant patient parties, accurate, and used for their intended purpose.
Currently, some medical record systems automatically remove parental access from their child's medical record, only allowing "proxy" access if the child subsequently grants it. Not only do parents need to understand and be up to date on their child's medical history as legal guardians, but children also may not fully understand their own medical record and require assistance. Furthermore, though the development of artificial intelligence can prove helpful in the medical field, it should not replace the role of the physician with regard to medical records.
Additionally, in order to ensure accuracy and allow doctors to make informed, personalized decisions regarding patient care, medical records must include vital information such as a patient's biological sex at birth. Biological sex informs medical care decisions with regard to the anatomy of organ systems, disease prevalence, drug and toxin tolerance, and other relevant factors for determining care.
Lastly, medical records also have recently been used for voter registration purposes and for entities to determine credit score reports. Medical records should be used for their intended purpose�communication between providers and patients�rather than as a financial or social engineering tool.
S.B. 1188 seeks to address these issues, as well as improve patient care by adding a place for doctors to address metabolic health and other root-causes of health issues.
As proposed, S.B. 1188 amends current law relating to electronic health record requirements.
RULEMAKING AUTHORITY
Rulemaking authority is expressly granted to the Health and Human Services Commission in SECTION 1 (Section 183.010, Health and Safety Code) of this bill.
Rulemaking authority is expressly granted to the Texas Medical Board in SECTION 1 (Section 183.010, Health and Safety Code) of this bill.
Rulemaking authority is expressly granted to the Texas Department of Insurance in SECTION 1 (Section 183.010, Health and Safety Code) of this bill.
SECTION BY SECTION ANALYSIS
SECTION 1. Amends Subtitle I, Title 2, Health and Safety Code, by adding Chapter 183, as follows:
CHAPTER 183. ELECTRONIC HEALTH RECORDS
Sec. 183.001. DEFINITIONS. Defines "biological sex," "female," "governmental entity," "health care practitioner," "male," "medical facility," and "sexual development disorder."
Sec. 183.002. REQUIREMENTS FOR ELECTRONIC HEALTH RECORD STORAGE. (a) Requires each medical facility, health care practitioner, and governmental entity to store all electronic health record information of residents of this state only at a location in the United States.
(b) Requires each medical facility, health care practitioner, and governmental entity to ensure electronic health record information of residents of this state, other than open data, is inaccessible to any person located outside of the United States.
Sec. 183.003. REQUIRED MEDICAL HISTORY INFORMATION IN ELECTRONIC HEALTH RECORD. Requires a medical facility, health care practitioner, or governmental entity to ensure each electronic health record maintained for an individual includes the individual's medical history and any communications between the practitioner and a specialty health care practitioner related to the individual's metabolic health and diet in the treatment of a chronic disease or illness.
Sec. 183.004. INFORMATION RESTRICTIONS IN ELECTRONIC HEALTH RECORD. Prohibits a medical facility, health care practitioner, or governmental entity from collecting or storing any information regarding an individual's credit score or voter registration status in the individual's electronic health record.
Sec. 183.005. ARTIFICIAL INTELLIGENCE IN ELECTRONIC HEALTH RECORD. Requires a health care practitioner who uses artificial intelligence for diagnostic or other purposes, including the use of artificial intelligence for recommendations on a diagnosis or course of treatment based on a patient's medical record, to review all information obtained through the artificial intelligence process to ensure the accuracy of the information for that patient before entering the information in the patient's electronic health record.
Sec. 183.006. ACCESS TO ELECTRONIC HEALTH RECORD OF MINOR. (a) Defines "minor."
(b) Requires a medical facility, health care practitioner, or governmental entity to ensure each electronic health record system the facility, practitioner, or entity uses to store electronic health records of minors automatically allows a minor's parent, guardian, or conservator to fully access the minor's electronic health record unless access to all or a portion of the record is restricted under state or federal law or by a court order.
Sec. 183.007. ELECTRONIC HEALTH RECORD REQUIREMENTS REGARDING BIOLOGICAL SEX. (a) Requires the Health and Human Services Commission (HHSC), the Texas Medical Board (TMB), and the Texas Department of Insurance (TDI) to jointly ensure that:
(1) each electronic health record prepared or maintained by a medical facility, health care practitioner, or governmental entity in this state includes a separate space for the health care practitioner to document:
(A) an individual's biological sex as either male or female based on the individual's observed biological sex recorded by a health care practitioner at birth; and
(B) information on any sexual development disorder of the individual, whether identified at birth or later in the individual's life; and
(2) any algorithm or decision assistance tool included in an electronic health record to assist a health care practitioner in making medical treatment decisions is based on an individual's biological sex as recorded in the space described by Subdivision (1)(A).
(b) Provides that this section does not prohibit an electronic health record from including spaces for recording other information related to an individual's biological sex or gender identity.
Sec. 183.008. AMENDING CERTAIN BIOLOGICAL SEX INFORMATION IN ELECTRONIC HEALTH RECORDS. (a) Provides that a medical facility, health care practitioner, or governmental entity is authorized to amend on an electronic health record an individual's biological sex as recorded in the space described by Section 183.007(a)(1)(A) only if:
(1) the amendment is to correct a clerical error; or
(2) the individual is diagnosed with a sexual development disorder and the amendment changes the individual's listed biological sex to the opposite biological sex.
(b) Requires the medical facility, health care practitioner, or governmental entity, if an individual's biological sex is amended under Subsection (a)(2), to include in the individual's electronic health record information on the individual's sexual development disorder in the space described by Section 183.007(a)(1)(B).
Sec. 183.009. DISCIPLINARY ACTION BY LICENSING AGENCY; MEDICAID REIMBURSEMENT INELIGIBILITY. (a) Authorizes the appropriate state licensing agency to take disciplinary action against a medical facility or health care practitioner that violates this chapter as if the medical facility or health care practitioner violated an applicable licensing law.
(b) Prohibits HHSC from providing Medicaid reimbursement to a medical facility or health care practitioner that violates this chapter and requires HHSC to disenroll the medical facility or health care practitioner from participation as a Medicaid provider.
Sec. 183.010. RULES. Requires HHSC, TMB, and TDI to adopt rules as necessary to implement this chapter.
SECTION 2. (a) Makes application of Chapter 183, Health and Safety Code, as added by this Act, except as provided by Subsection (b) of this section, prospective.
(b) Provides that Section 183.002, Health and Safety Code, as added by this Act, applies to the storage of an electronic health record on or after January 1, 2026, regardless of the date on which the electronic health record was prepared.
Honorable Lois W. Kolkhorst, Chair, Senate Committee on Health & Human Services
FROM:
Jerry McGinty, Director, Legislative Budget Board
IN RE:
SB1188 by Kolkhorst (Relating to electronic health record requirements.), As Introduced
No significant fiscal implication to the State is anticipated.
It is assumed that any costs associated with the bill could be absorbed using existing resources.
Local Government Impact
No significant fiscal implication to units of local government is anticipated.
Source Agencies: b > td >
452 Department of Licensing and Regulation, 454 Department of Insurance, 503 Texas Medical Board, 529 Health and Human Services Commission, 537 State Health Services, Department of, 644 Juvenile Justice Department, 696 Department of Criminal Justice, 701 Texas Education Agency, 710 Texas A&M University System Administrative and General Offices, 720 The University of Texas System Administration
LBB Staff: b > td >
JMc, NPe, THO, NAz, APA
Related Legislation
Explore more bills from this author and on related topics
SB1188 mandates a fundamental restructuring of Electronic Health Record (EHR) systems in Texas, requiring strict US-only data residency, specific biological sex data fields, and mandatory disclosure of AI usage in diagnostics. This law affects all "Covered Entities" (practitioners, hospitals, clinics) and introduces a "three-strikes" license revocation penalty for repeated non-compliance. Implementation Timeline Effective Date: September 1, 2025 (General Provisions and Record Formatting).
Q
Who authored SB1188?
SB1188 was authored by Texas Senator Lois Kolkhorst during the Regular Session.
Q
When was SB1188 signed into law?
SB1188 was signed into law by Governor Greg Abbott on June 20, 2025.
Q
Which agencies enforce SB1188?
SB1188 is enforced by Texas Attorney General (Injunctive relief and civil penalties), Texas Medical Board, Health and Human Services Commission (HHSC), Texas Department of Insurance and Texas Department of Licensing and Regulation.
Q
How urgent is compliance with SB1188?
The compliance urgency for SB1188 is rated as "critical". Businesses and organizations should review the requirements and timeline to ensure timely compliance.
Q
What is the cost impact of SB1188?
The cost impact of SB1188 is estimated as "high". This may vary based on industry and implementation requirements.
Q
What topics does SB1188 address?
SB1188 addresses topics including artificial intelligence, electronic information systems, health care providers, health and health--general.
Legislative data provided by LegiScanLast updated: November 25, 2025
Need Strategic Guidance on This Bill?
Need help with Government Relations, Lobbying, or compliance? JD Key Consulting has the expertise you're looking for.