Texas NPP Requirements: HB300 + HIPAA

By NPP Generator Research Team  ·  Published Apr 25, 2026  ·  Last reviewed Apr 28, 2026  ·  7 min read

Texas's Medical Records Privacy Act — usually called HB300 — went into effect in 2012 and was meaningfully strengthened in 2021. Any Texas-licensed practice subject to HIPAA also has to comply with HB300, which is generally more protective. The interaction shows up in a few specific places in your Notice of Privacy Practices.

How HB300 expands the HIPAA covered-entity definition

HIPAA's covered-entity definition is narrow: providers who electronically transmit PHI in the course of standard transactions, health plans, and clearinghouses. HB300's covered-entity definition is broader. It captures any person, organization, or business that obtains, assembles, collects, analyzes, evaluates, stores, or transmits PHI for any purpose other than the patient's own health care needs. That sweeps in many organizations that aren't HIPAA covered entities but handle PHI — for instance, employers running self-funded health plans, certain wellness vendors, and some HR-adjacent services.

If your Texas practice is HIPAA-covered, you're definitely HB300-covered. If you're a Texas business that touches PHI but isn't HIPAA-covered, you may still be HB300-covered and need NPP-style disclosures.

What HB300 requires that HIPAA does not

Three obligations sit on top of standard HIPAA NPP content for Texas covered entities:

• Biennial HIPAA training. HB300 requires a documented HIPAA training program for all employees within 90 days of hire and at least every two years thereafter. The training program is referenced in some practices' NPPs as evidence of safeguarding commitments, though direct disclosure is not mandated.
• 60-day breach notification to affected Texans. HB300 mandates notification to affected Texas residents within 60 days of breach discovery. HIPAA allows 60 days as well, but HB300 imposes Texas-specific requirements about notification content and the Texas Attorney General's role.
• Authorization for electronic disclosure of PHI for marketing. Texas requires explicit written authorization for any electronic marketing disclosure of PHI. The NPP should describe this authorization-required disclosure category in addition to HIPAA's marketing language.

Texas-specific NPP language to include

Texas covered entities should add or reinforce these clauses in the NPP:

• A clear statement that the practice complies with both HIPAA and Texas Medical Records Privacy Act
• A reference to electronic-marketing-authorization requirements (HB300 § 181.154)
• A statement that the practice provides employee HIPAA training every two years
• Privacy Officer contact (HIPAA-required) and an explicit Texas Attorney General complaint route (HB300 § 181.201)
• If you serve patients across state lines, language clarifying which state's stricter law applies for which patients

Sensitive-record categories with extra Texas protection

Texas applies extra protection to several record categories. The NPP should disclose these as authorization-required uses (or note that disclosure follows the stricter rule):

• Mental-health records under Texas Health & Safety Code Chapter 611 — generally require written consent for disclosure beyond treatment, payment, and certain narrow exceptions
• HIV/AIDS test results under Texas Health & Safety Code § 81.103 — disclosure restricted unless explicitly authorized
• Genetic information under Texas Occupations Code Chapter 58 — strict authorization rules
• Substance use disorder records under 42 CFR Part 2 — already federally protected; Texas adds nothing inconsistent but the NPP should still reference Part 2 if applicable

Distribution and posting in Texas

HIPAA's distribution rules apply uniformly: provide the NPP at the first patient encounter, post it on the practice's public website, and post it visibly at every clinical location. HB300 doesn't add distribution requirements, but a few practical notes for Texas practices:

• Bilingual NPPs are common in Texas given the large Spanish-speaking patient population. HHS doesn't require bilingual versions, but providing one is a recognized good-faith safeguard.
• Border practices serving cross-border patients should be deliberate about which entity's NPP applies to whom
• Multi-location practices (especially DSOs and group practices) need a single NPP listing all Texas locations or, if they're legally separate covered entities, a separate NPP per entity

How this fits with the HHS February 2026 revised model

The HHS February 2026 final rule revised the NPP model and clarified several content requirements. Practices issuing or updating an NPP after February 16, 2026 should align to the new model. Key changes that affect every NPP regardless of specialty include: the addition of mandatory language describing the practice's safeguards against unauthorized AI-driven uses of PHI; updated breach-notification language reflecting Cures Act information-blocking interactions; refined Right of Access language describing electronic-format options; and updated language around marketing communications.

For practices that updated to the HHS Feb 2026 model upon publication, no further regulatory NPP work is required until the next material change. Practices still on pre-February-2026 templates should update before their next material-change cycle to avoid drift.

Common implementation pitfalls

Across audits and routine compliance reviews, several specific implementation pitfalls recur:

• Privacy Officer drift. The named Privacy Officer leaves or moves to a different role; the NPP isn't updated.
• Acknowledgment-form mismatch. The acknowledgment form references an outdated NPP version. The form should always reference the current effective date.
• Multi-site inconsistency. Multi-location practices inadvertently use slightly different NPPs at different sites. Standardize on a single document.
• Translation drift. Practices providing Spanish or other-language NPPs sometimes update one language and not the other. Maintain version parity.
• Vendor-relationship update lag. When the practice adds or removes a major vendor relationship, the NPP isn't updated to reflect the new data flow until much later.

Audit-readiness considerations

When OCR or a state regulator audits, the NPP review typically asks for:

• Current NPP version with effective date
• Sample acknowledgment forms from the past 12 months
• Documentation of distribution process (front-desk procedure, telehealth workflow)
• Evidence of website posting (URL of public-facing NPP page)
• Evidence of physical posting (typically a photograph of the lobby posting)
• Documentation of material changes and re-distribution events
• Privacy Officer contact and complaint-log
• Training records (HIPAA-required workforce training, plus any state-specific requirements)

Quick reference checklist

When producing or updating an NPP, work through this checklist:

• Identify the legal covered entity. One NPP per legal entity. If you have multiple legal entities, you need multiple NPPs.
• List all clinical locations covered by this entity, including any virtual-only telehealth presence
• Confirm the Privacy Officer. Name, title, contact information. Update when this person changes.
• Inventory uses and disclosures. What data flows happen in your practice? Each major flow should be reflected in the NPP's permitted-use section.
• Confirm authorization-required disclosures. Marketing, sale of PHI, psychotherapy notes, and any state-specific authorization-required categories.
• Verify HIPAA-required content. Header statement, all eight individual rights, entity duties, complaint procedures, breach notification rights, paper-copy availability.
• Add state-law overlay. If your state has additional protection (mental health, HIV, genetic, biometric), reflect it in the NPP.
• Set effective date and last-revised date. Both should be current and visible.
• Distribution mechanics. First-encounter delivery, website posting, physical posting, electronic availability, multi-language versions if applicable.

How NPP Generator helps

Producing a HIPAA-compliant Notice of Privacy Practices from scratch — even with the HHS February 2026 model as a starting point — typically takes a few hours of attention to entity-specific details: practice name, locations, Privacy Officer, vendor relationships, state-specific overlays, sensitive-record categories, communication preferences, and effective-date management.

NPP Generator's tool walks through a guided intake, captures the practice-specific information, and produces a formatted PDF and editable Word document aligned to the HHS February 2026 model in about five minutes. The tool also handles state-specific overlay language for the major state-law regimes and produces a current-effective-date document ready for distribution. For practices that need state-specific overlay (Texas HB300, Illinois MHDDC, California CMIA/CCPA, etc.), the tool's state-handler ensures the right elevated-protection language appears in your final document.

About state-law and federal preemption

HIPAA establishes a federal floor for health-information privacy. State laws are not preempted where they are more protective of patient privacy than HIPAA — that's the basic preemption rule under 45 CFR § 160.203. The interaction can be subtle: a state law may be stricter on a specific topic (HIV records, mental-health records, genetic information) without being globally stricter than HIPAA. The NPP must reflect the stricter rule wherever it applies. Practices serving patients in multiple states often issue a single NPP that incorporates the strictest applicable rules across those states; multi-state organizations sometimes use state-specific NPP versions for clarity. For organizations subject to specific federal regimes beyond HIPAA — 42 CFR Part 2 for SUD, FERPA for educational records, Title X for federally-funded family-planning services — the NPP should describe how those regimes interact with HIPAA's framework.

Further reading

For more on the topics covered here:

• What is a Notice of Privacy Practices? — foundational explanation
• NPP requirements in 2026 — current regulatory baseline
• HHS February 2026 model walkthrough — the current federal baseline
• When state law is stricter than federal — preemption framework
• ComplyCreate: HIPAA vs state privacy laws — full state-by-state comparison