Does the Texas privacy law apply to my clinic?

Usually not. The Texas Data Privacy and Security Act (TDPSA) took effect on July 1, 2024. It leaves out HIPAA covered entities and their business associates, it exempts protected health information, and it exempts most small businesses. A dental, physical therapy, occupational therapy or chiropractic practice with two to four locations typically meets more than one of those tests. Patient data at a Texas clinic is governed by HIPAA and by Texas's own medical privacy law (HB 300), not by the TDPSA.

What is the Texas Data Privacy and Security Act?

The TDPSA is Texas's consumer privacy law. The Legislature passed it in 2023 as House Bill 4, and it is codified as chapter 541 of the Texas Business & Commerce Code. It gives Texas residents the right to see, correct, delete and port their personal data. It also gives them the right to opt out of targeted advertising, the sale of their data, and certain automated profiling. Businesses must answer those requests within 45 days (§541.052).

Does the TDPSA apply to a dental, PT or chiropractic clinic?

For most clinics, no. Section 541.002 sets two separate gates, and a clinic only needs to clear one of them to be outside the law.

Gate 1: HIPAA covered entities and business associates are excluded. Section 541.002(b)(3) says the chapter "does not apply to" a covered entity or business associate governed by the HIPAA privacy, security and breach notification rules (45 C.F.R. Parts 160 and 164). A clinic that bills insurance electronically is a HIPAA covered entity. A texting vendor that handles patient data for a covered clinic is its business associate.

Gate 2: small businesses are excluded. The law applies only to a business that "is not a small business as defined by the United States Small Business Administration" (§541.002(a)(3)). The SBA's size standards (13 C.F.R. §121.201) are based on average annual receipts: $9.0 million for offices of dentists and offices of chiropractors, and $12.5 million for offices of physical, occupational and speech therapists.

Is patient data covered even if my clinic isn't?

No. Section 541.003 exempts the data itself, separately from the business. Exempt data includes protected health information under HIPAA and health records. It also covers information "intermingled" with that data and maintained by a covered entity or business associate. That means a patient's name and mobile number, held by a clinic as part of its patient records, are outside the TDPSA.

What if my clinic isn't a HIPAA covered entity?

Some practices, such as cash-only clinics that never bill insurance electronically, may not be HIPAA covered entities. Those clinics lose Gate 1, but most still pass Gate 2 as small businesses, and health records stay exempt under §541.003. Small businesses keep one TDPSA duty: they may not sell sensitive data, such as a mental or physical health diagnosis, without the person's prior consent (§541.107). Sharing data with a vendor that processes it on the clinic's behalf is not a "sale" under the law (§541.001(28)(A)). Ask your attorney whether your practice is a HIPAA covered entity before relying on either gate.

What does the TDPSA require of a business it does cover?

For a business inside the law (the "controller"), the main duties are:

• A clear privacy notice listing the categories of personal data it processes, why, who it shares them with, and how people exercise their rights (§541.102).
• Consent before processing sensitive data, which includes health diagnoses (§541.101(b)(4)).
• Answering rights requests within 45 days, extendable once by another 45 days (§541.052).
• A written contract with each vendor that processes personal data for it (§541.104(b)). The contract must set the instructions, purpose, type of data and duration of processing, and the rights and obligations of both parties, and must require the vendor to: keep the data confidential; delete or return it when the service ends; show its compliance on request; allow reasonable assessments; and bind its own subcontractors to the same terms.

Who enforces the TDPSA, and what are the penalties?

Only the Texas Attorney General enforces the TDPSA (§541.151). There is no private right of action (§541.156). Before suing, the Attorney General must give 30 days' written notice, and a business that cures the violation in that time and sends the Attorney General the written statement the law requires (that it cured the violation, notified consumers where it can, gave supporting documents and changed its policies where needed) can't be sued for it, as long as it keeps to that statement (§541.154). After that, the penalty is up to $7,500 per violation, plus injunctions and the state's legal costs (§541.155). On January 13, 2025, the Attorney General filed the first lawsuit under the TDPSA, against Allstate and Arity, over driving and location data collected without notice or consent.

What this means for your clinic

• Your patient privacy obligations come from HIPAA and Texas HB 300, not the TDPSA. HB 300 (Texas Health & Safety Code chapter 181) is stricter than HIPAA in places, including required staff training. See HIPAA, the BAA and Texas HB 300.
• Don't treat "exempt" as "nothing to do." The exemptions depend on facts about your practice: whether you're a HIPAA covered entity, and your receipts against the SBA standard. Have your attorney confirm both once, and again if you grow or change how you bill.
• Never sell patient data, including to marketing partners. Even where the TDPSA applies only partly, selling sensitive data without consent is prohibited (§541.107), and HIPAA restricts it further.
• Put privacy terms in every vendor contract that touches patient contact details. A BAA covers PHI. A data processing addendum on the §541.104 model covers anything that falls outside PHI.

How Automynds handles it

• We sign a BAA before any patient data moves. If your clinic is a HIPAA covered entity, that makes us your business associate.
• A data protection addendum is part of every contract, whether or not the TDPSA applies to your practice. It follows the processor contract § 541.104 describes: we process your data only on your instructions, keep it confidential, delete or return it when the service ends, share compliance information on request, allow reasonable assessments, and bind our subprocessors to the same terms. For patient data, the BAA you sign with us sets the breach-reporting window and how data is returned.
• Our contract says we never sell patient data or use it for advertising.
• We use only what a review text needs. Typically a patient ID, first name, the mobile number, the text-message consent flag, and where and when the visit ended. Your contract lists the exact fields for your clinic. Ratings and comments come only from the patient's own reply. Never clinical notes, diagnoses or treatment details.
• Training records for your files. Dated sign-offs you can keep for HIPAA and Texas privacy training requirements.

Questions about our contracts: hello@automynds.com. Automynds, LLC, Dallas, TX.