What Texas Laws Apply to Medical Couriers?
Medical couriers in Texas are subject to six Texas laws: the Texas Medical Records Privacy Act as amended by HB 300, the Texas Identity Theft Enforcement and Protection Act, the Texas Data Privacy and Security Act, the Texas Responsible AI Governance Act, SB 1188 concerning artificial intelligence and electronic health records, and the Texas Medical Practice Act. These laws apply in addition to federal HIPAA and address privacy, identity protection, data security, and professional conduct obligations that arise from handling Protected Health Information during courier work.
Texas Medical Records Privacy Act (HB 300)
The Texas Medical Records Privacy Act, as amended by House Bill 300, is the primary state law governing medical courier work in Texas. HB 300 defines a covered entity more broadly than federal HIPAA, reaching any individual or organization that assembles, collects, analyzes, uses, evaluates, stores, or transmits Protected Health Information in Texas, a definition that includes medical courier services regardless of their status under federal HIPAA. Texas Health and Safety Code § 181.101 requires a covered entity to provide employees who have access to Protected Health Information with training on this law, completed within 90 days of hire and repeated at least every two years. Violations of HB 300 are enforced by the Texas Attorney General, independently of any action taken by HHS’ Office for Civil Rights under federal HIPAA.
Texas Identity Theft Enforcement and Protection Act
The Texas Identity Theft Enforcement and Protection Act addresses the safeguarding of sensitive personal information and sets out notification obligations when a data breach exposes that information. A medical courier who handles records containing personal identifiers alongside Protected Health Information falls within the scope of this law, since a breach involving courier-handled materials can trigger the notification requirements it imposes.
Texas Data Privacy and Security Act
The Texas Data Privacy and Security Act establishes broader data privacy and security obligations for organizations that process the personal data of Texas residents. Medical courier companies that process personal data as part of their operations, separate from the Protected Health Information covered by HB 300, are subject to the security and processing requirements this law imposes.
Texas Responsible AI Governance Act
The Texas Responsible AI Governance Act governs the development and use of artificial intelligence systems in Texas, including systems used to process or manage healthcare data. A medical courier company using AI-driven tools for route planning, tracking, or data handling involving Protected Health Information should be aware of the governance obligations this law places on such systems.
SB 1188: Regulating AI and Electronic Health Records
SB 1188 addresses the use of artificial intelligence in connection with electronic health records, including requirements related to accuracy, oversight, and the safeguarding of health information processed through AI systems. This law is relevant to medical couriers whose work intersects with electronic health record systems or AI-driven logistics platforms that handle Protected Health Information.
Texas Medical Practice Act
The Texas Medical Practice Act governs the practice of medicine in Texas and includes provisions related to the confidentiality of patient records. While the Act is directed primarily at licensed medical practitioners, its confidentiality provisions inform the broader standard of care that applies to any party, including a medical courier, handling patient records on behalf of a Texas healthcare provider.
Why These Laws Matter for Medical Couriers
A medical courier trained only on federal HIPAA has not addressed the requirements these six Texas laws impose. HB 300 carries the most direct and specific training obligation for medical courier work, but the remaining five laws each address a related aspect of data privacy, security, or professional conduct that can apply depending on the specific materials, systems, and records a courier handles.
HIPAA training is required under federal law by 45 CFR § 164.530(b), which requires covered entities and Business Associates to train workforce members on policies and procedures relating to Protected Health Information, along with 45 CFR § 164.308(a)(5), the Security Rule’s security awareness and training requirement. OSHA training is required separately under three standards: 29 CFR § 1910.1030(g)(2) for Bloodborne Pathogens, requiring training at initial assignment and at least annually thereafter; 29 CFR § 1910.132(f)(1) for Personal Protective Equipment, requiring training before an employee performs work requiring PPE; and 29 CFR § 1910.1200(h)(1) for Hazard Communication, requiring training at initial assignment and whenever a new chemical hazard is introduced.