89R23762 EAS-D     By: Bonnen, Metcalf, et al. H.B. No. 4503     Substitute the following for H.B. No. 4503:     By:  King C.S.H.B. No. 4503       A BILL TO BE ENTITLED   AN ACT   relating to electronic health record requirements; authorizing a   civil penalty.          BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:          SECTION 1.  Subtitle I, Title 2, Health and Safety Code, is   amended by adding Chapter 183 to read as follows:   CHAPTER 183.  ELECTRONIC HEALTH RECORDS          Sec. 183.001.  DEFINITIONS.  In this chapter:                (1)  "Biological sex" means the biological trait that   determines whether a sexually reproducing organism produces male or   female gametes.                (2)  "Covered entity" has the meaning assigned by   Section 181.001.  The term includes a health care practitioner.  The   term does not include:                      (A)  a home and community support services agency   licensed under Chapter 142;                      (B)  a nursing facility licensed under Chapter   242;                      (C)  a continuing care facility regulated under   Chapter 246;                      (D)  an assisted living facility licensed under   Chapter 247;                      (E)  an intermediate care facility licensed under   Chapter 252;                      (F)  a day activity and health services facility   licensed under Chapter 103, Human Resources Code; or                      (G)  a provider under the Texas home living   (TxHmL) or home and community-based services (HCS) waiver program.                (3)  "Female" means an individual whose reproductive   system is developed to produce ova.                (4)  "Health care practitioner" means an individual who   is licensed, certified, or otherwise authorized to provide health   care services in this state.                (5)  "Male" means an individual whose reproductive   system is developed to produce sperm.                (6)  "Sexual development disorder" means a congenital   condition associated with atypical development of internal or   external genital structures.  The term includes a chromosomal,   gonadal, and anatomic abnormality.          Sec. 183.002.  REQUIREMENTS FOR ELECTRONIC HEALTH RECORD   STORAGE.  (a)  A covered entity shall ensure that electronic health   records under the control of the entity that contain patient   information are physically maintained in the United States or a   territory of the United States.  This subsection applies to:                (1)  electronic health records that are stored by a   third-party or subcontracted computing facility or an entity that   provides cloud computing services; and                (2)  electronic health records that are stored using a   technology through which patient information may be electronically   retrieved, accessed, or transmitted.          (b)  A covered entity shall ensure that the electronic health   record information of this state's residents, other than open data,   is accessible only to individuals who require the information to   perform duties within the scope of the individual's employment   related to treatment, payment, or health care operations.          (c)  Each covered entity shall implement reasonable and   appropriate administrative, physical, and technical safeguards to   protect the confidentiality, integrity, and availability of   electronic health record information.          Sec. 183.003.  REQUIRED MEDICAL HISTORY INFORMATION IN   ELECTRONIC HEALTH RECORD. A covered entity shall ensure each   electronic health record maintained for an individual includes the   option for a health care practitioner to collect and record   communications between two or more covered entities related to the   individual's metabolic health and diet in the treatment of a   chronic disease or illness.          Sec. 183.004.  INFORMATION RESTRICTIONS IN ELECTRONIC   HEALTH RECORD. A covered entity may not collect, store, or share   any information regarding an individual's credit score or voter   registration status in the individual's electronic health record.           Sec. 183.005.  ARTIFICIAL INTELLIGENCE IN ELECTRONIC HEALTH   RECORD. (a)  A health care practitioner who uses artificial   intelligence for diagnostic purposes, including the use of   artificial intelligence for recommendations on a diagnosis or   course of treatment based on a patient's medical record, shall   review all records created with artificial intelligence to ensure   that the data is accurate and properly managed.          (b)  A health care practitioner who uses artificial   intelligence for diagnostic purposes as described by Subsection (a)   must disclose the practitioner's use of that technology to the   practitioner's patients.          Sec. 183.006.  ACCESS TO ELECTRONIC HEALTH RECORD OF MINOR.   (a)  In this section, "minor" means an individual 17 years of age or   younger who has not had the disabilities of minority removed for   general purposes.           (b)  A covered entity shall ensure each electronic health   record system the entity uses to store electronic health records of   minors allows a minor's parent or, if applicable, the minor's   managing conservator or guardian to obtain complete and   unrestricted access to the minor's electronic health record   immediately upon request, unless access to all or part of the record   is restricted under state or federal law or by a court order.          Sec. 183.007.  ELECTRONIC HEALTH RECORD REQUIREMENTS   REGARDING BIOLOGICAL SEX.  (a)  Notwithstanding any other law, the   commission, the Texas Medical Board, and the Texas Department of   Insurance shall jointly ensure that:                (1)  each electronic health record prepared or   maintained by a covered entity in this state includes a separate   space for the entity to document:                      (A)  an individual's biological sex as either male   or female based on the individual's observed biological sex   recorded by a health care practitioner at birth; and                      (B)  information on any sexual development   disorder of the individual, whether identified at birth or later in   the individual's life; and                (2)  any algorithm or decision assistance tool included   in an electronic health record to assist a health care practitioner   in making medical treatment decisions includes an individual's   biological sex as recorded in the space described by Subdivision   (1)(A).          (b)  This section does not prohibit an electronic health   record from including spaces for recording other information   related to an individual's biological sex or gender identity.          Sec. 183.008.  AMENDING CERTAIN BIOLOGICAL SEX INFORMATION   IN ELECTRONIC HEALTH RECORDS.  (a)  A covered entity may amend on an   electronic health record an individual's biological sex as recorded   in the space described by Section 183.007(a)(1)(A) only if:                (1)  the amendment is to correct a clerical error; or                (2)  the individual is diagnosed with a sexual   development disorder and the amendment changes the individual's   listed biological sex to the opposite biological sex.          (b)  If an individual's biological sex is amended under   Subsection (a)(2), the covered entity shall include in the   individual's electronic health record information on the   individual's sexual development disorder in the space described by   Section 183.007(a)(1)(B).          Sec. 183.009.  INVESTIGATION BY COMMISSION OR REGULATORY   AGENCY. The commission or the appropriate regulatory agency shall   conduct an investigation of any credible allegation of a violation   of this chapter by a covered entity.  The commission or agency shall   ensure the investigation is conducted in compliance with all   applicable state and federal laws, including the Health Insurance   Portability and Accountability Act of 1996 (Pub. L. No. 104-191).          Sec. 183.010.  DISCIPLINARY ACTION BY REGULATORY AGENCY.     The appropriate regulatory agency may take disciplinary action   against a covered entity that violates this chapter three or more   times in the same manner as if the covered entity violated an   applicable licensing or regulatory law.  The disciplinary action   may include license, registration, or certification suspension or   revocation for a period the agency determines appropriate.          Sec. 183.011.  INJUNCTIVE RELIEF; CIVIL PENALTY.  (a)  The   attorney general may institute an action for injunctive relief to   restrain a violation of this chapter.          (b)  In addition to the injunctive relief provided by   Subsection (a), the attorney general may institute an action for   civil penalties against a covered entity for a violation of this   chapter.  A civil penalty assessed under this section may not   exceed:                (1)  $5,000 for each violation that is committed   negligently and that occurs in a single year, regardless of how long   the violation continues during that year;                (2)  $25,000 for each violation that is committed   knowingly or intentionally and that occurs in a single year,   regardless of how long the violation continues during that year; or                (3)  $250,000 for each violation in which the covered   entity knowingly or intentionally used protected health   information for financial gain.          Sec. 183.012.  MEMORANDUM OF UNDERSTANDING; RULES. The   executive commissioner, the Texas Medical Board, the Texas   Department of Licensing and Regulation, the Texas Department of   Insurance, and each regulatory agency subject to this chapter shall   enter into a memorandum of understanding and, as necessary, adopt   rules to implement this chapter.          SECTION 2.  (a)  Except as provided by Subsection (b) of this   section, Chapter 183, Health and Safety Code, as added by this Act,   applies only to an electronic health record prepared on or after the   effective date of this Act.          (b)  Section 183.002, Health and Safety Code, as added by   this Act, applies to the storage of an electronic health record on   or after January 1, 2026, regardless of the date on which the   electronic health record was prepared.          SECTION 3.  This Act takes effect September 1, 2025.