By: Kolkhorst  S.B. No. 1188          (In the Senate - Filed February 7, 2025; February 28, 2025,   read first time and referred to Committee on Health & Human   Services; March 31, 2025, reported adversely, with favorable   Committee Substitute by the following vote:  Yeas 8, Nays 1;   March 31, 2025, sent to printer.)Click here to see the committee vote     COMMITTEE SUBSTITUTE FOR S.B. No. 1188 By:  Hancock     A BILL TO BE ENTITLED   AN ACT     relating to electronic health record requirements; authorizing a   civil penalty.          BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:          SECTION 1.  Subtitle I, Title 2, Health and Safety Code, is   amended by adding Chapter 183 to read as follows:   CHAPTER 183.  ELECTRONIC HEALTH RECORDS          Sec. 183.001.  DEFINITIONS.  In this chapter:                (1)  "Biological sex" means the biological trait that   determines whether a sexually reproducing organism produces male or   female gametes.                (2)  "Covered entity" has the meaning assigned by   Section 181.001. The term includes a health care practitioner.                (3)  "Female" means an individual whose reproductive   system is developed to produce ova.                (4)  "Health care practitioner" means an individual who   is licensed, certified, or otherwise authorized to provide health   care services in this state.                (5)  "Male" means an individual whose reproductive   system is developed to produce sperm.                (6)  "Sexual development disorder" means a congenital   condition associated with atypical development of internal or   external genital structures.  The term includes a chromosomal,   gonadal, and anatomic abnormality.          Sec. 183.002.  REQUIREMENTS FOR ELECTRONIC HEALTH RECORD   STORAGE.  (a)  A covered entity shall ensure that electronic health   records under the control of the entity that contain patient   information are physically maintained in the United States or a   territory of the United States.  This subsection applies to:                (1)  electronic health records that are stored by a   third-party or subcontracted computing facility or an entity that   provides cloud computing services; and                (2)  electronic health records that are stored using a   technology through which patient information may be electronically   retrieved, accessed, or transmitted.          (b)  A covered entity shall ensure that the electronic health   record information of this state's residents, other than open data,   is accessible only to individuals who require the information to   perform duties within the scope of the individual's employment   related to treatment, payment, or health care operations.          (c)  Each covered entity shall implement reasonable and   appropriate administrative, physical, and technical safeguards to   protect the confidentiality, integrity, and availability of   electronic health record information.          Sec. 183.003.  REQUIRED MEDICAL HISTORY INFORMATION IN   ELECTRONIC HEALTH RECORD. A covered entity shall ensure each   electronic health record maintained for an individual includes the   option for a health care practitioner to collect and record   communications between two or more covered entities related to the   individual's metabolic health and diet in the treatment of a   chronic disease or illness.          Sec. 183.004.  INFORMATION RESTRICTIONS IN ELECTRONIC   HEALTH RECORD. A covered entity may not collect, store, or share   any information regarding an individual's credit score or voter   registration status in the individual's electronic health record.           Sec. 183.005.  ARTIFICIAL INTELLIGENCE IN ELECTRONIC HEALTH   RECORD. (a)  A health care practitioner who uses artificial   intelligence for diagnostic purposes, including the use of   artificial intelligence for recommendations on a diagnosis or   course of treatment based on a patient's medical record, shall   review all records created with artificial intelligence to ensure   that the data is accurate and properly managed.          (b)  A health care practitioner who uses artificial   intelligence for diagnostic purposes as described by Subsection (a)   must disclose the practitioner's use of that technology to the   practitioner's patients.          Sec. 183.006.  ACCESS TO ELECTRONIC HEALTH RECORD OF MINOR.   (a)  In this section, "minor" means an individual 17 years of age or   younger who has not had the disabilities of minority removed for   general purposes.           (b)  A covered entity shall ensure each electronic health   record system the entity uses to store electronic health records of   minors allows a minor's parent or, if applicable, the minor's   managing conservator or guardian to obtain complete and   unrestricted access to the minor's electronic health record   immediately upon request, unless access to all or part of the record   is restricted under state or federal law or by a court order.          Sec. 183.007.  ELECTRONIC HEALTH RECORD REQUIREMENTS   REGARDING BIOLOGICAL SEX.  (a)  Notwithstanding any other law, the   commission, the Texas Medical Board, and the Texas Department of   Insurance shall jointly ensure that:                (1)  each electronic health record prepared or   maintained by a covered entity in this state includes a separate   space for the entity to document:                      (A)  an individual's biological sex as either male   or female based on the individual's observed biological sex   recorded by a health care practitioner at birth; and                      (B)  information on any sexual development   disorder of the individual, whether identified at birth or later in   the individual's life; and                (2)  any algorithm or decision assistance tool included   in an electronic health record to assist a health care practitioner   in making medical treatment decisions includes an individual's   biological sex as recorded in the space described by Subdivision   (1)(A).          (b)  This section does not prohibit an electronic health   record from including spaces for recording other information   related to an individual's biological sex or gender identity.          Sec. 183.008.  AMENDING CERTAIN BIOLOGICAL SEX INFORMATION   IN ELECTRONIC HEALTH RECORDS.  (a)  A covered entity may amend on an   electronic health record an individual's biological sex as recorded   in the space described by Section 183.007(a)(1)(A) only if:                (1)  the amendment is to correct a clerical error; or                (2)  the individual is diagnosed with a sexual   development disorder and the amendment changes the individual's   listed biological sex to the opposite biological sex.          (b)  If an individual's biological sex is amended under   Subsection (a)(2), the covered entity shall include in the   individual's electronic health record information on the   individual's sexual development disorder in the space described by   Section 183.007(a)(1)(B).          Sec. 183.009.  PROHIBITION ON COVERED ENTITY PARTICIPATION   UNDER MEDICAID AND CHILD HEALTH PLAN PROGRAM. (a)  In this section,   "child health plan program" and "Medicaid" have the meanings   assigned by Section 521.0001, Government Code.          (b)  The executive commissioner by rule shall prohibit a   covered entity that violates this chapter from participating as a   health care provider under Medicaid or the child health plan   program for a period that is reasonably proportionate to the   seriousness and frequency of the violation, as the executive   commissioner determines. In adopting rules under this section, the   executive commissioner shall ensure that the period during which a   covered entity is prohibited from participating as a provider under   Medicaid or the child health plan program runs concurrently with   the period during which the covered entity's license, registration,   certification, or other regulatory authorization is suspended or   revoked by a regulatory agency under Section 183.011, as   applicable.          Sec. 183.010.  INVESTIGATION BY COMMISSION OR REGULATORY   AGENCY. The commission or the appropriate regulatory agency shall   conduct an investigation of any credible allegation of a violation   of this chapter by a covered entity.  The commission or agency shall   ensure the investigation is conducted in compliance with all   applicable state and federal laws, including the Health Insurance   Portability and Accountability Act of 1996 (Pub. L. No. 104-191).          Sec. 183.011.  DISCIPLINARY ACTION BY REGULATORY AGENCY.     The appropriate regulatory agency may take disciplinary action   against a covered entity that violates this chapter three or more   times in the same manner as if the covered entity violated an   applicable licensing or regulatory law.  The disciplinary action   may include license, registration, or certification suspension or   revocation for a period the agency determines appropriate.          Sec. 183.012.  INJUNCTIVE RELIEF; CIVIL PENALTY.  (a)  The   attorney general may institute an action for injunctive relief to   restrain a violation of this chapter.          (b)  In addition to the injunctive relief provided by   Subsection (a), the attorney general may institute an action for   civil penalties against a covered entity for a violation of this   chapter.  A civil penalty assessed under this section may not   exceed:                (1)  $5,000 for each violation that is committed   negligently and that occurs in a single year, regardless of how long   the violation continues during that year;                (2)  $25,000 for each violation that is committed   knowingly or intentionally and that occurs in a single year,   regardless of how long the violation continues during that year; or                (3)  $250,000 for each violation in which the covered   entity knowingly or intentionally used protected health   information for financial gain.          Sec. 183.013.  MEMORANDUM OF UNDERSTANDING; RULES. The   executive commissioner, the Texas Medical Board, the Texas   Department of Licensing and Regulation, the Texas Department of   Insurance, and each regulatory agency subject to this chapter shall   enter into a memorandum of understanding and, as necessary, adopt   rules to implement this chapter.          SECTION 2.  (a)  Except as provided by Subsection (b) of this   section, Chapter 183, Health and Safety Code, as added by this Act,   applies only to an electronic health record prepared on or after the   effective date of this Act.          (b)  Section 183.002, Health and Safety Code, as added by   this Act, applies to the storage of an electronic health record on   or after January 1, 2026, regardless of the date on which the   electronic health record was prepared.          SECTION 3.  If before implementing any provision of this Act   a state agency determines that a waiver or authorization from a   federal agency is necessary for implementation of that provision,   the agency affected by the provision shall request the waiver or   authorization and may delay implementing that provision until the   waiver or authorization is granted.          SECTION 4.  This Act takes effect September 1, 2025.     * * * * *