Texas ABA Privacy and Data Breach Requirements

ABA practice privacy and data breach requirements in Texas combine HIPAA with Chapter 181, state breach law, Medicaid rules and, when applicable, the Texas Data Privacy and Security Act. Texas generally gives businesses no more than 60 days after determining a breach to notify affected residents. A breach affecting at least 250 Texas residents has a separate Attorney General reporting route generally due no later than 30 days under current official materials, so practices should map each entity, function, data set and clock.

Privacy is part of how a family experiences care

The first record in a Texas ABA practice may be a voicemail from a parent describing a diagnosis, a school concern and an insurance problem. Soon there may be assessments, treatment plans, behavior data, session notes, authorizations, claims, photographs and family messages. The HIPAA Privacy Rule establishes federal rights and limits for covered entities, but privacy becomes real in the small moments when staff decide where to save, share or discuss information.

Walk through one fictional client's journey from inquiry to discharge. Mark every device, inbox, portal, payer site, shared drive, paper folder and vendor that touches the record. Ask why each copy exists and how access ends. That exercise gives an owner a useful foundation for ABA practice privacy and data breach requirements in Texas without reducing the subject to a generic policy checklist.

Texas and HIPAA do not draw the same entity circle

Many ABA providers are HIPAA covered entities because they conduct standard electronic insurance transactions. Texas Health and Safety Code Chapter 181 uses its own definition of “covered entity,” reaching people and organizations that assemble, collect, analyze, use, evaluate, store or transmit protected health information in specified ways. The Texas circle can therefore include an organization or activity that needs separate analysis even when the HIPAA answer seems familiar.

Write an entity map that includes the professional practice, management company, independent clinicians, schools, payers and software vendors. Note who creates the record, who controls it and why each party receives it. Revisit the map after an acquisition, new service line or billing change. A shared logo is not proof that every company has the same duty.

Chapter 181 adds a Texas operating layer

Texas Health and Safety Code Chapter 181 addresses medical-record privacy, workforce training, consumer access, disclosures, marketing and enforcement. Covered entities generally train employees on state and federal protected-health-information law appropriate to their work within 90 days of hiring, and they retain a signed training record until the sixth anniversary of the signature. That is a concrete obligation, not a reason to give everyone the same slideshow.

Build role-based training around real decisions: intake identity checks, parent and guardian authority, supervision conversations, payer requests, secure messaging, exports and suspected incidents. Track the governing training version, signature and retention date. A person who can recite “minimum necessary” but cannot recognize a misaddressed treatment-plan email is not yet prepared for the job.

Access requests need a reliable route

Chapter 181 includes a 15-business-day response provision for electronic health records when the covered entity maintains a system capable of fulfilling the request, subject to its terms. HIPAA and other Texas rules can add their own rights, formats, fees, denials and representatives. An ABA practice should avoid treating every request as either an instant portal download or a month-long legal project.

Give families one visible request channel and staff one documented routing process. Verify identity and authority, search every designated location, separate access from amendment or accounting questions, and explain delays plainly. Keep a copy of what was produced and how. An organized access program also makes breach investigations easier because the practice knows where records normally live.

Texas breach law protects health-related information

The Texas Identity Theft Enforcement and Protection Act includes specified physical or mental health information, healthcare provided, and payment information within its sensitive-personal-information framework, along with government, financial, biometric and account-access data. The statute also addresses reasonable procedures, protection and disposal. Exact combinations and exclusions matter, so an incident record should list fields instead of saying only “patient data.”

Separate names, diagnoses, member identifiers, insurance details, banking data, credentials and biometrics. Record whether data was encrypted or redacted and whether a key was involved. A clinical export and a payroll file can both be important Texas events for different reasons. Field-level work keeps the analysis from drifting toward the most familiar legal label.

The resident notice deadline generally tops out at 60 days

Texas generally requires notice to affected residents as quickly as possible, and no later than 60 days after determining that a breach occurred, unless law enforcement requests a delay. The determination date is a legal and factual milestone, not a date the incident team should postpone while waiting for perfect certainty. HIPAA's outside period may look similar, but the underlying definition and analysis differ.

Open a clock register when credible facts arrive. Record discovery, containment, vendor notice, determination, population work, drafting and delivery. Add payer, insurer, contract and other-state dates. The calmest incident teams are not the ones that wait; they are the ones that begin organized work early while leaving room for the evidence to change the conclusion.

At least 250 Texans creates a state reporting track

The Texas Attorney General's current data breach reporting page directs businesses to file when a breach affects at least 250 Texas residents. Current official materials describe a deadline no later than 30 days after discovery or determination, so qualified counsel should pin the controlling statutory event and due date for the actual incident. The electronic report requests the event date, affected population, data type, mitigation and notice information.

Count Texas residents separately from the total population and assign a filing owner. The Attorney General warns that submitted information may be subject to public-disclosure law, which is another reason to keep filings factual and free of unnecessary PHI or privileged strategy. Save the exact submission and confirmation rather than relying on a ticket that merely says “legal handled it.”

Maintainers and owners need to cooperate quickly

A business that maintains sensitive personal information it does not own generally must notify the owner or licensee immediately after discovering a breach. ABA practices can sit on either side of that relationship. A billing platform may maintain practice data, while the practice may keep records for a school district, payer network or affiliated entity.

Contracts should identify ownership, incident contacts, evidence duties, resident mapping and timing. Test the route before a crisis. If a vendor can send only a generic assurance that “the issue is contained,” the practice may not have enough information to evaluate acquisition, data fields, Texans affected or notice. Cooperation should be a working procedure, not just a paragraph in a BAA.

The Texas privacy act has scoped healthcare exclusions

The Texas Data Privacy and Security Act has entity-level exclusions for HIPAA covered entities and business associates and separate exclusions for protected health information and other specified healthcare data. Those provisions can be meaningful, but they still require an accurate entity and data map. A separate management company, public website data or activity outside the excluded entity may need its own review.

Document the reason an exclusion applies and what it covers. If a nonexcluded operation falls within the law, examine consumer rights, notices, processor contracts, assessments and the special small-business provision using current advice. Avoid copying a consumer-privacy notice from another company and hoping that healthcare words make it fit.

Texas Medicaid keeps records in view for years

The August 2026 Texas Medicaid Provider Procedures Manual is the current program source. Its provider retention section generally requires the documentation and claims needed to show the services, medical necessity, costs and payment basis for at least five years from the date of service, and longer until audit questions, appeals, investigations or court cases are resolved. Specific providers and contracts can have longer periods.

Use a schedule by record class, payer and open matter. Link it to litigation holds, access requests, amendments, backups and secure destruction. A retention rule is not permission to scatter duplicate records across personal devices. It is a reason to keep the authoritative copy complete, retrievable and governed for the full required period.

A BAA should lead to an operable vendor relationship

HHS business associate guidance explains when a BAA is needed and how downstream safeguards follow the data. Owners also need operational answers: who can suspend access, preserve logs, identify Texas residents, restore records and explain a security setting after hours? State roles based on ownership and maintenance should be reflected alongside HIPAA roles.

Maintain a vendor register with data categories, contacts, authentication, logging, retention, backups, exports, incident terms and exit steps. Ask for evidence before renewal and test one recovery scenario. A polished security questionnaire is useful, but the practice will depend on the vendor's actual cooperation when a mailbox, integration or portal behaves unexpectedly.

A compromised billing mailbox tests every layer

Lone Star Learning Partners is fictional. A billing specialist approves a fraudulent sign-in, and the mailbox contains clinical attachments, insurance details, parent contacts and remittance information. The practice revokes sessions, preserves identity and email logs, checks forwarding rules, stops automated sharing and confirms that treatment systems remain available.

Reviewers open HIPAA, Chapter 181, Texas breach, privacy-act, Medicaid, payer, insurer and contract tracks. They count residents and fields, evaluate acquisition and compromise, and record the 30-day reporting and 60-day resident milestones without assuming either one is automatically triggered. If families need notice, the message explains the event and available help in plain language.

Incident communication should sound human

Families want to know whether their child's care is safe, what information may be involved and what they can do. A clear notice separates confirmed facts from uncertainty, explains the practice's response and offers a real contact route. Required legal content belongs in the message, but dense statutory phrasing should not crowd out the questions a parent is likely to ask first.

Prepare staff guidance, language support, alternate formats and escalation for people who report identity theft or care disruption. Track recurring questions and correct confusing wording. Respectful communication cannot cure weak security or late notice; it can keep a difficult event from becoming even harder for the people affected.

A growing practice needs a repeatable privacy rhythm

Review risk whenever the organization adds a site, payer, vendor, service or acquisition. Sample permissions, test offboarding, rehearse restoration, update the data map and train people with realistic scenarios. The BACB Ethics Code adds professional confidentiality and records duties for certificants, while ownership still needs designated privacy, security and incident leadership.

Keep short decision records for material changes. State the system or process, data affected, authority reviewed, chosen control, owner and next review date. This history helps a new operations lead understand why a control exists and prevents Texas compliance from becoming a binder of policies that no longer match the clinic.

ABA Practice Privacy and Data Breach Requirements in Texas