By Maxey                                              H.B. No. 1221
         Line and page numbers may not match official copy.
         Bill not drafted by TLC or Senate E&E.
                                A BILL TO BE ENTITLED
 1-1                                   AN ACT
 1-2     relating to protecting the privacy of medical records; providing
 1-3     penalties.
 1-4           BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
 1-5           SECTION 1. Title 2, Health and Safety Code, is amended by
 1-6     adding Subtitle I to read as follows:
 1-7                        SUBTITLE I.  MEDICAL RECORDS
 1-8                    CHAPTER 181.  MEDICAL RECORDS PRIVACY
 1-9                      SUBCHAPTER A.  GENERAL PROVISIONS
1-10           Sec. 181.001.  DEFINITIONS. In this chapter:
1-11                 (1)  "Administrative billing information" means
1-12     protected health information that is necessary for the payment or
1-13     administration of health care claims.  The term includes only the
1-14     date of service, reimbursement, any patient or practitioner
1-15     identifiers, diagnostic and treatment information contained in
1-16     standard billing codes, and information required by nationally
1-17     recognized third-party health care claim forms.  The term does not
1-18     include a clinical health record included or requested as an
1-19     attachment to administrative billing information.
1-20                 (2)  "Audit trail" means a complete and accurate record
1-21     of the date, user or recipient, and function performed with respect
1-22     to protected health information.
 2-1                 (3)  "Clinical health record" means a record of any
 2-2     protected health information, other than administrative billing
 2-3     information, that is used or maintained by or for a covered entity
 2-4     or an employee, agent, or contractor of a covered entity for the
 2-5     purpose of delivering health care to an individual.
 2-6                 (4)  "Computerized records system" means any
 2-7     electronic, digital, optical, magnetic, or other system that
 2-8     stores, retrieves, or manipulates data.  The term does not include
 2-9     a static storage system, including microfiche or microfilm.
2-10                 (5)  "Covered entity" means any person who:
2-11                       (A)  for commercial, financial, or professional
2-12     gain, monetary fees, or dues, or on a cooperative, nonprofit, or
2-13     pro bono basis, engages, in whole or in part, and with real or
2-14     constructive knowledge, in the practice of assembling, collecting,
2-15     analyzing, using, evaluating, storing, or transmitting protected or
2-16     deidentified health information.  The term includes a health care
2-17     payer, information or computer management entity, employer, school,
2-18     health researcher, health care facility, clinic, health care
2-19     practitioner, or person who maintains an Internet site;
2-20                       (B)  comes into possession of protected health
2-21     information;
2-22                       (C)  obtains or stores protected health
2-23     information under this chapter; or
2-24                       (D)  is an employee, agent, or contractor of a
2-25     person described by Paragraph (A), (B), or (C) insofar as the
2-26     employee, agent, or contractor creates, receives, obtains,
 3-1     maintains, uses, or transmits protected health information.
 3-2                 (6)  "Deidentified health information" means protected
 3-3     health information with respect to which the holder has made a good
 3-4     faith effort to evaluate the risks of reidentification of the
 3-5     information in the context in which it will be used or disclosed;
 3-6     and to remove all personal identifiers or other information that
 3-7     may be used by itself or in combination with other information to
 3-8     identify the subject from the information.  The term includes
 3-9     aggregate statistics, redacted health information, information for
3-10     which random or fictitious alternatives have been substituted for
3-11     personally identifiable information, and information for which
3-12     personally identifiable information has been encrypted and for
3-13     which the encryption key is maintained by a person otherwise
3-14     authorized to have access to the information in an identifiable
3-15     format.
3-16                 (7)  "Disclose" means to release, publish, share,
3-17     transfer, transmit, distribute, show, or otherwise divulge
3-18     protected health information to a person other than the individual
3-19     who is the subject of the information.
3-20                 (8)  "Governmental unit" means;
3-21                       (A)  this state and all the several agencies of
3-22     government that collectively constitute the government of this
3-23     state, including other agencies bearing different designations, and
3-24     all departments, bureaus, boards, commissions, offices, agencies,
3-25     councils, and courts;
3-26                       (B)  a political subdivision of this state,
 4-1     including any municipality, county, school district, junior college
 4-2     district, levee improvement district, drainage district, irrigation
 4-3     district, water improvement district, water control and improvement
 4-4     district, water control and preservation district, freshwater
 4-5     supply district, navigation district, conservation and reclamation
 4-6     district, soil conservation district, communication district,
 4-7     public health district, and river authority; and
 4-8                       (C)  any other institution, agency, or organ of
 4-9     government the status and authority of which are derived from the
4-10     state constitution or from laws passed by the legislature under the
4-11     constitution.
4-12                 (9)  "Health care" means preventive, diagnostic,
4-13     therapeutic, rehabilitative, maintenance, or palliative care,
4-14     counseling, a service, or a procedure normally provided by or under
4-15     the supervision or direction of a health care practitioner or
4-16     health care facility with respect to the physical or mental
4-17     condition of an individual or affecting the structure or function
4-18     of the human body or any part of the human body, including
4-19     individual cells and their components.  The term does not include
4-20     payment for health care, performance of health care delivery
4-21     review, or administration of health care claims.
4-22                 (10)  "Health care delivery review" means any review,
4-23     audit, assessment, or analysis of health care that is conducted in
4-24     regard to an individual who is the subject of protected health
4-25     information, that is performed by a covered entity or an agent or
4-26     contractor of a covered entity, and that requires any protected
 5-1     health information that is not deidentified, other than
 5-2     administrative billing information.  The term includes:
 5-3                       (A)  utilization, quality assurance, or
 5-4     management review activities;
 5-5                       (B)  population-based activities relating to
 5-6     improving health care or reducing health care costs;
 5-7                       (C)  protocol development;
 5-8                       (D)  review of the competence or qualifications
 5-9     of health care professionals;
5-10                       (E)  evaluation of health care practitioners,
5-11     health care payers, and health care facility performance;
5-12                       (F)  the conduct of training programs in which
5-13     undergraduate and graduate students and trainees in health care,
5-14     including graduate medical education students and residents, learn
5-15     under supervision to practice as health care providers; and
5-16                       (G)  accreditation, certification, licensing, or
5-17     credentialing activities.
5-18                 (11)  "Health care facility" means any facility
5-19     licensed to provide health care or legally and regularly engaged in
5-20     providing health care.  The term does not include an employer,
5-21     health care payer, or health maintenance organization.
5-22                 (12)  "Health care payer" means any person who provides
5-23     payment or reimbursement for health care, including a health
5-24     insurance or other insurance company, hospital or medical service
5-25     plan, health or dental service plan, health maintenance
5-26     organization, employee welfare benefit plan, or other group health
 6-1     plan, whether or not funded through the purchase of insurance.
 6-2                 (13)  "Health care practitioner" means a person who:
 6-3                       (A)  is licensed, certified, registered, or
 6-4     otherwise authorized by law to provide an item or service that, in
 6-5     the ordinary course of business or practice of a profession,
 6-6     constitutes health care, including a physician, nurse,
 6-7     chiropractor, midwife, podiatrist, physician assistant,
 6-8     optometrist, pharmacist, physical therapist, occupational
 6-9     therapist, or speech therapist; or
6-10                       (B)  is an employee, agent, or contractor of a
6-11     person described by Paragraph (A) who is supervised in providing
6-12     health care.
6-13                 (14)  "Health research" means any systematic
6-14     investigation, testing, evaluation, or other inquiry that uses
6-15     protected health information to develop or contribute to general
6-16     knowledge, including the study of:
6-17                       (A)  the causes of disease or medical conditions;
6-18     and
6-19                       (B)  the relationship among certain
6-20     characteristics, health care, and disease or health status.
6-21                 (15)  "Health researcher" means a person who conducts
6-22     health research using protected or deidentified health information.
6-23                 (16)  "Individual" means an adult person or anyone who
6-24     may legally obtain health care as a minor without the expressed
6-25     consent of a parent, custodian, or guardian.
6-26                 (17)  "Person" includes a corporation, organization,
 7-1     governmental unit, business trust, estate, trust, partnership,
 7-2     association, and any other legal entity.
 7-3                 (18)  "Protected health information" means any health
 7-4     information, other than deidentified information, that is
 7-5     maintained in any format, including in writing, electronically, or
 7-6     orally.  The term includes sensitive health information,
 7-7     administrative billing information, clinical health records, and
 7-8     prescription records that:
 7-9                       (A)  are created or received by a covered entity;
7-10                       (B)  relate to:
7-11                             (i)  the past, present, or future physical
7-12     or mental health or condition of an individual;
7-13                             (ii)  the providing of health care to an
7-14     individual; or
7-15                             (iii)  the past, present, or future payment
7-16     for providing health care to an individual; and
7-17                       (C)  identify or could be used or manipulated
7-18     alone or in combination with other information to identify an
7-19     individual by a reasonably foreseeable method.
7-20                 (19)  "Public health authority" means an authority
7-21     statutorily charged with responsibility for public health matters,
7-22     including the department, the board, and any local or municipal
7-23     agent.
7-24                 (20)  "Reidentification" means any attempt to
7-25     ascertain:
7-26                       (A)  the identity of the individual who is the
 8-1     subject of protected health information; or
 8-2                       (B)  any specific data element with the intention
 8-3     of ascertaining the identity of the subject or with knowledge that
 8-4     the data element would allow for the identification of the
 8-5     individual who is the subject of the protected health information.
 8-6                 (21)  "Sensitive health information" means protected
 8-7     health information that pertains specifically to:
 8-8                       (A)  a history, diagnosis, or treatment of:
 8-9                             (i)  substance abuse;
8-10                             (ii)  human immunodeficiency virus or
8-11     acquired immune deficiency syndrome;
8-12                             (iii)  sexually transmitted disease; or
8-13                             (iv)  sexual, physical, or mental abuse,
8-14     including information related to sexual assault;
8-15                       (B)  mental health;
8-16                       (C)  sexual or reproductive health; or
8-17                       (D)  the results of a genetic test, including the
8-18     fact that an individual has undergone a genetic test.
8-19           Sec. 181.002.  APPLICABILITY.  This chapter does not affect
8-20     the validity of another statute that provides greater
8-21     confidentiality for information made confidential by this chapter.
8-22           Sec. 181.003.  OMBUDSMAN.  (a)  The attorney general shall
8-23     appoint a lawyer to serve as the medical records privacy ombudsman.
8-24     The ombudsman shall serve on a full-time basis at the pleasure of
8-25     the attorney general.  The attorney general may assign other staff
8-26     as may be appropriate to assist in performing the duties of the
 9-1     ombudsman.  The ombudsman shall:
 9-2                 (1)  assist members of the public, governmental units,
 9-3     and covered entities in understanding and interpreting this chapter
 9-4     or other information privacy laws;
 9-5                 (2)  on written request, issue and publish advisory
 9-6     opinions to governmental units about compliance with this chapter;
 9-7                 (3)  collect technical information and determine best
 9-8     practices for distribution to individuals and parties subject to
 9-9     this chapter;
9-10                 (4)  assist in mediating disputes relating to the
9-11     release of protected health information;
9-12                 (5)  compile and make available for review relevant
9-13     federal and state laws governing the privacy of medical records in
9-14     this state;
9-15                 (6)  not later than December 1 of each even-numbered
9-16     year, prepare and deliver to the governor, the lieutenant governor,
9-17     the speaker of the house of representatives, and each member of the
9-18     legislature a biennial report on the state of medical records
9-19     privacy in this state and other states and make recommendations to
9-20     the legislature about medical records privacy;
9-21                 (7)  maintain records and compile reports on the types
9-22     of complaints filed with the ombudsman and how those complaints
9-23     were resolved; and
9-24                 (8)  create and maintain an Internet site through the
9-25     Texas Online government portal that contains easily understandable
9-26     information about an individual's privacy rights and that allows
 10-1    consumers to submit questions and receive replies about privacy
 10-2    rights.
 10-3          (b)  The ombudsman shall respond to a question submitted to
 10-4    the ombudsman not later than the 180th day after the date the
 10-5    ombudsman receives the question.
 10-6          (c)  Information received by the ombudsman relating to an
 10-7    advisory opinion issued by the ombudsman is confidential and not
 10-8    subject to disclosure under Chapter 552, Government Code.  An
 10-9    advisory opinion may contain only deidentified information with
10-10    respect to any individual who is the subject of the information.
10-11          Sec. 181.004.  INAPPLICABILITY TO ERISA PLANS.  This chapter
10-12    does not apply to a health benefit plan provided in accordance with
10-13    the Employee Retirement Income Security Act of 1974 (29 U.S.C.
10-14    Section 1001 et seq.), as amended.
10-15             (Sections 181.005-181.050 reserved for expansion
10-16        SUBCHAPTER B.  ACCESS TO AND USE OF HEALTH CARE INFORMATION
10-17          Sec. 181.051.  PATIENT ACCESS TO INFORMATION; FEE.  (a)
10-18    Except as provided by Subsection (b), a covered entity shall permit
10-19    an individual who is the subject of protected health information or
10-20    the person's designee to inspect and copy any protected health
10-21    information that the entity maintains or controls and that relates
10-22    to the individual.  A covered entity shall provide the individual
10-23    with one copy of the records requested under this subsection free
10-24    of charge during a three-year period.  Unless otherwise established
10-25    in law a covered entity may charge a reasonable fee for the cost of
10-26    additional copies.
 11-1          (b)  Any of the following persons who is providing
 11-2    professional services to an individual is not required to permit
 11-3    the individual to inspect or copy a personal note or diary
 11-4    containing protected health information relating to the individual
 11-5    if the information contained in the note or diary has not been
 11-6    disclosed to a person other than another of the following persons
 11-7    for the specific purpose of clinical supervision conducted in the
 11-8    regular course of treatment:
 11-9                (1)  a psychiatrist;
11-10                (2)  a psychologist licensed under Chapter 501,
11-11    Occupations Code;
11-12                (3)  a marriage and family therapist licensed under
11-13    Chapter 502, Occupations Code;
11-14                (4)  a licensed professional counselor licensed under
11-15    Chapter 503, Occupations Code;
11-16                (5)  a chemical dependency counselor licensed under
11-17    Chapter 504, Occupations Code; or
11-18                (6)  a social worker licensed under Chapter 505,
11-19    Occupations Code.
11-20          (c)  A covered entity shall provide requested information not
11-21    later than the 10th day after the date the entity receives the
11-22    request for inspection or copying.
11-23          (d)  On request of an individual who is the subject of
11-24    protected health information that is in coded form, a covered
11-25    entity shall provide the individual with an accurate translation in
11-26    plain language of the coded information.
 12-1          Sec. 181.052.  DISCLOSURE OR USE OF PROTECTED HEALTH
 12-2    INFORMATION.  (a)  A covered entity may not disclose or use
 12-3    protected health information except as authorized under this
 12-4    chapter.
 12-5          (b)  A covered entity may not use or disclose protected
 12-6    health information without obtaining the expressed consent of the
 12-7    individual who is the subject of the information.
 12-8          (c)  A covered entity may not use or request or require the
 12-9    disclosure of more protected health information than is directly
12-10    related to the specific purpose that is stated in the expressed
12-11    consent.
12-12          (d)  A covered entity shall evaluate a request made for
12-13    protected health information and may disclose only the minimum
12-14    amount of protected health information that is essential and
12-15    directly related to the specific function to be performed by the
12-16    recipient.
12-17          (e)  Protected health information, administrative billing
12-18    information, clinical health records, and deidentified health
12-19    information used or disclosed under this chapter shall be clearly
12-20    labeled.
12-21          (f)  A request for disclosure of protected health information
12-22    must be in writing.
12-23          Sec. 181.053.  USE OF CLINICAL HEALTH RECORDS.  (a)  Except
12-24    as provided by Section 181.054, this chapter does not limit the
12-25    ability of a health care practitioner or health care facility to
12-26    use protected health information to provide health care to an
 13-1    individual or to disclose the information as provided by Section
 13-2    181.056.
 13-3          (b)  With respect to a clinical health record used for any
 13-4    purpose other than to deliver health care, by a health care
 13-5    practitioner or health care facility, to the individual who is the
 13-6    subject of the record, the covered entity using the record shall:
 13-7                (1)  use, receive, or create the record only to the
 13-8    extent that a function cannot be reasonably performed with
 13-9    deidentified health information;
13-10                (2)  limit access to a clinical health record that is
13-11    not deidentified to only those employees, agents, or contractors
13-12    who perform an essential function that is directly related to the
13-13    purpose for which the record was created or collected;
13-14                (3)  prohibit an employee, agent, or contractor from
13-15    reidentifying an individual who is the subject of any deidentified
13-16    health information used, received, or created by the employee,
13-17    agent, or contractor unless otherwise authorized by law;
13-18                (4)  require that an employee, agent, or contractor use
13-19    or receive only the minimum amount of information from a clinical
13-20    health record that is essential and directly related to the
13-21    specific function performed by the employee, agent, or contractor;
13-22                (5)  prohibit an employee, agent, or contractor from
13-23    using or having access to a clinical health record for longer than
13-24    is necessary to perform the specific function of the employee,
13-25    agent, or contractor;
13-26                (6)  prohibit an employee, agent, or contractor from
 14-1    disclosing a clinical health record or deidentified health
 14-2    information to any other person except as otherwise authorized
 14-3    under this chapter;
 14-4                (7)  link, match, or index clinical health records
 14-5    collected, held, or maintained by other covered entities only if
 14-6    the entity has specific expressed consent; and
 14-7                (8)  disclose a clinical health record collected from
 14-8    or created by any other covered entity only to the individual who
 14-9    is the subject of the information or as otherwise authorized by
14-10    law.
14-11          Sec. 181.054.  USE OF ADMINISTRATIVE BILLING INFORMATION. (a)
14-12    with respect to administrative billing information used by a
14-13    covered entity, the entity shall:
14-14                (1)  limit the use of administrative billing
14-15    information to those essential functions that cannot be reasonably
14-16    performed with deidentified health information;
14-17                (2)  limit the use of administrative billing
14-18    information that is not deidentified to those employees, agents, or
14-19    contractors who perform an essential function;
14-20                (3)  prohibit an employee, agent, or contractor from
14-21    reidentifying an individual who is the subject of any deidentified
14-22    health information used, received, or created by the employee,
14-23    agent, or contractor unless otherwise authorized by law;
14-24                (4)  require that an employee, agent, or contractor use
14-25    only the minimum amount of administrative billing information that
14-26    is necessary to accomplish the specific function performed by the
 15-1    employee, agent, or contractor;
 15-2                (5)  prohibit an employee, agent, or contractor from
 15-3    disclosing administrative billing information or deidentified
 15-4    health information to any other person except as otherwise
 15-5    authorized under this chapter; and
 15-6                (6)  link, match, or index administrative billing
 15-7    information collected, held, or maintained by other covered
 15-8    entities only if the entity has specific expressed consent.
 15-9          (b)  Except as otherwise provided by this chapter, a health
15-10    care provider, a health care facility, a health care payer, or an
15-11    employee, agent, or contractor of a provider, facility, or payer
15-12    may use administrative billing information without the expressed
15-13    consent of the individual who is the subject of the information
15-14    only if the health care provider, facility, or payer:
15-15                (1)  deidentifies all the information used by the
15-16    entity; or
15-17                (2)  uses only the minimum amount of administrative
15-18    billing information that is essential and directly related to
15-19    administrative billing purposes and does not store, preserve, copy,
15-20    or otherwise maintain the information for longer than is necessary
15-21    to perform the specific function of the recipient.
15-22          (c)  A health care payer may not refuse to make a payment to,
15-23    or otherwise retaliate against, a covered entity if the covered
15-24    entity complies with this section or Section 181.056(8).
15-25          Sec. 181.055.  DIRECTORY INFORMATION. (a)  Except as provided
15-26    by Subsection (b), a health care practitioner or health care
 16-1    facility that provides patient services may disclose directory
 16-2    information regarding an individual to any person if:
 16-3                (1)  the patient:
 16-4                      (A)  has been notified of the patient's right to
 16-5    object at the time of admission to the facility and has not
 16-6    objected to the disclosure; or
 16-7                      (B)  is in a physical or mental condition that
 16-8    makes it impossible to notify the patient of the right to object
 16-9    and there are no prior indications that the patient would object;
16-10    and
16-11                (2)  the information consists of:
16-12                      (A)  the general health status of the patient,
16-13    described as critical, poor, fair, stable, or satisfactory or in
16-14    terms denoting similar conditions; or
16-15                      (B)  the location of the patient on premises
16-16    controlled by the practitioner or facility.
16-17          (b)  A health care practitioner or health care facility may
16-18    not release patient directory information without expressed consent
16-19    if:
16-20                (1)  disclosure of the location of the individual would
16-21    reveal information supporting all inferences about the specific
16-22    diagnosis of the individual; or
16-23                (2)  the practitioner or facility has reason to believe
16-24    that the disclosure of the information could lead to physical,
16-25    mental, or emotional harm to or the death of the individual.
16-26          Sec. 181.056.  DISCLOSURE OF INFORMATION. A covered entity
 17-1    may disclose protected health information without the consent of
 17-2    the individual who is the subject of the information if the
 17-3    disclosure is:
 17-4                (1)  to a health care practitioner or health care
 17-5    facility that is rendering health care to the individual;
 17-6                (2)  to a transporting emergency medical services
 17-7    provider for the direct purpose of determining the individual's
 17-8    diagnosis and the outcome of the individual's hospital admission;
 17-9                (3)  to a prospective health care provider for the
17-10    purpose of securing the services of that health care provider as
17-11    part of the patient's continuum of care, as determined by the
17-12    patient's attending physician, and the patient is in a physical or
17-13    mental condition that makes it impossible to obtain consent;
17-14                (4)  to an individual authorized to consent to medical
17-15    treatment under Chapter 313 or to an individual in a circumstance
17-16    exempted from chapter 313 to facilitate the adequate provision of
17-17    treatment and the protected health information to be disclosed is
17-18    directly related to the treatment;
17-19                (5)  to an employee or agent of the covered entity who
17-20    requires health care information for medical education, for peer
17-21    review, or for assisting the covered entity in complying with
17-22    statutory, licensing, accreditation, or certification requirements,
17-23    and the covered entity takes appropriate action to ensure that the
17-24    employee or agent:
17-25                      (A)  discloses only protected health information
17-26    that is directly related to the medical education, peer review, or
 18-1    compliance;
 18-2                      (B)  does not use or disclose the protected
 18-3    health information for any other purpose; and
 18-4                      (C)  takes appropriate steps to protect the
 18-5    protected health information;
 18-6                (6)  to a federal, state, or local government agency or
 18-7    authority to the extent authorized or required by law;
 18-8                (7)  to the American Red Cross for the specific purpose
 18-9    of fulfilling the duties specified under its charter granted as an
18-10    instrumentality of the United States government;
18-11                (8)  for purposes of performing health care delivery
18-12    review and the covered entity does not disclose any protected
18-13    health information that is not essential for the review or not
18-14    directly related to the specific care or procedure being reviewed;
18-15                (9)  to satisfy a request for medical records of a
18-16    deceased or incompetent person pursuant to Section 4.01(e), Medical
18-17    Liability and Insurance Improvement Act of Texas (Article 4590i,
18-18    Vernon's Texas Civil Statutes);
18-19                (10)  to comply with a court order except as provided
18-20    by Subdivision (11);
18-21                (11)  related to a judicial proceeding in which the
18-22    patient is a party and the disclosure is requested under a subpoena
18-23    issued under:
18-24                      (A)  the Texas Rules of Civil Procedure or Code
18-25    of Criminal Procedure; or
18-26                      (B)  Chapter 121, Civil Practice and Remedies
 19-1    Code; or
 19-2                (12)  to a public health authority for public health
 19-3    reasons.
 19-4          Sec. 181.057.  NEXT OF KIN. A health care practitioner or
 19-5    health care facility may disclose, without the patient's consent,
 19-6    protected health information regarding the health care provided to
 19-7    the patient if:
 19-8                (1)  the patient:
 19-9                      (A)  has been notified of the patient's right to
19-10    object at the time of admission to the facility and has not
19-11    objected to the disclosure; or
19-12                      (B)  is in a physical or mental condition that
19-13    makes it impossible to notify the patient of the right to object
19-14    and there is no indication that the patient would object to the
19-15    disclosure; and
19-16                (2)  the information is disclosed to the patient's next
19-17    of kin, a representative of the patient, or an individual with whom
19-18    the patient resides.
19-19          Sec. 181.058.  INFORMATION FOR RESEARCH. (a)  A researcher
19-20    may disclose protected health information to a health researcher,
19-21    regardless of the source of funding of the research, for the
19-22    purpose of conducting health research, only if the researcher has
19-23    obtained:
19-24                (1)  the expressed consent of the individual; or
19-25                (2)  documentation that a waiver of expressed consent
19-26    has been granted by:
 20-1                      (A)  an institutional review board in accordance
 20-2    with the Health Insurance Portability and Accountability Act of
 20-3    1996 (Pub. L. No. 104-191), as amended, and the rules adopted under
 20-4    that Act; or
 20-5                      (B)  a privacy board established under this
 20-6    section.
 20-7          (b)  The Texas Ethics Commission shall establish a privacy
 20-8    board for one or more health research projects.  A privacy board:
 20-9                (1)  must consist of members with varying backgrounds
20-10    and appropriate professional competency as necessary to review the
20-11    effect of the research protocol for the project or projects on the
20-12    privacy rights and related interests of the individuals whose
20-13    protected health information would be used or disclosed;
20-14                (2)  must include at least one member who is not
20-15    affiliated with the covered entity or an entity conducting or
20-16    sponsoring the research, and not related to any person who is
20-17    affiliated with an entity described by this subdivision; and
20-18                (3)  may not have any member participating in the
20-19    review of any project in which the member has a conflict of
20-20    interest.
20-21          (c)  A privacy board may grant a waiver of the expressed
20-22    consent for the use of protected health information if the privacy
20-23    board:
20-24                (1)  documents the date on which the waiver of the
20-25    expressed consent was approved and identifies the privacy board;
20-26                (2)  determines that:
 21-1                      (A)  the use or disclosure of protected health
 21-2    information involves no more than minimal risk to the affected
 21-3    individuals;
 21-4                      (B)  the waiver does not adversely affect the
 21-5    privacy rights and related interests of those individuals;
 21-6                      (C)  the research could not practicably be
 21-7    conducted without the waiver;
 21-8                      (D)  the research could not practicably be
 21-9    conducted without access to and use of the protected health
21-10    information;
21-11                      (E)  the privacy risks to an individual whose
21-12    protected health information is to be used or disclosed are
21-13    reasonable in relation to the anticipated benefits, if any, to the
21-14    individual and the importance of the knowledge that may reasonably
21-15    be expected to result from the research;
21-16                      (F)  there is an adequate plan to protect the
21-17    identifiers from improper use and disclosure;
21-18                      (G)  there is an adequate plan to destroy the
21-19    identifiers at the earliest opportunity consistent with the
21-20    conducting of the research, unless there is a health or research
21-21    justification for retaining the identifiers or the retention is
21-22    otherwise required by law;
21-23                      (H)  there are adequate written assurances that
21-24    the protected health information will not be reused or disclosed to
21-25    another person or entity, except:
21-26                            (i)  as required by law;
 22-1                            (ii)  for authorized oversight of the
 22-2    research project; or
 22-3                            (iii)  for other research for which the use
 22-4    or disclosure of protected health information would be permitted by
 22-5    this section; and
 22-6                      (I)  the health researcher has presented adequate
 22-7    assurances that none of the data containing protected health
 22-8    information will be loaned, sold, disseminated, or otherwise
 22-9    disclosed;
22-10                (3)  provides a description of the protected health
22-11    information for which use or access has been determined to be
22-12    necessary by the privacy board; and
22-13                (4)  documents that the waiver of expressed consent has
22-14    been approved by the privacy board following the procedures under
22-15    Subsection (e).
22-16          (d)  A waiver must be signed by the presiding officer of the
22-17    board or the presiding officer's designee.
22-18          (e)  The privacy board must review the proposed research at a
22-19    convened meeting at which a majority of the privacy board members
22-20    are present, including at least one member who satisfies the
22-21    requirements of Subsection (b)(2).  The waiver of expressed consent
22-22    must be approved by the majority of the privacy board members
22-23    present at the meeting, unless the privacy board elects to use an
22-24    expedited review procedure.  The privacy board may use an expedited
22-25    review procedure only if the research involves no more than minimal
22-26    risk to the privacy of the individual who is the subject of the
 23-1    protected health information for which use or disclosure is being
 23-2    sought.  If the privacy board elects to use an expedited review
 23-3    procedure, the review and approval of the waiver of expressed
 23-4    consent may be made by the presiding officer of the privacy board
 23-5    or by one or more members of the privacy board as designated by the
 23-6    presiding officer.
 23-7          (f)  The privacy board shall provide documentation of the
 23-8    board's findings under this section on request to:
 23-9                (1)  the Texas Ethics Commission;
23-10                (2)  the office of the attorney general;
23-11                (3)  the ombudsman; and
23-12                (4)  any individual whose protected health information
23-13    is disclosed or used under this section.
23-14          (g)  A health researcher who receives protected health
23-15    information pursuant to a waiver of expressed consent granted by a
23-16    privacy board may not use or disclose the information for any
23-17    purposes other than those specifically approved by the privacy
23-18    board and directly related to the research being performed.
23-19          Sec. 181.059.  DISCLOSURE IN LEGAL PROCEEDING. (a)  A covered
23-20    entity may disclose protected health information without consent if
23-21    the disclosure is made in response to compulsory legal process
23-22    issued on behalf of a party in compliance with this section.
23-23          (b)  Except as otherwise provided by Subsection (d), the
23-24    party seeking the information shall send the individual who is the
23-25    subject of the information written notice of the compulsory legal
23-26    process, at the subject's last known address, together with notice
 24-1    of the subject's right to challenge the process in accordance with
 24-2    Subsection (e).
 24-3          (c)  Except as otherwise provided by Subsection (d), a
 24-4    covered entity on whom compulsory legal process is served may not
 24-5    disclose protected health information:
 24-6                (1)  before the 16th day after the date the individual
 24-7    who is the subject of the information has been notified under
 24-8    Subsection (b); or
 24-9                (2)  if an objection has been made by the individual
24-10    who is the subject of the information in accordance with Subsection
24-11    (e) and no decision has been made.
24-12          (d)  In the event of a risk of flight or destruction of
24-13    evidence or if the identity and location of the individual who is
24-14    the subject of protected health information is not known to the
24-15    party seeking compulsory legal process, a court, administrative
24-16    agency, or other person having power to so act generally may issue
24-17    a subpoena, warrant, or other compulsory legal process requiring
24-18    disclosure of protected health information into the custody of the
24-19    court, administrative agency, or other person.  The court,
24-20    administrative agency, or other person shall send notice or cause
24-21    the entity in possession of the information to send notice to the
24-22    last known address of the individual who is the subject of the
24-23    information.  Protected health information held by the court may be
24-24    disclosed to the party seeking the information after the 15th day
24-25    after the date the notice is sent if the individual who is the
24-26    subject of the information has not objected to the disclosure of
 25-1    the information in accordance with Subsection (e).
 25-2          (e)  If an individual who is the subject of protected health
 25-3    information seeks to quash or limit compulsory legal process
 25-4    requiring disclosure of the information pertaining to the subject,
 25-5    the court, administrative agency, or other person may not issue
 25-6    process unless the party seeking the process demonstrates at a
 25-7    hearing by clear and convincing evidence that the information
 25-8    sought is necessary to the proceedings and the need of the party
 25-9    seeking the process for the information outweighs the privacy
25-10    interests of the subject.  In determining whether the need of the
25-11    party seeking protected health information outweighs the privacy
25-12    interests of the individual who is the subject of the information,
25-13    the court, administrative agency, or other person shall consider:
25-14                (1)  the particular purpose for which the information
25-15    is sought;
25-16                (2)  the degree to which the disclosure of the
25-17    information would embarrass, injure, or further invade the privacy
25-18    of the subject;
25-19                (3)  the effects of the disclosure on the subject's
25-20    future health care;
25-21                (4)  the importance of the information to the
25-22    proceeding; and
25-23                (5)  any other relevant factor.
25-24          (f)  A party that receives protected health information under
25-25    this section may not disclose or use the information in an
25-26    administrative, civil, or criminal action other than that for which
 26-1    the compulsory legal process is issued under this section.
 26-2          (g)  Protected health information received under this section
 26-3    is excepted from the disclosure requirements of Section 552.021,
 26-4    Government Code.
 26-5          Sec. 181.060.  AMENDMENT OF HEALTH RECORDS. (a)  An
 26-6    individual may request in writing that a covered entity that append
 26-7    or amend the individual's clinical health record.
 26-8          (b)  Not later than the 60th day after the date the covered
 26-9    entity receives a written request to append or amend the
26-10    individual's clinical health record, the covered entity shall:
26-11                (1)  make the appendant or amendment requested and make
26-12    reasonable efforts to notify any person reasonably designated by
26-13    the individual of the appendant or amendment; or
26-14                (2)  inform the individual of:
26-15                      (A)  the reasons for refusing to make the
26-16    appendant or amendment; and
26-17                      (B)  any procedures for further review of the
26-18    refusal.
26-19          (c)  A covered entity may not unreasonably refuse to append
26-20    or amend a clinical health record.
26-21          (d)  If a covered entity refuses to append or amend a
26-22    clinical health record, the covered entity shall comply with the
26-23    request of the individual to include at a relevant place in the
26-24    record a statement from the individual regarding the disputed
26-25    information.
26-26          (e)  For purposes of Subsection (b), an appendant or
 27-1    amendment is considered to have been made if the information that
 27-2    has been disputed by the individual has been supplemented by or
 27-3    replaced with appended or amended information and the information
 27-4    is clearly marked as appended or amended.  The covered entity
 27-5    making the appendant or amendment may select the method by which
 27-6    the information is appended or amended.
 27-7          (f)  A covered entity that receives appended or amended
 27-8    clinical health records shall:
 27-9                (1)  make the appendant or amendment not later than the
27-10    90th day after the date the covered entity receives the records;
27-11    and
27-12                (2)  make reasonable efforts to notify each person to
27-13    whom the covered entity disclosed the unappended or unamended
27-14    record of the appendant or amendment.
27-15          (g)  After a covered entity makes an appendant or amendment,
27-16    the covered entity shall send a copy of the appendant or amendment
27-17    to the individual free or charge.
27-18          Sec. 181.061.  REQUIRED NOTICE. (a)  A covered entity shall
27-19    provide written notice to an individual of the entity's practices
27-20    with respect to protected health information.  The covered entity
27-21    shall provide the notice not later than the seventh business day
27-22    after the date the entity receives a request from an individual for
27-23    the notice.
27-24          (b)  Notice under this section must include:
27-25                (1)  a complete description of the usual and customary
27-26    functions performed with protected health information that has not
 28-1    been deidentified;
 28-2                (2)  a statement of whether protected health
 28-3    information is stored within a computerized records system;
 28-4                (3)  the name and the method of contacting the
 28-5    individual responsible for responding to inquiries regarding the
 28-6    entity's information practices; and
 28-7                (4)  the procedures an individual must follow to
 28-8    exercise the rights granted under this chapter.
 28-9          (c)  The notice required by this section must be written in
28-10    clear language that a layperson can understand.  If the entity
28-11    serves a linguistically diverse or visually impaired clientele, the
28-12    entity must use a reasonable means to provide the required notice.
28-13          (d)  On written request by an individual, a covered entity
28-14    shall provide a list of the agents or contractors who ordinarily
28-15    have access to or use of protected health information that is not
28-16    deidentified.
28-17          (e)  The ombudsman shall, after notice and opportunity for
28-18    public comment, develop and disseminate model notice of information
28-19    practices of the type described by this section.  Any notice that
28-20    conforms to the model notice developed under this subsection is
28-21    considered to meet the notice requirements of this section.
28-22          (f)  A covered entity shall notify each individual who has
28-23    received notice under this section of any change in the entity's
28-24    practices with respect to protected health information.
28-25          (g)  A covered entity may not penalize an individual or
28-26    adversely affect the individual's ability to obtain goods or
 29-1    services from the covered entity if the individual requests notice
 29-2    under this section.
 29-3          Sec. 181.062.  AUDIT TRAIL. (a)  A covered entity that stores
 29-4    or maintains protected health information, other than
 29-5    administrative billing information that is not deidentified, in a
 29-6    digital, optical, magnetic, electronic, or other computerized
 29-7    records system shall maintain an audit trail of each use or
 29-8    disclosure of the information, other than a disclosure by a health
 29-9    care provider or a health care facility, and of the source of the
29-10    protected health information.  This subsection applies only to new
29-11    or substantially updated information systems implemented after the
29-12    effective date of this chapter.  With respect to an audit trail, a
29-13    covered entity shall either:
29-14                (1)  provide a copy of the audit trail maintained under
29-15    this section on request to the individual who is the subject of the
29-16    information; or
29-17                (2)  comply with the request of an individual to review
29-18    the audit trail maintained under this section and report any
29-19    unauthorized access to the information to the individual.
29-20          (b)  A covered entity shall maintain an audit trail for each
29-21    use or disclosure until the sixth anniversary of the date the use
29-22    or disclosure was made.
29-23          Sec. 181.063.  DISCLOSURE OF INFORMATION TO PUBLIC HEALTH
29-24    AUTHORITY. A covered entity may disclose protected health
29-25    information without expressed consent:
29-26                (1)  to a public health authority that is authorized by
 30-1    law to collect or receive the information to:
 30-2                      (A)  prevent or control disease, injury, or
 30-3    disability;
 30-4                      (B)  report disease, injury, or vital events,
 30-5    including birth and death; and
 30-6                      (C)  conduct public health surveillance, public
 30-7    health investigations, and public health interventions;
 30-8                (2)  at the direction of a public health authority, to
 30-9    an official of a foreign government agency that is acting in
30-10    collaboration with a public health authority; and
30-11                (3)  to the entity authorized by law to receive reports
30-12    of child abuse or neglect.
30-13          Sec. 181.064.  PROHIBITED USES OF INFORMATION. A person may
30-14    not disclose, use, or sell protected health information, including
30-15    prescription patterns and administrative billing information, for
30-16    marketing, education, or marketing research purposes without the
30-17    expressed consent of the individual who is the subject of the
30-18    protected health information.
30-19             (Sections 181.065-181.100 reserved for expansion
30-20                     SUBCHAPTER C.  HEALTH CARE PAYERS
30-21          Sec. 181.101.  NOTICE TO INDIVIDUAL. A health care payer
30-22    shall, on enrollment, notify an individual who is the subject of
30-23    protected health information of:
30-24                (1)  the regular uses of the information, including
30-25    administrative billing information; and
30-26                (2)  the required uses of the information in the case
 31-1    of any complaint, appeal, or other grievance made by or relating to
 31-2    the subject.
 31-3          Sec. 181.102.  CONTACT WITH PATIENT. (a)  A health care payer
 31-4    may not initiate contact with the subject of sensitive health
 31-5    information regarding any disease management or other clinical
 31-6    intervention program pertaining to the sensitive health condition.
 31-7    The health care payer shall initiate communication through a health
 31-8    care practitioner.
 31-9          (b)  A health care payer may not send mail addressed to an
31-10    individual regarding any health topic, including generic material
31-11    regarding sensitive health information.
31-12          Sec. 181.103.  DISEASE MANAGEMENT PROGRAM. (a)  A health care
31-13    payer or employer may not require as a condition of employment,
31-14    health insurance, or coverage or reimbursement for health care that
31-15    an individual participate in a disease management program or other
31-16    clinical intervention program.
31-17                (B)  this subsection does not include a case management
31-18    or care coordination program operated by a covered entity and
31-19    includes the individual's health care practitioner in the program.
31-20          Sec. 181.104.  CONSENT REQUIRED. Expressed consent provided
31-21    by an enrollee or member in any health plan is not valid as to
31-22    anyone other than that enrollee or member.  A health care payer may
31-23    not condition health care insurance or coverage or reimbursement
31-24    for health care on consent from a minor who has legally obtained
31-25    health care without parental consent to disclose any information
31-26    pertaining to the health care or payment for the health care to a
 32-1    parent or other legal guardian.
 32-2          Sec. 181.105.  HEALTH CARE DELIVERY REVIEW. (a)  For the
 32-3    purpose of performing health care delivery review, a health care
 32-4    payer may not request any protected health information unless the
 32-5    information is essential for the review and directly related to the
 32-6    specific care or procedure being reviewed.
 32-7          (b)  Protected health information collected for the
 32-8    performance of health care delivery review may not be used for any
 32-9    other purpose.
32-10             (Sections 181.106-181.150 reserved for expansion
32-11                     SUBCHAPTER D.  EXPRESSED CONSENT
32-12          Sec. 181.151.  FORM. (a)  Expressed consent required by this
32-13    chapter must be in writing and signed by:
32-14                (1)  the individual who is the subject of the health
32-15    information;
32-16                (2)  the individual's legal guardian; or
32-17                (3)  the individual's agent under a medical power of
32-18    attorney.
32-19          (b)  For purposes of this section, documentation of expressed
32-20    consent may be satisfied by the use of electronic signatures,
32-21    computerized expressed consent documentation, or other
32-22    technological means of recording expressed consent.  Use of a means
32-23    authorized by the ombudsman is considered to meet the requirements
32-24    of this subsection.
32-25          Sec. 181.152.  CONTENT OF CONSENT.  The written expressed
32-26    consent must:
 33-1                (1)  describe the information to be used or disclosed
 33-2    in clear, concise, and plain language;
 33-3                (2)  clearly identify the covered entity that will
 33-4    disclose the information;
 33-5                (3)  clearly identify the person:
 33-6                      (A)  who will use the information; or
 33-7                      (B)  to whom the information will be disclosed;
 33-8                (4)  describe in reasonable detail the purpose for
 33-9    which the information is being disclosed or used;
33-10                (5)  state that the information will be used or
33-11    disclosed solely for the purpose specified in the expressed consent
33-12    or as otherwise authorized by law;
33-13                (6)  contain a specific date or event at which the
33-14    authorization expires; and
33-15                (7)  contain a statement that the individual has the
33-16    right to:
33-17                      (A)  revoke or amend the authorization in
33-18    accordance with this chapter;
33-19                      (B)  receive the notice required by Section
33-20    181.061;
33-21                      (C)  inspect, copy, and request an appendant or
33-22    amendment of protected health information; and
33-23                      (D)  be informed of those circumstances under
33-24    which health information may be used or disclosed without expressed
33-25    consent under a court order or other proper legal process issued by
33-26    a federal or state administrative agency or any other legal
 34-1    requirement.
 34-2          Sec. 181.153.  EXPIRATION.  (a)  An expressed consent for the
 34-3    use of protected health information is valid until the expiration
 34-4    date or event specified in the documentation or until it is revoked
 34-5    by the individual.
 34-6          (b)  A signed express consent for use of protected health
 34-7    information by or disclosure of protected health information to a
 34-8    health researcher is valid until:
 34-9                (1)  the specific health research inquiry for which
34-10    expressed consent was provided is completed;
34-11                (2)  the expressed consent is revoked as provided by
34-12    Section 181.154; or
34-13                (3)  as otherwise authorized by an institutional review
34-14    board or privacy review board.
34-15          Sec. 181.154.  REVOCATION.  (a)  The subject of protected
34-16    health information may revoke or amend an expressed consent at any
34-17    time unless:
34-18                (1)  a disclosure or use has already been made in
34-19    reliance on the consent; or
34-20                (2)  disclosure or use of protected information is made
34-21    for payment or reimbursement for health care that has previously
34-22    been delivered and for which the subject is not providing other
34-23    payment.
34-24          (b)  A revocation or amendment to expressed consent must be
34-25    in writing.
34-26          Sec. 181.155.  MODEL CONSENT.  The ombudsman shall, after
 35-1    notice and opportunity for public comment, develop and distribute a
 35-2    model expressed consent form.  An expressed consent obtained on a
 35-3    model form developed or approved by the ombudsman is considered to
 35-4    meet the requirements of this subchapter.
 35-5             (Sections 181.156-181.200 reserved for expansion
 35-6                      SUBCHAPTER E.  PROHIBITED ACTS
 35-7          Sec. 181.201.  DEIDENTIFIED INFORMATION.  A person, including
 35-8    a governmental unit, may not identify or attempt to identify an
 35-9    individual who is the subject of any deidentified health
35-10    information.
35-11          Sec. 181.202.  COERCED CONSENT.  (a)  A covered entity may
35-12    not condition the provision of health care to an individual or the
35-13    payment or reimbursement for health care on:
35-14                (1)  the provision of an expressed consent to use or
35-15    disclose the information for any purpose that is not essential and
35-16    directly related to the purpose of providing health care,
35-17    performing health care delivery review, or administrating or paying
35-18    a health care claim; or
35-19                (2)  an individual's decision to consent or withhold
35-20    consent for the  use or disclosure of any national individual
35-21    health identification number or other common unique identifier,
35-22    including an individual's social security number.
35-23          (b)  An employer may not condition terms of employment or
35-24    health care coverage or payment or reimbursement for health care on
35-25    the provision of expressed consent to use or disclose any protected
35-26    health information that is not:
 36-1                (1)  deidentified; or
 36-2                (2)  necessary and directly related to the job duties
 36-3    performed by the individual.
 36-4          (c)  A person may not coerce an individual to sign an
 36-5    expressed consent document.
 36-6          Sec.181.203.  RETALIATION.  A covered entity may not
 36-7    adversely affect a patient, health care practitioner, or other
 36-8    person, directly or indirectly, because the patient, practitioner,
 36-9    or other person has exercised a right under this chapter, disclosed
36-10    information relating to a possible violation of this chapter, or
36-11    associated with or assisted a person in the exercise of a right
36-12    under this chapter, or has the intent to do so.
36-13          Sec. 181.204.  REFUSAL TO PROVIDE HEALTH CARE.  Except as
36-14    otherwise provided by law, a person may not refuse to provide
36-15    health care to an individual who refuses to consent to the
36-16    disclosure or use of protected health information as long as the
36-17    individual is not requesting payment or reimbursement for the
36-18    health care from a third party and the information is not essential
36-19    and directly related to the purpose of providing health care.
36-20          Sec. 181.205.  PERSON ON COMMUNITY SUPERVISION.  A
36-21    supervision officer may not require a defendant to provide the
36-22    supervision officer with the defendant's protected health
36-23    information unless the protected health information is directly
36-24    related to the terms of the supervision.
36-25                (Sections 181.206-181.250 reserved for expansion
36-26                           SUBCHAPTER F.  ENFORCEMENT
 37-1          Sec. 181.251.  INJUNCTIVE RELIEF; CIVIL PENALTY.   (a)  The
 37-2    attorney general may institute an action for injunctive or
 37-3    declaratory relief to restrain a violation of this chapter.
 37-4          (b)  In addition to the injunctive relief provided by
 37-5    Subsection (a), the attorney general may institute an action for
 37-6    civil penalties against a covered entity for a violation of this
 37-7    chapter.  A civil penalty assessed under this subsection may not
 37-8    exceed $3,000 for each violation.
 37-9          (c)  If the court in which an action under Subsection (b) is
37-10    pending finds that the violations have occured with a frequency as
37-11    to constitute a pattern or practice, the court may:
37-12                (1)  assess a civil penalty not to exceed $250,000;
37-13                (2)  exclude the covered entity from participating in
37-14    any state-funded health care program; and
37-15                (3)  revoke any license held by the covered entity.
37-16          Sec. 181.252.  INDIVIDUAL INJUNCTIVE RELIEF; CIVIL CAUSE OF
37-17    ACTION.  (a)  An individual who is aggrieved by a violation of this
37-18    chapter may institute an action against a covered entity for
37-19    appropriate injunctive or declaratory relief.
37-20          (b)  The individual may institute an action for civil
37-21    damages.  An individual who prevails in an action may recover:
37-22                (1)  the greater of:
37-23                      (A)  the individual's actual damages; or
37-24                      (B)  liquidated damages in the amount of $3,000;
37-25    and
37-26                (2)  punitive damages.
 38-1          (c)  if the alleged violation involves sensitive health
 38-2    information, the individual may recover:
 38-3                (1)  the greater of:
 38-4                      (A)  the individual's actual damages; or
 38-5                      (B)  liquidated damages in the amount of $10,000;
 38-6    and
 38-7                (2)  punitive damages.
 38-8          (d)  If the individual who institutes an action under this
 38-9    section is the prevailing party, the court may award reasonable
38-10    attorney's fees and other litigation costs and expenses reasonably
38-11    incurred, including expert fees.
38-12          (e)  A civil action brought under this section must be
38-13    commenced not later than:
38-14                (1)  three years after the date the cause of action
38-15    accrues; or
38-16                (2)  one year after the date the cause of action was
38-17    discovered but not later than 5 years after the date the cause of
38-18    action accrued.
38-19          (f)  It is a defense to a civil action brought under this
38-20    section that the defendant, in good faith, reasonably believed that
38-21    the disclosure of the information was authorized by an expressed
38-22    consent.
38-23          Sec. 181.253.  CRIMINAL OFFENSE. (a)  A person commits an
38-24    offense if the person knowingly uses, discloses, reidentifies, or
38-25    obtains, or induces another to use, disclose, reidentify, or
38-26    obtain, protected health information for commercial advantage or
 39-1    personal gain or to cause malicious harm in violation of this
 39-2    chapter.
 39-3          (b)  An offense under this section is a misdemeanor
 39-4    punishable by a fine of not more than $50,000, confinement in
 39-5    county jail for not more than one year, or both.
 39-6          (c)  If the person commits an offense under this section with
 39-7    intent to sell the information, the  offense is a felony punishable
 39-8    by a fine of not more than $500,000, imprisonment in the
 39-9    institutional division of the Texas Department of Criminal Justice
39-10    for not more than 10 years, or both.
39-11          Sec. 181.254.  DISCIPLINARY ACTION. In addition to the
39-12    penalties prescribed by this chapter, a violation of this chapter
39-13    by an individual or facility that is licensed by an agency of this
39-14    state is subject to the same consequence as a violation of the
39-15    licensing law applicable to the individual or facility or of a rule
39-16    adopted under that licensing law.
39-17          SECTION 2.  Section 38.009, Education Code, is repealed.
39-18          SECTION 3.  This Act takes effect September 1, 2002.