BILL ANALYSIS

Senate Research Center	H.B. 3233
89R25441 SCR-D	By: Harris (Kolkhorst)
	Health & Human Services
	5/16/2025
	Engrossed

AUTHOR'S / SPONSOR'S STATEMENT OF INTENT

Pharmacy benefit managers (PBMs) manage prescription drug benefits for health plans, insurers, pharmacies, and drug manufacturers; process prescription drug claims; calculate enrollee out-of-pocket costs; and are responsible for keeping patient data secure. PBMs often unite as Group Purchasing Organizations (GPOs) when they operate offshore, which exposes patient data to foreign servers. In 2023, Montana and Florida required healthcare providers to store patient information only within the continental United States or Canada. From January through March 2025, over 422,000 Texans have been affected by health data breaches.

An increase of cybersecurity attacks has led to illegal access to patient data, including a patient's Social Security numbers, Medicaid and Medicare ID numbers, full names, phone numbers, and health certificates. Texas must act to safeguard patient data.

H.B. 3233 aims to protect Texans' privacy by prohibiting PBMs from storing any patient data in countries where the U.S. Secretary of State has determined that the government has promoted international terrorist activities.

H.B. 3233 amends current law relating to patient data maintained by pharmacy benefit managers.

RULEMAKING AUTHORITY

This bill does not expressly grant any additional rulemaking authority to a state officer, institution, or agency.

SECTION BY SECTION ANALYSIS

SECTION 1. Amends Subchapter D, Chapter 4151, Insurance Code, by adding Section 4151.1531, as follows:

Sec. 4151.1531. SECURITY OF PATIENT DATA. Prohibits a pharmacy benefit manager from storing or processing patient data for a resident of this state in a location that is in a country the government of which has been determined by the secretary of state of the United States to have repeatedly provided support for acts of international terrorism as designated under Section 620A, Foreign Assistance Act of 1961 (22 U.S.C. Section 2371), Section 40, Arms Export Control Act (22 U.S.C. Section 2780), or Section 1754(c), John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. No. 115-232).

SECTION 2. Makes application of Section 4151.1531, Insurance Code, as added by this Act, prospective.

SECTION 3. Effective date: September 1, 2025.