BILL ANALYSIS

Senate Research Center	C.S.S.B. 1188
89R21061 EAS/CMO-F	By: Kolkhorst
	Health & Human Services
	3/27/2025
	Committee Report (Substituted)

AUTHOR'S / SPONSOR'S STATEMENT OF INTENT

Medical records provide vital patient information to healthcare providers, informing patient care. Therefore, it is imperative that these records are secure, accessible to relevant patient parties, accurate, and used for their intended purpose. 

Currently, some medical record systems have sought to remove parental access from their child's medical record by allowing "proxy" access if the child subsequently grants it. Not only do parents need to understand and be up to date on their child's medical history as legal guardians, but children also may not fully understand their own medical record and require assistance.  Furthermore, though the development of artificial intelligence can prove helpful in the medical field, it should not replace the role of the physician with regard to medical records.

Additionally, in order to ensure accuracy and allow doctors to make informed, personalized decisions regarding patient care, medical records must include vital information such as a patient's biological sex at birth. Biological sex informs medical care decisions with regard to the anatomy of organ systems, disease prevalence, drug and toxin tolerance, and other relevant factors for determining care.

Lastly, medical records also have recently been used for voter registration purposes and for entities to determine credit score reports. Medical records should be used for their intended purpose�communication between providers and patients�rather than as a financial or social engineering tool. 

S.B. 1188 seeks to address these issues, as well as improve patient care by adding a place for doctors to address metabolic health and other root-causes of health issues.

Key Provisions

• The bill mandates that electronic health records (EHR) must be stored on servers located in the domestic United States, requiring healthcare facilities, providers, and state agencies to ensure that this stipulation is met.

• The bill requires a field for providers to communicate updated information to patients related to metabolic health, diet, and the connection to long-term disease and illness.

• The bill prohibits the ability of electronic health records platforms from collecting and retaining any information regarding a person's voting history, voter registration status, or from collecting personal information that would in anyway be used for the purpose of facilitating the ability for a person to register to vote or execute a mail-in-ballot.

• The bill prohibits the use of Texas operated electronic health records platforms for credit score reporting.

• The bill requires oversight for the utilization of artificial intelligence in healthcare settings, mandating that any information recorded in systems by artificial intelligence be reviewed by a health care practitioners.

• Electronic records must contain a fixed field for biological sex, male or female, based on observed characteristics at birth.

• The bill explicitly states it does not prohibit the medical records from also listing an individual's gender identity.

• Healthcare providers are barred from changing the individual's biological sex unless a clerical mistake was made or the patient is intersex.

• If the records are amended through the latter methodology, then the physicians must note record applicable information on the patient's disorder.

• The Health and Human Services Commission or the applicable licensing board may discipline facilities or providers that do not comply with this legislation and restrict payments from Medicaid or even disenrollment as a provider in Medicaid.

Committee Substitute Changes

The committee substitute makes clarifying changes to several sections:

• It adds the definition of "covered entity" from the Texas Medical Privacy Act to the definitions section and changes the applicability from medical and health care practitioners and governmental entities to "covered entities." This change was suggested by several organizations.

• This definition still applies to health care practitioners, but is consistent with current law in medical privacy.

• The committee substitute revises the requirements for storing electronic medical records. It clarifies that a "covered entity" shall ensure that electronic medical records "under" their control are stored physically within the U.S. and its territories, but that those records may be accessible to physicians or other practitioners with reasonable safeguards.

• It clarifies that electronic medical records include "an option" for collecting and recording communications with practitioners related to patients' metabolic health and diet as part of treatments.

• Fourth, it clarifies provisions related to use of Artificial Intelligence (A.I.) by delineating that health care practitioners must review records where artificial intelligence may be used for diagnostic purposes only or to recommend treatments. It also adds a requirement that use of A.I. for diagnostic purposes using the contents of an EMR must be disclosed to the patient.

• The committee substitute clarifies a parent's ability to access a minor's electronic medical record. It adds language that the parents of minors 17 and younger shall have "complete" and "unrestricted access" upon request to the record unless otherwise restricted by state or federal law or a court order.

• Next, the committee substitute revises the information utilized by decision assistance tools within an electronic medical record to "include" a patient's biological sex. This change ensures it is not the sole determining factor for treatment.

• Finally, it updates the enforcement provisions of the bill to align enforcement with the Medical Privacy Act, by creating civil penalties of up to $5,000 per violation and will be enforced by the Texas Attorney General.

• It removes the enforcement mechanism for prohibiting Medicaid reimbursement and disenrollment, but does require compliance with the bill as a condition to participate in Medicaid and CHIP.

[1]������� https://acpeds.org/position-statements/sex-is-a-biological-trait-of-medical-significance

[2]������� https://roy.house.gov/sites/evosubsites/roy.house.gov/files/evomediadocument/ROY_Ep

ic. Vot- ER_8.20.24_FINAL.pdf 

C.S.S.B. 1188 amends current law relating to electronic health record requirements and authorizes a civil penalty.

RULEMAKING AUTHORITY

Rulemaking authority is expressly granted to the executive commissioner of the Health and Human Services Commission in SECTION 1 (Sections 183.009 and 183.013, Health and Safety Code) of this bill.

Rulemaking authority is expressly granted to the Texas Department of Licensing and Regulation in SECTION 1 (Section 183.013, Health and Safety Code) of this bill.

Rulemaking authority is expressly granted to the Texas Medical Board in SECTION 1 (Section 183.013, Health and Safety Code) of this bill.

Rulemaking authority is expressly granted to the Texas Department of Insurance in SECTION 1 (Section 183.013, Health and Safety Code) of this bill.

Rulemaking authority is expressly granted to each regulatory agency subject to Chapter 183, Health and Safety Code, in SECTION 1 (Section 183.013, Health and Safety Code) of this bill.

SECTION BY SECTION ANALYSIS

SECTION 1. Amends Subtitle I, Title 2, Health and Safety Code, by adding Chapter 183, as follows:

CHAPTER 183. ELECTRONIC HEALTH RECORDS

Sec. 183.001. DEFINITIONS. Defines "biological sex," "covered entity," "female," "health care practitioner," "male," and "sexual development disorder."

Sec. 183.002. REQUIREMENTS FOR ELECTRONIC HEALTH RECORD STORAGE. (a) Requires a covered entity to ensure that electronic health records under the control of the entity that contain patient information are physically maintained in the United States or a territory of the United States. Provides that this subsection applies to certain electronic health records.

(b) Requires a covered entity to ensure that electronic health record information of this state's residents, other than open data, is accessible only to individuals who require the information to perform duties within the scope of the individual's employment related to treatment, payment, or health care options.

(c) Requires each covered entity to implement reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic health record information.

Sec. 183.003. REQUIRED MEDICAL HISTORY INFORMATION IN ELECTRONIC HEALTH RECORD. Requires a covered entity to ensure each electronic health record maintained for an individual includes the option for a health care practitioner to collect and record communications between two or more covered entities related to the individual's metabolic health and diet in the treatment of a chronic disease or illness.

Sec. 183.004. INFORMATION RESTRICTIONS IN ELECTRONIC HEALTH RECORD. Prohibits a covered entity from collecting, storing, or sharing any information regarding an individual's credit score or voter registration status in the individual's electronic health record.

Sec. 183.005. ARTIFICIAL INTELLIGENCE IN ELECTRONIC HEALTH RECORD. Requires a health care practitioner who uses artificial intelligence for diagnostic or other purposes, including the use of artificial intelligence for recommendations on a diagnosis or course of treatment based on a patient's medical record, to review all records created with artificial intelligence to ensure that the data is accurate and properly managed.

(b) Requires a health care practitioner who uses artificial intelligence for diagnostic purposes as described by Subsection (a) to disclose the practitioner's use of that technology to the practitioner's patients.�

Sec. 183.006. ACCESS TO ELECTRONIC HEALTH RECORD OF MINOR. (a) Defines "minor."

(b) Requires a covered entity to ensure each electronic health record system the entity uses to store electronic health records of minors allows a minor's parent or, if applicable, the minor's managing conservator or guardian to obtain complete and unrestricted access to the minor's electronic health record immediately upon request, unless to all or part of the record is restricted under state or federal law or by a court order.

Sec. 183.007. ELECTRONIC HEALTH RECORD REQUIREMENTS REGARDING BIOLOGICAL SEX. (a) Requires the Health and Human Services Commission (HHSC), the Texas Medical Board (TMB), and the Texas Department of Insurance (TDI), notwithstanding any other law, to jointly ensure that:

(1) each electronic health record prepared or maintained by a covered entity in this state includes a separate space for the entity to document:

(A) an individual's biological sex as either male or female based on the individual's observed biological sex recorded by a health care practitioner at birth; and

(B) information on any sexual development disorder of the individual, whether identified at birth or later in the individual's life; and

(2) any algorithm or decision assistance tool included in an electronic health record to assist a health care practitioner in making medical treatment decisions is based on an individual's biological sex as recorded in the space described by Subdivision (1)(A).

(b) Provides that this section does not prohibit an electronic health record from including spaces for recording other information related to an individual's biological sex or gender identity.

Sec. 183.008. AMENDING CERTAIN BIOLOGICAL SEX INFORMATION IN ELECTRONIC HEALTH RECORDS. (a) Provides that a covered entity is authorized to amend on an electronic health record an individual's biological sex as recorded in the space described by Section 183.007(a)(1)(A) only if:

(1) the amendment is to correct a clerical error; or

(2) the individual is diagnosed with a sexual development disorder and the amendment changes the individual's listed biological sex to the opposite biological sex.

(b) Requires the covered entity, if an individual's biological sex is amended under Subsection (a)(2), to include in the individual's electronic health record information on the individual's sexual development disorder in the space described by Section 183.007(a)(1)(B).

Sec. 183.009. PROHIBITION ON COVERED ENTITY PARTICIPATION UNDER MEDICAID AND CHILD HEALTH PLAN PROGRAM. (a) Defines "child health plan program" and "Medicaid."

(b) Requires the executive commissioner of HHSC (executive commissioner) by rule to prohibit a covered entity that violates this chapter from participating as a health care provider under Medicaid or the child health plan program for a period that is reasonably proportionate to the seriousness and frequency of the violation, as the executive commissioner determines. Requires the executive commissioner, in adopting rules under this section, to ensure that the period during which a covered entity is prohibited from participating as a provider under Medicaid or the child health plan program runs concurrently with the period during which the covered entity's license, registration, certification, or other regulatory authorization is suspended under Section 183.011, as applicable.

Sec. 183.010. INVESTIGATION BY COMMISSION OR REGULATORY AGENCY. Requires HHSC or the appropriate regulatory agency to conduct an investigation of any credible allegation of a violation of this chapter by a covered entity. Requires HHSC or the agency to ensure the investigation is conducted in compliance with all applicable state and federal laws, including the Health Insurance Portability and Accountability Act of 1996 (Pub. L. No. 104-191).

Sec. 183.011. DISCIPLINARY ACTION BY REGULATORY AGENCY. Authorizes the appropriate regulatory agency to take disciplinary action against a covered entity that violates this chapter three or more times in the same manner as if the covered entity violated an applicable licensing or regulatory law. Authorizes the disciplinary action to include license, registration, or certification suspension or revocation for a period the agency determines appropriate.

Sec. 183.012. INJUNCTIVE RELIEF; CIVIL PENALTY. (a) Authorizes the attorney general to institute an action for injunctive relief to restrain a violation of this chapter.

(b) Authorizes the attorney general, in addition to the injunctive relief provided by Subsection (a), to institute an action for civil penalties against a covered entity for a violation of this chapter. Prohibits a civil penalty assessed under this section from exceeding certain amounts.�

Sec. 183.013. MEMORANDUM OF UNDERSTANDING; RULES. Requires the executive commissioner, TMB, the Texas Department of Licensing and Regulation, and TDI, and each regulatory agency subject to this chapter to enter into a memorandum of understanding and, as necessary, adopt rules to implement this chapter.

SECTION 2. (a) Makes application of Chapter 183, Health and Safety Code, as added by this Act, except as provided by Subsection (b) of this section, prospective.

(b) Provides that Section 183.002, Health and Safety Code, as added by this Act, applies to the storage of an electronic health record on or after January 1, 2026, regardless of the date on which the electronic health record was prepared.

SECTION 3. Requires a state agency, if necessary for implementation of a provision of this Act, to request a waiver or authorization from a federal agency, and authorizes a delay of implementation until such a waiver or authorization is granted.

SECTION 4. Effective date: September 1, 2025.