Texas now sets its own rules for AI in patient care. If your practice uses an ambient scribe, an AI feature in your EHR, or an assistant like Copilot or ChatGPT with patient information, these laws apply to you alongside HIPAA.
Two Texas laws passed in 2025 govern how health care providers use artificial intelligence. SB 1188 sets conditions for using AI in diagnosis and treatment and requires electronic health records to stay in the United States. HB 149, the Texas Responsible AI Governance Act, requires providers to tell patients when AI is used in their care. Both are enforced by the Texas Attorney General.
The two laws work together. One sets the conditions for using AI in care, and the other makes sure the patient knows.
A licensed practitioner may use AI for diagnostic purposes, including recommendations on diagnosis or treatment, when all of these are true:
When AI is used in relation to a patient’s health care service or treatment, the provider tells the patient or the patient’s representative. The disclosure is due by the date the service is provided, or as soon as reasonably possible in an emergency. Many practices include the disclosure in intake forms patients sign at the start of care. Confirm your wording with counsel.
From January 1, 2026, electronic health records of Texas residents must be physically stored in the United States or a U.S. territory. This includes records held by cloud providers, hosting companies, and other vendors. Staff outside the country may still access records with appropriate safeguards, as long as the records are never stored, copied, or cached on servers or devices outside the United States.
Access to electronic health records is limited to the people who need it for treatment, payment, or health care operations, protected by reasonable administrative, physical, and technical safeguards. This matters for AI because assistants and search tools see whatever a user’s permissions allow.
If you are a licensed practitioner or health care provider in Texas and any AI tool touches patient care, documentation, or records, plan for both laws. The storage requirement also reaches the vendors who store records for you.
Quick check
If any of these is true, both laws likely apply to some part of your practice.
| AI tool | What the law asks | What to have in place |
|---|---|---|
| Ambient scribes and visit note assistants | Practitioner review of the AI-generated note; patient disclosure | Patient notice before recording, clinician sign-off on every note, audio retention rules |
| AI features in your EHR or practice management system | Practitioner review; U.S. storage of records; access limits | Vendor confirmation of U.S. storage, BAA coverage for the feature, role-based access |
| Imaging and diagnostic AI | Use within the practitioner’s license; review; disclosure | Written workflow showing who reviews each result, disclosure language |
| Patient chatbots and automated messages | Disclosure that AI is used in the service | AI identified to the patient, clinical questions routed to staff |
| General assistants such as Microsoft Copilot or ChatGPT | All of the above when patient information is involved | Business licenses with a BAA, a written acceptable AI use policy, staff training |
HIPAA still applies to every AI tool that handles protected health information. The Texas laws add requirements on top of it.
The Texas Attorney General enforces both laws.
Penalty amounts are summarized from the statutes. Confirm current amounts and how they apply to your practice with counsel.
We prepare the systems and the paperwork so your clinicians can use AI with patient information protected. Whether a law applies to a specific use is a legal question for you and your counsel. We make sure your systems and records support the answer.
| What the law expects | What we do |
|---|---|
| AI used only with approved tools | We review the AI tools already in use, help you choose and license approved ones, and set up a written acceptable AI use policy |
| Patient disclosure | We provide template disclosure language for your counsel to finalize and help build it into intake |
| Practitioner review of AI records | We document review workflows and turn on the audit logging that shows who reviewed what |
| U.S. storage of health records | We map where your records are stored and processed, including cloud and vendor locations, and gather written confirmations |
| Access limited by role | We clean up permissions in your EHR, Microsoft 365, and file shares so assistants only see what each role allows |
| HIPAA alignment | We update your security risk analysis and BAA inventory to cover AI |
We have a list of every AI tool and feature that touches patient information.
Every one of those tools is covered by a signed BAA.
Patient AI disclosure language is approved and in use.
Clinicians review and sign off on every AI-generated record.
Our vendors have confirmed in writing that our health records are stored in the United States.
Access to health records is limited by role, and AI tools follow those limits.
Our HIPAA risk analysis covers AI.
Staff have a written acceptable AI use policy and have been trained on it.
This checklist helps you prepare. It does not determine compliance. Your counsel makes that call.
AI policy templates for health care practices Get our Acceptable AI Use Policy, AI Readiness Self-Assessment Checklist, and Healthcare Addendum, built for Texas practices.
Last reviewed: October 15, 2026.
This page is general information about Texas and federal law, not legal advice for your situation. Final compliance determinations rest with your organization and its counsel.
A focused review of how your team uses AI today, where patient information goes, and what to fix before you expand.
Managed IT, cybersecurity, and compliance for Central Texas since 2001.
© 2026 ALCON DTS.
