Report a HIPAA Violation in Texas

Texas does not give patients a right to sue, but its own privacy law reaches further than HIPAA and lets the Texas Attorney General fine a violator up to $1.5 million a year, separate from anything the federal government collects. Federal HIPAA sets the same complaint process nationwide, and Texas law adds its own rules on top of that floor.

Texas HIPAA Rules at a Glance

Federal HIPAA sets a single national floor, and Texas law sits on top of it rather than replacing it. Filing an HHS OCR complaint works the same in Texas as it does in every other state. What changes locally is whether Texas's own statute gives you a path federal law does not, and the table below lines up the two side by side.

Does Texas Give You More Than Federal HIPAA?

Texas took a different route than California. HB 300, passed in 2011 and layered into Chapter 181 of the Health and Safety Code, does not create a private right of action, so a Texas patient cannot personally sue a provider under this statute the way a California patient can under the CMIA. What Texas built instead is a broader definition of who has to comply and a state enforcement arm with real teeth.

Chapter 181 covers more entities than HIPAA does. Texas defines a covered entity to include some businesses that assemble, collect, analyze, or use protected health information even when they would not qualify as a HIPAA covered entity or business associate under federal law. That closes a gap HIPAA leaves open for certain health-adjacent businesses that are not clinics, insurers, or their contractors.

The statute is also stricter on specific disclosures. It tightens the rules around marketing uses of protected health information, psychotherapy notes, and re-identification of information a provider had de-identified, requiring more explicit authorization than the HIPAA Privacy Rule does in each case. A Texas clinic that wants to use your treatment history in a marketing email needs a more specific authorization than HIPAA alone would require, and skipping that step is a Chapter 181 problem even where a federal HIPAA reviewer might not flag it.

Enforcement is where Texas stands out. The Texas Attorney General can bring a civil action directly, on top of whatever HHS OCR does at the federal level, and can fine a violator up to $1.5 million per violation category per year. The Texas AG has used this authority against entities with no physical presence in Texas whenever Texas residents' health data was involved, so an out-of-state company is not automatically outside the state's reach.

How to Report a HIPAA Violation in Texas

File the federal complaint first. The main HIPAA violation guide covers the HHS OCR Complaint Portal process, and the same 180-day federal deadline applies in Texas as everywhere else. That complaint is free and does not require a lawyer.

To flag a Chapter 181 problem to Texas itself, contact the Texas Attorney General's Consumer Protection Division, which handles medical-privacy complaints under HB 300 alongside its broader consumer-protection docket. If the entity involved is a licensed facility such as a hospital or nursing home, the Texas Health and Human Services Commission's complaint intake handles facility-specific complaints and can trigger a survey or licensing action separate from anything the Attorney General does.

Because there is no private right of action here, a Texas patient's own path to money damages runs through a different legal theory rather than Chapter 181 itself, most often a negligence claim that uses HIPAA and Chapter 181 as the standard of care the provider fell short of. That is a case for a privacy or medical malpractice attorney to evaluate, not a form you file yourself.

Report the same facts to both offices rather than picking one. The Attorney General and HHS OCR investigate independently and do not automatically share complaints, so an entity that mishandled your records can face a federal corrective action plan, a separate state fine, and still owe you nothing personally unless you or your attorney also pursue the negligence route above.

Can You Sue for a HIPAA Violation in Texas?

Not directly under Chapter 181. Texas is one of the states without its own medical-privacy private right of action, so a lawsuit over a Texas HIPAA-type violation typically has to be built on a separate legal theory, most commonly negligence, breach of confidentiality, or invasion of privacy, with the HIPAA and Chapter 181 standards used as evidence of what a reasonable provider should have done.

Picture how that plays out. A Texas dental practice emails a patient's treatment history to a marketing vendor without the specific written authorization Chapter 181 requires for that use. The patient cannot sue under Chapter 181 itself, since it grants the Attorney General enforcement power, not the patient. What the patient can do is bring a negligence claim, pointing to the practice's failure to meet the Chapter 181 marketing-authorization standard as evidence the practice fell below the care a reasonable dental office owes its patients. The Attorney General, separately and on its own initiative, can also fine the practice up to $1.5 million per violation category regardless of whether the patient ever sues.

Confirm the current penalty figures before relying on them. The $1.5 million per-category cap above reflects Texas Attorney General enforcement authority as verified in August 2026, and Texas has periodically strengthened this statute since it first passed in 2011. An attorney evaluating your specific facts will confirm which cap and which legal theory actually fits your situation.

Frequently Asked Questions

Can I sue for a HIPAA violation in Texas?

Not directly under the Texas Medical Records Privacy Act, since it does not create a private right of action the way California's CMIA does. A Texas patient typically needs a separate legal theory, such as negligence, with HIPAA and Chapter 181 used as the standard the provider failed to meet.

What makes Texas privacy law stricter than HIPAA?

Chapter 181 covers some businesses that HIPAA does not reach, tightens the rules on marketing uses of health information and psychotherapy notes, and lets the Texas Attorney General fine violators up to $1.5 million per violation category per year, independent of any federal penalty.

Who do I report a HIPAA violation to in Texas?

File with HHS OCR first for the federal complaint. For the state side, the Texas Attorney General's Consumer Protection Division handles Chapter 181 complaints, and the Texas Health and Human Services Commission handles complaints against licensed facilities like hospitals and nursing homes.

Does Chapter 181 apply to companies HIPAA does not cover?

Yes. Texas defines a covered entity more broadly than federal law, reaching some businesses that assemble, collect, analyze, or use protected health information even when they are not a HIPAA covered entity or business associate.

Can the Texas Attorney General fine an out-of-state company over my records?

Yes, if Texas residents' health data was involved. The Texas Attorney General has enforced Chapter 181 against entities with no physical presence in the state on that basis, so a company being headquartered elsewhere does not put it outside Texas's reach.

Will reporting to the Texas Attorney General get me any money?

No, not directly. An Attorney General fine goes to the state, not to you. If you want compensation personally, you or an attorney need to pursue a separate negligence or breach-of-confidentiality claim using the Chapter 181 violation as evidence of the provider's failure.