Who needs Texas HB 300 training, how soon and what record to keep

Each employee of a Texas group practice must finish training on state and federal privacy law within 90 days of being hired. The practice must keep that employee's signed statement of completion until the sixth anniversary of the day it was signed. Health and Safety Code §181.101 sets no repeat schedule. It requires new training only when a material change in the law affects an employee's duties. The training is due within a reasonable period, and no later than the first anniversary of the day the change takes effect.

"HB 300" is the 2011 bill that added this duty to the Texas Medical Records Privacy Act, effective September 1, 2012. Many pages still say 60 days and training every two years. Those were the numbers in 2011, and the Legislature replaced them in 2013, as the section on older figures below shows.

Does a Texas group practice count as a covered entity under the Texas privacy law?

A Texas group practice is a covered entity under Texas law, and the Texas definition is wider than the federal one. Section 181.001(b)(2) reaches any person who handles protected health information, for pay or free, and names a "health care provider" and a "clinic" among those covered. Its paragraphs (A) and (B) read as follows.

"Covered entity" means any person who: (A) for commercial, financial, or professional gain, monetary fees, or dues, or on a cooperative, nonprofit, or pro bono basis, engages, in whole or in part, and with real or constructive knowledge, in the practice of assembling, collecting, analyzing, using, evaluating, storing, or transmitting protected health information. The term includes a business associate, health care payer, governmental unit, information or computer management entity, school, health researcher, health care facility, clinic, health care provider, or person who maintains an Internet site; (B) comes into possession of protected health information;

The federal rule is narrower. 45 CFR §160.103 limits a covered entity to a health plan, a clearinghouse or a provider that sends health information electronically in a standard transaction such as a claim. A cash-only practice that sends no standard electronic transactions may fall outside the federal definition and still be a Texas covered entity. The Texas definition also reaches a business associate and a "person who maintains an Internet site".

Section 181.051 exempts a few kinds of entity from most of the chapter, including "an employer". Chapter 181 does not define that word. Section 181.001(a) gives any term the chapter leaves undefined the meaning it has in the federal privacy standards as they stood on September 1, 2011. 45 CFR §160.103 says "Employer is defined as it is in 26 U.S.C. 3401(d)", a federal tax-law definition this guide did not read. The meaning of "an employer" therefore turns on a source outside both chapters, so a practice should not rely on the exemption to skip training for the staff who handle client records.

Which employees of a Texas group practice must take HB 300 training?

Every employee of a Texas covered entity must be trained "as necessary and appropriate for the employees to carry out the employees' duties", so the content differs by job and the duty does not. This is the wording of §181.101(a).

Each covered entity shall provide training to employees of the covered entity regarding the state and federal law concerning protected health information as necessary and appropriate for the employees to carry out the employees' duties for the covered entity.

In a group practice that means the front desk, intake staff, clinicians, billers, the practice manager and the owner. It also means anyone who administers the record system or the email account, because they can reach client information. The statute sets no minimum for an employee who touches no client information and does not exempt one.

Chapter 181 does not define "employee", and neither does 45 CFR §160.103, the federal list of definitions that §181.001(a) imports for undefined terms. That list defines "workforce", but §181.101 says "employees" and does not use "workforce", so the federal definition does not by itself widen the Texas duty. The eCFR text read for this guide is the current one, and the chapter freezes the federal reference at September 1, 2011, which this guide did not compare.

Two rules still point toward training contractors as well. The Texas definition of a covered entity in §181.001(b)(2)(D) reaches a contractor who handles protected health information.

(D) is an employee, agent, or contractor of a person described by Paragraph (A), (B), or (C) insofar as the employee, agent, or contractor creates, receives, obtains, maintains, uses, or transmits protected health information.

The federal HIPAA rule, 45 CFR §164.530(b)(1), requires training for every member of the workforce, and 45 CFR §160.103 defines that word broadly.

Workforce means employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity or business associate, is under the direct control of such covered entity or business associate, whether or not they are paid by the covered entity or business associate.

An LPC Associate paid as a contractor, a student intern and a volunteer fit that description. Train them on the same schedule, and have them sign the same statement.

How soon after hire must a Texas employee finish HB 300 training?

A Texas employee must finish HB 300 training no later than the 90th day after the date the covered entity hires the employee. The deadline is in §181.101(b).

An employee of a covered entity must complete training described by Subsection (a) not later than the 90th day after the date the employee is hired by the covered entity.

An employee hired on November 3, 2026 must finish by February 1, 2027. The statute says "hired" and does not say whether that means the offer, the signed agreement or the first day of work. A practice that counts from the earliest of the day the offer is made, the day the agreement is signed and the first day of work is the least likely to miss the date. It is also safer to train a person before the first day they can open a client record, though the statute does not require that.

The federal rule has no number. 45 CFR §164.530(b)(2)(i)(B) requires training for each new member of the workforce "within a reasonable period of time after the person joins". The Texas 90 days is the firmer limit, so a practice schedules to it.

How often must a Texas employee repeat HB 300 training?

A Texas employee repeats HB 300 training only when a material change in state or federal law affects the employee's duties, and not on any fixed cycle. Section 181.101(c) sets the outer limit.

If the duties of an employee of a covered entity are affected by a material change in state or federal law concerning protected health information, the employee shall receive training described by Subsection (a) within a reasonable period, but not later than the first anniversary of the date the material change in law takes effect.

Chapter 181 does not define "material", and the federal definitions read for this guide (45 CFR §§160.103 and 164.501) do not either, so the practice decides which changes qualify and writes the decision down. A federal rule is one example. The final rule on 42 CFR Part 2, published on February 16, 2024, took effect on April 16, 2024 with a compliance date of February 16, 2026. Section 181.101(c) says "takes effect" and does not say which of the two dates starts the year. If the April 16, 2024 effective date starts it, the one-year outer limit ended on April 16, 2025. If the compliance date starts it, the limit is February 16, 2027. A practice that treats a change as material and has not yet trained its staff should train them now and record the date.

A practice that retrains on its own cycle should record that as the practice's policy, because the statute does not require a cycle.

Why do some pages say HB 300 training takes 60 days and repeats every two years?

Some pages describe the 2011 text of HB 300, which the Legislature changed in 2013. The enrolled text of H.B. 300 required training "not later than the 60th day after the date the employee is hired" and "at least once every two years". The enrolled text of S.B. 1609 replaced "60th" with "90th" and replaced the two-year rule with the material-change rule above. The current section shows the 2013 act as an amendment, effective June 14, 2013.

The same act dropped the 2011 requirement that the training fit "the covered entity's particular course of business" and "each employee's scope of employment". The current words are "as necessary and appropriate" for the employee's duties.

What must Texas HB 300 training cover?

Texas HB 300 training must cover "the state and federal law concerning protected health information" that the employee needs for the job. The statute names no approved course, no provider, no length and no test. A practice may write its own or buy one, and the signed statement is the only proof the statute asks for.

The table lists what a group practice's training would reasonably include. The second column names the source for each topic.

What record must a Texas group practice keep, and for how long?

A Texas group practice must keep a statement, signed by each trained employee, that verifies the employee completed the training, until the sixth anniversary of the day it was signed. This is §181.101(d).

A covered entity shall require an employee of the entity who receives training described by Subsection (a) to sign, electronically or in writing, a statement verifying the employee's completion of training. The covered entity shall maintain the signed statement until the sixth anniversary of the date the statement is signed.

Three points follow from the words. The employee signs it, so a certificate a vendor issues does not replace it unless the employee also signs. The six years run from the signing date of each statement, not from the day the employee leaves. A statement signed on October 19, 2026 must be kept until October 19, 2032.

The federal rule asks for a record too. 45 CFR §164.530(b)(2)(ii) requires the practice to document that training was provided, and §164.530(j)(2) sets six years "from the date of its creation or the date when it last was in effect, whichever is later". Both rules use six years but count from different dates, so keep the record for the longer of the two. The statute does not ask for quiz scores or the course text, but keeping a dated copy of the version each person took lets the practice show what the signature meant.

What happens to a Texas group practice that cannot show HB 300 training?

A Texas group practice that cannot show the training can face a civil penalty from the Attorney General, and a licensing agency can act too. Section 181.201 sets the penalty for a violation of the chapter, and §181.101 is part of the chapter. The statute sets no separate penalty for missing training.

• Up to $5,000 for each violation in a year, if committed negligently.
• Up to $25,000 for each violation in a year, if committed knowingly or intentionally.
• Up to $250,000 for each violation in which the entity knowingly or intentionally used protected health information for financial gain.
• Up to $1.5 million a year if the court finds a pattern or practice.

These are the ceilings in §181.201(b) and (c). For a covered entity that a Texas licensing agency licenses, §181.201(e) lets the Attorney General sue for a civil penalty "only if the licensing agency refers the violation to the attorney general under Section 181.202(2)". Under §181.202 an agency may make that referral when there is evidence that violations "are egregious and constitute a pattern or practice". The statute does not say whether a practice company counts as licensed when its clinicians hold the licenses. The court weighs the seriousness of the violation, the entity's compliance history and its efforts to correct the violation under §181.201(d). Section 181.201(b-1) caps the penalty for a violation of the §181.154 electronic-disclosure rule at $250,000 a year when the court makes the findings below.

The total amount of a penalty assessed against a covered entity under Subsection (b) in relation to a violation or violations of Section 181.154 may not exceed $250,000 annually if the court finds that the disclosure was made only to another covered entity and only for a purpose described by Section 181.154(c) and the court finds that: (1) the protected health information disclosed was encrypted or transmitted using encryption technology designed to protect against improper disclosure; (2) the recipient of the protected health information did not use or release the protected health information; or (3) at the time of the disclosure of the protected health information, the covered entity had developed, implemented, and maintained security policies, including the education and training of employees responsible for the security of protected health information.

The purposes in §181.154(c) are treatment, payment and health care operations, an insurance or health maintenance organization function, and a disclosure otherwise authorized or required by state or federal law. Training counts toward the cap only through item (3), and only for a disclosure of that kind. Section 181.205 lets a covered entity offer its good-faith efforts to comply as mitigating evidence.

A licensed covered entity also faces discipline. Section 181.202 makes a violation by such an entity subject to investigation and disciplinary proceedings by the licensing agency, including probation or suspension.

What to do this week

1. List every person who works for the practice, including contractors, interns and volunteers, with the date each was hired.
2. Compute each person's training deadline as the hire date plus 90 days, and flag anyone past it.
3. Decide which training each role takes. Write down the course name and version so a signature can be tied to it.
4. Have each person who has finished sign a completion statement, on paper or electronically, and date it. A vendor certificate alone is not the employee's signed statement.
5. Put the sixth anniversary of each signing date in the record, and keep the statement until then.
6. Open a second log for changes in the law. Record each change the practice judges material, the date it took effect and a retraining deadline of the first anniversary.
7. Add "training deadline" to the new-hire checklist and start the count on the earliest of the day the offer is made, the day the agreement is signed and the first day of work.

The first table is the training record, one row per person per training.

The second table is the change log.

Where Practice Pillar fits

Practice Pillar, software for therapy group practices, lists training records with completion dates among what it does for the people who run a practice, on its operations page. A spreadsheet with the columns above holds the same record.

Sources

• Texas Health and Safety Code chapter 181, Medical Records Privacy, Texas Legislature. The full chapter was read in the Legislature's HTML file. It includes the 2025 addition of §181.105. Checked October 19, 2026.
• H.B. 300, 82nd Legislature, enrolled, Texas Legislature. Shows the original 60-day and two-year text. Checked October 19, 2026.
• S.B. 1609, 83rd Legislature, enrolled, Texas Legislature. Shows the change to 90 days and the material-change rule. Checked October 19, 2026.
• 45 CFR §160.103, §164.308 and §164.530, Electronic Code of Federal Regulations. Text in effect on October 15, 2026. Checked October 19, 2026.
• Confidentiality of Substance Use Disorder (SUD) Patient Records, 89 FR 12472, Federal Register, February 16, 2024. Shows the effective and compliance dates. Checked October 19, 2026.