Starting September 1, 2025, health care practitioners in Texas are required to store electronic health records in the United States under a new Act. This requirement is found in a recently enacted law that also includes requirements for practitioner's AI use.
Health care practitioners include providers licensed, certified, or otherwise authorized to provide health care services in Texas. Many practitioners use third party software for electronic health record solutions. This localization requirements also applies to those arrangements with vendors and cloud storage providers. The Act also requires that health care practitioners implement reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic health records. The law does not specifically contemplate what those safeguards might be. The law also prohibits collection and storage of individual credit scores or voter registration information in electronic health records.
Putting it into practice. While historically, there had not been many laws expressly requiring that EHRs be hosted in the U.S., Texas joins Florida in enacting this law. Before this law goes into effect, health care practitioners in Texas should assess storage of electronic health records to ensure records are maintained in the United States. Providers will also want to confirm that the necessary safeguards are in place to protect EHRs. Lastly, credit scores or voter registration records should not be collected or stored in electronic health records. In addition, health care practitioners should assess vendor relationships to confirm compliance with the Act. Practitioners may also want to update template agreements to account for these offshoring considerations (if not done so already).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
