Texas Medical Board Rules vs Federal Healthcare Laws

Table of Contents

• How Texas Medical Board Rules and Federal Healthcare Laws Interact
• Texas Medical Board Rules vs Federal Healthcare Laws: Quick Comparison
• Corporate Practice of Medicine Doctrine in Texas
• Texas Medical Record Retention Requirements and HIPAA
• Telehealth Regulatory Compliance in Texas
• Resolving Conflicts Between State Board Rules and Federal Regulations
• Compliance Checklist for Multi-State Providers
• Conclusion
• Frequently Asked Questions

Last Updated: September 13, 2026

How Texas Medical Board Rules and Federal Healthcare Laws Interact

Texas medical board rules and federal healthcare laws operate as two overlapping systems of regulation, and providers must satisfy both. This guide from Brewster Law Firm, PLLC breaks down where the Texas Medical Board's authority ends and federal jurisdiction begins, covering the Corporate Practice of Medicine doctrine, medical record retention, telehealth compliance, and the practical steps multi-state providers can take to stay compliant.

The core principle is simple: federal law sets a floor, not a ceiling. HIPAA establishes national privacy standards, but Texas law adds its own retention and reporting requirements on top. Where the two conflict, federal preemption applies only in narrow circumstances, and most day-to-day compliance questions are answered by state law.

Texas Medical Board official rules and regulations

The distinction matters because enforcement runs on parallel tracks. A single compliance failure can trigger a federal investigation and a state licensure action simultaneously, and the penalties are cumulative rather than alternative.

Texas Medical Board Rules vs Federal Healthcare Laws: Quick Comparison

The table below summarizes how the two regulatory layers divide responsibility across the areas that generate the most compliance questions.

The practical takeaway: the Texas Medical Board governs the license itself, while federal agencies govern participation in federal programs and controlled substance authority. Losing either one can end a practice.

Corporate Practice of Medicine Doctrine in Texas

The Corporate Practice of Medicine doctrine in Texas prohibits business corporations from employing physicians to practice medicine. Texas enforces this doctrine more strictly than most states, and the Texas Medical Board treats violations as grounds for disciplinary action against the physician, not just the entity.

This is where non-physician ownership structures run into trouble. A management services organization can handle billing, staffing, and facilities, but clinical decision-making and the physician-patient relationship must remain with a licensed physician. Common mistakes include:

• Drafting management agreements that give the MSO control over clinical staffing decisions
• Structuring fee arrangements as a percentage of medical revenue rather than fair market value
• Failing to document that the physician retains authority over patient care policies

Texas Medical Record Retention Requirements and HIPAA

Texas medical record retention requirements and HIPAA answer two different questions, and conflating them is one of the most common compliance errors a practice makes. HIPAA governs how protected health information is safeguarded; Texas law governs how long the record must exist in the first place.

Under the Texas Medical Board's rules, a physician must keep an adequate medical record for each patient. The retention floor most practitioners apply is seven years from the date of the last treatment for adult patients. For minors, the clock generally runs from the date the patient reaches the age of majority, which in Texas is 18, so a record for a patient treated at age 10 may need to be retained well past the seven-year mark. Records must be legible, complete, and dated, and the Board treats a missing or altered record as an independent basis for discipline separate from whatever the underlying care issue was.

HIPAA does not set a federal retention period. The Privacy Rule and Security Rule instead require that records be protected for as long as they are retained under state law, and the Security Rule's disposal standard requires that records be rendered unreadable, indecipherable, and unrecoverable when they are finally destroyed. That means a practice cannot satisfy HIPAA by shredding at an arbitrary internal interval, it must first satisfy the state retention floor, then destroy in a HIPAA-compliant manner.

HHS HIPAA Privacy Rule guidance

Texas Medical Board official rules and regulations

The gap catches providers off guard in three recurring ways:

• A practice adopts a five-year internal retention policy because it heard "HIPAA requires five years." No federal retention period exists, and the policy violates Texas law.
• A practice retains records indefinitely without a destruction schedule, which increases breach exposure and discovery burden in litigation.
• A practice maintains separate retention schedules by state and destroys a shared record on the shortest schedule, wiping out records that a longer-retention state still requires.

For practices operating across state lines, the safest approach is to apply the longest applicable retention period to all records rather than maintaining separate schedules by location. A single retention calendar keyed to the longest state requirement eliminates the reconciliation problem entirely and is far easier to defend in an audit than a patchwork of state-specific schedules.

Telehealth Regulatory Compliance in Texas

Telehealth regulatory compliance in Texas requires that a physician establish a proper physician-patient relationship before providing care, and Texas rules on this point diverge from federal telehealth policy. Federal law expanded Medicare telehealth coverage and DEA flexibilities for controlled substances, but those federal allowances do not override Texas practice standards. Navigating these conflicting mandates necessitates a clear understanding of the constitutional tensions inherent in federal overreach issues that arise when state medical boards assert their sovereign authority over local clinical practice.

The divergence creates real friction. A provider licensed in Texas who sees a patient located in another state must generally satisfy the licensing and practice standards of the state where the patient is physically located, not just Texas rules. For controlled substances, federal DEA registration and state authority must both be satisfied, and the two sets of rules on prescribing via telehealth do not always align.

Book a Consultation →

Resolving Conflicts Between State Board Rules and Federal Regulations

Conflicts between state board rules and federal regulations are resolved by preemption doctrine, but preemption applies far less often than providers assume. The Supremacy Clause makes federal law controlling where Congress has clearly occupied a field or where state law directly conflicts with a federal requirement. In healthcare, that leaves most day-to-day questions answered by state law, and the areas where the two layers genuinely overlap are narrower and more specific than the general "federal floor, state ceiling" framing suggests.

HIPAA versus Texas privacy and reporting rules. HIPAA sets a privacy floor that Texas may exceed, and Texas does. Texas law imposes its own breach notification timelines and its own reporting obligations to the Texas Medical Board and, in certain circumstances, to the Texas Attorney General. A practice that satisfies HIPAA's breach notification standard may still miss a Texas-specific notification deadline. The reconciliation rule is straightforward: follow the stricter standard on each element, and where the timelines differ, follow the shorter one.

EMTALA versus state emergency and transfer rules. The Emergency Medical Treatment and Labor Act imposes federal obligations on Medicare-participating hospitals to provide a medical screening examination and stabilizing treatment, and it restricts transfers of unstable patients. Texas has its own hospital and emergency-care requirements that operate alongside EMTALA. The two rarely conflict directly, but a transfer that satisfies EMTALA's stabilization and certification requirements can still violate a Texas-specific transfer or reporting rule. The practical answer is to build the transfer protocol around whichever requirement is more demanding at each step.

Federal anti-kickback and Stark versus Texas illegal remuneration rules. Federal anti-kickback and Stark Law requirements apply to referrals for federal healthcare program business. Texas has its own prohibitions on illegal remuneration that apply more broadly and are not limited to federal program patients. A fee arrangement that falls outside Stark's technical requirements can still violate Texas law. The reconciliation rule is to apply the Texas prohibition as the baseline and treat the federal analysis as an additional layer for federal program business.

Controlled substance prescribing. DEA registration and state prescribing authority must both be satisfied, and the two sets of rules on telehealth prescribing do not always align. A prescriber who meets the federal standard may still exceed a Texas-specific limitation on remote prescribing of controlled substances.

When a genuine conflict exists, the answer is rarely to pick one framework. It is to comply with both where possible and document the analysis where they cannot be reconciled. A written reconciliation memo, identifying the federal requirement, the state requirement, the controlling authority, and the resolution, is the single most useful artifact a practice can produce, because it converts a judgment call into a defensible record.

Compliance Checklist for Multi-State Providers

Multi-state providers face a compounding problem: each state's medical practice act, administrative code, and disciplinary authority applies independently, and a violation in one state can surface in another through the Federation of State Medical Boards' data-sharing network.

Federation of State Medical Boards resources

Use this checklist to structure your compliance review:

• Verify active licensure in every state where patients are located
• Confirm the corporate structure satisfies each state's Corporate Practice of Medicine doctrine
• Map record retention periods by state and apply the longest to shared records
• Document patient location at every telehealth encounter
• Confirm DEA registration and state prescribing authority align for each location
• Review management agreements for clinical control and fee-splitting exposure
• Establish a reporting workflow for adverse events and complaints
• Track administrative code changes in each state of operation

The reporting obligations deserve particular attention. Healthcare facilities must report certain adverse events and practitioner conduct to state boards, and failing to report can itself become a violation independent of the underlying incident.

Conclusion

The compliance landscape for Texas providers keeps shifting, and the cost of missing a change is measured in licenses, not fines. Brewster Law Firm, PLLC works with healthcare practice owners on exactly this problem: healthcare compliance and regulations, strategic entity formation, and corporate contracting that holds up under scrutiny. Book a consultation to review your structure before a regulator does it for you.