ultimate-guide
Texas Medical Practice Cybersecurity and Data Protection Guide
Last Updated: October 30, 2026
Quick Summary
A medical practice cybersecurity program is the set of policies, safeguards, and training that protects patient information from unauthorized access. Texas practices must meet federal HIPAA Privacy and Security Rules first, then state requirements layered on top, starting with a documented risk analysis.
- The HIPAA Security Rule requires a documented risk analysis, and a one-time review does not satisfy it.
- Any outside company handling PHI on your behalf needs a signed business associate agreement before access begins.
- Under the HIPAA Breach Notification Rule, an impermissible disclosure is presumed a breach unless low probability of compromise is shown.
- Texas Business and Commerce Code Chapter 521 imposes separate breach notification duties that run alongside federal requirements.
- Most incidents start with a phishing email or misdirected fax, so annual staff training is a key control.
Table of Contents
- Texas Medical Practice Cybersecurity: The Legal Framework You Must Meet
- Conducting a Healthcare Cybersecurity Risk Assessment
- Administrative, Physical, and Technical Safeguards for Patient Data
- Telehealth Data Security Best Practices for Texas Practices
- Securing Medical Devices, EHR Systems, and Vendor Relationships
- Medical Practice Cybersecurity Checklist and Staff Training
- Building a Healthcare Data Breach Response Plan Under Texas Law
- Booking Your Practice Compliance Review With Brewster Law Firm
- Frequently Asked Questions
Texas Medical Practice Cybersecurity: The Legal Framework You Must Meet
Every Texas medical practice that stores patient information already operates under a dense web of federal and state privacy law.
A medical practice cybersecurity program is the set of policies, safeguards, and training that protects patient information from unauthorized access. The legal obligations come from federal law first, then layer state requirements on top. Knowing both is what keeps a practice out of trouble.
How HIPAA Privacy and Security Rules Apply to Your Practice
The HIPAA Privacy Rule governs how protected health information (PHI) may be used and disclosed, while the HIPAA Security Rule sets standards for protecting electronic protected health information (ePHI).
The Security Rule requires administrative, physical, and technical safeguards, and it demands a documented risk analysis. A one-time review does not satisfy this requirement. The analysis must be accurate and updated as systems change.
What Texas HB 300 Adds to Federal Requirements
Texas state privacy law layers onto HIPAA rather than replacing it, so a practice must satisfy both. Confirm the current requirements directly with the Texas Legislature's official text before relying on any specific obligation.
Conducting a Healthcare Cybersecurity Risk Assessment
A risk assessment is the starting point for everything else.
Begin by inventorying every system that touches patient data: the EHR, billing software, email, cloud storage, mobile devices, and medical equipment with network connections.
Write the results down. Regulators and courts look for documented, repeated analysis, not good intentions. The written record also gives you a baseline to measure improvement against.
Administrative, Physical, and Technical Safeguards for Patient Data
The Security Rule organizes its requirements into three categories, and each needs attention.
- Administrative safeguards: designated security officer, written policies, workforce access rules, and a sanctions policy for violations.
- Physical safeguards: locked server rooms, workstation placement away from public view, and controlled disposal of paper and hardware.
- Technical safeguards: unique user logins, automatic logoff, encryption of ePHI in transit and at rest, and audit logs that show who accessed what.
A common mistake is treating technical controls as a substitute for policy. A locked-down server means little if no one has written down who is authorized to request access to it.
Telehealth Data Security Best Practices for Texas Practices
Telehealth expanded the number of places patient data travels. Video platforms, patient portals, and remote staff logins all create new entry points. When selecting telehealth platforms, consider whether the vendor will sign a business associate agreement, and consider enforcing multi-factor authentication for accounts that access patient information.
Securing Medical Devices, EHR Systems, and Vendor Relationships
Connected medical devices and EHR systems often run on software the practice cannot easily update, and vendors sit inside nearly every workflow that touches PHI. Both need a program, not a one-time check.
Medical device and EHR inventory
Start with a written inventory that captures, for every network-connected device and system: the manufacturer, model, operating system and version, the vendor's patch cadence, whether the device stores or transmits ePHI, and the name of the internal owner. Devices that no longer receive security patches should be isolated on a separate network segment (a VLAN) with restricted outbound traffic, and the practice should document the compensating controls in the risk analysis.
Business associate agreements: who needs one and what it must say
Any outside company that creates, receives, maintains, or transmits PHI on your behalf is a business associate and needs a signed business associate agreement (BAA). That includes cloud hosting, billing and coding services, IT managed service providers, EHR vendors, transcription services, shredding vendors, and patient-communication platforms. A BAA must, at minimum, describe the permitted uses and disclosures, require appropriate safeguards, require the BA to report breaches and security incidents to the covered entity, require the BA to ensure any subcontractors agree to the same restrictions, and address return or destruction of PHI at termination.
Vendor due diligence before you sign
Before onboarding a vendor that will touch PHI, ask for and review: a current SOC 2 Type II report or equivalent independent assessment, a written description of encryption in transit and at rest, its incident response and breach-notification commitments (including a notification window measured in hours, not weeks), its subcontractor list, and its cyber insurance certificate. For smaller vendors that cannot produce a SOC 2, a written security questionnaire plus contractual security obligations can substitute, but document the decision.
Ongoing third-party monitoring
Due diligence is not a one-time event. Build a vendor register that records each vendor's PHI role, contract and BAA expiration dates, last security review date, and the internal owner. Review the register at least annually and whenever a vendor's scope changes. Require vendors to notify you of material security incidents and subcontractor changes, and confirm that BAAs flow down to subcontractors.
Medical Practice Cybersecurity Checklist and Staff Training
Use this checklist as a working document, reviewed at least once a year:
- Current written risk analysis on file
- Designated privacy and security officers named in writing
- Multi-factor authentication enabled on email and EHR accounts
Training matters as much as technology. Most incidents start with a phishing email or a misdirected fax, not a sophisticated attack. Staff who understand why a suspicious link is dangerous are the most effective control your practice has.
Building a Healthcare Data Breach Response Plan Under Texas Law
A written breach response plan is the difference between a contained incident and a regulatory pileup. For a deeper look at the notification duties involved, see managing telehealth data breach notifications in Texas. Texas practices face two overlapping notification regimes, the federal HIPAA Breach Notification Rule and the Texas breach notification statute (Texas Business and Commerce Code Chapter 521), and the plan has to satisfy both without missing a deadline.
The first 24 hours: contain, document, convene
When a breach is suspected, the plan should trigger a fixed sequence rather than a debate:
- Contain. Disable compromised accounts, isolate affected devices from the network, and preserve logs before anyone wipes a machine. Do not power down a suspected ransomware host, memory state and encryption artifacts are evidence.
- Document. Open a written incident log with timestamps, who discovered the issue, systems affected, and every action taken. This log becomes the backbone of both the risk assessment and any regulator inquiry.
- Convene the response team. Name a single incident lead (often the designated security officer), a clinical operations lead, and outside counsel. The plan should list after-hours contact numbers for each, plus your cyber insurer's claims line.
The four-factor risk assessment that decides whether it is a "breach"
Under the HIPAA Breach Notification Rule, an impermissible use or disclosure of unsecured PHI is presumed to be a breach unless the practice demonstrates a low probability that the information was compromised. That demonstration rests on four factors: the nature and extent of the PHI involved (including identifiers and likelihood of re-identification), the unauthorized person who accessed or received it, whether the PHI was actually acquired or viewed, and the extent to which the risk has been mitigated.
Federal notification deadlines and recipients
Federal notification duties apply to individuals, HHS, the media (for larger breaches) and business associates. Confirm the current deadlines and thresholds with HHS guidance before relying on them.
Texas notification duties
Texas Business and Commerce Code Chapter 521 imposes breach notification duties on persons who conduct business in Texas and own or license computerized data containing sensitive personal information. Confirm the current notification timing, recipients and thresholds directly in the statute before relying on them. Map both statutes into a single notification matrix in the plan. For concrete post-incident actions, see legal steps after a telehealth data breach.
Do not let a vendor's investigation delay your clock. Under both regimes, the practice's notification duty is generally measured from its own discovery, not from when a vendor finishes its forensics. Build contractual language requiring the vendor to notify you within a set number of hours.
What the plan should contain
The written plan should include: the incident lead and backup, a contact tree, a system isolation checklist, the four-factor assessment worksheet, a notification matrix mapping each scenario to recipients and deadlines, template letters for individuals and HHS, a media-notification decision rule, and a post-incident review process that feeds back into the risk analysis. Test the plan at least annually with a tabletop exercise, a phishing scenario and a lost laptop scenario cover most of the realistic failure modes.
The breach response plan turns into a sequence with named owners and two notification tracks, summarized below.
| Stage | What to do | Timing or detail |
|---|---|---|
| Contain | Disable compromised accounts and isolate affected devices | Preserve logs before wiping any machine |
| Document | Open a written incident log | Timestamps, systems affected, every action taken |
| Convene | Name an incident lead, clinical lead and outside counsel | Include after-hours contacts and cyber insurer's claims line |
| Assess | Complete the four-factor risk assessment | Presumed breach unless low probability shown |
| Notify | Map federal and Texas duties into one matrix | Measured from the practice's own discovery |
| Test | Run a tabletop exercise | At least annually; phishing and lost laptop scenarios |
Booking Your Practice Compliance Review With Brewster Law Firm
Cybersecurity and privacy compliance are not one-time projects. If you are unsure where your practice stands, a compliance review is the most direct way to find out. Brewster Law Firm, PLLC works with Texas healthcare providers on healthcare compliance matters, and a practice planning to open or restructure can also review starting a healthcare practice in Texas.
Frequently Asked Questions
What cybersecurity requirements apply to medical practices in Texas?
Texas medical practices must meet the federal HIPAA Privacy Rule and Security Rule, which require administrative, physical, and technical safeguards for electronic protected health information. Texas HB 300 adds state-level obligations, including workforce training on handling patient information. Practices should map both sets of requirements against their current policies, document a risk analysis, and confirm the current text of each rule with HHS and the Texas Legislature before relying on it.
How can a medical practice protect patient data during telehealth visits?
Use a telehealth platform that signs a business associate agreement, encrypts audio and video, and requires strong authentication for providers and patients. Limit access to visit records, avoid personal devices where possible, and document who can join each session. Telehealth data security best practices also include updating software promptly and training staff on how to verify a patient's identity before sharing information.
What should a Texas medical practice include in a cybersecurity risk assessment?
A healthcare cybersecurity risk assessment should inventory every system that stores or transmits electronic protected health information, including EHR software, email, billing platforms, medical devices, and cloud services. It should identify threats and vulnerabilities for each, rate the likelihood and impact of harm, and record the controls in place. The output should be a prioritized risk management plan with owners and deadlines, reviewed at least annually and after any significant system change.
What steps should a medical practice take after a healthcare data breach?
Contain the incident, preserve logs, and bring in counsel and your IT provider quickly. Determine what protected health information was involved and whether it was unsecured. Under HIPAA, notify affected individuals without unreasonable delay and within 60 days of discovery, and report to HHS as required. Confirm the notification obligations that apply under Texas law, and document every step of your response for regulators.
How should medical practices train staff to protect patient information?
Train all workforce members at hire and periodically thereafter, covering password hygiene, phishing recognition, proper handling of patient records, and how to report suspected incidents. Document each training session, who attended, and the content covered. Texas HB 300 includes workforce training requirements, so confirm the current statutory language before setting your program's scope.
How can a medical practice secure electronic health records and connected devices?
Inventory every connected device, including imaging equipment, infusion pumps, and network printers, and confirm each one is covered by your risk analysis. Apply vendor security patches on a defined schedule, change default credentials, segment medical devices onto their own network where feasible, and enforce role-based access to the EHR with audit logging enabled.
What privacy and security policies should a Texas medical practice have?
At minimum, a practice should maintain a HIPAA privacy policy, a security policy covering access controls and encryption, a sanctions policy for violations, an incident response procedure, and a records retention and disposal policy. Each should be reviewed regularly, approved by leadership, and reflected in staff training. A healthcare attorney can help align these policies with both federal and Texas requirements.
