Texas HB300 training online for certificate proof that still needs compliance context

Texas HB 300 is a real state law, not just a label for HIPAA training

House Bill 300 passed the Texas Legislature in 2011 and took effect on September 1, 2012. It amended the Texas Medical Records Privacy Act, which is codified in Chapter 181 of the Texas Health and Safety Code. The bill was the state response to the federal HITECH Act, and it raised the Texas privacy bar above the federal HIPAA floor in several specific ways. When someone searches for Texas HB300 training online or Texas HB 300 certification, they are usually trying to confirm that a course covers these state additions and not only the federal rules. A generic HIPAA course that never names Chapter 181 leaves that question unanswered, which is the gap this page is meant to close.

The most practical thing to understand about HB 300 is that it does not replace HIPAA. It runs alongside it. A Texas organization that handles protected health information has to satisfy the federal Privacy Rule, Security Rule, and Breach Notification Rule, and then layer the Texas requirements on top. HIPAA sets the national floor, and Texas builds above it. Training that teaches only one side leaves a real compliance hole, and employers in the state know it.

Texas defines a covered entity far more broadly than federal HIPAA

Federal HIPAA applies to covered entities, meaning health plans, healthcare clearinghouses, and most healthcare providers, plus their business associates. Texas casts a much wider net. Under Section 181.001 of the Health and Safety Code, a covered entity includes any person who comes into possession of protected health information, who obtains or stores that information, or who engages in assembling, collecting, analyzing, using, evaluating, storing, or transmitting it. The definition also reaches the employees, agents, and contractors of those people when they create, receive, maintain, use, or transmit protected health information in Texas.

That definition pulls in organizations that would not be covered entities or business associates under federal law. A Texas company that handles health information as part of its operations can fall under Chapter 181 even if it never signs a business associate agreement. This is the single most overlooked point in Texas HB 300 training, and it is the reason employers in software, billing, staffing, marketing, and information technology so often ask their staff to complete it. If your role touches health information connected to Texas, the state definition may apply to you regardless of your job title, so mapping who actually handles the data matters more than the label on the org chart.

The 90-day training deadline is written into the statute

Most HIPAA training is driven by a general duty to train the workforce. Texas is more specific. Section 181.101 of the Health and Safety Code requires a covered entity to provide a training program to employees about state and federal law concerning protected health information. The training has to be tailored to each employee's scope of work. New employees must complete it within 90 days of hire. If a material change in state or federal law affects an employee's duties, the covered entity must provide updated training within a reasonable period, and no later than the first anniversary of the date the change takes effect.

The statute does not stop at delivery. The covered entity must require each employee to sign a statement, electronically or in writing, verifying that the employee attended the training, and it must keep that signed statement on file. Many Texas employers run this as an annual refresh even though the law frames it around new hires and material changes, because a yearly cadence is the simplest way to keep signed records current and defensible. This is exactly why searchers want certificate proof. The certificate and the completion record are the evidence that the Section 181.101 obligation was met for a specific person on a specific date.

HB 300 added duties that go well beyond training

Training is only one piece of HB 300. Section 181.102 requires a covered entity that uses an electronic health record system to provide a requested electronic copy of a patient's record within 15 business days of a written request, a tighter window than the federal default. Section 181.154 generally requires notice and authorization before a covered entity electronically discloses protected health information, with carve-outs for treatment, payment, healthcare operations, and other listed purposes. Section 181.153 restricts the sale of protected health information, and Section 181.152 limits certain marketing uses. A Texas worker who understands these duties handles records requests and electronic disclosures very differently from one trained only on the federal baseline.

Enforcement has teeth. Under Section 181.201, the Texas Attorney General can seek civil penalties for violations, and the amounts scale with intent: up to 5,000 dollars per violation in a year for negligent conduct, up to 25,000 dollars per violation in a year for knowing or intentional conduct, and up to 250,000 dollars per violation when protected health information is used for financial gain. Licensing boards can also take disciplinary action against regulated professionals, and the state can seek injunctive relief. Training that mentions only federal penalties skips the Texas enforcement layer that an organization actually answers to inside the state.

Who actually needs Texas HB 300 training

Because the Texas definition is so broad, the people who need this training reach past the clinic. Front-desk staff, nurses, medical assistants, and billing teams need it because they touch protected health information every shift. So do the business associates and vendors that federal HIPAA recognizes, such as billing companies, practice-management software providers, and IT firms. HB 300 then adds a third group: Texas businesses that handle health information without being classic healthcare providers, including health-technology startups, analytics and marketing firms working with patient data, transcription services, and staffing agencies that place workers into healthcare settings. If any of those describe your organization, the safest read is that Chapter 181 expects your workforce to be trained.

What a Texas HB 300 certificate proves, and what it does not

There is no government-issued Texas HB 300 certification. Neither the state nor the federal government licenses individuals as compliant, the same way the Department of Health and Human Services issues no official HIPAA certificate. What a credible certificate does is document that a named person completed training covering both the federal HIPAA rules and the Chapter 181 additions on a specific date, and that the completion can be retrieved and verified later. For an individual learner, that record answers an employer, school, or contract requirement. For an employer, it is the signed-attendance evidence that Section 181.101 expects.

What the certificate does not do is make an organization compliant on its own. A Texas covered entity still needs written policies, a current risk analysis under the Security Rule, access controls, business associate agreements with vendors that handle protected health information, breach and incident procedures, and a workable way to honor the 15-business-day electronic records request. The certificate is the training proof inside that program, not a substitute for the program. Use it to clear the workforce-training requirement first, then keep the rest of the Texas privacy record documented and easy to retrieve when an employer, client, or the Attorney General asks for it.