HIPAA Business Associate Agreements in Texas — Medical Records Privacy Act and BAA Implications

By BAA Generator Research Team  ·  Published Apr 27, 2026  ·  Last reviewed Apr 27, 2026  ·  6 min read

Texas laws affecting BAA terms

What Texas BAAs should add to the HHS model

• Verify whether the CE qualifies as a Texas-covered entity (broader than HIPAA)
• Bind BA to Tex. Health & Safety Code § 181 obligations explicitly
• Align breach-notification timing with Tex. Bus. & Com. Code § 521 if stricter

Operational notes

If your covered entity is based in Texas, every BAA you sign with a vendor handling PHI of your patients should bind that vendor to Texas's state-law obligations in addition to HIPAA. The HHS model BAA satisfies federal requirements but doesn't include state-specific language by default.

If your business associate operates in multiple states, you generally bind the BA to the strictest applicable state's requirements rather than each state separately. Practices in Texas typically reference Texas's rules in the BAA's "compliance with applicable law" clause.

For broader 2024–2026 HIPAA Privacy Rule context, see HIPAA BAA requirements. For state law and HIPAA interaction generally, see ComplyCreate's HIPAA vs state privacy laws guide.