TL;DR

Texas Senate Bill 1188 took effect September 1, 2025, and its U.S. storage rule has applied since January 1, 2026, including to records prepared before then. Covered entities must keep electronic health records physically in the United States, limit who can access them, and meet specific rules when AI is used for diagnosis and when the records belong to a minor. The section on what the law requires tracks the statute. Everything after it is a recommendation.

Texas SB 1188: Where Your Patient Records Live Is Now a Legal Question

If you run a Texas practice, build health tech, or sell cloud or AI tools to healthcare organizations, can you say where your patients' electronic health records physically sit right now?

Texas Senate Bill 1188 made that a compliance question. The law took effect September 1, 2025, and its U.S. storage rule has applied since January 1, 2026, including to records prepared before then.¹

The "What the law requires" section below tracks the statute. Everything after it is my recommendation.

Vendors, this includes you

SB 1188 borrows its "covered entity" definition from the Texas Medical Records Privacy Act, which reaches business associates, information or computer management entities, and anyone who comes into possession of protected health information.² Depending on what you do with patient data, you may be a covered entity yourself. Even if you aren't, your architecture decides whether your customer can comply.

What the law requires

(a) U.S. storage. Covered entities must ensure that EHRs under their control containing patient information are physically maintained in the United States or a U.S. territory. That includes records stored by a third-party or subcontracted computing facility or a cloud services provider, and records stored using any technology through which patient information can be electronically retrieved, accessed, or transmitted.³

(b) Access and safeguards. Access to Texas residents' EHR information, other than open data, must be limited to individuals who need it to perform duties within the scope of their employment related to treatment, payment, or health care operations. Covered entities must also implement reasonable and appropriate administrative, physical, and technical safeguards.⁴

(c) AI in diagnosis. A practitioner may use AI for diagnostic purposes if they act within the scope of their Texas license or other authorization, the use isn't otherwise restricted or prohibited by state or federal law, and they review all records created with AI consistent with Texas Medical Board standards. They must also disclose that use to their patients.⁵

(d) Minors' records. Each EHR system used for minors' records must allow a parent, or where applicable a managing conservator or guardian, to obtain complete and unrestricted access immediately, unless law or a court order restricts it.⁶

The law has other EHR provisions too, including one directing state agencies to ensure that EHR decision assistance tools used for treatment decisions include the patient's recorded biological sex.⁷ If you build clinical decision support, read that one.

"U.S. hosting" is a starting point

A vendor's U.S.-hosting representation may cover only some parts of the environment. Your data may travel further. Be able to answer these:

(a) Where do production, backup, archive, and disaster-recovery environments physically sit?

(b) Which subprocessors and downstream vendors (transcription, analytics, imaging, messaging, AI tools) receive or store EHR data, and can any of them copy it outside the United States?

(c) Does the contract commit to U.S. physical maintenance, with notice before hosting or subcontractor changes?

(d) Who can access the data, and can you show it?

(e) How does each AI vendor handle prompts, model-improvement programs, and outputs derived from patient records?

The storage rule speaks to where EHRs are physically maintained.³ It doesn't directly address remote access, and some will read that as a gap. Before anyone gets excited, look back at item (b) above. The same section limits who gets access and requires safeguards.⁴ And "we're HIPAA compliant" answers a different question.

AI: the label doesn't matter

Whether a vendor calls a tool "assistive," "ambient," or "generative" is marketing. Calling it assistive in the sales deck doesn't change what it does in the exam room.

A tool that summarizes a chart to suggest a care path, flags likely diagnoses, or recommends treatment may never announce a final diagnosis. Depending on how the practitioner relies on it, it may still fall within the diagnostic-purpose rule. One more nuance: the statute's requirement to review "all records created with artificial intelligence" appears as a condition on that diagnostic use.⁸ My read is that it stays tied to diagnostic use and stops short of reaching every AI-generated item in your organization. The statute doesn't say that expressly, though, so how far it reaches in your specific workflow is worth a real legal answer.

The stakes

The Attorney General can seek injunctions and civil penalties of up to $5,000 per negligent violation, $25,000 per knowing or intentional violation, and $250,000 per violation involving knowing or intentional use of protected health information for financial gain. For the first two tiers, a violation that continues through a year counts once for that year. Three or more violations can also lead to agency discipline, up to license suspension or revocation.⁹

A 30-day plan

1. Inventory. List every platform that stores, receives, transmits, or backs up EHRs subject to the storage rule.
2. Map storage. Confirm where each environment physically sits, vendors included.
3. Check access. Confirm access matches the employment-duties standard in item (b).
4. Review contracts. Check BAAs, MSAs, DPAs, and cloud terms for location, access, audit, and change-notice commitments.
5. Classify AI. Identify which AI uses fall within the diagnostic-purpose rule.
6. Build workflows. Decide how patients get told and how practitioners review AI-created records.
7. Test minor access. Confirm your systems provide immediate access while honoring legal restrictions.
8. Document it. Keep a compliance file with data maps, vendor attestations, contract terms, and AI policies.

Where this leaves you

SB 1188 took questions that used to live with IT and procurement and made them legal ones. If you can answer them with documents, you're working from a solid foundation. If some of those answers currently live in a vendor's sales deck, that's where to start.

This post is general information and isn't legal advice for your specific situation.

Sources

¹ Tex. S.B. 1188, 89th Leg., R.S., §§ 2(b), 4 (2025). https://capitol.texas.gov/tlodocs/89R/billtext/html/SB01188F.htm

² Tex. Health & Safety Code § 183.001(2) (added by Tex. S.B. 1188, 89th Leg., R.S., § 1 (2025)) (incorporating § 181.001). https://capitol.texas.gov/tlodocs/89R/billtext/html/SB01188F.htm; Tex. Health & Safety Code § 181.001(b)(2). https://codes.findlaw.com/tx/health-and-safety-code/health-safety-sect-181-001/

³ Tex. Health & Safety Code § 183.002(a) (added by Tex. S.B. 1188, 89th Leg., R.S., § 1 (2025)). https://capitol.texas.gov/tlodocs/89R/billtext/html/SB01188F.htm

⁴ Tex. Health & Safety Code § 183.002(b), (c) (added by Tex. S.B. 1188, 89th Leg., R.S., § 1 (2025)). https://capitol.texas.gov/tlodocs/89R/billtext/html/SB01188F.htm

⁵ Tex. Health & Safety Code § 183.005(a), (b) (added by Tex. S.B. 1188, 89th Leg., R.S., § 1 (2025)). https://capitol.texas.gov/tlodocs/89R/billtext/html/SB01188F.htm

⁶ Tex. Health & Safety Code § 183.006(b) (added by Tex. S.B. 1188, 89th Leg., R.S., § 1 (2025)). https://capitol.texas.gov/tlodocs/89R/billtext/html/SB01188F.htm

⁷ Tex. Health & Safety Code § 183.007(a)(2) (added by Tex. S.B. 1188, 89th Leg., R.S., § 1 (2025)). https://capitol.texas.gov/tlodocs/89R/billtext/html/SB01188F.htm

⁸ Tex. Health & Safety Code § 183.005(a)(3) (added by Tex. S.B. 1188, 89th Leg., R.S., § 1 (2025)). https://capitol.texas.gov/tlodocs/89R/billtext/html/SB01188F.htm

⁹ Tex. Health & Safety Code §§ 183.010, 183.011 (added by Tex. S.B. 1188, 89th Leg., R.S., § 1 (2025)). https://capitol.texas.gov/tlodocs/89R/billtext/html/SB01188F.htm