Avoiding the Fines: Texas HB300 Penalty Tiers for Negligence and Intentional PHI Violations

Texas HB 300 strengthened the state’s medical privacy law by establishing graduated civil penalty tiers for violations involving protected health information (PHI). Under Texas Health & Safety Code § 181.201, penalties escalate from negligent violations to knowing or intentional violations, and further to intentional violations committed for financial gain, with an additional annual cap for patterns or practices.

For small clinics, these tiers matter because the same incident can be evaluated very differently depending on training records, policies, vendor controls, and how quickly and thoroughly the clinic responds. This article explains the penalty tiers, the factors courts consider when setting penalties, and a practical, low-cost compliance framework that helps small practices keep violations in the lowest possible band.

Small practices often assume that meaningful financial penalties are reserved for large health systems. HB 300 makes clear that clinic size does not shield providers from state enforcement. Routine workflows, appointment reminders, identity verification, record disclosures, or vendor messaging, can become enforcement matters when they involve PHI and appear negligent or worse.

Texas Health & Safety Code Chapter 181 creates incentives to do two things consistently:

1. Prevent privacy errors through role-based training, minimum-necessary disclosures, and secure channels.

2. Document diligence so that, if an incident occurs, the record reflects reasonable safeguards and timely corrective action.

Understanding how violations are categorized under § 181.201 allows clinics to design operations that both prevent incidents and mitigate penalties when something goes wrong.

Understanding the Penalty Structure Under Texas Health & Safety Code § 181.201

Section 181.201 authorizes the Texas Attorney General to seek injunctive relief and civil penalties for violations of Chapter 181. Subsections (b) and (c) establish the penalty tiers and annual caps.

Statutory penalty tiers

Under Texas Health & Safety Code § 181.201(b)–(c), penalties may be assessed as follows:

• Negligent violations:
   Up to $5,000 per violation per year.

• Knowing or intentional violations:
   Up to $25,000 per violation per year.

• Intentional violations for financial gain:
   Up to $250,000 per violation per year.

• Pattern or practice of violations:
   An annual cap of up to $1.5 million when violations constitute a pattern or practice.

The same underlying facts can fall into different tiers depending on intent, repetition, and documentation.

Negligent violations

These involve unintentional failures, such as releasing more information than necessary or skipping identity verification. Clinics with documented training, written procedures, and credible corrective actions are better positioned to remain in this tier and argue for mitigation.

Knowing or intentional violations

These arise when staff knew or reasonably should have known the conduct violated privacy requirements, such as continuing to use unsecured email after being instructed otherwise. Absence of training records or vendor controls makes this classification more likely.

Intentional violations for financial gain

This tier applies when PHI is intentionally used for profit, such as selling PHI lists or exploiting PHI for marketing without authorization. Strong access controls, rapid offboarding, and clear workforce rules are the primary safeguards.

Pattern or practice

Repeated low-level violations that are never corrected can accumulate into a pattern or practice finding. Regular reviews, documented fixes, and monitoring prevent sporadic errors from becoming systemic.

When determining penalty amounts, courts may consider:

• Seriousness of the violation

• History of compliance

• Risk or harm to individuals

• Deterrence needs

• Whether the clinic held relevant certifications

• Corrective actions taken

For small practices, this means that documentation matters. Training logs, encryption evidence, vendor agreements, incident logs, and corrective action trackers directly influence how the same facts are judged.

The HHS Office for Civil Rights (OCR) enforces HIPAA’s Privacy, Security, and Breach Notification Rules. Texas HB 300 is enforced by state authorities, including the Attorney General. A single event can therefore trigger dual exposure, federal and state.

Clinics that treat HIPAA as the baseline and overlay Texas-specific requirements where stricter can demonstrate good faith to both federal and state reviewers.

1. Publish a “Texas controls when stricter” policy

How to comply: State that HIPAA is the baseline and Texas Chapter 181 controls when more stringent.
 Evidence: Signed policy, training agenda, staff attestations.
 Low-cost: Add a Texas section to the HIPAA manual.

2. Implement role-based training with six-year retention

How to comply: Train new hires on verification, minimum necessary, secure messaging, and incident reporting.
 Evidence: Role curricula, attendance logs, signed completion statements.
 Low-cost: Short micro-sessions during staff huddles.

3. Standardize identity verification and disclosures

How to comply: Use laminated scripts and a disclosure log with a minimum-necessary checkbox.
 Evidence: Scripts, completed logs, spot-check notes.
 Low-cost: One laminated card per workstation.

4. Encrypt and secure delivery by default

How to comply: Enable encryption and secure portals; capture acknowledgment for unencrypted delivery if requested.
 Evidence: Screenshots of settings, delivery logs.
 Low-cost: Native device encryption and EHR portals.

5. Govern vendors that touch PHI

How to comply: Maintain a vendor register and agreements requiring encryption and incident notice.
 Evidence: Executed agreements, annual confirmations.
 Low-cost: One-page annual vendor questionnaire.

6. Operate a documented incident-response playbook

How to comply: Define reporting, triage, assessment, notification, and closure steps.
 Evidence: Incident log, assessment notes, corrective action tracker.
 Low-cost: One-page flowchart and two tabletop drills per year.

7. Track near-misses and key metrics

How to comply: Log near-misses and monitor training timeliness, offboarding speed, and incident triage time.
 Evidence: KPI sheet and review notes.
 Low-cost: Spreadsheet with color-coded due dates.

Case Study

A small Texas clinic used a texting platform for appointment reminders that included visit reasons. Staff occasionally bypassed the secure platform and sent reminders via standard email. After a complaint, the clinic paused messaging, performed a risk assessment, retrained staff with signed attestations, updated vendor contracts, enabled encryption, and implemented a 48-hour escalation rule.

When state authorities inquired, the clinic produced training rosters, encryption screenshots, updated agreements, and a corrective action log. The absence of financial gain and the strength of remediation helped avoid higher penalty tiers and a pattern-or-practice finding.

Common Pitfalls to Avoid

• Treating training as a one-time event

• Allowing vendors to operate on default settings

• Skipping encryption or secure delivery

• Failing to document corrective actions

• Ignoring repeat low-level lapses

Each pitfall increases the likelihood of escalation to higher penalty tiers.

• One-binder evidence model

• Minimum-necessary by design

• Secure defaults with documented exceptions

• Short tabletop drills with immediate fixes

• Rapid offboarding and quarterly access reviews

Texas HB 300’s penalty tiers make intent, frequency, and documentation decisive. Small clinics that publish a clear Texas overlay policy, run role-based training with signatures, secure PHI by default, govern vendors, and document corrective actions can prevent most violations and substantially mitigate penalties if enforcement occurs.

Maintaining compliance is an ongoing process. By adopting a regulatory solution, your practice can track obligations in real time, complete risk assessments with confidence, and stay audit-ready, demonstrating proactive risk management and reinforcing trust with payers and patients.

• Texas Health and Safety Code § 181.201 – Injunctive Relief; Civil Penalty

• Texas Health and Safety Code § 181.202 – Disciplinary Action

• Health and Safety Code Chapter 181 – Medical Records Privacy (Full Chapter)

• 82(R) HB 300 – Engrossed Bill Analysis (Texas Legislature Online)

• 82(R) HB 300 – Engrossed Fiscal Note (Legislative Budget Board)