Texas health-record storage and AI disclosure

Who it applies to

Health care practitioners and other covered entities in Texas that create or maintain electronic health records, and the vendors that host those records for them. Two Texas laws are relevant and are often confused: Senate Bill 1188, which deals with electronic health records and practitioners' use of AI, and House Bill 149, the Texas Responsible Artificial Intelligence Governance Act, which regulates AI systems more broadly.

What it requires, in plain terms

Senate Bill 1188:

• Storage in the United States. Electronic health records of Texas patients must be physically stored in the United States or a US territory, including records maintained by a third-party vendor or cloud provider, whenever the data was created.
• AI for diagnosis. A practitioner may use AI for diagnostic purposes within the scope of their licence, provided they review AI-generated records in line with Texas Medical Board standards, and disclose the use of AI to patients.
• Other record provisions. Requirements on parents' access to minors' records and on what information may be collected in the record.

House Bill 149 (TRAIGA) adds general obligations for AI systems in Texas, including disclosure to patients when AI is used in their health care services.

Key dates

As of November 2026:

What it means for your systems

• Every copy of patient data needs a known location: the primary record, backups, search indexes built from it, logs that contain it, and any vendor's support access. A system that sends record content to a model hosted outside the United States would fall foul of the storage rule.
• Where AI helps with diagnosis-related records, the review step and the patient disclosure should be built into the workflow and recorded.
• Administrative work such as prior authorizations and denials is not diagnosis, but keeping it inside the same environment avoids having two sets of rules for one record.

Official sources

• Texas Legislature: SB 1188 bill analysis (PDF) (opens in a new tab)
• Hall Render: new Texas law on EHR data localisation and AI (opens in a new tab)
• Becker's Hospital Review: Texas regulates EHRs and AI use in care (opens in a new tab)

This guide explains the law in general terms and is not legal advice.

How this connects to our work

Private AI infrastructure keeps models, indexes and logs in a US region of your own cloud account or on your own servers, with outbound traffic allow-listed so record content cannot reach an outside model by accident. See also Healthcare.