TX Healthcare AI Law
Texas Healthcare AI and Electronic Health Record Law - SB 1188
Requires healthcare practitioners using AI for diagnosis to review all AI-generated records and disclose AI use to patients. Mandates EHR data localization (Texas patient data must be physically stored in US). Applies to covered entities and third-party vendors.
Jurisdiction
Texas
Enacted
Jun 20, 2025
Effective
Sep 1, 2025
Enforcement
Texas Medical Board; Texas Health and Human Services Commission
Signed by Governor Abbott on June 20, 2025. Effective September 1, 2025 (AI provisions); January 1, 2026 (data localization).
Texas LegislatureWhy It Matters
First state law requiring patient disclosure of AI use in healthcare. Data localization requirement affects all healthcare AI vendors. High compliance burden.
Recent Developments
Signed June 20, 2025. AI provisions effective Sept 1, 2025. Data localization effective Jan 1, 2026. First state to mandate healthcare AI disclosure and EHR data localization.
At a Glance
Applies to
Harms addressed
Who Must Comply
- Healthcare practitioners in Texas using AI for diagnostics
- Healthcare entities managing EHRs
- Third-party vendors and cloud service providers
- AI healthcare platforms
Safety Provisions
- Practitioners must review all AI-generated medical records
- Must disclose AI use to patients for diagnosis/treatment
- AI use must be within practitioner's scope of license
- EHR data localization (US-only storage for Texas patient data)
- Applies to vendors, cloud providers, subcontractors
Compliance & Enforcement
Key Dates
Jan 1, 2026
EHR data localization requirement takes effect (all Texas patient EHRs must be physically stored in US)
Penalties
$250K; $5K/violation
View on map
Texas
Focus Areas
Cite This
APA
Texas. (2025). Texas Healthcare AI and Electronic Health Record Law - SB 1188.
Related Regulations
TX TRAIGA
Comprehensive AI governance with prohibited uses approach. Bans AI that incites self-harm/suicide, exploits children, or intentionally discriminates. Government entities have additional disclosure requirements. First-in-nation AI regulatory sandbox program.
LA Healthcare AI Act
Regulates use of artificial intelligence by healthcare providers in Louisiana. Permits AI for administrative tasks but prohibits AI from making treatment/diagnosis decisions without licensed professional review, directly interacting with patients on treatment matters, or generating therapeutic recommendations without professional approval.
CA SB 947
Adds Labor Code Part 5.5.5 on employers' use of automated decision systems (ADS). Bars using an ADS to violate labor or civil rights law, to infer an employee's protected status, or to predict and act against workers exercising legal rights; bars relying solely on an ADS for disciplinary or termination decisions and requires human corroboration where an ADS output is the primary basis; and requires a written post-use notice and, on request, a description of the employee's data used. Operative July 1, 2027.
CA SB 503
Requires developers and deployers of AI clinical decision support systems used by health facilities, clinics and physician practices to make reasonable efforts to identify systems with a known or reasonably foreseeable risk of biased impacts on people with protected characteristics. Developers must mitigate those risks and give deployers an intended-use and risk statement plus documentation on training data, evaluation and data governance; deployers must regularly monitor the systems and mitigate.
TX Social Media Deepfake Takedown
Requires social media platforms to provide accessible complaint system for explicit deepfake material. Platform must confirm receipt within 48 hours, investigate within 30 days (60 days if delayed), and provide mandatory updates to reporting user.
CA AB 2246
Repeals and replaces the California Age-Appropriate Design Code Act. Requires a business providing an online service, product or feature likely to be accessed by children to estimate the age of child users with a reasonable level of certainty or extend child protections to all users, to configure high-privacy defaults, and to take reasonable steps to prevent specified harms including severe psychological harm. Removes the exceptions to the data-collection prohibitions, lets children void contracts entered through manipulative design features, and states that it creates no private right of action.
Last updated March 9, 2026. Verify against primary sources before relying on this information.