Governance, risk & compliance
Texas state requirements by sector (privacy, health, public) Statutes read 23 Oct 2026
Texas state requirements by sector, in one framework with seven tiers.
General privacy and breach: the Identity Theft Enforcement and Protection Act (Bus. & Com.
Code ch. 521: reasonable procedures and record destruction, notice to individuals no later than 60 days after determining a breach, and notice to the Attorney General within 30 days when 250 or more Texans are affected), biometric identifiers (ch.
503), social security numbers (ch. 501), and the cybersecurity program safe harbour against exemplary damages for businesses with fewer than 250 employees (ch.
542, from 1 September 2025). Health: the Medical Records Privacy Act (Health & Safety Code ch.
181, HB 300), whose “covered entity” reaches any person who handles protected health information, with training within 90 days of hire, a signed training statement kept six years, an electronic record within 15 business days, no sale of protected health information, and a separate authorization for each electronic disclosure; plus ch. 183 (SB 1188) on electronic health records kept in the United States and disclosure of diagnostic AI.
Insurance: Insurance Code chs. 601 and 602 and the Texas Department of Insurance bulletin on reporting cybersecurity incidents.
Banking and finance: Department of Banking incident notice rules for state banks, trust companies and money services businesses (7 TAC 3. 24, 17.
5 and 33. 30).
Motor vehicle records: Transportation Code ch. 730.
Public sector: the Texas Cyber Command chapter (Gov’t Code ch. 2063: annual training, incident notice to the Command within 48 hours, security plans, and state authorization of cloud vendors, known as TX-RAMP), public sector AI rules (Gov’t Code ch.
2054, SB 1964), the Public Information Act (ch. 552), and Texas confidentiality rules for benefits, unemployment and criminal history information.
The consumer privacy act (TDPSA) and the AI act (TRAIGA) are separate frameworks. This framework covers Texas law only; HIPAA, GLBA, CJIS and IRS 1075 have their own frameworks.
Some items could not be confirmed from the official text and are listed in the header of the SQL file (administrative rule wording, the TX-RAMP administrator, and whether Texas has an insurance-specific data security statute). General information, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses Texas state requirements by sector (privacy, health, public) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| General privacy and breach | Any business that holds Texans’ sensitive personal information: Bus. & Com. Code ch. 521 (protect and destroy records, s. 521.052; breach notice, s. 521.053; penalties, s. 521.151), biometric identifiers (ch. 503), social security numbers (ch. 501), and the ch. 542 safe harbour for businesses with fewer than 250 employees. Start here. | — |
| Health information | Health care providers, plans, and anyone who handles protected health information for them, including MSPs and software vendors: the Medical Records Privacy Act (Health & Safety Code ch. 181) and electronic health record rules (ch. 183). “Covered entity” is wider than under HIPAA (s. 181.001(b)(2)). Employers and insurance covered entities are only partly exempt (s. 181.051). | — |
| Insurance | Insurers, HMOs and agents holding a Texas Department of Insurance authorization (Insurance Code chs. 601 and 602), and their service providers: GLBA privacy duties, authorization before disclosing nonpublic personal health information, and the Department’s bulletin on reporting cybersecurity incidents. Chapter 602 does not apply to an entity bound by the federal HIPAA privacy standards (s. 602.002). | — |
| Banking and finance | State-chartered banks, state trust companies, and money transmission or currency exchange licensees: Texas Department of Banking cybersecurity incident notice rules (7 TAC 3.24, 17.5 and 33.30) and the customer breach notice in Bus. & Com. Code s. 521.053, which financial institutions still follow. GLBA safeguards sit in other frameworks. | — |
| Motor vehicle records | Anyone who receives, uses or resells personal information from Texas driver licence, vehicle registration or title records, and the vendors that hold it: Transportation Code ch. 730, including permitted uses, five-year redisclosure records, bulk-access contract terms and a 48-hour breach notice to the agency. | — |
| Public sector security | State agencies, local governments, higher education and the vendors that serve them: Texas Cyber Command rules (Gov’t Code ch. 2063), cloud vendor authorization (TX-RAMP), public sector AI duties (ch. 2054), information security standards (1 TAC ch. 477, formerly ch. 202) and the Public Information Act (ch. 552). | — |
| Programs and justice data | Agencies and contractors handling public assistance, Medicaid and other benefit programs, unemployment insurance and criminal history information, where Texas adds its own confidentiality rules to federal pass-through programs: Human Resources Code s. 12.003, Labor Code ss. 301.081 and 301.085, and Gov’t Code ss. 411.083-411.085. Federal rules (IRS 1075, CJIS, NIST 800-53) are in their own frameworks. | — |
How Lavawall® helps you get to Texas state requirements by sector (privacy, health, public) compliance
Most of Texas state requirements by sector (privacy, health, public) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Texas state requirements by sector (privacy, health, public), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against Texas state requirements by sector (privacy, health, public) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports Texas state requirements by sector (privacy, health, public) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- Texas state requirements by sector (privacy, health, public) Statutes read 23 Oct 2026
- Category
- Privacy
- Region
- USA - Texas
- Levels
- 7 assessment tiers
All Texas, United States frameworks and training →
Map this framework freeTalk to our team