Short answer: Mostly not for benefit plan work. Chapter 181 does not apply to an employee benefit plan or anyone acting in connection with one, and it exempts employers, insurers and licensed insurance agents from everything except its prohibited-acts subchapter.
Texas’s chapter 181 defines “covered entity” far more broadly than HIPAA: almost anyone who collects, uses, stores or comes into possession of protected health information. For those entities it requires, among other things, privacy training for employees within 90 days of hire, retraining within a year of a material change in law, and a signed statement of completion kept for six years.
But two exemptions take most benefits work out of it:
- the chapter does not apply to an employee benefit plan, or to any person acting in connection with an employee benefit plan;
- except for its prohibited-acts subchapter (no re-identifying people, rules on marketing, no selling PHI, notice and authorization for electronic disclosure), it does not apply to employers or to Insurance Code covered entities, which include insurers, HMOs and licensed insurance agents.
Separately, Insurance Code chapter 602 requires insurers and agents that are not required to follow the HIPAA privacy standards to get a signed authorization before disclosing nonpublic personal health information, with exceptions such as underwriting, policy placement and policyholder services. Violations of chapter 181 can bring civil penalties of up to $5,000 per violation (negligent), $25,000 (knowing) or $250,000 (for financial gain), and up to $1.5 million per year for a pattern or practice.