What Texas Practices Must Do Before the January 1 EHR Data Deadline

Texas Senate Bill 1188 is the state's new electronic health record (EHR) law, and its one time-sensitive deadline is January 1, 2026: from that date, EHRs that contain patient information must be physically maintained in the United States or a U.S. territory — including the records your cloud platform and third-party vendors hold for you. The law's other parts, covering who on your staff can open a record and how clinicians may use AI, have been in force since September 1, 2025. For a medical, dental, or veterinary group in Dallas–Fort Worth or Houston, almost all of the work is administrative: an audit of where your data lives and what your vendors do with it, not a change to how clinicians practice.

SB 1188 is a different law from Texas's general AI statute, the Texas Responsible Artificial Intelligence Governance Act (TRAIGA, HB 149). TRAIGA governs AI broadly; SB 1188 is specific to electronic health records. This article is only about SB 1188 and what it asks a practice's operations and compliance staff to do. It is general information, not legal advice; confirm your own obligations with health care counsel.

Where your patient records are allowed to live

Starting January 1, 2026, a covered entity must keep EHRs that contain patient information physically stored in the United States or a U.S. territory. Under the enrolled bill, that duty reaches records held by a “third-party or subcontracted computing facility” or “an entity that provides cloud computing services,” and it applies to the storage of a record on or after January 1, 2026, regardless of when the record was created (Texas S.B. 1188, Sec. 183.002). Law firms reading the statute reach the same conclusion: the near-term obligation is data localization, and it covers your vendors, not just your own servers (McDonald Hopkins).

See the administrative workflows Clairvance helps medical, dental, and veterinary groups connect.

One boundary is genuinely unsettled. The statute is written around storage. Whether offshore view-only access — an overseas support or coding team that opens a record kept on U.S. servers — is permitted is ambiguous, and at least one analysis flags it as unclear and suggests blocking the download, copying, or caching of records on non-U.S. devices as a safeguard (Hall Render). Treat that as a question for counsel, not a settled answer.

What the AI rules actually say — and don't

SB 1188 does not ban AI in a practice; it conditions clinical use and requires disclosure. A health care practitioner may use AI for diagnostic purposes — including a recommendation on a diagnosis or course of treatment drawn from the patient's record — if the practitioner is acting within their license, the specific use is not otherwise prohibited by law, and the practitioner reviews all AI-created records consistent with standards set by the Texas Medical Board. The practitioner must also disclose that AI use to the patient (Sec. 183.005). The Texas Medical Board's review standards are not yet spelled out, so the durable administrative step is to keep a named clinician reviewing anything an AI tool writes into the chart, and to add a plain patient-facing disclosure where AI touches diagnosis or treatment.

For the front office, the practical read is narrow: an AI scribe or ambient-documentation tool is not prohibited, but its output is a draft until a licensed person reviews it, and its use has to be disclosed. That is a documentation and consent change, not a reason to switch tools.

Immediate access to a minor's record

A system that stores a minor's EHR must let a parent — or a managing conservator or guardian where applicable — obtain complete and immediate access to that record, except where state or federal law or a court order limits it (Sec. 183.006). In practice this is a patient-portal configuration question: can a verified parent proxy see the whole record now, or does your portal gate parts of it? The law also bars storing a patient's credit score or voter registration status in an EHR (Sec. 183.004).

What happens if a practice gets it wrong

The Texas attorney general can seek injunctive relief and civil penalties, capped per violation per year at $5,000 for a negligent violation, $25,000 for a knowing or intentional one, and $250,000 where protected health information was knowingly or intentionally used for financial gain (Sec. 183.011). A regulatory agency may also discipline an entity that violates the chapter three or more times in the same manner, up to suspending or revoking a license. These are ceilings, not automatic fines, but they make the vendor audit worth finishing before January 1 (penalty tiers confirmed in McDonald Hopkins's reading of the statute).

A data-residency and AI-use audit you can run this quarter

Here is an operating method for turning the law into a short list of owned tasks. This audit is an operating method, not legal advice, and it does not tell you whether any specific arrangement complies — it tells you what to ask and who should own the answer. Work one row per system; the deliverable is a written answer and a named owner for each.

Two things make this finish quickly. First, most answers live in a contract or a business associate agreement (BAA), not in a settings screen — so the owner is usually whoever manages the vendor relationship, not IT alone. Second, the riskiest gaps are the invisible ones: a billing, coding, or transcription partner that quietly routes data or work offshore.

The following example is illustrative. A two-site Houston dental group inventories its vendors and finds its EHR and backups are U.S.-hosted, but its medical-transcription vendor routes dictation to an overseas team that downloads audio and draft notes onto local machines. The storage of those drafts abroad is the exposure. The group's action is not to drop AI or transcription; it is to get written confirmation of U.S.-only storage, or to move the work to a compliant option, and to name who owns the quarterly re-check.

What this does not settle

SB 1188 does not change clinical judgment, and it does not resolve every edge. The storage-versus-access line is unsettled; the Texas Medical Board's AI-review standards are still to come; and “covered entity” borrows the Chapter 181 definition with specific facility exclusions (home and community support, nursing, assisted living, and similar), so a few organizations sit outside it. None of that changes the core administrative work: know where patient data is stored, get U.S.-storage in writing from every vendor that holds it, keep a human reviewing AI-written chart content, and check your minor-access settings.

If you want help turning that audit into a connected, documented workflow — a vendor inventory, where each system's data lives, and who owns the exceptions — see the administrative workflows Clairvance helps medical, dental, and veterinary groups connect, or use the AI vendor evaluation scorecard to structure the vendor questions above.