Sec. 181.154.  NOTICE AND AUTHORIZATION REQUIRED FOR ELECTRONIC DISCLOSURE OF PROTECTED HEALTH INFORMATION; EXCEPTIONS.  (a) A covered entity shall provide notice to an individual for whom the covered entity creates or receives protected health information if the individual's protected health information is subject to electronic disclosure.  A covered entity may provide general notice by:
(1)  posting a written notice in the covered entity's place of business;
(2)  posting a notice on the covered entity's Internet website; or
(3)  posting a notice in any other place where individuals whose protected health information is subject to electronic disclosure are likely to see the notice.
(b)  Except as provided by Subsection (c), a covered entity may not electronically disclose an individual's protected health information to any person without a separate authorization from the individual or the individual's legally authorized representative for each disclosure.  An authorization for disclosure under this subsection may be made in written or electronic form or in oral form if it is documented in writing by the covered entity.
(c)  The authorization for electronic disclosure of protected health information described by Subsection (b) is not required if the disclosure is made:
(1)  to another covered entity, as that term is defined by Section 181.001, or to a covered entity, as that term is defined by Section 602.001, Insurance Code, for the purpose of:
(A)  treatment;
(B)  payment;
(C)  health care operations; or
(D)  performing an insurance or health maintenance organization function described by Section 602.053, Insurance Code; or
(2)  as otherwise authorized or required by state or federal law.
(d)  The attorney general shall adopt a standard authorization form for use in complying with this section.  The form must comply with the Health Insurance Portability and Accountability Act and Privacy Standards and this chapter.
(e)  This section does not apply to a covered entity, as defined by Section 602.001, Insurance Code, if that entity is not a covered entity as defined by 45 C.F.R. Section 160.103.
Added by Acts 2011, 82nd Leg., R.S., Ch. 1126 (H.B. 300), Sec. 7, eff. September 1, 2012.