A person is subject to administrative actions or sanctions if the person:
  (1) engages in any negligent or abusive practice that results in death, injury, or substantial probability of death or injury to a recipient;
  (2) fails to provide an item or service to a recipient in accordance with accepted medical community standards or standards required by statute, regulation, or contract, including statutes and standards that govern occupations;
  (3) furnishes or orders services or items for a recipient under the Medicaid or other HHS program that substantially exceed a recipient's needs, are not medically necessary, are not provided economically or are of a quality that fails to meet professionally recognized standards of health care;
  (4) is the subject of a voluntary or involuntary action taken by a licensing or certification agency or board, which action is based upon the agency or board's receipt of evidence of noncompliance with licensing or certification requirements;
  (5) has its license to provide health care revoked, suspended, or probated by any state's licensing or certification authority, or surrenders a license or certification while a formal disciplinary proceeding is pending before any state's licensing or certification authority;
  (6) fails to abide by applicable statutes and standards governing providers;
  (7) fails to comply with the security, privacy, marketing, disclosure, notification, business associate and breach requirements of HIPAA and regulations promulgated under HIPAA or the Texas Medical Records Privacy Act in chapter 181 of the Texas Health and Safety Code and regulations promulgated under that Act;
  (8) fails to timely provide notice of electronic disclosure to a recipient for whom the person creates or receives protected health information that is subject to electronic disclosure;
  (9) electronically discloses or permits the electronic disclosure of a recipient's protected health information to any person without a separate, documented authorization from the recipient or the recipient's legally authorized representative for each disclosure, unless the disclosure is:
    (A) to a covered entity as defined by §181.001 of the Texas Health and Safety Code or to a covered entity as that term is defined by §602.001 of the Texas Insurance Code for the purpose of:
      (i) treatment;
      (ii) payment;
      (iii) health care operations; or
      (iv) performing an insurance or health maintenance organization function as described by §602.053 of the Texas Insurance Code; or
    (B) as otherwise authorized by state or federal law;
  (10) employs any treatment modality that has been declared unsafe or ineffective by the Food and Drug Administration, CMS, the Public Health Service, or other state or federal agency with regulatory authority; or
  (11) fails to comply with eligibility or meaningful use or other standards of the Health Information Technology for Economic and Clinical Health Act incentive programs and regulations promulgated under the Act.

Source Note: The provisions of this §371.1659 adopted to be effective October 14, 2012, 37 TexReg 7989; amended to be effective April 15, 2014, 39 TexReg 2833; amended to be effective May 1, 2016, 41 TexReg 2941