HB 300 training is mandatory for medical couriers in Texas because Texas Health and Safety Code § 181.101 legally requires every covered entity to train employees with access to Protected Health Information, and HB 300 defines a covered entity broadly enough to include medical courier services regardless of their status under federal HIPAA. This requirement exists independently of federal HIPAA training and applies whether a courier works as an employee or an independent contractor.
The Statutory Basis for the Requirement
Texas Health and Safety Code § 181.101 states that a covered entity must provide a training program on state and federal law concerning Protected Health Information to each employee who has access to that information. The statute requires this training to be completed within 90 days of an employee’s hire date and repeated at least once every two years. Because the requirement is written into state law rather than left to company policy, a medical courier operating in Texas cannot treat this training as optional or discretionary.
Why Medical Couriers Fall Within Scope
HB 300 amended the Texas Medical Records Privacy Act to define a covered entity as any individual or organization that assembles, collects, analyzes, uses, evaluates, stores, or transmits Protected Health Information in Texas. This definition reaches further than the federal HIPAA definition of a covered entity or Business Associate, and it applies to a medical courier the moment the courier handles Protected Health Information during pickup, transport, or delivery, regardless of the size of the courier operation.
Why HIPAA Training Alone Does Not Satisfy This Requirement
Federal HIPAA training addresses the Privacy Rule, Security Rule, and Breach Notification Rule under 45 CFR § 164.530(b) and 45 CFR § 164.308(a)(5), but it does not cover the state-specific obligations HB 300 imposes. A medical courier who completes only a general HIPAA course has not met the separate training obligation Texas Health and Safety Code § 181.101 sets out, since that statute is a distinct legal requirement enforced under state law.
Enforcement of HB 300 Training Requirements
Violations of HB 300, including a failure to provide the required training, are enforced by the Texas Attorney General, independently of any action HHS’ Office for Civil Rights may take under federal HIPAA. This means a Texas medical courier that fails to complete HB 300 training faces state regulatory exposure separate from, and in addition to, any exposure under federal HIPAA enforcement.
Meeting the HB 300 Training Requirement
The HIPAA Journal’s Medical Courier Certification in Texas includes a Texas State Medical Privacy and Security Regulations module that addresses HB 300 and the related Texas statutes that apply alongside it, including the Texas Identity Theft Enforcement and Protection Act, the Texas Data Privacy and Security Act, the Texas Responsible AI Governance Act, SB 1188, and the Texas Medical Practice Act. This module is included in a course bundle alongside HIPAA and OSHA training, providing a single certification that satisfies the HB 300 training obligation together with the courier’s other legal training requirements.