Behavioral health EHR in Texas: the state rules your software has to handle

The Texas checklist at a glance

Print this and take it to every vendor demo, us included. The middle column is the question; the right column is our answer, from how Cima works today.

Texas rule	Ask the vendor	Cima EHR
EHRs stored physically in the US (HSC ch. 183, since January 1, 2026)	Where do the database, backups and file storage sit? Any offshore support with record access?	Hosted in the US on AWS under AWS's BAA; backups encrypted in US storage. Security details.
AI: review what it drafts and tell clients (HSC ch. 183)	Does the client paperwork include an AI notice? Can a client opt out? Does a signed note show AI helped?	Yes to all three; details below.
Sex at birth, female or male, changed only for set reasons (HSC ch. 183)	Is there a separate sex at birth field? What stops a silent change?	Required on new charts; a change needs a reason and is kept with who and when.
Privacy training within 90 days of hire, signed statement (HSC 181.101)	Can we record each person's training and keep the statement?	Each user signs a training statement in the app; the owner sees who is due.
Copy of electronic records within 15 business days (HSC 181.102)	Does the system count the Texas clock, not HIPAA's 30 days?	Records requests run on the 15-business-day clock, with no extension, and show on Today.
Medicaid claims inside 95 days (1 TAC 354.1003)	Can you send to TMHP and each Medicaid plan I bill? Who is the submitter?	Claims go through our clearinghouse to payers that accept them electronically; search each payer in Cima. No TexMedConnect link.
Commercial claims inside 95 days (Insurance Code 1301.102, 843.337)	Does the claim check warn before the filing limit?	A Texas practice's filing limit starts at 95 days; claims warn 14 days before it and flag it after.
Retention (26 TAC 564.508 for SUD facilities; license rules for individuals)	Does it show when a chart may be destroyed, and honor legal holds?	Keep-until date of 7 years from discharge (age 25 for minors), legal holds; never auto-deletes.
Substance use records (42 CFR Part 2, federal)	Show me a Part 2 release, the notice on a disclosure, and the client's accounting.	Releases with the §2.31 elements, consent checked before records go out, notice attached, accounting printed.

Federal rules still apply on top: our HIPAA checklist for behavioral health covers the rest. For everything else to score in an EHR demo, see how to choose an EHR for an IOP or PHP. An LCDC in private practice has its own record rule, 26 TAC 562.24; the EHR guide for Texas LCDCs maps it item by item.

SB 1188: US storage, AI and sex at birth

SB 1188 (89th Legislature, 2025) added chapter 183 to the Health and Safety Code. Law-firm summaries from Goodwin and Hall Render describe the parts that touch your EHR, and the Texas Medical Association covers the AI disclosure. Civil penalties run from $5,000 to $250,000 per violation depending on intent.

1. Records stored in the US

Electronic health records must be physically maintained in the United States, including by vendors and cloud services, from January 1, 2026. Ask every vendor that holds records: the EHR, its backups, your file storage, your e-fax, your billing company. Cima runs in its own AWS account in the US, under AWS's Business Associate Addendum, with nightly encrypted backups in US storage.

2. AI: the clinician reviews it, and clients are told

A practitioner may use AI for diagnosis or treatment recommendations within their license if they review the records AI helped create and disclose the use to patients. How Cima does it, when the practice turns AI note drafting on (it's off by default):

• The notice goes in the paperwork. New clients' forms include "How We Use AI in Your Care": what AI helps draft, that a licensed clinician reads, corrects and signs everything, that AI never makes a diagnosis or treatment decision, and that they can say no without any change to their care. It's sent only while AI drafting is on.
• The client's choice is kept. "Please don't use AI on my notes," chosen on the form or recorded by staff, is saved with who recorded it and when, and can't be deleted, only replaced by a newer choice. On that chart, every AI drafting button refuses and tells the clinician why.
• The signed note says so. A note AI helped draft carries that mark inside the signed text, so a later edit can't drop it, and the printed note says it was drafted with AI and reviewed and signed by the clinician named.
• Drafts run on AWS's HIPAA-eligible AI service under our BAA; client records aren't used to train models for anyone else.

3. Sex at birth, female or male

The law requires a field for biological sex at birth, female or male, and limits changes to a clerical error or a diagnosed disorder of sex development; it doesn't stop you from recording gender identity separately. In Cima:

• New charts can't be saved without sex at birth (female or male). Charts imported or booked online before anyone asked read "Not recorded yet" until someone asks the client, and a claim won't go out without it.
• Once recorded, a change asks for the reason: a clerical error, or a disorder of sex development with the diagnosis, which has its own field. Every change is kept with the reason, who made it and when.
• Gender, pronouns and a preferred name are separate fields.

HB 300: training and records requests

HB 300 (2011) amended the Texas Medical Records Privacy Act, Health and Safety Code chapter 181, which reaches more organizations than HIPAA's covered entities. Two parts land in your EHR:

Requirement	The rule	In Cima
Training	Each employee trained on state and federal privacy law within 90 days of hire and again after a material change in law, and signs a statement that they completed it (HSC 181.101). The 2024 Part 2 rule was such a change for SUD programs.	My account → Privacy training: the date, the course and a signed statement, kept 6 years. The owner sees each person's status; a due training shows on that person's Today.
Copies of electronic records	A written request for a copy of an electronic health record gets it, in electronic form unless the person agrees otherwise, within 15 business days (HSC 181.102). HIPAA allows 30 days plus an extension; Texas is shorter.	"Client asked for something" on the chart's Privacy tab starts a records request on the 15-business-day clock. Cima won't extend it, shows the days left on Today, and "Send their copy" builds the record. Amendment requests run on HIPAA's 60 days.

Mental health records also fall under Health and Safety Code chapter 611, including when a professional may deny access. Our HIPAA checklist lists the Texas breach-notice deadlines too.

Texas Medicaid: TMHP and the managed care plans

Texas Medicaid runs two ways, and your EHR has to reach whichever one pays for each client:

• Managed care. Many members are in a managed care plan (STAR, STAR+PLUS or STAR Kids, among others), and behavioral health is part of those plans' benefits; the old NorthSTAR carve-out ended in 2017, per the state's 1115 waiver amendment. You enroll with Texas Medicaid, then contract and bill each plan under its own rules. Our guide to the Texas Medicaid health plans lists them.
• Fee-for-service through TMHP. TMHP takes claims through its TexMedConnect portal or by EDI with a submitter ID. Claims are due within 95 days of the date of service under 1 TAC 354.1003.

How Cima handles it. Cima sends claims (837P, or 837I for program per diem days) and eligibility checks through Stedi, its clearinghouse. In Cima, search a payer by name and it shows whether that payer takes electronic eligibility, professional claims, institutional claims and electronic remittances, or needs enrollment first. Check each Medicaid plan you bill before you rely on it, and ask us if one you need isn't there. Cima doesn't connect to TexMedConnect, so a payer that only takes claims there means keying them in TMHP's portal. Getting enrolled in Texas Medicaid comes first; Texas Medicaid enrollment walks through it, and Cima Consulting does the state enrollment and the first managed care plan for $500 per clinician.

Commercial claims and the 95-day rule

For fully insured Texas HMO and PPO plans, a contracted provider generally has 95 days from the date of service to file (Insurance Code 1301.102 for PPOs, 843.337 for HMOs), and the plan then has to pay clean claims on the prompt pay clock. Self-funded employer plans, Medicare and federal plans set their own limits. Cima sets a Texas practice's filing limit to 95 days (other states start at 90), warns on a claim 14 days before it, and flags anything past it with what to do. Our timely filing limits by payer and Texas prompt pay law guides go deeper.

Retention and Part 2

Retention. A licensed chemical dependency treatment facility keeps records at least 6 years, and adolescents' at least 5 years after age 18, with a log of destroyed records (26 TAC 564.508). Counselors, social workers, psychologists and physicians each have their own board rules; our Texas records retention guide has a table by license. Cima's Privacy tab shows each discharged chart's keep-until date, 7 years from discharge or age 25 for a minor, whichever is later, which is longer than the facility minimum. A legal hold stops a chart from ever reading as destroyable, and Cima never deletes a chart on its own. When you leave, the owner exports every chart, and records stay readable and exportable for at least 90 days after cancelling.

Part 2. Texas SUD programs that are federally assisted follow 42 CFR Part 2. Cima writes releases with the elements of §2.31 for the client to sign on their phone, checks the consent before any records go out, attaches the Part 2 notice, records every disclosure and prints the client's accounting. The Part 2 guide explains the 2024 changes.

If you're a licensed facility

An outpatient, IOP or PHP program licensed by HHSC under 26 TAC chapter 564 has more to show a surveyor than a private practice: assessments and plans on time, a QCC's co-sign on intern work, group sizes, telehealth details per session, and original records kept in Texas. Our 26 TAC 564 guide lists each rule. In Cima's Program plan:

• Levels of care (PHP, IOP, OP) with each level's day and week hours and per diem code; hours counted from signed group notes; one per diem charge per day that meets its hours.
• Due dates for the biopsychosocial assessment, the treatment plan and plan reviews, in calendar days you set (counting calendar days is never later than a service-day rule); the defaults are 3, 5 and every 30 days.
• Notes by a counselor intern wait for a licensed co-signer; a telehealth note can't be signed without the client's consent, identity check and location for that session.
• Continued-stay reviews prompted 5 days before an authorization's last day, with ASAM dimensions 1 to 6. More on Cima for IOP and PHP.

The licensing itself, from the application to the HHSC inspection, is what Cima Consulting's IOP / PHP Program Launch does for $39,500, including six months of Cima EHR.

What Cima doesn't do yet

• No TexMedConnect connection; payers reachable only through TMHP's portal are keyed there.
• No detox, residential or sober living levels, and no medication administration record.
• E-prescribing isn't live yet, and lab orders aren't live yet.
• No Columbia suicide screen (C-SSRS) built in; PHQ-9 and GAD-7 are, with an alert on the self-harm item.
• No built-in video; you bring a HIPAA-ready video service.
• The Program plan covers up to 25 clients in the program; talk to us first if you're bigger.
• The BAA, Terms and Privacy Policy are drafts under attorney review.

Questions

Does Texas require EHR data to be stored in the US?

Yes. Under SB 1188, which added Health and Safety Code chapter 183, electronic health records must be physically maintained in the United States from January 1, 2026, including records held by vendors and cloud services. Ask each vendor in writing where your data and backups sit.

Do I have to tell clients I use AI for notes in Texas?

Under chapter 183, a practitioner who uses AI for diagnosis or treatment recommendations must review what it produced and disclose the use to patients. If you use an AI scribe or note drafter, put a plain notice in your intake paperwork and keep each client's choice. Cima does both when AI drafting is turned on.

What is HB 300 and does it apply to a small practice?

HB 300 (2011) expanded the Texas Medical Records Privacy Act, Health and Safety Code chapter 181. It applies broadly, including to many organizations that aren't HIPAA covered entities, and requires privacy training within 90 days of hire with a signed statement, and copies of electronic records within 15 business days of a written request.

Can my EHR bill Texas Medicaid?

If it can reach the payer. Members in a managed care plan are billed to that plan; fee-for-service claims go to TMHP by EDI or TexMedConnect. In Cima, search the payer to see whether it accepts claims electronically through our clearinghouse. Enrollment with Texas Medicaid and each plan comes first.

How long do Texas behavioral health records have to be kept?

It depends on the license and setting: licensed SUD facilities at least 6 years (adolescents at least 5 years past 18), with each board setting its own rule for individual clinicians. See how long to keep records in Texas.

Is there a Texas-specific EHR certification?

Not one we know of for behavioral health practices. Texas law sets requirements on how records are kept, stored and shared, which is why this checklist asks vendors to show each one.

Sources

1. Texas Legislature, SB 1188, 89th Legislature, enrolled text (Health and Safety Code chapter 183).
2. Goodwin, "New Texas Law Regulates Use of EHRs and AI Tools," August 2025; Hall Render, "New Texas Law on EHR Data Localization and AI," August 19, 2025; Texas Medical Association, "New Law Requires Texas Physicians to Disclose AI."
3. Texas Health and Safety Code §181.101 (training), §181.102 (electronic records requests) and §611.0045 (mental health records access).
4. 1 TAC §354.1003, Texas Medicaid time limits for submitted claims; TMHP.
5. Texas HHSC, 1115 waiver amendment (NorthSTAR services moving to STAR, STAR+PLUS and STAR Kids).
6. Texas Insurance Code chapter 1301 (§1301.102) and chapter 843 (§843.337).
7. 26 TAC §564.508, client records in licensed chemical dependency treatment facilities.
8. eCFR, 42 CFR Part 2 and §2.31.
9. Cima EHR's handling of each rule: alturaops server/ehr/ai-use.ts, server/solo/practice.ts (sex at birth, filing limit), server/ehr/rights.ts (training, requests, retention), server/solo/releases.ts and clearinghouse.ts.

General information, not legal advice. Laws change; confirm with your attorney and the agency. If something here is out of date, tell us.