Published Nov 10, 2026

Does HIPAA require data to be stored in the US? No, but Texas now does

HIPAA has no US‑only rule, but Texas SB 1188 has required US storage of EHRs since Jan 1, 2026. An IT checklist for backups, cloud regions and vendors.

Dale Calvin

Founder & CEO

The short answer: HIPAA doesn't require patient data to stay in the US. Texas does. Since January 1, 2026, Texas SB 1188 has required electronic health records to be physically stored in the United States or a US territory, including copies held by cloud and other outside vendors. As of November 2026, no state agency has issued rules or guidance on it, so the statute itself is the only text to work from.

Most compliance conversations about SB 1188 stop at the EHR: the vendor says its data centers are in the US, and the box gets checked. The records the law covers rarely live in one place. They're also in backups, imaging archives, email, fax inboxes, billing tools and the laptops of people who support them. This guide covers what the law says, how it differs from HIPAA, and where to look for copies of your patient data that may not be in the US.

HIPAA vs. Texas SB 1188

	HIPAA	Texas SB 1188 (Health & Safety Code ch. 183)
Where patient data can be stored	Anywhere, including outside the US, with a business associate agreement and a risk analysis	Only in the United States or a US territory, from January 1, 2026
Copies held by cloud and other outside vendors	Covered through the business associate agreement	Covered expressly: records stored by a "third‑party or subcontracted computing facility" or a cloud provider
Who it applies to	HIPAA covered entities and their business associates	Texas's broader definition: providers, practitioners, business associates, IT and "computer management" firms and anyone else who handles the records
Access from outside the US	Allowed, assessed in the risk analysis	Not expressly banned; access is limited to people who need it for treatment, payment or operations
Enforcement	HHS Office for Civil Rights	Texas Attorney General, plus the state licensing agencies

HHS has said so directly. Asked whether a covered entity can use a cloud provider that stores health data on servers outside the United States, its guidance answers: "Yes, provided the covered entity (or business associate) enters into a business associate agreement (BAA) with the CSP and otherwise complies with the applicable requirements of the HIPAA Rules." The same guidance notes that offshore storage "may increase the risks," which belongs in the risk analysis, not in a ban.

The proposed update to the HIPAA Security Rule, published in January 2025, doesn't change this. It would require an inventory of where your systems and data are, but not a US‑only rule, and it isn't final: the current federal regulatory agenda lists final action for July 2027.

What SB 1188 actually says

The storage rule is one sentence in Section 183.002(a):

A covered entity shall ensure that electronic health records under the control of the entity that contain patient information are physically maintained in the United States or a territory of the United States.

Four details matter for IT:

It reaches vendors' copies. The rule expressly covers records stored by "a third‑party or subcontracted computing facility or an entity that provides cloud computing services," and records stored using any technology through which patient information "may be electronically retrieved, accessed, or transmitted." Handing records to a vendor doesn't hand off the duty: the law says the covered entity must ensure it.
It applies to old records too. The law took effect September 1, 2025. The storage rule applies to storage on or after January 1, 2026, "regardless of the date on which the electronic health record was prepared." A 2018 chart in an offshore archive counts.
The US, not Texas. A data center in Virginia or Oregon is fine. Canada is not, which matters because Florida's similar 2023 law allows Canada and some backup products offer it as a region.
Access is limited by role. Section 183.002(b) requires that Texas residents' records be accessible only to people who need them for treatment, payment or health care operations within the scope of their jobs. Section 183.002(c) requires administrative, physical and technical safeguards.

What the law doesn't do is define its key terms. "Electronic health record," "physically maintained" and "under the control of" are undefined, and the agencies that are supposed to adopt rules haven't. Until they do, the safest reading is the plain one: if a copy of patient information exists somewhere, it should be in the US.

Who it covers

SB 1188 borrows the definition of "covered entity" from the Texas Medical Records Privacy Act, which is broader than HIPAA's. It includes anyone who assembles, uses, stores or transmits protected health information, including business associates and "information or computer management" entities, and it adds every licensed practitioner. It excludes only seven long‑term and home care categories, such as nursing facilities and assisted living.

For outpatient care, that means:

Ambulatory surgery centers, office‑based labs and specialty practices in Texas are covered.
MSOs that manage Texas practices and handle their records are very likely covered.
Their vendors (EHR and practice management companies, billing and coding firms, IT providers and cloud hosts) are likely covered in their own right. That doesn't take the obligation off the practice.

Where your patient data actually lives

This is where most of the work is. In a typical Texas surgery center or specialty practice, patient information sits in many places, and the EHR is only one of them. Check each one and write down what you find.

System	What to check	Where to find the answer
EHR and practice management	Hosting country and region, backup and disaster recovery locations, and whether any support or development staff outside the US can access records	The vendor's security or trust page, then a written statement from the vendor
ASC software (scheduling, charting, billing, inventory)	Each module separately; one suite can run on several clouds	The vendor's security overview, module by module
PACS, imaging archives and cardiovascular reporting	Where the archive and its cloud backup sit, and how the vendor connects for remote support	The vendor's support agreement and remote‑access setup
Microsoft 365 (email, OneDrive, SharePoint, Teams)	That your data location is the United States and the tenant isn't Multi‑Geo	Microsoft 365 admin center: Settings > Org settings > Organization profile > Data location
Backups and disaster recovery	The storage region of every backup target, including the MSP's	The backup console's region or storage settings
Cloud servers (Azure, AWS, Google Cloud)	That every resource and backup vault sits in a US region, and nothing replicates elsewhere	The cloud console, plus a policy that blocks non‑US regions
Fax and scanning	Where the eFax service and scan‑to‑email inboxes store documents	The fax vendor's terms; your scanner's destinations
AI scribes and dictation	Where recordings and notes are stored and processed	The vendor's data residency documentation
Billing, coding and clearinghouse	Where staff are located, and whether they can download EOBs, charts or reports	The vendor's contract and staffing model
Patient texting, intake and portals	Each add‑on's hosting and its subcontractors	The vendor's subprocessor list
Laptops and remote access	Whether files sync to devices that travel or sit abroad	Your device management and file sync settings

A few vendors publish clear answers, and they show why the details matter:

eClinicalWorks says its cloud uses "Microsoft Azure data centers located in different regions of the United States," with each client database replicated to a failover site in another region. That covers eCW's own cloud, not self‑hosted or partner‑hosted installations.
HST Pathways, an ASC software vendor, says "We only host data within the United States," and its security page shows how its products are spread across C Spire, AWS, Azure and Google Cloud. One vendor, four hosting providers: that's why the map has to go module by module.
Oracle Health says client data "will be stored and hosted in the same country in which the client is located unless otherwise mutually agreed," and that it "may provide temporary access to the platforms from outside of the country where the applicable platform is hosted." That's US storage with offshore support access, which is exactly the gray area covered below.
Microsoft commits in its Product Terms to storing Exchange, SharePoint, OneDrive and Teams data at rest in the United States for tenants provisioned there. Its Dragon Copilot documentation (formerly Nuance DAX) lists US storage at rest for US customers.
AWS says it will not move or replicate content outside the regions a customer chooses "without your agreement." The region choice is yours, so it's yours to check.
Backblaze asks for a region (US East, US West, EU Central or CA East) when the account is created, and stores data there. An account set up years ago on the Canadian or EU region doesn't meet the Texas rule.

Many other vendors don't publish a data location at all. That doesn't mean their data is offshore; it means you need the answer in writing. Vendor web pages also change, so treat them as a starting point, not as proof. The statements above are as of November 2026.

Offshore billing, coding and IT support

Offshore storage is clearly out. Offshore access is the unsettled part, and it's common: outsourced billing, coding, transcription and help desk teams often work from outside the US.

The law firms that have written on SB 1188 mostly agree on where the line sits:

Viewing may be allowed, keeping isn't. The enacted bill dropped an earlier draft's ban on access from outside the US. Firms including Baker & Hostetler and McDonald Hopkins read the final text as allowing offshore access, as long as no records are stored, copied or cached outside the US.
Not everyone is sure. Hall Render calls the law "ambiguous" on offshore view‑only access, and no agency has addressed it.

If you keep offshore access, set it up so nothing can persist abroad:

Screen‑only access. Offshore staff work in a virtual desktop or remote app that keeps the data on US servers.
No downloads, printing or copying. Block file transfer, clipboard, print‑to‑file and local storage in the remote session.
No database exports. Offshore admins shouldn't be able to run exports or dumps of patient data.
Role‑based access and audit logs, so each person sees only what their job needs and every access is recorded.

An SB 1188 IT checklist

Map every system that holds Texas patient data, module by module, using the table above. Include systems you no longer use but still keep data in.
Get each vendor's answer in writing: hosting country and region, backup and disaster recovery region, subprocessors and their countries, and who outside the US can access records.
Check your own settings: Microsoft 365 data location, cloud regions, backup regions, and any content delivery or caching in front of patient‑facing apps.
Move anything that isn't in the US, starting with backups and archives, which are the copies most likely to have landed in another region.
Amend contracts and business associate agreements to require US‑only storage, covering backups, replicas, caches and logs, with notice before any change of location or subcontractor.
Restrict offshore access to screen‑only sessions with downloads, printing and exports blocked.
Limit access by role to treatment, payment and operations, and keep audit logs on.
Lock down devices: encryption, no local copies of charts or exports, and file sync rules for laptops that travel.
Keep a dated evidence file: the data map, vendor statements, screenshots of region settings and access policies. If the Attorney General asks, this is what you'll hand over.
Repeat it when anything changes: a new vendor, a new module, an acquisition or a new backup provider.

Questions to send your vendors

Copy these into an email to each vendor that stores, backs up or accesses your patient records:

In which country and region are our records stored, including backups, disaster recovery copies and logs?
Do any subcontractors or subprocessors store or process our data? Where are they located?
Can any of your staff or contractors outside the United States access our records? If so, in what roles, and can they download, export or copy them?
Will you confirm in writing, or in our agreement, that our data stays in the United States, and notify us before that changes?
Has your company issued a statement on Texas SB 1188 (Health & Safety Code Chapter 183)?

The rest of SB 1188

The storage rule gets the attention, but the law also sets other requirements for electronic health records:

AI in diagnosis. Practitioners may use AI for diagnostic purposes if they act within their license, review all AI‑created records against Texas Medical Board standards, and disclose the use of AI to patients.
Required fields. EHRs must include a field for biological sex, with limits on amending it, and an option to record communications about a patient's metabolic health and diet.
Prohibited data. Credit scores and voter registration status may not be collected, stored or shared in the EHR.
Minors. Parents or guardians must be able to get immediate, complete access to a minor's record, unless state or federal law or a court order restricts it.

Most of these are configuration questions for your EHR vendor. Ask when their system will support them, if it doesn't already.

Penalties and enforcement

Civil penalties. The Texas Attorney General can sue for up to $5,000 per violation committed negligently, up to $25,000 per violation committed knowingly or intentionally (each counted per year), and up to $250,000 per violation where protected health information was knowingly or intentionally used for financial gain.
Injunctions. The Attorney General can also seek a court order to stop a violation.
Licenses. State regulators must investigate credible allegations, and can suspend or revoke a license after three or more violations of the same kind.
Status. As of November 2026, we found no rules, published agency agreements or enforcement actions under the law. That's no reason to wait: the requirements apply now.

Frequently asked questions

Does HIPAA require data to be stored in the US?

No. HHS guidance says covered entities may use cloud providers that store patient data outside the US, provided there's a business associate agreement and the risks are addressed in the HIPAA risk analysis. State laws can be stricter, and Texas is.

What does Texas SB 1188 require?

It requires covered entities to keep electronic health records that contain patient information physically in the United States or a US territory, including copies held by cloud and other outside vendors. It also limits access by job role, adds AI disclosure rules and requires new EHR fields.

When did the storage requirement take effect?

January 1, 2026, for all records, no matter when they were created. The rest of the law took effect September 1, 2025.

Does SB 1188 apply to backups and cloud providers?

The law expressly covers records stored by third‑party, subcontracted and cloud computing providers. It doesn't mention backups by name, but law firms read it to include backups, replicas and disaster recovery copies, and so should you.

Can offshore billing or IT support staff still access patient records?

Probably, but only if nothing is stored, copied or cached outside the US. The law doesn't expressly ban offshore access, though at least one firm calls it ambiguous. Use screen‑only access with downloads and exports blocked.

Does SB 1188 apply to businesses outside Texas?

Possibly. The law applies to covered entities that hold electronic health records, and law firms read it as reaching the vendors that store or manage records for Texas providers. If you're an out‑of‑state vendor with Texas clients, expect them to ask.

What are the penalties?

Up to $5,000 per negligent violation, $25,000 per knowing or intentional violation, and $250,000 when health information is knowingly used for financial gain, plus possible license action after repeated violations.

This article explains how the law affects IT. It isn't legal advice; for questions about your obligations, talk to your healthcare attorney. If you'd like help mapping where your patient data lives, tell us about your setup.

Sources