Texas enacts new health privacy law.

• Position: PRIVACY

[ILLUSTRATION OMITTED]

After an embarrassing data breach that exposed the personal information of more than 3.5 million Texans on a public government server for more than one year, Gov. Rick Perry has signed into law an expansive new health privacy bill.

The law's requirements exceed those of the federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, legal experts say. The law, which becomes effective Sept. 1, 2012, includes a broad definition of the term "covered entity" in Texas' existing health privacy law and may affect many non-HIPAA-covered entities.

Under the Texas law, "covered entity" includes any organization that engages in "assembling, collecting, analyzing, using, evaluating, storing, or transmitting protected health information," as well as any entity that "comes into possession of" or "obtains or stores" protected health information (PHI). The new law also: I Requires employees of covered entities to undergo training on HIPAA and Texas' health privacy law within 60 days of hiring (and at least once every two years)

* Bans the disclosure of PHI for remuneration, but covered...