HIPAA applies to medical couriers in Texas because a courier that handles Protected Health Information on behalf of a healthcare provider typically qualifies as a HIPAA Business Associate, making the courier subject to the Privacy Rule, Security Rule, and Breach Notification Rule in the same way as any other Business Associate. This obligation exists independently of the courier’s size, whether it operates as an individual contractor or a larger courier company, and applies whenever specimens, records, or other materials containing Protected Health Information are collected, transported, or delivered.
Texas State Law Adds Requirements Beyond HIPAA
HIPAA is the federal baseline, but Texas medical couriers are also subject to state law that extends beyond it. The Texas Medical Records Privacy Act as amended by House Bill 300 defines a covered entity more broadly than federal HIPAA, reaching any individual or organization that assembles, collects, analyzes, uses, evaluates, stores, or transmits Protected Health Information in connection with a business, a definition that includes medical courier services. HB 300 imposes training and compliance obligations enforced separately by the Texas Attorney General, in addition to the obligations HIPAA already imposes.
Several additional Texas statutes apply alongside HB 300 and HIPAA, including the Texas Identity Theft Enforcement and Protection Act, the Texas Data Privacy and Security Act, the Texas Responsible AI Governance Act, SB 1188 concerning artificial intelligence and electronic health records, and the Texas Medical Practice Act. A medical courier trained only on federal HIPAA has not addressed the requirements these additional Texas laws impose.
OSHA Requirements For Medical Couriers
Separate from HIPAA and Texas privacy law, OSHA regulations apply to medical couriers because courier work can involve physical exposure to blood, blood samples, and hazardous chemicals during transport. Bloodborne Pathogens standards apply when couriers handle blood or blood samples, requiring an understanding of Universal Precautions and exposure response. Hazard Communication standards apply when couriers transport chemicals, requiring an understanding of labeling and Safety Data Sheets. Personal Protective Equipment standards govern the selection and proper use of protective gear appropriate to the materials being handled. These OSHA obligations apply regardless of a courier’s HIPAA or Texas privacy law compliance, since they address physical safety rather than information handling.
| Regulation | What It Covers | Regulation |
|---|---|---|
| HIPAA | Sets the rules for how a medical courier may use, disclose, and safeguard Protected Health Information while it is in transit, and what steps to take if that information is exposed. | 45 CFR § 164.530(b); 45 CFR § 164.308(a)(5) |
| HB 300 | Extends Texas privacy protections to any person or business that handles Protected Health Information in the state, and requires that employees with access to that information receive specific training within a set timeframe of being hired. | Texas Health and Safety Code § 181.101 |
| Bloodborne Pathogens (BBP) | Requires instruction on Universal Precautions and exposure response procedures for anyone whose work brings them into contact with blood or blood samples. | 29 CFR § 1910.1030(g)(2) |
| Personal Protective Equipment (PPE) | Requires an employee to be shown when protective gear such as gloves is needed and how to put it on, remove it, and dispose of it correctly before being allowed to perform work that requires it. | 29 CFR § 1910.132(f)(1) |
| Hazard Communication (HazCom) | Requires that anyone transporting or handling chemicals be trained on container labeling, Safety Data Sheets, and how to recognize a chemical hazard before starting the work. | 29 CFR § 1910.1200(h)(1) |
Table: Compliance Regulations for Medical Couriers in Texas
Where This Certification for Medical Couriers in Texas is Provided
The HIPAA Journal’s Medical Courier Certification in Texas includes a Texas State Medical Privacy and Security Regulations module that covers HIPAA, HB 300 and the Texas Medical Records Privacy Act, the Texas Identity Theft Enforcement and Protection Act, the Texas Data Privacy and Security Act, the Texas Responsible AI Governance Act, SB 1188, and the Texas Medical Practice Act. The same course bundle includes separate OSHA modules covering Bloodborne Pathogens, Hazard Communication, and Personal Protective Equipment, giving Texas medical couriers a single certification that addresses federal HIPAA, the full range of applicable Texas privacy statutes, and the OSHA standards that apply to their work.
PJ Murray is the founder and publisher of The HIPAA Journal. He has more than 10 years of experience writing about HIPAA, healthcare compliance, patient privacy, and the protection of medical records. Through The HIPAA Journal, PJ helps healthcare organizations, business associates, and their employees better understand HIPAA regulations, reduce compliance risks, and strengthen the safeguards used to protect patient information.
