Revision 26-2; Effective Sept. 1, 2026

All grantees must comply with the U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA) standards for protection of privacy.

A PHC provider must maintain all health care information as confidential to the extent required by law.

Grantees are required by HIPPA to develop and distribute a notice that provides a clear explanation of privacy rights and practices. 

This Notice of Privacy Practices must be given to clients:

• at the first appointment,
• upon request,
• at least every three years. 

Grantees must post this notice in a clear and easy to find location for clients to review. It must be included on the organization’s website.

Grantees must make sure all employees and volunteers receive training on client confidentiality during orientation. Grantees also must make all employees and volunteers aware that violation of the law about confidentiality may result in civil damages and criminal penalties. All employees, volunteers, subrecipients, board members and advisory board members must sign a confidentiality statement during orientation.

Grantees must monitor client records to make sure only appropriate staff and HHSC may access the records.

Grantees must document the client’s preferred method of communication, such as cell phone, email, work phone or text, and preferred language in the client’s record.

Each client must receive verbal assurance of confidentiality, an explanation of what confidentiality means, and any applicable exceptions, such as abuse reporting. Grantees must also provide clients with a copy of their confidentiality policy or agreement. Clients must sign this policy or agreement, and the grantee must maintain a signed copy in the client's record.

More information on confidentiality and required postings is available on these HHSC and U.S. Department of Health and Human Services (HHS) webpages:

• HIPAA and Privacy Laws – HHSC
• Notice of Privacy Practices for Protected Health Information – HHS.gov
• Your Rights Under HIPAA – HHS.gov for information for individuals
• HIPAA Guidance Materials – HHS.gov for information for providers 

3310 Minors and Confidentiality

Revision 26-2; Effective Sept. 1, 2026

Except as permitted by law, providers are legally required to maintain the confidentiality of care provided to minors. Confidential care does not apply when the law requires parental notification or consent, or when the law requires the provider to report health information, such as cases of contagious disease or abuse. Privacy refers to a person’s ability to control access to their personal information. Confidentiality in health care is the obligation of the health care provider to refrain from disclosing protected health information. While confidentiality is inherent in maintaining a patient's privacy, it is not an absolute right.

The HIPAA Privacy Rule requires covered entities to treat a personal representative the same as the person about the use and disclosure of that person’s protected health information. In most cases, parents serve as the personal representatives of their minor children. Parents may exercise personal rights, such as access to medical records, on behalf of their minor children. Review 45 Code of Federal Regulations Section 164.502(g).

For more information, review the Adolescent Health – A Guide for Providers webpage.

3320 Civil Rights

Revision 26-2; Effective Sept. 1, 2026

HHSC contracts require grantees to comply with state and federal antidiscrimination laws. This includes state rules in Texas Administrative Code (TAC) Title 1, Part 15, Chapter 395, Subchapter B, Rule 395.11.

More information about nondiscrimination laws and regulations is on the HHSC Civil Rights Office webpage and the Requirements for Contractors webpage.

Grant Terms and Conditions

To ensure compliance with nondiscrimination laws, regulations and policies, grantees must:

• sign a written assurance to comply with applicable federal and state nondiscrimination laws and regulations;
• have a written policy that states the agency does not discriminate based on:
  • race
  • color
  • national origin including limited English proficiency (LEP)
  • sex
  • age
  • religion
  • disability
• have a policy that addresses client rights and responsibilities that is applicable to all people who request services;
• have procedures to notify the HHSC Civil Rights Office of any program- or service-related discrimination allegation or complaint no more than 10 calendar days after the allegation or complaint;
• make sure all grantee staff are trained in the grantee's nondiscrimination policies;
• notify everyone who applies for services of the grantee's nondiscrimination policies and complaint procedures; and
• prominently display Civil Rights Posters in English and Spanish as applicable in common areas, including lobbies and waiting rooms, the front reception desk and locations where people apply for services.

More information about nondiscrimination laws and regulations is on the HHSC Civil Rights Office webpage.

Limited English Proficiency – LEP

To comply with civil rights requirements related to LEP, grantees must:

• take reasonable steps to make sure people with LEP have meaningful access to its programs and services;
• not require a person with LEP to use friends or family members as interpreters:
  • a family member or friend may serve as a person’s interpreter if the person requests it; and
  • the family member or friend does not compromise the effectiveness of the service or violate client confidentiality; and
• make sure people with language service needs, including people with LEP and disabilities, are aware that the grantee will provide an interpreter free of charge. 

3330 Required Signage

Revision 26-2; Effective Sept. 1, 2026

Grantees that provide direct services to clients must display certain HHS posters about civil rights. The posters must be displayed where clients and the public can easily see them, such as lobbies, waiting rooms, front reception desks, and locations where people apply for and receive HHS services. The following posters are required:

• Americans with Disabilities Act (English PDF)
• Americans with Disabilities Act (Spanish PDF)
• Know Your Rights - Clients and Applicants (English PDF)
• Know Your Rights - Clients and Applicants (Spanish PDF)
• Need a Sign Language Interpreter? (PDF)
• Need an Interpreter? (PDF)

Grantees must display signs about human trafficking and suicide prevention, including the 988 Suicide and Crisis Lifeline. Signs must be displayed where clients and the public can easily view them, such as lobbies, waiting rooms, front reception desks, and locations where people apply for and receive services.

Examples of suitable flyers are available here:

• Human Trafficking Signage, English and Spanish – OAG
• 988 Suicide & Crisis Lifeline Poster, English – SAMHSA
• 988 Suicide & Crisis Lifeline Poster, Spanish – SAMHSA
• Suicide Warning Signs for Youth Poster – SAMHSA
• Texting 988 Poster 1, Spanish – SAMHSA
• Texting 988 Poster 2, English – SAMHSA

More mental health and suicide prevention resources are available at:

• Behavioral Health Provider Resources
• Suicide Prevention
• 988 Partner Toolkit – SAMHSA
• Find Resources or a Provider – You're Not Alone | Mental Health Texas

3340 Termination of Services

Revision 26-2; Effective Sept. 1, 2026

Grantees must never deny services to an eligible client because of an inability to pay.

Grantees have the right to terminate services to a client if:

• the client is disruptive, unruly, threatening or uncooperative to the extent that the client seriously impairs the grantee’s ability to effectively and safely provide services; or
• the client’s behavior jeopardizes their own safety, or the safety of clinic staff or others.

A termination of services must be included in the grantee’s policy.

If a grantee denies, modifies, suspends or terminates services to a client, an explanation must be documented in the client’s record. A client has the right to appeal the denial, modification, suspension or termination of services by following the Resolution of Complaints process.

3350 Resolution of Complaints

Revision 26-2; Effective Sept. 1, 2026

Grantees must make sure clients can express concerns about the care they’ve received. Grantees must also make sure any complaints or concerns are handled in a consistent and timely manner. A grantee’s policy and procedure manuals must explain the process clients may follow if they are not satisfied with the care received. This process includes:

• Grantees must investigate and resolve a complaint or concern within 30 business days, beginning on the day they are notified by the aggrieved client.
• Clients may contact the grantee during and after the resolution of an investigation to receive more information on the grantee's decision or to help correct the issue.
• Grantees must provide the client with contact information to the HHS Office of the Ombudsman. If a client has requested more help from the Ombudsman, a grantee must not terminate services to that client until a final decision is rendered by HHSC, unless there is a viable risk to the safety of the aggrieved client, clinic staff or others.
• All complaints and concerns must be documented in the client's record.

3360 Research, Human Subject Clearance

Revision 26-2; Effective Sept. 1, 2026

To participate in proposed research that would involve the use of PHC clients as subjects, the use of PHC client records or any data collected from PHC clients, PHC grantees must get prior approval from their own internal Institutional Review Board (IRB) and from HHSC. For information about the process, grantees should visit the Institutional Review Board website.

The grantee must have a policy in place that shows approval will be obtained from the HHSC PHC program, as well as the IRB, before instituting any research activities. The grantee must also make sure all staff are made aware of this policy through staff training. Documentation of training on this topic must be maintained.