3300, Confidentiality

Body

Revision 25-3; Effective Nov. 14, 2025

All grantees must comply with the U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA)  established standards for protection of privacy.

A PHC provider must maintain all health care information as confidential to the extent required by law.

Grantees are required by HIPAA to develop and distribute a notice that provides a clear explanation of privacy rights and practices. This Notice of Privacy Practices must be given to clients at the first appointment, upon request, and at a minimum, every three years. The notice must also be posted in a clear and easy-to-find location for clients to review. It must be included on the organization’s website.

Grantees must ensure that all employees and volunteers receive training about client confidentiality during orientation and be made aware that violation of privacy laws may result in civil damages and criminal penalties. A health care provider’s staff, both paid and unpaid, must be informed during orientation of the importance of keeping client information confidential. Grantees must maintain a written confidentiality policy that requires staff to be informed during orientation of the importance of keeping client information confidential. All employees, volunteers, subrecipients, board members, and advisory board members must sign a confidentiality statement during orientation.

Grantees must monitor client records to make sure only appropriate staff and HHSC may access the records. A grantee must document a client’s preferred language and method of communication, including phone, email, or text, in the client’s record. Each client must receive verbal assurance of confidentiality, an explanation of what confidentiality means, and any applicable exceptions, such as abuse reporting. Grantees are required to provide clients with a copy of their confidentiality policy or agreement. Clients must sign this policy or agreement, and the grantee must maintain a signed copy in client's record.

A health care provider may not require consent for services from the spouse of a married client.

Additional information on confidentiality and required postings are available here:

3310 Minors and Confidentiality

Revision 23-2; Effective Sept. 15, 2023

Except as permitted by law, a provider is legally required to maintain the confidentiality of care provided to a minor. Confidential care does not apply when the law requires parental notification or consent, or when the law requires the provider to report health information such as in the cases of contagious disease or abuse. The definition of privacy is the ability of the individual to maintain information in a protected way. Confidentiality in health care is the obligation of the health care provider not to disclose protected information. While confidentiality is implicit in maintaining a patient's privacy, confidentiality between provider and patient is not an absolute right.

The HIPAA privacy rule requires a covered entity to treat a “personal representative” the same as the individual with respect to use and disclosure of the individual’s protected health information. In most cases, parents are the personal representatives for their minor children, and they can exercise individual rights, such as access to medical records, on behalf of their minor children (45 Code of Federal Regulations Section 164.502(g)).

For more information, see Adolescent Health – A Guide for Providers.

3320 Civil Rights

Revision 25-1; Effective Jan. 28, 2025

Per grantee contracts with HHSC, grantees must comply with state and federal anti-discrimination laws.

Find more information about nondiscrimination laws and regulations on the HHSC Civil Rights Office page.

3330 Required Signage

Revision 25-3; Effective Nov. 14, 2025

Grantees that provide direct services to clients must display certain HHS posters about civil rights. The posters must be displayed where clients and the public can easily see them, such as lobbies, waiting rooms, front reception desks, and locations where people apply for and receive HHS services. The following posters are required:

  • Americans with Disabilities Act
  • Know Your Rights – Clients and Applicants
  • Need a Sign Language Interpreter?
  • Need an Interpreter?

Grantees must display signage about human trafficking and suicide prevention, including the 988 Suicide and Crisis Lifeline. Signage must be displayed where clients and the public can easily view them, such as lobbies, waiting rooms, front reception desks, and locations where people apply for and receive services.

Examples of suitable flyers are available here:

Additional mental health and suicide prevention resources are available here:

3340 Termination of Services

Revision 25-3; Effective Nov. 14, 2025

A grantee must never deny services to an eligible client due to an inability to pay.

Grantees have the right to terminate services to a client if:

  • the client is disruptive, unruly, threatening or uncooperative to the extent that the client seriously impairs the grantee’s ability to effectively and safely provide services; or
  • the client’s behavior jeopardizes their own safety, or the safety of clinic staff or others.  

A termination of services must be included in the grantee’s policy manual.

If a grantee denies, modifies, suspends, or terminates services to a client, an explanation must be documented in the client’s record. A client has the right to appeal the denial, modification, suspension or termination of services by following the Resolution of Complaints process. More information is available in the PHC rules under Section 364.17, Appeals.

3350 Resolution of Complaints

Revision 25-3; Effective Nov. 14, 2025

Grantees must ensure clients can express concerns about care received and further ensure those concerns are handled in a consistent manner. Grantees’ policy and procedure manuals must explain the process clients may follow if they are not satisfied with the care received.

1. Grantees must investigate and resolve a complaint or concern within 30 days, beginning on the day they are notified by the aggrieved client.

2. Clients may contact the grantee during and after the resolution of an investigation to receive more information on the grantee's decision or to help correct the issue.

3. Grantees must provide the client with contact information to the HHS Office of the Ombudsman. If a client has requested more help from the Ombudsman, a grantee must not terminate services to that client until a final decision is rendered by HHSC, unless there is a viable risk to the safety of the aggrieved client, clinic staff, or others.

4. All complaints and concerns must be documented in the client's record.

3360 Research (Human Subject Clearance)

Revision 25-3; Effective Nov. 14, 2025

Grantees considering clinical or sociological research using PHC Program funded clients as subjects must get prior approval from their own internal Institutional Review Board (IRB) and HHSC.

The grantee must have a policy in place showing that prior approval will be obtained from the HHSC PHC program, as well as the IRB, before instituting any research activities. The grantee must also ensure that all staff are made aware of this policy through staff training. Documentation of training on this topic must be maintained.