Texas AI Healthcare Laws for Therapists: How SB 1188 and TRAIGA Affect Your Documentation in 2026

Texas is the second-largest therapy market in the United States by practitioner count. It is also, as of 2026, one of the most regulated states in the country for AI use in clinical settings. If you are a licensed therapist practicing in Texas, you now operate under two separate state AI laws on top of your existing federal obligations. These laws are not theoretical. They have effective dates, civil penalty ranges, and requirements specific enough to affect your documentation workflow today.

This guide explains both laws, how they interact with each other, and what you need to do if you are currently using or considering an AI documentation tool. It is not a substitute for legal advice from a licensed Texas attorney, but it will give you a working understanding of what the law actually requires.

The Two Laws: A Quick Orientation

Texas enacted two distinct AI governance laws that apply to healthcare practitioners, including therapists. They address different aspects of AI use, have different effective dates, and come from different policy concerns. Understanding each one separately before looking at how they interact will save you confusion.

Texas SB 1188 (Senate Bill 1188) took effect September 1, 2025. It focuses on AI used for diagnostic or treatment recommendation purposes, and it establishes specific requirements for how healthcare practitioners must handle AI-generated records. It also includes a data localization rule prohibiting the physical offshoring of electronic medical records.

Texas HB 149 (House Bill 149), commonly called TRAIGA (the Texas Responsible AI Governance Act), took effect January 1, 2026. It addresses patient disclosure: when AI is used in a patient's care, the patient must be told, clearly and conspicuously, that AI is involved.

These laws are not the same law. SB 1188 governs what you do with AI-generated records. TRAIGA governs what you disclose to the patient. Both apply to Texas therapists who use AI documentation tools, and both carry civil penalties for non-compliance.

SB 1188: What It Requires for AI-Generated Records

The core obligation under SB 1188 is a mandatory clinician review requirement. Any healthcare practitioner who uses AI for diagnostic or treatment recommendation purposes must review all AI-generated records in a manner consistent with medical records standards before those records enter the clinical file.

In practice, this means:

• You cannot use an AI tool that auto-inserts notes into your records without your review.
• You must actively read, verify, and approve each AI-generated note before it is finalized.
• The review standard is consistent with existing medical records standards, meaning the same level of accuracy and completeness you would be held to for any clinical record applies to AI-generated ones.

For most therapists this review obligation is already part of their workflow. If you type a session summary, the AI structures it into a DAP or SOAP note, and you read it before signing, you have already completed the SB 1188 review step. The law formalizes what good clinical practice already required.

The Data Localization Rule

SB 1188 also prohibits the physical offshoring of electronic medical records. This is a separate requirement from the review obligation, and it applies to any cloud-based vendor or service provider you use for documentation storage.

In plain terms: if a vendor stores your Texas clients' records on servers located outside the United States, that vendor may not comply with SB 1188. Before using any AI documentation tool for Texas client records, you should confirm that the vendor uses US-based cloud hosting.

This is a question worth asking directly: "Where are client records physically stored?" Vendors that use major US-based cloud infrastructure (AWS US regions, Google Cloud US regions, Azure US regions) generally satisfy this requirement. Vendors that route data through servers in other countries may not.

Civil Penalties Under SB 1188

The civil penalty range for SB 1188 violations is $5,000 to $250,000 per violation. The higher end of that range applies when patient health information was used for financial gain without proper authorization. For documentation errors, you are more likely to be looking at the lower end, but "lower end" here is still $5,000 per incident. This is not a law to treat as aspirational.

TRAIGA / HB 149: The Patient Disclosure Requirement

TRAIGA's primary obligation is simpler to state: if AI is used in a patient's care, the patient must receive clear and conspicuous disclosure of that fact.

This is a separate legal requirement from anything in SB 1188. It does not require you to explain the technical details of how the AI works. It requires that patients know AI is involved. "Clear and conspicuous" is a standard from consumer law that means the disclosure must be prominent enough that a reasonable person would actually notice and understand it, not buried in a consent form footnote.

For therapists using AI documentation tools, the practical question is: when does AI use in your documentation process rise to the level of AI use "in their care"? The answer is not entirely settled, but the conservative and professionally responsible interpretation is to treat AI-assisted note generation as AI use in clinical care, and disclose accordingly.

What an Adequate TRAIGA Disclosure Looks Like

The law requires disclosure, not consent (though many best practices and ethical codes recommend seeking consent, which goes further). A straightforward disclosure would include:

• A statement that you use an AI tool to assist with structuring clinical documentation
• A brief description of what the AI does: in a generation-based workflow, the AI takes your written summary and formats it into a clinical note; it does not record the session
• An indication of how patient information is handled, without implying HIPAA compliance if your vendor cannot confirm it

You can incorporate this disclosure into your informed consent process at the start of treatment, your intake paperwork, or a standalone AI use notice. The key is that it is readable, prominent, and completed before AI-assisted documentation begins.

How the Two Laws Interact

The laws are complementary but address different obligations. Think of them as two separate compliance gates:

Gate 1 (TRAIGA): Before using AI in your documentation workflow, tell the patient.

Gate 2 (SB 1188): When an AI-generated record exists, review it before it enters the clinical file.

Both gates must be cleared. Disclosing to your client that you use AI (satisfying TRAIGA) does not excuse skipping the review requirement (SB 1188). And thoroughly reviewing every note (satisfying SB 1188) does not excuse failing to inform the client that AI was involved (TRAIGA).

There is a compounding effect when you add HIPAA to the picture. Texas therapists operating under HIPAA still have their federal obligations as the floor. SB 1188 and TRAIGA add state-level requirements on top of that floor.

Why Documentation Tool Architecture Matters for Texas Compliance

Not all AI documentation tools have the same compliance profile under these two laws. The architecture of the tool, specifically whether it uses ambient recording or a post-session generation-based workflow, has practical implications for how much compliance friction Texas therapists face.

Ambient Recording Tools: Three Friction Points

An ambient recording tool works by listening to a session, transcribing the audio in real time or after the session, and generating a note from the transcript. For Texas therapists, this architecture creates three separate compliance considerations:

1. SB 1188 review requirement: Every AI-generated note must be reviewed before it enters the record. This step is required regardless of tool type.

2. TRAIGA disclosure requirement: Patients must be told AI is involved in their care. For ambient tools, this disclosure necessarily includes the fact that the session audio is being processed by an AI system, which is a more sensitive disclosure than saying AI helps structure written notes.

3. Session recording consent: This is separate from TRAIGA and SB 1188. When you record a session, separate consent is appropriate under ethical guidelines and standard of care expectations. In Texas, which is a one-party consent state for recordings, the legal standard is lower than in California or Illinois, but the ethical standard and best practice expectation are higher.

Three distinct steps versus the single TRAIGA disclosure that generation-based tools require.

Generation-Based Tools: One Friction Point

A generation-based tool works differently. You have the session. You write a brief summary of what happened, in your own words, after the session ends. The AI takes your text and structures it into a clinical note format. No audio recording occurs. No session content is transcribed in real time.

For Texas therapists using this workflow:

• SB 1188 review requirement: Naturally satisfied. You wrote the input. You receive the structured output. You review it before signing. This is a single, already-existing workflow step for any professional already reading their own notes before finalizing them.

• TRAIGA disclosure: Still required. You must tell patients that AI assists with structuring your documentation. This is straightforward because the disclosure is accurate and limited: the AI formats notes, it does not listen to sessions.

• Session recording consent: Not applicable. There is no session recording to disclose.

One compliance friction point instead of three. The generation-based workflow does not eliminate your Texas legal obligations, but it significantly reduces the surface area of compliance management.

A Fictional Example: Two Texas Therapists

Dr. Reyes is an LPC in Austin using an ambient recording tool. At intake, she tells clients that an AI will record and transcribe their sessions to help generate notes. She has a TRAIGA-compliant disclosure, she reviews every note before finalizing it, and she confirms her vendor uses US-based servers. Her compliance posture is solid, but it required three distinct steps: recording consent language in her intake paperwork, TRAIGA disclosure, and active note review. She also had to update her vendor agreement to confirm US-only data storage.

Dr. Vargas is an LCSW in Houston using a generation-based tool. She updated her intake paperwork to include a TRAIGA-compliant AI disclosure: she uses an AI tool that formats her written session summaries into clinical notes; no session audio is recorded or processed. She reviews every structured note before signing it. Her SB 1188 review requirement is satisfied by her existing practice of reading notes before signing. She has one disclosure to manage.

Both practitioners are compliant. Dr. Vargas has fewer moving pieces.

Common Compliance Mistakes to Avoid

Assuming your current consent form covers TRAIGA. A generic "electronic records" disclosure does not constitute clear and conspicuous AI disclosure under TRAIGA. Review your intake paperwork specifically for AI use language. If it is not there, add it.

Not asking your vendor about data storage location. SB 1188's data localization rule is about physical server location. "We use encryption" is not the same as "our servers are in the United States." Ask the question directly. If the vendor cannot answer it, treat that as a red flag.

Treating the SB 1188 review requirement as optional. Some therapists have workflows where AI-generated notes auto-populate into a record without meaningful clinician review. In Texas, this is now a specific legal risk. Every AI-generated note that enters your clinical record should have a documented review step.

Using your existing HIPAA BAA as evidence of SB 1188 compliance. A HIPAA Business Associate Agreement addresses federal obligations. It does not address Texas-specific requirements under SB 1188. These are separate legal frameworks, and compliance with one does not equal compliance with the other.

Relying on a verbal disclosure for TRAIGA. The "clear and conspicuous" standard implies documentation. A verbal mention at the start of therapy does not create a record that you disclosed AI use. Put it in writing, in your intake consent paperwork.

Forgetting telehealth clients who live in Texas. If you are a therapist licensed in another state but providing telehealth services to clients physically located in Texas, Texas law may still apply to the clinical relationship. If you have Texas-based clients, review your compliance posture against these two laws regardless of where you are personally licensed.

Checking Your Vendor's Compliance Posture

Before relying on an AI documentation tool for Texas client records, work through these questions with your vendor:

On SB 1188:

• Are records stored on US-based servers only? Can you confirm in writing?
• Does your tool require clinician review before a note is finalized? Or is there an auto-insert function?
• What is your data retention policy? Are notes deleted after generation, or stored?

On TRAIGA:

• Can you provide language I can include in my client-facing disclosure that accurately describes what your tool does?
• Does your tool involve session recording or audio transcription, or is it post-session text generation only?

On general documentation integrity:

• Is your note generation template-based (therapist controls structure) or freeform generation from session content? This affects hallucination risk.
• Can I customize note formats to match what my licensing board and payers expect?

If a vendor cannot clearly answer the data storage question, treat that as a compliance risk under SB 1188. If a vendor's description of their tool's function would make your TRAIGA disclosure more complex (for example, because the tool does involve session recording), factor that into your workflow planning.

Tools like NotuDocs use a generation-based workflow where the therapist writes the input and reviews the structured output before any note is finalized, which naturally aligns with SB 1188's review requirement. Your TRAIGA disclosure for that workflow is also straightforward: AI helps format written summaries; no session audio is involved.

The Texas Landscape in Context

Texas is the second state after Illinois to enact substantial AI healthcare regulation affecting therapists, but it will not be the last. Louisiana enacted a verbal notification requirement for AI transcription of medical visits in April 2026. New York has a proposed bill mirroring Illinois' framework. More than 40 AI mental health bills have been introduced across 25 states as of 2026.

The directional trend is clear: therapists who build clean AI disclosure and review practices now will not need to rebuild them as additional states add requirements. A practice that requires written client disclosure of AI use, confirms vendor data localization, and reviews every AI-generated note before signing it is already positioned to adapt to what most proposed state-level AI legislation requires.

The Texas laws are also significant because they cover the full range of AI use in care, not just mental health. SB 1188 and TRAIGA were written to govern AI in healthcare broadly. Therapists are not specifically called out, but they are included. If you use AI for documentation and you practice in Texas, these laws apply to you.

Texas AI Compliance Checklist for Therapists

Client Disclosure (TRAIGA)

• Reviewed intake paperwork for AI disclosure language specific to your documentation workflow
• Added a clear, written TRAIGA-compliant disclosure if none existed
• Disclosure specifies what the AI does (structures written notes vs records sessions), not just that AI is used
• Disclosure is prominent, not buried in fine print
• Existing clients informed of AI use in documentation if you have recently adopted a new tool

Record Review (SB 1188)

• Confirmed your documentation workflow includes reviewing every AI-generated note before it is finalized
• No auto-insert function is set up that would bypass clinician review
• Your review is documented: the act of signing or finalizing a note serves as evidence of review
• Notes meet the same accuracy and completeness standards as manually written records

Data Localization (SB 1188)

• Confirmed in writing with your AI documentation vendor that client records are stored on US-based servers only
• If vendor cannot confirm server location, you have flagged this as a compliance risk
• Your vendor's data handling aligns with your existing records retention obligations

Vendor Due Diligence

• Asked vendor whether the tool involves session recording, transcription, or post-session text generation
• Reviewed vendor's data retention policy (how long are notes stored after generation?)
• Obtained language from vendor for client-facing AI disclosure that accurately describes the tool's function
• Confirmed vendor's HIPAA BAA status separately from SB 1188 compliance confirmation

Ongoing Compliance

• Scheduled a periodic review of your AI tool vendor's terms and data storage policies (at least annually)
• Monitoring Texas state agency guidance for any implementing regulations under SB 1188 or TRAIGA
• Aware that telehealth clients physically located in Texas are subject to Texas law regardless of your own license state

---

For the broader state-by-state compliance landscape, see State-by-State AI Documentation Laws for Therapists and Illinois AI Psychotherapy Law: A Therapist's Guide to Public Act 104-0054. For a deeper look at how tool architecture affects compliance across all states, Ambient Recording vs. Generation-Based AI Notes covers the workflow differences in detail.

This article is for general informational purposes. It does not constitute legal advice. Consult a Texas-licensed attorney for guidance specific to your practice situation.