The HB-300 training requirements are that all members of a Covered Entity´s workforce receive training on the Texas Medical Records Privacy Act within 90 days of starting work for an employer. Refresher training has to be provided within a year of a material change to HB-300 policies, and – if there are no material changes – every two years. It is important to be aware that HB-300 does not distinguish between Covered Entities and Business Associates in the same way as HIPAA. All businesses with access to PHI/ePHI are considered to be Covered Entities. Additionally, HB-300 protects the PHI of all Texas citizens regardless of where PHI is collected, received, maintained, or used. Therefore, a HIPAA Business Associate in (for example) California could be a Covered Entity under the Texas Medical Records privacy Act.