DentalX Back to home

BAA Schedule C: Texas

BAA-US-SCH-C · Draft of October 6, 2026 · revision 1 · version 1.0

Part of Business Associate Agreement and Health Data Processing Addendum

Final draft for counsel's review. It is not in effect, and no clinic has accepted it. Items still to be confirmed are highlighted in the text.

This is the controlling text.

SHA-256 of this text: 8d1c6da457d63240b8a6d7318c925b7b805e78e557d9b0402fbed58e143129d0

Schedule C — Texas

Applies to: Clinics whose principal place of practice is in Texas.

C.1 US-only storage (SB 1188). VstreamX ensures that the Clinic's electronic health record information is physically maintained only in the United States or its territories, including:

  • information it stores itself;
  • information stored by its Subcontractors; and
  • backups, caches it controls, and exports it generates.

This applies as Texas Health and Safety Code Chapter 183, as added by SB 1188 (89th Legislature), requires. [[TO CONFIRM: statutory section numbers]]

VstreamX keeps an inventory of every location where such information is stored. For Texas Clinics:

  • (a) WhatsApp messaging is blocked, as for every US Clinic;
  • (b) Users cannot export PHI from DentalX to devices outside the United States [[TO CONFIRM: release date of the export-location control]];
  • (c) AI requests are processed in a Google Cloud United States region (section 3.13); and
  • (d) email to patients is sent only from a Google Workspace account whose data at rest is pinned to the United States by a Google Workspace data-region policy. Otherwise DentalX sends no patient email for Texas Clinics. [[BLOCKING TO CONFIRM: the Workspace edition supports a United States data region, and the policy is set for the sending account]]

C.2 Texas Medical Records Privacy Act (Chapter 181). VstreamX acknowledges that it is a covered entity under Health and Safety Code § 181.001(b)(2). It:

  • (a) does not disclose PHI for direct or indirect remuneration (§ 181.153);
  • (b) trains each of its employees who handles PHI in state and federal law on PHI, as it relates to VstreamX's business and the employee's scope, within 90 days of hire. It keeps a signed statement of completion for each employee (§ 181.101). [[TO CONFIRM: Texas training programme and signed statements in place]]; and
  • (c) supports the Clinic's notice to patients that their PHI is subject to electronic disclosure (§ 181.154), by providing a template.

C.3 Electronic access. VstreamX's help under section 3.8 allows the Clinic to provide electronic health records to a patient within 15 business days of a written request (§ 181.102).

C.4 Artificial intelligence. DentalX provides a patient-disclosure template for the Clinic's use of AI where Texas law requires it to disclose that use. AI output is labelled, and a practitioner reviews it before it enters the record.

C.5 Breach. VstreamX's report under section 3.4 allows the Clinic to notify individuals within 60 days. It also allows the Clinic to notify the Attorney General within 30 days where 250 or more Texas residents are affected.

Items to confirm before publication (BAA-US)

  1. The publication date of v1.0.
  2. Blocking: a regional US Vertex AI endpoint enabled for US Clinics (§ 3.13; Exhibit 2; C.1(c)).
  3. That no PHI is exported to or kept on personnel devices (§ 3.14).
  4. VstreamX's own HIPAA risk analysis completed (§ 3.15(a)).
  5. The owner's decision on reimbursing Breach-notification costs, and on a separate data-breach cap (§ 7.2).
  6. A dedicated privacy/HIPAA notice address (§ 10.4).
  7. Blocking: that the project runs on Identity Platform, a covered Google service (Exhibit 2).
  8. Blocking: Google Workspace BAA accepted for the sending account, which must be a Google Workspace account. Until then, no email to US patients; links do not cure this (§ 3.7; Exhibit 2).
  9. The Nevada NRS section numbers (Schedule A).
  10. That the audit trail records before-and-after values for clinical changes, or a release date (B.1(d)).
  11. The release date of the California sensitive-services controls (B.2).
  12. Whether AB 3030 reaches dental offices (B.3).
  13. The Texas Chapter 183 section numbers (C.1).
  14. The release date of the export-location control (C.1(b)).
  15. The Texas Chapter 181 training programme and signed statements (C.2(b)).
  16. Blocking for California: the before-and-after change history and the sensitive-services controls live before Schedule B is published (Schedule B, opening condition).
  17. Blocking for Texas email: a United States data-region policy on the sending account, or no patient email for Texas Clinics (C.1(d)).
  18. Mandatory MFA for US owners and managers, if VstreamX wants § 3.15(c) to say "required by default" (§ 3.15(c)).
  19. Destruction of file versions and of the audit trail (or its de-identification) on the deletion date (§ 5.4(c)).