§ 74A.002.Limitation on Liability of Health Care Providers Relating to Health Information Exchanges

The operative provision, and it addresses a specific fear.

Unless the health care provider acts with malice or gross negligence, a provider who provides patient information to a health information exchange is not liable for damages, penalties, or other relief related to the obtainment, use, or disclosure of that information in violation of federal or state privacy laws by a health information exchange, another health care provider, or any other person.

The protection is against someone else's breach. A provider that shares records properly is not answerable for what the exchange, another provider, or a third party then does with them.

Health information exchanges exist so that a patient's records follow them between providers, which requires each provider to release data it no longer controls. Without this section, HIPAA exposure would be a rational reason to decline to participate.

Malice and gross negligence remain outside the shield, so a provider that released records recklessly or deliberately is not protected.

Subsection (b) is a careful disclaimer: nothing in the section may be construed to create a cause of action or to create a standard of care, obligation, or duty that forms the basis for a cause of action.

That forecloses the argument that the section, by protecting providers who act without gross negligence, thereby establishes a duty to avoid it — a reading that would turn an immunity into a source of liability.