IT and compliance for Houston financial and medical offices.

No regulator writes to this office, which is why it is the one most often told it has nothing to comply with. The requirements arrive from somewhere else: a cyber-insurance application that asks whether MFA is enforced, a client questionnaire from a bank or a hospital before a contract is signed, and PCI DSS, which applies to every business that accepts cards regardless of size or transaction volume.

Texas Business and Commerce Code section 521.053 applies to any person conducting business in the state and carries no employee threshold, with notice to the Attorney General starting at 250 affected Texas residents. The gap is rarely the controls. It is that nobody in the office is tracking which of these already applies.

A tax practice is a financial institution under the Gramm-Leach-Bliley Act, so the FTC Safeguards Rule at 16 CFR Part 314 applies in full: a written information security program, a documented risk assessment, a named Qualified Individual, and the fourteen safeguards behind them. IRS Publication 5708 states the same conclusion in plainer terms, that tax and accounting professionals are financial institutions regardless of size.

The specific failure mode is the PTIN renewal. Attesting that the firm keeps a written data security plan without one behind it is a false statement on a federal form, and it is made annually, by name.

An agency holds nonpublic personal information and carries the GLBA safeguarding duty, but the regulator is not the FTC. Under GLBA section 505, 15 U.S.C. 6805, rulemaking for the business of insurance is allocated to state insurance authorities, and the Safeguards Rule at 16 CFR 314.1(b) reaches only institutions not already under another functional regulator.

Texas has not adopted the NAIC Insurance Data Security Model Law, so there is no Texas insurance-specific cybersecurity statute today. The real, present obligations are GLBA, Texas breach law, and the carrier and E&O contracts, and the failure mode is attesting to a control on a carrier questionnaire that the agency does not actually run.

Which rule binds an advisory practice depends on where it is registered. An SEC-registered adviser follows Regulation S-P at 17 CFR 248.30, amended in 2024 to require a written incident-response program and client notification generally within 30 days of determining that information was, or likely was, accessed.

A Texas state-registered adviser, generally under $100 million in assets under management, falls under FTC Part 314 instead. The failure mode is the same either way: the 30-day clock starts on determination, not on cleanup, so the procedure has to exist in writing before anything happens.

Real estate settlement services is a listed covered activity, so a settlement office sits under FTC Part 314, while title insurance agency activity answers to the state insurance regulator under the same GLBA allocation. Most Texas title offices do both, so the written program is the job regardless of which half is being examined.

The failure mode here is not a fine. It is a forged wiring instruction that clears at a closing, which is why ALTA Best Practices Pillar 3 names multi-factor authentication as a wire-fraud defense and why an out-of-band callback is the control that actually stops the loss.

The HIPAA Security Rule at 45 CFR 164.308(a)(1) requires every covered entity to conduct an accurate and thorough assessment of the risks to electronic protected health information. It is not optional and it is not a one-time task, and it is the first document the Office for Civil Rights asks for after an incident or a complaint.

HIPAA has no small-practice exemption, so a two-provider office carries the same obligation as a hospital system. The failure mode is having no current risk analysis on file, which is exactly the gap the OCR Risk Analysis Initiative was created to pursue.