(1) The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. Existing law deems a business that offers a mental health digital service or reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual's information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a provider of health care subject to the requirements of the CMIA.
The bill would additionally deem a business that offers a health care chatbot, as defined, to a consumer for the above-described purposes to be a provider of health care subject to the requirements of the CMIA.
(2) Existing law provides for the licensure and regulation of health facilities and clinics by the State Department of Public Health. Existing law generally makes a violation of these provisions a crime. Existing law requires a health facility, clinic, physician's office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person, except as specified.
This bill would require a health facility, clinic, physician's office, or office of a group practice to take reasonable steps to ensure that a licensed health care professional, acting within their scope of practice, retains the ability to exercise independent professional judgment in their care of a patient whenever that care is informed by the output of a clinical decision support system, as defined. The bill would authorize the appropriate professional licensing board to pursue an injunction or restraining order to enforce these provisions to the extent that a violation constitutes the practice of a health care profession without a license. The bill would specify that these provisions do not apply to the use of automated decision systems for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records. By placing new requirements on health facilities and clinics, this bill would expand the scope of a crime and would impose a state-mandated local program.
(3) The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.

Statutes affected:
AB 1979: 56.05 CIV, 56.06 CIV
02/13/26 - Introduced: 56.05 CIV
03/16/26 - Amended Assembly: 56.05 CIV, 56.05 CIV, 56.06 CIV, 56.06 CIV, 56.05 CIV
03/19/26 - Amended Assembly: 56.05 CIV, 56.06 CIV
04/09/26 - Amended Assembly: 56.06 CIV
04/23/26 - Amended Assembly: 56.05 CIV, 56.05 CIV, 56.06 CIV
06/17/26 - Amended Senate: 56.05 CIV, 56.06 CIV
06/22/26 - Amended Senate: 56.05 CIV, 56.06 CIV
07/02/26 - Amended Senate: 56.05 CIV, 56.06 CIV