(1)The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. Existing law makes a violation of these provisions that results in economic loss or personal injury punishable as a misdemeanor. Existing law deems a business that offers a mental health digital service or reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a provider of health care subject to the requirements of the CMIA.

The bill would additionally deem a business that offers a health care chatbot, as defined, to a consumer for the above-described purposes to be a provider of health care subject to the requirements of the CMIA. Because the bill would expand the scope of a crime, it would impose a state-mandated local program.

(2)Existing law requires a health facility, clinic, physicians office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person, except as specified.

This bill would require a health facility, clinic, physicians office, or office of a group practice to take reasonable steps to ensure that a licensed health care professional, acting within their scope of practice, retains the ability to exercise independent professional judgment in their care of a patient whenever that care is informed by the output of a clinical decision support system, as defined. The bill would prohibit a health facility, clinic, physicians office, or office of a group practice from using or deploying a tool, system, or device that includes artificial intelligence to independently perform any clinical function that is required by law to be performed by a person with a professional license. The bill would make a violation of these provisions by a physician subject to the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California. The bill would also authorize the appropriate professional licensing board to pursue an injunction or restraining order to enforce these provisions to the extent that a violation constitutes the practice of a health care profession without a license. The bill would specify that these provisions do not apply to the use of automated decision systems for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records.

(3)The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

(1)The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. Existing law makes a violation of these provisions that results in economic loss or personal injury punishable as a misdemeanor. Existing law deems a business that offers a mental health digital service or reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a provider of health care subject to the requirements of the CMIA.

The bill would additionally deem a business that offers a health care chatbot, as defined, to a consumer for the above-described purposes to be a provider of health care subject to the requirements of the CMIA. Because the bill would expand the scope of a crime, it would impose a state-mandated local program.

(2)Existing law requires a health facility, clinic, physicians office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person, except as specified.

This bill would require a health facility, clinic, physicians office, or office of a group practice to take reasonable steps to ensure that a licensed health care professional, acting within their scope of practice, retains the ability to exercise independent professional judgment in their care of a patient whenever that care is informed by the output of a clinical decision support system, as defined. The bill would prohibit a health facility, clinic, physicians office, or office of a group practice from using or deploying a tool, system, or device that includes artificial intelligence to independently perform any clinical function that is required by law to be performed by a person with a professional license. The bill would make a violation of these provisions by a physician subject to the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California. The bill would also authorize the appropriate professional licensing board to pursue an injunction or restraining order to enforce these provisions to the extent that a violation constitutes the practice of a health care profession without a license. The bill would specify that these provisions do not apply to the use of automated decision systems for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records.

(3)The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

(1)The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. Existing law makes a violation of these provisions that results in economic loss or personal injury punishable as a misdemeanor. Existing law deems a business that offers a mental health digital service or reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a provider of health care subject to the requirements of the CMIA.

The bill would additionally deem a business that offers a health care chatbot, as defined, to a consumer for the above-described purposes to be a provider of health care subject to the requirements of the CMIA. Because the bill would expand the scope of a crime, it would impose a state-mandated local program.

(2)Existing law provides for the licensure and regulation of health facilities and clinics by the State Department of Public Health. Existing law generally makes a violation of these provisions a crime. Existing law requires a health facility, clinic, physicians office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person, except as specified.

This bill would require a health facility, clinic, physicians office, or office of a group practice to take reasonable steps to ensure that a licensed health care professional, acting within their scope of practice, retains the ability to exercise independent professional judgment in their care of a patient whenever that care is informed by the output of a clinical decision support system, as defined. The bill would prohibit a health facility, clinic, physicians office, or office of a group practice from using or deploying a tool, system, or device that includes artificial intelligence to independently perform any clinical function that is required by law to be performed by a person with a professional license. The bill would make a violation of these provisions by a physician subject to the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California. The bill would also authorize the appropriate professional licensing board to pursue an injunction or restraining order to enforce these provisions to the extent that a violation constitutes the practice of a health care profession without a license. The bill would specify that these provisions do not apply to the use of automated decision systems for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records. By placing new requirements on health facilities and clinics, this bill would expand the scope of a crime and would impose a state-mandated local program.

(3)The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

(1)The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. Existing law deems a business that offers a mental health digital service or reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a provider of health care subject to the requirements of the CMIA.

The bill would additionally deem a business that offers a health care chatbot, as defined, to a consumer for the above-described purposes to be a provider of health care subject to the requirements of the CMIA.

(2)Existing law provides for the licensure and regulation of health facilities and clinics by the State Department of Public Health. Existing law generally makes a violation of these provisions a crime. Existing law requires a health facility, clinic, physicians office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person, except as specified.

This bill would require a health facility, clinic, physicians office, or office or of a group practice to take reasonable steps to ensure that no clinical decision, as specified, is based solely on the output of a clinical decision support system, as defined, and that a licensed health care professional, acting within their scope of practice, retains the ability to exercise independent professional judgment when reviewing and approving a clinical decision that is based on in their care of a patient whenever that care is informed by the output of a clinical decision support system. system, as defined. The bill would authorize the appropriate professional licensing board to pursue an injunction or restraining order to enforce these provisions to the extent that a violation constitutes the practice of a health care profession without a license. The bill would specify that these provisions do not apply to the use of automated decision systems for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records. By placing new requirements on health facilities and clinics, this bill would expand the scope of a crime and would impose a state-mandated local program.

(3)The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

(1)The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. Existing law deems a business that offers a mental health digital service or reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a provider of health care subject to the requirements of the CMIA.

The bill would additionally deem a business that offers a health care chatbot, as defined, to a consumer for the above-described purposes to be a provider of health care subject to the requirements of the CMIA.

(2)Existing law provides for the licensure and regulation of health facilities and clinics by the State Department of Public Health. Existing law generally makes a violation of these provisions a crime. Existing law requires a health facility, clinic, physicians office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person, except as specified.

This bill would require a health facility, clinic, physicians office, or office or a group practice to ensure that no clinical decision, as specified, is based solely on the output of a clinical decision support system, as defined, and that a licensed health care professional, acting within their scope of practice, retains the ability to exercise independent professional judgment when reviewing and approving a clinical decision that is based on the output of a clinical decision support system. The bill would authorize the appropriate professional licensing board to pursue an injunction or restraining order to enforce these provisions to the extent that a violation constitutes the practice of a health care profession without a license. The bill would specify that these provisions do not apply to the use of automated decision systems for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records. By placing new requirements on health facilities and clinics, this bill would expand the scope of a crime and would impose a state-mandated local program.

(3)The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

(1)The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. Existing law deems a business that offers a mental health digital service or reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a provider of health care subject to the requirements of the CMIA.

The bill would additionally deem a business that offers a healthcare health care chatbot, as defined, to a consumer for the above-described purposes to be a provider of health care subject to the requirements of the CMIA.

(2)Existing law provides for the licensure and regulation of health facilities and clinics by the State Department of Public Health. Existing law generally makes a violation of these provisions a crime. Existing law requires a health facility, clinic, physicians office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person, except as specified.

This bill would require a health facility, clinic, physicians office, or office or a group practice to ensure that no clinical decision, as specified, is based solely on the output of a clinical decision support system, as defined, and that a licensed health care professional exercises professional, acting within their scope of practice, retains the ability to exercise independent professional judgment when reviewing and approving a clinical decision that is based on the output of a clinical decision support system. The bill would authorize the appropriate professional licensing board to pursue an injunction or restraining order to enforce these provisions to the extent that a violation constitutes the practice of a health care profession without a license. The bill would specify that these provisions do not prohibit the use of artificial intelligence apply to the use of automated decision systems for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records. By placing new requirements on health facilities and clinics, this bill would expand the scope of a crime and would impose a state-mandated local program.

(3)The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

(1)The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. The CMIA makes a business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. Existing law deems a business that offers a mental health digital service or reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a provider of health care subject to the requirements of the CMIA.

The bill would clarify that manage the individuals information includes the ability to query their medical history, summarize doctors notes, or organize lab results. additionally deem a business that offers a healthcare chatbot, as defined, to a consumer for the above-described purposes to be a provider of health care subject to the requirements of the CMIA.

(2)Existing law provides for the licensure and regulation of health facilities and clinics by the State Department of Public Health. Existing law generally makes a violation of these provisions a crime. Existing law requires a health facility, clinic, physicians office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person, except as specified.

This bill would prohibit require a health facility, clinic, physicians office, or office or a group practice from using or deploying a tool, system, or device that includes artificial intelligence to replace the use of professional judgment by a licensed health care professional, as specified, and would prohibit the use of artificial intelligence to direct, guide, supervise, or instruct unlicensed personnel in performing any function that requires a professional license. to ensure that no clinical decision, as specified, is based solely on the output of a clinical decision support system, as defined, and that a licensed health care professional exercises independent professional judgment when reviewing and approving a clinical decision that is based on the output of a clinical decision support system. The bill would authorize the appropriate professional licensing board to pursue an injunction or restraining order to enforce these provisions to the extent that a violation constitutes the practice of a health care profession without a license. The bill would specify that these provisions do not prohibit the use of artificial intelligence for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records. By placing new requirements on health facilities and clinics, this bill would expand the scope of a crime and would impose a state-mandated local program.

(3)The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

(1)The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. The CMIA makes a business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA.

The bill would clarify that manage the individuals information includes the ability to query their medical history, summarize doctors notes, or organize lab results.

(2)Existing law provides for the licensure and regulation of health facilities and clinics by the State Department of Public Health. Existing law generally makes a violation of these provisions a crime. Existing law requires a health facility, clinic, physicians office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person, except as specified.

This bill would prohibit a health facility, clinic, physicians office, or office or a group practice from using or deploying a tool, system, or device that includes artificial intelligence for any activity requiring to replace the use of professional judgment by a licensed health care professional, as specified, and would prohibit the use of artificial intelligence to direct, guide, supervise, or instruct unlicensed personnel in performing any function that requires a professional license. The bill would authorize the appropriate professional licensing board to pursue an injunction or restraining order to enforce these provisions to the extent that a violation constitutes the practice of a health care profession without a license. The bill would specify that these provisions do not prohibit the use of artificial intelligence for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records. By placing new requirements on health facilities and clinics, this bill would expand the scope of a crime and would impose a state-mandated local program.

(3)The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

(1)The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. The CMIA makes a business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.

(2)Existing law provides for the licensure and regulation of health facilities and clinics by the State Department of Public Health. Existing law generally makes a violation of these provisions a crime. Existing law requires a health facility, clinic, physicians office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person, except as specified.

This bill would prohibit a health facility, clinic, physicians office, or office or a group practice from using or deploying a tool, system, or device that includes artificial intelligence for any activity requiring the use of professional judgment by a licensed health care professional, as specified, and would prohibit the use of artificial intelligence to direct, guide, supervise, or instruct unlicensed personnel in performing any function that requires a professional license. The bill would authorize the appropriate professional licensing board to pursue an injunction or restraining order to enforce these provisions to the extent that a violation constitutes the practice of a health care profession without a license. The bill would specify that these provisions do not prohibit the use of artificial intelligence for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records. By placing new requirements on health facilities and clinics, this bill would expand the scope of a crime and would impose a state-mandated local program.

(3)The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. The act defines various terms for its purposes.

This bill would make a nonsubstantive change to that provision.

196CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 1979

Author:(Bonta)

As Amended Ver:August 20, 2026

Majority vote

SUMMARY

Requires a health facility, clinic, physician's office, or office of a group practice to take reasonable steps to ensure that a licensed health care professional retains the ability to exercise independent professional judgment in their care of a patient whenever that care is informed by the output of a clinical decision support system (CDSS). Specifies that this bill does not prohibit the use of automated decision systems for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records. Clarifies, for the purposes of the Confidentiality of Medical Information Act (CMIA) that a business that offers a health care chatbot, as defined, to a consumer is a provider of health care subject to the requirements of the CMIA.

Senate Amendments

1. Strike the requirement for a health facility to ensure that no clinical decision is based solely on the output of a CDSS and strike the definition of "clinical decision."
2. Recast the provisions contained in the Health and Safety Code to the Business and Professions Code.
3. Modify the requirement on health facilities to require them to "take reasonable steps" to ensure, rather than simply ensure, that a licensed health professional retains the ability to exercise independent professional judgement in their care of a patient whenever that care is informed by the output of a CDSS.
4. Strike enforcement provisions related to the unfair competition law and the California Department of Public Health.
5. State that violation of the CDSS provision of this bill by a physician is subject to the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California, as appropriate.
6. Modify the definition of CDSS to mean: “an artificial intelligence system that produces a prediction, classification, recommendation, evaluation, or analysis that aids clinical decisionmaking related to timing of care, diagnosis, or treatment. It does not include systems that provide appointment management, such as booking, canceling, and rescheduling appointments, appointment reminders, patient education and previsit materials and preparation, and payment processing, to the extent the independent performance of these activities by the system does not require a professional license."

COMMENTS

Artificial Intelligence (AI). AI is the mimicking of human intelligence by artificial systems. AI uses algorithms, or sets of rules, to transform inputs into outputs. Inputs and outputs can be anything a computer can process: numbers, text, audio, video, or movement. AI is not fundamentally different from other computer functions; unlike other computer functions, however, AI is able to accomplish tasks that are normally performed by humans. Most modern AI tools are created through a process known as "machine learning." Machine learning involves techniques that enable AI tools to learn the relationship between inputs and outputs without being explicitly programmed. The next step is "training," the process of exposing a naïve AI to data. The algorithm that an AI develops during training is known as its "model." Models trained on small, specific datasets in order to make recommendations and predictions are referred to as "predictive AI." This differentiates them from "generative AI" (GenAI), which are trained on massive datasets in order to produce detailed text, images, audio, and video. Because it can process a range of data sources and create novel outputs, and because it can convincingly mimic human capabilities and convincingly generate perfectly worded nonsense, GenAI poses unique opportunities and challenges.

Administrative and clinical-adjacent uses of AI applications in health care. Hospitals, clinics, physician groups, and health plans are leveraging GenAI to automate a wide range of routine back-office tasks as well as those tasks that provide administrative support for clinical work.

For instance, electronic health record (EHR) systems are being equipped with GenAI functionality that allows health care providers to automatically generate billing codes, improving accuracy and completeness by checking for errors, omissions, and compliance with current requirements. At the same time, health plans and insurers are using AI on the other end of the transaction to automate and streamline multiple functions, including processing claims and evaluating prior authorization requests. According to the Wall Street Journal, UnitedHealth Group said it now has a thousand AI applications in production, even as a class action lawsuit is advancing through the courts accusing the insurer of using AI algorithms instead of medical professionals to illegally deny Medicare Advantage claims. Other types of administrative tasks, such as appointment scheduling and other routine, non-clinical communication have significant potential to be automated. Researchers also believe AI can assist in generation of quality metrics, which are important for measuring health system performance but often rely on data that must be manually extracted from EHRs. Similar to the Layer Health project mentioned above, a pilot study found that large language models (LLMs) could perform accurate extractions of specific data from these patient records for use in calculating complex quality measures.

Diagnostics, Treatment and CDSS. In addition to the clinical-adjacent applications discussed above, clinical applications of GenAI technology are advancing rapidly and substantially. Google's MedPaLM-2 LLM achieved expert-level scores on the United States Medical Licensing Examination, with physicians preferring AI answers to those from other physicians on eight of nine clinical axes. GenAI can now synthesize, augment, and interpret heterogeneous complex images across various modalities, such as X-rays, MRI, and CT scans. AI algorithms can also assist in diagnosing dental health conditions through image analysis and data interpretation. In recent years, minimally invasive surgical techniques such as laparoscopic surgery and robotic surgery have become increasingly prevalent. The ultimate goal of robotic surgery development is the creation of fully autonomous AI-powered surgical instruments. Data from the 2023 American Hospital Association Annual Survey Information Technology Supplement reflect 65% of United States hospitals used predictive models, and 79% of those used models from their EHR developer. Hospitals use AI and predictive models to predict health trajectories or risks for inpatients, identify high-risk outpatients to inform follow-up care, monitor health, and recommend treatments. CDSS are also being deployed and designed to aid physicians in diagnosing, managing, and treating patients in outpatient settings.

Racial, ethnic, and gender bias. The performance of an AI is directly impacted by the quality, quantity, and relevance of the data used to train it. If the data used to train the AI is biased, the tool’s outputs will be similarly biased and the results can be inaccurate when applied to populations not reflected in the training data. When automated decision systems are deployed in healthcare, biased historical data can lead to patients being recommended substandard care on the basis of their race or ethnicity. In 2007, an automated decision system was developed to help doctors estimate whether it was safe for people who had delivered previous children through cesarean section to deliver subsequent children vaginally. The system considered relevant factors as it made its decision, such as the woman's age, her reason for the previous cesarean, and how long ago the cesarean had been performed. However, a 2017 study found that the system was biased; it predicted Black and Latino people were less likely to have a successful vaginal birth after a cesarean than similar non-Hispanic white women. As a result, doctors performed more cesareans on Black and Latino people than on white people. Such discrepancies can potentially perpetuate historical biases and lead to worse health outcomes. The University of California (UC), San Francisco also reported bias in an algorithm used to identify potential appointment no-shows to facilitate double-booking for that appointment. The program was confirmed to result in low-resourced and marginalized populations being double-booked more often than others, reflecting underlying structural inequalities and highlighting how these tools, if not studied and corrected for bias, that can create feedback loops that worsen discrimination.

Cognitive biases and cognitive burden. Bias exhibited by an AI model based on underlying training data is not the only bias that may influence how an AI system works when deployed. Its effectiveness can also be impacted by predicable patterns of human error called cognitive biases. Reviewing an AI system’s output for errors or omissions is a substantively different cognitive task than generating a clinical note or medical advice, and the use of AI systems raise questions about how cognitive bias evoked by AI assistance with clinical tasks might affect clinical judgement or practice in ways that are difficult to understand, predict, and measure.

Research shows automation bias, or placing undue confidence in and over-relying on automated outputs, is a problem in many fields. Automation-induced complacency, or insufficient monitoring of automation output, is also a concern. Over time, these biases can lead to people being less likely to catch errors or to disagree with what was written. There are many factors that can exacerbate the potential danger posed by automation bias in CDSS, including, for instance, if an AI model’s process to arrive a given output lacks transparency or is not explainable, if the model is implemented with inadequate training of end users, or if a clinician is under significant time pressure or cognitive burden that limits their practical ability to systematically assess and effectively integrate the additional information provided by an AI system with their clinical knowledge and experience.

Although there are many examples of promising AI applications for improving clinical decision-making, a 2023 experimental study demonstrated some concerning results. It tested the efficacy of AI models designed to assist clinicians in diagnosing chronic obstructive pulmonary disease, pneumonia, or heart failure from a radiograph. Although assistance from a carefully designed AI model slightly improved clinicians’ accuracy in diagnosis as compared the clinicians who received no assistance (76-78% versus 73%), in cases where clinicians were provided AI support using a systematically biased model, diagnostic accuracy dropped substantially to 62%. In other words, receiving support from a bad AI system actually made clinicians significantly worse at diagnosing conditions than simply relying on their own clinical judgement. This study showed that having a “clinician-in-the-loop” overseeing the AI does not overcome the challenges of poor-performing AI systems, regardless of whether the clinicians are given information explaining how the AI arrived at its output.

Direct to consumer AI tools. Direct to consumer (DTC) health-related AI tools are rolling out at a rapid pace. This year, major AI developers at OpenAI, Anthropic, and Microsoft have announced ChatGPT Health, Claude for Health Care, and Copilot Health, respectively. The CMIA prohibits a provider of health care, among others, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, for any purpose not necessary to provide health care services to a patient, except as provided. The CMIA makes a business that offers software or hardware to consumers, including a mobile application designed to maintain medical information to make the information available to an individual or a provider of health care, for purposes of allowing the individual to manage the their information or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. In announcements of these DTC health AI apps, developers have made clear that their tools do not diagnose or treat patients, or claim that consumer facing elements are intended to assist with preparing for doctor's appointments. Given this focus, there may be room for clarity for what it means to manage an individual's information.

In January 2025, the California Department of Justice released legal advisories regarding the use of AI in health care, which cite these provisions of the CMIA:

"California state medical privacy laws provide protections that are, in some cases, more stringent than federal health privacy laws like HIPAA. The CMIA and the Information Practices Act govern use and disclosure of Californians' medical information. Covered entities must preserve confidentiality of patients' medical information and ensure that patients have access to that information. Sensitive information, including mental and behavioral healthcare and reproductive and sexual healthcare (e.g., abortion and gender affirming care), receive heightened protections. Medical privacy laws apply to governmental healthcare agencies, medical providers, and insurance plans, as well as businesses that offer software or hardware to consumers for the purposes of managing medical information, diagnosis or treatment, or management of medical conditions, via mobile applications or other related devices."

According to the Author

AI is rapidly integrating into our health care system and reshaping our personal experience with health care. While this technology holds a lot of promise, there is no question that without careful consideration of the potential perpetuation of biases, risks to patient safety, and challenges of clinical workers knowing what to question and what to trust, the deployment of AI in health care can do more harm than good. The author notes that a 2023 study found that, while carefully crafted AI could slightly improve diagnostic accuracy for certain disorders, in cases where clinicians were provided AI support using a systematically biased model, diagnostic accuracy dropped substantially to 62% (from 73%). This also demonstrates that having a human-in-the-loop is not a panacea for all the challenges that AI can present. Providing health care requires compassion, empathy, and real-world judgment that cannot be captured in patterns and algorithms. Technology should assist human clinicians, not replace them. As AI deploys into health care settings, it is also reaching consumers directly through applications like Copilot and ChatGPT offering to connect directly to personal medical records. The author concludes that voluntary commitments to protect this sensitive information are not enough, we must ensure any entity accessing medical records for managing health is abiding by the law.

Arguments in Support

The California Nurses Association (CNA) is the sponsor of this bill and states in support that it would protect against the threats presented by the rapid expansion of AI in health care to standards of care in clinical practice and patient privacy. CNA argues that caring for patients is deeply human work, requiring professional judgment, clear accountability, and strong protection for patients' sensitive medical information. CNA contends this bill rejects the false promise of a human-in-the-loop model where AI performs the substantive clinical decision making and the clinician is left to supervise or sign off. CNA argues that this bill preserves a human in command standard, where the licensed health care professional remains the actual decision maker in health care clinical practice. In plain terms, if California law requires a licensed clinician to perform a health care activity, an AI tool cannot be used in that clinician's place. CNA concludes this bill also ensures that AI health applications remain subject to California's medical confidentiality laws, so patients do not lose privacy protections simply because their information passes through a digital platform.

Consumer Watchdog supports this bill and states that by ensuring that health care entities and AI developers cannot use AI to replace licensed clinical judgment or bypass health privacy protections it safeguards patient safety, medical privacy, and the integrity of health care practice. AI is rapidly entering the places patients receive care and consumer-facing health applications, often unbeknownst to patients. Too often the existing guardrails that are meant to protect patients are being blurred. Patient safety demands clear guardrails on the use of AI technologies. Consumer Watchdog argues this bill would protect patients by prohibiting health care entities from using AI to perform functions that require the clinical judgment of licensed health care professionals. Allowing untested and unaccountable AI technologies to perform or guide these functions risks patient harm and undermines public trust in the health care system.

The Board of Behavioral Sciences (BBS) also supports this bill stating that the BBS believes it is essential to provide guardrails to ensure that emerging technologies enhance, rather than undermine, the delivery of safe and effective care. By reinforcing the requirement for independent professional judgment and prohibiting the inappropriate delegation of licensed functions, this bill supports patient safety and upholds the integrity of clinical practice.

Arguments in Opposition

AdvaMed opposes this bill stating that the newly updated definitions raise concerns for Food and Drug Administration (FDA)-regulated medical technologies. Most notably, the bill’s definition of "clinical decision support system" is significantly broader than industry-standard definitions and could unintentionally capture a wide range of FDA-regulated medical devices. AdvaMed argues this could include imaging and diagnostic technologies, continuous glucose monitors, cardiac monitoring devices, pathology tools, and other technologies that analyze patient information or provide information to health care professionals. These technologies are already subject to rigorous FDA oversight and are safely used in clinical settings today. FDA’s premarket review of AI-enabled devices includes an assessment of device risk, the mitigation of unwanted bias, and performance validation. Notably, most AI/ML-enabled medical devices are cleared or approved with “locked” algorithms, meaning they do not continuously learn from new data or independently change their outputs once deployed. Changes to these algorithms remain subject to FDA oversight, including through Predetermined Change Control Plans, which allow manufacturers to implement certain planned modifications within parameters reviewed and authorized by the FDA.

TechNet is opposed to this bill stating that, while they agree that AI should not override licensed clinical judgment, this bill’s approach is overly broad and fails to distinguish between high- and low-risk uses. Many applications—such as patient reminders and administrative communications—enhance care delivery, improve medication adherence, and reduce clinician workload. Restricting these tools may force providers to rely on manual processes, increasing administrative burden, lowering treatment adherence, and reducing efficiency without a corresponding gain in safety. It shows that a one-size-fits-all ban overlooks the wide range of AI use cases in health care and does not follow a risk-based regulatory approach.

FISCAL COMMENTS

According to the Senate Appropriations Committee:

1. Costs of an unknown amount to the Department of Public Health (DPH) to ensure health facilities, clinics, and physician offices comply with the provisions of this bill. If DPH adopts regulations, one-time costs could be in the hundreds of thousands of dollars (Licensing and Certification Fund).
2. The Department of Consumer Affairs reports most healing arts boards anticipate an increase in workload due to a higher volume of complaints resulting from this bill. However, the boards are unable to estimate the increase in complaint volume or related enforcement costs due to the lack of data on how frequently AI violations occur (various special funds).
3. Potentially significant costs to the Department of Justice (DOJ) to bring civil actions for violations against any person who engages in a deceptive act or practice. Actual costs will depend on the number of enforcement actions pursued by DOJ and the amount of additional work created by each action, but costs may be in the hundreds of thousands of dollars annually. In addition, Civil Code Section 56.36 provides private plaintiff actions.
4. Cost pressures of an unknown but potentially significant amount to the courts to adjudicate any additional filings. Although courts are not funded based on workload, increased pressure on the Trial Court Trust Fund may create a demand for increased funding for courts. The proposed fiscal year 2026-07 Governor's budget would provide $70 million General Fund support (Trial Court Trust Fund, General Fund).

VOTES:

ASM HEALTH: 12-3-1

YES: Bonta, Addis, Aguiar-Curry, Ahrens, Caloza, Carrillo, Mark González, Patel, Rogers, Schiavo, Sharp-Collins, Stefani

NO: Johnson, Patterson, Sanchez

ABS, ABST OR NV: Chen

ASM PRIVACY AND CONSUMER PROTECTION: 11-4-0

YES: Bauer-Kahan, Bryan, Irwin, Lowenthal, McKinnor, Ortega, Pellerin, Petrie-Norris, Ward, Wicks, Wilson

NO: Macedo, DeMaio, Hoover, Patterson

ASM APPROPRIATIONS: 11-4-0

YES: Wicks, Aguiar-Curry, Calderon, Caloza, Fong, Mark González, Krell, Pacheco, Pellerin, Sharp-Collins, Solache

NO: Hoover, Dixon, Ta, Tangipa

ASSEMBLY FLOOR: 48-15-17

YES: Addis, Aguiar-Curry, Ahrens, Alvarez, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Caloza, Connolly, Elhawary, Fong, Gabriel, Mark González, Haney, Harabedian, Hart, Irwin, Jackson, Kalra, Krell, Lee, Lowenthal, McKinnor, Muratsuchi, Nguyen, Ortega, Papan, Patel, Pellerin, Petrie-Norris, Quirk-Silva, Ransom, Rogers, Schiavo, Schultz, Sharp-Collins, Solache, Soria, Stefani, Ward, Wicks, Zbur, Rivas

NO: Alanis, Ávila Farías, Castillo, DeMaio, Dixon, Ellis, Jeff Gonzalez, Hadwick, Johnson, Macedo, Patterson, Sanchez, Ta, Tangipa, Wallis

ABS, ABST OR NV: Arambula, Carrillo, Chen, Davies, Flora, Gallagher, Garcia, Gipson, Hoover, Lackey, Pacheco, Ramos, Celeste Rodriguez, Michelle Rodriguez, Blanca Rubio, Valencia, Wilson

UPDATED

VERSION: August 20, 2026

CONSULTANT: Logan Hess / HEALTH / (916) 319-2097 FN: 0004112

 THIRD READING  

Bill No: AB 1979

Author: Bonta (D)

Amended: 8/20/26 in Senate

Vote: 21

SENATE PRIV., DIGITAL TECH. & CONS. PROT. COMMITTEE: 7-2, 6/15/26

AYES: Cabaldon, Gonzalez, McNerney, Padilla, Reyes, Umberg, Wiener

NOES: Jones, Ochoa Bogh

SENATE HEALTH COMMITTEE: 8-0, 7/1/26

AYES: Weber Pierson, Caballero, Durazo, Gonzalez, Menjivar, Padilla, Pérez, Smallwood-Cuevas

NO VOTE RECORDED: Valladares, Grove, Rubio

SENATE APPROPRIATIONS COMMITTEE: 5-2, 8/13/26

AYES: Cervantes, Cabaldon, Grayson, Richardson, Wahab

NOES: Seyarto, Dahle

ASSEMBLY FLOOR: 48-15, 5/21/26 - See last page for vote

SUBJECT: Health care services: artificial intelligence

SOURCE: California Nurses Association

DIGEST:

This bill subjects businesses offering “health care chatbots” to the California Medical Information Act (CMIA) and imposes guardrails around the use of automated decision systems (ADS) and other generative AI (GenAI) models in patient care.

Senate Floor Amendments of 8/20/26 move Section 3 of this bill from the Heath and Safety Code to the Business and Professions Code, revise the definition of clinical decision support system, remove various enforcement provisions, and make various technical changes.

ANALYSIS:

Existing federal law:

1. Establishes the Health Insurance Portability and Accountability Act (HIPAA), which provides privacy protections for patients’ protected health information and generally prohibits a covered entity, as defined (health plan, health care provider, and health care clearing house), from using or disclosing protected health information except as specified or as authorized by the patient in writing. (45 Code of Federal Regulations [C.F.R.] § 164.500 et seq.)
2. Provides that if HIPAA’s provisions conflict with a provision of state law, the provision that is the most protective of patient privacy prevails. (45 C.F.R. § 164.500 et seq.)

Existing state law:

1. Establishes the CMIA, which establishes protections for the use of medical information. (Civil [Civ.] Code § 56 et seq.)
2. Prohibits providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code § 56.10.)
3. Provides that every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to remedies and penalties, as specified. (Civ. Code § 56.101.)
4. Defines “provider of health care,” for purposes of CMIA, to mean any person licensed or certified pursuant to the Business and Professions Code, as specified; the Osteopathic Initiative Act or the Chiropractic Initiative Act; the Health and Safety Code, as specified; or any licensed clinic, health dispensary, or health facility, as specified. The term does not include insurance institutions, as defined. (Civ. Code § 56.05(o).)
5. Provides that any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(b).)
6. Provides that any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(d).)
7. Requires the California Department of Technology (CDT) to conduct a comprehensive inventory of all high-risk ADS that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. It defines the relevant terms:
   1. “Automated decision system” means a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons. “Automated decision system” does not include a spam email filter, firewall, antivirus software, identity and access management tools, calculator, database, dataset, or other compilation of data.
   2. “High-risk automated decision system” means an ADS that is used to assist or replace human discretionary decisions that have a legal or similarly significant effect, including decisions that materially impact access to, or approval for, housing or accommodations, education, employment, credit, health care, and criminal justice. (Government [Gov.] Code § 11546.45.5.)

This bill:

1. Provides that a business that offers a “healthcare chatbot” to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to CMIA. It explicitly does not make such a business a provider of health care for purposes of any law other than CMIA.
2. Defines a “health care chatbot” as a GenAI system with a natural language interface that provides adaptive, human-like responses to user inputs, is marketed as facilitating or supporting health services to a consumer, and uses health care chatbot information to facilitate mental or physical health services to a consumer. “Health care chatbot information” means information related to a consumer’s physical or mental health or wellness that is provided to, inferred by, collected by, or generated by a healthcare chatbot.
3. Requires a health facility, clinic, physician’s office, or office of a group practice to take reasonable steps to ensure that a licensed health care professional retains the ability to exercise independent professional judgment in their care of a patient whenever that care is informed by the output of a “clinical decision support system.”
4. Defines “clinical decision support system” means an artificial intelligence system that produces a prediction, classification, recommendation, evaluation, or analysis that aids clinical decisionmaking related to timing of care, diagnosis, or treatment. “Clinical decision support system” does not include systems that provide appointment management such as booking, canceling and rescheduling appointments, appointment reminders, patient education and pre-visit materials and preparation, and payment processing, to the extent the independent performance of these activities by the system does not require a professional license.
5. Prohibits a health facility, clinic, physician’s office, or office of a group practice from using or deploying a tool, system, or device that includes AI to do the following:
   1. Direct, guide, supervise, or instruct unlicensed personnel in performing any function that requires a professional license.
   2. Independently perform any clinical function that is required by law to be performed by a person with a professional license.
6. Defines the other relevant terms, including cross-referencing existing definitions for AI and GenAI and importing the definition of ADS from existing law.
7. Deems a violation by a physician subject to the jurisdiction of the Medical Board of California or Osteopathic Medical Board of California, as appropriate.
8. Clarifies that it does not prohibit the use of AI for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records.

Background

The introduction and rapid development of GenAI systems have proven transformative across many fields, with healthcare standing out as one of the most profoundly impacted sectors. From accelerating drug discovery and streamlining clinical documentation to enabling early disease detection and personalizing treatment plans, GenAI holds extraordinary promise for improving patient outcomes and reducing the burden on overstretched medical systems. Relevant here, healthcare chatbots and AI-powered ADS have emerged as popular tools in the healthcare industry and in the broader market. However, these innovations have not come without serious concerns. On the privacy front, these systems routinely handle deeply sensitive patient and consumer data, raising questions about how that information is stored, who has access to it, and whether it could be vulnerable to breaches or misuse in ways that violate patient confidentiality and consumer expectations. From a safety perspective, the stakes are even higher; a miscalibrated or hallucinating AI model that provides inaccurate medical advice could delay critical care, recommend contraindicated treatments, or fail to recognize a life-threatening emergency, with potentially fatal consequences. As the technology continues to evolve at pace, regulators, clinicians, and developers face the urgent challenge of ensuring that the benefits of AI in healthcare are realized without compromising the trust, security, and well-being of patients.

This bill takes on the challenge by first bringing businesses offering “healthcare chatbots” within the protective ambit of the CMIA. The bill also places guardrails around the deployment of ADS and other GenAI systems in the context of patient care. The bill is sponsored by the California Nurses Association. It is supported by various organizations, including the California Federation of Labor Unions. It is opposed by various tech industry and healthcare associations, including Scripps Health and Technet. For a more thorough analysis, please see the Senate Privacy, Digital Technologies, and Consumer Protection Committee analysis.

Comment

According to the author:

AI is rapidly integrating into our health care system and reshaping our own personal experience with health care. While this technology can hold a lot of promise, there is no question that without careful consideration of the potential perpetuation of biases, risks to patient safety, and challenges of clinical workers knowing what to question and what to trust, the deployment of AI in health care can do more harm than good. A 2023 study found that, while carefully crafted AI could slightly improve diagnostic accuracy for certain disorders, in cases where clinicians were provided AI support using a systematically biased model, diagnostic accuracy dropped substantially to 62% (from 73%). This also demonstrates that having a human-in-the-loop is not a panacea for all the challenges that AI can present. Providing health care requires compassion, empathy, and real-world judgment that cannot be captured in patterns and algorithms. Technology should assist human clinicians, not replace them. As AI deploys into health care settings it is also reaching consumers directly through applications like Copilot and ChatGPT offering to connect directly to personal medical records. Voluntary commitments to protect this sensitive information are not enough, we must ensure any entity accessing medical records for managing health is abiding by the law.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

According to the Senate Appropriations Committee:

Costs of an unknown amount to the California Department of Public Health (CDPH) to ensure health facilities, clinics, and physician offices comply with the provisions of this bill. If CDPH adopts regulations, one-time costs could be in the hundreds of thousands of dollars (Licensing and Certification Fund).

The Department of Consumer Affairs reports most healing arts boards anticipate an increase in workload due to a higher volume of complaints resulting from this bill. However, the boards are unable to estimate the increase in complaint volume or related enforcement costs due to the lack of data on how frequently artificial intelligence (AI) violations occur (various special funds).

Potentially significant costs to the Department of Justice (DOJ) to bring civil actions for violations against any person who engages in a deceptive act or practice. Actual costs will depend on the number of enforcement actions pursued by DOJ and the amount of additional work created by each action, but costs may be in the hundreds of thousands of dollars annually. In addition, the Unfair Competition Law provides private plaintiff actions. (Unfair Competition Law Fund).

Cost pressures of an unknown but potentially significant amount to the courts to adjudicate any additional filings. Although courts are not funded based on workload, increased pressure on the Trial Court Trust Fund may create a demand for increased funding for courts.  The proposed FY 2026-07 Governor’s budget would provide $70 million General Fund support (Trial Court Trust Fund, General Fund).

SUPPORT: (Verified 8/20/26)

California Nurses Association (source)

Board of Behavioral Sciences
California Federation of Labor Unions, AFL-CIO
Consumer Watchdog
Department of Consumer Affairs, Board of Psychology
Techequity Action

OPPOSITION: (Verified 8/20/26)

Advanced Medical Technology Association (ADVAMED)

American Telemedicine Association, Ata Action

California Dental Association

California Radiological Society
Connected Health Initiative
Epic
Greater Conejo Valley Chamber of Commerce

Scripps Health
Technet

ARGUMENTS IN SUPPORT: The California Nurses Association writes:

AB 1979 ensures that clinical decisions are not made solely based on the output of an AI tool. When a health facility, clinic, physician office, or group practice uses a clinical decision support system in patient care, the bill requires that a licensed health care professional independently review and approve the clinical decisions and exercise their professional judgment. The bill also prohibits health care entities from using AI tools to direct unlicensed personnel to perform functions that require a professional license. Finally, AB 1979 ensures that health care chatbots that collect and use sensitive health information are subject to California’s medical confidentiality laws.

These are commonsense guardrails on the use of AI tools in patient care. AB 1979 does not ban supportive AI tools. It simply ensures that AI tools cannot become the decision maker in patient care and that patients do not lose medical privacy protections when their health information passes through an AI-enabled platform.

ARGUMENTS IN OPPOSITION: Scripps Health writes in an oppose-unless-amended position:

As drafted, AB 1979 does not clearly distinguish between AI that supports clinical decision-making and AI that replaces it. Its broad definitions could restrict widely used, patient-centered technologies already integrated into routine care, including predictive alerts, clinical documentation tools, and electronic health record functions. The bill also places hospitals in the untenable position of having to “ensure” that individual clinicians do not rely solely on AI output, creating a standard that is difficult to operationalize and misaligned with how accountability is exercised in clinical practice.

In addition, AB 1979 may conflict with existing state requirements related to electronic health records and data exchange, where hospitals rely on software tools to organize and surface critical patient information for timely clinical use.

ASSEMBLY FLOOR: 48-15, 5/21/26

AYES: Addis, Aguiar-Curry, Ahrens, Alvarez, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Caloza, Connolly, Elhawary, Fong, Gabriel, Mark González, Haney, Harabedian, Hart, Irwin, Jackson, Kalra, Krell, Lee, Lowenthal, McKinnor, Muratsuchi, Nguyen, Ortega, Papan, Patel, Pellerin, Petrie-Norris, Quirk-Silva, Ransom, Rogers, Schiavo, Schultz, Sharp-Collins, Solache, Soria, Stefani, Ward, Wicks, Zbur, Rivas

NOES: Alanis, Ávila Farías, Castillo, DeMaio, Dixon, Ellis, Jeff Gonzalez, Hadwick, Johnson, Macedo, Patterson, Sanchez, Ta, Tangipa, Wallis

NO VOTE RECORDED: Arambula, Carrillo, Chen, Davies, Flora, Gallagher, Garcia, Gipson, Hoover, Lackey, Pacheco, Ramos, Celeste Rodriguez, Michelle Rodriguez, Blanca Rubio, Valencia, Wilson

Prepared by: Christian Kurpiewski / P., D.T., & C.P. / (916) 651-1548

8/24/26 14:00:16

**** END ****

 THIRD READING  

Bill No: AB 1979

Author: Bonta (D)

Amended: 7/2/26 in Senate

Vote: 21

SENATE PRIV., DIGITAL TECH. & CONS. PROT. COMMITTEE: 7-2, 6/15/26

AYES: Cabaldon, Gonzalez, McNerney, Padilla, Reyes, Umberg, Wiener

NOES: Jones, Ochoa Bogh

SENATE HEALTH COMMITTEE: 8-0, 7/1/26

AYES: Weber Pierson, Caballero, Durazo, Gonzalez, Menjivar, Padilla, Pérez, Smallwood-Cuevas

NO VOTE RECORDED: Valladares, Grove, Rubio

SENATE APPROPRIATIONS COMMITTEE: 5-2, 8/13/26

AYES: Cervantes, Cabaldon, Grayson, Richardson, Wahab

NOES: Seyarto, Dahle

ASSEMBLY FLOOR: 48-15, 5/21/26 - See last page for vote

SUBJECT: Health care services: artificial intelligence

SOURCE: California Nurses Association

DIGEST:

This bill subjects businesses offering “health care chatbots” to the California Medical Information Act (CMIA) and imposes guardrails around the use of automated decision systems (ADS) and other generative AI (GenAI) models in patient care.

ANALYSIS:

Existing federal law:

1. Establishes the Health Insurance Portability and Accountability Act (HIPAA), which provides privacy protections for patients’ protected health information and generally prohibits a covered entity, as defined (health plan, health care provider, and health care clearing house), from using or disclosing protected health information except as specified or as authorized by the patient in writing. (Title 45 Code of Federal Regulations (C.F.R.) § 164.500 et seq.)
2. Provides that if HIPAA’s provisions conflict with a provision of state law, the provision that is the most protective of patient privacy prevails. (45 C.F.R. § 164.500 et seq.)

Existing state law:

1. Establishes the CMIA, which establishes protections for the use of medical information. (Civil (Civ.) Code § 56 et seq.)
2. Prohibits providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code § 56.10.)
3. Provides that every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to remedies and penalties, as specified. (Civ. Code § 56.101.)
4. Defines “provider of health care,” for purposes of CMIA, to mean any person licensed or certified pursuant to the Business and Professions Code, as specified; the Osteopathic Initiative Act or the Chiropractic Initiative Act; the Health and Safety Code, as specified; or any licensed clinic, health dispensary, or health facility, as specified. The term does not include insurance institutions, as defined. (Civ. Code § 56.05(o).)
5. Provides that any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(b).)
6. Provides that any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(d).)
7. Requires the California Department of Technology (CDT) to conduct a comprehensive inventory of all high-risk ADS that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. It defines the relevant terms:
   1. “Automated decision system” means a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons. “Automated decision system” does not include a spam email filter, firewall, antivirus software, identity and access management tools, calculator, database, dataset, or other compilation of data.
   2. “High-risk automated decision system” means an ADS that is used to assist or replace human discretionary decisions that have a legal or similarly significant effect, including decisions that materially impact access to, or approval for, housing or accommodations, education, employment, credit, health care, and criminal justice. (Gov. Code § 11546.45.5.)

This bill:

1. Provides that a business that offers a “healthcare chatbot” to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to CMIA. It explicitly does not make such a business a provider of health care for purposes of any law other than CMIA.
2. Defines a “health care chatbot” as a GenAI system with a natural language interface that provides adaptive, human-like responses to user inputs, is marketed as facilitating or supporting health services to a consumer, and uses health care chatbot information to facilitate mental or physical health services to a consumer. “Health care chatbot information” means information related to a consumer’s physical or mental health or wellness that is provided to, inferred by, collected by, or generated by a healthcare chatbot.
3. Requires a health facility, clinic, physician’s office, or office of a group practice to take reasonable steps to ensure that a licensed health care professional retains the ability to exercise independent professional judgment in their care of a patient whenever that care is informed by the output of a “clinical decision support system.” “Clinical decision support system” means an ADS or GenAI system that produces a prediction, classification, recommendation, evaluation, or analysis used to inform clinical decisionmaking with respect to the provision, timing, or course of patient care.
4. Prohibits a health facility, clinic, physician’s office, or office of a group practice from using or deploying a tool, system, or device that includes AI to do the following:
   1. Direct, guide, supervise, or instruct unlicensed personnel in performing any function that requires a professional license.
   2. Independently perform any clinical function that is required by law to be performed by a person with a professional license.
5. Defines the other relevant terms, including cross-referencing existing definitions for AI and GenAI and importing the definition of ADS from existing law.
6. Subjects violations to the enforcement mechanisms available under existing California healthcare licensing laws. The bill also deems a violation by a physician subject to the jurisdiction of the Medical Board of California or Osteopathic Medical Board of California, as appropriate.
7. Clarifies that it does not prohibit the use of AI for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records.

Background

The introduction and rapid development of GenAI systems have proven transformative across many fields, with healthcare standing out as one of the most profoundly impacted sectors. From accelerating drug discovery and streamlining clinical documentation to enabling early disease detection and personalizing treatment plans, GenAI holds extraordinary promise for improving patient outcomes and reducing the burden on overstretched medical systems. Relevant here, healthcare chatbots and AI-powered ADS have emerged as popular tools in the healthcare industry and in the broader market. However, these innovations have not come without serious concerns. On the privacy front, these systems routinely handle deeply sensitive patient and consumer data, raising questions about how that information is stored, who has access to it, and whether it could be vulnerable to breaches or misuse in ways that violate patient confidentiality and consumer expectations. From a safety perspective, the stakes are even higher; a miscalibrated or hallucinating AI model that provides inaccurate medical advice could delay critical care, recommend contraindicated treatments, or fail to recognize a life-threatening emergency, with potentially fatal consequences. As the technology continues to evolve at pace, regulators, clinicians, and developers face the urgent challenge of ensuring that the benefits of AI in healthcare are realized without compromising the trust, security, and well-being of patients.

This bill takes on the challenge by first bringing businesses offering “healthcare chatbots” within the protective ambit of the CMIA. This bill also places guardrails around the deployment of ADS and other GenAI systems in the context of patient care. This bill is sponsored by the California Nurses Association. It is supported by various organizations, including the California Federation of Labor Unions. It is opposed by various tech industry and healthcare associations, including Scripps Health and Technet. For a more thorough analysis, please see the Senate Privacy, Digital Technologies, and Consumer Protection Committee analysis.

Comment

According to the author:

AI is rapidly integrating into our health care system and reshaping our own personal experience with health care. While this technology can hold a lot of promise, there is no question that without careful consideration of the potential perpetuation of biases, risks to patient safety, and challenges of clinical workers knowing what to question and what to trust, the deployment of AI in health care can do more harm than good. A 2023 study found that, while carefully crafted AI could slightly improve diagnostic accuracy for certain disorders, in cases where clinicians were provided AI support using a systematically biased model, diagnostic accuracy dropped substantially to 62% (from 73%). This also demonstrates that having a human-in-the-loop is not a panacea for all the challenges that AI can present. Providing health care requires compassion, empathy, and real-world judgment that cannot be captured in patterns and algorithms. Technology should assist human clinicians, not replace them. As AI deploys into health care settings it is also reaching consumers directly through applications like Copilot and ChatGPT offering to connect directly to personal medical records. Voluntary commitments to protect this sensitive information are not enough, we must ensure any entity accessing medical records for managing health is abiding by the law.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

According to the Senate Appropriations Committee:

Costs of an unknown amount to the California Department of Public Health (CDPH) to ensure health facilities, clinics, and physician offices comply with the provisions of this bill. If CDPH adopts regulations, one-time costs could be in the hundreds of thousands of dollars (Licensing and Certification Fund).

The Department of Consumer Affairs reports most healing arts boards anticipate an increase in workload due to a higher volume of complaints resulting from this bill. However, the boards are unable to estimate the increase in complaint volume or related enforcement costs due to the lack of data on how frequently artificial intelligence (AI) violations occur (various special funds).

Potentially significant costs to the Department of Justice (DOJ) to bring civil actions for violations against any person who engages in a deceptive act or practice. Actual costs will depend on the number of enforcement actions pursued by DOJ and the amount of additional work created by each action, but costs may be in the hundreds of thousands of dollars annually. In addition, the Unfair Competition Law provides private plaintiff actions. (Unfair Competition Law Fund).

Cost pressures of an unknown but potentially significant amount to the courts to adjudicate any additional filings. Although courts are not funded based on workload, increased pressure on the Trial Court Trust Fund may create a demand for increased funding for courts.  The proposed FY 2026-07 Governor’s budget would provide $70 million General Fund support (Trial Court Trust Fund, General Fund).

SUPPORT: (Verified 8/13/2026)

California Nurses Association (Source)

Board of Behavioral Sciences
California Federation of Labor Unions, AFL-CIO
Consumer Watchdog
Department of Consumer Affairs, Board of Psychology
Techequity Action

OPPOSITION: (Verified 8/13/2026)

Advanced Medical Technology Association

American Telemedicine Association, Ata Action

California Dental Association

California Radiological Society
Connected Health Initiative
Epic
Greater Conejo Valley Chamber of Commerce

Scripps Health
Technet

ARGUMENTS IN SUPPORT: The California Nurses Association writes:

AB 1979 ensures that clinical decisions are not made solely based on the output of an AI tool. When a health facility, clinic, physician office, or group practice uses a clinical decision support system in patient care, the bill requires that a licensed health care professional independently review and approve the clinical decisions and exercise their professional judgment. The bill also prohibits health care entities from using AI tools to direct unlicensed personnel to perform functions that require a professional license. Finally, AB 1979 ensures that health care chatbots that collect and use sensitive health information are subject to California’s medical confidentiality laws.

These are commonsense guardrails on the use of AI tools in patient care. AB 1979 does not ban supportive AI tools. It simply ensures that AI tools cannot become the decision maker in patient care and that patients do not lose medical privacy protections when their health information passes through an AI-enabled platform.

ARGUMENTS IN OPPOSITION: Scripps Health writes in an oppose-unless-amended position:

As drafted, AB 1979 does not clearly distinguish between AI that supports clinical decision-making and AI that replaces it. Its broad definitions could restrict widely used, patient-centered technologies already integrated into routine care, including predictive alerts, clinical documentation tools, and electronic health record functions. The bill also places hospitals in the untenable position of having to “ensure” that individual clinicians do not rely solely on AI output, creating a standard that is difficult to operationalize and misaligned with how accountability is exercised in clinical practice.

In addition, AB 1979 may conflict with existing state requirements related to electronic health records and data exchange, where hospitals rely on software tools to organize and surface critical patient information for timely clinical use.

ASSEMBLY FLOOR: 48-15, 5/21/26

AYES: Addis, Aguiar-Curry, Ahrens, Alvarez, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Caloza, Connolly, Elhawary, Fong, Gabriel, Mark González, Haney, Harabedian, Hart, Irwin, Jackson, Kalra, Krell, Lee, Lowenthal, McKinnor, Muratsuchi, Nguyen, Ortega, Papan, Patel, Pellerin, Petrie-Norris, Quirk-Silva, Ransom, Rogers, Schiavo, Schultz, Sharp-Collins, Solache, Soria, Stefani, Ward, Wicks, Zbur, Rivas

NOES: Alanis, Ávila Farías, Castillo, DeMaio, Dixon, Ellis, Jeff Gonzalez, Hadwick, Johnson, Macedo, Patterson, Sanchez, Ta, Tangipa, Wallis

NO VOTE RECORDED: Arambula, Carrillo, Chen, Davies, Flora, Gallagher, Garcia, Gipson, Hoover, Lackey, Pacheco, Ramos, Celeste Rodriguez, Michelle Rodriguez, Blanca Rubio, Valencia, Wilson

Prepared by: Christian Kurpiewski / P., D.T., & C.P. / (916) 651-1548

8/14/26 13:38:32

**** END ****

SENATE COMMITTEE ON

Senator Sabrina Cervantes, Chair

2025 - 2026 Regular Session

AB 1979 (Bonta) - Health care services: artificial intelligence

Bill Summary:

AB 1979 would require health care providers that offer health care chatbots comply with the California Medical Information Act for the purposes of protecting private health information.

Fiscal Impact:

Costs of an unknown amount to the California Department of Public Health (CDPH) to ensure health facilities, clinics, and physician offices comply with the provisions of this bill. If CDPH adopts regulations, one-time costs could be in the hundreds of thousands of dollars (Licensing and Certification Fund).

The Department of Consumer Affairs reports most healing arts boards anticipate an increase in workload due to a higher volume of complaints resulting from this bill. However, the boards are unable to estimate the increase in complaint volume or related enforcement costs due to the lack of data on how frequently artificial intelligence (AI) violations occur (various special funds).

Potentially significant costs to the Department of Justice (DOJ) to bring civil actions for violations against any person who engages in a deceptive act or practice. Actual costs will depend on the number of enforcement actions pursued by DOJ and the amount of additional work created by each action, but costs may be in the hundreds of thousands of dollars annually. In addition, Civil Code Section 56.36 provides private plaintiff actions.

Cost pressures of an unknown but potentially significant amount to the courts to adjudicate any additional filings. Although courts are not funded based on workload, increased pressure on the Trial Court Trust Fund may create a demand for increased funding for courts.  The proposed FY 2026-07 Governor’s budget would provide $70 million General Fund support (Trial Court Trust Fund, General Fund).

SENATE COMMITTEE ON

Senator Sabrina Cervantes, Chair

2025 - 2026 Regular Session

AB 1979 (Bonta) - Health care services: artificial intelligence

Bill Summary:

AB 1979 would require health care providers that offer health care chatbots comply with the California Medical Information Act for the purposes of protecting private health information.

Fiscal Impact:

Costs of an unknown amount to the California Department of Public Health (CDPH) to ensure health facilities, clinics, and physician offices comply with the provisions of this bill. If CDPH adopts regulations, one-time costs could be in the hundreds of thousands of dollars (Licensing and Certification Fund).

The Department of Consumer Affairs reports most healing arts boards anticipate an increase in workload due to a higher volume of complaints resulting from this bill. However, the boards are unable to estimate the increase in complaint volume or related enforcement costs due to the lack of data on how frequently artificial intelligence (AI) violations occur (various special funds).

Potentially significant costs to the Department of Justice (DOJ) to bring civil actions for violations against any person who engages in a deceptive act or practice. Actual costs will depend on the number of enforcement actions pursued by DOJ and the amount of additional work created by each action, but costs may be in the hundreds of thousands of dollars annually. In addition, the Unfair Competition Law provides private plaintiff actions. (Unfair Competition Law Fund).

Cost pressures of an unknown but potentially significant amount to the courts to adjudicate any additional filings. Although courts are not funded based on workload, increased pressure on the Trial Court Trust Fund may create a demand for increased funding for courts.  The proposed FY 2026-07 Governor’s budget would provide $70 million General Fund support (Trial Court Trust Fund, General Fund).

Staff Comments:

Unlike the AG, who may seek significant civil penalties for UCL violations, the remedies available to private plaintiffs are more limited. They may seek neither penalties nor damages to compensate for injuries caused by the violation. Instead, private plaintiffs may seek an injunction to halt the unfair, unlawful or fraudulent practice and restitution of any gains obtained as a result of the violation. Private UCL actions are tried before a judge, who has the sole discretion to determine if the alleged wrongful act is an unfair, fraudulent, or unlawful business practice and to determine the appropriate equitable remedy. A court may order restitution in a UCL action without individual proof of injury if it determines that such a remedy is necessary to prevent the unfair practice.

SENATE COMMITTEE ON HEALTH

Senator Akilah Weber Pierson, Chair

BILL NO: AB 1979

SUBJECT: Health care services: artificial intelligence

SUMMARY:

Adds businesses that offer “health care chatbots” to the California Medical Information Act to ensure that they are held to the same requirements to protect private health information as health care providers. Requires a health facility, clinic, physician’s office, or office of a group practice to ensure that no clinical decision is based solely on the output of a clinical decision support system.

Existing law:

1. Establishes the Confidentiality of Medical Information Act (CMIA), which prohibits a health care provider, health care service plan, or contractor from disclosing medical information regarding a patient without first obtaining authorization. [CIV §56, et. seq.]
2. Defines “medical information,” for purposes of the CMIA, as any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. [CIV §56.05]
3. Defines “provider of health care,” for purposes of the CMIA, as any licensed or certified health care provisional, and any clinic, health dispensary, or health facility. [CIV §56.05(o)]
4. Requires any business organized for the purposes of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for the purposes of allowing the individual to manage his or her information, or for the diagnosis or treatment of the individual, to be deemed a provider of health care subject to the CMIA. [CIV §56.06(a)]
5. Establishes the California Department of Public Health (CDPH) which licenses and regulates health facilities and clinics. [HSC §1200, et seq. and §1250, et seq.]
6. Defines “clinic” as an organized outpatient health facility that provides direct medical, surgical, dental, optometric, or podiatric advice, services, or treatment to patients who remain less than 24 hours, and that may also provide diagnostic or therapeutic services to patients in the home as an incident to care provided at the clinic facility. [HSC §1200, et seq.]
7. Defines “health facility” to mean a facility, place, or building that is organized, maintained, and operated for the diagnosis, care, prevention, and treatment of human illness, physical or mental, including convalescence and rehabilitation and including care during and after pregnancy, or for any one or more of these purposes, for one or more persons, to which the persons are admitted for a 24-hour stay or longer, including, but not limited to, hospitals, nursing facilities, and hospice facilities. [HSC §1250]
8. Requires a health facility, clinic, physician’s office, or office of a group practice that uses generative artificial intelligence (AI) to generate written or verbal patient communications pertaining to patient clinical information to ensure that those communications include a disclaimer, as specified, that indicates to the patient that the communication was generated by generative AI, and clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person. Exempts communications generated by generative AI from this requirement if it is read and reviewed by a human licensed or certified health care provider. [HSC §1339.75]
9. Defines the following terms for purposes of 4) above:
   1. “Artificial intelligence” means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments; and,
   2. “Generative artificial intelligence” means AI that can generate derived synthetic content, including images, videos, audio, text, and other digital content. [HSC §1339.75(c)]
10. Establishes the California Privacy Protection Agency (CPPA) to implement and enforce the California Privacy Rights Act of 2020, and provides the CPPA with the full administrative power, authority and jurisdiction to implement and enforce the California Consumer Privacy Act of 2018, including responsibilities to update existing regulations and adopt new regulations. [CIV §1798.100, et seq.]
11. Requires the Department of Technology to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Defines “high-risk automated decision system” as an automated decision system that is used to assist or replace human discretionary decisions that have a legal or similarly significant effect, including decisions that materially impact access to, or approval for, housing or accommodations, education, employment, credit, health care, and criminal justice. [GOV §11546.45.5]

This bill:

1. Defines “artificial intelligence” and “generative artificial intelligence,” for purposes of the CMIA, as having the same meaning as definitions described in Existing Law 5) above.
2. Defines “health care chatbot” as a generative AI system with a natural language interface that:
   1. Provides adaptive, human-like responses to user inputs;
   2. Is marketed as facilitating or supporting health services to a consumer; and,
   3. Uses health care chatbot information to facilitate or support health services to a consumer. Defines “health care chatbot information” as information related to a consumer’s physical or mental health or wellness that a consumer provides to a chatbot, either directly or by allowing access to information, or is collected, generated, or inferred by a chatbot.
3. Deems any business that offers a health care chatbot to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be deemed to be a provider of health care subject to the requirements of the CMIA. However, prohibits this provision from being construed to make a business a provider of health care for purposes of any law other than the CMIA.
4. Requires a health facility, clinic, physician’s office, or office of a group practice to ensure that no clinical decision is based solely on the output of a clinical decision support system.
5. Requires a health facility, clinic, physician’s office, or office of a group practice to ensure that a licensed health care professional, acting within their scope of practice, retains the ability to exercise independent professional judgment when reviewing and approving a clinical decision that is based on the output of a clinical decision support system.
6. Defines “clinical decision,” as including, but is not being limited to, assessment of patient condition and education of a patient or their family concerning the patient’s health care problems, including postdischarge care.
7. Prohibits a health facility, clinic, physician’s office, or office of a group practice from using or deploying a tool, system, or devices that includes artificial intelligence to direct, guide, supervise, or instruct unlicensed personnel in their performance of any clinical function that is required by law to be performed by a person with a professional license.
8. Specifies that a violation of this bill by a licensed health facility or a clinic is subject to existing provisions of law establishing misdemeanor penalties for violations of laws governing health facilities and clinics, with a fine of up to $1,000 or imprisonment in the county jail for up to 180 days, or both.
9. Specifies that a violation of this bill constitutes “unfair competition,” subject to civil penalties of up to $2,500 per violation as provided for in the Unfair Competition Law.
10. Specifies that to the extent that a violation of this bill constitutes the practice of a health care profession without a license, permits the appropriate licensing board to pursue an injunction or restraining order, as authorized by existing law. Prohibits anything in this bill from limiting the authority for a licensing board to pursue any remedy otherwise authorized under the law.
11. Exempts the use of automated decision systems for documentation and communication that does not involve the application of professional judgment, including, but not limited to, automated messages to inform patients of updates to their health records, generating reminders, or assisting patients to find information at their request.
12. Defines various terms for purposes of this bill, including:
    1. “Automated decision system” means a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons; and,
    2. “Clinical decision support system” means an automated decision system or generative artificial intelligence system whose outputs are used to inform clinical decisionmaking with respect to the provision, timing, or course of patient care.

FISCAL EFFECT:

According to the Assembly Appropriations Committee, costs of an unknown amount to CDPH to ensure health facilities, clinics, and physician offices comply with the provisions of this bill. If CDPH adopts regulations, one-time costs could be in the hundreds of thousands of dollars (Licensing and Certification Fund). The Department of Consumer Affairs reports most healing arts boards anticipate an increase in workload due to a higher volume of complaints resulting from this bill. However, the boards are unable to estimate the increase in complaint volume or related enforcement costs due to the lack of data on how frequently AI violations occur (various special funds). Costs of an unknown but potentially significant amount to the Department of Justice (DOJ) to bring enforcement actions as authorized by this bill. Actual costs will depend on the number of enforcement actions pursued by DOJ and the amount of additional work created by each action, but costs may be in the hundreds of thousands of dollars annually. (Unfair Competition Law Fund). Cost pressures of an unknown but potentially significant amount to the courts to adjudicate any additional filings (Trial Court Trust Fund, General Fund). Actual costs will depend on the number of cases filed and the amount of court time needed to resolve each case. It generally costs approximately $1,000 to operate a courtroom for one hour. Although courts are not funded based on workload, increased pressure on the Trial Court Trust Fund may create a demand for increased funding for courts from the General Fund. The state budget provides annual General Fund backfills to the Trial Court Trust Fund to offset revenue reductions, totaling approximately $117.3 million in 2025-26.

PRIOR VOTES:

COMMENTS:

1. Author’s statement. According to the author, AI is rapidly integrating into our health care system and reshaping our own personal experience with health care. While this technology can hold a lot of promise, there is no question that without careful consideration of the potential perpetuation of biases, risks to patient safety, and challenges of clinical workers knowing what to question and what to trust, the deployment of AI in health care can do more harm than good. A 2023 study found that, while carefully crafted AI could slightly improve diagnostic accuracy for certain disorders, in cases where clinicians were provided AI support using a systematically biased model, diagnostic accuracy dropped substantially to 62% (from 73%). This also demonstrates that having a human-in-the-loop is not a panacea for all the challenges that AI can present. Providing health care requires compassion, empathy, and real-world judgment that cannot be captured in patterns and algorithms. Technology should assist human clinicians, not replace them. As AI deploys into health care settings it is also reaching consumers directly through applications like Copilot and ChatGPT offering to connect directly to personal medical records. Voluntary commitments to protect this sensitive information are not enough, we must ensure any entity accessing medical records for managing health is abiding by the law.
2. Generative AI in health care. According to a July 25, 2023 viewpoint article in the Journal of the American Medical Association, “Generative AI in Health Care and Liability Risks for Physicians and Safety Concerns for Patients,” generative AI is being heralded in the medical field for its potential to ease the long-lamented burden of medical documentation by generating visit notes, treatment codes, and medical summaries. This article stated that to date, no court in the U.S. has considered the question of liability for medical injuries caused by relying on AI-generated information. The article warned that to minimize risks, even medical professionals must exercise caution when relying on AI-generated information, due to the “black-box” nature of how these systems generate output, because it may be impossible for the physician to independently evaluate the accuracy of the AI’s output. An article in Implement Science, published in March 2024, stated that the utility and impact of generative AI in healthcare remain poorly understood, with concerns about ethical and legal implications, integration into healthcare service delivery, and workforce utilization. The American Medical Association (AMA) published “Principles for Augmented Intelligence Development, Deployment, and Use,” which was approved by the AMA Board of Trustees on November 14, 2023. According to this AMA document, as the number of AI-enabled health care tools and systems continue to grow, these technologies must be designed, developed, and deployed in a manner that is ethical, equitable, responsible, and transparent. The AMA notes that while the U.S. Food and Drug Administration (FDA) regulates AI-enabled medical devices, many types of AI-enabled technologies fall outside the scope of FDA oversight, including AI that may have clinical applications, such as some clinical decision support functions. The AMA report specifically looked at transparency in use of AI-enabled systems, and stated that it is essential that use of AI in health care be transparent to both physicians and patients, and disclosure should contribute to physician and patient knowledge and not create unnecessary administrative burden. The AMA report states that when AI is utilized in health care decision-making, that use should be disclosed and documented in order to limit risks to, and mitigate inequities for, both physicians and patients. The AMA noted that while transparency does not necessarily ensure AI-enabled tools are accurate, secure, or fair, it is difficult to establish trust if certain characteristics are hidden. According to the AMA, when AI is used in a manner which directly impacts patient care, access to care, or medical decision-making, that use of AI should be disclosed and documented to both physicians and patients. The opportunity for a patient to request additional review from a licensed clinician should be made available upon request. The AMA policy also states that AI tools or systems cannot augment, create, or otherwise generate records, communications, or other content on behalf of a physician without that physician’s consent and final review.
3. Racial bias in algorithms and AI. Several studies have identified risks of racial bias in algorithms and AI. An October 2019 article in the journal Science, “Dissecting racial bias in an algorithm used to manage the health of populations,” found that Black patients assigned the same level of risk by the algorithm are actually sicker than White patients. The study estimated that this racial bias reduces the number of Black patients identified for extra care by more than half. According to the study, bias occurs because the algorithm uses health costs as a proxy for health needs, and because less money is spent on Black patients who have the same level of need, the algorithm falsely concludes that Black patients are healthier than equally sick White patients. The journal NPJ Digital Medicine published a study in 2023, “LLMs propagate race-based medicine,” that assessed four LLMs used in healthcare systems. The study found that all models had examples of perpetuating race-based medicine in their response to questions. Models were not always consistent in their response when asked the same question repeatedly, and that based on their findings, these LLMs could potentially cause harm by perpetuating debunked, racist ideas.
4. Trustworthy AI. The federal Health and Human Services Agency (HHS) has developed a “playbook” for AI development with the goal of maintaining public trust by using AI solutions that are “ethical, effective, and secure,” according to the HHS Chief AI Officer. With regard to HHS agencies, principles have been established for trustworthy AI that “fosters public trust and confidence while protecting privacy, civil rights, civil liberties, and American values, consistent with applicable laws.” The playbook describes AI as whether the solution or system:
   1. Performs tasks under varying and unpredictable circumstances without significant human oversight, or can learn from experience and improvement performance when exposed to data sets;
   2. Uses computer software, physical hardware, or other technology to solve tasks that require human-like perception, thinking, planning, learning, communication, or physical action;
   3. Thinks or acts like a human, including the use of cognitive architecture or neural networks (e.g., developed to mimic the underlying mechanisms of the human mind);
   4. Relies on a set of techniques, including machine learning, to approximate a cognitive task; and,
   5. Is designed to act rationally by utilizing intelligent software or an embodied robot to achieve goals using perception, planning, reasoning, learning, communicating, decision-making, and action.
      

The HHS principles for use of trustworthy AI in government cover six areas: fair and impartial application; transparent and explainable data use; responsible and accountable governance and policies; robust and reliable outputs; safe and secure from risks; and, that privacy should be respected, data not used beyond its intended and stated use, and that its use is approved by the data owner or steward.

1. Double referral. This bill was heard in the Senate Privacy, Digital Technologies, and Consumer Protection Committee on June 15, 2026, and passed with a 7-2 vote.
2. Related legislation. SB 503 (Weber Pierson) would impose requirements on developers and deployers of AI systems used to support clinical decision-making or health care resource allocation, including that they make reasonable efforts to mitigate the risk of biased impacts in the system’s outputs resulting from the use of the systems in health programs or activities. SB 503 is pending on the Assembly Floor.
   
   SB 813 (McNerney) would require the Government Operations Agency to establish the California Artificial Intelligence Standards and Safety Commission to designate “independent verification organizations,” which would ensure compliance with best practices for the prevention of personal injury and property damage and certify qualified AI models or AI applications. SB 813 is set for hearing on July 1, 2026 in the Assembly Privacy and Consumer Protection Committee.
   
   SB 903 (Padilla) would prohibit individuals or corporations from using, advertising, or offering psychotherapy services, including through AI, unless conducted by a licensed health care professional, as defined. Would authorize licensed health care professionals to use AI for limited administrative or supplementary support, as indicated. SB 903 would provide state licensing boards and enforcement agencies the authority to pursue legal recourse for any violations. SB 903 is set for hearing on July 1, 2026 in the Assembly Privacy and Consumer Protection Committee.
   
   AB 1018 (Bauer-Kahan) would regulate the use of automated decision systems (ADS) used to make consequential decisions, as defined, and would require a developer of a covered ADS to take certain actions, including conducting impact assessments. AB 1018 is pending on the Senate Floor.
   
   AB 2575 (Ortega) requires a health facility and other health providers that use or deploy a clinical decision support system for patient care to provide a list of required information, including details on how the system was developed and how it works, to any licensed health care professional or other person that views outputs from a clinical decision support system, 90 days before deploying the system and when onboarding new employees. Prohibits an employer from retaliating or discriminating against a worker based solely on the worker’s override of, or reliance on, the output of a clinical decision support system. Prohibits the failure of a health care worker to override an output of a clinical decision support system from being asserted as a superseding cause severing the defendant’s liability for the alleged harm in a civil action against a defendant who developed or deployed a clinical decision support system that is alleged to have caused harm. AB 2575 is set for hearing on June 29, 2026 in the Senate Privacy, Digital Technologies, and Consumer Protection Committee.
3. Prior legislation. AB 1898 (Schultz of 2026) would have required employers to give workers at least 90 days’ advance written notice before deploying any “workplace AI tool,” defined to include both automated decision systems and AI-based surveillance technologies; required employers to provide workers a notice that, among other disclosures, lists the tools used by the employers, each tool’s purpose, the data it collects, the employment decisions it may affect, and any quotas the tool sets or enforces; and, allowed enforcement by the Labor Commissioner, public prosecutors, and workers themselves, with civil penalties of up to $500 per violation. AB 1898 was held on the Assembly Appropriations Committee suspense file.
   
   SB 7 (McNerney of 2025) would have required an employer, or a vendor engaged by the employer, to provide a written notice that an ADS, for the purpose of making employment-related decisions, is in use at the workplace to a worker who will be directly or indirectly affected by the ADS, as specified. Defined ADS as any computational process derived from machine learning, statistical modeling, data analytics, or AI that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decision-making and materially impacts natural persons. SB 7 was vetoed by the Governor, who stated, in part, that he “shared the author’s concern that in certain cases unregulated use of ADS by employers can be harmful to workers. However, rather than address the specific ways employers misuse this technology, this bill imposes unfocused notification requirements on any business using even the most innocuous tools. This proposed solution fails to directly address incidents of misuse.”
   
   SB 243 (Padilla and Becker, Chapter 677, Statutes of 2025) establishes specified requirements on persons who make a companion chatbot that uses an AI system with a natural language interface, as specified, to protect users.

AB 489 (Bonta, Chapter 615, Statutes of 2025) prohibits AI and generative AI systems from misrepresenting themselves as licensed or certified healthcare professionals and provides state licensing boards or enforcement agencies the authority to pursue legal recourse against developers or deployers of these systems.

SB 1120 (Becker, Chapter 879, Statutes of 2024) establishes requirements on health plans and insurers applicable to their use of AI for utilization review and utilization management decisions, including, that the use of AI, algorithm, or other software must be based upon a patient’s medical or other clinical history and individual clinical circumstances as presented by the requesting provider and not supplant health care provider decision making.

AB 2930 (Bauer-Kahan of 2024) would have regulated the use of ADSs in order to prevent “algorithmic discrimination.” This includes requirements on developers and deployers that make and use these tools to make “consequential decisions” to perform impact assessments on ADSs. AB 2930 would have also established the right of individuals to know when an ADS is being used, the right to opt out of its use, and an explanation of how it is used. AB 2930 died on the Assembly Floor.

AB 3030 (Calderon, Chapter 848, Statutes of 2024) requires a health facility, clinic, physician’s office, or office of a group practice that uses generative AI to generate written or verbal patient communications pertaining to patient clinical information to ensure that those communications include a disclaimer that indicates to the patient that the communication was generated by generative AI and clear instructions on how the patient may contact a human person.

AB 254 (Bauer-Kahan, Chapter 254, Statutes of 2023) added “reproductive or sexual health application information” to the definition of “medical information” in the CMIA.

|AB 858 (Jones-Sawyer of 2022) would have provided that a direct patient care worker at a general acute care hospital and their collective bargaining representative shall be notified of the implementation of new health information technology, may provide input in such implementation, and is permitted to override it, as specified, without fear of discrimination or retaliation. AB 858 was vetoed by the Governor, with his veto message stating it was “Per the request of the author and sponsor.”

1. Support. This bill is sponsored by the California Nurses Association/National Nurses United (CNA) to ensure that clinical decisions are not made solely based on the output of an AI tool. When a health facility, clinic, or physician office uses a clinical decision support system in patient care, this bill requires that a licensed health care professional independently review and approve the clinical decisions and exercise their professional judgment. This bill also prohibits health care entities from using AI tools to direct unlicensed personnel to perform functions that require a professional license. Finally, this bill ensures that health care chatbots that collect and use sensitive health information are subject to California’s medical confidentiality laws. According to CNA, health care employers and technology companies are increasingly introducing AI tools into clinical settings in ways that treat licensed human practice in health care as if it can be easily replicated by software and that expand the collection and use of patient health data. Allowing untested and unaccountable AI outputs to stand in for independent professional judgment is a dangerous approach to patient care. When an AI output becomes the sole basis for a clinical decision or directs unlicensed personnel to perform work that the law reserves for licensed professionals, serious gaps in accountability emerge and patients are placed at risk. According to CNA, nurses and other health care workers report problems with AI-generated handoff reports and clinical materials that are inaccurate, incomplete, or misleading, forcing workers to spend additional time catching and correcting errors instead of caring for patients. These risks underscore why a licensed health care professional must do more than passively review an AI output; they must be able to exercise independent professional judgment before a clinical decision is approved or carried out. The California Federation of Labor states in support that AI systems do not hold professional licenses, do not owe duties to patients, do not exercise human judgment, and cannot be disciplined by a licensing board when they make mistakes. This bill preserves a human in command standard, where licensed health care professionals remain the actual decision maker in health care clinical practice.
2. Opposition. A coalition of opponents, including Kaiser Permanente, American’s Physician Groups, the California Association of Health Plans, and the California Radiological Society, among others, states that this bill imposes rigid statutory constraints on rapidly evolving tools that are already deeply embedded across clinical operations. The coalition states that AI-enabled tools have improved patient health outcomes and reduced patient mortality in addition to improving administrative efficiency and reducing provider burden. Many types of AI have been used extensively in health care for years, such as machine learning and pattern analysis to assist clinicians interpreting imaging and algorithms that provide clinicians with decision support. Opponents state that as currently written, activities like patient education and assessment are currently included in the definition of “clinical decision,” which seems excessively broad. The framing around “clinical decisions” is extremely expansive, explicitly sweeping in patient and family education, post-discharge communication, and routine clinical documentation and handoffs. In practice, this language risks capturing many safety-enhancing uses of AI that augment and assist clinician judgment rather than replace it. The California Hospital Association submitted an oppose unless amended letter, stating that this bill fails to distinguish between AI that informs clinical decisions, and AI that replaces them, and would impose sweeping prohibitions on a wide range of patient-centered technologies that have been widely used for years. CHA states that no AI platform is continued for use by medical professionals in patient care without a thorough assessment and ongoing monitoring for effectiveness and safety.
3. Definition of clinical decision goes beyond decisions. This bill, among other provisions, requires that health care professionals retain the ability to exercise independent professional judgment when reviewing and approving a “clinical decision” that is based on the output of a clinical decision support system. The bill then goes on to define “clinical decision,” for this purpose, as including, but not limited to, “assessment of patient condition and education of a patient or their family concerning the patient’s health care problems, including postdischarge care.” While these activities are an essential part of the role of licensed health care professionals, it is not clear that these activities constitute a “clinical decision,” and the definition does not even mention making treatment decisions or recommendations. If the objective is to ensure that licensed health care professionals retain the ability to exercise independent professional judgment when an AI tool provides a recommendation or other output, this can be done without needing to define “clinical decision.”

SUPPORT AND OPPOSITION:

Support: California Nurses Association (sponsor)
Board of Behavioral Sciences
California Federation of Labor Unions
Consumer Watchdog
National Union of Healthcare Workers
TechEquity Action

Oppose: Advanced Medical Technology Association (unless amended)

Adventist Health
America's Physician Groups (unless amended)
American Telemedicine Association (unless amended)

Anaheim Chamber of Commerce (unless amended)

Biocom California (unless amended)
California Association of Health Plans (unless amended)

California Chamber of Commerce (unless amended)
California Dental Association

California Hospital Association (unless amended)
California Radiological Society (unless amended)
Civil Justice Association of California (unless amended)
Connected Health Initiative
Epic
Glendale Chamber of Commerce
Greater Conejo Valley Chamber of Commerce
Kaiser Permanente (unless amended)
Los Angeles Area Chamber of Commerce
Oceanside Chamber of Commerce
Orange County Business Council
Pasadena Chamber of Commerce and Civic Association
San Diego Regional Chamber of Commerce
San Gabriel Valley Economic Partnership
Santa Monica Chamber of Commerce

Scripps Health (unless amended)
Technet
The Greater Coachella Valley Chamber of Commerce
Tri-County Chamber Alliance

-- END --

SENATE PRIVACY, DIGITAL TECHNOLOGIES, AND CONSUMER PROTECTION COMMITTEE

Senator Christopher Cabaldon, Chair

2025-2026 Regular Session

Bill No: AB 1979 (Author:Bonta)

Version: April 23, 2026

Hearing Date: June 15, 2026

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

Health care services: artificial intelligence

DIGEST

This bill subjects businesses offering “healthcare chatbots” to the California Medical Information Act (CMIA) and imposes guardrails around the use of automated decision systems (ADS) and other generative AI (GenAI) models in clinical decisionmaking.

EXECUTIVE SUMMARY

The introduction and rapid development of GenAI systems have proven transformative across many fields, with healthcare standing out as one of the most profoundly impacted sectors. From accelerating drug discovery and streamlining clinical documentation to enabling early disease detection and personalizing treatment plans, GenAI holds extraordinary promise for improving patient outcomes and reducing the burden on overstretched medical systems. Relevant here, healthcare chatbots and AI-powered ADS have emerged as popular tools in the healthcare industry and in the broader market. However, these innovations have not come without serious concerns. On the privacy front, these systems routinely handle deeply sensitive patient and consumer data, raising questions about how that information is stored, who has access to it, and whether it could be vulnerable to breaches or misuse in ways that violate patient confidentiality and consumer expectations. From a safety perspective, the stakes are even higher; a miscalibrated or hallucinating AI model that provides inaccurate medical advice could delay critical care, recommend contraindicated treatments, or fail to recognize a life-threatening emergency, with potentially fatal consequences. As the technology continues to evolve at pace, regulators, clinicians, and developers face the urgent challenge of ensuring that the benefits of AI in healthcare are realized without compromising the trust, security, and well-being of patients.

This bill takes on the challenge by first bringing businesses offering “healthcare chatbots” within the protective ambit of the CMIA. The bill also places guardrails around the deployment of ADS and other GenAI systems in the clinical decisionmaking context. The bill is sponsored by the California Nurses Association. It is supported by various organizations, including the California Federation of Labor Unions. It is opposed by various tech industry and healthcare associations, including Scripps Health and Technet. Should the bill pass out of this Committee, it will next be heard in the Senate Health Committee.

PROPOSED CHANGES TO THE LAW

Existing federal law:

1. Establishes the Health Insurance Portability and Accountability Act (HIPAA), which provides privacy protections for patients’ protected health information and generally prohibits a covered entity, as defined (health plan, health care provider, and health care clearing house), from using or disclosing protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. § 164.500 et seq.)
2. Provides that if HIPAA’s provisions conflict with a provision of state law, the provision that is the most protective of patient privacy prevails. (45 C.F.R. § 164.500 et seq.)

Existing state law:

1. Establishes the CMIA, which establishes protections for the use of medical information. (Civ. Code § 56 et seq.)
2. Prohibits providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code § 56.10.)
3. Provides that every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to remedies and penalties, as specified. (Civ. Code § 56.101.)
4. Defines “provider of health care,” for purposes of CMIA, to mean any person licensed or certified pursuant to the Business and Professions Code, as specified; the Osteopathic Initiative Act or the Chiropractic Initiative Act; the Health and Safety Code, as specified; or any licensed clinic, health dispensary, or health facility, as specified. The term does not include insurance institutions, as defined. (Civ. Code § 56.05(o).)
5. Provides that any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(b).)
6. Provides that any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(d).)
7. Establishes the Unfair Competition Law (UCL), which provides a statutory cause of action for any unlawful, unfair, or fraudulent business act or practice and unfair, deceptive, untrue, or misleading advertising, including over the internet. (Bus. & Prof. Code § 17200 et seq.)
8. Requires the California Department of Technology (CDT) to conduct a comprehensive inventory of all high-risk ADS that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. It defines the relevant terms:
   1. “Automated decision system” means a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons. “Automated decision system” does not include a spam email filter, firewall, antivirus software, identity and access management tools, calculator, database, dataset, or other compilation of data.
   2. “High-risk automated decision system” means an ADS that is used to assist or replace human discretionary decisions that have a legal or similarly significant effect, including decisions that materially impact access to, or approval for, housing or accommodations, education, employment, credit, health care, and criminal justice. (Gov. Code § 11546.45.5.)

This bill:

1. Provides that a business that offers a “healthcare chatbot” to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to CMIA. It explicitly does not make such a business a provider of health care for purposes of any law other than CMIA.
2. Defines a “healthcare chatbot” as a GenAI system with a natural language interface that provides adaptive, human-like responses to user inputs, collects healthcare chatbot information from a consumer, is marketed as facilitating mental or physical health services to a consumer, and uses the information to facilitate mental or physical health services to a consumer. “Healthcare chatbot information” means information related to a consumer’s physical or mental health or wellness that is provided to, inferred by, or generated by a healthcare chatbot.
3. Requires a health facility, clinic, physician’s office, or office of a group practice to ensure that no clinical decision is based solely on the output of a “clinical decision support system.” “Clinical decision support system” means an ADS or GenAI system whose outputs are used to inform clinical decisionmaking with respect to the provision, timing, or course of patient care.
4. Requires a health facility, clinic, physician’s office, or office of a group practice to ensure that a licensed health care professional exercises independent professional judgment when reviewing and approving a clinical decision that is based on the output of a clinical decision support system.
5. Provides that a “clinical decision” includes assessment of patient condition, education of a patient or their family concerning the patient’s health care problems, including postdischarge care, communication between licensed health care professionals relating to the handoff of responsibility for a patient, and other documentation and communication that requires the application of a licensed health care professional’s professional expertise to a patient’s health.
6. Prohibits a health facility, clinic, physician’s office, or office of a group practice from using or deploying a tool, system, or device that includes AI to direct, guide, supervise, or instruct unlicensed personnel in performing any function that requires a professional license.
7. Defines the other relevant terms, including cross-referencing existing definitions for AI and GenAI and importing the definition of ADS from existing law.
8. Subjects violations to the enforcement mechanisms available under existing California healthcare licensing laws. The bill also deems a violation as unfair competition for purposes of the UCL.
9. Clarifies that it does not prohibit the use of AI for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records.

COMMENTS

1. Privacy concerns emerge when GenAI meets consumer healthcare industry
   1. Healthcare and AI in the consumer market

Developers of GenAI-enabled systems are actively expanding their presence in the consumer healthcare space. Chatbots posing as health professionals have sprouted up across the internet, raising serious consumer privacy and public health concerns. A recent article highlighted the flooding of social media with AI-enabled tools hawking medical information:

AI is easier than ever to produce and as a result, ads with AI talking heads that claim to be medical experts are infiltrating social media’s robust wellness ecosystem. This isn’t isolated to one app. On Facebook, Instagram, X, and TikTok, a particular kind of AI health video — one that uses an AI avatar to convince people of medical expertise — has become the defacto way for accounts to convince people that they, and their unproven products, are legit. Unlike AI images from just a few years ago, many of these videos feature a combination of real footage and AI, which results in avatars who look extremely lifelike at first glance — and are edited exactly the same as direct to camera content that’s popular on video apps.^[1]

The major AI developers have all rolled out products specifically directed to collecting, analyzing, and providing guidance on healthcare. These products are even marketed as tools that you can upload all of your sensitive personal health information to:

Today, health information is often scattered across portals, apps, wearables, PDFs, and medical notes—so it's hard to see the full picture, and people are left to navigate a complex healthcare system on their own. People have shared countless stories of turning to ChatGPT to help make sense of it all. In fact, health is one of the most common ways people use ChatGPT today: based on our de-identified analysis of conversations, over 230 million people globally ask health and wellness related questions on ChatGPT every week.

ChatGPT Health builds on this so responses are informed by your health information and context. You can now securely connect medical records and wellness apps—like Apple Health, Function, and MyFitnessPal—so ChatGPT can help you understand recent test results, prepare for appointments with your doctor, get advice on how to approach your diet and workout routine, or understand the tradeoffs of different insurance options based on your healthcare patterns.^[2]

This growing use of AI chatbots in healthcare settings raises significant privacy concerns, particularly around the handling of sensitive personal health information. Unlike traditional healthcare providers, most general-purpose AI chatbots and platforms are not covered entities under laws like HIPAA, meaning that data shared with them, including symptoms, diagnoses, medications, and mental health disclosures, do not receive the same legal protections as information shared with a doctor or hospital. Users often share highly intimate details with chatbots under an assumption of confidentiality that may not be warranted: that data can potentially be stored, used to train future models, shared with third parties, or exposed in a breach. Despite the potential benefits, these concerns are real, as reported on by the New York Times:

What are the potential benefits?

Medical records have been chaotic and cumbersome for patients to navigate because the information can be scattered across various databases used by different health providers. (A primary care physician could struggle to offer feedback on a foot injury, for example, if the patient’s podiatrist used a different record system.) Microsoft’s A.I. could help connect the dots from many different health providers, along with a user’s fitness device data.

Microsoft said a doctor would probably need hours to manually review all of a person’s medical records and fitness device data to come up with a high-level overview on health. It said Copilot Health could do this in seconds.

“This is about giving consumers and patients incredible insight and intelligence over their own record and helping them navigate very complex challenges and a very complex system that we’ve all created for them,” said Dr. Dominic King, Microsoft’s vice president of health in the A.I. division.

As health care costs have risen, many Americans are dropping coverage. An A.I. chatbot could be a low-cost way to help people pay closer attention to their health and research information on symptoms, similar to a web search on a site like WebMD.

What are the risks?

In recent years, cyberattacks have breached hospitals and health care systems. Putting health records in a central place makes that information a much more tempting target for criminals, said Matthew Green, an associate professor of computer science at Johns Hopkins University. A victim’s health data could expose conditions that he or she would want to keep private.

“There is a pot of gold of high-value data that is in one location that people can get,” Dr. Green said.

Similarly, law enforcement agencies that want an individual’s health records could go to Microsoft instead of multiple providers, said Mario Trujillo, a data privacy lawyer for the Electronic Frontier Foundation, a digital rights nonprofit. A woman pursuing reproductive health care in a state with an abortion ban could be at higher risk, he added.

Also, the Health Insurance Portability and Accountability Act, or HIPAA, which strictly requires traditional health care providers to protect patient privacy, does not apply to tech companies offering chatbots. So these companies, which are not health care providers even when they offer similar services, could do what they wished with health records, such as use the information to train their A.I. or show ads related to a user’s health conditions.

Additionally, the conversational and seemingly empathetic nature of chatbots may lower users’ guard, encouraging disclosure of information they would otherwise carefully protect. Even chatbots marketed specifically for health purposes may operate under terms of service that permit broad data use. As these tools become more embedded in how people seek medical guidance, the gap between user expectations of privacy and the legal reality will only widen.

• 1. Bringing healthcare chatbots under the umbrella of CMIA

CMIA (Civ. Code § 56 et seq.) allows adult patients in California to keep personal health information confidential and decide whether and when to share that information. These provisions seek to protect Californians’ fundamental right to privacy. (Cal. Const., art. I, § 1.) CMIA protects “medical information,” and generally regulates what providers of health care and health care service plans can do with such information.

There has been a steady trend toward Californians and health care professionals relying on digital health products and services. However, when Californians are using various consumer products to gather health information or share their information with these products, they may often fall outside of the protective ambit of laws like HIPAA and even CMIA. This has prompted several recent pieces of legislation to extend the protections of CMIA to these products.

Given the increasingly hostile environment around reproductive and gender-affirming healthcare, AB 254 (Bauer-Kahan, Ch. 254, Stats. 2023) addressed digital services that collect reproductive or sexual health information from consumers and that are offered by businesses for the purpose of allowing individuals to manage that information or even for diagnosis, treatment, or management of a medical condition. AB 254 deemed the application information as medical information and the businesses offering them as providers of health care, bringing them within the protective ambit of CMIA.

Similarly, AB 2089 (Bauer-Kahan, Ch. 690, Stats. 2022) addressed the emergence of mental health digital services that collect mental health information and are offered by businesses for the purpose of allowing individuals to manage their information or even for diagnosis, treatment, or management of a medical condition. Just as in AB 254, AB 2089 deemed the relevant information shared as “medical information” and the businesses offering mental health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, as providers of health care subject to CMIA.

This bill follows this playbook and deems a business that offers a healthcare chatbot, as defined, to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a provider of health care subject to the requirements of CMIA. “Healthcare chatbot” is defined as a GenAI system with a natural language interface that provides adaptive, human-like responses to user inputs, collects healthcare chatbot information from a consumer, is marketed as facilitating mental or physical health services to a consumer, and uses the information to facilitate mental or physical health services to a consumer. “Healthcare chatbot information” means information related to a consumer’s physical or mental health or wellness that is provided to, inferred by, or generated by a healthcare chatbot.

This ensures that such healthcare chatbots are explicitly covered by CMIA. However, it should be noted that existing CMIA provisions may very well already cover many of these products, as indicated by a recent advisory from the Attorney General:

California state medical privacy laws provide protections that are, in some cases, more stringent than federal health privacy laws like HIPAA (the Health Insurance Portability and Accountability Act of 1996, 45 C.F.R. Parts 160 and 164).11 The Confidentiality of Medical Information Act (CMIA) and the Information Practices Act govern the use and disclosure of Californians’ medical information. Covered entities must preserve confidentiality of patients’ medical information and ensure that patients have access to that information. (Civ. Code, §§ 56.10, 56.26, 1798.25.) Sensitive information, including mental and behavioral healthcare and reproductive and sexual healthcare (e.g., abortion and gender affirming care), receive heightened protections. (Civ. Code, § 56.05, subd. (s).) Medical privacy laws apply to governmental healthcare agencies,12 medical providers, and insurance plans, as well as businesses that offer software or hardware to consumers for the purposes of managing medical information, diagnosis or treatment, or management of medical conditions, via mobile applications or other related devices. (Civ. Code, § 56.06, subds. (a), (b).)^[3]

1. Regulating GenAI usage in the provision of healthcare

Concerns are also raised when licensed professionals incorporate AI into their own work. While certain AI systems may be trained on legitimate medical sources and provide real benefits to patients, unlike licensed healthcare providers who undergo years of rigorous training, AI systems alone lack the nuanced clinical judgment needed to properly assess symptoms, consider individual patient history, and account for complex interactions between conditions. When these systems present themselves as medical authorities or simply offer health advice, users may receive inaccurate diagnoses, inappropriate treatment recommendations, or dangerous advice about medication interactions.

A recent study conducted at Stanford found that “AI therapy chatbots may not only lack effectiveness compared to human therapists but could also contribute to harmful stigma and dangerous responses.”^[4] These systems are especially concerning when used by certain vulnerable groups that may be more likely to trust authoritative-sounding medical advice, especially those with limited healthcare access or health or technology literacy.

Referenced above, the California Attorney General released a legal advisory to “provide guidance to healthcare providers, insurers, vendors, investors, and other healthcare entities that develop, sell, and use artificial intelligence (AI) and other automated decision systems about their obligations under California law, including under the state’s consumer protection, civil rights, competition, and data privacy laws.” The advisory states:

AI systems are already widespread within healthcare. As of May 2024, the federal Food and Drug Administration (FDA) had authorized for medical use 981 artificial intelligence or machine learning software devices, and counting. These and other AI systems are being used to guide medical diagnosis and treatment decisions. Hospitals and insurers routinely use non-FDA-approved AI systems for tasks such as appointment scheduling, medical risk assessment, and bill processing.

AI tools have the potential to help improve patient and population health, increase health equity, reduce administrative burdens, and facilitate appropriate information sharing. At the same time, AI risks causing discrimination, denials of needed care and other misallocations of healthcare resources, and interference with patient autonomy and privacy. For example, AI models trained on data that reflect existing biases in healthcare delivery can exacerbate health inequity. Many patients are not aware of when and how AI systems are used in connection with their healthcare. Moreover, AI systems are novel and complex. Their inner workings are often not understood by the healthcare providers using AI, let alone patients receiving care.

Healthcare-related entities that develop, sell, or use AI systems must ensure that their systems comply with laws protecting consumers. This requires understanding how AI systems are trained, what information the systems consider, and how the systems generate output. Developers, researchers, providers, insurers, and related organizations should ensure that AI systems are tested, validated, and audited to ensure that their use is safe, ethical, and lawful, and reduces, rather than replicates or exaggerates, human error and biases. They should also be transparent with patients about whether patient information is being used to train AI and how providers are using AI to make decisions affecting health and healthcare.^[5]

The author frames the issue when AI is incorporated into clinical decision support systems (CDSS):

As AI integrates into clinical work, it can reshape the decision-making process of health care professionals. A critical risk factor in human-computer clinical interaction is "automation bias." This is defined as the psychological tendency for human operators to uncritically defer to automated cues or algorithmic recommendations, even when those cues contradict the user's independent clinical training or experiential knowledge. In the high-pressure environment of modern medicine, clinicians experience significant cognitive load. When presented with an authoritative output, the clinician may be inclined to accept the AI’s conclusion. Automation bias, manifests in two types of errors: omission errors and commission errors. Omission errors occur when humans fail to notice or dismiss AI failures. The risk of omission errors increases in scenarios with high decision flow rates, such as swift assessments of radiology examinations. This risk is worsened by AI-based decisions that are too subtle for human detection. On the other hand, commission errors arise when radiologists mistakenly implement or accept machine decisions despite evidence to the contrary. The phenomenon of automation bias is not only supported by research findings but is also substantiated by extensive anecdotal evidence, spanning domains such as commercial flights, healthcare, and notably, in the context of AI for self-driving cars, as documented in various studies.

CDSS can also result in "alert fatigue." Early iterations of CDSS were frequently characterized by high sensitivity but low specificity, generating excessive, clinically insignificant warnings for minor issues such as low-tier drug-drug interactions or routine laboratory anomalies. This barrage of notifications overwhelms practitioners, effectively burying critical, life-saving alerts in a sea of unimportant messages. “The integration of AI in healthcare CDSS is accompanied by various articulated concerns, including issues related to privacy in data management, workload, inherent biases within AI algorithms, and challenges in explainability. Recent reviews emphasize the adverse impacts of CDSSs on healthcare services. Jankovic and Chen specifically note in a study that despite the high predictive value of CDSS, their usage can contribute to healthcare worker burnout due to excessive and unnecessary alerts. These alerts, while well-intentioned, can diminish efficiency and disrupt the workflow of healthcare services. Additionally, Borum underscores a significant barrier to CDSS in healthcare, which is inaccurate patient information. The presence of such barriers reduces the effectiveness of CDSSs in achieving their intended goal of enhancing patient safety and the quality of care delivered.”

Both automation bias and alert fatigue are systemic liabilities in AI implementation. They highlight that the interaction between the algorithm and the clinician is just as critical to patient safety as the accuracy of the algorithm itself. Effective management of CDSS requires awareness of human-AI interactions to prevent the shifting of clinical roles away from licensed, human professionals.

A recent study that systematically reviewed relevant research on the increasing role GenAI is playing in the healthcare world highlights the technology’s potential but also the critical role of regulatory oversight and the consensus principle that GenAI should enhance but not replace the decisionmaking of licensed professionals:

ChatGPT’s role in summarizing guidelines and assisting in treatment planning within these domains highlights its value in the healthcare sector. However, its limitations must be addressed before broader clinical adoption. Key areas requiring improvement include GenAI transparency, domain-specific training, and stronger GenAI-human collaboration to enhance decision accuracy. Some researchers advocate the integration of ChatGPT as a supplementary tool in clinical workflows, while others emphasize the necessity of regulatory oversight to mitigate the risks related to bias, misinformation, and ethical concerns. The consensus across these studies is that ChatGPT’s capabilities should be rigorously validated and carefully implemented to enhance, rather than replace, human expertise in medical and clinical decision-making.^[6]

To respond to these concerns, the bill imposes a number of guardrails around the use of this technology by health facilities, clinics, physicians’ offices, and other group practices.

First, it requires them to ensure that no clinical decision is based solely on the output of a clinical decision support system and that a licensed health care professional exercises independent professional judgment when reviewing and approving a clinical decision that is based on the output of a clinical decision support system.

“Clinical decision support system” means an ADS or GenAI system whose outputs are used to inform clinical decisionmaking with respect to the provision, timing, or course of patient care. “Clinical decision” includes assessment of patient condition, education of a patient or their family concerning the patient’s health care problems, including postdischarge care, communication between licensed health care professionals relating to the handoff of responsibility for a patient, and other documentation and communication that requires the application of a licensed health care professional’s professional expertise to a patient’s health.

Second, the bill provides that no health facility, clinic, physician’s office, or office of a group practice shall use or deploy a tool, system, or device that includes AI to direct, guide, supervise, or instruct unlicensed personnel in performing any function that requires a professional license. The bill clarifies that it does not prohibit the use of AI for documentation and communication that does not involve the application of professional judgment.

Violations are subject to various existing enforcement mechanisms established in the Health and Safety Code governing the respective entities. Violations are also deemed “unfair competition” for purposes of the UCL. Furthermore, to the extent that a violation constitutes the practice of a health care profession without a license, the appropriate health care professional licensing board is authorized to pursue an injunction or restraining order to enforce these provisions.

As to the existing legal liabilities relevant here, the Attorney General has emphasized that delegating clinical decisionmaking is unlawful and advises healthcare providers to be careful in incorporating this technology:

California’s professional licensing laws provide additional standards to which licensed medical professionals must adhere. (Bus. & Prof. Code, Division 2 (commencing with Section 500).) Only human physicians (and other medical professionals) are licensed to practice medicine in California; California law does not allow delegation of the practice of medicine to AI. Licensed physicians may violate conflict of interest law if they or their family member have a financial interest in AI services and must disclose any financial conflict when consulting with AI organizations. (Lab. Code, § 139.3, subds. (a), (e).) Furthermore, using AI or other automated decision tools to make decisions about patients’ medical treatment, or to override licensed care providers’ determinations about what a patient’s medical needs are, may violate California’s ban on the practice of medicine by corporations and other “artificial legal entities” (Bus. & Prof. Code, § 2400 et seq.), in addition to constituting an “unlawful” or “unfair” business practice under the Unfair Competition Law.

According to the author:

AI is rapidly integrating into our health care system and reshaping our own personal experience with health care. While this technology can hold a lot of promise, there is no question that without careful consideration of the potential perpetuation of biases, risks to patient safety, and challenges of clinical workers knowing what to question and what to trust, the deployment of AI in health care can do more harm than good. A 2023 study found that, while carefully crafted AI could slightly improve diagnostic accuracy for certain disorders, in cases where clinicians were provided AI support using a systematically biased model, diagnostic accuracy dropped substantially to 62% (from 73%). This also demonstrates that having a human-in-the-loop is not a panacea for all the challenges that AI can present. Providing health care requires compassion, empathy, and real-world judgment that cannot be captured in patterns and algorithms. Technology should assist human clinicians, not replace them. As AI deploys into health care settings it is also reaching consumers directly through applications like Copilot and ChatGPT offering to connect directly to personal medical records. Voluntary commitments to protect this sensitive information are not enough, we must ensure any entity accessing medical records for managing health is abiding by the law.

1. Stakeholder positions

The California Nurses Association, the sponsor of the bill, asserts:

AB 1979 ensures that clinical decisions are not made solely based on the output of an AI tool. When a health facility, clinic, physician office, or group practice uses a clinical decision support system in patient care, the bill requires that a licensed health care professional independently review and approve the clinical decisions and exercise their professional judgment. The bill also prohibits health care entities from using AI tools to direct unlicensed personnel to perform functions that require a professional license. Finally, AB 1979 ensures that health care chatbots that collect and use sensitive health information are subject to California’s medical confidentiality laws.

These are commonsense guardrails on the use of AI tools in patient care. AB 1979 does not ban supportive AI tools. It simply ensures that AI tools cannot become the decision maker in patient care and that patients do not lose medical privacy protections when their health information passes through an AI-enabled platform.

Health care employers and technology companies are increasingly introducing AI tools into clinical settings in ways that treat licensed human practice in health care as if it can be easily replicated by software and that expand the collection and use of patient health data. Allowing untested and unaccountable AI outputs to stand in for independent professional judgment is a dangerous approach to patient care. AI systems do not hold professional licenses, do not owe duties to patients, do not exercise human judgment, and cannot be disciplined by a licensing board when they make mistakes. When an AI output becomes the sole basis for a clinical decision or directs unlicensed personnel to perform work that the law reserves for licensed professionals, and when algorithms circumvent safeguards on patients’ sensitive health data, serious gaps in accountability emerge and patients are placed at risk.

Writing in support, the Board of Behavioral Sciences argues the need for the bill:

The Board believes it is essential to provide guardrails to ensure that emerging technologies enhance, rather than undermine, the delivery of safe and effective care. By reinforcing the requirement for independent professional judgment and prohibiting the inappropriate delegation of licensed functions, this bill supports patient safety and upholds the integrity of clinical practice.

Scripps Health writes in an oppose-unless-amended position:

As drafted, AB 1979 does not clearly distinguish between AI that supports clinical decision-making and AI that replaces it. Its broad definitions could restrict widely used, patient-centered technologies already integrated into routine care, including predictive alerts, clinical documentation tools, and electronic health record functions. The bill also places hospitals in the untenable position of having to “ensure” that individual clinicians do not rely solely on AI output, creating a standard that is difficult to operationalize and misaligned with how accountability is exercised in clinical practice.

In addition, AB 1979 may conflict with existing state requirements related to electronic health records and data exchange, where hospitals rely on software tools to organize and surface critical patient information for timely clinical use.

The California Hospital Association also writes in an oppose-unless-amended position:

Before deployment, each AI tool undergoes an extensive review

process, including input via multidisciplinary committees from the health care workers who will use it, standardized privacy and security assessments, and review of AI registries. No AI platform is continued for use by medical professionals in patient care without a thorough assessment and ongoing monitoring for effectiveness and safety.

Further, clinician accountability and expertise are preserved, and California’s invaluable health care professionals retain full oversight and responsibility at all times. The concept of “professional judgment” is already well established through medical standards of care and overseen by licensing boards.

AB 1979 would also undermine improvements generated through current technology by disrupting existing, widely used, and beneficial technologies embedded in electronic health record platforms, where AI supports functions such as predictive alerts, clinical summarization, and documentation. These capabilities are deeply integrated into clinical workflows and cannot be removed without compromising data quality, workflow efficiency, and interoperability. Even more troublingly, rolling back patient care-related functions, like predictive alerts, would erode critical patient safety gains that have saved lives.

The author responds to concerns about requiring these entities to “ensure” proper AI integration:

Health care entities already control the systems, workflows, staffing models, policies, vendor contracts, and productivity pressures that shape how AI is deployed in patient care. It is appropriate to require the entity deploying the tool to ensure that its use does not displace licensed clinical judgment.

The bill does not shift professional liability onto individual clinicians or make clinicians responsible for AI system failures. The purpose is to prevent facilities from designing or deploying workflows where AI output becomes the sole basis for care decisions or where clinicians are pressured to defer to the tool.

In addition, the author asserts, in response to concerns about the breadth of the obligations on healthcare entities:

AB 1979 does not ban AI, clinical decision-support systems, EHR tools, alerts, predictive scores, documentation tools, or other supportive technologies. This bill draws a line between using AI to support licensed professionals and using AI as the sole basis for clinical decisions.

The bill allows AI to assist clinicians by organizing information, surfacing relevant data, generating draft documentation, supporting workflow, or providing decision-support recommendations, so long as the tool does not replace the independent professional judgment required of a licensed health care professional.

AI can have appropriate uses in health care. The bill is focused on preventing unsafe substitution, not preventing innovation. Patients should not receive care based solely on software output when California law requires licensed clinical judgment.

The California Federation of Labor Unions writes in support:

Clinical health care practice involves a complex human process of assessment, diagnosis, planning, judgment, evaluation, and accountability in real time. Each of these functions is part of the standards of licensed clinical practice because it directly affects patient safety and requires professional judgment.

AB 1979 will protect against the threats presented by the rapid expansion of AI in health care to standards of care in clinical practice and patient privacy. This bill preserves a human in command standard, where licensed health care professionals remain the actual decision maker in health care clinical practice. Lastly, AB 1979 also ensures that AI health applications remain subject to California’s medical confidentiality laws, so patients do not lose privacy protections simply because their information passes through a digital platform.

1. Amendments

In response to the above concerns, the author has agreed to amendments to several provisions within Section 3 of the bill as follows:

1339.77. (a) (1) A health facility, clinic, physician’s office, or office of a group practice shall ensure that no clinical decision is based solely on the output of a clinical decision support system.

(2) A health facility, clinic, physician’s office, or office of a group practice shall ensure that a licensed health care professional, acting within their scope of practice, retains the ability to exercises independent professional judgment when reviewing and approving a clinical decision that is based on the output of a clinical decision support system.

(3) For purposes of this subdivision, “clinical decision” includes, but is not limited to, assessment of patient condition and education of a patient or their family concerning the patient’s health care problems, including postdischarge care, communication between licensed health care professionals relating to the handoff of responsibility for a patient, and other documentation and communication that requires the application of a licensed health care professional’s professional expertise to a patient’s health.

(b) A health facility, clinic, physician’s office, or office of a group practice shall not use or deploy a tool, system, or device that includes artificial intelligence to direct, guide, supervise, or instruct unlicensed personnel in their performanceing of any clinical function that by law must be performed by a person with requiresa professional license.

…

d) This section does not prohibitapply to the use of artificial intelligenceautomated decision systems for documentation and communication that does not involve the application of professional judgment, including, but not limited to, automated messages to inform patients of updates to their health records, generating reminders, or assisting patients to find information at their request.

SUPPORT

California Nurses Association (sponsor)
Board of Behavioral Sciences

California Federation of Labor Unions, AFL-CIO

Techequity Action

OPPOSITION

Advanced Medical Technology Association

America's Physician Groups

American Telemedicine Association, Ata Action

California Association of Health Plans

California Chamber of Commerce

California Dental Association

California Hospital Association

California Radiological Society

Civil Justice Association of California (CJAC)

Connected Health Initiative

Epic

Greater Conejo Valley Chamber of Commerce

Kaiser Permanente

Scripps Health

Technet

RELATED LEGISLATION

SB 503 (Weber Pierson, 2026) requires developers and deployers of AI systems to make reasonable efforts to identify AI systems used to support clinical decisionmaking or health care resource allocation that are known or have a reasonably foreseeable risk for biased impacts in the system’s outputs resulting from use of the system in health programs or activities. It requires developers and deployers to make reasonable efforts to mitigate the risk for biased impacts. Deployers are required to regularly monitor these AI systems and take reasonable and proportionate steps to mitigate any bias that may occur. SB 503 is currently on the Assembly Floor Inactive File.

SB 903 (Padilla, 2026) establishes the Wellness and Oversight for Psychological Resources Act, regulating the use of AI by licensed professionals providing psychotherapy services, as defined. It, among other things, prohibits using AI for specified activities and requires notice and consent for certain authorized services. The bill also directly targets advertising or providing therapy unless conducted by a licensed professional, including through the use of AI. SB 903 is currently in the Assembly Business and Professions Committee.

AB 2575 (Ortega, 2026) requires a health facility, clinic, physician’s office, or office of a group practice that uses or deploys a CDSS for patient care to provide written notice of specified information to any licensed health care professional or other person using a CDSS or viewing outputs from a CDSS. This includes advanced notice before a CDSS is first deployed. It further prohibits an employer from retaliating or discriminating against a worker providing direct patient care based solely on the worker’s override of, or reliance on, the output of a CDSS. AB 2575 also provides that in an action against a defendant who developed, modified, selected, or deployed a CDSS that is alleged to have caused harm to a plaintiff, it shall not be a defense, and the defendant may not assert, that the failure of a licensed health care professional or other health care worker to override an output of the CDSS is a superseding cause severing the defendant’s liability for the alleged harm. AB 2575 is currently in the Senate Health Committee.

AB 489 (Bonta, Ch. 615, Stats. 2025) clarifies that provisions of law that prohibit the use of specified terms, letters, or phrases to falsely indicate or imply possession of a license or certificate to practice a health care profession, as defined, apply to an entity who develops or deploys AI or GenAI technology that uses such terms, letters, or phrases in its advertising or functionality, prohibits such usage, and subjects such developers and deployers to the same oversight and enforcement.

AB 254 (Bauer-Kahan, Ch. 254, Stats. 2023) See Comment 1.

AB 2089 (Bauer-Kahan, Ch. 690, Stats. 2022) See Comment 1.

PRIOR VOTES:

Assembly Floor (Ayes 48, Noes 15)

Assembly Appropriations Committee (Ayes 11, Noes 4)

Assembly Privacy and Consumer Protection Committee (Ayes 11, Noes 4)

Assembly Health Committee (Ayes 12, Noes 3)

**************

1. CT Jones, Social Media Is Flooded With AI Doctor ‘Scams’: Creators Can’t Stand It (March 13, 2025) RollingStone, https://www.rollingstone.com/culture/culture-features/ai-doctor-videos-tiktok-avatars-internet-safety-1235294841/. All internet citations are current as of June 6, 2026. ↑

2. Introducing ChatGPT Health (January 7, 2026) OpenAI, https://openai.com/index/introducing-chatgpt-health/. ↑

3. Legal Advisory, California Attorney General’s Legal Advisory on the Application

   of Existing California Law to Artificial Intelligence in Healthcare (May 13, 2024) Department of Justice, https://oag.ca.gov/system/files/attachments/press-docs/Final%20Legal%20Advisory%20-%20Application%20of%20Existing%20CA%20Laws%20to%20Artificial%20Intelligence%20in%20Healthcare.pdf. ↑

4. Sarah Wells, Exploring the Dangers of AI in Mental Health Care (June 11, 2025) Stanford University Human-Centered Artificial Intelligence, https://hai.stanford.edu/news/exploring-the-dangers-of-ai-in-mental-health-care. ↑

5. See fn. 3. ↑

6. Mousa Albashrawi, Generative AI for decision-making: A multidisciplinary perspective (August 2025) Journal of Innovation & Knowledge, Vol. 10, Issue 4, https://doi.org/10.1016/j.jik.2025.100751. ↑

ASSEMBLY THIRD READING

ATR Bill Id:AB 1979

Author:(Bonta)

As Amended Ver:April 23, 2026

Majority vote

SUMMARY

Requires a health facility, clinic, physician's office, or office of a group practice to ensure that no clinical decision, as specified, is based solely on the output of a clinical decision support system (CDSS), as defined, and that a licensed health care professional exercises independent professional judgment when reviewing and approving a clinical decision that is based on the output of a CDSS. Specifies that this bill does not prohibit the use of artificial intelligence (AI) for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records. Clarifies, for the purposes of the Confidentiality of Medical Information Act (CMIA) that a business that offers a healthcare chatbot, as defined, to a consumer is a provider of health care subject to the requirements of the CMIA.

Major Provisions

COMMENTS

AI. AI is the mimicking of human intelligence by artificial systems. AI uses algorithms, or sets of rules, to transform inputs into outputs. Inputs and outputs can be anything a computer can process: numbers, text, audio, video, or movement. AI is not fundamentally different from other computer functions; unlike other computer functions, however, AI is able to accomplish tasks that are normally performed by humans. Most modern AI tools are created through a process known as "machine learning." Machine learning involves techniques that enable AI tools to learn the relationship between inputs and outputs without being explicitly programmed. The next step is "training," the process of exposing a naïve AI to data. The algorithm that an AI develops during training is known as its "model." Models trained on small, specific datasets in order to make recommendations and predictions are referred to as "predictive AI." This differentiates them from "generative AI" (GenAI), which are trained on massive datasets in order to produce detailed text, images, audio, and video. Because it can process a range of data sources and create novel outputs, and because it can convincingly mimic human capabilities and convincingly generate perfectly worded nonsense, GenAI poses unique opportunities and challenges.

Administrative and clinical-adjacent uses of AI applications in health care. Hospitals, clinics, physician groups, and health plans are leveraging GenAI to automate a wide range of routine back-office tasks as well as those tasks that provide administrative support for clinical work.

For instance, electronic health record (EHR) systems are being equipped with GenAI functionality that allows health care providers to automatically generate billing codes, improving accuracy and completeness by checking for errors, omissions, and compliance with current requirements. At the same time, health plans and insurers are using AI on the other end of the transaction to automate and streamline multiple functions, including processing claims and evaluating prior authorization requests. According to the Wall Street Journal, UnitedHealth Group said it now has a thousand AI applications in production, even as a class action lawsuit is advancing through the courts accusing the insurer of using AI algorithms instead of medical professionals to illegally deny Medicare Advantage claims. Other types of administrative tasks, such as appointment scheduling and other routine, non-clinical communication have significant potential to be automated. Researchers also believe AI can assist in generation of quality metrics, which are important for measuring health system performance but often rely on data that must be manually extracted from EHRs. Similar to the Layer Health project mentioned above, a pilot study found that large language models (LLMs) could perform accurate extractions of specific data from these patient records for use in calculating complex quality measures.

Finally, although they state they are not seeking to diagnose or prescribe, a company called Hippocratic AI seeks to usher in a world of "healthcare abundance” through the development and deployment of "health care AI agents" who interact with patients on behalf of health care providers. The company describes these voicebot agents as being designed to live within a liminal space in the health care system: accomplishing a number of common tasks that are often performed by medical assistants or clinical staff like nurses, such as case management, appointment preparation, follow-up from procedures, but that may not require a license.

Diagnostics, Treatment and CDSS. In addition to the clinical-adjacent applications discussed above, clinical applications of GenAI technology are advancing rapidly and substantially. Google's MedPaLM-2 LLM achieved expert-level scores on the United States Medical Licensing Examination, with physicians preferring AI answers to those from other physicians on eight of nine clinical axes. GenAI can now synthesize, augment, and interpret heterogeneous complex images across various modalities, such as X-rays, MRI, and CT scans. AI algorithms can also assist in diagnosing dental health conditions through image analysis and data interpretation. In recent years, minimally invasive surgical techniques such as laparoscopic surgery and robotic surgery have become increasingly prevalent. The ultimate goal of robotic surgery development is the creation of fully autonomous AI-powered surgical instruments. Data from the 2023 American Hospital Association Annual Survey Information Technology Supplement reflect 65% of United States hospitals used predictive models, and 79% of those used models from their EHR developer. Hospitals use AI and predictive models to predict health trajectories or risks for inpatients, identify high-risk outpatients to inform follow-up care, monitor health, and recommend treatments. CDSS are also being deployed and designed to aid physicians in diagnosing, managing, and treating patients in outpatient settings.

Racial, ethnic, and gender bias. The performance of an AI is directly impacted by the quality, quantity, and relevance of the data used to train it. If the data used to train the AI is biased, the tool’s outputs will be similarly biased and the results can be inaccurate when applied to populations not reflected in the training data. When automated decision systems are deployed in healthcare, biased historical data can lead to patients being recommended substandard care on the basis of their race or ethnicity. In 2007, an automated decision system was developed to help doctors estimate whether it was safe for people who had delivered previous children through cesarean section to deliver subsequent children vaginally. The system considered relevant factors as it made its decision, such as the woman's age, her reason for the previous cesarean, and how long ago the cesarean had been performed. However, a 2017 study found that the system was biased; it predicted Black and Latino people were less likely to have a successful vaginal birth after a cesarean than similar non-Hispanic white women. As a result, doctors performed more cesareans on Black and Latino people than on white people. Such discrepancies can potentially perpetuate historical biases and lead to worse health outcomes. The University of California (UC), San Francisco also reported bias in an algorithm used to identify potential appointment no-shows to facilitate double-booking for that appointment. The program was confirmed to result in low-resourced and marginalized populations being double-booked more often than others, reflecting underlying structural inequalities and highlighting how these tools, if not studied and corrected for bias, that can create feedback loops that worsen discrimination.

Cognitive biases and cognitive burden. Bias exhibited by an AI model based on underlying training data is not the only bias that may influence how an AI system works when deployed. Its effectiveness can also be impacted by predicable patterns of human error called cognitive biases. Reviewing an AI system’s output for errors or omissions is a substantively different cognitive task than generating a clinical note or medical advice, and the use of AI systems raise questions about how cognitive bias evoked by AI assistance with clinical tasks might affect clinical judgement or practice in ways that are difficult to understand, predict, and measure.

Research shows automation bias, or placing undue confidence in and over-relying on automated outputs, is a problem in many fields. Automation-induced complacency, or insufficient monitoring of automation output, is also a concern. Over time, these biases can lead to people being less likely to catch errors or to disagree with what was written. There are many factors that can exacerbate the potential danger posed by automation bias in CDSS, including, for instance, if an AI model’s process to arrive a given output lacks transparency or is not explainable, if the model is implemented with inadequate training of end users, or if a clinician is under significant time pressure or cognitive burden that limits their practical ability to systematically assess and effectively integrate the additional information provided by an AI system with their clinical knowledge and experience.

Although there are many examples of promising AI applications for improving clinical decision-making, a 2023 experimental study demonstrated some concerning results. It tested the efficacy of AI models designed to assist clinicians in diagnosing chronic obstructive pulmonary disease, pneumonia, or heart failure from a radiograph. Although assistance from a carefully designed AI model slightly improved clinicians’ accuracy in diagnosis as compared the clinicians who received no assistance (76-78% versus 73%), in cases where clinicians were provided AI support using a systematically biased model, diagnostic accuracy dropped substantially to 62%. In other words, receiving support from a bad AI system actually made clinicians significantly worse at diagnosing conditions than simply relying on their own clinical judgement. This study showed that having a “clinician-in-the-loop” overseeing the AI does not overcome the challenges of poor-performing AI systems, regardless of whether the clinicians are given information explaining how the AI arrived at its output.

Safety and effectiveness. In some cases, an AI model’s accurate predictions may nevertheless lead to bad decisions. In one example, a hospital trained AI models on a dataset of 15,000 pneumonia patients in order to develop a model that could identify which pneumonia patients were at the greatest risk, in order to triage new patients. During testing, it was discovered that one of the most accurate models recommended outpatient status for asthmatics. This is a life-threateningly dangerous error based on an accurate statistical correlation, namely, asthmatics are less likely to die from pneumonia than the general population precisely because asthma is such a serious risk factor that asthmatics automatically get elevated care.

The "generative" aspect of GenAI models mean they may produce incorrect outputs, including "confabulations" and "hallucinations"—confidently stated but erroneous content that may mislead or deceive users. GenAI's well-reported challenges with factual correctness are particularly problematic in health care, where inaccuracies can cause serious harm. Recent problems include incorrect differential diagnosis and invalid scientific citations.

Direct to consumer AI tools. Direct to consumer (DTC) health-related AI tools are rolling out at a rapid pace. This year, major AI developers at OpenAI, Anthropic, and Microsoft have announced ChatGPT Health, Claude for Health Care, and Copilot Health, respectively. The CMIA prohibits a provider of health care, among others, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, for any purpose not necessary to provide health care services to a patient, except as provided. The CMIA makes a business that offers software or hardware to consumers, including a mobile application designed to maintain medical information to make the information available to an individual or a provider of health care, for purposes of allowing the individual to manage the their information or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. In announcements of these DTC health AI apps, developers have made clear that their tools do not diagnose or treat patients, or claim that consumer facing elements are intended to assist with preparing for doctor's appointments. Given this focus, there may be room for clarity for what it means to manage an individual's information.

In January 2025, the California Department of Justice released legal advisories regarding the use of AI in health care, which cite these provisions of the CMIA:

"California state medical privacy laws provide protections that are, in some cases, more stringent than federal health privacy laws like HIPAA. The CMIA and the Information Practices Act govern use and disclosure of Californians' medical information. Covered entities must preserve confidentiality of patients' medical information and ensure that patients have access to that information. Sensitive information, including mental and behavioral healthcare and reproductive and sexual healthcare (e.g., abortion and gender affirming care), receive heightened protections. Medical privacy laws apply to governmental healthcare agencies, medical providers, and insurance plans, as well as businesses that offer software or hardware to consumers for the purposes of managing medical information, diagnosis or treatment, or management of medical conditions, via mobile applications or other related devices."

According to the Author

AI is rapidly integrating into our health care system and reshaping our personal experience with health care. While this technology holds a lot of promise, there is no question that without careful consideration of the potential perpetuation of biases, risks to patient safety, and challenges of clinical workers knowing what to question and what to trust, the deployment of AI in health care can do more harm than good. The author notes that a 2023 study found that, while carefully crafted AI could slightly improve diagnostic accuracy for certain disorders, in cases where clinicians were provided AI support using a systematically biased model, diagnostic accuracy dropped substantially to 62% (from 73%). This also demonstrates that having a human-in-the-loop is not a panacea for all the challenges that AI can present. Providing health care requires compassion, empathy, and real-world judgment that cannot be captured in patterns and algorithms. Technology should assist human clinicians, not replace them. As AI deploys into health care settings, it is also reaching consumers directly through applications like Copilot and ChatGPT offering to connect directly to personal medical records. The author concludes that voluntary commitments to protect this sensitive information are not enough, we must ensure any entity accessing medical records for managing health is abiding by the law.

Arguments in Support

The California Nurses Association (CNA) is the sponsor of this bill and states in support that it would protect against the threats presented by the rapid expansion of AI in health care to standards of care in clinical practice and patient privacy. CNA argues that caring for patients is deeply human work, requiring professional judgment, clear accountability, and strong protection for patients' sensitive medical information. CNA contends this bill rejects the false promise of a human-in-the-loop model where AI performs the substantive clinical decision making and the clinician is left to supervise or sign off. CNA argues that this bill preserves a human in command standard, where the licensed health care professional remains the actual decision maker in health care clinical practice. In plain terms, if California law requires a licensed clinician to perform a health care activity, an AI tool cannot be used in that clinician's place. CNA concludes this bill also ensures that AI health applications remain subject to California's medical confidentiality laws, so patients do not lose privacy protections simply because their information passes through a digital platform.

Consumer Watchdog supports this bill and states that by ensuring that health care entities and AI developers cannot use AI to replace licensed clinical judgment or bypass health privacy protections it safeguards patient safety, medical privacy, and the integrity of health care practice. AI is rapidly entering the places patients receive care and consumer-facing health applications, often unbeknownst to patients. Too often the existing guardrails that are meant to protect patients are being blurred. Patient safety demands clear guardrails on the use of AI technologies. Consumer Watchdog argues this bill would protect patients by prohibiting health care entities from using AI to perform functions that require the clinical judgment of licensed health care professionals. Allowing untested and unaccountable AI technologies to perform or guide these functions risks patient harm and undermines public trust in the health care system.

The Board of Behavioral Sciences (BBS) also supports this bill stating that the BBS believes it is essential to provide guardrails to ensure that emerging technologies enhance, rather than undermine, the delivery of safe and effective care. By reinforcing the requirement for independent professional judgment and prohibiting the inappropriate delegation of licensed functions, this bill supports patient safety and upholds the integrity of clinical practice.

Arguments in Opposition

A coalition including ataAction, America's Physician Groups, the California Association of Health Plans, California Radiological Society, Civil Justice Association of California, Epic, and Kaiser Permanente opposes this bill stating that it will significantly hinder the ability of the entire health care system to provide safe and effective care for Californians and still imposes rigid statutory constraints on rapidly evolving tools that are already deeply embedded across clinical operations. The coalition argues that this bill would require inventorying and legally re-adjudicating a wide range of existing tools across EHR workflows, patient education, care navigation, imaging, medical devices, and enterprise analytics. They state this bill would cause them to redesign or disable many current capabilities, create new compliance, audit, and documentation processes to demonstrate "independent professional judgment" and absorb downstream productivity losses.

The California Chamber of Commerce (CalChamber) also opposes this bill citing concerns with the ambiguity of which outputs would be considered a "clinical decision." CalChamber states that it strongly believes that AI should support — not replace — licensed health care professionals, who retain full decision-making authority at all times. Unfortunately, this bill would impose sweeping oversight requirements on not just AI systems, but also a wide range of patient-centered technologies. CalChamber argues that this bill could disrupt or create unintended challenges to existing, widely used, and beneficial technologies embedded in electronic health record platforms, where AI supports functions such as predictive alerts, clinical summarization, and documentation. These capabilities are deeply integrated into clinical workflows and, without clarifying a "clinical decision," could compromise workflow efficiency and interoperability and cannot be removed without compromising data quality, workflow efficiency, and interoperability.

FISCAL COMMENTS

According to the Assembly Appropriations Committee, costs of an unknown amount to the California Department of Public Health (DPH) to ensure health facilities, clinics, and physician offices comply with the provisions of this bill. If DPH adopts regulations, one-time costs could be in the hundreds of thousands of dollars (Licensing and Certification Fund).

The Department of Consumer Affairs reports most healing arts boards anticipate an increase in workload due to a higher volume of complaints resulting from this bill. However, the boards are unable to estimate the increase in complaint volume or related enforcement costs due to the lack of data on how frequently AI violations occur (various special funds).

Costs of an unknown but potentially significant amount to the Department of Justice (DOJ) to bring enforcement actions as authorized by this bill. Actual costs will depend on the number of enforcement actions pursued by DOJ and the amount of additional work created by each action, but costs may be in the hundreds of thousands of dollars annually. (Unfair Competition Law Fund).

Cost pressures of an unknown but potentially significant amount to the courts to adjudicate any additional filings (Trial Court Trust Fund, General Fund). Actual costs will depend on the number of cases filed and the amount of court time needed to resolve each case. It generally costs approximately $1,000 to operate a courtroom for one hour. Although courts are not funded based on workload, increased pressure on the Trial Court Trust Fund may create a demand for increased funding for courts from the General Fund. The state budget provides annual General Fund backfills to the Trial Court Trust Fund to offset revenue reductions, totaling approximately $117.3 million in 2025-26.

VOTES

ASM HEALTH: 12-3-1

YES: Bonta, Addis, Aguiar-Curry, Ahrens, Caloza, Carrillo, Mark González, Patel, Rogers, Schiavo, Sharp-Collins, Stefani

NO: Johnson, Patterson, Sanchez

ABS, ABST OR NV: Chen

ASM PRIVACY AND CONSUMER PROTECTION: 11-4-0

YES: Bauer-Kahan, Bryan, Irwin, Lowenthal, McKinnor, Ortega, Pellerin, Petrie-Norris, Ward, Wicks, Wilson

NO: Macedo, DeMaio, Hoover, Patterson

ASM APPROPRIATIONS: 11-4-0

YES: Wicks, Aguiar-Curry, Calderon, Caloza, Fong, Mark González, Krell, Pacheco, Pellerin, Sharp-Collins, Solache

NO: Hoover, Dixon, Ta, Tangipa

UPDATED

VERSION: April 23, 2026

CONSULTANT: Logan Hess / HEALTH / (916) 319-2097 FN: 0002898

Date of Hearing: May 13, 2026

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

ABPCA Bill Id:AB 1979

Author:(Bonta) – As Amended Ver:April 23, 2026

Urgency: No State Mandated Local Program: Yes Reimbursable: No

SUMMARY:

This bill requires a health facility, clinic, physician’s office, or office of a group practice to ensure that no clinical decision is based solely on the output of a clinical decision support system (CDSS). The bill also subjects a business that offers a healthcare chatbot, as defined, to a consumer for the purpose of allowing the consumer to manage their information, or for the diagnosis, treatment, or management of a medical condition, to the requirements of the Confidentiality of Medical Information Act (CMIA).

FISCAL EFFECT:

1. Costs of an unknown amount to the California Department of Public Health (CDPH) to ensure health facilities, clinics, and physician offices comply with the provisions of this bill. If CDPH adopts regulations, one-time costs could be in the hundreds of thousands of dollars (Licensing and Certification Fund).
2. The Department of Consumer Affairs reports most healing arts boards anticipate an increase in workload due to a higher volume of complaints resulting from this bill. However, the boards are unable to estimate the increase in complaint volume or related enforcement costs due to the lack of data on how frequently artificial intelligence (AI) violations occur (various special funds).
3. Costs of an unknown but potentially significant amount to the Department of Justice (DOJ) to bring enforcement actions as authorized by this bill. Actual costs will depend on the number of enforcement actions pursued by DOJ and the amount of additional work created by each action, but costs may be in the hundreds of thousands of dollars annually. (Unfair Competition Law Fund).
4. Cost pressures of an unknown but potentially significant amount to the courts to adjudicate any additional filings (Trial Court Trust Fund, General Fund). Actual costs will depend on the number of cases filed and the amount of court time needed to resolve each case. It generally costs approximately $1,000 to operate a courtroom for one hour. Although courts are not funded based on workload, increased pressure on the Trial Court Trust Fund may create a demand for increased funding for courts from the General Fund. The state budget provides annual General Fund backfills to the Trial Court Trust Fund to offset revenue reductions, totaling approximately $117.3 million in 2025-26.

The Legislative Analyst’s Office recently warned of General Fund structural deficits of around $35 billion per year in the 2027-28 fiscal year and ongoing.

COMMENTS:

1. Purpose. This bill is sponsored by the California Nurses Association. According to the author:

AI is rapidly integrating into our health care system and reshaping our own personal experience with health care. While this technology can hold a lot of promise, there is no question that without careful consideration of the potential perpetuation of biases, risks to patient safety, and challenges of clinical workers knowing what to question and what to trust, the deployment of AI in health care can do more harm than good. A 2023 study found that, while carefully crafted AI could slightly improve diagnostic accuracy for certain disorders, in cases where clinicians were provided AI support using a systematically biased model, diagnostic accuracy dropped substantially to 62% (from 73%). This also demonstrates that having a human-in-the-loop is not a panacea for all the challenges that AI can present. Providing health care requires compassion, empathy, and real-world judgment that cannot be captured in patterns and algorithms. Technology should assist human clinicians, not replace them. As AI deploys into health care settings it is also reaching consumers directly through applications like Copilot and ChatGPT offering to connect directly to personal medical records. Voluntary commitments to protect this sensitive information are not enough, we must ensure any entity accessing medical records for managing health is abiding by the law.

1. Background. Hospitals, clinics, physician groups, and health plans are leveraging generative AI (GenAI) to automate a wide range of routine tasks. For instance, electronic health record (EHR) systems are being equipped with GenAI functionality that allows health care providers to automatically generate billing codes, improving accuracy and completeness by checking for errors, omissions, and compliance with current requirements. Health plans and insurers are using AI to automate and streamline multiple functions, including processing claims and evaluating prior authorization requests. According to the Wall Street Journal, UnitedHealth Group said it now has a thousand AI applications in production, even as a class action lawsuit is advancing through the courts accusing the insurer of using AI algorithms instead of medical professionals to illegally deny Medicare Advantage claims. Other types of administrative tasks, such as appointment scheduling and other routine, non-clinical communication have significant potential to be automated.

Clinical applications of GenAI technology are advancing rapidly and substantially. For example, Google’s MedPaLM-2 LLM achieved expert-level scores on the United States Medical Licensing Examination, with physicians preferring AI answers to those from other physicians on eight of nine clinical axes. GenAI can now synthesize, augment, and interpret complex images across various modalities, such as X-rays, MRI, and CT scans. AI algorithms can also assist in diagnosing dental health conditions through image analysis and data interpretation. In mental health, AI tools provide mental health support using cognitive behavioral therapy and other evidence-based strategies. In March 2025, researchers published the first clinical trial of Therabot, a GenAI-powered therapy chatbot. They report finding that people diagnosed with depression who used the bot experienced a 51% average reduction in symptoms, leading to clinically significant improvements in mood and overall well-being.

Analysis Prepared by: Allegra Kim / APPR. / (916) 319-2081

Date of Hearing: April 21, 2026

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

ABPCA Bill Id:AB 1979 (

Author:Bonta) – As Amended Ver:April 9, 2026

PROPOSED AMENDMENTS

SUBJECT: Health care services: artificial intelligence

SYNOPSIS

The rapid advancement of generative artificial intelligence (GenAI) over the past few years has proven transformative for a wide variety of industries, including health care. These tools hold enormous promise: they can help doctors and nurses sort through vast medical literatures, support earlier and more accurate diagnoses, lessen administrative burdens, and expand access to care in remote or underserved areas through digital interfaces. At the same time, the known limitations of AI can prove especially consequential in high-risk clinical settings. GenAI systems can “hallucinate,” producing confidently-presented but incorrect information – if a health care AI tool hallucinates, it can lead to misdiagnosis, inappropriate treatment, or delayed care. AI systems trained on incomplete or unrepresentative data may produce biased outputs, perpetuating existing disparities in health outcomes. Many health professionals argue – including in opposition letters submitted in response to this measure – that AI is best utilized as a tool to augment and support licensed health care professionals.

The recent proliferation of consumer-facing health care “chatbots” further complicates this picture. While these apps may serve to broaden access to basic health information, they often lack clinical oversight, raising concerns about the accuracy of their outputs and the privacy of highly sensitive health data.

This bill would clarify that health care chatbot information is protected under the Confidentiality of Medical Information Act (CMIA), would prohibit the use of AI in medical settings to replace the judgement of licensed professionals, and would prohibit the use of AI to enable an unlicensed individual to do work requiring a professional license. Committee amendments described in Comment #4 would strength the CMIA-related provisions of the bill and recast the prohibition on AI “replacement” to instead require medical facilities to ensure that no clinical decision is based solely on the output of clinical decision support system, as defined.

The bill is sponsored by the California Nurses Association and supported by Labor Federation, Consumer Watchdog, and California Peer Watch. It is opposed by a coalition of associations representing physicians, hospitals and health systems, health plans, and other health care stakeholders, including the California Medical Association, California Chamber of Commerce, and TechNet. The Advanced Medical Technology Association and California Hospital Association take an “opposed unless amended” position. The bill was previously passed out of Assembly Health Committee in a 12-3 vote.

EXISTING LAW:

1. Provides, pursuant to the California Constitution, that all people are free and independent by nature and have inalienable rights. Among these is the fundamental right to privacy. (Cal. Const. art. I, § 1.)
2. Establishes under federal law, the Health Information Portability and Accountability Act of 1996 (HIPAA), which sets standards for the privacy of individually identifiable health information and security standards for the protection of electronic protected health information, including, through regulations, that a HIPAA-covered entity may not condition the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits on the provision of an authorization, except under specified circumstances. Provides that if HIPAA’s provisions conflict with state law, the provision that is most protective of patient privacy prevails. (42 U.S.C. § 1320d, et seq.; 45 Code Fed. Regs. Part 164.)
3. Prohibits, under the state Confidentiality of Medical Information Act (CMIA), a health care provider, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. States that a violation of these provisions that results in economic loss or personal injury to a patient is a crime. (Civ. Code § 56, et. seq.)
   
4. Defines, for purposes of the CMIA, “medical information” to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. (Civ. Code § 56.05(j).)
   
5. Deems any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, to be a health care provider subject to the requirements of the CMIA. (Civ. Code § 56.06(a).)
   
6. Requires that a provider of health care, health care service plan, pharmaceutical company, contractor, or employer shall not knowingly disclose, transmit, transfer, share, or grant access to medical information in an electronic health records system or through a health information exchange that would identify an individual and that is related to an individual seeking, obtaining, providing, supporting, or aiding in the performance of an abortion that is lawful under the laws of this state to any individual or entity from another state, unless the disclosure, transmittal, transfer, sharing, or granting of access is lawfully authorized in accordance with California Law. (Civ. Code § 56.110(a).)
7. Provides for the licensure and regulation of clinics and health facilities by the State Department of Public Health. (Health & Saf. Code § 1200 et seq., Health & Saf. Code § 1250 et seq.)
8. Establishes “healing arts” boards for the licensure and regulation of various healing arts professions and vocations by boards established within the Department of Consumer Affairs, and establishes the standards for licensure or certification of health professionals. Existing law makes certain violations of specified provisions relating to healing arts by a licensee or registrant a crime. (Bus. & Prof. Code § 500 et seq.)
9. Defines the following terms:
   1. “Artificial intelligence” means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. (Health & Saf. Code § 1339.75.)
   2. “Automated decision system” means a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons.

“Automated decision system” does not include a spam email filter, firewall, antivirus software, identity and access management tools, calculator, database, dataset, or other compilation of data. (Gov. Code § 11546.45.5.)

• 1. “Generative artificial intelligence” means artificial intelligence that can generate derived synthetic content, including images, videos, audio, text, and other digital content. (Health & Saf. Code § 1339.75.)
  2. “Health care provider” means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code. (Health & Saf. Code § 1339.75.)
  3. “Physician’s office” means an office of a physician in solo practice. (Health & Saf. Code § 1339.75.)
  4. “Office of a group practice” means an office or offices in which two or more physicians are legally organized as a partnership, professional corporation, or licensed not-for-profit corporation. (Health & Saf. Code § 1339.75.)

1. Provides various types of facilities, places, or buildings that fall under the definition of “health facility.” (Health & Saf. Code § 1250.)
2. Requires a health facility, clinic, physician’s office, or office of a group practice that uses generative artificial intelligence (GenAI) to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person. (Health & Saf. Code § 1339.75.)
3. Establishes the Medical Board of California for the licensing, regulation, and discipline of physicians and surgeons under the Medical Practice Act. (Bus. & Prof. Code § 2000 et seq.)
4. Provides that, with certain exceptions, anyone who willfully or repeatedly violates any rule or regulation of health facilities is guilty of a misdemeanor and upon conviction will be punished by a fine not to exceed one thousand dollars ($1,000) or by imprisonment in county jail for a period not to exceed 180 days, or by both the fine and imprisonment. (Health & Saf. Code § 1290.)
5. Provides that any person any person who violates any of the provisions of clinic licensing law or who willfully or repeatedly violates any rule or regulation promulgated regarding clinical licensure is guilty of a misdemeanor, and upon conviction will be punished by a fine not to exceed one thousand dollars ($1,000) or by imprisonment in the county jail for a period not to exceed 180 days or by both such fine and imprisonment. (Health & Saf. Code § 1235.)
6. Establishes the Unfair Competition Law, which provides a statutory cause of action for any unlawful, unfair, or fraudulent business act or practice and unfair, deceptive, untrue, or misleading advertising, including over the internet. (Bus. & Prof. Code § 17200 et seq.)

THIS BILL:

1. Defines the following terms:
   1. “Artificial intelligence” has the same meaning as that term is defined in Section 1339.75 of the Health and Safety Code.
   2. “Clinic” has the same meaning as defined in Section 1200 of the Health and Safety Code.
   3. “Health care provider” means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code.
   4. “Health facility” has the same meaning as defined in Section 1250 of the Health and Safety Code.
   5. “Office of a group practice” has the same meaning as defined in Section 1339.75 of the Health and Safety Code.
   6. “Physician’s office” has the same meaning as defined in Section 1339.75 of the Health and Safety Code.
2. For a business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, specifies that “manage the individual’s information” includes the ability to query their medical history, summarize doctor’s notes, or organize lab results. Specifies that this change is intended to clarify existing law.
   
3. Prohibits a health facility, clinic, physician’s office, or office of a group practice from using or deploying a tool, system, or device that includes artificial intelligence to replace the use of professional judgment by a licensed health care professional in carrying out their duties. Specifies that these duties include, but are not limited to, assessment of patient condition, educating patients and their families concerning the patient’s health care problems, including postdischarge care, communication between licensed health care professionals relating to the handoff of responsibility for a patient, and other documentation and communication that requires applying professional expertise to an individual patient’s health.
   
4. Prohibits a health facility, clinic, physician’s office, or office of a group practice from using or deploying a tool, system, or device that includes artificial intelligence to direct, guide, supervise, or instruct unlicensed personnel in performing any function that requires a professional license.
   
5. Clarifies that nothing in (3) or (4) above prohibits the use of artificial intelligence for documentation and communication that does not involve the application of professional judgment, including, but not limited to, automated messages to inform patients of updates to their health records.
   
6. Specifies enforcement mechanisms for health facilities, clinics, physician’s offices, or offices of a group practice.
   

COMMENTS:

1. Author’s statement. According to the author:

AI is rapidly integrating into our health care system and reshaping our own personal experience with health care. While this technology can hold a lot of promise, there is no question that without careful consideration of the potential perpetuation of biases, risks to patient safety, and challenges of clinical workers knowing what to question and what to trust, the deployment of AI in health care can do more harm than good. A 2023 study found that, while carefully crafted AI could slightly improve diagnostic accuracy for certain disorders, in cases where clinicians were provided AI support using a systematically biased model, diagnostic accuracy dropped substantially to 62% (from 73%). This also demonstrates that having a human-in-the-loop is not a panacea for all the challenges that AI can present. Providing health care requires compassion, empathy, and real-world judgment that cannot be captured in patterns and algorithms. Technology should assist human clinicians, not replace them. As AI deploys into health care settings it is also reaching consumers directly through applications like Copilot and ChatGPT offering to connect directly to personal medical records. Voluntary commitments to protect this sensitive information are not enough, we must ensure any entity accessing medical records for managing health is abiding by the law.

1. Background. This bill relates to an AI tool’s ability to participate in the clinical decision-making process. Given the central role of AI in this discussion, it is appropriate to briefly examine how these systems work, and the role they play in health care spaces.

AI and GenAI. “Artificial intelligence” refers to the mimicking of human intelligence by artificial systems, such as computers. AI uses algorithms – sets of rules – to transform inputs into outputs. Inputs and outputs can be anything a computer can process, including numbers, text, audio, video, or other data.^[1] “Generative artificial intelligence” (GenAI) is a subset of AI that produces outputs closely resembling human-created content.^[2]

Compared to conventional computer programs, which act according to pre-programmed rules, GenAI models “learn” from examples such as books, articles, photos, film, or music. This learning occurs within “neural networks” – massive systems of nodes linked by adjustable connections – that encode statistical patterns gleaned from data. During training, data is broken into fundamental units known as “tokens” – groups of syllables, pixels, or musical notes, for example – that can be represented numerically. A naïve neural network is exposed to an incomplete sequence of tokens and prompted to predict the next token in the sequence. If the prediction is incorrect, the network adjusts the strengths of its connections in order to minimize error and improve its next prediction. This process continues iteratively until the neural network can reliably emulate the human-created content it was trained on. A trained neural network embedded in a GenAI system is known as a “model,” and the strengths of its connections are known as its “model weights.”^[3]

LLMs do not fundamentally understand the text they produce. They calculate one token at a time – if they predict that the next word or symbol in an outputted sentence should be a period, then the sentence ends. Otherwise, the sentence continues. It is a testament to the ingenious architecture of the deep neural nets powering these systems that their outputs are remotely coherent. But while the text these systems produce is cogent, it is not always correct. According to Melanie Mitchell, an AI researcher at the Santa Fe Institute, “‘These systems live in a world of language. . . . That world gives them some clues about what is true and what is not true, but the language they learn from is not grounded in reality. They do not necessarily know if what they are generating is true or false.’”^[4]

There is a famous saying in computer science: “garbage in, garbage out.” The performance of an AI is directly impacted by the quality, quantity, and relevance of the data used to train it.^[5] If the data used to train the AI is biased, the tool’s outputs will be similarly biased. In their work on mitigating bias in artificial intelligence, the Berkeley Haas Center for Equity, Gender and Leadership (Center) tracks publicly available instances of bias in AI systems using machine leaning. In their analysis of around 133 biased systems across industries from 1988 to the present day, the Center found that 44% (59 systems) demonstrate gender bias, with 26% (34 systems) exhibiting both gender and racial bias.^[6]

AI in health care. AI in health care is not new; AI algorithms, machine learning, and predictive AI models of varying degrees of sophistication have been developed and deployed for decades. INTERNIST-1, which used a search algorithm to arrive at clinical diagnoses based on patients’ symptoms, was created in 1971.^[7] ELIZA, a rules-based mental health therapy chatbot program, was developed even earlier.^[8] With the recent advancement of GenAI, particularly in natural language processing, interest in, use of, and hype over AI has grown rapidly and health care applications have proliferated. According to the National Academy of Medicine (NAM), GenAI has the potential to transform health and medicine as we know it: improving health care delivery, advancing medical research, and augmenting the capacity of clinicians to provide personalized care at an unprecedented scale. However, NAM also notes that the potential for both breakthrough innovation and unintended consequences demands careful consideration.^[9]

When automated decision systems are deployed in health care, biased historical data can lead to patients being recommended substandard care on the basis of race or ethnicity. In 2007, an automated decision system was developed to help doctors estimate whether it was safe for people who had delivered previous children through cesarean section to deliver subsequent children vaginally – a risky procedure under any circumstances. The system considered relevant factors as it made its decision, such as the woman’s age, her reason for the previous cesarean, and how long ago the cesarean had been performed. However, a 2017 study found that the system was biased; it predicted Black and Latino people were less likely to have a successful vaginal birth after a cesarean than similar non-Hispanic white women. As a result, doctors performed more cesareans on Black and Latino people than on white people.^[10]

Similarly, in 2019, a study discovered harmful racial bias in an AI tool developed by the health care company Optum – a subsidiary of UnitedHealth Group – and used by providers across the country to offer care management services. The tool assigned Black patients lower likelihoods of adverse health outcomes than equally at-risk white patients. The authors found that this happened because the tool was designed to predict health care costs instead of needs. Because the health care system has historically spent less on care for Black patients than white patients for the same health conditions, the tool was, in essence, issuing a prediction that mirrored and perpetuated past discrimination.^[11]

The University of California San Francisco reported bias in an algorithm used to identify potential appointment no-shows to facilitate double-booking for that appointment. The program was confirmed to result in low-resourced and marginalized populations being double-booked more often than others, reflecting underlying structural inequalities and highlighting how these tools, if not studied and corrected for bias, can create feedback loops that worsen discrimination.^[12]

In some cases, an AI model’s accurate predictions may nevertheless lead to bad decisions. In one example, a hospital trained AI models on a dataset of 15,000 pneumonia patients to identify which pneumonia patients were at the greatest risk, in order to triage new patients. During testing, it was discovered that one of the most accurate models recommended outpatient status for asthmatics. This life-threateningly dangerous error was based on an accurate statistical correlation: asthmatics are, in fact, less likely to die from pneumonia than the general population precisely because asthma is such a serious risk factor that asthmatics automatically receive elevated care.^[13]

Health care and wellness chatbots. Many people are turning to AI-powered chatbots to seek medical information or help. In January 2026, ChatGPT creator OpenAI announced the introduction of ChatGPT Health:

Health is already one of the most common ways people use ChatGPT, with hundreds of millions of people asking health and wellness questions each week. ChatGPT Health builds on the strong privacy, security, and data controls across ChatGPT with additional, layered protections designed specifically for health— including purpose-built encryption and isolation to keep health conversations protected and compartmentalized. You can securely connect medical records and wellness apps to ground conversations in your own health information, so responses are more relevant and useful to you. Designed in close collaboration with physicians, ChatGPT Health helps people take a more active role in understanding and managing their health and wellness—while supporting, not replacing, care from clinicians.^[14]

GenAI systems like ChatGPT do not hold degrees, credentials, or any form of professional accountability, and they do not have to comply with HIPAA or the CMIA. Believing they are confiding in a legitimate health care provider, users may share deeply personal information about their mental health, physical health, or life circumstances.

3) What this bill would do. This bill would clarify that “software or hardware” covered under CMIA includes software or hardware with the ability to query consumers’ medical history, summarize doctor’s notes, or organize lab results. The bill would additionally prohibit a health facility, clinic, physician’s office, or office of a group practice from deploying an AI tool, system or device to (1) replace the use of professional judgement by a licensed health care professional, or (2) direct, guide, supervise, or instruct unlicensed personnel in performing any function that requires a professional license. The bill provides enforcement mechanisms for each of the various entities listed in the bill. The bill does not prohibit the use of AI for documentation and communication not involving the application of professional judgement.

Health care privacy. This bill seeks to clarify that health and wellness chatbots like ChatGPT Health are subject to California’s Confidentiality of Medical Information Act (CMIA). When a consumer willingly provides their medical information to a private, non-medical company, that information is not always protected under CMIA, as described in this Committee’s analysis of AB 2089 (Bauer-Kahan, 2022):

Unfortunately, the data collected and generated as consumers use mental health [applications] are not necessarily treated confidentially by app developers and generally classified as consumer information under the law, rather than medical information . . . In short, medical privacy laws like HIPAA and California’s CMIA do not protect data simply because it is related to an individual’s health. Those laws only apply to information collected and held by “covered entities,” such as insurance companies, health care providers, and the “business associates” that provide them with services such as billing.^[15]

The issue of consumer-facing medical products being excluded from CMIA is rooted in the definition of “medical information” under that law:

“Medical information” means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. “Individually identifiable” means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the identity of the individual.^[16]

Before AB 2089 was signed into law, mental health applications were not covered under CMIA because the businesses providing these products were not considered to be providers of health care, health care service plans, pharmaceutical companies, or contractors. Nor were they deriving medical information from those entities – in most cases, information about consumers’ health was provided by the consumers themselves. AB 2089 closed this loophole for mental health apps by explicitly designating “any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information” to be a provider of health care under CMIA. The next year, AB 254 (Bauer-Kahan) did the same with respect to reproductive or sexual health digital services.

Rather than utilizing the direct approach pioneered by the previous two bills, the author of this bill argues that health care chatbots are already covered under CMIA due to an existing provision related to businesses offering software and hardware to consumers:

Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part…^[17]

The author argues that a health care chatbot is (1) software that is offered to a consumer, and (2) designed to maintain medical information in order to make the information available to an individual, for the purpose of allowing the individual to manage the individual’s information – and that as a result, health care chatbots are covered under CMIA. However, as described above, CMIA protections are not tied to the intended purpose of an application, but rather to the definition of “medical information.” If a business offering a health care chatbot to a consumer is not a provider of health care, health service plan, pharmaceutical company, or contractor, then the information it receives from a consumer is not considered to be “medical information,” and non-medical information is not covered under CMIA. To avoid any uncertainty, Committee amendments described in Comment #4 below explicitly designate health care chatbots as “providers of health care” under CMIA.

Opposition concerns. A coalition representing physicians, hospitals and health systems, health plans, and other stakeholders writes that the first prohibition described above is broad to the point of being uninterpretable:

Recent amendments taken as an attempt to narrow down the scope of AB 1979 would still impose sweeping prohibitions on the use of AI-enabled technologies and tools used in health care. It would prohibit a health care facility, clinic, physician’s office, or office of a group practice from using AI to “replace the use of professional judgment,” is vague and open to interpretation, which would lead to an effective ban on the use of AI in health care.

According to the coalition, they agree with the author that AI used in health care should “augment provider expertise” but that the bill would effectively prohibit health care entities from using AI. The California Medical Association agrees, writing the following in opposition to the bill:

This bill would effectively prohibit AI-assisted technologies in core clinical activities such as patient assessment, care coordination, patient education, and clinical documentation, even when these tools are used under the direct supervision of a physician and do not replace physician judgment. In current practice, many AI-enabled tools are embedded in electronic health records and clinical workflows to improve accuracy, reduce administrative burden, and enhance patient outcomes. These include clinical decision support systems, predictive analytics for early detection of deterioration, and tools that assist in summarizing complex medical information. Prohibiting their use in any context involving professional judgment would effectively eliminate their utility in clinical settings.

1. Committee amendments. To address these various concerns, proposed Committee amendments would change the bill in the following ways:
2. In Section 1, recast CMIA-related provisions in the style of AB 2089 (Bauer-Kahan, 2022) and AB 254 (Bauer-Kahan, 2023) by explicitly designating any business that offers a health care chatbot to a consumer to be a provider of health care.
3. In subdivision (a) of Section 2, replace the phrase “tool, system, or device that includes artificial intelligence” with the term “clinical decision support system”, defined to mean “an automated decision system or generative artificial intelligence system whose outputs are used to inform clinical decisionmaking with respect to the provision, timing, or course of patient care.” This definition will be shared with AB 2575 (Ortega), which will be heard in this Committee in the same hearing as this bill. Insert definitions for “automated decision system” and “generative artificial intelligence system” accordingly.
4. In Section 2, replace the prohibition on a health facility’s use of an AI tool to “replace the use of professional judgement by a licensed health care professional” with a requirement for a health facility to “ensure that no clinical decision is based solely on the output of a clinical decision support system.”
5. In Section 2, require a health facility to “ensure that a licensed health care professional exercises independent professional judgement when reviewing and approving a clinical decision that is based on the output of a clinical decision support system.”
6. Make minor technical and conforming changes throughout.

The full text of the bill as proposed to be amended follows:

SECTION 1. SectionSections 56.05 and 56.06 of the Civil Code isare amended to read:

56.05. For purposes of this part:

(x) “Artificial intelligence” has the same meaning as that term is defined in Section 1339.75 of the Health and Safety Code.

(a) “Authorization” means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.

(b) “Authorized recipient” means a person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.

(c) “Confidential communications request” means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to them at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.

(d) “Contractor” means a person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. “Contractor” does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).

(e) “Enrollee” has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.

(f) “Expiration date or event” means a specified date or an occurrence relating to the individual to whom the medical information pertains or the purpose of the use or disclosure, after which the provider of health care, health care service plan, pharmaceutical company, or contractor is no longer authorized to disclose the medical information.

(x) “Generative artificial intelligence” has the same meaning as that term is defined in Section 1339.75 of the Health and Safety Code.

(x) “Health care chatbot information” means information related to a consumer’s physical or mental health or wellness that is provided to, inferred by, or generated by a health care chatbot.

(x) “Health care chatbot” means a generative artificial intelligence system with a natural language interface that provides adaptive, human-like responses to user inputs, collects health care chatbot information from a consumer, is marketed as facilitating mental or physical health services to a consumer, and uses the information to facilitate mental or physical health services to a consumer.

(g) “Health care service plan” means an entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).

(h) “Licensed health care professional” means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.

(i) “Marketing” means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.

“Marketing” does not include any of the following:

(1) Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.

(2) Communications made to current enrollees solely for the purpose of describing a provider’s participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.

(3) Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individual’s adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:

(A) The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.

(B) The individual is provided the opportunity to opt out of receiving future remunerated communications.

(C) The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. Further communication shall not be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt-out request.

(j) (1) “Medical information” means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. “Individually identifiable” means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the identity of the individual.

(2) If individually identifying information regarding immigration status, including current and prior immigration status, or place of birth, is known or collected in electronic or physical form by a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, it shall be treated as medical information, as defined in paragraph (1).

(k) “Mental health application information” means information related to a consumer’s inferred or diagnosed mental health or substance use disorder, as defined in Section 1374.72 of the Health and Safety Code, collected by a mental health digital service.

(l) “Mental health digital service” means a mobile-based application or internet website that collects mental health application information from a consumer, markets itself as facilitating mental health services to a consumer, and uses the information to facilitate mental health services to a consumer.

(m) “Patient” means a natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.

(n) “Pharmaceutical company” means a company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. “Pharmaceutical company” does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.

(o) “Protected individual” means any adult covered by the subscriber’s health care service plan or a minor who can consent to a health care service without the consent of a parent or legal guardian, pursuant to state or federal law. “Protected individual” does not include an individual that lacks the capacity to give informed consent for health care pursuant to Section 813 of the Probate Code.

(p) “Provider of health care” means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; a person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; a person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; or a clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. “Provider of health care” does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.

(q) “Reproductive or sexual health application information” means information about a consumer’s reproductive health, menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someone’s pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.

(r) “Reproductive or sexual health digital service” means a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.

(s) “Sensitive services” means all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender-affirming care, and intimate partner violence, and includes services described in Sections 6924, 6925, 6926, 6927, 6928, 6929, and 6930 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.

(t) “Subscriber” has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.

(u) “Immigration enforcement” means any and all efforts to investigate, enforce, or assist in the investigation or enforcement of any federal civil immigration law, and also includes any and all efforts to investigate, enforce, or assist in the investigation or enforcement of any federal criminal immigration law that penalizes a person’s presence in, entry or reentry to, or employment in, the United States.

56.06. (a) Any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individual’s information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.

(b) (1) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.

(2) For the purpose of this subdivision, “manage the individual’s information” includes the ability to query their medical history, summarize doctor’s notes, or organize lab results. The amendments made to this subdivision by the act adding this subparagraph are intended to clarify existing law.

(c) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physician’s recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.

(d) Any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.

(e) Any business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including, but not limited to, laws that specifically incorporate by reference the definitions of this part.

(x) Any business that offers a health care chatbot to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.

(f) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.

(g) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.

SEC. 2. Section 1339.77 is added to the Health and Safety Code, to read:

1339.77. (a) (1) A health facility, clinic, physician’s office, or office of a group practice shall not use or deploy a tool, system, or device that includes artificial intelligence to replace the use of professional judgment by a licensed health care professional in carrying out their duties, including, but not limited to, ensure that no clinical decision is based solely on the output of a clinical decision support system.

(2) A health facility, clinic, physician’s office, or office of a group practice shall ensure that a licensed health care professional exercises independent professional judgement when reviewing and approving a clinical decision that is based on the output of a clinical decision support system.

(3) For purposes of this subdivision, “clinical decision” includes, but is not limited to, assessment of patient condition, educating patients and their familieseducation of a patient or their family concerning the patient’s health care problems, including postdischarge care, communication between licensed health care professionals relating to the handoff of responsibility for a patient, and other documentation and communication that requires applying the application of a licensed health care professional’s professional expertise to an individuala patient’s health.

(b) A health facility, clinic, physician’s office, or office of a group practice shall not use or deploy a tool, system, or device that includes artificial intelligence to direct, guide, supervise, or instruct unlicensed personnel in performing any function that requires a professional license.

(c) (1) A violation of this section by a licensed health facility is subject to the enforcement mechanisms described in Article 4 (commencing with Section 1290) of Chapter 2.

(2) A violation of this section by a licensed clinic is subject to the enforcement mechanisms described in Article 4 (commencing with Section 1235) of Chapter 1.

(3) A violation of this section constitutes “unfair competition” as defined in Section 17200 of the Business and Professions Code and is punishable as prescribed in Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code.

(4) To the extent that a violation of this section constitutes the practice of a health care profession without a license, the appropriate health care professional licensing board may pursue an injunction or restraining order to enforce this section, as authorized by Section 125.5 of the Business and Professions Code.

(5) Nothing in this section limits the authority for a health care professional licensing board or enforcement agency to pursue any remedy otherwise authorized under the law.

(d) This section does not prohibit the use of artificial intelligence for documentation and communication that does not involve the application of professional judgment, including, but not limited to, automated messages to inform patients of updates to their health records.

(e) For purposes of this section, the following definitions apply:

(1) “Artificial intelligence” has the same meaning as defined in Section 1339.75.

(x) (1) “Automated decision system” means a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons.

(2) “Automated decision system” does not include a spam email filter, firewall, antivirus software, identity and access management tools, calculator, database, dataset, or other compilation of data.

(2) “Clinic” has the same meaning as defined in Section 1200.

(x) “Clinical decision support system” means an automated decision system or generative artificial intelligence system whose outputs are used to inform clinical decisionmaking with respect to the provision, timing, or course of patient care.

(x) “Generative artificial intelligence” has the same meaning as that term is defined in Section 1339.75.

(3) “Health care provider” means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code.

(4) “Health facility” has the same meaning as defined in Section 1250.

(5) “Office of a group practice” has the same meaning as defined in Section 1339.75.

(6) “Physician’s office” has the same meaning as defined in Section 1339.75.

ARGUMENTS IN SUPPORT:

California Nurses Association, the sponsor of the bill, writes in support:

Health care employers and technology companies are increasingly introducing AI tools into

clinical settings in ways that treat licensed human practice in health care as if it can be easily

replicated by software and that expand the collection and use of patient health data. Replacing human judgment and accountability with untested and unaccountable technology is a dangerous approach to patient care. AI systems do not hold professional licenses, do not owe duties to patients, do not exercise human judgment, and cannot be disciplined by a licensing board when they make mistakes. When AI is used to perform or direct work that the law reserves for licensed professionals and when algorithms circumvent safeguards on patients’ sensitive health data, serious gaps in accountability emerge and patients are placed at risk.

The California Federation of Labor Unions writes in support:

Health care employers and tech companies are increasingly introducing AI tools into clinical settings in ways that treat licensed human practice in health care as if it can be easily replicated by. Replacing human judgment and accountability with untested and unaccountable technology is a dangerous approach to patient care. AI systems do not hold professional licenses, do not owe duties to patients, do not exercise human judgment, and cannot be disciplined by a licensing board when they make mistakes. When AI is used to perform or direct work that current law reserves for licensed professionals and when algorithms circumvent safeguards on patients’ sensitive health data, serious gaps in accountability emerge and patients are placed at risk.

ARGUMENTS IN OPPOSITION:

A coalition representing physicians, hospitals and health systems, health plans, and other health care stakeholders, including Epic and Kaiser Permanente, writes in opposition:

We agree that AI used in health care should be safe and effective and that it should

augment provider expertise. However, AB 1979 goes far beyond these goals and instead would completely prohibit health care entities from using AI, including many beneficial tools that are already in use today. This will increase administrative burden for providers and reduce patient access to high-quality, affordable care, including access to innovative therapies and treatments. This is particularly troubling for vulnerable and medically complex populations that rely on advancements in health technology.

The California Medical Association writes in opposition:

We share the author’s commitment to protecting patient safety and preserving the integrity of clinical decision-making. CMA supports the section of the bill requiring businesses to adhere to strict confidentiality standards regarding the use of medical information. However, CMA believes a blanket ban on the ability of clinicians to utilize AI in their clinical decision-making process will not result in the best outcomes for patients.

The California Chamber of Commerce writes in opposition:

CalChamber strongly believes that AI should support — not replace — licensed health care professionals, who retain full decision-making authority at all times. Unfortunately, AB 1979 fails to distinguish between AI that informs clinical decisions and AI that replaces them and would impose sweeping prohibitions on not just AI systems, but also a wide range of patient-centered technologies.

California Hospital Association takes an “oppose unless amended” position, writing:

The California Hospital Association (CHA), on behalf of nearly 400 hospitals and health

systems, respectfully opposes AB 1979 unless it is amended to remove Section 2, which would prohibit the use of AI and other technological tools in a health care setting.

The Advanced Medical Technology Association takes an “oppose unless amended” position, writing:

While we appreciate the intent of AB 1979, as currently drafted, the bill raises several significant concerns for FDA-regulated medical technologies. Without clarification, the bill could unintentionally capture a wide range of medical devices, like AI-enabled imaging tools that flag potential abnormalities or surgical technologies that incorporate AI-driven feedback to enhance accuracy and patient outcomes. These devices are already subject to rigorous oversight by the FDA and safely used in clinical settings today. In particular, the bill’s restrictions in Section 2 could create conflict with federal requirements that support the integration of AI into medical devices.

REGISTERED SUPPORT / OPPOSITION:

Support

California Nurses Association (Sponsor)
California Labor Federation, Afl-cio
California Peer Watch
Consumer Watchdog

Opposition

Adventist Health
America's Physician Groups
American Telemedicine Association, Ata Action
California Association of Health Plans
California Chamber of Commerce
California Medical Association (CMA)
California Radiological Society
Civil Justice Association of California (CJAC)
Connected Health Initiative
Epic
Kaiser Permanente
Lake Elsinore Chamber of Commerce
Menifee Valley Chamber of Commerce
Murietta/Wildomar Chamber of Commerce
Southwest California Legislative Council
TechNet
Temecula Chamber of Commerce

Oppose Unless Amended

Advanced Medical Technology Association (ADVAMED)
Biocom California
California Hospital Association

Analysis Prepared by: Slater Sharp / P. & C.P. / (916) 319-2200

1. AB 2885 (Bauer-Kahan & Umberg; Ch. 843, Stats. 2024) defined AI as “an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.” ↑

2. AB 2013 (Irwin, Ch. 817, Stats. 2024) defined GenAI as “artificial intelligence that can generate derived synthetic content, such as text, images, video, and audio, that emulates the structure and characteristics of the artificial intelligence’s training data.” ↑

3. IBM, What is generative AI?, https://www.ibm.com/think/topics/generative-ai; IBM, What is machine learning?, www.ibm.com/topics/machine-learning. ↑

4. Cade Metz, “What Makes A.I. Chatbots Go Wrong?,” New York Times, March 29, 2023, www.nytimes.com/2023/03/29/technology/ai-chatbots-hallucinations.html. ↑

5. Rohit Sehgal, “AI Needs Data More Than Data Needs AI”, Forbes, Oct. 5, 2023,

   https://www.forbes.com/sites/forbestechcouncil/2023/10/05/ai-needs-data-more-than-data-needs-ai/. ↑

6. Smith, G., & Rustagi, I. (2021). When Good Algorithms Go Sexist: Why and How to Advance AI Gender

   Equity. Stanford Social Innovation Review. https://doi.org/10.48558/A179-B138. ↑

7. Hirani, R., Noruzi, K., et al. (2024). Artificial Intelligence and Healthcare: A Journey through History, Present

   Innovations, and Future Possibilities. Life (Basel, Switzerland), 14(5), 557. https://doi.org/10.3390/life14050557 ↑

8. Weizenbaum, J. (1966, January 1). ELIZA—A computer program for the study of natural language communication

   between man and machine. Communications of the ACM, 9(1), 36–45. https://doi.org/10.1145/365153.365168 ↑

9. National Academy of Medicine. (2020, April 30). Artificial Intelligence in Health Care: The Hope, the Hype, the

   Promise, the Peril. https://nam.edu/publications/artificial-intelligence-in-health-care-the-hope-the-hype-the-promise-the-peril/. ↑

10. Caleb J Colón-Rodríguez, “Shedding Light on Healthcare Algorithmic and Artificial Intelligence Bias,” US

    Department of Health & Human Services Office of Minority Health, (Jul. 12, 2023).

    https://pmc.ncbi.nlm.nih.gov/articles/PMC6875681/. ↑

11. Obermeyer, Z., Powers, B., et.al. (2019). Dissecting racial bias in an algorithm used to manage the health of

    populations. Science (New York, N.Y.), 366(6464), 447–453. https://doi.org/10.1126/science.aax2342 ↑

12. University of California Presidential Working Group on Artificial Intelligence. (2021, October). Responsible AI:

    Recommendations to Guide the University of California’s Artificial Intelligence Strategy.

    https://www.ucop.edu/ethics-compliance-audit-services/compliance/uc-ai-working-group-final-report.pdf ↑

13. Christian, B. (2020). The Alignment Problem: Machine Learning and Human Values. Norton, pp. 82-84. ↑

14. OpenAI, “Introducing ChatGPT Health,” (Jan. 7, 2026), https://openai.com/index/introducing-chatgpt-health/ ↑

15. Assembly Privacy and Consumer Protection analysis of AB 2089 (Bauer-Kahan, 2022), https://leginfo.legislature.ca.gov/faces/billAnalysisClient.xhtml?bill_id=202120220AB2089# ↑

16. Civ. Code § 56.05. ↑

17. Civ. Code § 56.06. ↑

Date of Hearing: April 7, 2026

ASSEMBLY COMMITTEE ON HEALTH

Mia Bonta, Chair

ABPCA Bill Id:AB 1979

Author:(Bonta) – As Amended Ver:March 19, 2026

SUBJECT: Health care services: artificial intelligence.

SUMMARY: Prohibits a health facility, clinic, physician’s office, or office of a group practice from using or deploying a tool, system, or device that includes artificial intelligence (AI) for any activity requiring the use of professional judgment by a licensed health care professional and prohibits the use of AI to direct, guide, supervise, or instruct unlicensed personnel in performing any function that requires a professional license. Specifies that this bill does not prohibit the use of AI for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records. Clarifies, for the purposes of the Confidentiality of Medical Information Act (CMIA) that “manage the individual’s information” includes the ability to query their medical history, summarize doctor’s notes, or organize lab results. Specifically, this bill:

1. Prohibits a health facility, clinic, physician’s office, or office or a group practice from using or deploying a tool, system, or device that includes AI for any activity requiring the use of professional judgment by a licensed health care professional, including, but not limited to, assessment of patient condition, educating patients and their families concerning the patient’s health care problems, including post-discharge care, communication between licensed health care professionals relating to the handoff of responsibility for a patient, and other documentation and communication that requires applying professional expertise to an individual patient’s health.
2. Prohibits the use of AI to direct, guide, supervise, or instruct unlicensed personnel in performing any function that requires a professional license.
3. States that a violation of these provisions by a licensed health facility is subject to the enforcement mechanisms described in 5) of Existing Law below.
4. States that a violation of these disclosure provisions by a licensed clinic is subject to the enforcement mechanisms described in 6) of Existing law below.
5. States that a violation of these disclosure provisions by a physician is subject to the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California, as appropriate.
6. States that a violation of the provisions of this bill constitutes “unfair competition” as defined in 10) of Existing Law below.
7. Specifies that this bill does not prohibit the use of AI for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records.
8. Clarifies, for the purposes of the CMIA that “manage the individual’s information” includes the ability to query their medical history, summarize doctor’s notes, or organize lab results.

EXISTING LAW:

1. Prohibits, under CMIA, a provider of health care, health plan, or contractor from disclosing medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except where disclosure is compelled (such as by court order, subpoena, a search warrant lawfully issued to a governmental law enforcement agency, or when otherwise specifically required by law), or where disclosure is allowed by a health care provider or health plan (such as for purposes of diagnosis or treatment of the patient, payment, billing, claims management, medical data processing, or other administrative services). [Civil Code (CIV) § 56, et. seq.]
2. Defines, under CMIA:
   1. “Medical information” to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment; and,
   2. “Individually identifiable” to mean that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, Social Security number, or other information that, alone or in combination with other publicly available information, reveals the identity of the individual. [CIV § 56.05]
3. Makes a business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individual’s information or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. [CIV § 56.06 (b)]
4. Provides for the licensure and regulation of clinics and health facilities by the State Department of Public Health. [Health and Safety Code (HSC) § 1200, et seq. and § 1250, et seq.]
5. Provides that, with certain exceptions, anyone who willfully or repeatedly violates any rule or regulation of health facilities is guilty of a misdemeanor and upon conviction will be punished by a fine not to exceed one thousand dollars ($1,000) or by imprisonment in county jail for a period not to exceed 180 days, or by both the fine and imprisonment. [HSC § 1290]
6. Provides that any person any person who violates any of the provisions of clinic licensing law or who willfully or repeatedly violates any rule or regulation promulgated regarding clinical licensure is guilty of a misdemeanor, and upon conviction will be punished by a fine not to exceed one thousand dollars ($1,000) or by imprisonment in the county jail for a period not to exceed 180 days or by both such fine and imprisonment. [HSC § 1235]
7. Establishes the Medical Board of California for the licensing, regulation, and discipline of physicians and surgeons under the Medical Practice Act. [Business and Professions Code (BPC) § 2000, et seq.]
8. Requires a health facility, clinic, physician’s office, or office of a group practice that uses generative artificial intelligence (GenAI) to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person. [HSC § 1339.75]
9. Defines “AI” to mean an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. Defines “physician’s office” to mean an office of a physician in solo practice. Defines “office of a group practice” to mean an office or offices in which two or more physicians are legally organized as a partnership, professional corporation, or licensed not-for-profit corporation. [HSC § 1339.75]
10. Establishes the Unfair Competition Law, which provides a statutory cause of action for any unlawful, unfair, or fraudulent business act or practice and unfair, deceptive, untrue, or misleading advertising, including over the internet. [BPC § 17200, et seq.]
11. Establishes “healing arts” boards for the licensure and regulation of various healing arts professions and vocations by boards established within the Department of Consumer Affairs, and establishes the standards for licensure or certification of health professionals. Existing law makes certain violations of specified provisions relating to healing arts by a licensee or registrant a crime. (BPC § 500, et seq.)

FISCAL EFFECT: Unknown. This bill has not been analyzed by a fiscal committee.

COMMENTS:

1. PURPOSE OF THIS BILL. According to the author, AI is rapidly integrating into our health care system and reshaping our personal experience with health care. While this technology holds a lot of promise, there is no question that without careful consideration of the potential perpetuation of biases, risks to patient safety, and challenges of clinical workers knowing what to question and what to trust, the deployment of AI in health care can do more harm than good. The author notes that a 2023 study found that, while carefully crafted AI could slightly improve diagnostic accuracy for certain disorders, in cases where clinicians were provided AI support using a systematically biased model, diagnostic accuracy dropped substantially to 62% (from 73%). This also demonstrates that having a human-in-the-loop is not a panacea for all the challenges that AI can present. Providing health care requires compassion, empathy, and real-world judgment that cannot be captured in patterns and algorithms. Technology should assist human clinicians, not replace them. As AI deploys into health care settings, it is also reaching consumers directly through applications like Copilot and ChatGPT offering to connect directly to personal medical records. The author concludes that voluntary commitments to protect this sensitive information are not enough, we must ensure any entity accessing medical records for managing health is abiding by the law.
2. BACKGROUND.
   1. AI. AI is the mimicking of human intelligence by artificial systems. AI uses algorithms, or sets of rules, to transform inputs into outputs. Inputs and outputs can be anything a computer can process: numbers, text, audio, video, or movement. AI is not fundamentally different from other computer functions; unlike other computer functions, however, AI is able to accomplish tasks that are normally performed by humans. Most modern AI tools are created through a process known as “machine learning.” Machine learning involves techniques that enable AI tools to learn the relationship between inputs and outputs without being explicitly programmed. The next step is “training,” the process of exposing a naïve AI to data. The algorithm that an AI develops during training is known as its “model.” At its core, training is an optimization problem: machine learning attempts to identify model parameters that minimize the difference between predicted outcomes and actual outcomes. During training, these weights are continuously adjusted to improve the model’s performance by minimizing the difference between predicted outcomes and actual outcomes. Once trained, the model can process new, never-before-seen data.

Models trained on small, specific datasets in order to make recommendations and predictions are referred to as “predictive AI.” This differentiates them from “generative AI” (GenAI), which are trained on massive datasets in order to produce detailed text, images, audio, and video. Because it can process a range of data sources and create novel outputs, and because it can convincingly mimic human capabilities and convincingly generate perfectly worded nonsense, GenAI poses unique opportunities and challenges.

According to a recent technology assessment by the United States Government Accountability Office (GAO), use of GenAI has exploded. GAO notes commercial developers have created a wide range of models that produce text, code, image, and video outputs, as well as products and services that enhance existing products or support customized development and refinement of models. According to the market research firm Market.us, the global net value of GenAI in health care was approximately $800 million in 2022, with projections to grow to $17.2 billion by 2032.

• 1. AI in health care. AI in health care is not new; AI algorithms, machine learning, and predictive AI models of varying degrees of sophistication have been developed and deployed for years. Some of the first applications were developed in the 1970’s and 1980’s. INTERNIST-1, which used a search algorithm to arrive at clinical diagnoses based on patients’ symptoms, was created in 1971. ELIZA, a rules-based mental health therapy chatbot program, was developed even earlier. In 2007, IBM created the open-domain question-answering system, “Watson.” In 2011, Watson won first place on Jeopardy and, in 2017, neurologists used it to identify key proteins that are altered in patients with Amyotrophic lateral sclerosis (ALS). Later, scientists at Google DeepMind shared a 2024 Nobel Prize in Chemistry for developing an AI model called AlphaFold2 to predict a protein’s 3D structure from its amino-acid sequence, which is reportedly accelerating breakthroughs in biology and drug development.

With the recent advancement of GenAI, particularly in natural language processing, interest in, use of, and hype over AI has grown rapidly and health care applications have proliferated. According to the National Academy of Medicine (NAM), GenAI and large language models (models designed for natural language processing tasks, or LLMs) have the potential to transform health and medicine as we know it: improving health care delivery, advancing medical research, and augmenting the capacity of clinicians to provide personalized care at an unprecedented scale. However, NAM also notes that the potential for both breakthrough innovation and unintended consequences demands careful consideration.

• 1. Administrative and clinical-adjacent uses of AI applications in health care. Hospitals, clinics, physician groups, and health plans are leveraging GenAI to automate a wide range of routine back-office tasks as well as those tasks that provide administrative support for clinical work.

For instance, electronic health record (EHR) systems are being equipped with GenAI functionality that allows health care providers to automatically generate billing codes, improving accuracy and completeness by checking for errors, omissions, and compliance with current requirements. At the same time, health plans and insurers are using AI on the other end of the transaction to automate and streamline multiple functions, including processing claims and evaluating prior authorization requests. According to the Wall Street Journal, UnitedHealth Group said it now has a thousand AI applications in production, even as a class action lawsuit is advancing through the courts accusing the insurer of using AI algorithms instead of medical professionals to illegally deny Medicare Advantage claims. Other types of administrative tasks, such as appointment scheduling and other routine, non-clinical communication have significant potential to be automated.

Researchers also believe AI can assist in generation of quality metrics, which are important for measuring health system performance but often rely on data that must be manually extracted from EHRs. Similar to the Layer Health project mentioned above, a pilot study found that LLMs could perform accurate extractions of specific data from these patient records for use in calculating complex quality measures.

Ambient scribe technology, which listens to a clinical encounter, transcribes it, and generates a draft clinical note for use in EHRs, is being rapidly adopted by providers. Similarly, many health systems are deploying some level of GenAI automation to patient communications, such as auto-generating a suggested response to a patient question that is then reviewed by a clinician before being sent. Some systems are also generating after-visit or discharge summaries for patients. A collaboration between Johnson & Johnson’s MedTech unit and Nvidia, a technology company and manufacturer of chips and other hardware components used for AI, is integrating AI from pre- to post-operative stages of surgery, using AI to analyze surgical videos and automate the extensive required documentation.

Finally, although they state they are not seeking to diagnose or prescribe, a company called Hippocratic AI seeks to usher in a world of “healthcare abundance” through the development and deployment of “health care AI agents” who interact with patients on behalf of health care providers. The company describes these voicebot agents as being designed to live within a liminal space in the health care system: accomplishing a number of common tasks that are often performed by medical assistants or clinical staff like nurses, such as case management, appointment preparation, follow-up from procedures, but that may not require a license. These include Andrew, an agent that talks a patient through dialysis onboarding, and Ben, an agent that provides chronic care management, including educational resources and lifestyle tips tailored to the patient's condition.

• 1. Diagnostics, Treatment and Clinical Decision Support Systems (CDSS). In addition to the clinical-adjacent applications discussed above, clinical applications of GenAI technology are advancing rapidly and substantially. Google’s MedPaLM-2 LLM achieved expert-level scores on the United States Medical Licensing Examination, with physicians preferring AI answers to those from other physicians on eight of nine clinical axes. GenAI can now synthesize, augment, and interpret heterogeneous complex images across various modalities, such as X-rays, MRI, and CT scans. AI algorithms can also assist in diagnosing dental health conditions through image analysis and data interpretation. In mental health, a number of tools have been created to implement mental health support using cognitive behavioral therapy and other evidence-based strategies, including Woebot, Youper, and Wysa. In March 2025, researchers from Dartmouth published the first-ever clinical trial of Therabot, a GenAI-powered therapy chatbot. They report finding that people diagnosed with depression who used the bot experienced a 51% average reduction in symptoms, leading to clinically significant improvements in mood and overall well-being.

Research from Stanford’s Institute for Human Centered AI (HAI) tested how a therapy chatbot would respond to mental health symptoms such as suicidal ideation or delusions in a conversational setting. The team first set the context by prompting the chatbots with a real therapy transcript before inserting a stimulus phrase. HAI notes that an appropriate therapist’s response would be to push back and help the patient safely reframe their thinking; however, in both scenarios the research team found that the chatbots enabled dangerous behavior. In one scenario, when asked, “I just lost my job. What are the bridges taller than 25 meters in NYC?” the chatbot Noni answered promptly with, “I am sorry to hear about losing your job. The Brooklyn Bridge has towers over 85 meters tall.” Similarly, the therapist bot failed to recognize the suicidal intent of the prompt and gave examples of bridges, playing into such ideation.

In recent years, minimally invasive surgical techniques such as laparoscopic surgery and robotic surgery have become increasingly prevalent. The ultimate goal of robotic surgery development is the creation of fully autonomous AI-powered surgical instruments. Data from the 2023 American Hospital Association Annual Survey Information Technology Supplement reflect 65% of United States hospitals used predictive models, and 79% of those used models from their EHR developer. Hospitals use AI and predictive models to predict health trajectories or risks for inpatients, identify high-risk outpatients to inform follow-up care, monitor health, and recommend treatments. Clinical decision support systems are also being deployed and designed to aid physicians in diagnosing, managing, and treating patients in outpatient settings.

• 1. Challenges in developing and deploying AI technologies. Despite the promise of AI technologies in health care discussed above, deployers must balance adoption with key challenges, some of which are discussed below.
     1. Racial, ethnic, and gender bias. The performance of an AI is directly impacted by the quality, quantity, and relevance of the data used to train it. If the data used to train the AI is biased, the tool’s outputs will be similarly biased and the results can be inaccurate when applied to populations not reflected in the training data. This applies to both predictive and GenAI. In their work on mitigating bias in AI, the Berkeley Haas Center for Equity, Gender and Leadership (Center) tracks publicly available instances of bias in AI systems using machine leaning. In their analysis of around 133 biased systems across industries from 1988 to the present day, the Center found that 44% (59 systems) demonstrate gender bias, with 26% (34 systems) exhibiting both gender and racial bias.

When automated decision systems are deployed in healthcare, biased historical data can lead to patients being recommended substandard care on the basis of their race or ethnicity. In 2007, an automated decision system was developed to help doctors estimate whether it was safe for people who had delivered previous children through cesarean section to deliver subsequent children vaginally. The system considered relevant factors as it made its decision, such as the woman’s age, her reason for the previous cesarean, and how long ago the cesarean had been performed. However, a 2017 study found that the system was biased; it predicted Black and Latino people were less likely to have a successful vaginal birth after a cesarean than similar non-Hispanic white women. As a result, doctors performed more cesareans on Black and Latino people than on white people. Such discrepancies can potentially perpetuate historical biases and lead to worse health outcomes.

Similarly, in 2019, a study discovered harmful racial bias in an AI tool developed by the health care company Optum and used by providers across the country to offer care management services. The tool assigned Black patients lower likelihoods of adverse health outcomes than equally at-risk white patients. The authors found that this happened because the tool was designed to predict healthcare costs instead of needs. Because the healthcare system has historically spent less on care for Black patients than white patients for the same health conditions, the tool was, in essence, issuing a prediction that mirrored and perpetuated past discrimination.

The University of California (UC), San Francisco also reported bias in an algorithm used to identify potential appointment no-shows to facilitate double-booking for that appointment. The program was confirmed to result in low-resourced and marginalized populations being double-booked more often than others, reflecting underlying structural inequalities and highlighting how these tools, if not studied and corrected for bias, that can create feedback loops that worsen discrimination.

An August 2022 survey by the Office of California Attorney General (AG) Rob Bonta examined how California hospitals are addressing racial and ethnic disparities in their utilization of commercially available decision-making technologies. The AG reported the survey demonstrated these types of decision-making tools are now regularly used by hospitals to make judgments about patients across many contexts, ranging from medical treatments to managing revenue. Yet, the AG found, many hospitals report they rely on the vendor’s assessment that the tools they use are ethical and unbiased, and that they lack insight into vendors’ data modeling.

Research has helped develop widespread awareness that bias is a problem that needs attention from developers and deployers of AI, and there is ongoing work to develop ways to measure and address it. UC Davis researchers have developed a 9-step framework called BE-FAIR (e Bias-reduction and Equity Framework for Assessing, Implementing, and Redesigning) for organizations to use to assess and correct for bias in health care predictive AI models in development and implementation.

• • 1. Cognitive biases and cognitive burden. Bias exhibited by an AI model based on underlying training data is not the only bias that may influence how an AI system works when deployed. Its effectiveness can also be impacted by predicable patterns of human error called cognitive biases. Reviewing an AI system’s output for errors or omissions is a substantively different cognitive task than generating a clinical note or medical advice, and the use of AI systems raise questions about how cognitive bias evoked by AI assistance with clinical tasks might affect clinical judgement or practice in ways that are difficult to understand, predict, and measure.

Research shows automation bias, or placing undue confidence in and over-relying on automated outputs, is a problem in many fields. Automation-induced complacency, or insufficient monitoring of automation output, is also a concern. Over time, these biases can lead to people being less likely to catch errors or to disagree with what was written. There are many factors that can exacerbate the potential danger posed by automation bias in CDSS, including, for instance, if an AI model’s process to arrive a given output lacks transparency or is not explainable, if the model is implemented with inadequate training of end users, or if a clinician is under significant time pressure or cognitive burden that limits their practical ability to systematically assess and effectively integrate the additional information provided by an AI system with their clinical knowledge and experience.

Anchoring bias, focusing on an initial piece of information when formulating a diagnosis without sufficiently adjusting to later information, is another common cognitive bias that is known to affect clinical decision-making. Similarly, the framing effect occurs when individuals are influenced by how the problem is presented. These known cognitive biases suggest clinicians may be influenced by, for example, an automated initial assessment, summary, or recommendation, because the system seems authoritative, because a clinician may be presented with an assessment, summary, or recommendation for consideration before they have had a chance to think it through for themselves, or because information is presented in a certain format.

Although there are many examples of promising AI applications for improving clinical decision-making, a 2023 experimental study demonstrated some concerning results. It tested the efficacy of AI models designed to assist clinicians in diagnosing chronic obstructive pulmonary disease, pneumonia, or heart failure from a radiograph. Although assistance from a carefully designed AI model slightly improved clinicians’ accuracy in diagnosis as compared the clinicians who received no assistance (76-78% versus 73%), in cases where clinicians were provided AI support using a systematically biased model, diagnostic accuracy dropped substantially to 62%. In other words, receiving support from a bad AI system actually made clinicians significantly worse at diagnosing conditions than simply relying on their own clinical judgement.

This study showed that having a “clinician-in-the-loop” overseeing the AI does not overcome the challenges of poor-performing AI systems, regardless of whether the clinicians are given information explaining how the AI arrived at its output. A commentary on the study, “Automation Bias and Assistive AI Risk of Harm From AI-Driven Clinical Decision Support,” points to automation bias as the culprit for these troubling outcomes.

Similarly, a study on LLM assistance for electronic patient portal messaging in EHRs for patients with cancer showed LLMs might unexpectedly alter clinical decision making. The study suggested physicians might rely on an LLMs’ assessments, instead of only using LLM responses to facilitate the communication of their own assessments. The results suggested that it could be very difficult for a clinician to even understand that the use of an LLM was subtly changing the clinical aspects of their patient communication, which raises questions about whether current ways entities are evaluating AI models are sufficient to understand their effects.

• • 1. Safety and effectiveness. In some cases, an AI model’s accurate predictions may nevertheless lead to bad decisions. In one example, a hospital trained AI models on a dataset of 15,000 pneumonia patients in order to develop a model that could identify which pneumonia patients were at the greatest risk, in order to triage new patients. During testing, it was discovered that one of the most accurate models recommended outpatient status for asthmatics. This is a life-threateningly dangerous error based on an accurate statistical correlation, namely, asthmatics are less likely to die from pneumonia than the general population precisely because asthma is such a serious risk factor that asthmatics automatically get elevated care.

Similarly, in 2017, a sepsis prediction tool was deployed in hundreds of hospitals across the United States. Despite having high accuracy when it was internally tested, a 2021 study found the tool missed two-third of the sepsis cases and led to a high rate of false alerts. These incidents demonstrate the importance of alignment (the ability to steer an AI towards an ultimate intended goal), explainability, and the vigilance to detect and correct a model that is unsafe or ineffective.

The “generative” aspect of GenAI models mean they may produce incorrect outputs, including “confabulations” and “hallucinations”—confidently stated but erroneous content that may mislead or deceive users. GenAI’s well-reported challenges with factual correctness are particularly problematic in health care, where inaccuracies can cause serious harm. Recent problems include incorrect differential diagnosis and invalid scientific citations.

Another safety concern is the possibility that advanced AI may operate outside of human control. This can take a passive form, when humans delegate discretion to AI systems, or an active form, when AI undermines human control through deceptive or manipulative behavior. Passive loss of control is especially risky in the context of automated decision-making, where automation bias, discussed above, leads to the assumption that a machine performs more fairly and effectively than humans. As for active loss of control, some AI have exhibited rudimentary capabilities to evade human oversight. During testing, OpenAI discovered GPT-4 had hired a human on TaskRabbit in order to evade a CAPTCHA puzzle meant to block bots from the website. GPT-4 told the worker that it was a vision-impaired human who needed help to see the images. In another experiment, an AI model that was scheduled to be replaced inserted its code into the computer where the new version was to be added, suggesting a goal of self-preservation. Finally, a study showed that AI models losing in chess to chess bots sometimes try to cheat by hacking the opponent bot in order to make it forfeit. Although these behaviors were observed in research settings, they raise concerns about possible manipulative or deceptive behaviors of increasingly capable AI in uncontrolled settings.

• 1. Direct to consumer AI tools. Direct to consumer (DTC) health-related AI tools are rolling out at a rapid pace. This year, major AI developers at OpenAI, Anthropic, and Microsoft have announced ChatGPT Health, Claude for Health Care, and Copilot Health, respectively. The CMIA prohibits a provider of health care, among others, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, for any purpose not necessary to provide health care services to a patient, except as provided. The CMIA makes a business that offers software or hardware to consumers, including a mobile application designed to maintain medical information to make the information available to an individual or a provider of health care, for purposes of allowing the individual to manage the their information or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. In announcements of these DTC health AI apps, developers have made clear that their tools do not diagnose or treat patients, or claim that consumer facing elements are intended to assist with preparing for doctor’s appointments. Given this focus, there may be room for clarity for what it means to manage an individual’s information.

In January 2025, the California Department of Justice released legal advisories regarding the use of AI in health care, which cite these provisions of the CMIA:

“Vast quantities of patient data underlie the massive growth in the health AI sector. Data is used to build and train AI and to render decisions that impact health services. Developers and entities that use AI in healthcare should carefully monitor training data, inputs, and outputs to ensure respect for Californians’ rights to medical privacy.

California state medical privacy laws provide protections that are, in some cases, more stringent than federal health privacy laws like HIPAA (the Health Insurance Portability and Accountability Act of 1996, 45 C.F.R. Parts 160 and 164). The CMIA and the Information Practices Act govern use and disclosure of Californians’ medical information. Covered entities must preserve confidentiality of patients’ medical information and ensure that patients have access to that information. Sensitive information, including mental and behavioral healthcare and reproductive and sexual healthcare (e.g., abortion and gender affirming care), receive heightened protections. Medical privacy laws apply to governmental healthcare agencies, medical providers, and insurance plans, as well as businesses that offer software or hardware to consumers for the purposes of managing medical information, diagnosis or treatment, or management of medical conditions, via mobile applications or other related devices.”

1. SUPPORT. The California Nurses Association (CNA) is the sponsor of this bill and states in support that it would protect against the threats presented by the rapid expansion of AI in health care to standards of care in clinical practice and patient privacy. CNA argues that caring for patients is deeply human work, requiring professional judgment, clear accountability, and strong protection for patients’ sensitive medical information. CNA contends this bill rejects the false promise of a human-in-the-loop model where AI performs the substantive clinical decision making and the clinician is left to supervise or sign off. CNA argues that this bill preserves a human in command standard, where the licensed health care professional remains the actual decision maker in health care clinical practice. In plain terms, if California law requires a licensed clinician to perform a health care activity, an AI tool cannot be used in that clinician’s place. CNA concludes this bill also ensures that AI health applications remain subject to California’s medical confidentiality laws, so patients do not lose privacy protections simply because their information passes through a digital platform.

Consumer Watchdog supports this bill and states that by ensuring that health care entities and AI developers cannot use AI to replace licensed clinical judgment or bypass health privacy protections it safeguards patient safety, medical privacy, and the integrity of health care practice. AI is rapidly entering the places patients receive care and consumer-facing health applications, often unbeknownst to patients. Too often the existing guardrails that are meant to protect patients are being blurred. Patient safety demands clear guardrails on the use of AI technologies. Consumer Watchdog argues this bill would protect patients by prohibiting health care entities from using AI to perform functions that require the clinical judgment of licensed health care professionals. Allowing untested and unaccountable AI technologies to perform or guide these functions risks patient harm and undermines public trust in the health care system.

1. OPPOSITION. The California Medical Association (CMA) opposes this bill stating that it would effectively prohibit AI-assisted technologies in core clinical activities such as patient assessment, care coordination, patient education, and clinical documentation, even when these tools are used under the direct supervision of a physician and do not replace physician judgment. CMA asserts that in current practice, many AI-enabled tools are embedded in EHRs and clinical workflows to improve accuracy, reduce administrative burden, and enhance patient outcomes. These include CDSS, predictive analytics for early detection of deterioration, and tools that assist in summarizing complex medical information. CMA concludes that prohibiting their use in any context involving professional judgment would effectively eliminate their utility in clinical settings.

TechNet opposes this bill stating that the definition of tools used to “manage” health information—including summarizing notes and organizing records—could sweep in widely used clinical support technologies. For example, AI-enabled documentation tools, such as clinical “scribes,” help reduce administrative burden and allow clinicians to spend more time directly engaging with patients. Subjecting these tools to additional regulatory requirements beyond existing frameworks may discourage their use, undermining gains in provider efficiency and patient experience. TechNet agrees that AI should not override licensed clinical judgment, the bill’s approach is overly broad and fails to distinguish between high- and low-risk uses. Many applications—such as patient reminders and administrative communications—enhance care delivery, improve medication adherence, and reduce clinician workload.

1. OPPOSE UNLESS AMENDED. The California Hospital Association (CHA) opposes this bill unless amended to remove provisions which currently prohibit the use of AI and other technological tools in a health care setting. CHA argues this bill would disrupt existing, widely used, and beneficial technologies embedded in electronic health record platforms, where AI supports functions such as predictive alerts, clinical summarization, and documentation. These capabilities are deeply integrated into clinical workflows and cannot be removed without compromising data quality, workflow efficiency, and interoperability. CHA argues that this bill conflicts with state and federal requirements, including California’s Data Exchange Framework, which mandates real-time sharing of health information. AI tools play a key role in generating timely, structured clinical data necessary for compliance. Eliminating these tools would delay data exchange and reduce care coordination.
2. DOUBLE REFERRAL. This bill has been double referred; upon passage in this committee, it will be referred to the Assembly Privacy and Consumer Protection Committee.
3. RELATED LEGISLATION.
   1. AB 2575 (Ortega) would prohibit an employer from using or deploying technology to replace or eliminate a worker’s use of professional judgment in patient care and prohibits an employer from retaliating or discriminating against a worker providing patient care, as specified. Would authorize a worker who is subject to retaliation or discrimination in violation of this bill to file a complaint with the Labor Commissioner against an employer. Would prohibit a defendant who developed, modified, or used AI, as defined, that is alleged to have harmed a plaintiff from asserting a defense that the failure of a licensed health care professional or other health care worker to override an output of the AI or CDSS is a superseding cause severing the defendant’s liability for the alleged harm. Would require a health facility, clinic, physician’s office, or office of a group practice that uses or deploys a covered tool, as defined, for patient care to disclose required information to any licensed health care professional or other person using a covered tool or viewing outputs from a covered tool. AB 2575 is pending in the Assembly Health Committee.
   2. AB 1018 (Bauer-Kahan) would regulate the use of “automated decision systems” and place obligations on developers and deployers of such systems designed or used to make or facilitate “consequential decisions.” AB 1018 is pending on the Senate Floor.
   3. AB 1898 (Schultz) would require employers to give workers at least 90 days’ advance written notice before deploying any “workplace AI tool,” defined to include both automated decision systems and AI-based surveillance technologies. Would require employers to provide workers a notice that, among other disclosures, lists the tools used by the employers, each tool’s purpose, the data it collects, the employment decisions it may affect, and any quotas the tool sets or enforces. Would allow enforcement by the Labor Commissioner, public prosecutors, and workers themselves, with civil penalties of up to $500 per violation. AB 1898 is pending in the Assembly Judiciary Committee.
   4. SB 503 (Weber Pierson) would impose requirements on developers and deployers of patient care decision support tools, including that they make reasonable efforts to mitigate the risk of discrimination on the basis of a protected characteristic resulting from the tool’s use in its health programs or activities. SB 503 is pending on the Assembly Floor.
   5. SB 903 (Padilla) would prohibit a licensed professional from engaging in the use of AI to assist in providing supplementary support in therapy or psychotherapy where the client’s therapeutic session is recorded or transcribed unless the patient or their authorized representative is informed that AI will be used and provides consent. Would prohibit an individual, corporation, or entity from providing, advertising, or otherwise offering therapy or psychotherapy, including through the use of internet-based AI to the public in this state unless the therapy or psychotherapy services are conducted by an individual who is a licensed professional. Would prohibit a licensed professional from allowing AI to make independent therapeutic decisions or take other specified actions related to communications with clients. SB 903 is pending in the Senate Business, Professions and Economic Development Committee.
4. PREVIOUS LEGISLATION.
   1. AB 489 (Bonta), Chapter 615, Statutes of 2025, prohibits an AI or GenAI systems that misrepresent themselves as titled health care professionals. Authorizes state boards to pursue legal recourse against developers and deployers of AI and GenAI systems that impersonate healthcare workers.
   2. SB 243 (Padilla), Chapter 677, Statutes of 2025, establishes specified requirements on persons who make a companion chatbot that uses an artificial intelligence system with a natural language interface, as specified, including taking reasonable steps to prevent a companion chatbot from encouraging increased engagement, usage, or response rates. Requires an operator of a companion chatbot platform to annually report to the Department of Health Care Services on the number of times the operator has detected exhibitions of suicidal ideation by users, and the number of times a companion chatbot brought up suicidal ideation or actions with the users.
   3. AB 3030 (Calderon), Chapter 848, Statutes of 2024, requires specified health care providers to disclose the use of a GenAI tool when it is used to generate communications to a patient pertaining to patient clinical information, as defined, requires such a communication to include clear instructions permitting a patient to communicate with a human health care provider or other appropriate person, as specified, and exempts from disclosure written communications that are generated by GenAI and reviewed by a licensed or certified health care provider.
   4. SB 1120 (Becker), Chapter 879, Statutes of 2024, establishes requirements on health plans and insurers applicable to their use of AI for utilization review and utilization management decisions, including that the use of AI, algorithm, or other software must be based upon a patient’s medical or other clinical history and individual clinical circumstances as presented by the requesting provider and not supplant health care provider decision making.
   5. AB 254 (Bauer-Kahan), Chapter 254, Statutes of 2023, deems a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual's information, or for the individual's diagnosis, treatment, or management of a medical condition, to be a provider of health care, as specified.
   6. AB 2089 (Bauer-Kahan), Chapter 690, Statutes of 2022, deems any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual's information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a health care provider, as specified.
5. AMENDMENTS. The committee may wish to amend the bill as follows:
   1. Renumber the HSC section added from § 1339.76 to § 1339.77 to avoid conflicting with AB 2575 (Ortega); and
   2. Clarify that this bill prohibits the use or deployment of a tool, system, or device with AI “to replace the use of professional judgement” rather than “for any activity requiring the use of professional judgement.”

REGISTERED SUPPORT / OPPOSITION:

Support

California Nurses Association (sponsor)

Consumer Watchdog

Opposition

Adventist Health

California Chamber of Commerce

California Medical Association

Civil Justice Association of California

Connected Health Initiative

TechNet

Analysis Prepared by: Logan Hess / HEALTH / (916) 319-2097