AB45 - Privacy: health data: location and research.

Assembly Bill No. 45 CHAPTER 134 An act to amend Section 1798.99.90 of, to amend the heading of Title 1.81.49 (commencing with Section 1798.99.90) of Part 4 of Division 3 of, and to add Sections 1798.99.91, 1798.99.92, and 1798.99.93 to, the Civil Code, and to amend Section 140 of the Health and Safety Code, relating to privacy. [ Approved by Governor September 26, 2025. Filed with Secretary of State September 26, 2025. ] LEGISLATIVE COUNSEL'S DIGEST AB 45, Bauer-Kahan. Privacy: health data: location and research. Existing law prohibits a person or business, as defined, from collecting, using, disclosing, or retaining the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, as defined, except as necessary to perform the services or provide the goods requested and prohibits a person or business from selling or sharing this personal information. Existing law authorizes an aggrieved person or entity to institute and prosecute a civil action against a person or business for a violation of these provisions and specifies the damages and costs authorized to be recovered. This bill would recast the above-described provisions, and instead prohibit the collection, use, disclosure, sale, sharing, or retention of the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except under certain circumstances, including, among others, for the collection or use as necessary to perform the services or provide the goods requested. The bill would also provide that these provisions do not alter applicable law regarding use by a law enforcement agency, as defined, of personal information generated by an electronic monitoring device. The bill would authorize an aggrieved person to institute and prosecute a civil action against a natural person, association, proprietorship, corporation, trust, foundation, partnership, or any other organization or group of people acting in concert for a violation of these provisions. The bill would also make other nonsubstantive changes. This bill would, subject to specified exceptions, prohibit geofencing, or selling or sharing personal information with a third party to geofence, as defined, an entity that provides in-person health care services in California for specified purposes, and would prohibit the use of personal information obtained in violation of this provision. The bill would provide that violators are subject to an injunction and liable for a civil penalty assessed and recovered in a civil action brought by the Attorney General, and deposited in the California Reproductive Justice and Freedom Fund. The bill would require those penalties to be awarded by the State Department of Public Health for grants to implement a program or to fund an existing program that provides and promotes medically accurate and comprehensive reproductive and sexual health education, as provided. The bill would also provide that a statement signed under penalty of perjury, as specified, that the personal information will not be used for selling or sharing personal information in violation of these geofencing provisions is prima facie evidence that the personal information was not sold or shared in violation of these geofencing provisions. By expanding the crime of perjury, this bill would impose a state-mandated local program. Existing law, the Confidentiality of Medical Information Act (CMIA), generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless a specified exception applies. The CMIA prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another state’s laws that interfere with a person’s rights to choose or obtain an abortion or a foreign penal civil action. This bill would, similar to the provisions of the CMIA, prohibit the release of research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another state’s laws that interfere with a person’s rights to choose or obtain an abortion or a foreign penal civil action. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YES Bill Text The people of the State of California do enact as follows: SECTION 1. The heading of Title 1.81.49 (commencing with Section 1798.99.90) of Part 4 of Division 3 of the Civil Code is amended to read: TITLE 1.81.49. Health and Location Data Privacy SEC. 2. Section 1798.99.90 of the Civil Code is amended to read: 1798.99.90. For purposes of this title, the following definitions apply: (a) “Collect,” “collected,” or “collection” means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a natural person by any means. This includes receiving information from the natural person, either actively or passively, or by observing the natural person’s behavior. (b) “Family planning center” means a facility categorized as a family planning center by the North American Industry Classification System adopted by the United States Census Bureau, including, but not limited to, a clinic or center that provides reproductive health care services as defined in Section 1798.300. (c) “Geofence” means any technology that enables spatial or location detection to establish a virtual boundary around, and detect an individual’s presence within, a “precise geolocation” as defined in subdivision (w) of Section 1798.140. (d) “Health care services” means any service provided to a natural person of a medical, surgical, psychiatric, therapeutic, diagnostic, mental health, behavioral health, preventative, rehabilitative, supportive, consultative, referral, or prescribing nature. (e) “Person” means a natural person, association, proprietorship, corporation, trust, foundation, partnership, or any other organization or group of people acting in concert. (f) “Personal information” has the same definition as that term is defined in subdivision (v) of Section 1798.140, except as applied to all natural persons and not limited to consumers and households, as those terms are defined in subdivisions (i) and (q), respectively, of that section. (g) “Precise geolocation” means a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet as derived from a device that is used or intended to be used to locate a person. If the geographic scope of the term “precise geolocation” as defined in Section 1798.140 is expanded beyond 1,850 feet, then that larger scope shall apply to this definition of precise geolocation. (h) “Research” means systematic investigation, including research development, testing, and evaluation, that has as its primary purpose the development of, or contribution to, generalizable knowledge. (i) “Sell,” “selling,” “sale,” or “sold” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a natural person’s personal information by another person to a third party for monetary or other valuable consideration. (j) “Share,” “shared,” or “sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a natural person’s personal information by another person to a third party, whether or not for monetary or other valuable consideration. SEC. 3. Section 1798.99.91 is added to the Civil Code, immediately following Section 1798.99.90, to read: 1798.99.91. (a) It shall be unlawful to collect, use, disclose, sell, share, or retain the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except as specified in subdivision (b) or as otherwise provided by law or in a collective bargaining agreement. (b) Notwithstanding subdivision (a), it is permissible to collect or use the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, but only as necessary to perform the services or provide the goods requested by the natural person. All other prohibitions under subdivision (a) shall continue to apply. (c) (1) An aggrieved person or entity, including a family planning center, may institute and prosecute a civil action against any person who violates this section for injunctive and monetary relief and attorney’s fees within three years of discovery of the violation. (2) If the court finds for the petitioner in an action authorized by paragraph (1), recovery shall be in the amount of three times the amount of actual damages and any other expenses, costs, or reasonable attorney’s fees incurred in connection with the litigation. (d) (1) This section does not apply to a provider of health care, a health care service plan, or contractor, as those terms are defined in Section 56.05 or to a covered entity or its business associate, as defined in Section 160.103 of Title 45 of the Code of Federal Regulations. (2) In order to qualify for this exemption, a contractor or business associate must be contractually obligated to comply with all applicable state and federal privacy laws. (e) (1) Nothing in this section shall be construed to alter applicable law, including pursuant to Section 3010 of the Penal Code, regarding use by a law enforcement agency of personal information, including geolocation information, generated by an electronic monitoring device. (2) For purposes of this section, “law enforcement agency” means any department or agency of the state or any local government, special district, or other political subdivision thereof that employs any peace officer, as described in Chapter 4.5 (commencing with Section 830) of Title 3 of Part 2 of the Penal Code. SEC. 4. Section 1798.99.92 is added to the Civil Code, immediately following Section 1798.99.91, to read: 1798.99.92. (a) Except as provided in subdivision (f), it shall be unlawful to geofence an entity that provides in-person health care services in California for any of the following purposes: (1) To identify or track a person seeking, receiving, or providing health care services. (2) To collect personal information from a person seeking, receiving, or providing health care services. (3) To send notifications to a person related to their personal information or health care services. (4) To send advertisements to a person related to the person’s personal information or health care services. (b) It shall be unlawful to sell personal information to, or share personal information with, a third party for the use of such information to violate subdivision (a). A statement signed under penalty of perjury, pursuant to Section 2015.5 of the Code of Civil Procedure, by a natural person authorized to enter into agreements on behalf of the third party that the personal information will not be used for these purposes shall be prima facie evidence that the personal information was not sold or shared in violation of this subdivision. (c) Except as provided in subdivision (f), it shall be unlawful to use personal information obtained in violation of subdivision (a) or (b). (d) (1) Any person that violates this section shall be subject to an injunction and liable for a civil penalty of twenty-five thousand dollars ($25,000) for each violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The court may consider the good faith cooperation of the entity or person in determining the amount of the civil penalty. (2) Any civil penalty recovered by an action brought by the Attorney General for a violation of this section, and the proceeds of any settlement of any said action, shall be deposited in the California Reproductive Justice and Freedom Fund established pursuant to Section 140 of the Health and Safety Code. (e) This section shall be implemented consistent with state and federal law. (f) (1) (A) This section does not prohibit any person that owns, operates, manages, or otherwise provides services to an in-person health care entity from geofencing the entity’s own location to provide necessary health care services, including the use of location-based alarm devices to monitor newborns and memory-impaired individuals. (B) This section does not prohibit any person that provides reproductive health care services, as defined in Section 1798.300, from utilizing geofencing for the purpose of providing security services to protect patients, staff, or property. (2) Nothing in this section shall exempt any person from complying with any of the following: (A) A lawfully executed search warrant. (B) A lawful subpoena issued pursuant to existing California law. (C) Law enforcement if law enforcement, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires access to such geofencing data. For purposes of this subparagraph, accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including, but not limited to, abortion services, shall not constitute being at risk or danger of death or serious physical injury. (3) Nothing in this section abrogates or limits the requirements of the Electronic Communications Privacy Act (Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code). (4) Nothing in this section shall apply to geofencing activities conducted solely for research purposes by an investigator within an institution that holds an assurance with the federal Department of Health and Human Services pursuant to Part 46 (commencing with Section 46.101) of Title 45 of the Code of Federal Regulations and [Text truncated for display. Full text available on Congress.gov.]