AB1979 - Health care services: artificial intelligence.

Amended IN Senate August 20, 2026 Amended IN Senate July 02, 2026 Amended IN Senate June 22, 2026 Amended IN Senate June 17, 2026 Amended IN Assembly April 23, 2026 Amended IN Assembly April 09, 2026 Amended IN Assembly March 19, 2026 Amended IN Assembly March 16, 2026 CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION Assembly Bill No. 1979 Introduced by Assembly Member Bonta February 13, 2026 An act to add Chapter 25.5 (commencing with Section 22758.5) to Division 8 of the Business and Professions Code, and to amend Sections 56.05 and 56.06 of the Civil Code, and to add Section 1339.77 to the Health and Safety Code, relating to health care services. LEGISLATIVE COUNSEL'S DIGEST AB 1979, as amended, Bonta. Health care services: artificial intelligence. (1) The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. Existing law makes a violation of these provisions that results in economic loss or personal injury punishable as a misdemeanor. Existing law deems a business that offers a mental health digital service or reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a provider of health care subject to the requirements of the CMIA. The bill would additionally deem a business that offers a health care chatbot, as defined, to a consumer for the above-described purposes to be a provider of health care subject to the requirements of the CMIA. Because the bill would expand the scope of a crime, it would impose a state-mandated local program. (2) Existing law provides for the licensure and regulation of health facilities and clinics by the State Department of Public Health. Existing law generally makes a violation of these provisions a crime. Existing law requires a health facility, clinic, physician’s office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person, except as specified. This bill would require a health facility, clinic, physician’s office, or office of a group practice to take reasonable steps to ensure that a licensed health care professional, acting within their scope of practice, retains the ability to exercise independent professional judgment in their care of a patient whenever that care is informed by the output of a clinical decision support system, as defined. The bill would prohibit a health facility, clinic, physician’s office, or office of a group practice from using or deploying a tool, system, or device that includes artificial intelligence to independently perform any clinical function that is required by law to be performed by a person with a professional license. The bill would make a violation of these provisions by a physician subject to the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California. The bill would also authorize the appropriate professional licensing board to pursue an injunction or restraining order to enforce these provisions to the extent that a violation constitutes the practice of a health care profession without a license. The bill would specify that these provisions do not apply to the use of automated decision systems for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records. By placing new requirements on health facilities and clinics, this bill would expand the scope of a crime and would impose a state-mandated local program. (3) The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YES Bill Text The people of the State of California do enact as follows: SECTION 1. Chapter 25.5 (commencing with Section 22758.5) is added to Division 8 of the Business and Professions Code, to read: CHAPTER 25.5. AI Clinical Decision Support 22758.5. (a) A health facility, clinic, physician’s office, or office of a group practice shall take reasonable steps to ensure that a licensed health care provider, acting within their scope of practice, retains the ability to exercise independent professional judgment in their care of a patient whenever that care is informed by the output of a clinical decision support system. (b) (1) A health facility, clinic, physician’s office, or office of a group practice shall not use or deploy a tool, system, or device that includes artificial intelligence to do any of the following: (A) Direct, guide, supervise, or instruct unlicensed personnel in their performance of any clinical function that is required by law to be performed by a person with a professional license. (B) Independently perform any clinical function that is required by law to be performed by a person with a professional license. (2) This subdivision does not prohibit the use or deployment of a tool, system, or device by a trainee as part of a supervised course of study or training program while working toward licensure. (c) (1) A violation of this section by a physician is subject to the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California, as appropriate. (2) To the extent that a violation of this section constitutes the practice of a health care profession without a license, the appropriate health care professional licensing board may pursue an injunction or restraining order to enforce this section, as authorized by Section 125.5. (3) Nothing in this section limits the authority for a health care professional licensing board or enforcement agency to pursue any remedy otherwise authorized under the law. (d) This section does not apply to the use of automated decision systems for documentation and communication that does not involve the application of professional judgment, including, but not limited to, automated messages to inform patients of updates to their health records, generating reminders, or assisting patients to find information at their request. (e) For purposes of this section, the following definitions apply: (1) “Artificial intelligence” has the same meaning as defined in Section 1339.75 of the Health and Safety Code. (2) (A) “Automated decision system” means a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons. (B) “Automated decision system” does not include a spam email filter, firewall, antivirus software, identity and access management tools, calculator, database, dataset, or other compilation of data. (3) “Clinic” has the same meaning as defined in Section 1200 of the Health and Safety Code. (4) “Clinical decision support system” means an artificial intelligence system that produces a prediction, classification, recommendation, evaluation, or analysis that aids clinical decisionmaking related to timing of care, diagnosis, or treatment. It does not include systems that provide appointment management such as booking, canceling and rescheduling appointments, appointment reminders, patient education and pre-visit materials and preparation, and payment processing, to the extent the independent performance of these activities by the system does not require a professional license. (5) “Generative artificial intelligence” has the same meaning as that term is defined in Section 1339.75 of the Health and Safety Code. (6) “Health care provider” means a person licensed or certified pursuant to Division 2 (commencing with Section 500). (7) “Health facility” has the same meaning as defined in Section 1250 of the Health and Safety Code. (8) “Office of a group practice” has the same meaning as defined in Section 1339.75 of the Health and Safety Code. (9) “Physician’s office” has the same meaning as defined in Section 1339.75 of the Health and Safety Code. SECTION 1. SEC. 2. Section 56.05 of the Civil Code is amended to read: 56.05. For purposes of this part: (a) “Artificial intelligence” has the same meaning as that term is defined in Section 1339.75 of the Health and Safety Code. (b) “Authorization” means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information. (c) “Authorized recipient” means a person who is authorized to receive medical information pursuant to Section 56.10 or 56.20. (d) “Confidential communications request” means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to them at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee. (e) “Contractor” means a person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. “Contractor” does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code). (f) “Enrollee” has the same meaning as that term is defined in Section 1345 of the Health and Safety Code. (g) “Expiration date or event” means a specified date or an occurrence relating to the individual to whom the medical information pertains or the purpose of the use or disclosure, after which the provider of health care, health care service plan, pharmaceutical company, or contractor is no longer authorized to disclose the medical information. (h) “Generative artificial intelligence” has the same meaning as that term is defined in Section 1339.75 of the Health and Safety Code. (i) “Health care chatbot” means a generative artificial intelligence system with a natural language interface that does all of the following: (1) Provides adaptive, human-like responses to user inputs. (2) Is marketed as facilitating or supporting health services to a consumer. (3) (A) Uses health care chatbot information to facilitate or support health service to a consumer. (B) For purposes of this paragraph, “health care chatbot information” means information related to a consumer’s physical or mental health or wellness that a consumer provides to a chatbot, either directly or by allowing access to that information, or is collected, generated, or inferred by a chatbot. (j) “Health care service plan” means an entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code). (k) “Licensed health care professional” means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code. (l) “Marketing” means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service. “Marketing” does not include any of the following: (1) Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication. (2) Communications made to current enrollees solely for the purpose of describing a provider’s participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals. (3) Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individual’s adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (e) and (f) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply: (A) The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration. (B) The individual is provided the opportunity to opt out of receiving future remunerated communications. (C) The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. Further communication shall not be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt-out request. (m) (1) “Medical information” means any individually identifiable information, in electr [Text truncated for display. Full text available on Congress.gov.]