WHAT THIS BILL REGULATES · 2 REQUIREMENT TYPES
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
(a) \"Artificial intelligence health modelArtificial intelligence health model\"Artificial intelligence health model\" means an artificial intelligence model, as defined in Section 22757.11 of the Business and Professions Code, that offers an individual the option to securely connect or integrate their medical record for the purpose of understanding and managing their health and wellness.Civ. Code § 56.05(a)\" means an artificial intelligenceArtificial intelligence\"Artificial intelligence\" has the same meaning as defined in Section 1339.75.Health & Safety Code § 1339.76(e)(1) model, as defined in Section 22757.11 of the Business and Professions Code, that offers an individual the option to securely connect or integrate their medical record for the purpose of understanding and managing their health and wellness.
Section 1 of the bill amends Civil Code § 56.05 to add a new definition of artificial intelligence health model — an AI model that offers an individual the option to securely connect or integrate their medical record for purposes of understanding and managing their health and wellness. This definition is keyed to the existing definition of "artificial intelligence model" in Business and Professions Code § 22757.11. By introducing this defined term, the section sets the stage for § 56.06(f), which deems any business offering such a model a provider of health care subject to the CMIA.
The remainder of the amendments to § 56.05 are re-lettering changes to accommodate the new subdivision (a) definition. No other definitions are substantively changed.
(f) 1 Any business that offers an artificial intelligence health modelArtificial intelligence health model\"Artificial intelligence health model\" means an artificial intelligence model, as defined in Section 22757.11 of the Business and Professions Code, that offers an individual the option to securely connect or integrate their medical record for the purpose of understanding and managing their health and wellness.Civ. Code § 56.05(a) shall be deemed to be a provider of health careProvider of health care"Provider of health care" means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; a person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; a person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; or a clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. "Provider of health care" does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.Civ. Code § 56.05(q) subject to the requirements of this part.
(g) 1 Any business described in this section shall maintain the same standards of confidentiality required of a provider of health careProvider of health care"Provider of health care" means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; a person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; a person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; or a clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. "Provider of health care" does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.Civ. Code § 56.05(q) with respect to medical informationMedical information"Medical information" means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient's medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. "Individually identifiable" means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient's name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the identity of the individual.Civ. Code § 56.05(k) disclosed to the business.
(h) Any business described in this section is subject to the penalties for improper use and disclosure of medical informationMedical information"Medical information" means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient's medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. "Individually identifiable" means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient's name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the identity of the individual.Civ. Code § 56.05(k) prescribed in this part.
Section 2 amends Civil Code § 56.06 to add new subdivision (f), which deems any business that offers an artificial intelligence health model a "provider of health care" subject to the full requirements of the Confidentiality of Medical Information Act (CMIA). This is the bill's primary mechanism for extending health data confidentiality obligations to AI health products. The standard CMIA limiting clause applies: the business is deemed a provider of health care only for purposes of Part 2.6 of the Civil Code, not for any other law.
Subdivisions (g) and (h), re-lettered from former (f) and (g), continue to require all businesses covered by § 56.06 — now including AI health model businesses — to maintain the same confidentiality standards as traditional health care providers and to be subject to CMIA penalties for improper use and disclosure of medical information.
(a) 2 A health facilityHealth facility\"Health facility\" has the same meaning as defined in Section 1250.Health & Safety Code § 1339.76(e)(4), clinicClinic\"Clinic\" has the same meaning as defined in Section 1200.Health & Safety Code § 1339.76(e)(2), physician's officePhysician's office\"Physician's office\" has the same meaning as defined in Section 1339.75.Health & Safety Code § 1339.76(e)(6), or office of a group practiceOffice of a group practice\"Office of a group practice\" has the same meaning as defined in Section 1339.75.Health & Safety Code § 1339.76(e)(5) shall not use or deploy a tool, system, or device that includes artificial intelligenceArtificial intelligence\"Artificial intelligence\" has the same meaning as defined in Section 1339.75.Health & Safety Code § 1339.76(e)(1) for any activity requiring the use of professional judgment by a licensed health care professionalLicensed health care professional"Licensed health care professional" means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.Civ. Code § 56.05(i).
(b) 3 A health facilityHealth facility\"Health facility\" has the same meaning as defined in Section 1250.Health & Safety Code § 1339.76(e)(4), clinicClinic\"Clinic\" has the same meaning as defined in Section 1200.Health & Safety Code § 1339.76(e)(2), physician's officePhysician's office\"Physician's office\" has the same meaning as defined in Section 1339.75.Health & Safety Code § 1339.76(e)(6), or office of a group practiceOffice of a group practice\"Office of a group practice\" has the same meaning as defined in Section 1339.75.Health & Safety Code § 1339.76(e)(5) shall not use or deploy a tool, system, or device that includes artificial intelligenceArtificial intelligence\"Artificial intelligence\" has the same meaning as defined in Section 1339.75.Health & Safety Code § 1339.76(e)(1) to direct, guide, supervise, or instruct unlicensed personnel in performing any function that requires a professional license.
(c)(1)–(5) A violation of this section by a licensed health facilityHealth facility\"Health facility\" has the same meaning as defined in Section 1250.Health & Safety Code § 1339.76(e)(4) is subject to the enforcement mechanisms described in Article 4 (commencing with Section 1290) of Chapter 2.
(d) This section does not prohibit the use of artificial intelligenceArtificial intelligence\"Artificial intelligence\" has the same meaning as defined in Section 1339.75.Health & Safety Code § 1339.76(e)(1) for documentation and communication that does not involve the application of professional judgment, including, but not limited to, automated messages to inform patients of updates to their health records.
(e)(1)–(6) For purposes of this section, the following definitions apply: (1) \"Artificial intelligenceArtificial intelligence\"Artificial intelligence\" has the same meaning as defined in Section 1339.75.Health & Safety Code § 1339.76(e)(1)\" has the same meaning as defined in Section 1339.75. (2) \"ClinicClinic\"Clinic\" has the same meaning as defined in Section 1200.Health & Safety Code § 1339.76(e)(2)\" has the same meaning as defined in Section 1200.
Section 3 adds new Health & Safety Code § 1339.76, the bill's most operationally significant provision. It imposes two categorical prohibitions on health facilities, clinics, physician's offices, and group practice offices. First, subdivision (a) prohibits using or deploying any AI tool, system, or device for any activity requiring the use of professional judgment by a licensed health care professional — including patient condition assessment, patient and family education on health care problems and post-discharge care, inter-professional handoff communications, and documentation requiring professional expertise applied to an individual patient. Second, subdivision (b) prohibits using AI to direct, guide, supervise, or instruct unlicensed personnel in performing any function that requires a professional license.
Subdivision (d) provides a notable carve-out: AI may still be used for documentation and communication that does not involve the application of professional judgment, such as automated patient notifications about health record updates. Enforcement is layered — existing health facility and clinic enforcement mechanisms, the Unfair Competition Law (Bus. & Prof. Code § 17200), and professional licensing board injunctive authority all apply.
No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction.
Section 4 is a standard California state-mandated local program disclaimer, stating that no reimbursement is required because the only costs that may be incurred by local agencies arise from the creation of new crimes or changes to crime definitions.