The Confidentiality of Medical Information Act (CMIA) regulates the use and disclosure of medical information by health care providers and other covered entities. Existing law already treats businesses offering certain mental health and reproductive or sexual health digital services as health care providers subject to the CMIA. Separately, existing law requires specified health care facilities using generative artificial intelligence to generate patient communications regarding clinical information to disclose that the communication was AI-generated and explain how the patient can contact a human health care provider or other appropriate person.
AB 1979 expands both sets of protections. First, AB 1979 treats a business offering a qualifying health care chatbot as a health care provider subject to the CMIA, thereby subjecting that business to California’s medical-information privacy requirements. Second, AB 1979 requires a health facility, clinic, physician’s office, or group practice using an AI-assisted clinical decision support system to take reasonable steps to ensure that a licensed health care professional retains the ability to exercise independent professional judgment when patient care is informed by the system’s output.
AB 1979 also prohibits covered health care entities from using an AI tool, system, or device to independently perform a clinical function that state law requires to be performed by a licensed professional. AB 1979 does not prohibit automated systems used for documentation or communications that do not involve professional judgment, such as automated notices informing patients of updates to their health records. Physicians may be subject to discipline by the Medical Board of California or Osteopathic Medical Board of California for violations, and appropriate professional licensing boards may seek injunctive relief where use of the technology amounts to unlicensed practice.
Affected health care facilities, clinics, physicians’ offices, and group practices should review their clinical AI and decision-support tools to ensure licensed professionals retain independent judgment and that AI is not independently performing functions legally reserved for licensed professionals. Businesses offering qualifying health care chatbots must also comply with the CMIA’s medical-information privacy requirements.
AB 1979 amends sections 56.05 and 56.06 of the Civil Code and adds section 1339.77 to the Health and Safety Code.
