AB 2448 Medical information: confidentiality
Sep 27, 2026 edition · GC-2026-0076 · Published 2026-09-27 · Version 2 · Proposed
AB 2448 proposes requiring covered sensitive-record businesses to enable specified security functions, with an express direct-provider/plan/contractor exclusion.
What happened
AB 2448 proposes changing CMIA’s sensitive-record system provision from developing capabilities that enable specified features to requiring those features actually be enabled. The functions address access limits, segregation of gender-affirming, abortion-related and contraception information, interstate disclosure controls and the ability to disable access from another state. The proposal refers to the existing July 2024 framework; that historical date is not presented here as a new 2026 implementation deadline. The measure remains proposed during the covered week.
The subsection reaches the specified businesses under Civil Code 56.06 storing or maintaining sensitive-service information on behalf of listed entities. It expressly does not apply to a contractor, health plan or healthcare provider as defined in section 56.05, so the particular business role matters. Existing general confidentiality, record-integrity and access rules remain separate. Teams assessing a vendor should distinguish a promised feature from evidence it is enabled, while checking the proposed statutory scope and other applicable disclosure law rather than assuming every provider itself has this new subsection duty.
Scope and timing
- Authority status
- Proposed
- Applicability
- Potentially applicable
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
Why it matters
A contractual capability and an enabled production safeguard differ, but the proposed duty must first be matched to the correct type of record-holding business.
Recommended action
Monitor the proposal, confirm vendor/business status with Legal and request evidence of applicable sensitive-record controls. Preserve current confidentiality and lawful access practices; do not infer new permission to disclose or a new deadline from the proposal.
Sources
- AB 2448 Medical information: confidentiality, bill historyOfficial · California Legislature · 2026-09-03 · Source review 2026-09-10
- AB 2448 Medical information: confidentiality, current bill text (08/30/26 - Enrolled)Official · California Legislature · 2026-08-30 · Source review 2026-09-10
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →