AB 1854 strengthens protected healthcare legal process safeguards
Oct 4, 2026 edition · GC-2026-0218 · Published 2026-10-04 · Version 2 · Final
California expanded protected-healthcare safeguards regardless of patient location and extended specified legal-process controls to California financial-service corporations. AB 1854 also adds enforcement tools while retaining conditions for patient-brought proceedings and process unrelated to penalizing protected care.
What happened
California enacted AB 1854 on September 27 to amend Penal Code sections 1549.1, 13778.2 and 13778.3. The amendments apply specified arrest, public-agency cooperation and California subpoena restrictions to legally protected healthcare activity regardless of the patient’s location, when the activity is lawful under California law. They also bar state or local law enforcement from knowingly arresting, or participating in the arrest of, a person whom the Governor has declined to surrender under section 1549.1. The public-agency restriction on cooperation with federal law enforcement remains expressly limited to the extent permitted by federal law. The enactment is the event reported here; the applicable commencement of these provisions must be confirmed separately.
The law extends the declaration requirements for specified out-of-state process and law-enforcement record requests to California corporations providing financial services to the general public, alongside electronic communication and remote computing services. Financial services include receiving deposits, extending credit, transferring funds, or transporting cash or financial instruments. The declaration must state that the discovery and resulting information will not be used in a protected-care proceeding, or establish the specified alternative for a patient-brought tort, contract or statutory claim actionable in an equivalent or similar manner in California. Covered corporations may rely on the declaration’s representations. The Attorney General may seek enforcement, and a court must assess $10,000 for a first and $15,000 for each subsequent violation involving intentional, knowing, willing or reckless prohibited compliance or disclosure. The text also preserves process unrelated to laws penalizing protected care and specified requests by the investigation’s subject.
Scope and timing
- Authority status
- Final
- Applicability
- Potentially applicable
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
Why it matters
Protected-care information can surface through public-agency records, technology services and financial transactions. The new financial-services coverage and patient-location language make request classification important, but they do not support treating every out-of-state request as prohibited. The required declarations, patient-claim conditions and federal-law limitation require legal review.
Recommended action
Confirm the applicable commencement before treating the new provisions as current duties. Prepare the following for implementation at that commencement: Route protected-care subpoenas and law-enforcement requests to counsel before disclosure. Update intake checks for the required declaration and the conditions for patient-brought claims, and identify financial-service relationships that may hold revealing records. Preserve the request, legal analysis and disclosure decision, and distinguish the covered entity’s duties from those of a healthcare provider using its services.
Sources
- AB1854 enacted final textOfficial · California Legislature · 2026-09-27 · Source review 2026-10-05
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →