AB 1979 regulates healthcare chatbot functions and confidentiality
Oct 4, 2026 edition · GC-2026-0071 · Published 2026-10-04 · Version 2 · Final
AB 1979 adds qualifying healthcare chatbot businesses to CMIA protections and limits AI performance of licensed clinical functions. The enacted law preserves independent professional judgment and defines limited communication, documentation and supervised-training exceptions.

What happened
California enacted AB 1979 on September 30 with separate confidentiality and clinical-use provisions. Under Civil Code section 56.06, a business offering a qualifying healthcare chatbot so a consumer can manage information or obtain diagnosis, treatment or management of a condition is deemed a healthcare provider for CMIA purposes. The chatbot definition requires an adaptive generative AI natural-language interface, marketing as supporting health services and use of health-related information supplied, accessed, collected, generated or inferred by the chatbot. Covered businesses must maintain provider-equivalent confidentiality standards and face CMIA penalties for improper use or disclosure. This designation does not make them licensed providers under other laws. The enactment is the event reported here; the applicable commencement of these provisions must be confirmed separately.
New Business and Professions Code section 22758.5 requires covered facilities and practices to take reasonable steps to preserve a licensed provider’s independent professional judgment when care is informed by clinical decision support. They may not deploy AI to independently perform clinical functions legally requiring a professional license or direct unlicensed personnel in those functions. The text preserves use by trainees in supervised training toward licensure and excludes documentation or communication without professional judgment, such as record-update messages, reminders or helping a patient find requested information. Listed administrative functions are also outside the clinical-decision-support definition when their independent performance requires no professional license. Physician discipline and licensing-board injunction authority remain specified enforcement routes.
Scope and timing
- Authority status
- Final
- Applicability
- Potentially applicable
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
Why it matters
A chatbot’s confidentiality obligations and its permission to perform a clinical function are different questions. A business can enter CMIA’s privacy framework without acquiring authority to practice a profession. Provider review must also preserve meaningful professional judgment rather than simply present AI output for routine acceptance.
Recommended action
Confirm the applicable commencement before treating the new provisions as current duties. Prepare the following for implementation at that commencement: Inventory chatbot data flows and clinical decision functions, then map each to CMIA coverage, licensing restrictions and the actual exception relied on. Review confidentiality safeguards, clinician authority and escalation paths before expanding autonomous use. Document supervised-training and nonjudgment communication use cases separately.
Sources
- AB 1979 Health care services: artificial intelligence, bill historyOfficial · California Legislature · 2026-09-04 · Source review 2026-09-10
- AB 1979 Health care services: artificial intelligence, current bill text (09/01/26 - Enrolled)Official · California Legislature · 2026-09-01 · Source review 2026-09-10
- California’s nation-leading AI framework just got stronger, Governor Newsom signs more first-in-the-nation worker protections and moreOfficial · Office of the Governor · 2026-09-30 · Source review 2026-10-04
- AB1979 enacted final textOfficial · California Legislature · 2026-09-30 · Source review 2026-10-05
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →