Compliance SweepBack to stories →
← Back to stories

AB 1979 regulates healthcare chatbot functions and confidentiality

AB 1979 adds qualifying healthcare chatbot businesses to CMIA protections and limits AI performance of licensed clinical functions. The enacted law preserves independent professional judgment and defines limited communication, documentation and supervised-training exceptions.

Illustrative artwork. Fictional scene, not a photograph of the people or events in this story.

What happened

California enacted AB 1979 on September 30 with separate confidentiality and clinical-use provisions. Under Civil Code section 56.06, a business offering a qualifying healthcare chatbot so a consumer can manage information or obtain diagnosis, treatment or management of a condition is deemed a healthcare provider for CMIA purposes. The chatbot definition requires an adaptive generative AI natural-language interface, marketing as supporting health services and use of health-related information supplied, accessed, collected, generated or inferred by the chatbot. Covered businesses must maintain provider-equivalent confidentiality standards and face CMIA penalties for improper use or disclosure. This designation does not make them licensed providers under other laws. The enactment is the event reported here; the applicable commencement of these provisions must be confirmed separately.

New Business and Professions Code section 22758.5 requires covered facilities and practices to take reasonable steps to preserve a licensed provider’s independent professional judgment when care is informed by clinical decision support. They may not deploy AI to independently perform clinical functions legally requiring a professional license or direct unlicensed personnel in those functions. The text preserves use by trainees in supervised training toward licensure and excludes documentation or communication without professional judgment, such as record-update messages, reminders or helping a patient find requested information. Listed administrative functions are also outside the clinical-decision-support definition when their independent performance requires no professional license. Physician discipline and licensing-board injunction authority remain specified enforcement routes.

Scope and timing

Authority status
Final
Applicability
Potentially applicable
Audience
Health systems, Provider networks, Health-tech
Jurisdiction
California

Why it matters

A chatbot’s confidentiality obligations and its permission to perform a clinical function are different questions. A business can enter CMIA’s privacy framework without acquiring authority to practice a profession. Provider review must also preserve meaningful professional judgment rather than simply present AI output for routine acceptance.

Sources

Complete edition and supplemental material

This finding in the complete approved report →

Regulatory horizons, CIA trends and implementation trackers remain in the full report.

Read the entire Compliance Sweep report →

← Return to stories

Privacy preferences

Where enabled for this site, Cloudflare Web Analytics can send page-use and performance measurements to Cloudflare. This panel provides information and does not turn analytics on or off.

This panel stores no tracking choice and does not change your tool saves, screening, resets, reports or exports. Other sites have separate settings.

Read Privacy & Cookies