AB 2448 requires sensitive medical information access controls
Oct 4, 2026 edition · GC-2026-0076 · Published 2026-10-04 · Version 2 · Final
AB 2448 changes sensitive-medical-information protections from developing capabilities to enabling them for covered storage businesses. Its final text specifies segregation, access and out-of-state controls while retaining exclusions for the separately defined providers, plans and contractors.
What happened
California enacted AB 2448 on September 27 to amend Civil Code section 56.101. For covered businesses described in section 56.06 that electronically store or maintain sensitive-service medical information on behalf of the listed healthcare and employer entities, the text adds an express requirement to enable the specified safeguards as well as develop capabilities, policies and procedures. The controls cover information related to gender-affirming care, abortion and abortion-related services, and contraception. They limit access privileges to authorized persons, address prohibited out-of-state disclosure and processing, segregate the sensitive information from the rest of a record, and provide the ability to disable out-of-state access automatically. The enactment is the event reported here; the applicable commencement of these provisions must be confirmed separately.
The amendment retains the subsection’s July 1, 2024 date in its wording; that retained date should not be described as a newly created prospective implementation period in 2026. Subsection (c) excludes contractors, health plans and healthcare providers as those terms are defined in section 56.05, so the identity and role of the storage business matter. The surrounding section preserves confidentiality duties and requires an EHR or EMR to record changes or deletions with the user identity, access date and time, and change made. Fees charged to comply with subsection (c) must remain consistent with the cited federal information-blocking regulation.
Scope and timing
- Authority status
- Final
- Applicability
- Potentially applicable
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
Why it matters
A capability on a vendor roadmap does not establish that the required protection is enabled for sensitive information. Scope review must distinguish the storage business subject to subsection (c) from the entities excluded there, while preserving the broader confidentiality and record-integrity framework.
Recommended action
Confirm the applicable commencement before treating the new provisions as current duties. Prepare the following for implementation at that commencement: Have HIM, IT, privacy and vendors identify covered business roles, data categories and enabled safeguards. Obtain evidence of actual segregation and access behavior, including out-of-state access controls, and review audit records and compliance fees. Do not infer a new future deadline from the retained July 2024 wording.
Sources
- AB 2448 Medical information: confidentiality, bill historyOfficial · California Legislature · 2026-09-03 · Source review 2026-09-10
- AB 2448 Medical information: confidentiality, current bill text (08/30/26 - Enrolled)Official · California Legislature · 2026-08-30 · Source review 2026-09-10
- Governor Newsom issues legislative update 9.27.2026Official · Office of the Governor · 2026-09-27 · Source review 2026-10-04
- AB2448 enacted final textOfficial · California Legislature · 2026-09-27 · Source review 2026-10-05
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →