SB 354 establishes future insurance privacy standards
Oct 4, 2026 edition · GC-2026-0231 · Published 2026-10-04 · Version 2 · Final
SB 354 replaces California’s insurance privacy framework beginning July 1, 2028, adding purpose limits, notices, consent controls, retention policies and consumer rights. The scope includes important CMIA and HIPAA exclusions and a specified health-insurer exception, requiring entity-specific review.
What happened
California enacted SB 354 on September 27 to revise the Insurance Information and Privacy Protection Act, with the new article operative July 1, 2028. The framework governs qualifying insurance licensees, surplus-line insurers, reinsurers and third-party service providers processing or sharing consumer information for the business of insurance. It introduces stand-alone privacy notices, privacy-rights notices for continuing relationships, consent requirements, limits on processing and sharing, written retention policies and schedules, and processes for access, correction, amendment or deletion. Service-provider contracts must govern the processing and sharing performed on behalf of covered insurance entities.
The entity and transaction limits are material. Section 791.01 generally excludes CMIA-governed healthcare providers and HIPAA-governed covered entities and business associates, including from the third-party-service-provider definition. It nevertheless applies to the specified disability insurer licensed for health insurance that is not regulated as a Knox-Keene health plan. The article generally addresses personal, family or household insurance information and contains additional financial-institution, producer and intermediary conditions. A standard privacy notice is generally due within 21 calendar days of first collection, processing or sharing, with specified exceptions and transition rules for existing relationships. These future obligations require scope analysis before copying one uniform notice or rights process across a health enterprise.
Scope and timing
- Authority status
- Final
- Applicability
- Potentially applicable
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
- Recorded date
- 2028-07-01
- Date type
- implementation
Why it matters
Insurance, provider and vendor entities within the same organization can fall on different sides of the exclusions. The long lead time is useful for data and contract mapping, but the July 2028 framework should not be represented as already operative in October 2026.
Recommended action
Map legal entities, insurance transactions, HIPAA and CMIA status and the health-insurer exception. Plan notices, consent, retention, rights and vendor-contract changes for the July 1, 2028 operative date, including transition and producer conditions. Reconcile other applicable privacy duties separately.
Sources
- SB354 enacted final textOfficial · California Legislature · 2026-09-27 · Source review 2026-10-05
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →