AB 2448 requires sensitive medical information access controls
Oct 11, 2026 edition · GC-2026-0076 · Published 2026-10-11 · Version 3 · Final
AB 2448 requires covered medical-information businesses to enable specified sensitive-record safeguards as well as develop them. The September 27 amendment addresses access, segregation, and interstate disclosure controls, with an express exclusion for entities defined as CMIA providers, health plans, or contractors.
What happened
California chaptered AB 2448 on September 27 as Chapter 607, amending Civil Code section 56.101. The change adds an express obligation to enable the specified capabilities, policies, and procedures for businesses described in section 56.06 that electronically store or maintain sensitive-service information on behalf of the listed health care entities or employers. The amended subdivision retains the earlier July 1, 2024 date in its text; that retained date should be distinguished from the enactment of the 2026 amendment rather than presented as a new future deadline.
The safeguards limit access privileges for gender-affirming care, abortion-related care, and contraception information to authorized persons; address disclosure and processing outside California in accordance with CMIA; segregate that information from the remainder of the record; and provide the ability to automatically disable out-of-state access to segregated information. Fees must comply with the cited federal information-blocking regulation. The subdivision expressly excludes contractors, health plans, and providers as those terms are defined in section 56.05, even though other confidentiality and electronic-record obligations remain in the surrounding statute.
Scope and timing
- Authority status
- Final
- Applicability
- Potentially applicable
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
- Recorded date
- 2027-01-01
- Date type
- effective
Why it matters
Covered businesses handling medical information may need to change security capabilities, policies, and procedures specified in the final text.
Recommended action
Have HIM, IT and vendors confirm covered data categories, enabled access restrictions and auditable workflows under the final statute.
Sources
- AB 2448 Medical information: confidentiality, bill historyOfficial · California Legislature · 2026-09-03 · Source review 2026-09-10
- AB 2448 Medical information: confidentiality, current bill text (08/30/26 - Enrolled)Official · California Legislature · 2026-08-30 · Source review 2026-09-10
- Governor Newsom issues legislative update 9.27.2026Official · Office of the Governor · 2026-09-27 · Source review 2026-10-04
- AB2448 chaptered textOfficial · California Legislature · 2026-09-27 · Source review 2026-10-11
- California Constitution, Article IV section 8(c), official Assembly 2023–24 editionOfficial · California State Assembly · Source review 2026-10-14
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →