SB 354 establishes future insurance privacy standards
Oct 11, 2026 edition · GC-2026-0231 · Published 2026-10-11 · Version 3 · Final
SB 354 replaces California's insurance privacy framework beginning July 1, 2028, with detailed notices, consent, rights, and service-provider controls. Health-privacy exclusions have a specific health-insurer carveback, and conditional producer exceptions and contract timing require separate scope analysis.
What happened
California enacted SB 354 on September 27 as Chapter 481, with the new insurance privacy article operative July 1, 2028. It addresses covered licensees, surplus-line insurers, reinsurers, and their relevant service providers in personal, family, or household insurance. The framework includes stand-alone privacy notices with specified exceptions, recorded consent and revocation, access and correction/deletion procedures, and accessible rights-request channels. Consent rules distinguish activities requiring opt-in or allowing opt-out from processing reasonably necessary for an insurance transaction or legally required; the act does not make every insurance use contingent on an optional consent.
Section 791.01 generally excludes CMIA-governed health care providers and HIPAA-governed covered entities and business associates, but restores coverage for a disability insurer licensed to transact health insurance outside Knox-Keene regulation. Other exclusions and conditional producer provisions limit particular duties. Section 791.24 requires vendor diligence and written processing, security, reporting, assistance, and subcontracting terms, with its stated temporary-service and producer qualifications; that section applies to contracts executed, amended, or renewed after July 1, 2028. The Commissioner must develop model compliance regulations. These future requirements do not establish that a particular entity is covered or that those regulations already exist.
Scope and timing
- Authority status
- Final
- Applicability
- Potentially applicable
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
- Recorded date
- 2028-07-01
- Date type
- implementation
Why it matters
Affected health insurance businesses and vendors need advance data and contract mapping.
Recommended action
Inventory covered processing and third-party contracts, then plan notices, retention and consumer-rights workflows before the operative date.
Sources
- SB354 enacted final textOfficial · California Legislature · 2026-09-27 · Source review 2026-10-11
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →