California enacts AB 1979 extending CMIA to health care chatbots and imposing AI guardrails in clinical care
The law expands medical privacy protections to AI chatbots and sets new safeguards on AI use in clinical settings, impacting providers and tech firms.
ADTP Regulatory Watch· October 29, 2026· CA AG
ImpactHigh 64
Type🏛️ New Law
Statussignedenacted, check the effective date
JurisdictionUS-CA
Effective1 January 2027
BillAB 1979
What happened
California enacted AB 1979, extending the Confidentiality of Medical Information Act to consumer‑facing health care chatbots and requiring them to meet the same standards as traditional providers. The law also mandates health facilities to ensure licensed providers retain independent clinical judgment when AI‑based clinical decision support systems are used, and prohibits AI tools that enable unlicensed personnel to perform clinical functions.
Why it matters for trust and compliance
Its status is signed. It is enacted but may not be in force yet. Check the effective date before planning around it.
The law expands medical privacy protections to AI chatbots and sets new safeguards on AI use in clinical settings, impacting providers and tech firms.
Takes effect January 1, 2027.
Who is affected
healthcaretechnologycontrollerdeveloperplatform
Recommended actions
Check that privacy notices describe the practices this addresses.
Inventory AI or automated decision systems in scope and their assessments.
Confirm handling of sensitive data categories meets the stricter rules.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.