California's Healthcare AI Laws: AB 3030, SB 1120 and the Rest of the Family

Five, and they do different jobs. There is no California AI Act to comply with, and looking for one is the most common reason buyers arrive at a California deployment underprepared.

Read the table as a stack rather than a menu. A single patient facing agent can touch AB 3030 for what it says, AB 489 for what it calls itself, the CMIA for the record it writes into, and the CCPA regulations for the decision it influences. That is four different regulators looking at one deployment, which is why California rewards a single governance programme over four project plans. The same logic drives our AI governance and compliance work.

Two things, on every patient communication generated by generative AI that pertains to clinical information: a disclaimer saying the communication was generated by generative AI, and clear instructions describing how the patient can contact a human health care provider or other appropriate person.

The disclaimer's placement is prescribed by medium, and this is where most implementations get sloppy.

• Written communications, including letters and emails: prominently at the beginning of each communication.
• Chat based interactions, including chat based telehealth: prominently displayed throughout the interaction.
• Audio communications: verbally, at the start and again at the end.
• Video communications: prominently displayed throughout the interaction.

Note the audio rule in particular. Start and end, both, spoken. An AI phone agent that discloses once at pickup and then discusses a result is not compliant if the call touched clinical information.

Two boundaries define the whole statute. The first is subject matter: it applies to communications about patient clinical information, meaning information relating to the health status of a patient, and expressly excludes administrative matters including appointment scheduling, billing and other clerical or business matters. The second is the review exception: the requirements do not apply where the communication is generated by generative AI and then read and reviewed by a human licensed or certified health care provider.

Those two boundaries do more work than the disclaimer rules. Between them they mean a large share of real deployments fall outside AB 3030 entirely, and the compliance question becomes a design question: can you prove which messages went out unreviewed?

Usually not, for different reasons in each case, and the reasoning is worth being able to state to a surveyor.

An ambient scribe produces a note that a clinician reviews and signs. Where the output reaching the patient has been read and reviewed by a licensed provider, the exception applies. That places the compliance burden exactly where the clinical burden already is: on attestation. If your workflow allows a draft to reach a patient portal without a signature, the exception has not been earned, whatever the policy says.

A patient intake agent collecting demographic and insurance details is dealing in administrative matters, which are excluded. The moment it starts summarising symptoms back to the patient or answering a question about their condition, it is dealing in clinical information and the exclusion stops helping.

A scheduling agent is administrative and therefore outside AB 3030. It is not outside AB 489, which does not care about the subject matter and only cares what the system calls itself.

The practical control is a log, not a policy. For every automated outbound message, record whether it contained clinical information and whether a licensed provider reviewed it before it left. Without that record, you cannot demonstrate the exception applies, and the disclaimer becomes the cheaper default. Many organisations conclude it is easier to disclaim everything than to prove the boundary, which is a defensible answer as long as it is a decision rather than a drift.

SB 1120 binds payers, not providers. It amends Health and Safety Code section 1367.01 for health care service plans and Insurance Code section 10123.135 for disability insurers.

Where a plan or insurer uses AI, an algorithm or another software tool for utilization review or utilization management, the tool must base its determination on the enrollee's medical or other clinical history, individual clinical circumstances and other relevant records, and must not base its determination solely on a group dataset. Its criteria and guidelines must comply with the chapter, it must be fairly and equitably applied, it must not discriminate directly or indirectly, it must be open to inspection for audit or compliance review, and disclosures about its use and oversight must appear in written policies and procedures.

The provision that changes conduct is the one about who decides. A tool may not deny, delay or modify health care services based in whole or in part on medical necessity. That determination must be made by a licensed physician or a licensed health care professional competent to evaluate the specific clinical issues, after reviewing the requesting provider's recommendation and the enrollee's individual circumstances.

For a provider organisation, the operational value is leverage. If a denial arrives with reasoning that reads as machine generated and no evidence of individualised clinical review, SB 1120 gives you a named statutory hook for the appeal rather than a general complaint. Teams running prior authorization automation and denial management should be capturing that pattern rather than only capturing outcomes. Colorado followed with a broadly similar rule in HB 26-1139, effective January 1, 2027, which we cover on the Colorado page.

Separately, SB 306 attacks the same problem from the volume side. Plans must report prior authorization approval rates by December 31, 2026, the departments publish a list of services approved at ninety percent or above by July 1, 2027, and prior authorization for those services must stop no later than January 1, 2028. That is a real change to the workload your automation is sized for.

AB 489 added chapter 15.5 to the Business and Professions Code, effective January 1, 2026. It makes the existing prohibitions on holding yourself out as a licensed professional enforceable against the developers and deployers of AI systems, and it bars an AI or generative AI system from using terms, letters or phrases that indicate or imply that care, advice, reports or assessments are provided by a person licensed or certified to provide health care.

Each use of a prohibited term, letter or phrase is a separate violation. Enforcement sits with the appropriate health care professional licensing board or enforcement agency.

This is the least discussed and most easily tripped of the California statutes, because it is triggered by product design rather than by clinical function. Names, avatars, honorifics and credential styled suffixes are all in scope. So is copy that says an assistant will review your symptoms in language that reads as clinical assessment. A triage agent branded with a clinician persona is a licensing exposure in California even if every clinical output is safe and every disclaimer is present.

The remedy is cheap and best done before launch: name the agent as software, avoid protected titles and their near neighbours, and put the naming decision through the same review as the clinical content. It belongs in staff training too, because front line teams routinely give agents nicknames that undo careful branding decisions.

The CMIA is the reason California is stricter than HIPAA on the vendor question. Civil Code section 56.06 deems several kinds of business to be providers of health care in their own right, including any business organised for the purpose of maintaining medical information to make it available to an individual or a provider, and any business offering software or hardware to consumers, including a mobile application or related device, designed to maintain medical information. Businesses offering a mental health digital service or a reproductive or sexual health digital service are covered too.

The practical consequence is that a vendor which is a business associate under HIPAA may also be a provider of health care under the CMIA, with its own direct duties and its own exposure, including a private right of action. A business associate agreement does not dispose of the CMIA question, and vendor questionnaires written to a HIPAA template frequently do not ask it. Our tooling comparison notes where vendors publicly address California specifically, and where they do not.

The CCPA reaches the parts a health system tends to forget. PHI under HIPAA and medical information under the CMIA are exempted, but employee and job applicant data is not, and neither is consumer data collected outside the treatment relationship: marketing sites, appointment request forms before a relationship exists, patient acquisition campaigns. AB 1008 confirmed that personal information can exist inside an AI system capable of outputting it, which pulls fine tuned models into the analysis.

Then there are the CPPA regulations, effective January 1, 2026. They define a significant decision to include the provision or denial of healthcare services, where healthcare services means services related to the diagnosis, prevention or treatment of human disease or impairment, or the assessment or care of an individual's health. A business using ADMT to make a significant decision must be in compliance with article 11, including pre-use notice and the rights to opt out of and access ADMT, no later than January 1, 2027. Risk assessments for pre-existing processing must be conducted by December 31, 2027 and submitted by April 1, 2028, and the first cybersecurity audits fall due on April 1, 2028 for larger businesses.

Those dates line up almost exactly with Colorado's. If you are building one automated decision notice and one human review path, build it once for both.

Distributed, which makes it harder to plan for than a single regulator with a single penalty schedule.

AB 3030 has no bespoke penalty. It routes into the existing enforcement provisions for health facilities and clinics, and to the Medical Board of California or the Osteopathic Medical Board where the conduct is a physician's. So the realistic exposure is a licensing or facility matter, arriving through a complaint, discovered during an unrelated survey. AB 489 works the same way and adds that each use of a prohibited term counts separately, which turns a badly named product into an arithmetic problem.

SB 1120 is enforced by the Department of Managed Health Care and the Department of Insurance against plans and insurers. SB 243 gives injured users a direct right to sue. The CMIA gives patients a private right of action alongside administrative fines. The CCPA is enforced administratively by the CPPA and by the Attorney General.

The pattern to take from this: California will not send you a single notice of violation with a sixty day cure period the way Texas and Colorado will. It will surface as a board complaint, a plan audit, a patient lawsuit or an agency inquiry, each with its own timeline. That argues for evidence that is retrievable on demand rather than a compliance binder that is assembled when asked.

Seven items. Most are a day of work each, and the first two prevent the majority of the realistic exposure.

1. Classify every outbound automated message as clinical or administrative. AB 3030 only reaches clinical information. Scheduling, billing and clerical matters are excluded by statute. Write the classification down, because you will be asked to defend it.
2. Prove the human review exception, or disclaim. If a licensed or certified provider reads and reviews the communication, no disclaimer is needed. If your workflow cannot evidence that review per message, disclaim by default and stop arguing about it.
3. Fix the audio path. Verbal disclaimers at the start and the end of the call, not just at pickup. This is the most commonly failed requirement in voice deployments.
4. Audit the agent's name and persona against AB 489. No protected titles, no implied credentials, no clinician styled avatars. Each use is a separate violation, so this scales badly if you get it wrong.
5. Ask vendors the CMIA question, not just the HIPAA question. A vendor can be a provider of health care under Civil Code 56.06 in its own right. A signed business associate agreement does not answer this.
6. Map the non PHI data. Employee data, applicant data and pre relationship consumer data sit under the CCPA, not under the HIPAA exemption. That is where the CPPA's ADMT rules will find you.
7. Put January 1, 2027 in the plan. Pre-use notice, opt out and access rights for ADMT used in significant decisions, which expressly include healthcare services. Colorado's deadline is the same day, so design the notice and the human review path once.

The pattern across all seven is that California punishes ambiguity about what your system did, more than it punishes the system itself. Organisations that can answer which message went to which patient, generated by what, reviewed by whom, tend to have short conversations with regulators. Organisations that cannot tend to have long ones. Building that evidence layer, and reusing it across Utah, Texas and Colorado, is the substance of our AI governance and compliance engagement, and it sits alongside the federal baseline set out in HIPAA and AI.