California recently enacted AB 1979 (the “Act”), which extends California’s Confidentiality of Medical Information Act (the “CMIA”) to consumer-facing health care chatbots and limits how health care providers may use artificial intelligence (“AI”) in clinical care. The Act will take effect on January 1, 2027.

Health Care Chatbots and the CMIA

The Act provides that any business that offers a health care chatbot for the purpose of allowing consumers to manage their information, or for the diagnosis, treatment or management of a medical condition, shall be deemed to be a provider of health care subject to the CMIA. Accordingly, such businesses must maintain the same standards applicable to other providers of health care under the CMIA and are subject to any penalties applicable to other providers of health care for violations of the CMIA.

The Act defines “health care chatbot” as a generative AI system with a natural language interface that:

• provides adaptive, human-like responses to user inputs;
• is marketed as facilitating or supporting health services to a consumer; and
• uses health care chatbot information to facilitate or support health service to a consumer.

Preserving Independent Clinical Judgment

The Act requires health facilities, clinics, physician’s offices, and group practice offices to take reasonable steps to ensure that licensed health care providers can exercise independent professional judgment in their care of patients whenever such care is informed by the output of a “clinical decision support system.”

The Act defines “clinical decision support system” as an  AI system that “produces a prediction, classification, recommendation, evaluation or analysis that aids clinical decisionmaking related to timing of care, diagnosis or treatment.” Systems that provide appointment management (such as booking, canceling, and rescheduling appointments, appointment reminders, patient education, and pre-visit materials and preparation) and payment processing services are carved out from this definition to the extent the independent performance of such activities does not require a professional license.

Preventing Use of AI to Practice Without a License

The Act prohibits health facilities, clinics, physician’s offices, and group practice offices from using or deploying a tool, system, or device that includes AI to :

• direct, guide, supervise, or instruct unlicensed personnel in their performance of any clinical function that is required by law to be performed by a person with a professional license; or independently perform any clinical function that is required by law to be performed by a person with a professional license.

Trainees using such tools, systems, or devices in a supervised course of study or training program while working toward licensure are exempt.

The Act does not prohibit the use of automated decision systems for documentation and communication that do not involve the application of professional judgment, including but not limited to automated messages to inform patients of updates to their health records, generating reminders, or assisting patients to find information.