When does AB 1979 take effect?

January 1, 2027. Governor Newsom approved it on September 30, 2026 as Chapter 854 of the Statutes of 2026.

Is a general AI assistant like ChatGPT or Claude a health care chatbot under AB 1979?

Not on the definition alone. All three prongs must be met, and the second requires that the system be marketed as facilitating or supporting health services. A general assistant becomes a question when it ships a health-branded product or mode. Author Mia Bonta's release names Microsoft's Copilot Health and similar OpenAI and Anthropic products.

Does AB 1979 make a chatbot company subject to HIPAA?

No. The bill says the provider status applies only for the CMIA, not for any other law. HIPAA coverage still depends on whether you are a covered entity or business associate.

What are the penalties for a CMIA violation?

$1,000 in nominal damages per patient for a negligent release without proof of harm, fines up to $2,500 per negligent violation, up to $25,000 for knowing and willful violations, and up to $250,000 plus disgorgement where the motive is financial gain. A violation causing economic loss or injury is a misdemeanor.

Can a health chatbot still send conversations to an LLM API provider?

Possibly, under the CMIA exception for medical data processing and other administrative services, which bars the recipient from further disclosure. No court or regulator has applied it to an LLM API yet, so put the no-training and no-reuse terms in the contract.

California AB 1979: Health Chatbots Come Under the CMIA

A doctor in a white coat touching a tablet screen, representing health chatbots and patient data covered by California AB 1979 Image: Pexels, used under the Pexels License.

Yes, from January 1, 2027 a company that offers a health chatbot to people in California can be a "provider of health care" under the state's Confidentiality of Medical Information Act (CMIA), with the same duties and penalties as a clinic. AB 1979, by Assemblymember Mia Bonta, was approved on September 30, 2026 as Chapter 854. Holland & Knight's alert and our own September 30 roundup led with its rules on AI in clinical decisions. For a software company, the chatbot clause matters more, because it reaches businesses that never thought of themselves as health care.

Use this if you build or run a symptom checker, a wellness or nutrition coach, a medication helper, a patient-portal assistant or any AI feature that asks people about their health, and some of your users are in California. If you only use AI inside a clinic, skip to the section on clinical decision support near the end.

The four-part test in Civil Code 56.05 and 56.06

AB 1979 adds a definition to Civil Code 56.05 and a new subdivision (f) to 56.06. A product is caught only if all four conditions hold.

#	Condition	Statute wording (abridged)
1	A generative AI system with a natural language interface that gives "adaptive, human-like responses to user inputs"	56.05(i)(1)
2	It "is marketed as facilitating or supporting health services to a consumer"	56.05(i)(2)
3	It uses health care chatbot information: physical or mental "health or wellness" information the user provides, lets it access, or that it collects, generates or infers	56.05(i)(3)
4	The business offers it to a consumer to let the person manage their own information, or "for the diagnosis, treatment, or management of a medical condition"	56.06(f)

Civil Code 56.05(i) as added by AB 1979: the definition of a health care chatbot, with its three prongs and the definition of health care chatbot information Screenshot: AB 1979, Chapter 854, Section 2 (Civil Code 56.05(i)), leginfo.legislature.ca.gov. Captured November 1, 2026.

Two details in that text do most of the work. "Wellness" in prong 3 can pull in sleep, diet and fitness data, not just diagnoses, on our reading. And "inferred" means a model's guess about a condition counts even if the user never typed the word.

The status has limits. The bill says it does not make the business "a provider of health care for purposes of any law other than this part." It does not make you a HIPAA covered entity. It does make you keep "the same standards of confidentiality" as a provider and face the same penalties, under 56.06(g) and (h).

Six product types run through the test

No regulator has issued guidance yet; we found none on the Attorney General's or the Medical Board's sites on November 1, 2026. This table is our reading of the text, not a legal opinion.

Product	Prongs 1 to 3	56.06(f) purpose	Our reading
General assistant with no health marketing	1 and 3 yes, 2 no	Not marketed for it	Outside, until a health-branded mode or product ships
Consumer symptom checker	All three	Diagnosis or management	Inside
Wellness, sleep or nutrition coach	All three if marketed as supporting health services	Arguable: "manage the individual's information" is broad	Treat as inside
Mental health chat app	All three	Already covered	Already a provider under existing 56.06 rules for mental health digital services
Clinic or portal assistant answering patients	All three	Management of a condition	Inside, and the clinic is a provider anyway
Staff-only clinical assistant, or a white-label model sold to a clinic	Not offered to a consumer	No	Outside 56.06(f); the clinic's own CMIA duties and the vendor contract govern

The first row is the one to watch. Bonta's office tied the bill to big-platform launches: its August 27 release says "Microsoft launched Copilot Health, a consumer-facing AI service" and that "similar products have been launched by OpenAI and Anthropic." Bonta's own line, repeated in the nurses' union release after the signing: "AB 1979 does that by ensuring medical records stay protected when accessed through direct-to-consumer health chatbots." The target is products sold as health tools, not every chatbot that hears the word "headache."

Camino Strategy Group, a health care consultancy, described the gap the bill closes: "a lot of wellness apps and DTC platforms have operated on the assumption that they aren't HIPAA covered entities, so health privacy rules didn't really apply to them." In California, that assumption gets much harder to hold onto on January 1.

What the CMIA costs when it applies

The penalties are why this matters for a ten-person company. The CMIA allows a patient to sue for a negligent release without showing any harm.

Exposure	Amount	Section
Patient's own claim for a negligent release	$1,000 nominal damages, no actual damages needed, plus actual damages	56.36(b)(1)
Patient's claim for use or disclosure in breach of 56.10 (and a few other sections) that caused economic loss or personal injury	Compensatory damages, punitive up to $3,000, attorney's fees up to $1,000, costs	56.35
Negligent disclosure, public enforcement	Fine or civil penalty up to $2,500 per violation	56.36(c)(1)
Knowing and willful, by someone not a licensed professional	Up to $25,000 per violation	56.36(c)(2)(A)
Knowing or willful use for financial gain	Up to $250,000 per violation, plus disgorgement	56.36(c)(3)(A)
Violation causing economic loss or personal injury	Misdemeanor	56.36(a)

Civil Code 56.36(b) and (c): nominal damages of $1,000 for a negligent release without actual damages, and fines of $2,500, $25,000 and $250,000 per violation Screenshot: California Civil Code 56.36(b) and (c), leginfo.legislature.ca.gov. Captured November 1, 2026.

An illustration, not a prediction: a negligent leak of chat logs touching 10,000 California users is, on paper, 10,000 claims at $1,000 each, or $10,000,000 before any fine. The defense in 56.36(e) against nominal damages is written for HIPAA covered entities and business associates that meet its conditions, so a consumer chatbot that is neither cannot lean on it.

Steps before January 1, 2027

Inventory every health-adjacent flow. List each place a user can type or upload health or wellness information, and each place your model infers it. Mark which are marketed as health features. That list is your scope.
Take chat content out of ad pixels and analytics. Section 56.10(d) bars a provider from sharing, selling or using medical information "for a purpose not necessary to provide health care services to the patient" without express authorization. Session replay, ad pixels and product analytics that capture message text are the first thing to cut.
Rebuild consent as a CMIA authorization. A click-through privacy policy is not one. Under 56.11 the authorization must be handwritten or in type no smaller than 14-point, set apart from other language with a signature that serves no other purpose, signed and dated, and must state the specific uses, the recipients and an expiration that defaults to one year or less. The user gets a copy.
Put your LLM vendor on the record. 56.10(c)(3) allows disclosure to an entity providing "medical data processing, or other administrative services for providers of health care or health care service plans," and the recipient may not further disclose it. Whether an LLM API fits that phrase is untested, so the contract has to do the work: no training on your traffic, no reuse, a retention limit and breach notice. Our HIPAA AI vendor guide lists which vendors sign such terms.
Lock down storage. 56.101(a) requires that medical information be created, stored and destroyed "in a manner that preserves the confidentiality of the information," and negligence there triggers the 56.36 remedies. Encrypt chat logs, set a deletion schedule and restrict staff access.
Decide on training. Using conversations to train or fine-tune a model is the use most likely to be challenged as "not necessary to provide health care services." Our reading is that it needs an authorization. That point is unsettled; if you want the data, ask for it in a separate 56.11 form.

The case that shows how these claims are pleaded

We found no CMIA suit against a health chatbot yet. The closest is an AI scribe case. In Washington v. Sutter Health (N.D. Cal., No. 4:26-cv-03012), the April 2026 complaint by three patients against Sutter Health and MemorialCare over the Abridge ambient scribe paired wiretap claims with a CMIA count. The current version, the second amended complaint filed August 5, 2026, names only Sutter Health and one plaintiff, Christina Washington. Its paragraph 26 reads: "Sutter Health further failed to obtain written authorizations that satisfy the requirements of CMIA before transmitting or disclosing patients' medical information through the Abridge platform."

Sutter filed two motions to dismiss the second amended complaint on August 19, 2026. The CourtListener docket we read on November 1 shows no ruling, and the last filing was on October 27. Swap "Abridge platform" for your model provider and that paragraph is the template for a claim against a health chatbot after January 1. It is also why step 3 matters more than any disclaimer.

If you run a clinic: the other half of AB 1979

AB 1979 also adds Business and Professions Code 22758.5. A health facility, clinic, physician's office or group practice must take "reasonable steps" so that a licensed provider "retains the ability to exercise independent professional judgment" when care is informed by a clinical decision support system. It may not use AI to direct or supervise unlicensed staff in licensed clinical functions, or to perform such a function on its own. Booking, reminders, patient education and documentation that involves no professional judgment are outside it. Violations by physicians go to the Medical Board of California or the Osteopathic Medical Board. Existing law under AB 3030 already requires a disclaimer and a route to a human on generative AI messages about clinical information. Our September 30 signings tracker covers SB 503, the companion bias rule.

What to log

The date each health feature was classified, and the reasoning for each row of the product table
Every third party that receives chat content, with the contract clause that limits its use
Signed authorizations, versioned, with their expiry dates
Deletion runs on chat logs
Any request from a user to see or delete their conversations, and your answer

What we could not confirm

We found no guidance from the Attorney General or the Medical Board interpreting "marketed as facilitating or supporting health services," and no case applying 56.10(c)(3) to an AI model provider. The Sutter case has no ruling on the CMIA count. We read the chaptered text and the Civil Code sections, not the committee analyses, so we cannot say what the Legislature said about wellness apps along the way.

Our view: the definition is narrower than the headlines and wider than the wellness apps Camino describes have assumed. A general chatbot is not the target. A coaching app that tells users it helps their health and then pipes transcripts into analytics is exactly the target, and the $1,000-per-person nominal damages make that a class action, not a compliance memo.