California extends CMIA protections to health care chatbots and adds AI guardrails

What happened

• AB 1979 amends the California Confidentiality of Medical Information Act to include data collected by consumer‑facing health care chatbots.
• The law prohibits providers from using AI to make autonomous clinical diagnoses without human oversight.
• Violations may trigger civil penalties under existing California privacy enforcement mechanisms.
• The statute applies to all health care entities that deploy chatbot interfaces to patients in California.

Why it matters

Providers deploying chat‑based virtual assistants must treat chatbot data as protected medical information and implement human‑in‑the‑loop controls for any AI‑driven clinical recommendations.

Business impact

Failure to reclassify chatbot data could expose providers to civil penalties and increase liability for inaccurate AI advice, while compliance may require redesign of existing AI workflows and privacy notices.

What to check

1. 1

   reclassify chatbot dataHigh priority

   Update data inventories to label all information collected by consumer‑facing health chatbots as CMIA‑protected medical information.

2. 2

   implement human oversightHigh priority

   Ensure any AI‑generated clinical recommendation is reviewed and approved by a licensed health professional before delivery to patients.

3. 3

   revise privacy noticesMedium priority

   Add clear disclosures about chatbot data collection, use, and sharing in compliance with the amended CMIA.