What applies to a hospital in California
A guide to the entries on this map, not legal advice. Whether a law covers you depends on its text, its thresholds and its exemptions; check the entry and its sources, and ask counsel before you rely on it.
Applies to your hospital
16 entries
- CaliforniaIn forceIn force since Jan. 1, 2020AB 375, California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Proposition 24)
Applies to: For-profit businesses doing business in California with annual gross revenue over $26.625 million (the statute's $25 million, adjusted from Jan. 1, 2025), or that buy, sell or share the personal information of 100,000 or more consumers or households, or derive half or more of annual revenue from selling or sharing it
Binds for-profit businesses over the revenue or data thresholds; PHI-only exemption, so practices and hospitals must honor rights for other data, though most practices fall below them and nonprofits are outside.
- FederalFinalIn force since March 18, 2024HHS Office for Civil Rights, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (bulletin issued December 2022, revised March 18, 2024)
Applies to: HIPAA covered entities and business associates that use tracking technologies on websites or mobile apps
HHS guidance for HIPAA covered entities: tracking technologies on patient portals and apps may not send PHI to vendors without a business associate agreement or patient authorization.
- CaliforniaIn forceIn force since Jan. 1, 2025AB 1008, California Consumer Privacy Act of 2018: Personal Information
Applies to: Businesses covered by the California Consumer Privacy Act
Binds for-profit CCPA businesses; PHI-only exemption, so practices and hospitals over the revenue or data thresholds are covered for other data, though most practices fall below them and nonprofits are outside.
- CaliforniaIn forceIn force since Jan. 1, 2025AB 3030, Health Care Services: Artificial Intelligence
Applies to: Health facilities, clinics, physician's offices and group practice offices that use generative AI to generate patient communications about clinical information
Binds health facilities, clinics, physician's offices and group practices that use generative AI for clinical patient messages; a physician's violation goes to the medical boards.
- CaliforniaIn forceIn force since Jan. 1, 2025SB 1223, Consumer Privacy: Sensitive Personal Information: Neural Data
Applies to: Businesses covered by the California Consumer Privacy Act
Binds CCPA businesses; PHI-only exemption, so for-profit practices and hospitals over the thresholds must honor limits on neural data outside patient records, though most practices fall below them.
- FederalFinalIn force since Jan. 10, 2025HHS Office for Civil Rights, Dear Colleague letter: Ensuring Nondiscrimination Through the Use of Artificial Intelligence and Other Emerging Technologies (Jan. 10, 2025)
Applies to: Covered entities under Section 1557 that use patient care decision support tools
OCR guidance on 45 CFR 92.210 for Section 1557 covered entities, such as practices and hospitals; it changes no coverage, payment or licensure decision reaching physicians.
- CaliforniaIn forceIn force since Jan. 13, 2025Attorney General's Legal Advisory on the Application of Existing California Law to Artificial Intelligence in Healthcare
Applies to: Health care providers, insurers, vendors, investors and other entities that develop, sell or use AI in health care
Guidance on existing California law binding health care providers, physicians and provider entities alike, including the bar on delegating the practice of medicine to AI.
- FederalIn forceIn force since May 1, 2025Nondiscrimination in Health Programs and Activities, final rule, 89 FR 37522 (May 6, 2024); 45 CFR 92.210, Nondiscrimination in the use of patient care decision support tools
Applies to: Covered entities under Section 1557 of the Affordable Care Act: health programs and activities receiving HHS federal financial assistance, HHS-administered programs and ACA Exchanges
Binds Section 1557 covered entities, such as practices and hospitals receiving HHS funds, on decision support tools; it changes no coverage, payment or licensure decision reaching physicians.
- CaliforniaIn forceIn force since Jan. 1, 2026AB 45, Privacy: Health Data: Location and Research
Applies to: Anyone collecting personal information at or near family planning centers or geofencing in-person health care providers
Bars any person, practices and hospitals included, from geofencing in-person care sites to track or advertise to patients; the provider and HIPAA exemption covers only the family planning center rule.
- CaliforniaIn forceIn force since Jan. 1, 2026AB 489, Health Care Professions: Deceptive Terms or Letters: Artificial Intelligence
Applies to: Any person or entity that develops or deploys an AI or generative AI system or device
Binds any person or entity that deploys AI implying its advice comes from a licensed professional, which reaches practices and hospitals; physician is left off as the narrower reading of deployer.
- CaliforniaIn forceIn force since Jan. 1, 2026CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations
Applies to: Businesses subject to the California Consumer Privacy Act
Binds CCPA businesses using automated decisionmaking for health care decisions; PHI-only exemption, so it reaches for-profit practices and hospitals over the thresholds only for non-patient data.
- CaliforniaEnactedTakes effect Jan. 1, 2027AB 1979, Health Care Services: Artificial Intelligence
Applies to: Businesses offering health care chatbots to consumers; health facilities, clinics, physician's offices and group practice offices
Binds health facilities, clinics, physician's offices and group practices on decision support and licensed functions, and sends physicians' violations to the medical boards, so physicians are tagged too.
- CaliforniaEnactedTakes effect Jan. 1, 2027SB 503, Health Care Services: Artificial Intelligence
Applies to: Developers of AI clinical decision support systems and the health facilities, clinics, physician's offices and group practices that use them
Binds developers and the health facilities, clinics, physician's offices and group practices that deploy AI decision support; the duties fall on the deploying entity, not the individual physician.
- FederalFinalHHS Office for Civil Rights, Business Associates guidance (web page, content last reviewed July 30, 2026): AI chatbot example
Applies to: HIPAA covered entities and the vendors that handle PHI for them
HHS guidance for HIPAA covered entities: a vendor's AI chatbot handling PHI on a patient portal is a business associate, so the practice or hospital needs a business associate agreement first.
- FederalProposedSigned Jan. 6, 2025HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule, 90 FR 898 (Jan. 6, 2025), RIN 0945-AA22
Applies to: HIPAA covered entities and business associates
Proposed rule binding HIPAA covered entities and business associates: asset inventory, network map, ePHI encryption and multifactor authentication, with ePHI in AI training data protected.
- FederalIntroducedS. 3062, Guidelines for User Age-verification and Responsible Dialogue Act of 2026 (GUARD Act), 119th Congress, reported by the Senate Judiciary Committee with an amendment (Calendar No. 406)
Applies to: Anyone who makes an AI chatbot publicly available to consumers
Would bind anyone who makes an AI chatbot publicly available to consumers, which reaches a practice's or hospital's patient-facing chatbot.
Applies to your physicians
0 entries
None on the map.
Also affects your hospital
11 entries
- FederalIn forceIn force since Jan. 1, 2024Medicare Program; Contract Year 2024 Policy and Technical Changes to the Medicare Advantage Program, Medicare Prescription Drug Benefit Program, Medicare Cost Plan Program, and Programs of All-Inclusive Care for the Elderly, final rule (CMS-4201-F), 88 FR 22120 (April 12, 2023), RIN 0938-AU96; 42 CFR 422.101(b)(6) and (c)(1) and 422.566(d)
Applies to: Medicare Advantage organizations
Binds Medicare Advantage plans only: medical necessity decisions rest on the enrollee's own circumstances, and a qualified professional reviews adverse decisions before issue.
- FederalFinalIn force since Feb. 6, 2024CMS, Frequently Asked Questions related to Coverage Criteria and Utilization Management Requirements in CMS Final Rule (CMS-4201-F), HPMS memo, Feb. 6, 2024
Applies to: Medicare Advantage organizations and Medicare-Medicaid Plans
Applies to Medicare Advantage organizations and Medicare-Medicaid Plans only: AI alone may not deny an admission, downgrade to observation or end post-acute care, and decisions rest on the patient's own circumstances.
- FederalIn forceIn force since Jan. 1, 2025Medicare physician fee schedule payment for digital mental health treatment devices, HCPCS G0552, G0553 and G0554: CY 2025 final rule (CMS-1807-F), 89 FR 97710 (Dec. 9, 2024), expanded in the CY 2026 final rule (CMS-1832-F), 90 FR 49266 (Nov. 5, 2025)
Applies to: Physicians and other practitioners billing the Medicare physician fee schedule
Fee schedule codes G0552 to G0554 let clinicians bill for FDA-cleared digital mental health treatment devices; a payment option, not a duty.
- CaliforniaIn forceIn force since Jan. 1, 2025SB 1120, Health Care Coverage: Utilization Review
Applies to: Health care service plans, including specialized plans, and disability insurers that use AI or other software tools in utilization review or management, directly or through contractors
Binds health plans and disability insurers only: AI tools may not deny, delay or modify care on medical necessity; a licensed physician or competent professional decides.
- CaliforniaIn forceIn force since May 5, 2025Department of Insurance Guidance SB 1120:1, Use of Artificial Intelligence, Algorithms and Other Software Tools in Utilization Management
Applies to: Health insurers regulated by the Department of Insurance and entities performing utilization review or management for them
Binds CDI-regulated insurers and their UR entities: tools may not deny, delay or modify care on medical necessity, which stays with a licensed physician or competent professional.
- FederalIn forceIn force since Jan. 1, 2026Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Advancing Interoperability and Improving Prior Authorization Processes, final rule (CMS-0057-F), 89 FR 8758 (Feb. 8, 2024), RIN 0938-AU87
Applies to: Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and qualified health plan issuers on the federally facilitated Exchanges
Binds MA, Medicaid, CHIP and Exchange payers only: prior authorization deadlines, specific denial reasons and a prior authorization API; no AI rule, listed for prior authorization.
- FederalIn forceIn force since Oct. 1, 2026Medicare Program; Hospital Inpatient Prospective Payment Systems for Acute Care Hospitals (IPPS) and the Long-Term Care Hospital Prospective Payment System and Policy Changes and Fiscal Year (FY) 2027 Rates, final rule (CMS-1849-F), 91 FR 49570 (Aug. 4, 2026), RIN 0938-AV79; new technology add-on payments under 42 CFR 412.87 and 412.88
Applies to: Hospitals paid under the Medicare inpatient prospective payment system
Inpatient new technology add-on payments for approved AI tools; a payment change for hospitals, not a duty.
- FederalProposedSigned July 7, 2026Medicare Program: Hospital Outpatient Prospective Payment and Ambulatory Surgical Center Payment Systems; and Quality Reporting Programs, CY 2027 proposed rule (CMS-1850-P), 91 FR 41734 (July 7, 2026), RIN 0938-AV83
Applies to: Hospital outpatient departments paid under the Medicare outpatient prospective payment system
Proposed outpatient payment for 36 designated software analysis services in hospital outpatient departments; a payment change, not a duty.
- FederalProposedSigned July 16, 2026Medicare and Medicaid Programs; CY 2027 Payment Policies Under the Physician Fee Schedule and Other Changes to Part B Payment and Coverage Policies, proposed rule (CMS-1848-P), 91 FR 43842 (July 16, 2026), RIN 0938-AV82
Applies to: Physicians and other practitioners paid under the Medicare physician fee schedule
Proposed fee schedule pricing for 10 software analysis codes, paid to whoever bills the fee schedule; a payment change, not a duty.
- FederalIntroducedH.R. 3514, Improving Seniors' Timely Access to Care Act of 2025, 119th Congress, ordered reported by the House Ways and Means Committee
Applies to: Medicare Advantage organizations; CMS and ONC for a report to Congress
Would bind Medicare Advantage plans only: electronic prior authorization and annual reports on requests approved or denied with AI or other decision technology.
- FederalIntroducedS. 3097, Health Information Privacy Reform Act, 119th Congress, reported by the Senate Health, Education, Labor, and Pensions Committee with an amendment (Calendar No. 538)
Applies to: HHS (rulemaking); entities that process identifiable health information outside HIPAA's protections for protected health information, including data brokers; HIPAA covered entities for the AI-related minimum necessary rules
Would direct HHS to write rules on how the minimum necessary standard applies to PHI used for AI; covered entities would be bound only through those future rules, so it affects them.
Show failed bills (3)
- CaliforniaFailedAB 1018, Automated Decisions Safety Act
Applies to: Developers and deployers of automated decision systems used to make or facilitate consequential decisions, including in health care and health insurance
Would have bound deployers of automated decision systems, including provider organizations and health plans, to give adverse-outcome notice and appeal; no duty on physicians as individuals.
- CaliforniaFailedAB 2575, Health Care Services: Artificial Intelligence
Applies to: Would have applied to employers of direct patient care workers and to those who develop, modify, select or deploy AI clinical decision support systems, when sued
Would have bound employers and deployers of AI decision support as entities; physicians hold no duty but would have gained protection from retaliation for overriding AI output.
- CaliforniaFailedSB 903, Mental Health Professionals: Artificial Intelligence (Wellness and Oversight for Psychological Resources Act)
Applies to: Would have applied to anyone who provides or facilitates psychotherapy services, including psychiatrists and other licensed professionals and their employers
Would have bound entities that provide or facilitate psychotherapy, their employers and licensed professionals, defined to include physicians practicing psychiatry, to limits on AI use and AI recording.
Calendar of dates laws take effect (California): subscribe or download the .ics file.
California on the map · Federal entries · About the data · How to read the law map