What applies to a physician in California

Applies to: Health facilities, clinics, physician's offices and group practice offices that use generative AI to generate patient communications about clinical information

Binds health facilities, clinics, physician's offices and group practices that use generative AI for clinical patient messages; a physician's violation goes to the medical boards.

Applies to: Health care providers, insurers, vendors, investors and other entities that develop, sell or use AI in health care

Guidance on existing California law binding health care providers, physicians and provider entities alike, including the bar on delegating the practice of medicine to AI.

Applies to: Businesses offering health care chatbots to consumers; health facilities, clinics, physician's offices and group practice offices

Binds health facilities, clinics, physician's offices and group practices on decision support and licensed functions, and sends physicians' violations to the medical boards, so physicians are tagged too.

Applies to: For-profit businesses doing business in California with annual gross revenue over $26.625 million (the statute's $25 million, adjusted from Jan. 1, 2025), or that buy, sell or share the personal information of 100,000 or more consumers or households, or derive half or more of annual revenue from selling or sharing it

Binds for-profit businesses over the revenue or data thresholds; PHI-only exemption, so practices and hospitals must honor rights for other data, though most practices fall below them and nonprofits are outside.

Applies to: HIPAA covered entities and business associates that use tracking technologies on websites or mobile apps

HHS guidance for HIPAA covered entities: tracking technologies on patient portals and apps may not send PHI to vendors without a business associate agreement or patient authorization.

Applies to: Businesses covered by the California Consumer Privacy Act

Binds for-profit CCPA businesses; PHI-only exemption, so practices and hospitals over the revenue or data thresholds are covered for other data, though most practices fall below them and nonprofits are outside.

Applies to: Businesses covered by the California Consumer Privacy Act

Binds CCPA businesses; PHI-only exemption, so for-profit practices and hospitals over the thresholds must honor limits on neural data outside patient records, though most practices fall below them.

Applies to: Covered entities under Section 1557 that use patient care decision support tools

OCR guidance on 45 CFR 92.210 for Section 1557 covered entities, such as practices and hospitals; it changes no coverage, payment or licensure decision reaching physicians.

Applies to: Covered entities under Section 1557 of the Affordable Care Act: health programs and activities receiving HHS federal financial assistance, HHS-administered programs and ACA Exchanges

Binds Section 1557 covered entities, such as practices and hospitals receiving HHS funds, on decision support tools; it changes no coverage, payment or licensure decision reaching physicians.

Applies to: Anyone collecting personal information at or near family planning centers or geofencing in-person health care providers

Bars any person, practices and hospitals included, from geofencing in-person care sites to track or advertise to patients; the provider and HIPAA exemption covers only the family planning center rule.

Applies to: Any person or entity that develops or deploys an AI or generative AI system or device

Binds any person or entity that deploys AI implying its advice comes from a licensed professional, which reaches practices and hospitals; physician is left off as the narrower reading of deployer.

Applies to: Businesses subject to the California Consumer Privacy Act

Binds CCPA businesses using automated decisionmaking for health care decisions; PHI-only exemption, so it reaches for-profit practices and hospitals over the thresholds only for non-patient data.

Applies to: Large private businesses, those with more than $500 million in gross annual revenue nationally, that use customer service chatbots with customers; hospitals are exempt for health care communications

Binds private businesses over $500 million in revenue that use customer service chatbots, which leaves out most practices; hospitals are exempt for health care communications.

Applies to: Developers of AI clinical decision support systems and the health facilities, clinics, physician's offices and group practices that use them

Binds developers and the health facilities, clinics, physician's offices and group practices that deploy AI decision support; the duties fall on the deploying entity, not the individual physician.

Applies to: HIPAA covered entities and the vendors that handle PHI for them

HHS guidance for HIPAA covered entities: a vendor's AI chatbot handling PHI on a patient portal is a business associate, so the practice or hospital needs a business associate agreement first.

Applies to: HIPAA covered entities and business associates

Proposed rule binding HIPAA covered entities and business associates: asset inventory, network map, ePHI encryption and multifactor authentication, with ePHI in AI training data protected.

Applies to: Anyone who makes an AI chatbot publicly available to consumers

Would bind anyone who makes an AI chatbot publicly available to consumers, which reaches a practice's or hospital's patient-facing chatbot.

Applies to: Medicare Advantage organizations

Binds Medicare Advantage plans only: medical necessity decisions rest on the enrollee's own circumstances, and a qualified professional reviews adverse decisions before issue.

Applies to: Medicare Advantage organizations and Medicare-Medicaid Plans

Applies to Medicare Advantage organizations and Medicare-Medicaid Plans only: AI alone may not deny an admission, downgrade to observation or end post-acute care, and decisions rest on the patient's own circumstances.

Applies to: Physicians and other practitioners billing the Medicare physician fee schedule

Fee schedule codes G0552 to G0554 let clinicians bill for FDA-cleared digital mental health treatment devices; a payment option, not a duty.

Applies to: Health care service plans, including specialized plans, and disability insurers that use AI or other software tools in utilization review or management, directly or through contractors

Binds health plans and disability insurers only: AI tools may not deny, delay or modify care on medical necessity; a licensed physician or competent professional decides.

Applies to: Health insurers regulated by the Department of Insurance and entities performing utilization review or management for them

Binds CDI-regulated insurers and their UR entities: tools may not deny, delay or modify care on medical necessity, which stays with a licensed physician or competent professional.

Applies to: Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and qualified health plan issuers on the federally facilitated Exchanges

Binds MA, Medicaid, CHIP and Exchange payers only: prior authorization deadlines, specific denial reasons and a prior authorization API; no AI rule, listed for prior authorization.

Applies to: Medicare Part B-enrolled organizations that join the model, other than suppliers of durable medical equipment, prosthetics, orthotics and supplies and laboratory suppliers; their Original Medicare patients; and clinicians who co-manage those patients

Voluntary CMS model: participating organizations and co-managing clinicians gain new billing options; no duty unless an organization joins.

Applies to: Physicians and other practitioners paid under the Medicare physician fee schedule

Proposed fee schedule pricing for 10 software analysis codes, paid to whoever bills the fee schedule; a payment change, not a duty.

Applies to: Medicare Advantage organizations; CMS and ONC for a report to Congress

Would bind Medicare Advantage plans only: electronic prior authorization and annual reports on requests approved or denied with AI or other decision technology.