Assembly BillChaptered/SignedCivil
AB 2448: Medical information: confidentiality.
What AB 2448 does, verified September 29, 2026
This bill aims to expand the California Confidentiality of Medical Information Act. It would prohibit the disclosure of medical information without authorization, except in certain situations. A violation of this law could result in a misdemeanor and economic loss or personal injury to the patient. The bill requires businesses that store or maintain medical information to develop capabilities and policies to limit user access privileges and segregate sensitive information. These businesses must also enable these security features by July 1, 2024, to comply with the law.
Bill journey
✓IntroducedComplete
✓In CommitteeComplete
✓First Chamber FloorComplete
✓Second ChamberComplete
✓GovernorComplete
6ChapteredCurrent
Last action: Chaptered by Secretary of State - Chapter 607, Statutes of 2026. (2026-09-27)Alert me
Author and sponsors
Full contact details, staff, and committees with Connect, $16/moUnlockRecent actions21 total · showing 5
| Sep. 27, 2026 | Chaptered by Secretary of State - Chapter 607, Statutes of 2026. |
| Sep. 27, 2026 | Approved by the Governor. |
| Sep. 03, 2026 | Enrolled and presented to the Governor at 4 p.m. |
| Aug. 27, 2026 | In Assembly. Ordered to Engrossing and Enrolling. |
| Aug. 26, 2026 | Read third time. Passed. Ordered to the Assembly. (Ayes 29. Noes 9.). |
Latest bill textChaptered version, September 27, 2026 · 933 words
Assembly Bill No. 2448
CHAPTER 607
An act to amend Section 56.101 of the Civil Code, relating to medical information.
[ Approved by Governor September 27, 2026. Filed with Secretary of State September 27, 2026. ]
LEGISLATIVE COUNSEL'S DIGEST
AB 2448, Berman. Medical information: confidentiality.
Existing law, the Confidentiality of Medical Information Act (CMIA), generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless a specified exception applies. Existing law makes a violation of the CMIA that results in economic loss or personal injury to a patient punishable as a misdemeanor. Existing law requires specified businesses that electronically store or maintain medical information on the provision of sensitive services on behalf of a provider of health care, health care service plan, pharmaceutical company, contractor, or employer to develop capabilities, policies, and procedures, on or before July 1, 2024, to enable certain security features, including limiting user access privileges and segregating medical information related to gender affirming care, abortion and abortion-related services, and contraception, as specified.
This bill would also require those specified businesses to enable the above-specified capabilities, policies, and procedures for those security features, as specified. Because the bill would expand the scope of an existing crime, it would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The people of the State of California do enact as follows:
SECTION 1.
Section 56.101 of the Civil Code is amended to read:56.101.
(a) Every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to the remedies and penalties provided under subdivisions (b) and (c) of Section 56.36.(b) (1) An electronic health record system or electronic medical record system shall do all of the following:
(A) Protect and preserve the integrity of electronic medical information.
(B) Automatically record and preserve any change or deletion of any electronically stored medical information. The record of any change or deletion shall include the identity of the person who accessed and changed the medical information, the date and time the medical information was accessed, and the change that was made to the medical information.
(2) A patient’s right to access or receive a copy of the patient’s electronic medical records upon request shall be consistent with applicable state and federal laws governing patient access to, and the use and disclosures of, medical information.
(c) (1) A business, as described in Section 56.06, that electronically stores or maintains medical information on the provision of sensitive services, including, but not limited to, on an electronic health record system or electronic medical record system, on behalf of a provider of health care, health care service plan, pharmaceutical company, contractor, or employer, shall develop capabilities, policies, and procedures to enable and shall enable, on or before July 1, 2024, all of the following:
(A) Limit user access privileges to information systems that contain medical information related to gender affirming care, abortion and abortion-related services, and contraception only to those persons who are authorized to access specified medical information.
(B) Prevent the disclosure, access, transfer, transmission, or processing of medical information related to gender affirming care, abortion and abortion-related services, and contraception to persons and entities outside of this state in accordance to this part.
(C) Segregate medical information related to gender affirming care, abortion and abortion-related services, and contraception from the rest of the patient’s record.
(D) Provide the ability to automatically disable access to segregated medical information related to gender affirming care, abortion and abortion-related services, and contraception by individuals and entities in another state.
(2) Any fees charged to providers of health care, health care service plans, pharmaceutical company, contractors, employers, or patients to comply with this subdivision shall be consistent with Section 171.302 of Title 45 of the Code of Federal Regulations.
(3) For the purposes of this subdivision, “gender affirming care” means gender affirming health care and gender affirming mental health care as defined in subdivision (b) of Section 16010.2 of the Welfare and Institutions Code.
(4) This subdivision does not apply to a contractor, health care service plan, or provider of health care as those terms are defined in Section 56.05.
(d) This section shall apply to an “electronic medical record” or “electronic health record” that meets the definition of “electronic health record,” as that term is defined in Section 17921(5) of Title 42 of the United States Code.
SEC. 2.
No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution.Text of AB 2448 as chaptered, from the official record. Connect Plus keeps every version and highlights what changed.Compare versions