If an AI tool writes a message about a patient's health and a licensed provider doesn't read it before it goes out, California requires a disclaimer and a way to reach a person. Governor Newsom signed AB 1979 and SB 503 on September 30, and starting January 1, 2027, they add three things on top of that rule: clinicians must keep their own judgment when AI tools inform care, health chatbots fall under California's medical privacy law, and practices must watch their clinical decision tools for biased results.

These laws name health facilities, clinics, physician offices, and group practices. If you run a dental, chiropractic, therapy, physical therapy, or med spa practice, check with counsel whether your practice fits one of those categories before you plan around them.

The AI message rule, and two questions it asks

The disclaimer rule comes from AB 3030, which has applied since January 1, 2025, and the new laws don't change it. Paubox covered it in which states require disclosure of AI use in treatment.

Under Health and Safety Code section 1339.75, when generative AI writes a patient message about their health, the message needs a note that AI wrote it and clear instructions for reaching a human provider or staff member.

Two kinds of messages are exempt. Administrative messages, such as "appointment scheduling, billing, or other clerical or business matters," don't count. A message is also exempt if it was "read and reviewed by a human licensed or certified health care provider" before it went out.

That leaves two questions for every AI message. Is it about the patient's health, and did a licensed provider read it first?

What AB 1979 adds on clinical decisions

AB 1979 keeps clinicians in charge when AI helps with care. Paubox wrote about it in California bill would bar AI from replacing licensed clinical judgment before it was signed, and the signed version keeps the same core rules.

In plain terms, your practice has to take reasonable steps so a licensed clinician can still use their own judgment whenever a clinical decision support tool informs a patient's care. AI can't do work on its own that the law reserves for a licensed professional, and it can't direct unlicensed staff to do that work.

Routine messages stay outside this law. It doesn't cover "documentation and communication that does not involve the application of professional judgment," such as reminders and notices that a patient's record was updated. Licensing boards enforce it, which for physicians means the Medical Board of California or the Osteopathic Medical Board of California.

Health chatbots now fall under California's medical privacy law

AB 1979 brings health chatbots under the Confidentiality of Medical Information Act (CMIA), California's medical privacy law. A business that offers a health chatbot to consumers is now treated as a health care provider under that law.

Your practice is already covered by the CMIA, so this rule mainly reaches chatbot companies. If you use a vendor's chatbot on your website or patient portal, ask how they're preparing, since the same privacy rules and penalties that apply to you will apply to them.

SB 503 reaches practices that use clinical decision tools

SB 503 applies if your practice uses software that helps make clinical decisions, such as diagnostic or risk-scoring tools. Your practice has to make reasonable efforts to spot any of these tools with a known or foreseeable risk of biased results for patients, then monitor them and take reasonable steps to reduce that bias. The vendor has to give you a statement of each tool's intended uses and known risks "upon request or at the time of initial sale," which is a practical place to start.

Sort your patient messages before January

You can work through this in an afternoon:

  1. List every message an AI tool writes or helps write for patients, including portal replies, after-visit summaries, emails, and texts.
  2. Mark each one as administrative (scheduling, billing, reminders) or about the patient's health (results, symptoms, treatment).
  3. For each health message, decide whether a licensed provider reads it before it goes out. If not, add the AI disclaimer and instructions for reaching a person.
  4. Check any tool that suggests diagnoses or treatment, and confirm your clinicians can accept, change, or ignore what it says.
  5. Ask each clinical tool vendor for their statement of intended uses and known risks.
  6. Confirm with counsel whether these laws cover your type of practice.

The privacy rules still apply to every message

None of these laws change HIPAA. An AI-drafted message about a patient's care still contains protected health information (PHI), and it still has to be sent securely, whether or not it carries an AI disclaimer.

Paubox Email Suite works with Google Workspace and Microsoft 365 to encrypt every email by default, so your staff don't need an extra step or portal before sending. For more on the basics, see our guide to HIPAA compliant email.