Health care services: artificial intelligence.

New Section 22759 added to Division 8 of the Business and Professions Code (Chapter 25.4) requiring health facilities, clinics, physician offices, and group practices to maintain an inventory of clinical decision support systems, provide detailed information about those systems upon request, and notify workers annually of their right to access that information. This creates a parallel regulatory track alongside the existing Health and Safety Code Section 1339.78.

The new Business and Professions Code section defines 'clinical decision support system' more broadly as 'an artificial intelligence system that produces a prediction, classification, recommendation, evaluation, or analysis that aids clinical decisionmaking related to timing of care, diagnosis or treatment,' rather than limiting it to 'automated decision system or generative artificial intelligence system.' It also adds explicit exclusions for booking, canceling, rescheduling appointments, appointment reminders, patient education and previsit materials, and payment processing where the system's independent performance does not require a professional license.

The new Business and Professions Code section (22759) has a much simpler enforcement provision: violations by physicians are subject to Medical Board or Osteopathic Medical Board jurisdiction only. Unlike Section 1339.78 in the Health and Safety Code, it does not reference State Department of Public Health enforcement for health facilities and clinics, nor does it include the detailed oversight limitations on what regulators may or may not evaluate.

The fiscal note was corrected from 'State-mandated local program: yes' to 'State-mandated local program: no,' indicating the bill no longer imposes a state-mandated local program on local agencies.

Duplicate definitions of 'clinical decision support system' appear in both Section 1714.48 (Civil Code) and Section 2820 (Labor Code), where both the older definition (automated decision system or generative AI system) and the newer broader definition (artificial intelligence system with administrative exclusions) are present under the same subsection numbers, suggesting a drafting error where the old text was not fully replaced.

Added 'Commencing July 1, 2027' effective dates for both the information disclosure requirement (subdivision b) and the annual notification requirement (subdivision c) in Section 1339.78. Previously these requirements had no explicit start date beyond the inventory deadline.

Added a new safe harbor provision in Section 1339.78(b)(2) allowing health facilities, clinics, and offices to satisfy their information disclosure duty by making available information supplied by the developer or vendor of the clinical decision support system, accompanied by the developer's or vendor's written attestation as to accuracy, unless the entity knows or has received credible notice that a material statement is false or misleading.

Changed 'qualitative measures of performance' to 'quantitative measures of performance' in Section 1339.78(b), requiring numerical performance data rather than descriptive assessments.

Added a critical new provision in Section 2821(b)(2)(B) stating that 'A policy, procedure, or protocol that requires a worker to accept, defer to, or refrain from overriding the output of a clinical decision support system is not a duty described in this paragraph.' This explicitly prevents employers from using their own AI compliance policies as a defense against retaliation claims.

In Section 2821(b)(2), changed 'standard operating procedures or other policies' to 'standard operating procedures or other written policies,' requiring that the policies be in writing to qualify as a legitimate duty.

Added new paragraphs (d)(4) through (d)(7) in Section 1339.78 that significantly limit regulatory oversight: the Department of Public Health, Medical Board, and Osteopathic Medical Board are limited to determining on the face of records whether an entity maintained the inventory, provided notification, and made information available - without regard to accuracy, completeness, adequacy, or technical sufficiency. They are not required to evaluate, verify, audit, or determine accuracy. A compliance determination does not constitute endorsement of accuracy. The agencies may review compliance during existing surveys or in response to complaints but are not required to conduct separate investigations. They may also issue all-facility letters to implement the section until regulations are adopted.

Changed enforcement jurisdiction in Section 1339.78(d)(3) from 'a physician' to 'a physician's office or office of a group practice,' expanding Medical Board and Osteopathic Medical Board jurisdiction to cover the offices themselves rather than just individual physicians.

Changed the definition of 'clinical decision support system' in both Section 1714.48 and Section 1339.78 from 'whose outputs produce that produces a prediction, classification, recommendation, evaluation, or analysis that is used to inform clinical decisionmaking' to 'that produces a prediction, classification, recommendation, evaluation, or analysis used to inform clinical decisionmaking,' removing 'outputs' as the subject and tightening the language.

Added a new definition in Section 1339.78(e) defining 'Department' as the State Department of Public Health.

Narrowed the exemption in Section 1714.48(d) from applying to any 'person licensed or certified pursuant to Division 2' to only 'a person providing direct patient care who is licensed or certified pursuant to Division 2,' limiting the carve-out for professional negligence actions.

Corrected the Health and Safety Code section number reference from 1339.76 to 1339.78 in the act description, and fixed the typo 'Healthy and Safety Code' to 'Health and Safety Code' in the generative AI definition.

The document was reformatted from a traditional legislative print layout with page numbers and line numbering into a web-based bill text format with navigation menus, search functionality, and different typographic structure. No substantive legal language was added, removed, or altered.

The definition of 'clinical decision support system' was changed from any computerized system that supports patient care decisionmaking and produces outputs (predictions, classifications, recommendations, etc.) to specifically an automated decision system or generative AI system whose outputs inform clinical decisionmaking. This narrows what qualifies as a CDSS.

A new definition of 'automated decision system' was added in both the Civil Code and Health and Safety Code sections, defining it as a computational process derived from machine learning, statistical modeling, data analytics, or AI that issues simplified output used to assist or replace human discretionary decisionmaking and materially impacts natural persons, with exclusions for spam filters, firewalls, antivirus software, and similar tools.

The definition of 'technology' (scientific hardware or software including AI and CDSS used to achieve a medical or nursing care objective) was removed from the Labor Code section, along with the definition of 'patient clinical information' from the Health and Safety Code section.

The term 'covered tool' (defined as any tool, system, or device that includes artificial intelligence or a clinical decision support system) was eliminated throughout the bill. All references now use only 'clinical decision support system,' narrowing the scope of covered systems.

The broad prohibition on employers from using or deploying technology to replace or limit a worker's use of professional judgment in patient care (former Labor Code Section 2821(c)) was removed entirely. The old bill prohibited this as a standalone violation; the new bill does not.

The public policy statement that workers should not be penalized for relying in good faith on technology their employer selected or approved was removed from both the legislative findings and the operative text.

A new exemption was added (Health and Safety Code Section 1339.76(f)) making the disclosure requirements inapplicable to use of a clinical decision support system for documentation, communication, or other administrative tasks that do not involve professional judgment, including automated messages to inform patients of their health records.

The civil liability provision (Civil Code Section 1714.48) was narrowed: the old version covered defendants who 'developed, modified, or used artificial intelligence or selected, or deployed a clinical decision support system,' while the new version covers only those who 'developed, modified, selected, or deployed a clinical decision support system.' This removes standalone AI liability and removes 'used' as a triggering verb.

The requirement to provide disclosure in plain language to patients (linked in their health record) whose care may be affected by or whose health information may be used as input to the system was removed entirely. The prior version required both worker-facing and patient-facing disclosures; now only worker-facing disclosures remain.

The requirement that disclosure be provided with 'ample time' for the health care professional to review and make reasoned decisions was removed.

The override notice language was narrowed from 'permitted to override if appropriate for the patient, or as necessary to comply with applicable law, including civil rights law' to 'may override if necessary to meet the applicable standard of care or comply with applicable law.' The reference to civil rights law specifically was removed and the standard shifted from 'appropriate for the patient' to 'necessary to meet the applicable standard of care.'

Worker retaliation protection was narrowed from two prongs (protection for overriding technology output AND protection for complying with employer-provided technology) to a single prong: protection only against retaliation based solely on the worker's override of, or reliance on, the output of a clinical decision support system.

Added a new affirmative defense in Civil Code Section 1714.48(c)(3) allowing defendants who developed or deployed a clinical decision support system to present evidence they took reasonable precautions to prevent harm, including providing clear disclosures about the system's intended use, scope, known risks, and limitations to the health facility.

Added Civil Code Section 1714.48(d) exempting medical malpractice actions under Code of Civil Procedure Section 340.5 against licensed or certified professionals (including osteopathic and chiropractic licensees) from the prohibition on asserting that a worker's failure to override an AI output is a superseding cause.

Renumbered the Health and Safety Code provision from Section 1339.76 to Section 1339.78, leaving 1339.76 as an empty placeholder section.

Removed the provision that a violation of the Health and Safety Code section constitutes 'unfair competition' under Business and Professions Code Section 17200, eliminating a potential enforcement pathway through the Attorney General or local prosecutors.

Changed the enforcement mechanism for licensed health facility violations from reference to Article 4 (commencing with Section 1290) of Chapter 2 to a narrower reference to only Sections 1280 and 1280.3.

Added Labor Code Section 2821(b)(3) providing guidance that the Labor Commissioner may consider evidence of alternate reasons for employer action (such as a worker's failure to satisfy listed duties) and clarifying that determinations under this section are not determinative of malpractice or disciplinary actions against professional licenses.

Added Labor Code Section 2821(d) granting the Labor Commissioner explicit authority to enforce the article, including investigating violations, ordering temporary relief, issuing citations, and filing civil actions, with procedures referencing Sections 98, 98.3, 98.7, 98.74, and 1197.1.

Expanded the list of worker duties that limit anti-retaliation protection in Labor Code Section 2821(b)(2) from three general categories (standard of care, scope of practice, independent judgment) to seven specific items including compliance with Business and Professions Code Section 125.6, employer standard operating procedures, Title 22 CCR Section 70215, and Title 22 CCR Section 70703 bylaws and rules.

The bill's operative term shifts from 'covered tool' (any tool including AI or a CDSS) to 'clinical decision support system,' narrowing which systems trigger the disclosure and liability requirements.

A new definition of 'automated decision system' is added across all three sections (Civil Code, Health and Safety Code, Labor Code), defining it as a computational process from machine learning, statistical modeling, data analytics, or AI that issues simplified output to assist or replace human decisionmaking and materially impacts natural persons. It explicitly excludes spam filters, firewalls, antivirus software, identity and access management tools, calculators, databases, datasets, and other data compilations.

A new definition of 'generative artificial intelligence' is added, referencing the existing definition in Section 1339.75 of the Health and Safety Code.

The definition of 'clinical decision support system' in the Civil Code section is redefined as 'an automated decision system or generative artificial intelligence system whose outputs are used to inform clinical decisionmaking with respect to the provision, timing, or course of patient care,' replacing the prior algorithm/model-based definition.

In the liability defense section (Civil Code 1714.48), the list of defendant actions expands from 'developed, modified, or used' to 'developed, modified, or selected, or deployed,' potentially capturing more parties in a product liability context.

The worker override right is strengthened: language changes from 'permitted to override' to 'may override,' adds 'independent professional judgment' as a qualifier, and adds 'necessary to meet the applicable standard of care' as an additional basis for override alongside compliance with applicable law.

The disclosure timing requirement is changed: the prior version required disclosure 'at the time' a professional uses the tool or views its output. The new version removes this real-time requirement and instead requires disclosure to be 'consistent with' the listed timing triggers (upon hire, 90 days before deployment, 90 days before material change, and annual inventory by February 1, 2028).

Patient notification language is broadened from 'whose care was affected' to 'whose care may be affected' and from 'whose health information was used' to 'may be used,' expanding which patients must receive notice.

The required disclosure content for item (1) is reduced: 'funding source' and 'any foundation model used' are removed from the list of details that must be disclosed about the system.

The Labor Code anti-retaliation provision is narrowed: a new subdivision prohibits retaliation 'solely on the worker's override of, or reliance on, the output of a clinical decision support system,' replacing the broader prior language that covered any technology. A new carve-out clarifies this does not affect a worker's duty to meet the standard of care, act within scope of practice, or exercise independent professional judgment.

The definition of 'clinical decision support system' was narrowed. Previously it covered any system whose outputs are used to inform clinical decisionmaking. Now it must produce a prediction, classification, recommendation, evaluation, or analysis that is used to inform clinical decisionmaking, which excludes systems that do not produce those specific output types.

A new requirement was added mandating that health facilities, clinics, physician's offices, and group practices make available, upon request, an inventory of all clinical decision support systems currently in use or deployed for patient care. This must be done on or before July 1, 2027, and the list must be updated at least annually.

The disclosure mechanism was changed from proactive written notice to a reactive model. Previously, facilities had to 'provide written notice' of required information to any licensed health care professional using the system. Now they only need to make that information available 'upon request' from a person using or viewing outputs from a CDSS.

A new notification requirement was added: facilities must notify workers whose duties include using or viewing CDSS outputs, upon hire and annually, of their right to request the inventory of all clinical decision support systems in use.

Several required information items were downgraded from 'description' to 'summary,' reducing the depth of detail facilities must provide. This affects how the system generates outputs, the training set or clinical research underlying recommendations, and the validation process.

A new item was added to the required information list: a link to the Certified Health IT Product List produced by the Office of the National Coordinator for Health Information Technology at the U.S. Department of Health and Human Services.

The requirement that disclosures be provided at least 90 days before a material change in the use, function, intended users, intended patient population, or decisionmaking role of an existing CDSS was removed from the new version.

Enforcement provisions were made more specific by citing particular code sections (Sections 1280 and 1280.3 for health facilities, Section 1229 for clinics) rather than referencing Article 4 generally.

The disclosure obligation was changed from 'shall disclose required information' to 'shall provide written notice of required information,' specifying the form must be written.

The liability notice required in the disclosure was softened from 'health care entities and developers are liable for harm' to 'health care entities and developers may be liable for harm.'

The definition of 'covered tool' was expanded from 'artificial intelligence or a clinical decision support system' to 'a tool, system, or device that includes artificial intelligence or a clinical decision support system,' broadening which products fall under the law.

The definition of 'artificial intelligence' in Section 1339.76 now includes a cross-reference stating it 'has the same meaning as in Section 1339.75,' aligning the two statutory sections.

New specific timing triggers were added for when disclosure must be provided: (A) upon hire/onboarding/credentialing of new staff who will use the tool, (B) at least 90 days before a new covered tool is first deployed, (C) at least 90 days before a material change to an existing tool's use or function, and (D) on or before February 1, 2028, and annually thereafter via an updated inventory of all covered tools in use.

Patient notification scope was broadened: patients whose care 'was affected' by tool output or whose information 'was used' as input were changed to those whose care 'may be affected' or whose information 'may be used,' potentially requiring notice to a larger group of patients.

Section 1714.48(b) now explicitly includes 'clinical decision support system' alongside 'artificial intelligence' as the types of tools whose developers or deployers are barred from asserting that a health care worker's failure to override an output is a superseding cause of harm. This broadens the class of defendants who cannot use this defense in malpractice or injury actions.