On September 30, 2026, California enacted AB 1979, requiring specified healthcare facilities and practices to take reasonable steps to preserve licensed practitioners’ ability to exercise independent professional judgment when AI clinical decision support informs patient care. The law generally takes effect January 1, 2027.
The obligation belongs to the organization as well as the clinical setting in which decisions occur. A facility cannot explain how it preserves that ability merely by pointing to a clinician’s signature or a policy stating that the practitioner remains responsible.
The Duty Concerns the Conditions of Clinical Work
The enacted provision, Business and Professions Code section 22758.5, applies whenever patient care is informed by the output of a defined clinical decision support system. Its focus is a licensed healthcare provider acting within their scope of practice. The organization must take reasonable steps to ensure that the provider retains the ability to exercise independent professional judgment.
The provision does not enumerate a particular training course, review form, minimum review time, or audit schedule. Those implementation choices require attention to the actual clinical use. A process suited to a routine recommendation might not support assessment of a time-sensitive treatment suggestion.
An override button addresses one part of the problem. It permits a different selection. It does not establish that the practitioner has the information, practical opportunity, or organizational support to decide whether another course is appropriate.
Coverage Follows California Healthcare Definitions
Covered is shorthand here for the categories named in AB 1979. It does not mean a HIPAA covered entity, a CCPA business, or every company that markets a healthcare product. The law incorporates specific California definitions.
Health facilities are defined through Health and Safety Code section 1250. The Department of Health Care Services describes that category as facilities organized for specified care purposes where patients are admitted for at least 24 hours, including general acute care hospitals, psychiatric hospitals, skilled nursing facilities, and other listed facility types.
Clinics are defined through Health and Safety Code section 1200. That definition concerns organized outpatient facilities providing direct medical, surgical, dental, optometric, or podiatric advice, services, or treatment for patients remaining less than 24 hours. The category has statutory qualifications and should not be inferred from the word clinic in a business name.
The law separately covers physician offices and group-practice offices by incorporating section 1339.75. These include a physician in solo practice and the specified arrangements involving two or more physicians organized as a partnership, professional corporation, or qualifying not-for-profit corporation. The express inclusion of offices matters: the obligation is not confined to hospitals.
The practitioner whose judgment is protected is not necessarily a physician. Section 22758.5 defines healthcare provider by reference to people licensed or certified under Division 2 of the Business and Professions Code, which encompasses multiple healthcare professions. The person must still act within the scope of their own professional authority.
For a digital-health company, the practical starting point is the operating arrangement: which entity provides care, under which facility or practice category, and through which licensed practitioners? Selling software to a practice does not by itself make the vendor a covered practice. Delivering care through a qualifying practice does not cease to involve that practice because the interface is digital.
The System Must Inform Clinical Care
AB 1979 defines clinical decision support as AI producing predictions, classifications, recommendations, evaluations, or analyses that aid decisions about timing of care, diagnosis, or treatment. It excludes specified appointment, education, preparation, and payment functions to the extent their independent performance does not require a professional license.
It also separately excludes automated documentation and communication that does not involve professional judgment, such as automated messages about record updates, generating reminders, and assisting patients to find information at their request.
Some Clinical Functions Cannot Be Assigned to AI
The law also prohibits specified facilities and practices from deploying AI to independently perform clinical functions legally reserved for licensed people, or to direct, guide, supervise, or instruct unlicensed personnel in performing those functions. It preserves the stated exception for trainees in supervised programs working toward licensure.
Where a violation constitutes the practice of a health care profession without a license, the appropriate licensing board may pursue an injunction or restraining order as authorized by Business and Professions Code section 125.5. The section supplies no comparable route for a facility or clinic that is not physician-owned, and it creates neither a private right of action nor an express bar on one.
Separately, AB 1979 deems qualifying healthcare-chatbot businesses providers of health care under the Confidentiality of Medical Information Act. Such a business must maintain the same standards of confidentiality required of a provider of health care and is subject to that part’s penalties for improper use and disclosure of medical information.
