Binding law — in force
Medical information goes to an AI vendor only with authorization or a CMIA basis, and not for uses beyond care (California)
California Civil Code 56.10(a) bars a health care provider, health care service plan, or contractor from disclosing a patient's medical information without the patient's authorization unless 56.10(b) or (c) applies; 56.10(c)(3) permits disclosure to a person or entity providing billing, claims management, medical data processing, or other administrative services for the provider or plan, and bars that recipient from further disclosing it in violation of the Act. 56.10(d) bars sharing, selling, using for marketing, or otherwise using medical information for a purpose not necessary to provide health care services, absent express authorization. 56.06 treats businesses offering consumer health software or apps, and mental health digital services, as providers under the Act. Detect medical information sent to a model vendor with no evidence of an authorization or covered processing arrangement, and medical information fed into AI-generated marketing.
ca-cmia.medical-information-to-ai-vendor · Cal. Civ. Code 56.10(a) · official source · jurisdictions: US-CA