Recently, California’s Governor signed Assembly Bill (AB) 45, which builds on existing California laws, such as the Confidentiality of Medical Information Act, seeking to protect individuals seeking certain healthcare services. AB 45 takes effect January 1, 2026.
Specifically, the law prohibits the collection, use, disclosure, sale, sharing, or retention of personal information of a natural person located at or with the precise geolocation of a “family planning center” – in general, a clinic or center that provides reproductive health care services.
Some exceptions apply, such as to perform services or provide goods requested by the natural person, or as provided in a collective bargaining agreement. Also, the proscription described above does not apply to covered entities and business associates as defined under HIPAA, although for the exception to apply to business associates, they must be contractually obligated to comply with all state and federal privacy laws.
Persons aggrieved by a violation of this prohibition have a private right of action, which permits treble damages and recovery of attorneys’ fees and costs.
AB 45 also makes it unlawful to, directly or through a third party, geofence for certain purposes an entity that provides certain in-person health care services (e.g., medical, surgical, psychiatric, mental health, behavioral health, preventative, rehabilitative, supportive, consultative, referral). Those purposes include, but are not limited to, identifying the persons receiving such services or sending notifications or advertisements to such persons. Any person who violates this section can be subject to a $25,000 penalty per violation.
However, there are several exceptions, such as:
- The owner of an in-person health care entity may geofence its own location to provide necessary health care services.
- Geofencing is conducted solely for certain approved research purposes that comply with applicable federal regulations.
- Geofencing either by (I) labor organizations if the geofencing does not result in the labor union’s collection of names or personal information without the express consent of an individual and is for activities concerning workplace conditions, worker or patient safety, labor disputes, or organizing, or (II) a third party vendor, including, but not limited to, a social media platform, that collects personal information from a labor organization solely to carry out the purposes in (I).
AB 45 also provides protections for personally identifiable research records developed for the kind of research described above. Those protections provide that such records may not be released in response to another state’s law enforcement activities, including subpoenas or requests, that would interfere with certain rights of a person, such as under California’s Reproductive Privacy Act.
Federal and state laws, including under HIPAA, continue to expand protections for information related to health services, including whether or not a person is receiving services, as well as the types of services, such as reproductive health services. Persons or entities seeking to collect, process, or share this information need to be aware of this growing patchwork of law.