California Healthcare GenAI Disclosure Law

Overview

California AB 3030 establishes notification requirements for health facilities, clinics, and physicians’ offices, including group practices, that use generative artificial intelligence to communicate patient clinical information. The requirements took effect on January 1, 2025. They apply to specified California healthcare settings rather than creating a nationwide patient-notification requirement. The Medical Board of California’s Generative Artificial Intelligence (GenAI) Notification Requirements page provides an official explanation of the obligations.

The central requirements are disclosure of the communication’s GenAI origin and clear instructions for contacting an appropriate human. Disclosure placement depends on whether the communication is an ordinary written message, a continuous written online interaction, audio, or video. Communications read and reviewed by a licensed or certified human health care provider are exempt. Administrative matters, including appointment scheduling and billing, are excluded from patient clinical information. Applicability therefore turns on the setting, the technology used, the subject matter communicated, the channel, and qualifying human review.

Definitions and Covered Settings

Artificial intelligence is an engineered or machine-based system with varying autonomy that can infer from inputs how to generate outputs influencing physical or virtual environments, for explicit or implicit objectives. Generative artificial intelligence is AI capable of generating derived synthetic content, including images, video, audio, text, and other digital content. The notification framework concerns the use of this generative capability in communications about a patient’s health status, rather than every use of software or automated processing within a healthcare organization.

Patient clinical information means information relating to a patient’s health status. Administrative matters, including appointment scheduling, billing, and other clerical or business matters, are excluded. This distinction separates clinical communications from administrative exchanges. For implementation purposes, a message combining administrative and clinical material should be assessed by its actual content rather than treated as administrative solely because it includes an appointment or billing element. That assessment is a practical method for applying the definition, not a separate mandated classification procedure.

A clinic has the meaning in California Health and Safety Code section 1200, and a health facility has the meaning described in section 1250. A physician’s office is the office of a physician in solo practice. An office of a group practice is an office or offices in which two or more physicians are legally organized as a partnership, professional corporation, or not-for-profit corporation licensed according to Health and Safety Code section 1204(a). These organizational definitions identify the healthcare settings covered by the notification requirements.

A health care provider is a person licensed or certified under Division 2 of the California Business and Professions Code. Examples include physicians, registered nurses, physician assistants, licensed midwives, and pharmacists. Medical assistants do not qualify as health care providers for this requirement. The distinction is important because the exemption depends on review by a provider with the specified qualification, while the patient-contact instructions may direct the patient to a broader category of appropriate human recipients.

Governance and Accountability

AB 3030 is the legislative basis for the notification requirements. The Medical Board of California provides an official explanatory resource and directs readers to California Legislative Information for further information. The operational focus is the communication delivered by the covered healthcare setting: whether GenAI was used, whether the content concerns patient health status, whether a qualifying provider read and reviewed it, and whether the required notice and contact instructions appear in the appropriate form.

Organizations can assign responsibility for message classification, disclosure templates, communication interfaces, and reviewer-qualification checks. These are practical governance measures rather than additional statutory institutional structures. Clear allocation of responsibilities helps distinguish the person reviewing a message for the exemption from the person available to respond to the patient. A human contact recipient may be a health care provider, employee, or other appropriate person; an exemption reviewer must be a licensed or certified human health care provider.

Accountability also requires keeping the notification decision distinct from broader clinical responsibilities. A message may qualify for the human-review exemption because it was read and reviewed by an appropriately qualified provider. That exemption addresses the notification requirements; it does not make disclosure compliance a substitute for clinical judgment, professional obligations, or responsible patient communication. Similarly, a GenAI notice identifies the origin of a communication and is not a guarantee that the generated information is accurate.

Channel-Specific Notification Requirements

For written physical and digital communications, such as letters and emails, the GenAI notification must appear prominently at the beginning of each nonexempt communication. Placement at the beginning makes the disclosure part of the patient’s initial encounter with the message. Organizations using multiple written-message templates can incorporate the notice into each relevant template so that the disclosure accompanies the actual clinical communication rather than depending on a separate general statement elsewhere.

For written online communications involving chat or another continuous interaction, the notification must remain prominently displayed throughout the interaction. This differs from the beginning-only placement used for ordinary written messages. A continuous interaction may extend across multiple exchanges, so a practical interface design should keep the notice visible as the interaction proceeds. The operative requirement is continuing prominent display, rather than a one-time disclosure that disappears after the opening exchange.

For audio communications, including voicemail, verbal notification is required at both the beginning and end of the interaction. A compliant audio workflow therefore needs both an opening and a closing disclosure for a nonexempt communication. For video communications, notification must be prominently displayed throughout the interaction. Audio and video have different placement rules: spoken notices at the two ends of audio, and continuing prominent display for video.

The four channel rules should be implemented separately. A notice placed only at the start of an email follows a different pattern from a persistent chat notice, an opening-and-closing audio script, or an ongoing video display. Templates, interface settings, audio scripts, and video overlays are practical ways to deliver these requirements. Their suitability depends on whether they achieve the required placement and prominence in the patient-facing communication.

Human Contact and the Review Exemption

Where the notification requirements apply, patients must receive clear instructions explaining how to contact a human health care provider, employee, or other appropriate person. This obligation complements the GenAI disclosure: the patient is informed about the communication’s origin and given a route to a human. The relevant distinction is between an actual human-contact pathway and further interaction with an automated system alone. The instructions should make the route understandable to the patient receiving the communication.

Communications read and reviewed by a licensed or certified human health care provider are exempt from the described notification requirements. Both the act of reading and reviewing the communication and the reviewer’s professional qualification matter. Review by a medical assistant alone does not satisfy the stated provider category. The examples of qualifying providers include physicians, registered nurses, physician assistants, licensed midwives, and pharmacists, subject to the licensing or certification definition.

The review exemption and the human-contact requirement serve different roles. Qualifying review determines whether the communication is exempt, while contact instructions support human accessibility when the requirements apply. An employee may be an appropriate contact recipient without qualifying to perform the review that supports an exemption. Organizations should therefore evaluate reviewer eligibility and contact-recipient suitability as separate workflow questions rather than treating any human involvement as equivalent to provider review.

Implementation and Operational Monitoring

A practical implementation process starts by identifying the covered setting, determining whether GenAI generated the communication, and assessing whether the content relates to the patient’s health status. Administrative-only communications fall outside the clinical-information definition. For a clinical communication, the next step is to determine whether a qualifying licensed or certified human health care provider read and reviewed it. If the communication is nonexempt, the delivery channel determines the required disclosure placement, and clear human-contact instructions must accompany the applicable communication.

Implementation can use existing communication tools rather than a single uniform disclosure design. Letters and emails can include beginning-of-message notices; chat interfaces can maintain a visible notice; audio scripts can include opening and closing disclosures; and video workflows can use a continuing prominent display. Organizations can also check whether patient-contact instructions connect to a functioning and appropriate human pathway. These operational methods support the express duties while remaining recommendations about how to execute them.

Internal checks can examine whether disclosures reach patients in the required position and remain visible for the required duration. Written-message checks can focus on the beginning of the message, chat and video checks on continuing display, and audio checks on both opening and closing notices. Reviewing actual outputs is useful because a template setting alone does not show how a notice appears in the final patient-facing experience. These checks are practical compliance controls, not a separate statutory audit or certification framework.

Organizations relying on the exemption can check reviewer credentials and whether each relevant communication was actually read and reviewed. Proportionate evidence of review, periodic tests of human-contact routes, and documentation of disclosure configurations can support internal accountability. These are recommended practices rather than a prescribed retention schedule or audit-trail format. Operational evaluation should also distinguish notification compliance from clinical accuracy and model safety: delivery of a notice addresses transparency, not the correctness of the underlying clinical information.

Relationship to Other Instruments

The California Health and Safety Code references identify clinics, health facilities, and the relevant group-practice organization, while Division 2 of the Business and Professions Code identifies qualifying licensed or certified health care providers. These definitional connections establish which settings and reviewers fit the notification framework. AB 3030’s patient-communication obligations are distinct from requirements addressing model development, computing infrastructure, or the regulatory treatment of medical devices.

The Federal Register document on reporting requirements for advanced artificial intelligence models and computing clusters concerns a separate federal proposed rule. Its subject is advanced AI development and computing-cluster reporting, rather than California patient-facing healthcare disclosures. It is a contextual comparison and is not an authority for AB 3030’s notification obligations.

The FDA announcement seeking public feedback on GenAI-enabled medical devices concerns a discussion paper and regulatory policy development for medical devices. It is also separate from AB 3030. A California healthcare communication disclosure, a federal development-reporting proposal, and an FDA consultation address different regulatory subjects and should not be treated as interchangeable obligations.

For organizations operating across jurisdictions, the California rules can be treated as a distinct communication specification. A reusable global notice should still be assessed against the relevant California channel requirements and human-contact obligation. General transparency language alone does not demonstrate beginning-of-message placement, continuing visibility, or opening-and-closing audio disclosure. This is an implementation recommendation for multijurisdictional workflows, not a statement that the California measure creates an international compliance or mutual-recognition regime.

Implementation Timeline

Compliance Checklist

Sources and References