Legally protected health care activity.

The document was converted from the official authenticated chaptered format (with page numbers, 'STATE OF CALIFORNIA AUTHENTICATED ELECTRONIC LEGAL MATERIAL' header, and formal layout) to a web page display that includes site navigation elements such as quick search, bill information links, version history sidebar, and share options. No substantive legal text was added or removed.

The bill cover page (showing Senate and Assembly passage dates, Governor's receipt line, and Private Secretary signature block) was replaced with the standard chaptered law header: STATE OF CALIFORNIA, AUTHENTICATED ELECTRONIC LEGAL MATERIAL, CHAPTER 764, and the approval/filing date of October 13, 2025.

Page headers and footers changed from 'SB 497' with sequential page numbers to 'Ch. 764' with a different pagination scheme (starting at page 93).

Text was reflowed throughout due to the new page width and layout, but the statutory language in all sections (Civil Code 56.109, Code of Civil Procedure 2029.300 and 2029.350, Health and Safety Code 11165) is substantively unchanged.

New exception in Section 56.109(e) of the Civil Code: the bill no longer blocks compliance with audits or investigations of activity unlawful under state or federal law, or audits/reviews/investigations for licensure, registration, accreditation, or certification purposes (including those by organizations recognized by the State Department of Public Health or CMS).

New exception in Section 56.109(f) of the Civil Code: the Department of Corrections and Rehabilitation may disclose a patient's medical information to an out-of-state health care facility or federal law enforcement agency for treatment purposes and direct medical care, narrowly limited to the request.

In Section 11165(c)(2)(C)(i) of the Health and Safety Code (CURES), the prohibition on providing data in furtherance of an interstate investigation is now limited to investigations seeking to impose liability 'based on another state's laws,' rather than any interstate investigation.

New paragraph (iii) in Section 11165(c)(2)(C) of the Health and Safety Code: the CURES data-sharing prohibition does not apply to compliance with audits or investigations of activity unlawful under state or federal law, or audits/reviews/investigations for licensure, registration, accreditation, or certification purposes.

The digest now states that the bill incorporates additional changes to Section 11165 proposed by AB 82, operative only if both bills are enacted and SB 497 is enacted last.

Multiple instances of 'meaning' corrected to 'meanings' in definitions referencing Section 16010.2 of the Welfare and Institutions Code, and a typo in the bill title ('health care. care,') corrected to 'health care,'.

Prohibitions on state or local agencies providing CURES data or expending resources in furtherance of interstate investigations seeking to impose liability for legally protected health care activity now require that the agency act 'knowingly.' Previously, any provision of data or expenditure of resources was prohibited regardless of intent.

The exception allowing compliance with investigations of crimes under California law no longer requires that no medical information related to gender-affirming health care be shared with out-of-state agencies or individuals. The old version contained a more restrictive version of this exception that explicitly barred sharing such information; the new version removes that limitation.

The requirement for a warrant, subpoena, or court order for law enforcement to obtain CURES data as part of a criminal investigation was changed from a flat requirement to a more flexible standard: regulations must now address 'the conditions under which' such process is required, rather than mandating it in all cases.

The Department of Justice's obligation to adopt regulations regarding access and use of CURES information was changed from 'shall' (mandatory) to 'may' (discretionary), making rulemaking optional rather than required.

Out-of-state law enforcement access to CURES data is now specifically limited to cases where the department receives a warrant, subpoena, or court order issued pursuant to Section 2029.300 or 2029.350 of the Code of Civil Procedure, or Section 1326 of the Penal Code. The prior language was less specific about what legal process would suffice.

The interstate data sharing hub provision was restructured to remove incomplete or corrupted language and to more clearly state that out-of-state authorized users who obtain CURES data through the hub shall not provide that data in furtherance of investigations seeking to impose liability for legally protected health care activity.

New subdivision (h)(6) in Health and Safety Code Section 11165 prohibits the Department of Justice from providing CURES data to out-of-state law enforcement unless they present a warrant, subpoena, or court order issued under specific California statutes (Code of Civil Procedure Sections 2029.300 or 2029.350, or Penal Code Section 1326). This creates a concrete procedural barrier to out-of-state access of prescription drug monitoring data.

Changed 'shall adopt regulations' to 'may adopt regulations' in Health and Safety Code Section 11165(c)(3), making the Department of Justice's rulemaking on CURES access and use permissive rather than mandatory. This gives the department discretion over whether to issue such regulations.

In Civil Code Section 56.109(a), changed 'any civil action, request' to 'any subpoena or request,' narrowing the prohibition on releasing medical information related to gender-affirming care from covering all civil actions to specifically covering subpoenas and requests.

The original bill had a duplicate subdivision (d) in Section 56.109. The amendment splits this into two separate provisions: one preserving the ability to comply with investigations of crimes under California law as long as no gender-affirming care medical information is shared out-of-state, and a second that simply states the section does not prohibit compliance with investigation of activity punishable as a crime under California law (without the condition about not sharing gender-affirming care data).

Senator Cervantes was added as a coauthor of the bill.

Clarified awkward language in CURES regulations from 'Require a warrant, subpoena, or court order' to 'The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.'

An urgency clause was added, meaning the bill would take effect immediately upon the governor's signature rather than on January 1 of the following year. This requires a two-thirds vote in both houses.

The vote requirement changed from a simple majority to a two-thirds supermajority, reflecting the urgency clause addition.

A severability provision was added, stating that if any part of the bill is found invalid, the remaining provisions continue in effect.

A double negative in the CURES exception clause was fixed. The old text read 'so long as no CURES data...is not knowingly shared' (which logically meant sharing was required). The new text reads 'so long as CURES data...is not knowingly shared,' correctly stating that investigations of in-state crimes are permitted as long as protected health care data is not shared out of state.

The CURES data prohibition was clarified to require that state or local agencies not 'knowingly provide' CURES data and not 'knowingly expend or use time, money, facilities, property, equipment, personnel, or other resources' in furtherance of interstate proceedings targeting legally protected health care activity. The previous version had contradictory language ('shall not provide...or expend knowingly providing').

The explicit prohibition on out-of-state law enforcement having access to CURES data through the interstate data sharing hub was removed. It was replaced with a narrower provision that the department shall not share data with an out-of-state law enforcement agency without a warrant, subpoena, or court order.