Health care services: artificial intelligence.

A new Chapter 25.3 (Section 22758) is added to the Business and Professions Code, creating a separate regulatory track specifically for clinical decision support systems - AI that produces predictions, classifications, recommendations, evaluations, or analyses aiding clinical decisionmaking related to timing of care, diagnosis, or treatment.

The new CDSS section explicitly excludes systems providing appointment management (booking, canceling, rescheduling), appointment reminders, patient education and previsit materials, and payment processing, to the extent these do not require a professional license.

The bill now operates as a two-track system: the new Business and Professions Code section applies specifically to clinical decision support systems with narrower scope and developer-to-deployer transparency duties, while the retained Health and Safety Code Section 1339.76 continues to apply more broadly to all AI systems used for clinical decisionmaking or health care resource allocation.

The requirement for developers to submit AI systems to an independent third-party auditor beginning January 1, 2030 (and annually thereafter) is entirely removed, along with the requirement to publish a high-level summary of audit results on the developer's website.

Developers of CDSS must now provide deployers with a statement describing intended uses and known or foreseeable risks, plus documentation covering training data summaries (including demographic representativeness), evaluation methods for performance and bias mitigation, data governance measures, intended benefits and expected outputs, known biases and mitigation efforts, usage and monitoring recommendations, and any other reasonably necessary documentation.

A safe harbor is created allowing developers to comply with documentation requirements by adhering to nationally recognized or widely adopted industry standards developed through multistakeholder consensus, or by providing results from regularly conducted algorithmic impact assessments using industry-accepted methodologies.

A deployer that also serves as a developer is exempt from generating the required documentation if the system is developed and deployed for internal use and equivalent information is readily available to the deployer.

The definition of 'biased impact' in the new CDSS section removes the word 'unintended,' making it simply 'an adverse impact...on an individual based on their protected characteristics,' which is broader than the Health and Safety Code version that retains 'unintended adverse impact.'

The document changed from a formal printed bill format (with page numbers, Secretary/Clerk signature lines, and Governor approval block) to a web page rendering of the same text with site navigation, version history dropdown, and metadata elements added around the identical statutory language.

The definition of 'deployer' was narrowed from any person, partnership, state or local governmental agency, corporation, or health care entity to only health facilities, clinics, physician's offices, or offices of a group practice. This significantly reduces the number of entities subject to the bill's monitoring and mitigation duties.

Beginning January 1, 2027, developers must submit a report to the department identifying their compliance efforts before making an AI system commercially or publicly available to a deployer. Developers must also file updated reports for each substantial update prior to initial deployment. These pre-deployment reporting obligations do not extend to postdeployment use.

Beginning January 1, 2027 and annually thereafter, deployers must provide the department with a report identifying their efforts to comply with identification, mitigation, and monitoring requirements.

The department is explicitly not required to independently inspect, test, or evaluate the functionality of an AI system. Developers and deployers bear responsibility for ensuring compliance and must maintain documentation of their respective compliance efforts.

The department is required to make all developer and deployer compliance reports available on its internet website, creating a public transparency mechanism.

Deployers are now explicitly included alongside developers and health care entities as parties with an ongoing duty to identify AI systems with foreseeable risk of biased impacts in clinical decisionmaking or resource allocation.

Beginning January 1, 2030, and at least annually thereafter, developers must submit their AI systems to an independent third-party auditor to assess compliance with the identification and mitigation duties. Developers must also make a high-level summary of audit results publicly available at no cost on their internet website.

The definition of 'deployer' was expanded to explicitly include health facilities, clinics, physician's offices, or offices of a group practice (replacing the prior reference to 'developer'), broadening who qualifies as a deployer under the law.

The term 'artificial intelligence system' with its custom definition was replaced with simply 'artificial intelligence' incorporating the existing definition from Section 11546.45.5 of the Government Code.

Throughout the bill, the phrase 'and or' was corrected to 'or,' and subsections were renumbered (old (c) became (d), old (d) became (e)) to accommodate the new audit provision as subsection (c).

The term 'patient care decision support tool' is eliminated entirely. All references are consolidated under 'artificial intelligence system,' which now also cross-references Section 11546.45.5 of the Government Code for the definition of 'intelligence.'

The definition of 'biased impact' is clarified to read 'unintended adverse impact' (the prior version had a markup artifact showing the transition from 'impact' to 'adverse impact').

The standalone definition of 'patient care decision support tool' (any automated or nonautomated tool, mechanism, method, technology, or combination thereof used by health facilities to support clinical decisionmaking) is removed.

The requirement that developers ensure patient care decision support tools are tested for biased impacts in outputs at least once every three years is removed. No replacement testing frequency is specified.

Several instances of 'and' between 'clinical decisionmaking' and 'health care resource allocation' are changed to 'and or,' which could broaden the scope of covered uses by making it unclear whether both functions must be present or either one suffices.

The entire advisory board section is deleted. This removed requirements for DHCAI and the Department of Technology to establish an advisory board that would develop best practices, create a standardized testing system for biased impacts, and issue a statewide certification for AI models used in health care.

The bill now applies to 'artificial intelligence systems' used to support clinical decisionmaking and health care resource allocation, not just patient care decision support tools. A new definition of 'artificial intelligence system' is added: an engineered or machine-based system that varies in autonomy and can infer from input how to generate outputs influencing physical or virtual environments.

Deployers of artificial intelligence systems must now regularly monitor those systems and take reasonable and proportionate steps to mitigate any bias that may occur. This is a new ongoing obligation not present in the prior version.

The definition of 'biased impact' is narrowed from 'an unintended impact on an individual based on their protected characteristics' to 'an unintended adverse impact, including diminished access to health care, quality of care, or outcomes, on an individual based on their protected characteristics.' The addition of 'adverse' and the specific examples limits the scope of what qualifies.

The definitions of 'deployer' and 'developer' are expanded to include artificial intelligence systems used to support clinical decisionmaking and health care resource allocation, in addition to patient care decision support tools.

A new subsection (d) states that the section is in addition to other applicable state law regulating AI or automated decision systems, and that compliance with this section cannot be used as a defense to a claim of unlawful discrimination. This prevents entities from arguing they met this bill's requirements and therefore are shielded from other legal liability.

New section requires developers of patient care decision support tools and health facilities to make reasonable efforts to identify uses of those tools that employ input variables measuring a protected characteristic.

New section requires developers and deployers to make reasonable efforts to mitigate the risk of discrimination on the basis of a protected characteristic resulting from a patient care decision support tool's use in health programs or activities.

New requirement that developers ensure patient care decision support tools are tested for biased impacts in their outputs at least once every three years.

New definition of 'patient care decision support tool' as any automated or nonautomated tool, mechanism, method, technology, or combination thereof used by health facilities, clinics, physician's offices, or group practices to support clinical decisionmaking.

New definition of 'protected characteristic' referencing subdivision (b) of Section 51 of the Civil Code (race, color, religion, national origin, etc.).

Removed a standalone section stating the Legislature's intent to enact legislation regarding the regulation of medical software.

Title simplified by removing 'relating to public health' and the digest removed the 'Medical software' descriptor, narrowing the stated subject matter.

Fiscal committee designation changed from 'no' to 'yes,' indicating the bill now involves a state-mandated local program or fiscal impact requiring fiscal committee review.

Added Section 1339.76 to the Health and Safety Code, expanding the bill from a one-line intent statement into a multi-part regulatory framework governing AI use in health care services.

Requires the Department of Health Care Access and Information and the Department of Technology to establish an advisory board on AI in health care services.

The advisory board must develop best practices for AI use by health facilities, clinics, physician's offices, and group practice offices.

The advisory board must develop a standardized testing system with criteria for developers to test AI models or systems for biased impacts.

The advisory board must establish a statewide certificate confirming that a developer's AI model or system meets the board's standards for biased impact testing.

Developers of AI models or systems, in conjunction with health facilities, clinics, physician's offices, or group practice offices, are required to test for biased impacts in outputs based on the facility's patient population.

Developers must use an existing testing system designated by the board until the board develops its own standardized testing system; after that, developers may alternatively use the board's system.

Added definitions for 'biased impact' (unintended impact on an individual based on protected characteristics), 'developer,' 'deployer,' 'clinic,' 'health care provider,' 'office of a group practice,' and 'physician's office.'

Fiscal committee designation changed from 'no' to 'yes,' indicating the amendment introduces a state-mandated local program or fiscal impact.