Law / United States / 
California
Healthcare AI Patient-Communication Disclosure Act (AB 3030)
Cal. Health and Safety Code Section 1339.75
In force since .
An AI sector rules rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Disclosure
- Audit expectation
- none
- Setting the rule reaches
- General
What it requires
- If you are a health facility, clinic, physician's office, or office of a group practice using generative AI to produce written or verbal patient communications about clinical information, include a disclaimer that the communication was generated by generative artificial intelligenceNIST AI RMFMEASURE 2.8
- Place that disclaimer at the start of a written letter or email, displayed throughout an ongoing chat, video, or telehealth interaction, or spoken at the start and end of an audio interaction, depending on the communication's formatNIST AI RMFMEASURE 2.8
- In each such communication, give clear instructions describing how the patient can reach a human health care provider or other appropriate personNIST AI RMFMEASURE 3.3
- Both duties do not apply where a licensed or certified human health care provider reads and reviews the AI-generated communication before it is sent
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- MIT mitigations Draft
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
Who enforces it
Enforcement body
A violation by a licensed health facility is enforced through the licensing article at Health and Safety Code Section 1275 et seq., and a violation by a licensed clinic through Section 1225 et seq.; a violation by a physician falls under the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California, as appropriate. The section states no separate civil penalty.
What it makes you log
Logging duty
The section requires a disclaimer and human-contact instructions in each AI-generated patient communication. It states no duty to create, keep, or produce on demand any record of when a communication was sent, whether the disclaimer was included, or whether a human reviewed it.
- Kind
- None
- As of
What this law does
Chapter 2.13 of the Health and Safety Code, added by AB 3030 (Stats.
2024, Ch. 848) and effective per the code's own history note, requires a health facility, clinic, physician's office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications about clinical information to include, in each such communication, a disclaimer that it was generated by generative artificial intelligence and clear instructions for reaching a human health care provider.
The disclaimer's placement is format-specific: prominently at the start of a letter or email, displayed throughout an ongoing chat, video, or telehealth interaction, and spoken at the start and end of an audio interaction. Both duties fall away where a licensed or certified human health care provider reads and reviews the AI-generated communication before it is sent.
A violation by a licensed health facility or clinic is enforced through the same licensing-enforcement articles that already govern those facilities, and a violation by a physician falls under the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California.
The duty reaches a 'health facility' as defined in Health and Safety Code Section 1250, a definition that expressly includes government-operated facilities such as a general acute care hospital operated by the State Department of Developmental Services, the Department of Corrections and Rehabilitation, or the Department of Veterans Affairs, so the duty is not limited to privately owned providers. Confirmed against leginfo's codified text of Section 1339.75.
When LexLint raises it
When your app profile says your app generates audio with AI, generates text with AI or generates video with AI.
Back to the example · Lint your app
Page updated .