HIPAA is the floor.
In California, CMIA raises the bar.

Yes. HIPAA is the federal floor, but the CMIA adds obligations on top, and HIPAA compliance doesn't automatically mean CMIA compliance. The CMIA is broader in ways that matter: it can reach entities outside HIPAA's definitions, including certain digital health businesses; it includes a private right of action, so individuals can sue directly; and it carries statutory penalties that can reach up to $250,000, alongside administrative fines.

Because the two laws overlap but aren't identical, the practical rule is that where both apply, you generally have to satisfy the more protective requirement. For a California healthcare organization, treat HIPAA as the baseline and layer the CMIA-specific obligations — authorization, confidentiality of stored information, and the newer sensitive-services rules — on top, rather than assuming your HIPAA work already covers them.

Both signed in September 2023, these bills expanded the CMIA's reach and added concrete technical duties. AB 254 broadened the law to expressly cover reproductive and sexual health services delivered through digital health solutions, and deems a business offering a reproductive or sexual health digital service to a consumer a "provider of health care" for CMIA purposes — pulling many app and platform companies in for the first time.

AB 352 focused on how EHR systems handle medical information about sensitive services — defined to include mental and behavioral health, sexual and reproductive health, STIs, substance use disorder, gender-affirming care, and intimate partner violence. It requires the capability to limit access to records on gender-affirming care, abortion and related services, and contraception to authorized individuals, to restrict transmitting that information out of state, and generally prohibits cooperating with out-of-state inquiries seeking to identify someone in connection with abortion services lawful in California, absent a valid authorization or recognized exception. These are operational requirements touching system configuration, access controls, and disclosure workflows — not just policy language.

Quite possibly — one of the most important shifts from the recent amendments. Under AB 254, a business that offers a reproductive or sexual health digital service to a consumer (to let the individual manage their information, or for diagnosis, treatment, or management of a medical condition) is deemed a provider of health care for CMIA purposes. That pulls digital health companies, certain apps, and platforms that assumed they sat outside health privacy law squarely within the CMIA, with all the confidentiality, authorization, and sensitive-services obligations that follow.

This is true even for organizations that are not HIPAA covered entities — exactly the gap that catches companies by surprise: they reasoned that because they aren't a hospital or health plan, health privacy law didn't reach them. The safe approach for any digital health, telehealth, or wellness business serving California consumers is to deliberately analyze whether the CMIA now applies, rather than assume it doesn't, because the penalties and private right of action make a wrong guess expensive.

No. AB 352 included a good-faith grace period stating that a provider of health care wouldn't be subject to liability or to civil or enforcement actions for failing to meet the out-of-state disclosure requirements before January 31, 2026, as long as the provider was working diligently and in good faith to comply. That date has now passed, so the grace period has ended and those requirements are enforceable.

In practical terms, organizations relying on diligent, good-faith effort as their position can no longer count on that cushion — the expectation now is actual compliance with the restrictions on out-of-state transmission of, and cooperation regarding, protected medical information. If your systems still can't reliably segregate sensitive-services records, restrict their access, or control out-of-state disclosure, that's live exposure now — compounded by the CMIA's private right of action and penalty structure. We help California organizations close exactly those gaps and document a defensible posture.