California AB 1184: Medical Information Confidentiality Rules Explained
California AB 1184 gives people enrolled in health plans and health insurance policies more control over where certain health care communications are sent. The law is especially important when a policyholder, parent, or other person might otherwise see another person’s explanation of benefits or related records. It requires plans and insurers to honor qualifying requests for confidential communications and provides added protections for communications about sensitive services. Knowing how to request privacy can help prevent unintended disclosure of personal medical information.
What California AB 1184 Does
Assembly Bill 1184, authored by Assemblymember Chau and signed in 2021, amended California law on the confidentiality of medical information. Its key provisions took effect on January 1, 2022. The law focuses on communications from health care service plans and health insurers to people covered under a policy or plan.
In practical terms, AB 1184 lets a covered person ask a health plan or insurer to send communications to a different mailing address, telephone number, email address, or other approved destination. A person can make this request even if someone else—such as a parent, spouse, or employer—is the policyholder or pays the premiums.
The aim is to reduce the risk that routine insurance communications will disclose private care to someone who shares an address, account, or insurance policy. The law does not remove medical information from an insurer’s records. It changes how covered communications are directed when the legal requirements are met.
Who Is Protected Under the Law
AB 1184 refers to a person receiving coverage through a health plan or health insurance policy as a “protected individual” in the relevant provisions. The protections can matter to adults and minors who are covered as dependents on another person’s plan. A policyholder’s status alone does not mean that every communication about another covered person must be sent to the policyholder.
The law applies to California-regulated health care service plans and health insurers. Oversight generally falls to the California Department of Managed Health Care (DMHC) for health care service plans and the California Department of Insurance (CDI) for insurers, though the right regulator can depend on the type of coverage. Some coverage arrangements, including certain self-funded employer plans, may be governed by different rules. Members can check their plan documents or ask the plan which regulator oversees it.
What Counts as a Confidential Communication
AB 1184 covers communications concerning a person’s receipt of health care services. Examples include documents that could reveal that a person received care, sought a service, or submitted a claim. These communications may be delivered on paper or electronically.
- Explanation of benefits (EOB) statements and claim notices
- Bills, invoices, and statements about amounts owed
- Notices of claims or services received
- Communications about claims, including certain denial or coverage notices
- Other plan or insurer communications that disclose receipt of care
An EOB is generally not a bill. It explains how a claim was processed, what the plan paid, and what amount may be the patient’s responsibility. Even so, it can reveal the provider, service, or date of care, making it a significant privacy concern for people who share an insurance account.
The specific communication covered can depend on the circumstances and governing law. A confidential communications request does not necessarily change where every document from a medical provider, pharmacy, or other organization is sent. People may need to make separate requests directly to those organizations.
Extra Privacy for Sensitive Services
California law gives particular attention to communications about “sensitive services.” The definition includes specified care that can be highly personal, including services related to sexual and reproductive health, mental health, substance use disorder, gender-affirming care, and care related to intimate partner violence. The exact statutory definition controls, and not every service that a person considers private will automatically fall into a legal category.
For communications concerning sensitive services, AB 1184 requires a plan or insurer to direct communications to the protected individual when the individual makes the applicable request. This is designed to help prevent an EOB or similar notice from exposing sensitive care to another person on the policy. People should confirm with their plan how to submit a request and what communication types the request will cover.
These protections are about the handling of insurance communications. They do not change whether a service is medically appropriate, covered, or subject to plan terms. Nor do they guarantee that a provider, pharmacy, or other party will use the same confidential contact information without a separate request.
How to Request Confidential Communications
A protected individual can ask the health plan or insurer to send covered communications to an alternative address or method. California’s rules are intended to make this process accessible. For sensitive services, a plan or insurer generally may not require the request to be in writing; a request can be made through an accepted method such as phone or electronic communication. Plans must provide ways to submit requests, including through their websites or online portals where applicable.
For other covered communications, the person should ask the plan what request method applies and whether it requires a particular form. The plan may need enough information to identify the member, verify the request, and apply the change to the correct account. A request should be clear about the preferred contact method and destination.
- Contact the customer service number on the insurance card or use the plan’s member portal.
- Ask for a confidential communications request under California AB 1184.
- Specify the safe mailing address, phone number, email, or other available destination.
- Ask whether the request applies to EOBs, bills, claim notices, and electronic account messages.
- Request confirmation of when the change begins and how to update or cancel it.
- Keep a record of the date, method, and confirmation number, if one is provided.
If the person believes a shared online account, email inbox, or phone plan is not private, an alternative destination should be one they can access safely. They can also ask whether the plan can suppress paper mail or change electronic notification settings, while confirming which notices the plan is legally required to send.
When Does the Request Take Effect?
Timing can depend on the type of request and the plan’s procedures. A request may not change communications already generated or sent, and an update to one system may take time to reach billing or claims systems. The member should ask the plan when the new destination will take effect and whether any pending claims could still trigger communications to the old address.
A confidential communications request is not a substitute for updating the mailing address on every account. People may need to separately update contact preferences with health care providers, pharmacies, laboratories, behavioral health practices, and other organizations. They should also review account permissions and notification settings for shared portals.
How AB 1184 Relates to HIPAA
The federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule includes a right to request confidential communications from a covered health plan or health care provider. Under federal rules, an individual can request communication by an alternative means or at an alternative location, and a health plan must accommodate a reasonable request when the individual clearly states that disclosure could endanger them.
California AB 1184 provides additional state protections for covered communications, including a framework for sensitive services that does not simply depend on the federal endangerment standard. State and federal requirements can overlap, and the rule that applies can depend on the organization and situation. A person can ask the plan’s privacy officer or member services to explain how the request will be handled.
What AB 1184 Does Not Do
AB 1184 is a confidentiality rule, not a general ban on insurance records or a guarantee that no one else can learn about care. It does not erase claims data, prevent a plan from processing a claim, or automatically make a provider’s records confidential from every legally authorized party. It also does not necessarily cover every type of insurance or every entity that handles health information.
Privacy can depend on several systems working together. For example, an insurer may redirect an EOB while a provider continues to send appointment reminders to a shared phone. A person may need separate privacy requests for each organization and should ask how each one communicates about care.
What to Do if a Request Is Not Honored
If a plan sends a covered communication to the wrong place after confirming a confidential communications request, the member can contact the plan and ask for its privacy officer or grievance department. They should explain what was requested, when it was submitted, what communication was disclosed, and whether the plan confirmed the change. Keeping copies of forms and messages can help resolve the issue.
If the matter remains unresolved, the member can contact the regulator responsible for the coverage. The California Department of Managed Health Care provides assistance for many health care service plan issues. The California Department of Insurance handles many insurance matters. The plan’s member materials can help identify the regulator and complaint process.
People concerned about immediate safety may also consider speaking with a health care provider, advocate, or legal services organization about additional privacy steps. This article provides general information, not legal advice; individual rights can depend on the coverage arrangement and facts.
Quick Reference: California AB 1184 Privacy Rules
| Question | General answer |
|---|---|
| When did the law take effect? | January 1, 2022. |
| What can a request change? | Where or how covered health plan or insurer communications are sent. |
| Can a dependent make a request? | Yes. A person can seek confidential communications even when covered under another person’s policy. |
| What services receive added attention? | Statutorily defined sensitive services, including specified sexual and reproductive, mental health, substance use, gender-affirming, and intimate partner violence-related care. |
| Does the request automatically cover providers? | No. Separate requests may be needed with providers, pharmacies, and other organizations. |
| Where can someone raise a complaint? | With the plan or insurer first, then the applicable California regulator, such as DMHC or CDI. |
Key takeaway: California AB 1184 gives covered individuals a practical way to direct certain health insurance communications to a safer destination. A clear request, confirmation from the plan, and separate updates to providers and shared accounts can help make the protection more effective.
Official resources: Review the text and legislative history through the California Legislative Information website, and consult the DMHC or CDI for coverage-specific assistance.