Governor Newsom recently signed Senate Bill 81, which extends patient privacy rights in the healthcare context to information about immigration status and place of birth. In addition, it sets out new requirements for healthcare providers to establish non-public areas in their facilities, access to which is not permitted for the purpose of immigration enforcement.

New Patient Privacy Rights for Immigration Information

SB 81 amends the California Confidentiality of Medical Information Act (CMIA) to treat as “medical information” a patient’s past or present immigration status and place of birth. Accordingly, that information will be subject to the same protections as other medical information. The information is protected regardless of whether it is collected electronically or in physical form, and by a provider of health care, health care service plan, pharmaceutical company, or contractor.

The CMIA defines a “provider of health care” as any licensed health facility, health dispensary, or clinic, or any privately licensed individual healthcare practitioner. The definition does not include assisted living facilities licensed as residential care facilities for the elderly (RCFEs). Accordingly, SB 81 does not require RCFEs to treat a resident’s past or present immigration status and place of birth as confidential information.

Because it is a state law, SB 81 does not add to the obligations of healthcare providers under HIPAA. However, HIPAA requires providers to follow more stringent state confidentiality requirements. The SB 81 requirements meet the stringency test. Therefore, California healthcare providers must include them in their health information privacy policies.

It is worth noting that the regulation also applies to contractors of healthcare providers. “Contractor” denotes any outside entity that provides operational assistance to a provider and needs access to medical information to furnish that assistance. This includes “business associates” under HIPAA, which are outside contractors that have access to patient medical information in order to assist with provider operations. HIPAA-mandated business associate agreements covering California patients now should require the business associate to maintain the confidentiality of a patient’s past or present immigration status and place of birth.

SB 81 also explicitly prohibits disclosure of medical information for immigration enforcement purposes, except in three instances. First, CMIA (and HIPAA) permit the disclosure of medical information when expressly permitted by the patient in an authorization form that meets legal requirements. Second, the healthcare provider may be required to turn over the information under CMIA’s mandatory disclosure provision (e.g., in response to a court order or search warrant). Third, the provider may be expressly permitted to disclose the information without a written authorization (e.g., to a payor to obtain reimbursement or to another provider to aid in the diagnosis or care of the patient).

Mandatory Establishment of Limited-Access Non-Public Areas

SB 81 also requires providers to establish non-public areas of a facility where patients discuss their health status or receive treatment or care. Providers are encouraged to use mapping, signage, key entry, and other means to identify such areas. SB 81 expressly prohibits access to these non-public areas for the purpose of immigration enforcement, unless the person seeking entry has a valid judicial warrant or court order that specifically grants access to the non-public areas of the facility.

Upon receiving a request to access either the facility or a patient for the purpose of immigration enforcement, staff must immediately refer the requestor to management, administration, or legal counsel. Staff also must immediately direct any person asking to review the provider’s documents for immigration enforcement purposes (including requests authorized by a lawfully issued subpoena, warrant, or court order) to management, administration, or legal counsel.

SB 81 requires providers to inform both staff and relevant volunteers about how to respond to requests for access that relate to immigration enforcement. It encourages providers to post a “notice to authorities” at facility entrances setting out its requirements.

SB 81 should be distinguished from existing California laws specifically designed to protect the privacy rights of employees in the workplace. These include the California Immigration Worker Protection Act (CIWPA). For information about these laws, see Hanson Bridgett’s June 13, 2025 alert: Guidance for Employers on Preparing for Responding to ICE or Other Law Enforcement in the Workplace.

Providers have until November 4, 2025, which is 45 days after the effective date, to comply with the limited access provisions of SB 81. Accordingly, they should turn their attention without delay to creating and implementing protocols to effectuate compliance.