California AB 1184 amended the Confidentiality of Medical Information Act to keep sensitive healthcare private from the person who holds your insurance policy. Since July 1, 2022, health plans and insurers in California must send bills, explanations of benefits, and other communications about certain sensitive services directly to the patient rather than to the primary subscriber.1California Legislative Information. California AB 1184 – Medical Information Confidentiality The law also lets anyone covered by a California plan ask that all medical communications go to an alternative address, phone, or email, for any reason at all.
The practical effect: a spouse, an adult child on a parent’s plan, or a teenager seeking care they can legally consent to on their own can get treatment without the policyholder learning about it from a piece of mail.
Which Services Are Automatically Protected
For a defined list of “sensitive services,” the privacy protections apply automatically. You don’t have to file anything in advance. The categories include:
- Mental and behavioral health, including therapy, psychiatric care, and counseling
- Sexual and reproductive health, including contraception, pregnancy-related services, and abortion
- Testing, diagnosis, and treatment for sexually transmitted infections
- Substance use disorder treatment
- Gender-affirming care
- Medical treatment related to intimate partner violence
The definition also folds in several Family Code provisions that let minors consent on their own to things like mental health treatment, sexual assault care, and substance abuse services.1California Legislative Information. California AB 1184 – Medical Information Confidentiality If a minor has the legal right to consent to a particular service, communications about that service fall under the same protection.
The insurer cannot require the policyholder’s authorization before you receive one of these services or submit a claim for it, as long as you have the right to consent to the care yourself.2California Legislative Information. California Insurance Code 791.29
Who Qualifies as a Protected Individual
AB 1184 created a category called “protected individual.” You qualify if you are an adult covered under someone else’s health plan, or a minor who has the legal right to consent to care without a parent or guardian.1California Legislative Information. California AB 1184 – Medical Information Confidentiality That covers a spouse on a partner’s employer plan, an adult child under 26 on a parent’s plan, and a teenager seeking services they can legally consent to.
One exclusion: a person who lacks the legal capacity to give informed consent for healthcare under Probate Code Section 813 is not a protected individual, and the person authorized to make healthcare decisions for them keeps access to the information.
What Communications Get Redirected
For sensitive services, the plan or insurer must send everything that could reveal the care directly to the patient, not to the subscriber. That includes:
- Bills and payment collection notices
- Explanations of benefits
- Claim denials and other adverse benefit determinations
- Requests for more information about a claim
- Contested claim notices
- Provider names, addresses, and descriptions of services
If you have given the plan an alternative mailing address, email, or phone number, communications go there. If you have not, the plan sends the communication in your name to the address already on file for you, keeping it separate from correspondence to the policyholder.2California Legislative Information. California Insurance Code 791.29
How to Request Confidential Communications
The confidential communications right is broader than the sensitive services right. It lets you redirect any medical communication, not only those tied to the listed categories, and the plan must honor the request without asking why. Before AB 1184, you generally had to state that disclosure could endanger you. That requirement is gone for California plans.3California Legislative Information. California AB 1184 – Medical Information Confidentiality
To make the request:
- Call the member services number on your insurance card and ask about the plan’s confidential communications request process. Many plans accept the request through an online member portal.
- Provide an alternative mailing address, email address, or phone number where only you have access.
- Be ready to submit the request in writing or electronically. The plan is allowed to require that format.2California Legislative Information. California Insurance Code 791.29
A confidential communications request stays in effect until you revoke it or submit a new one. Timing matters: the request applies to future communications, not retroactively to a visit you have already had. If you have an appointment coming up and you want the paperwork rerouted, submit the request first.
When the Law May Not Fully Apply
AB 1184 binds two kinds of entities: health care service plans regulated under the Knox-Keene Act, which covers most California HMOs and managed care plans, and health insurers regulated under the California Insurance Code.1California Legislative Information. California AB 1184 – Medical Information Confidentiality The same obligations apply whether your coverage is an HMO or a traditional insurance policy.
Self-funded employer plans are a separate matter. These are governed primarily by federal ERISA law and may not be subject to all California insurance rules. If your employer self-funds its health plan rather than buying coverage from an insurer, the AB 1184 protections may not apply in full. You would still have HIPAA’s baseline right to request confidential communications, but under HIPAA that right generally requires you to state that disclosure could endanger you, and the automatic sensitive services protections do not exist at the federal level.4eCFR. 45 CFR 160.203 – General Rule and Exceptions If you are not sure which kind of plan you have, your HR department or the plan documents will say.
If a Plan or Provider Violates Your Privacy
If medical information is disclosed in violation of the CMIA, you can sue. Under Civil Code Section 56.36, you can recover nominal damages of $1,000 per violation without having to prove you were harmed, plus actual damages if you can document financial or personal injury.5California Legislative Information. California Civil Code 56.36 – Violations
Section 56.35 provides a second route if the disclosure caused economic loss or personal injury. There you can recover compensatory damages, punitive damages up to $3,000, attorney’s fees up to $1,000, and litigation costs.6California Legislative Information. California Civil Code 56.35 Separate administrative fines and civil penalties, enforced by state regulators, can also run against the violator, with higher amounts for knowing and willful conduct.5California Legislative Information. California Civil Code 56.36 – Violations
If you believe a plan has sent sensitive information to the wrong person, document what was sent, when, and to whom, and file a complaint with the plan in writing. The California Department of Managed Health Care handles complaints about Knox-Keene plans, and the California Department of Insurance handles complaints about insurers.