California AB 1184 took effect July 1, 2022, and amended the Confidentiality of Medical Information Act to keep health insurance communications about sensitive care away from the policyholder. If you are covered under someone else’s plan, your insurer must send bills, explanation of benefits notices, and other communications about certain sensitive services directly to you. You can also tell your plan to route all of your medical communications to an address, email, or phone number of your choosing, and the plan has to honor that request without asking why.1California Legislative Information. California AB 1184 – Medical Information Confidentiality
The law matters most for spouses on a partner’s employer plan, adult children under 26 still on a parent’s plan, and minors who have the legal right to consent to their own care. Before AB 1184, a routine explanation of benefits could reveal a therapy visit, a contraception prescription, or substance use treatment to whoever opened the mail at the subscriber’s address. That default is now reversed for sensitive services.
Which Services Are Automatically Protected
The law defines “sensitive services” to cover healthcare categories where a privacy leak could deter people from seeking care or expose them to harm. The protected categories include:
- Mental and behavioral health, including therapy, psychiatric care, and counseling
- Sexual and reproductive health, including contraception, pregnancy-related services, and abortion
- Testing, diagnosis, and treatment for sexually transmitted infections
- Substance use disorder treatment
- Gender-affirming care
- Medical treatment related to intimate partner violence
The definition also incorporates several Family Code provisions that let minors consent to specific services without a parent’s permission, including mental health treatment, sexual assault care, and substance abuse services.1California Legislative Information. California AB 1184 – Medical Information Confidentiality Communications about any of these services go directly to the person who received the care, automatically. You do not have to file paperwork first.
Who Can Use These Rights
AB 1184 created a category called “protected individual.” You qualify if you are an adult covered under someone else’s health plan, or a minor with the legal right to consent to care without a parent or guardian.1California Legislative Information. California AB 1184 – Medical Information Confidentiality A spouse on a partner’s employer-sponsored plan, an adult child on a parent’s plan, and a 16-year-old seeking mental health treatment all qualify and can exercise these rights independently.
The one exclusion is for individuals who lack the legal capacity to give informed consent under California Probate Code Section 813. In that situation, the person authorized to make healthcare decisions retains access to the medical information.
What Communications Get Redirected
For sensitive services, the plan cannot send information about the care to the policyholder. The redirect covers every type of communication that could reveal what you received:
- Bills and payment collection attempts
- Explanation of benefits notices
- Adverse benefit determinations, meaning claim denials
- Requests for additional claim information
- Contested claim notices
- Provider names, addresses, and service descriptions
The insurer also cannot require you to get the policyholder’s authorization before receiving sensitive services or submitting a claim for them, as long as you have the right to consent to the care.2California Legislative Information. California Insurance Code 791.29
How to Request Confidential Communications for All Your Care
Sensitive services are protected automatically, but you can go further. A confidential communications request tells your health plan to send any medical communication to an alternative address, email, or phone number that you choose. This right existed in a narrower form before AB 1184, and the law expanded it in one critical way: plans must honor the request regardless of the reason. You no longer have to say that disclosure would endanger you.3California Legislative Information. California AB 1184 – Medical Information Confidentiality
To submit a request, contact your health plan or insurer using the member services number on your insurance card and ask for their confidential communications request process. Most plans have a dedicated form, and some accept the request through their online member portal. Provide the alternative contact information where you want communications sent, and make sure it is a mailing address, email, or phone number that only you can access. The plan can require the request in writing or electronically, so be ready to follow up with documentation if you start by phone.2California Legislative Information. California Insurance Code 791.29
Timing matters. A confidential communications request applies going forward. It will not retroactively cover a visit on the day you submit it. If you have an appointment coming up for care you want kept private, file the request first. Once in place, the request stays in effect until you revoke it or submit a new one.
If you don’t designate an alternative address, the plan sends communications in your name to the address already on file, which keeps your information out of correspondence directed to the policyholder.
When AB 1184 May Not Fully Apply
The law binds health care service plans regulated under the Knox-Keene Act, which covers most HMOs and managed care plans in California, along with health insurers regulated under the California Insurance Code.1California Legislative Information. California AB 1184 – Medical Information Confidentiality The same obligations apply whether your coverage is through an HMO or a traditional insurance policy.
Self-funded employer plans are the significant exception. Those plans are governed primarily by federal ERISA law and may not be subject to all California insurance regulations. If your employer self-funds its health plan instead of buying coverage from an insurer, AB 1184’s protections may not apply in full. You would still have HIPAA’s confidential communications protections, but HIPAA requires the accommodation only when you state that disclosure could endanger you, and it does not include the automatic sensitive services rule. If you are not sure how your employer’s plan is structured, ask the benefits administrator whether the plan is fully insured or self-funded.
What to Do If a Plan Discloses Your Information Anyway
If a health plan or insurer violates the CMIA’s confidentiality requirements, you can sue. Under Civil Code Section 56.36, you can recover nominal damages of $1,000 per violation without having to prove any actual harm, plus actual damages if you can document financial or personal injury from the disclosure.4California Legislative Information. California Civil Code 56.36 – Violations
Section 56.35 provides a separate remedy when the violation caused economic loss or personal injury. You can recover compensatory damages, punitive damages up to $3,000, attorney’s fees up to $1,000, and litigation costs.5California Legislative Information. California Civil Code 56.35 Regulators can also impose administrative fines on the plan or insurer separately from anything you recover in a lawsuit.
Before filing suit, keep records. Save the envelope or the electronic notice that went to the wrong person, note the date, and write down what the communication revealed. If you had a confidential communications request on file when the disclosure happened, keep a copy of that request as well. Documentation is what turns a privacy violation into a provable claim.