California Makes Companies Tell the AG Before Handing Over Abortion Records

California Makes Companies Tell the AG Before Handing Over Abortion Records

Governor Newsom signed AB 1930 on September 26, 2026. Chapter 468, Statutes of 2026 adds Civil Code section 1798.309, which requires any business operating in California to notify the Attorney General at least seven business days before producing records in response to a subpoena about abortion or gender-affirming care.

Information last verified on September 27, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article addresses California Civil Code title 1.81.7 as amended and added by AB 1930. It does not address the federal HIPAA Privacy Rule, which operates separately, and it does not address whether another state's court will honor California's rule. For the federal framework on court process and protected health information, see our guide to HIPAA and subpoenas.

What Happened

AB 1930 passed the Senate 29 to 10 on August 26, 2026 and the Assembly concurred in Senate amendments 60 to 17 the following day. It was enrolled and presented to the Governor at 4 p.m. on September 4, 2026. The Legislature's bill history records both "Approved by the Governor." and "Chaptered by Secretary of State - Chapter 468, Statutes of 2026." on September 26, 2026.

The author is Assemblymember Rick Chavez Zbur, with Assemblymembers Harabedian, Schultz and Sharp-Collins as coauthors. The Governor's office announced the signing as part of a six-bill package, describing the privacy piece as "requiring healthcare providers and institutions to notify the California Attorney General (AG) when they receive a subpoena regarding protected healthcare activity, and authorizing the AG to respond and intervene."

The enacted text is broader than that description. Section 1798.309(a)(1)(A) reaches "a person or entity that is located, headquartered, incorporated, or otherwise conducting business in California," not only health care providers and institutions.

The seven-day clock

The operative sentence is long, and the length is the point:

"Notwithstanding any other law, a person or entity that is located, headquartered, incorporated, or otherwise conducting business in California and receives, is served with, or is subject to a subpoena, discovery request, or other request for information that is part of a legal process related to a civil, criminal, regulatory, or legislative investigation regarding abortion or gender-affirming health care services that are legally protected health care activities secured by the Constitution or laws of California shall provide notice to the Attorney General at least seven business days prior to producing records in response to the request unless a shorter response time is required by federal law or other federal obligation, including a contract, grant requirement, or Medicare condition of participation." Cal. Civ. Code 1798.309(a)(1)(A), as added by Stats. 2026, ch. 468

Four categories of proceeding trigger it: civil, criminal, regulatory and legislative. The last of those is unusual. A legislative investigation is not litigation, and a subpoena issued by an out-of-state legislative committee is now within the statute's reach if it concerns care that is legally protected in California.

The notice itself must include a copy of the request. The party giving notice "may redact any identifying or confidential information related to specific individuals, patients, or individual providers for confidentiality or as required by applicable state and federal law." The Attorney General learns that a demand exists and what it says, without necessarily learning who it is about.

Where federal law or another federal obligation, including a contract, grant requirement or Medicare condition of participation, requires a faster response, the notice must go out no later than contemporaneously with production, and the responding party must make best efforts to deliver on the required date.

The four off-switches

Paragraph (a)(2) removes the notice duty entirely if the request meets any of four conditions.

The first is that it "is ordered by a court of competent jurisdiction." The second is that it "is issued by a California state or local agency." The third is that it comes with an attestation verifying that the use or disclosure satisfies one of three listed conditions: that the information will not be used to investigate or impose liability on anyone for seeking, obtaining, providing or facilitating abortion or gender-affirming care lawful in California; that the request concerns activity unlawful under California civil or criminal law, identifying the California law; or that it concerns activity that is grounds for professional discipline in California, identifying the grounds.

The fourth is easy to miss and does a great deal of work. Paragraph (a)(2)(D) switches the duty off where "Information regarding abortion or gender-affirming health care services may be included in responsive records but is incidental to the civil, criminal, regulatory, or legislative investigation." A demand aimed at something else that happens to sweep in such records is outside the notice requirement altogether.

The attestation route is the workable path for a requester whose investigation genuinely is about this care, and the statute protects the person who relies on it. Paragraph (a)(5) provides that a person or entity subject to the section "is entitled to rely on the representations made in an attestation provided pursuant to subparagraph (C) of paragraph (2)."

What a violation costs

The reliance rule only functions if the attestation means something, so the act attaches a penalty. Under subdivision (c)(1), attaching a false attestation is punishable by a civil penalty of $15,000, the Attorney General may commence a civil action against a person or entity that does it, and the penalty "shall be in addition to any other penalties or remedies provided by law."

A second, separate enforcement track sits in subdivision (c)(2), and it reaches violations of the section generally rather than false attestations. The Attorney General "may commence an action to enforce the provisions of this section, including, but not limited to, an application or motion for an order enjoining ongoing or subsequent violations of this section." and may "seek all available legally and equitable remedies." A court may assess a statutory penalty of up to $10,000 for a first violation and up to $15,000 for each subsequent violation against anyone "found to have intentionally, knowingly, willingly, or recklessly violated this section." So a recipient who simply produces records without giving notice is exposed too, on an escalating scale, where the failure was more than inadvertent.

Any action the Attorney General brings must be commenced within six years of the date the Attorney General received the notice at issue. Where a court imposes a penalty authorized by the section, it must award the Attorney General court costs and attorney's fees.

The Attorney General is also given two affirmative powers. The office may make reasonable attempts to notify the individual who provided, sought, received, facilitated or otherwise engaged in the care at issue. And it may intervene in any civil action brought by a person or entity to resist compliance with the request.

What the Law Actually Says

AB 1930 is an amendment to an existing scheme, not a new one. Section 1 of the act amends Civil Code section 1798.300, the definitions section for title 1.81.7, California's shield-law title, and the definitions do most of the work.

"Legally protected health care activity" means the exercise or attempted exercise of rights to reproductive health care services, gender-affirming health care services or gender-affirming mental health care services "secured by the Constitution or laws of California," acts undertaken to aid or encourage a person in exercising those rights, the provision of those services by a person licensed in California, including where the service is lawful under California law "regardless of the patient's location," and a health care service plan's or health insurer's provision of a contract or policy covering such services and its coverage of and reimbursement for them. The definition carves out anything that "would be deemed unprofessional conduct or that would violate antidiscrimination laws of California."

The same section defines "abusive litigation" as litigation or other legal action brought "to deter, prevent, sanction, or punish a person engaging in legally protected health care activity," either by filing or prosecuting an action outside California whose liability theory rests, wholly or partly, directly or indirectly, on activity that was legal where it occurred, or by attempting to enforce an order or judgment from such an action. The punitive purpose is part of the definition, not just the liability theory. That definition predates AB 1930, and it explains the architecture around it.

California already prohibited providers, health care service plans, health insurers and contractors from releasing medical information about a person seeking or obtaining gender-affirming care, and already barred state and local agencies and their employees from cooperating with out-of-state or federal law enforcement regarding a legally protected health care activity. What California did not have was a rule reaching entities beyond the health-sector holders already named in its shield statutes, and no mechanism that put the Attorney General on notice in time to do anything.

AB 1930 supplies both. It does not forbid production. It inserts a delay, an informed state actor and a sworn statement.

The federal layer runs alongside. Under the HIPAA Privacy Rule a covered entity may disclose protected health information in response to a subpoena or discovery request on satisfying 45 C.F.R. 164.512(e), and a court order is its own authority. A federal court vacated most of the 2024 HIPAA reproductive health privacy rule, a development we covered in our report on the Purl decision, which is the backdrop against which states have been legislating. For how the federal rules on court process interact with state law generally, see when a subpoena reaches protected health information, and for California's own consumer-facing privacy regime, see our overview of California's data privacy statutes.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

Most state health-data shield laws work by prohibition. They tell a class of holders not to disclose a class of information to a class of requesters. Prohibitions are easy to draft and hard to operate, because the holder facing legal process has to decide, alone and under a deadline, whether the state statute or the out-of-state demand controls. Get it wrong one way and you are in contempt somewhere; get it wrong the other and you have violated California law.

AB 1930 takes a different route. It does not tell the recipient what to decide. It requires them to tell the Attorney General, wait seven business days, and then, if the Attorney General does nothing, produce. The decision about whether to fight is moved to a party that can actually fight, and the intervention power at the end of the section is the tell. This is a notification statute engineered to create standing and time, not a disclosure ban.

The attestation mechanism is the other structural choice worth noting. A requester who can truthfully say the information will not be used to impose liability for lawful California care, or who can identify the California law the conduct violates, bypasses the delay entirely and gets a clean production. The incidental-information carve-out in paragraph (a)(2)(D) narrows it further, taking out demands that are about something else and merely happen to catch such records. Together these aim the statute at out-of-state enforcement theories rather than at ordinary civil discovery, and they do so without asking the recipient to evaluate the requester's motives. The $15,000 false-attestation penalty and the express reliance rule are two halves of the same design: the recipient is safe because the requester is exposed. Subdivision (c)(2) then covers the other direction, with escalating penalties for a recipient who intentionally, knowingly, willingly or recklessly ignores the section.

Two features will bear watching. The first is reach. The statute applies to any entity "otherwise conducting business in California," which is a long arm for a duty that attaches on receipt of legal process anywhere. The second is the court-order carve-out. A request "ordered by a court of competent jurisdiction" skips the notice requirement, and whether an out-of-state court issuing process in an action premised on conduct lawful in California is a court of competent jurisdiction for this purpose is not answered in the text. That is the question this statute is most likely to be litigated over, and we take no position on how it will come out.

Finally, note what the statute does not do. It does not make the underlying records privileged, it does not void an out-of-state subpoena, and it does not protect a California entity from a contempt finding in another forum. It buys seven business days and a phone call to Sacramento.

How This Affects You

If you are a California patient, this changes nothing you do. The duty runs to entities that receive legal process, not to you. If a request about your care reaches a covered entity, the Attorney General may attempt to notify you, but the statute frames that as a power rather than an obligation.

If you operate a business in California that holds records touching reproductive or gender-affirming care, including entities that are not health care providers, the practical change from January 1, 2027 is a triage step. A subpoena in one of the four listed proceeding categories either carries a court order, comes from a California agency, carries a conforming attestation, reaches this material only incidentally, or triggers notice to the Attorney General and a seven-business-day hold. The seven-business-day clock runs from the notice, not from receipt: paragraph (a)(3) bars production "until at least seven business days after providing notice to the Attorney General." No court has construed this provision, which does not take effect until 2027.

None of this is advice about a particular subpoena. Whether a given request falls inside the statute, and how it interacts with a federal obligation or an order from another state's court, are questions for a lawyer licensed in California.

What Happens Next

The act is chaptered and needs no further legislative step. It takes effect January 1, 2027. The open questions are practical: whether the Attorney General publishes a notice channel or form, whether an attestation template emerges, and whether any out-of-state requester tests the court-order carve-out. We will update this article if the Attorney General issues guidance or if a court construes section 1798.309.

This is general legal information, not legal advice. It covers California Civil Code sections 1798.300 and 1798.309 as enacted by AB 1930 (Stats. 2026, ch. 468) and reflects sources verified on September 27, 2026. Laws change, the act does not take effect until January 1, 2027, and this story is developing. Consult a lawyer licensed in California about your specific situation.

Related articles

• When a subpoena can reach protected health information
• The federal reproductive health privacy rule a court threw out
• California's consumer data privacy framework
• Comparing state privacy laws side by side

---

Last updated: 2026-09-27. This is a developing story; details verified as of 2026-09-27.

Frequently Asked Questions

Is AB 1930 in effect now?

No. The Legislature's bill history shows it was approved by the Governor and chaptered as Chapter 468, Statutes of 2026 on September 26, 2026, but the act carries no urgency clause, so it takes effect January 1, 2027.

Who has to notify the California Attorney General under AB 1930?

Any person or entity that is located, headquartered, incorporated or otherwise conducting business in California and that receives, is served with or is subject to a subpoena, discovery request or other request for information that is part of a legal process related to a civil, criminal, regulatory or legislative investigation regarding abortion or gender-affirming health care services that are legally protected under California law. It is not limited to health care providers.

How long must a company wait before producing the records?

At least seven business days after giving notice to the Attorney General. If federal law or another federal obligation, including a contract, grant requirement or Medicare condition of participation, requires a shorter response time, notice must instead go out no later than contemporaneously with production and the responding party must make best efforts to deliver on the required date.

When does the notice requirement not apply?

In four situations. The request is ordered by a court of competent jurisdiction; it is issued by a California state or local agency; it is accompanied by an attestation meeting the statute's conditions, such as verifying that the information will not be used to investigate or impose liability on anyone for seeking, obtaining, providing or facilitating care that is lawful in California; or the abortion or gender-affirming care information may appear in the responsive records but is incidental to the investigation rather than its subject.

What happens to someone who files a false attestation?

Under subdivision (c)(1), attaching a false attestation is punishable by a civil penalty of $15,000, in addition to any other penalties or remedies provided by law. Separately, subdivision (c)(2) lets the Attorney General sue to enforce the section, including by seeking an injunction, and lets a court assess up to $10,000 for a first violation and up to $15,000 for each subsequent one against anyone who intentionally, knowingly, willingly or recklessly violated it. Any action must be commenced within six years of the date the Attorney General received the notice at issue, and the court must award the Attorney General costs and attorney's fees where it imposes a penalty.

Can the recipient rely on an attestation it receives?

Yes. Paragraph (a)(5) provides that a person or entity subject to the section is entitled to rely on the representations made in an attestation provided under subparagraph (C) of paragraph (2).

Does AB 1930 stop an out-of-state subpoena from being enforced?

No. The statute creates a notice requirement and a waiting period and gives the Attorney General power to intervene in a civil action brought to resist the request. It does not make the records privileged, does not void out-of-state process, and does not resolve what happens if another state's court orders production.

Does the Attorney General have to tell the patient?

The statute authorizes the Attorney General to make reasonable attempts to notify the individual who provided, sought, received, facilitated or otherwise engaged in the abortion or gender-affirming health care service at issue. It is framed as an authorization rather than a mandate.