General acute care hospitals: patient directories.

As proposed by Assembly Member Carrillo, the measure would require general acute care hospitals to inform patients or their representatives about the right to restrict or prohibit the use or disclosure of protected health information in the hospital’s patient directory, to be delivered at admission or as soon as reasonably possible in cases of incapacity or an emergency. The notice would be provided through either a separate acknowledgment document or a verbal briefing by hospital staff, and must be accessible in the top five non-English languages spoken in the hospital’s service area.

The bill defines “patient’s representative” as a person legally authorized to make medical decisions for the patient, and it requires the acknowledgment document to include an explicit notice of privacy practices and information about the hospital’s directory and the protected health information it may contain. The separate document would include a checkbox allowing the patient or representative to restrict or prohibit directory use or disclosure, while the alternative verbal notice would convey the same rights. Information must be available in the top five languages used in the service area.

The operative date is July 1, 2026. Violations would be defined as a crime, and the measure is described as creating a state-mandated local program. The act includes a no-reimbursement provision for costs borne by local agencies or school districts, and the bill references federal privacy provisions and existing California confidentiality law to situate the new requirement within established privacy frameworks.

Implementation considerations include potential administrative changes to admission workflows, translation and documentation costs, and staff training to ensure compliant delivery and recording of notices. The policy interacts with existing protections around patient identifiers and directory disclosures, aiming to clarify rights within hospital directories without altering federal privacy rights. Stakeholders include hospitals, patients and their representatives, and clinical staff, with responsibilities ranging from workflow updates and multilingual access to documentation and verification of notice.