Legally protected health care activity.

Senator Wiener frames this measure as a constitutional shield for Californians seeking gender-affirming health care, pairing that privacy emphasis with tighter governance of the state’s prescription monitoring data. The authors contend that residents and visitors, especially transgender and gender-nonconforming people, face targeted harassment and harm, and they seek to protect against in-state and out-of-state actions that would impede access to gender-affirming care or related mental health care. The bill is drafted as an urgency statute with immediate effect, while also laying out a staged implementation path tied to another measure’s timing.

Key changes focus on two interrelated domains. First, the Civil Code and related criminal-process provisions broaden protections around gender-affirming care information, prohibiting release in response to foreign subpoenas or civil/criminal actions issued under another state’s laws that interfere with access to gender-affirming care. The amendments define gender-affirming care consistent with existing Welfare and Institutions Code definitions and extend protections to information requests from out-of-state or federal bodies that would identify a person seeking or receiving such care. They also preserve compliance with California investigations that address activities punishable as crimes under state law and maintain processes for licensure, accreditation, and certification audits. In addition, the Penal Code provisions align criminal subpoena procedures with the civil protections, extending similar prohibitions to foreign subpoenas in criminal contexts.

Second, the bill intensifies governance and cross-border controls around California’s Controlled Substances Utilization Review and Evaluation System (CURES), the state’s PDMP. It restricts disclosure or data-sharing to a narrow set of purposes and requires rigorous privacy and security safeguards, with data sharing limited to appropriately vetted public agencies, research entities under strict privacy protections, and UC for approved research. The measure prohibits providing CURES data to out-of-state law enforcement for purposes based on another state’s laws, unless a warrant, subpoena, or court order is obtained, and it creates misdemeanor penalties for unauthorized access or improper dissemination by authorized users. The bill also requires a detailed data-submission regime for every Schedule II–V prescription and sets up a regulatory framework—through the Department of Justice—to govern access, purposes, and enforcement, including a process for patient-facing access to their own CURES records. It contemplates interstate data-sharing arrangements only under valid agreements that ensure California privacy, audit, and data-security standards, and it conditions such sharing on final regulations and compliance with California law. The bill includes mechanisms for ongoing funding, annual reporting of funding sources, and stakeholder-driven rulemaking, with a parallel set of provisions that would operate if paired with AB 82, creating a staged implementation timeline.

The bill’s architecture also specifies sequencing and operative conditions. While it asserts immediate effect for its urgency provisions, a notable provision structures the more expansive CURES interoperability and interstate-sharing elements through a layered timetable contingent on the enactment and timing of AB 82. This sequencing means some of the most far-reaching changes could be activated only after the companion measure’s regulatory and statutory conditions are satisfied. The measure preserves general severability and clarifies no reimbursement is mandated for local entities, while signaling local-program cost considerations and enforcement responsibilities for new penalties and governance obligations.

In sum, the proposal advances a dual policy objective: fortifying California’s privacy defenses for gender-affirming health care against cross-border legal actions, and tightening the governance, access controls, and enforcement around CURES to curb improper interstate data use. It positions the Department of Justice as the central regulator for PDMP changes, sets forth data-reporting requirements and patient-privacy protections, and imposes criminal penalties for unauthorized data access or sharing. Together with the urgency clause and the interdependent sequencing with AB 82, the measure seeks to align cross-border legal processes with California’s privacy and health-care governance framework while shaping how PDMP data can be shared or accessed across state lines.