Preserving Clinician Judgment in the Age of AI: What California’s New Laws Mean for Healthcare Compliance and Workflows

Artificial intelligence (AI) tools are rapidly transforming clinical workflows, from AI ambient scribes drafting medical notes to predictive algorithms flagging sepsis risks or suggesting treatment plans. However, as healthcare organizations adopt these technologies, a fundamental question emerges: where does machine automation end and professional clinical judgment begin?

On September 30, 2026, California Governor Gavin Newsom signed landmark legislation—Assembly Bill (AB) 1979 (authored by Assemblymember Mia Bonta) and Senate Bill (SB) 503 (authored by State Senator Akilah Weber Pierson)—establishing explicit safeguards for independent clinician judgment and setting new rules for AI governance in healthcare, effective January 1, 2027. At the same time, Governor Newsom vetoed AB 2575, a companion bill that aimed to prohibit employer retaliation against workers who override AI recommendations.

Together, these legislative developments signal a critical shift for healthcare executives, compliance officers, and medical practice managers. They reinforce that human clinicians remain the ultimate deciders and lightning rods for patient care, while creating strict new compliance mandates around algorithmic bias, EHR integration, and workflow oversight.

The New Regulatory Baseline: AB 1979 and SB 503

California’s new legal framework places clear boundaries on how artificial intelligence can be used across healthcare facilities, clinics, and physician offices:

• Preserving Human Judgment (AB 1979): Requires healthcare facilities, clinics, and physician offices to take reasonable steps ensuring licensed providers can exercise independent professional judgment when clinical decision support (CDS) systems guide patient care.

• Banning Autonomous AI Clinical Work (AB 1979): Explicitly prohibits using AI tools to independently perform clinical functions reserved by state law for licensed professionals, or using AI to direct or instruct unlicensed personnel (such as medical assistants) in performing licensed tasks.

• Expanding Chatbot Privacy (AB 1979): Extends California’s Confidentiality of Medical Information Act (CMIA) to direct-to-consumer health chatbots and symptom checkers, treating them under strict medical record privacy rules.

• Mitigating Algorithmic Bias (SB 503): Mandates that developers of clinical decision support systems take reasonable steps to identify and reduce known or predictable algorithmic bias based on protected characteristics. Furthermore, deploying healthcare organizations must conduct regular monitoring and mitigation of biased outputs.

While administrative automations—such as AI ambient scribes that draft notes for physician review or automated prescription refill reminders—remain permitted, any clinical choice informed by AI must involve human oversight and explicit sign-off by a licensed provider.

Key Warning Signs & Compliance Gaps

Healthcare organizations preparing for these regulations should watch out for several operational and technical vulnerabilities:

1. Unchecked Triage or Automated Tasking: Using AI software to automatically assign tasks or guide unlicensed staff without direct human clinician oversight.

2. "Black Box" AI Implementations: Deploying clinical decision software without clear developer disclosures regarding training data limitations, intended clinical uses, and known risks of bias.

3. Reliance on Default EHR Overrides: Allowing clinicians to dismiss or override AI alerts using generic dropdown selections (e.g., "Not applicable") without logging specific clinical rationale.

4. Unmonitored Algorithmic Bias: Failing to audit clinical decision tools to ensure predictions do not create disparate impacts across diverse patient populations.

Malpractice and Operational Impact: The Human Remains the Decider

The veto of AB 2575 leaves traditional medical malpractice standards firmly in place. When a clinician overrides an AI recommendation and a negative outcome occurs, legal liability rests on whether the provider's choice met the standard of care that a reasonable human physician would provide under similar circumstances. The AI recommendation is treated merely as diagnostic data—not a legally binding standard.

However, because the shield proposed under AB 2575 was vetoed, software developers may still attempt to argue that a doctor’s independent judgment breaks the chain of causation if an AI error occurs. Consequently, clear and defensible clinical documentation inside the Electronic Health Record (EHR) is a provider's primary defense.

The 4-Step "A-B-C-D" Documentation Framework for AI Overrides

When overriding an AI prompt or decision support tool, clinicians should document their reasoning using a structured format:

• A – Acknowledge the AI Input: Note that the AI system generated an alert or score.

• B – Basis for Disagreement: Detail the specific clinical data or patient nuances the algorithm missed, misinterpreted, or weighted incorrectly.

• C – Corroboration by Human Evidence: Cite physical exam findings, real-time lab trends, or patient history verifying your decision.

• D – Defensive Plan & Monitoring: Outline your alternative care plan and safety monitoring instructions to demonstrate a deliberate, safe clinical choice.

Establishing a Compliance Baseline and Team Education

With state mandates like AB 1979 and SB 503 taking effect in 2027, healthcare organizations cannot rely on ad-hoc compliance. Creating a reliable organizational baseline and empowering team members requires structured tools and robust resources:

• Conducting a Security Risk Analysis (SRA): An SRA serves as the foundational baseline to inventory every AI tool, clinical decision support (CDS) system, and consumer chatbot integrated into your network. It identifies vulnerabilities, evaluates vendor documentation regarding bias and risk, and ensures data governance aligns with both HIPAA and expanded state privacy laws.

• Leveraging EPI Compliance Resources: Implementing ongoing compliance policies, tracking monthly tasks, and maintaining documentation can be complex. Utilizing the EPI Compliance platform and its comprehensive resources ensures your organization has continuous tools to manage regulatory workflows, update internal policies, and keep staff informed of evolving legal standards.

• Empowering Staff Through the Certified HIPAA Security Officer (CHSO) Program: Technology and legal requirements evolve rapidly. Enrolling compliance officers and clinical leaders in specialized training programs like the Certified HIPAA Security Officer (CHSO) course provides team members with a deep understanding of security frameworks, risk mitigation, and technical safeguards. This education equips internal champions to train the broader workforce, evaluate AI software vendors critically, and maintain continuous compliance oversight.

Practical Actions for Healthcare Leaders

To ensure compliance with evolving AI laws and maintain robust clinical risk governance, organizations should take the following steps:

1. Audit AI Workflows and EHR Integrations: Review all active software tools to confirm that AI functions only in an advisory capacity and never directs unlicensed staff or makes autonomous clinical choices.

2. Review Developer Disclosures: Require vendors of clinical decision support tools to supply standardized risk documentation, intended use disclosures, and bias mitigation data.

3. Update Clinical Policies and Training: Establish standardized protocols for documenting AI overrides in the medical record and train workforce members on proper EHR charting.

4. Establish Ongoing Bias Monitoring: Implement regular reviews of AI tools to evaluate performance equity and mitigate potential algorithmic bias.

5. Execute an SRA, Utilize Compliance Platforms, and Elevate Team Training: Establish your baseline security posture via a comprehensive HIPAA Security Risk Analysis, leverage EPI Compliance resources for ongoing task management, and upskill your personnel through advanced certification training.

How Taino Consultants and EPI Compliance Can Help

Navigating complex healthcare technologies requires strong governance, up-to-date policies, and comprehensive risk management. Taino Consultants assists healthcare facilities and practices in conducting thorough HIPAA Security Risk Analyses (SRA), establishing technical baselines, and updating clinical governance frameworks.

Additionally, through the EPI Compliance platform and our Certified HIPAA Security Officer (CHSO) program, we empower healthcare leaders and team members to master emerging technology risks, streamline regulatory workflows, and safeguard patient data confidence.

Contact Taino Consultants today to schedule your Security Risk Analysis and elevate your team's compliance expertise.

Disclaimer

This article provides general educational information and operational guidance. It does not constitute formal legal advice or binding regulatory counsel. For specific legal questions regarding state or federal healthcare legislation, consult a qualified attorney.