CMIA vs HIPAA: The California Confidentiality of Medical Information Act for Health Apps

By Zaid Tirmizi, Technical Architecture and Costing Strategist at AppVerticals

The California Confidentiality of Medical Information Act (CMIA) protects medical information held by providers, health plans, their contractors and any business whose app is designed to maintain medical information, while HIPAA covers health plans, clearinghouses, providers that bill electronically and their business associates. That gap puts many consumer health apps under California law even when HIPAA does not touch them. If you are comparing app developers San Francisco health startups use, ask each one how they handle CMIA. In this guide I cover what the act protects, the CMIA vs HIPAA differences that change a build, which app types fall under each law, the penalties, the 30-day breach clock, how the CCPA fits and a checklist for your next release.

This guide explains how the law applies to app builds. Talk to a lawyer about your own case.

HIPAA follows your relationship with a provider. CMIA follows what your app is built to do, so a period tracker with no clinic behind it still answers to California. Zaid Tirmizi, Technical Architecture and Costing Strategist at AppVerticals

Key Takeaways

• HIPAA applies to health plans, clearinghouses, providers that bill electronically and their business associates, so a consumer health app that no covered entity hired sits outside it.
• CMIA reaches further: a business that offers software designed to maintain medical information is treated as a provider of health care under California Civil Code § 56.06.
• CMIA also covers mental health digital services and reproductive or sexual health digital services, and AB 1979, signed on September 30, 2026, adds health care chatbots from January 1, 2027.
• Patients can sue under CMIA for $1,000 in nominal damages without proving harm, and fines reach $2,500 per negligent violation, $25,000 per knowing and willful one and $250,000 when done for financial gain.
• Since January 1, 2026, California’s breach law gives you 30 calendar days to notify affected residents, and a sample notice goes to the Attorney General within 15 days when more than 500 residents are notified.
• The CCPA steps aside for medical information governed by CMIA or HIPAA, so account, device and marketing data in the same app still falls under it.

What the California Confidentiality of Medical Information Act covers

The California Confidentiality of Medical Information Act, Civil Code § 56 and the sections after it, controls how providers, health plans, contractors and businesses it treats as providers use and disclose a patient’s medical information.

Medical information under § 56.05 means individually identifiable information, in electronic or physical form, about a patient’s medical history, mental health or reproductive health app information, mental or physical condition or treatment. “Individually identifiable” means the record carries a name, address, email address, phone number or another detail that points to the person. A step count stored next to an email address meets that bar once it describes a medical condition.

The core rule sits in § 56.10: a covered business does not disclose medical information without the patient’s written authorization, apart from the exceptions the statute lists, such as treatment and billing. Section 56.11 sets the form of that authorization, including handwriting or a type size of at least 14 points, separation from other text on the page, a signature and a date, with electronic signatures allowed.

The Confidentiality of Medical Information Act dates to 1981, which makes it older than HIPAA. The act names four groups. Providers of health care and health plans hold the records. Contractors process them on their behalf. Section 56.06 adds businesses that it treats as providers, which is where most app teams land. SB 81, in force since September 20, 2025, added immigration status and place of birth to medical information when they are collected as part of a patient’s medical history. AB 2448, signed on September 27, 2026, requires businesses that store sensitive services data, such as abortion, contraception and gender-affirming care records, to switch on data segregation and access controls from January 1, 2027.

CMIA vs HIPAA: key differences for health apps

CMIA vs HIPAA comes down to scope: HIPAA follows the entity that handles the data, and CMIA follows the medical information itself, so the state law reaches more apps and gives patients a private right to sue.

The California medical information act and HIPAA overlap for a telehealth app built for a clinic, and that app answers to both. Where the two disagree, the stricter rule wins, so I design consent, logging and breach response to the CMIA standard from the first sprint.

When HIPAA applies to your app

HIPAA applies when a covered entity hires you to build or run the app, which makes your company a business associate with a signed business associate agreement (BAA).

A clinic’s patient portal, a payer’s member app and a remote monitoring tool that feeds a provider’s records all fit that pattern. The same goes for apps that pull charts through EHR integration services. An app a consumer picks and downloads to store their own data sits outside HIPAA when no covered entity directs it. HHS sets out these cases in its resources for health app developers, including its health app use scenarios.

When CMIA applies to your app

CMIA California rules apply to your app when it is designed to maintain medical information, offers mental health or reproductive health digital services or, from January 1, 2027, works as a health care chatbot.

Civil Code § 56.06 covers four routes in. Subsection (b) treats a business that offers software or hardware, including a mobile app, designed to maintain medical information as a provider of health care. Subsection (d) adds mental health digital services, and subsection (e) adds reproductive or sexual health digital services.

AB 1979, signed on September 30, 2026, brings businesses that offer a health care chatbot under § 56.06 from January 1, 2027. The law defines a chatbot as a generative AI system with a natural language interface, marketed to support health services, that uses health information to respond to a consumer. This matters for any team adding AI in medical diagnosis features. Contractors that process records for a provider fall under the act too, a common position for firms in healthcare software development.

CMIA penalties and enforcement

CMIA penalties stack per violation and per patient under Civil Code § 56.36, and the state law gives patients a direct right to sue.

Civil Code § 56.36 lets the Attorney General, district attorneys, county counsel, city attorneys and city prosecutors recover civil penalties in the name of the People. Licensed health professionals face a separate scale under the same section, starting at $2,500 for a first negligent violation.

HIPAA enforcement runs through the HHS Office for Civil Rights, and state attorneys general can sue on behalf of residents under the HITECH Act. HIPAA gives patients no private cause of action. HHS published its current penalty amounts in the Federal Register on January 28, 2026, and on October 21, 2026 it confirmed no further adjustment for 2026.

Breach notification for health apps in California

A breach of unencrypted medical information triggers a 30-calendar-day notice to every affected California resident under Civil Code § 1798.82, and HIPAA and the FTC each run their own clocks on top of it.

Civil Code § 1798.82 counts medical information and health insurance information as personal information when a name sits next to it and the data is unencrypted. Since January 1, 2026, SB 446 sets the 30-day deadline, counted from discovery, with a delay allowed for a law enforcement request or to establish the scope of the breach. When more than 500 California residents receive notice, a sample copy goes to the Attorney General within 15 calendar days of notifying them.

Health apps that fall outside HIPAA still answer to the FTC Health Breach Notification Rule. The FTC rule covers vendors of personal health records, including mobile apps and connected devices, and its civil penalty stands at $53,088 per violation for 2026 after the FTC announced no inflation adjustment this year.

How CMIA and HIPAA fit with the CCPA

The CCPA steps aside for medical information governed by CMIA and for protected health information under HIPAA, so the rest of the data in your app still falls under it.

The CCPA exemption in § 1798.145(c) covers the medical record, and the line stops there. Account details, device identifiers, marketing preferences and analytics events sit outside the exemption. I map each data field to one law in the data model so the privacy notice, deletion flow and consent screens match the law that governs that field.

CMIA checklist for health app builds

A CMIA-ready build maps every flow of medical information, gets written authorization before any disclosure and logs every access, and I scope these controls before the first sprint.

The same controls carry most of HIPAA compliant app development, so one design covers both laws.

• Map the data. Trace where medical information flows, including analytics SDKs and ad pixels, the way a healthcare data integration plan maps every source.
• Get written authorization. Build consent screens that meet the § 56.11 format before any disclosure.
• Limit access. Use role-based access control and an audit log for every read and write.
• Encrypt at rest and in transit. Encryption changes whether a breach triggers notice under § 1798.82.
• Sign the right contracts. Use a BAA when HIPAA applies and vendor contracts that block redisclosure.
• Plan for a breach. Write a 30-day response plan with notice templates ready.
• Segregate sensitive services data. Switch on the segregation and access controls AB 2448 requires for abortion, contraception and gender-affirming care records by January 1, 2027.
• Review your chatbot. Check any AI chat feature against AB 1979 before January 1, 2027.
• Publish a clear privacy notice. Name each data type, its purpose and its recipients.

CMIA in practice: access controls for a healthcare kiosk network

The controls CMIA expects, such as limited access windows, role-based permissions and audit trails, are the same ones we built for CPCG, a US firm whose remote representatives serve patients at kiosks in medical supply stores.

CPCG ran its sessions on spreadsheets and separate remote access tools, with no central log of who connected to which kiosk. We built a platform with schedule-based access, so a representative connects only during an assigned window, plus four role levels for representatives, store managers, organization admins and super admins. An audit module records every session for quality review. [APPROVAL NEEDED: route the CPCG name and details via the AppVerticals editor and confirm with Muhammad Arif before publishing]

The stack is React, Electron JS, Node.js, PostgreSQL and AWS, and the healthcare kiosk network now runs on one platform in place of five tools. I show this build as an example of the controls the act expects, and the project makes no claim of a compliance result.

Choosing app developers for a California health app

Choose a partner that has launched healthcare apps, can explain where HIPAA and CMIA apply to your product and builds audit logging and consent screens into the first release.

Ask for a past data flow map, a sample audit log and the consent screens from a live health app. A mobile app development company San Francisco teams trust will name the CMIA subsection that applies to your app before quoting a price. That is the bar our mobile app development San Francisco team sets for every health client.