HIPAA vs. AB 3030: What's the Difference?

Medical providers are well-versed in HIPAA (Health Insurance Portability and Accountability Act). It's the bedrock of patient privacy. But with the arrival of California's AB 3030, many are confused. Does HIPAA cover AI? Does AB 3030 replace HIPAA?

The short answer is: HIPAA protects the data. AB 3030 regulates the conversation.

HIPAA: The Container

HIPAA is concerned with the security and privacy of Protected Health Information (PHI). When you use an AI tool, HIPAA asks:

• Is the data encrypted in transit and at rest?
• Do you have a Business Associate Agreement (BAA) with the AI vendor?
• Who has access to the chat logs?

If your AI vendor trains their public model on your patient data without consent, that is a massive HIPAA violation.

AB 3030: The Content

AB 3030 doesn't care as much about encryption. It cares about truth and transparency. It targets Generative AI (like LLMs) that create new text. AB 3030 asks:

• Did the AI just make up a medical diagnosis?
• Does the patient know this text was written by a machine?
• Is there a human reviewing this advice?

Where They Overlap

The intersection occurs in patient trust. A breach of AB 3030 (e.g., an AI hallucinating a diagnosis) can lead to a patient complaint. That complaint triggers an audit. That audit reveals you didn't have a BAA with the vendor. Now you are facing penalties from both the California Medical Board (for AB 3030) and the Office for Civil Rights (for HIPAA).