AB 1879 directs the Department of Health Care Services to collect year‑end, individualized records (with no personally identifiable information) from licensed alcohol and drug treatment facilities, certified programs, and recovery residences, and to publish an aggregated annual report on its website. The bill lists three required data elements — number of individuals served or residing, whether they had prior service/residence in that category, and duration of treatment or residence.
This creates a standing statewide data feed that can inform capacity planning, quality oversight, and funding decisions. At the same time, the bill leaves key implementation details — data format, submission method, enforcement, and funding — to be resolved and explicitly requires compliance with federal and state privacy laws, which will shape how DHCS and providers operationalize the mandate.
At a Glance
What It Does
The bill requires covered entities to submit individualized records (without PII) annually to DHCS and requires DHCS to publish those inputs in aggregated form as an annual report. It covers three narrow data points per individual: count, prior treatment/residence status, and length of stay.
Who It Affects
Licensed alcohol and other drug (AOD) treatment facilities, DHCS‑certified AOD programs, and recovery residences as defined in state law — including entities that historically have not been subject to licensing. DHCS must build or adapt intake, aggregation, and publication processes.
Why It Matters
If implemented well, the dataset can close visibility gaps in capacity, repeat treatment patterns, and average lengths of stay across sectors; if implemented poorly it risks uneven compliance, privacy exposure, and low‑utility aggregate reporting that fails to support operational decisions.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
AB 1879 adds a new reporting chapter to the Health and Safety Code that applies to three categories of substance use service providers in California: licensed treatment facilities, certified programs, and recovery residences as defined elsewhere in state law. Instead of a broad roster of clinical metrics, the bill narrowly prescribes three pieces of information for each person served during the calendar year: whether the person received services or resided at the entity; whether they had prior experience in that same category; and how long they stayed or received services.
The data must be submitted to DHCS in individualized records — meaning each person’s entry is submitted as a distinct row or record — but DHCS is required to strip any personally identifiable information before publishing an annual, aggregated report on its website. The statute insists that submissions and publication exclude PII and that implementation not conflict with federal or state privacy laws, creating a legal constraint that will influence the technical approach to de‑identification and data handling.The bill sets a clear start date for reporting but does not set out formats, secure submission channels, validation rules, enforcement mechanisms, or funding for compliance.
That omission pushes the practical questions — who will build intake systems, how DHCS will reconcile records across providers, what counts as prior treatment in a way that avoids double‑counting, and how small recovery residences will comply — into rulemaking or administrative planning. The result will be a mix of policy clarity (what to report) and operational ambiguity (how to report).Finally, because substance use treatment records are subject to heightened privacy regimes, implementing the law will require DHCS and providers to navigate HIPAA, 42 C.F.R.
Part 2, and California privacy law standards to ensure the individualized submissions are legally permissible and the published aggregates are not reasonably re‑identifiable. Those legal constraints will determine whether the bill produces a usable dataset or becomes a paper exercise with limited analytical value.
The Five Things You Need to Know
Reporting begins January 1, 2028 — entities must submit data covering each corresponding year starting that date.
The bill requires three specific data elements per individual: (1) number of individuals served or residing, (2) indicator of prior service/residence in that same category, and (3) duration of treatment or residential period.
Entities must submit data in individualized form to DHCS, but DHCS must publish only aggregated results on its website.
The statute requires that submitted and published data exclude personally identifiable information and be implemented consistent with federal and state privacy laws (e.g.
HIPAA and 42 C.F.R. Part 2 will be relevant to how data are de‑identified and shared).
AB 1879 does not specify technical formats, submission procedures, penalties for noncompliance, or dedicated funding — leaving those operational details to DHCS to resolve.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Scope: which entities must report
This subdivision identifies the three categories that must report: licensed alcohol or drug recovery or treatment facilities (Chapter 7.5), DHCS‑certified alcohol or drug programs (Chapter 7.1), and recovery residences as defined in state law (section 11833.05). The language is categorical rather than conditional, which brings recovery residences explicitly into the reporting universe even when those residences are not otherwise licensed — an important expansion of DHCS's data reach.
Annual individual‑level reporting requirements
This is the operative reporting mandate. It requires each covered entity, beginning with calendar year 2028, to submit annual, individualized records containing three items: counts of individuals served or residing, whether each individual had prior experience in that same category, and the duration of each individual's treatment or residence. The statute frames these as minimal, discrete fields, which narrows the initial reporting burden but invites questions about standardized definitions (for example, how to measure 'duration') and record reconciliation across providers.
DHCS collection and publication duties
DHCS must collect the individualized submissions and publish an annual aggregated report on its website. The bill requires individualized submission for collection but only aggregated publication, implying DHCS will hold more granular information than it releases publicly. That dual requirement affects DHCS's internal security, data governance, and analytic capabilities because it will need to store, aggregate, and potentially audit underlying records while ensuring published outputs cannot be traced back to individuals.
Privacy carveouts and legal compliance
This subdivision instructs that both submitted and published data exclude personally identifiable information and mandates implementation consistent with federal and state privacy laws. The clause delegates to DHCS the responsibility to design submission protocols that comply with HIPAA, 42 C.F.R. Part 2, and California privacy requirements. Practically, this will influence whether the department requires specific de‑identification techniques, limits the granularity of published aggregates, or seeks statutory or regulatory clarifications to reconcile competing confidentiality regimes.
This bill is one of many.
Codify tracks hundreds of bills on Healthcare across all five countries.
Explore Healthcare in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Department of Health Care Services — gains a continuous dataset that can support statewide capacity planning, trend analysis on repeat treatment, and automated aggregate reporting for policymakers.
- State policymakers and funders — receive standardized metrics to inform resource allocation, program evaluation, and decisions about where to expand services or target interventions.
- Public health researchers and analysts — obtain a new source of longitudinal, system‑level metrics (if DHCS provides sufficiently granular aggregates) to study treatment trajectories and average lengths of stay across sectors.
- Programs that track outcomes — larger outpatient programs and licensed facilities can benchmark volumes and lengths of stay against statewide aggregates to guide operational planning.
Who Bears the Cost
- Small recovery residences and unlicensed operators — may lack electronic records and administrative capacity to produce individualized annual submissions, creating an outsized compliance burden relative to their size.
- Licensed treatment providers and certified programs — will need to adapt recordkeeping, extract data in required formats, and dedicate staff time to annual submissions, producing a recurring administrative cost.
- DHCS — must build secure intake pipelines, aggregation tools, publication workflows, and compliance oversight processes without dedicated funding allocated in the text, increasing administrative responsibilities.
- Clients/residents — face potential privacy risks if de‑identification is insufficient or if small‑cell data in aggregates are insufficiently masked, which could chill disclosure or deter help‑seeking in some contexts.
- IT vendors and EHR/recordkeeping systems — will need to update products or create export functions to meet the new data fields and submission requirements, incurring development costs.
Key Issues
The Core Tension
The central dilemma is balancing the state's legitimate need for system‑level information about volumes, repeat treatment, and lengths of stay against the legal and practical imperative to protect highly sensitive substance use treatment information and avoid imposing burdens that impair service providers — particularly small recovery residences — from operating or reporting. Solving one side (better data) risks undermining the other (privacy and access) unless DHCS crafts carefully limited, well‑funded, and legally robust implementation.
The bill sets a narrow but consequential mandate: collect individualized, non‑PII records and publish aggregates. That narrowness creates three implementation stress points.
First, privacy law interaction is complex: substance use records often fall under 42 C.F.R. Part 2, which restricts redisclosure of substance use treatment information beyond HIPAA.
Declaring that submissions and publication exclude PII does not automatically resolve whether an individualized submission to a state agency is permitted without patient consent, nor whether aggregated outputs are legally protected from re‑identification risk. DHCS will need to define de‑identification standards and possibly seek legal pathway(s) for lawful collection.
Second, the bill omits operational details that determine data quality: it does not define data formats, unique identifiers, deduplication rules, the technical channel for secure submission, or sanctions for noncompliance. Those gaps mean the usefulness of the dataset will depend on follow‑on administrative rulemaking or guidance.
Without consistent definitions (for example, how to count prior episodes across different provider types), DHCS may receive inconsistent records that limit the validity of aggregate metrics.
Third, the bill extends obligations to recovery residences, some of which are informal or small, creating equity and access concerns. If the compliance cost falls on these operators without funding or technical assistance, the reporting mandate could discourage participation in formal referral networks or push activity underground.
At the same time, failing to include recovery residences would leave an important piece of the continuum unobserved. The statute chooses inclusion but does not fund the supports needed to make it practical.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.