AB 82 amends California law to broaden privacy and criminal protections tied to what the bill calls "legally protected health care activity." Key changes: it expands the Secretary of State’s address confidentiality program to explicitly cover gender‑affirming health care providers, employees, volunteers, and patients; it extends criminal prohibitions and civil remedies that originally targeted doxxing of reproductive‑health participants to those involved in gender‑affirming care; and it carves testosterone and mifepristone prescriptions out of the state’s prescription drug monitoring program (CURES), including a mandate to purge older records.
The bill also rewrites multiple enforcement and judicial provisions to prevent California state or local agencies, courts, and service providers from aiding out‑of‑state investigations or subpoenas seeking to impose liability for legally protected health care activities performed in California, creates a $15,000 civil penalty for false affidavits in such out‑of‑state requests, and requires zero-dollar bail in county schedules for people arrested out of state over those activities. These changes create new compliance duties for state and local agencies, health care entities, pharmacies, and online platforms—and they tighten the firewall between California data, courts, and out‑of‑state enforcement efforts.
At a Glance
What It Does
The bill expands the state address confidentiality program to include gender‑affirming health care participants; makes it a crime to post, sell, or trade personal information or images of those participants online with intent to incite or threaten violence and creates private civil remedies; exempts testosterone and mifepristone prescriptions from reporting into CURES and requires removal of older records; and bars California agencies and courts from assisting out‑of‑state enforcement targeting legally protected health care activity.
Who It Affects
Gender‑affirming and reproductive health care providers, employees, volunteers, and patients; pharmacies and dispensers that report to CURES; the Department of Justice (CURES) and the Secretary of State (address program); county superior courts and bail schedulers; online platforms and California‑based communication service providers facing out‑of‑state process.
Why It Matters
AB 82 reshapes privacy and enforcement boundaries for sensitive health care: it protects people involved in gender‑affirming care from doxxing and cross‑border legal exposure, while reducing certain data flows into the state PDMP—changes that have immediate operational, public‑health, and intergovernmental consequences for compliance, data sharing, and investigations.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
AB 82 packages several discrete but related protections around what it calls legally protected health care activity. First, it expands an existing Secretary of State address confidentiality program—previously focused on reproductive health care—to cover gender‑affirming health care providers, employees, volunteers, and patients who face threats because of their affiliation with a gender‑affirming services facility.
Applicants must apply in person through a community‑based assistance program, provide documentation of affiliation and recent threats or restraining orders, designate the Secretary of State as agent for service, and, if approved, may use the Secretary of State’s designated address in lieu of their home address for public‑record responses.
Second, the bill strengthens online‑harms law by folding gender‑affirming participants into California’s anti‑doxxing framework. It makes it unlawful to publicly post, display, sell, or trade the personal information or images of covered persons on websites or social media with the intent to incite imminent violence or place them in reasonable fear.
Violations carry civil remedies (injunctive relief, attorney fees, and statutory damages: up to treble actual damages but at least $4,000) and criminal penalties—fines up to $10,000 per posting, possible jail time, and a felony tier (up to $50,000 fine) if the posting causes bodily injury.Third, AB 82 alters the state’s Controlled Substances Utilization Review and Evaluation System (CURES). The bill bars reporting of prescriptions for testosterone and mifepristone to the Department of Justice, CURES, or its contractors, and directs DOJ to remove records created before January 1, 2026, by January 1, 2027.
The statute also prohibits California agencies and employees from knowingly providing CURES data or other resources in furtherance of interstate investigations that seek to impose civil, criminal, or professional liability for legally protected health care activities, while preserving the state’s ability to investigate crimes under California law.Finally, the measure rewrites several enforcement‑oriented provisions to insulate California actors and data from out‑of‑state legal processes. It redefines "prohibited violation" for wiretap and surveillance limits to include investigations into legally protected health care activities; requires county bail schedules to set $0 bail for persons arrested out of state over such activities if the activity is lawful in California; forbids California law enforcement, courts, and state actors from cooperating with out‑of‑state investigations into legally protected care; and authorizes the Attorney General to sue and impose a $15,000 civil penalty on anyone who submits a false affidavit claiming an out‑of‑state request is not related to such protected activity.
Together, these provisions create new operational responsibilities for state and local agencies, health facilities, pharmacies, and online service providers while narrowing cross‑border data and legal cooperation.
The Five Things You Need to Know
The Secretary of State’s address confidentiality program now explicitly covers "gender‑affirming health care" providers, employees, volunteers, and patients who show documentation of affiliation and threats; applications must be filed in person at a designated community‑based assistance program.
The law criminalizes online posting, display, solicitation, sale, or trade of personal information or images of covered health‑care participants with intent to incite imminent violence or place them in reasonable fear—civil plaintiffs may recover attorney fees and damages up to triple actual damages (minimum $4,000).
AB 82 bars reporting of prescriptions for testosterone and mifepristone to CURES or its contractors and requires the Department of Justice to remove existing records created before January 1, 2026, by January 1, 2027.
The bill requires county bail schedules to set $0 bail for people arrested in another state over conduct related to legally protected health care activity in California when that activity is lawful here, and it prohibits California law enforcement and public agencies from cooperating with out‑of‑state investigations seeking to impose liability for those activities.
Submitting a false affidavit to justify out‑of‑state subpoenas or process that could relate to legally protected health care activity triggers a civil action by the California Attorney General and a $15,000 civil penalty (in addition to other remedies).
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Expand address confidentiality to gender‑affirming care and application mechanics
These amendments add gender‑affirming health care providers, employees, volunteers, and patients to the Secretary of State’s address confidentiality program. The bill specifies definitions (facility, provider, patient), requires in‑person applications through designated community programs, and preserves procedural safeguards: proof of affiliation, certification or restraining orders showing threats within one year, counselor orientation, designation of the Secretary of State as agent for service of process, and fee waivers for patients. Practically, agencies that respond to public records requests must accept the designated address and the Secretary of State must forward legal process to participants within three days.
Anti‑doxxing rules and civil/criminal remedies for covered health participants
These sections extend existing anti‑doxxing prohibitions to include gender‑affirming participants and codify civil cause of action and criminal penalties. A private plaintiff can seek injunctive relief and recover attorney’s fees; statutory damages are available up to treble actual damages but not less than $4,000. Criminal penalties include fines up to $10,000 per violation and potential imprisonment; an aggravated felony tier applies if the posting results in bodily injury (up to $50,000 fine). The law also narrows Section 230 liability, making interactive computer services nonliable only if they do not intend to abet likely bodily harm.
CURES: carve‑outs for testosterone and mifepristone and limits on interstate use
AB 82 creates a categorical exception in the CURES reporting regime: prescriptions for testosterone and mifepristone must not be reported to the Department of Justice, CURES, or contractors. The DOJ must purge records created before Jan 1, 2026, by Jan 1, 2027. The bill also forbids state or local agencies and employees from knowingly providing CURES data or resources for interstate investigations that seek to impose liability for legally protected health care activity, while preserving California’s authority to investigate crimes under state law. Departments must adopt or amend CURES rules and consult stakeholders about access and interstate sharing in light of the new limits.
Prescriber recordkeeping and reporting carve outs
The prescriber‑level recordkeeping rules remain in place for Schedule II–IV drugs, but the CURES carve‑outs for testosterone and mifepristone alter which prescriptions are forwarded to DOJ. Prescribers who dispense controlled substances must keep the statutorily required patient and dispensing details; however, the bill removes those two drugs from the data stream to the PDMP, affecting prescribers who rely on CURES for clinical decision support and pharmacies that transmit reports.
Surveillance warrants and "prohibited violation" definition
The wiretap/pen‑register statutory language is amended so that a "prohibited violation" now includes investigations into providing, facilitating, or obtaining legally protected health care activity that is lawful in California. The practical effect: courts should refuse orders—wiretap, electronic surveillance, or similar—sought for the purpose of investigating out‑of‑state attempts to punish legally protected care in California, narrowing permissible uses of electronic surveillance in cross‑border matters.
Bail schedules: $0 bail for certain out‑of‑state arrests
Judges preparing countywide bail schedules must list offenses and dollar amounts; the statute now mandates a $0 bail setting for people arrested in connection with out‑of‑state proceedings that target individuals for performing, aiding, or obtaining legally protected health care activity in California when that activity is lawful here. County courts must incorporate this zero‑bail rule into their uniform schedules and communicate the schedule to jails and judicial officers.
Prohibition on cross‑state cooperation and false‑affidavit enforcement
These provisions bar California law enforcement, public agencies, court officers, and contracted entities from knowingly arresting, cooperating with, or providing information to out‑of‑state agents seeking to impose civil or criminal liability for legally protected health care activity lawful in California. They also require an affidavit for any out‑of‑state legal process attesting that the request is not related to such activity; a false affidavit exposes the submitter to an AG civil action and a $15,000 penalty. The statute also restricts California corporations that provide electronic communication services from complying with out‑of‑state process absent that affidavit.
This bill is one of many.
Codify tracks hundreds of bills on Healthcare across all five countries.
Explore Healthcare in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Gender‑affirming health care providers, employees, volunteers, and patients — gain explicit inclusion in the Secretary of State’s address confidentiality program and the anti‑doxxing protections, reducing exposure to doxxing, harassment, and targeted violence.
- Reproductive health care participants and clinics — receive parity of protections already available to them (address confidentiality and anti‑doxxing remedies) and reinforce existing statutory shields against out‑of‑state enforcement.
- Persons receiving testosterone or mifepristone (including many transgender patients and patients prescribed mifepristone for reproductive care) — their prescriptions are removed from the PDMP reporting stream, which reduces the presence of these records in law enforcement and interstate data sharing systems.
- State and local public employees and court officers — obtain clear statutory direction to refuse cooperation with out‑of‑state investigations or subpoenas that target legally protected health care activity, reducing legal risk in cross‑jurisdictional requests.
Who Bears the Cost
- Department of Justice (CURES) and contracting vendors — must modify reporting rules and systems, remove pre‑2026 records by a statutory deadline, and implement access restrictions and new auditing protocols, producing technical and administrative costs.
- Pharmacies, clinics, and prescribers — must alter reporting practices to exclude testosterone and mifepristone, update dispensing workflows and software to ensure nonreporting, and face transitional compliance burdens.
- County courts and superior court judges — must revise uniform countywide bail schedules to implement the $0 bail requirement, with administrative time and notice responsibilities to jails and clerks.
- Online platforms and California corporations providing communication services — face expanded civil exposure for doxxing content and new procedural hurdles when responding to out‑of‑state process requests absent the required affidavit, increasing legal and compliance costs.
- Local agencies and public employees — bear the operational burden of implementing the statutory non‑cooperation rules and responding to AG inquiries or potential litigation when evaluating out‑of‑state process.
Key Issues
The Core Tension
The bill resolves a core conflict between protecting the safety and privacy of people involved in sensitive, lawful health care and preserving the investigative and public‑health value of state data and law enforcement cooperation: tightening privacy and non‑cooperation reduces risks of harassment and cross‑border prosecution, but it also narrows data visibility and impedes some lawful investigatory uses—forcing trade‑offs between individual security and collective surveillance/ enforcement goals.
AB 82 advances privacy and safety aims but raises several implementation and policy trade‑offs. First, carving testosterone and mifepristone out of CURES weakens the PDMP’s completeness for prescriber and dispenser surveillance: clinicians and public health analysts will have reduced visibility into prescribing patterns for a class of patients (including many transgender patients) and for mifepristone, a commonly used medication in reproductive care.
The statutory directive to purge prior records by a fixed date poses logistical questions about indexing, backups, interstate copies, and audit trails; DOJ will need clear rules and funding to complete the purge without compromising other investigatory obligations.
Second, the anti‑doxxing and non‑cooperation provisions hinge on intent, attribution, and the content‑platform interface. Proving that an online actor had the specific intent to incite imminent violence or that a platform "intended to abet" bodily harm will be fact‑intensive; platforms may respond by over‑removing content or by raising Section 230 defenses, producing friction and potential First Amendment challenges.
Likewise, the bill’s prohibition on interstate cooperation sweeps broadly: it protects people from out‑of‑state enforcement but may complicate legitimate cross‑border criminal investigations that touch on legally protected care, requiring robust legal tests to separate lawful California investigations from prohibited assistance.
Third, the tension between protecting individuals and preserving law enforcement tools is unresolved. The bill preserves California’s ability to investigate crimes but blocks sharing of CURES data or cooperation when the underlying interest is an out‑of‑state effort to punish legally protected activity.
That line will be contested in cases where an out‑of‑state subpoena claims nexus to a separate, concurrent crime; courts and agencies will need to develop standards for evaluating affidavits and for when disclosure is justified. Finally, the statutory $15,000 penalty for false affidavits creates a deterrent but may not fully deter sophisticated attempts to evade disclosure through intermediaries, and the AG’s enforcement resources will determine how effectively that deterrent functions.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.