SB 679 adds Section 805.3 to the Business and Professions Code and requires health care facilities and peer review bodies to submit an annual report on physicians and medical residents who were terminated and on staff-privilege actions (applications completed, grants, suspensions, revocations). Reports must include counts and race- and gender‑stratified breakdowns for the prior calendar year and be sent to the Civil Rights Department and the Medical Board of California.
The Civil Rights Department must publish the submitted information by September 1 each year in an aggregated, deidentified form that omits facility names and personally identifiable information. The bill also makes the raw submissions confidential and exempt from public records disclosure, and it includes legislative findings explaining the limited public‑access restriction under the California Constitution.
The requirement raises practical questions about data collection, privacy safeguards, small‑cell suppression, and the administrative burden on facilities and peer review bodies.
At a Glance
What It Does
The bill requires annual reporting by March 1 of counts for physician and resident terminations and staff‑privilege steps (applications completed, privileges granted, suspended, or revoked), plus percentages and counts stratified by race and gender. The Civil Rights Department must publish aggregated, deidentified summaries by September 1.
Who It Affects
Licensed health care facilities and peer review bodies (they must prepare and submit the reports), the Civil Rights Department and Medical Board of California (they receive and use the data), and physicians and medical residents whose employment or privileges are the subject of those actions.
Why It Matters
This creates a new, statewide, disaggregated data stream on credentialing and adverse employment outcomes in health care — material for regulators, researchers, and equity reviews — while also spelling out privacy limits on public access to the underlying submissions.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
SB 679 directs each health care facility or peer review body to compile and submit a single annual report, by March 1, covering the prior calendar year. The report must include counts of physicians and surgeons and of medical residents who were terminated, the number of physicians who completed applications for staff privileges, and counts of physicians who were granted privileges, had privileges suspended, or had privileges revoked.
For those categories the report must also show the percentage who identified their race or gender and provide counts stratified by race and gender.
The bill requires submission of that data to two state recipients: the Civil Rights Department and the Medical Board of California. It expressly permits a facility or peer review body to bundle all required items into a single report, which is intended to reduce duplication between entities that play overlapping roles in credentialing and disciplinary processes.Once the Civil Rights Department receives the reports, SB 679 obliges the department to publish the information publicly by September 1 each year.
The statute requires the published dataset to be aggregated and deidentified, to omit facility names, and to remove personally identifiable information. At the same time, the bill makes the underlying submissions confidential and not subject to disclosure under the California Public Records Act, except for the aggregated, deidentified output the department posts.Implementation will require facilities to map existing HR, credentialing, and peer review records into the bill’s specific categories, capture self‑identified race and gender data consistently, and apply suppression or other deidentification techniques before publication.
The bill is silent about enforcement mechanisms for missed or inaccurate reports, and it contains drafting inconsistencies in numbering that would need to be resolved in rulemaking or subsequent amendments.
The Five Things You Need to Know
The statute (Section 805.3) requires facilities or peer review bodies to submit the report on or before March 1 each year and to cover the prior calendar year.
Required data elements include counts of terminated physicians and medical residents; counts of physicians who completed applications for staff privileges; and counts of physicians granted privileges, suspended, or revoked.
For those categories the report must state the percentage who identified their race or gender and provide counts stratified by race and gender (separate entries for physicians and for medical residents where specified).
Submissions go to both the Civil Rights Department and the Medical Board of California, and the Civil Rights Department must publish aggregated, deidentified summaries by September 1 annually while keeping raw submissions confidential under an express CPRA exemption.
The bill adds Section 805.3 to the Business and Professions Code and includes legislative findings that the limited confidentiality carve‑out satisfies Article I, Section 3 of the California Constitution.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Annual data elements facilities and peer review bodies must report
This subsection lists the substantive data items a facility or peer review body must compile for the prior calendar year: counts of terminated physicians and medical residents; counts of physicians who completed privilege applications; counts of physicians granted privileges; counts of privileges revoked; counts of privileges suspended; percentages of persons in each category who self‑identified race/gender; and counts stratified by race and gender. Practically, this forces organizations to align HR and credentialing records and to capture or reconcile self‑identified demographic data for credentialing and adverse‑action events.
Single combined report permitted
This provision allows a health care facility or peer review body to submit a single consolidated report containing all required items instead of multiple filings. That flexibility reduces duplication where peer review bodies are aligned with facilities or where a single entity performs both administrative and peer review functions, but it also places responsibility for completeness on the submitting entity.
Public publication standard and timeline
The Civil Rights Department must publish the information on its website and make it publicly available on or before September 1 each year. The statute requires the published information to be aggregated and deidentified and to omit the names of health care facilities, which shapes how the department must process submissions and design public datasets (aggregation thresholds, cell suppression, or other disclosure‑avoidance techniques).
Confidentiality and CPRA exemption for submissions
Except for the aggregated deidentified output required for publication, the bill treats the submissions as confidential and not disclosable under the California Public Records Act. That creates a statutory confidentiality layer for raw reports, but it leaves open whether and how the Civil Rights Department may use identifiable submissions for investigations or share them with the Medical Board or other agencies under existing law.
Constitutional findings limiting public access
The Legislature declares that Section 805.3 limits public access to certain records and includes findings to satisfy the California Constitution’s requirement for statutes that restrict access to public records or meetings. The findings emphasize balancing transparency with privacy for individuals and facilities, a point that will guide judicial or administrative scrutiny if the confidentiality provisions are challenged.
This bill is one of many.
Codify tracks hundreds of bills on Healthcare across all five countries.
Explore Healthcare in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Civil Rights Department and Medical Board of California — They receive structured, statewide data that can inform oversight, identify patterns of disparate outcomes by race and gender, and support targeted reviews or policy responses.
- Researchers and health equity advocates — Aggregated, disaggregated data enables analysis of systemic trends in credentialing and terminations that were previously visible only in fragmented local records.
- Physicians and medical residents from underrepresented groups — Public aggregation of disaggregated outcomes creates potential for visibility into systemic disparities, which can support advocacy and programmatic remedies.
Who Bears the Cost
- Health care facilities (hospitals, clinics) — Facilities must extract, reconcile, and report specific credentialing and personnel data by calendar year, requiring staff time, possible EHR/HR system changes, and new data governance processes.
- Peer review bodies — Entities that run peer review panels must coordinate reporting while protecting the integrity of peer review processes and any legal privileges tied to those reviews.
- Civil Rights Department — The agency must receive, process, deidentify, aggregate, and publish the data, which will require technical resources, staffing, and policy work on disclosure‑avoidance methods.
- Physicians and residents — Even with deidentification, affected clinicians face potential reputational or privacy risks if small‑cell data are not properly suppressed or if the department’s deidentification methods are inadequate.
Key Issues
The Core Tension
The bill tries to reconcile two legitimate goals—public accountability on potential racial and gender disparities in credentialing and employment actions, and protection of individual and facility privacy—but it does so by sending identifiable reports to a state agency while only publishing deidentified aggregates, leaving open how to prevent reidentification, handle incomplete demographic data, and preserve peer review confidentiality without undermining transparency.
SB 679 packages more transparency into credentialing and termination outcomes, but it leaves several implementation knots untied. The statute requires the Civil Rights Department to publish aggregated, deidentified results but does not require submissions themselves to be deidentified; in practice that means the department will receive potentially identifiable data and must establish protocols for storage, access, and downstream use.
The bill is silent on enforcement: it contains no civil penalties, audit rights, or explicit administrative remedies for missed, late, or inaccurate reports, which raises questions about compliance incentives and data quality.
The statute's reliance on self‑identified race and gender also creates analytical limits: the bill asks for percentages “who identified their race or gender,” which can understate or skew disparities where demographic data are incomplete. Small facilities or rare event counts create reidentification risks unless the department adopts rigorous small‑cell suppression or other disclosure‑avoidance techniques.
Finally, the bill requires reporting from peer review bodies without addressing how existing peer review privileges, evidentiary protections, or confidentiality rules intersect with the new reporting duty — an unresolved legal tension for hospitals and lawyers defending peer review processes.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.