California's AB 1930 adds a seven-business-day wait before companies answer protected health-data subpoenas

Most legal-response systems begin with a ticket and end with a database export, according to a dev.to write-up that walks through the new law ^[15]. That pipeline skips the questions AB 1930 turns on. A team has to establish who issued the demand, what investigation it supports, which records it seeks, whether an attestation came with it, and whether another binding deadline controls ^[11]. The label on the document does not settle any of them ^[11].

The duty attaches to the demand. As the write-up summarizes the statute, it is triggered when a covered entity is served with a subpoena, a discovery request or any other request tied to a civil, criminal, regulatory or legislative investigation into protected abortion or gender-affirming care ^[3]. It starts January 1, 2027, by the write-up's reading ^[6]. AB 1930 is a non-urgency statute from a regular session with no special effective-date provision, so the default rule in Article IV, Section 8 of the California Constitution sets the date ^[6]. The gap from signing is 97 days ^[17].

The write-up proposes an intake form with eight fields: who issued the demand, the jurisdiction, when it was served, when a response is due, what the investigation is for, which data categories and which individuals it concerns, and whether an attestation came with it ^[12]. The coverage and exemption decision sits before production is enabled ^[12]. In order, a demand moves like this:

1. Intake captures the eight fields and keeps the attestation document itself ^[12]. Its wording decides whether the exemption applies ^[8]. It may state that the information will not be used to investigate or impose liability for care lawful in California, or that the demand concerns conduct unlawful under identified California law ^[9]. 2. A coverage check confirms the company's California presence and the subject of the investigation ^[2][3]. 3. The exemption check runs against the four carve-outs ^[8]. 4. A covered demand goes to the Attorney General ^[3]. 5. Production stays locked for at least seven business days after notice ^[5]. 6. Records go out.

Step 5 cannot be a plain timer. If federal law or another federal obligation requires a faster response, notice may go to the Attorney General at the same time as production ^[10]. The company must then make best efforts to deliver on the date the federal obligation sets ^[10].

Without a federal clock, the hold runs longer than seven days. Seven business days always spans a weekend: the seventh business day after a Monday notice is nine calendar days out, and after a Friday notice it is eleven, before holidays ^[16].

None of this works without a data map ^[13], and the time to learn which analytics service logs search terms is before a subpoena arrives. The write-up lists what the map should cover: appointment details, messages, search activity, location signals, billing information, clinical records, referrals and support logs, plus copies held by processors, cloud vendors and analytics services ^[13].

For a small team, I think the gate belongs on the export permission. No production job runs until the ticket's coverage state resolves. The federal case becomes a named, logged override, so the record shows why notice and production went out together ^[10].