CA AB2688

Prohibits operators of commercial health monitoring programs from sharing, selling, or disclosing individually identifiable health monitoring information to third parties without providing clear notice and obtaining affirmative consumer consent.

Requires consent requests to be clear, conspicuous, and separate from other agreements, and must specify the third party name and purpose for disclosure.

Allows consumers to refuse third-party sharing without losing access to the health monitoring program's core features, and permits consumers to withdraw consent at any time.

Requires employers receiving health monitoring information to establish procedures preserving confidentiality and security, and prohibits discrimination against employees who refuse to consent or based on their health monitoring information.

Exempts entities subject to HIPAA or the Confidentiality of Medical Information Act from these requirements and permits emergency disclosures to healthcare providers and government officials with notice to the consumer.