CA AB2167

Expands the definition of "medical information" under California's Confidentiality of Medical Information Act to include any information collected, possessed, or derived from digital health feedback systems (ingestible sensors and related devices/software).

Requires manufacturers and operators selling devices or software applications that may be used with digital health feedback systems to California consumers to equip them with reasonable security features appropriate to protect against unauthorized access, destruction, use, modification, or disclosure of information.

Deems businesses offering software or hardware to maintain medical information (including mobile applications and related devices) as providers of health care subject to confidentiality requirements and penalties under the Confidentiality of Medical Information Act.

Makes violations of these provisions punishable as a misdemeanor, expanding existing criminal penalties for improper disclosure of medical information.

Clarifies that no state reimbursement is required because costs imposed on local agencies result from changes to criminal penalties and definitions.