CA AB2280

Defines "personal health record information" as individually identifiable information in electronic or physical form about an individual's mental or physical condition collected by commercial internet websites, online services, or products that collect such information through direct measurement or user input.

Deems businesses offering personal health record software or hardware (including mobile applications and devices) to consumers as "providers of health care" subject to the Confidentiality of Medical Information Act requirements when the software or hardware is designed to maintain personal health record information for diagnosis, treatment, or management of medical conditions.

Requires businesses offering personal health record software or hardware to maintain the same confidentiality standards as health care providers and be subject to penalties for improper use and disclosure of medical information.

Removes the requirement that personal health records be FDA-approved and removes the requirement that they be used at the direction of a health care provider with collection as the primary purpose.

Specifies that no state reimbursement is required for local agencies or school districts because costs result from changes to crime definitions under existing law.