CA AB2089

Expands the definition of "medical information" under the Confidentiality of Medical Information Act (CMIA) to include mental health application information collected by mental health digital services.

Deems businesses offering mental health digital services (mobile applications or websites that collect mental health or substance use disorder information) to be healthcare providers subject to CMIA requirements and penalties.

Requires mental health digital service businesses partnering with healthcare providers to provide information about how to find data breaches reported on the California Attorney General's website.

Defines "mental health application information" as information related to a consumer's inferred or diagnosed mental health or substance use disorder collected by a mental health digital service.

Specifies that no state reimbursement is required for local agencies or school districts under Article XIII B of the California Constitution, as the bill only changes crime definitions and penalties.