Bill > AB2448

This bill strengthens the privacy protections mandated by California’s Confidentiality of Medical Information Act (CMIA), a state law that strictly regulates how patient health records are handled and protects them from unauthorized disclosure. Specifically, the legislation requires businesses that electronically store or maintain medical records on behalf of healthcare providers to actively implement and enforce strict security features for sensitive services—namely gender-affirming care, abortion and related services, and contraception. These required safeguards include limiting internal user access privileges, separating this sensitive information from the rest of a patient's medical file, and preventing the transfer, disclosure, or transmission of these specific records to individuals, entities, or out-of-state systems attempting to access them from outside California. Because existing law punishes violations of the CMIA that result in economic loss or personal injury as a misdemeanor, this bill slightly broadens the scope of that existing crime by enforcing these updated technical mandates, while also clarifying that the state is not required to financially reimburse local agencies for any minor costs associated with these new crime-related provisions.