Here is a SANS news item on a California Blood Bank:

Keep in mind that the California law is pretty open ended. All you have to do is conduct business in California for the law to apply. That includes online transactions, distance learning (that's a big one for me), and any other relationship where your customer is residing in the state of California. No matter where you may be, that constitutes doing business in California.

As I understand it, other states are seriously considering this type of legislation.

nihil would call this a sticky wicket, with twinkies on top.