AB 1751: Controlled substances: CURES database.
- Session Year: 2017-2018
- House: Assembly
- Latest Version Date: 2018-09-18
Existing law classifies certain controlled substances into designated schedules. Existing law requires the Department of Justice to maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense a Schedule II, Schedule III, or Schedule IV controlled substance.
This bill would require the department, no later than July 1, 2020, to adopt regulations regarding the access and use of the information within CURES by consulting with stakeholders, and addressing certain processes, purposes, and conditions in the regulations. The bill would authorize the department, once final regulations have been issued, to enter into an agreement with any entity operating an interstate data sharing hub, or any agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information, as specified. The bill would require any agreement entered into by the department for those purposes to ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.
The bill would make conforming changes to related provisions concerning exceptions to the prohibition on a state agency from disclosing personal information.
This bill would incorporate additional changes to Section 11165 of the Health and Safety Code proposed by AB 1753 to be operative only if this bill and AB 1753 are enacted and this bill is enacted last.
Existing law classifies certain controlled substances into designated schedules. Existing law requires the Department of Justice to maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense a Schedule II, Schedule III, or Schedule IV controlled substance.
This bill would require the department, no later than July 1, 2020, to adopt regulations regarding the access and use of the information within CURES by consulting with stakeholders, and addressing certain processes, purposes, and conditions in the regulations. The bill would authorize the department, once final regulations have been issued, to enter into an agreement with any entity operating an interstate data sharing hub, or any agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information, as specified. The bill would require any agreement entered into by the department for those purposes to ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.
The bill would make conforming changes to related provisions concerning exceptions to the prohibition on a state agency from disclosing personal information.
This bill would incorporate additional changes to Section 11165 of the Health and Safety Code proposed by AB 1753 to be operative only if this bill and AB 1753 are enacted and this bill is enacted last.
Existing law classifies certain controlled substances into designated schedules. Existing law requires the Department of Justice to maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense a Schedule II, Schedule III, or Schedule IV controlled substance.
This bill would require the department, no later than July 1, 2020, to adopt regulations regarding the access and use of the information within CURES by consulting with stakeholders, and addressing certain processes, purposes, and conditions in the regulations. The bill would authorize the department, once final regulations have been issued, to enter into an agreement with any entity operating an interstate data sharing hub, or any agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information, as specified. The bill would require any agreement entered into by the department for those purposes to ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.
The bill would make conforming changes to related provisions concerning exceptions to the prohibition on a state agency from disclosing personal information.
This bill would incorporate additional changes to Section 11165 of the Health and Safety Code proposed by AB 1753 to be operative only if this bill and AB 1753 are enacted and this bill is enacted last.
Existing law classifies certain controlled substances into designated schedules. Existing law requires the Department of Justice to maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense a Schedule II, Schedule III, or Schedule IV controlled substance.
This bill would require the department, no later than July 1, 2020, to adopt regulations regarding the access and use of the information within CURES by consulting with specified stakeholders, and addressing certain processes, purposes, and conditions in the regulations. The bill would authorize the department, once those final regulations have been adopted, issued, to enter into an agreement with any entity operating an interstate data sharing hub, or any agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information, as specified. The bill would require any agreement entered into by the department for those purposes to ensure that all access to data obtained from CURES complies and the handling of data contained within CURES comply with California law and meets meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.
The bill would authorize a health care practitioner otherwise eligible for access to CURES, or a pharmacist who is employed by a health insurer or health care service plan and is involved in accepting, denying, or adjusting a claim for health insurance policy benefits or health care service plan contract benefits related to controlled substances, to access CURES for purposes of reviewing a claim. The bill would make conforming changes to related provisions concerning the departments release of the electronic history of controlled substances corresponding to an individual, and to provisions concerning exceptions to the prohibition on a state agency from disclosing personal information.
Existing law requires specified health care practitioners and pharmacists to submit an application to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Existing law authorizes the denial of an application, or the suspension of a subscriber, for specified reasons, including, among others, accessing information for a reason other than to diagnose or treat the patient, or to document compliance with the law.This bill would additionally authorize the denial of an application, or the suspension of a subscriber, in that circumstance if the information is accessed for a reason other than to assess or ensure patient safety, or to make a determination regarding accepting, denying, or adjusting a benefits claim, as specified.Existing law classifies certain controlled substances into designated schedules. Existing law requires the Department of Justice to maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense a Schedule II, Schedule III, or Schedule IV controlled substance.
This bill would require the department, no later than July 1, 2020, to adopt regulations regarding the access and use of the information within CURES by consulting with specified stakeholders, and addressing certain processes, purposes, and conditions in the regulations. The bill would authorize the Department of Justice department, once those regulations have been adopted, to enter into an agreement with an any entity operating an interstate data share hub for the purposes of participating in interjurisdictional information sharing between prescription drug monitoring programs across state lines. sharing hub, or any agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information, as specified. The bill would require any agreement entered into by the Department of Justice department for those purposes to ensure that all access to data within obtained from CURES complies with California law and meets the same patient privacy privacy, audit, and data security standards employed and required for direct access of to CURES.
The bill would authorize a health care practitioner otherwise eligible for access to CURES, or a pharmacist who is employed by a health insurer or health care service plan and is involved in accepting, denying, or adjusting a claim for health insurance policy benefits or health care service plan contract benefits related to controlled substances, to access CURES for purposes of reviewing a claim. The bill would make conforming changes to related provisions concerning the departments release of the electronic history of controlled substances corresponding to an individual, and to provisions concerning exceptions to the prohibition on a state agency from disclosing personal information.
Existing law requires specified health care practitioners and pharmacists to submit an application to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Existing law authorizes the denial of an application, or the suspension of a subscriber, for specified reasons, including, among others, accessing information for a reason other than to diagnose or treat the patient, or to document compliance with the law.
This bill would additionally authorize the denial of an application, or the suspension of a subscriber, in that circumstance if the information is accessed for a reason other than to assess or ensure patient safety, or to make a determination regarding accepting, denying, or adjusting a benefits claim, as specified.
Existing law classifies certain controlled substances into designated schedules. Existing law requires the Department of Justice to maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense a Schedule II, Schedule III, or Schedule IV controlled substance.
This bill would authorize the Department of Justice to enter into an agreement with an entity operating an interstate data share hub for the purposes of participating in interjurisdictional information sharing between prescription drug monitoring programs across state lines. The bill would require any agreement entered into by the Department of Justice for those purposes to ensure that all access to data within CURES complies with California law and meets the same patient privacy and data security standards employed and required for direct access of CURES.
An agency shall not disclose any personal information in a manner that would link the information disclosed to the individual to whom it pertains unless the information is disclosed, as follows:
(a)To the individual to whom the information pertains.
(b)With the prior written voluntary consent of the individual to whom the information pertains, but only if that consent has been obtained not more than 30 days before the disclosure, or in the time limit agreed to by the individual in the written consent.
(c)To the duly appointed guardian or conservator of the individual or a person representing the individual if it can be proven with reasonable certainty through the possession of agency forms, documents, or correspondence that this person is the authorized representative of the individual to whom the information pertains.
(d)To those officers, employees, attorneys, agents, or volunteers of the agency that has custody of the information if the disclosure is relevant and necessary in the ordinary course of the performance of their official duties and is related to the purpose for which the information was acquired.
(e)To a person, or to another agency if the transfer is necessary for the transferee agency to perform its constitutional or statutory duties, and the use is compatible with a purpose for which the information was collected and the use or transfer is in accordance with Section 1798.25. With respect to information transferred from a law enforcement or regulatory agency, or information transferred to another law enforcement or regulatory agency, a use is compatible if the use of the information requested is needed in an investigation of unlawful activity under the jurisdiction of the requesting agency or for licensing, certification, or regulatory purposes by that agency.
(f)To a governmental entity if required by state or federal law.
(g)Pursuant to the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1 of the Government Code).
(h)To a person who has provided the agency with advance, adequate written assurance that the information will be used solely for statistical research or reporting purposes, but only if the information to be disclosed is in a form that will not identify any individual.
(i)Pursuant to a determination by the agency that maintains information that compelling circumstances exist that affect the health or safety of an individual, if upon the disclosure notification is transmitted to the individual to whom the information pertains at his or her last known address. Disclosure shall not be made if it is in conflict with other state or federal laws.
(j)To the State Archives as a record that has sufficient historical or other value to warrant its continued preservation by the California state government, or for evaluation by the Director of General Services or his or her designee to determine whether the record has further administrative, legal, or fiscal value.
(k)To any person pursuant to a subpoena, court order, or other compulsory legal process if, before the disclosure, the agency reasonably attempts to notify the individual to whom the record pertains, and if the notification is not prohibited by law.
(l)To any person pursuant to a search warrant.
(m)Pursuant to Article 3 (commencing with Section 1800) of Chapter 1 of Division 2 of the Vehicle Code.
(n)For the sole purpose of verifying and paying government health care service claims made pursuant to Division 9 (commencing with Section 10000) of the Welfare and Institutions Code.
(o)To a law enforcement or regulatory agency when required for an investigation of unlawful activity or for licensing, certification, or regulatory purposes, unless the disclosure is otherwise prohibited by law.
(p)To another person or governmental organization to the extent necessary to obtain information from the person or governmental organization for an investigation by the agency of a failure to comply with a specific state law that the agency is responsible for enforcing.
(q)To an adopted person and is limited to general background information pertaining to the adopted persons biological parents, if the information does not include or reveal the identity of the biological parents.
(r)To a child or a grandchild of an adopted person and disclosure is limited to medically necessary information pertaining to the adopted persons biological parents. However, the information, or the process for obtaining the information, shall not include or reveal the identity of the biological parents. The State Department of Social Services shall adopt regulations governing the release of information pursuant to this subdivision. The regulations shall require licensed adoption agencies to provide the same services provided by the department as established by this subdivision.
(s)To a committee of the Legislature or to a Member of the Legislature, or his or her staff if authorized in writing by the member, if the member has permission to obtain the information from the individual to whom it pertains or if the member provides reasonable assurance that he or she is acting on behalf of the individual.
(t)(1)To the University of California, a nonprofit educational institution, or, in the case of education-related data, another nonprofit entity, conducting scientific research, if the request for information is approved by the Committee for the Protection of Human Subjects (CPHS) for the California Health and Human Services Agency (CHHSA) or an institutional review board, as authorized in paragraphs (4) and (5). The approval shall include a review and determination that all the following criteria have been satisfied:
(A)The researcher has provided a plan sufficient to protect personal information from improper use and disclosures, including sufficient administrative, physical, and technical safeguards to protect personal information from reasonable anticipated threats to the security or confidentiality of the information.
(B)The researcher has provided a sufficient plan to destroy or return all personal information as soon as it is no longer needed for the research project, unless the researcher has demonstrated an ongoing need for the personal information for the research project and has provided a long-term plan sufficient to protect the confidentiality of that information.
(C)The researcher has provided sufficient written assurances that the personal information will not be reused or disclosed to any other person or entity, or used in any manner, not approved in the research protocol, except as required by law or for authorized oversight of the research project.
(2)The CPHS or institutional review board shall, at a minimum, accomplish all of the following as part of its review and approval of the research project for the purpose of protecting personal information held in agency databases:
(A)Determine whether the requested personal information is needed to conduct the research.
(B)Permit access to personal information only if it is needed for the research project.
(C)Permit access only to the minimum necessary personal information needed for the research project.
(D)Require the assignment of unique subject codes that are not derived from personal information in lieu of social security numbers if the research can still be conducted without social security numbers.
(E)If feasible, and if cost, time, and technical expertise permit, require the agency to conduct a portion of the data processing for the researcher to minimize the release of personal information.
(3)Reasonable costs to the agency associated with the agencys process of protecting personal information under the conditions of CPHS approval may be billed to the researcher, including, but not limited to, the agencys costs for conducting a portion of the data processing for the researcher, removing personal information, encrypting or otherwise securing personal information, or assigning subject codes.
(4)The CPHS may enter into written agreements to enable other institutional review boards to provide the data security approvals required by this subdivision, if the data security requirements set forth in this subdivision are satisfied.
(5)Pursuant to paragraph (4), the CPHS shall enter into a written agreement with the institutional review board established pursuant to former Section 49079.6 of the Education Code. The agreement shall authorize, commencing July 1, 2010, or the date upon which the written agreement is executed, whichever is later, that board to provide the data security approvals required by this subdivision, if the data security requirements set forth in this subdivision and the act specified in subdivision (a) of Section 49079.5 of the Education Code are satisfied.
(u)To an insurer if authorized by Chapter 5 (commencing with Section 10900) of Division 4 of the Vehicle Code.
(v)Pursuant to Section 450, 452, 8009, or 18396 of the Financial Code.
(w)For the sole purpose of participation in interstate data sharing of prescription drug monitoring program information pursuant to the California Uniform Controlled Substances Act (Division 10 (commencing with Section 11000) of the Health and Safety Code), if disclosure is limited to prescription drug monitoring program information.
This article does not require the disclosure of personal information to the individual to whom the information pertains if that information may otherwise be withheld as set forth in Section 1798.40.
SEC. 2.Section 11165 of the Health and Safety Code is amended to read:11165.(a)To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and Internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.
(b)The Department of Justice may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.
(c)(1)The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.
(2)(A)CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the Department of Justice, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the Department of Justice, for educational, peer review, statistical, or research purposes, if patient information, including any information that may identify the patient, is not compromised. Further, data disclosed to any individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to any third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The Department of Justice shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.
(B)Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.
(3)The Department of Justice shall, no later than July 1, 2020, adopt regulations regarding the access and use of the information within CURES. The Department of Justice shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:
(A)The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.
(B)The purposes for which a health care practitioner may access information in CURES.
(C)The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.
(D)The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.
(4)In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and keep a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.
(d)For each prescription for a Schedule II, Schedule III, or Schedule IV controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, and 1308.14, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the Department of Justice as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed, in a format specified by the Department of Justice:
(1)Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.
(2)The prescribers category of licensure, license number, national provider identifier (NPI) number, the federal controlled substance registration number, and the state medical license number of any prescriber using the federal controlled substance registration number of a government-exempt facility, if provided.
(3)Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.
(4)National Drug Code (NDC) number of the controlled substance dispensed.
(5)Quantity of the controlled substance dispensed.
(6)International Statistical Classification of Diseases, 9th revision (ICD-9) or 10th revision (ICD-10) Code, if available.
(7)Number of refills ordered.
(8)Whether the drug was dispensed as a refill of a prescription or as a first-time request.
(9)Date of origin of the prescription.
(10)Date of dispensing of the prescription.
(e)The Department of Justice may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. All prescriber and dispenser invitees shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.
(f)The Department of Justice shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).
(g)The Department of Justice may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.
(h)(1)The Department of Justice may enter into an agreement with any entity operating an interstate data sharing hub, or any agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information.
(2)Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the Department of Justice pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the Department of Justice for interstate data sharing of prescription drug monitoring program information.
(3)Any agreement entered into by the Department of Justice for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.
(4)For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if he or she is registered and in good standing with that states prescription drug monitoring program.
(5)The Department of Justice shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).
SEC. 2.5.Section 11165 of the Health and Safety Code is amended to read:11165.(a)To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and Internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.
(b)The Department of Justice may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.
(c)(1)The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.
(2)(A)CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the Department of Justice, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the Department of Justice, for educational, peer review, statistical, or research purposes, if patient information, including any information that may identify the patient, is not compromised. Further, data disclosed to any individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to any third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The Department of Justice shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.
(B)Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.
(3)The Department of Justice shall, no later than July 1, 2020, adopt regulations regarding the access and use of the information within CURES. The Department of Justice shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:
(A)The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.
(B)The purposes for which a health care practitioner may access information in CURES.
(C)The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.
(D)The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.
(4)In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and keep a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.
(d)For each prescription for a Schedule II, Schedule III, or Schedule IV controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, and 1308.14, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the Department of Justice as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed, in a format specified by the Department of Justice:
(1)Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.
(2)The prescribers category of licensure, license number, national provider identifier (NPI) number, the federal controlled substance registration number, and the state medical license number of any prescriber using the federal controlled substance registration number of a government-exempt facility, if provided.
(3)Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.
(4)National Drug Code (NDC) number of the controlled substance dispensed.
(5)Quantity of the controlled substance dispensed.
(6)International Statistical Classification of Diseases, 9th revision (ICD-9) or 10th revision (ICD-10) Code, if available.
(7)Number of refills ordered.
(8)Whether the drug was dispensed as a refill of a prescription or as a first-time request.
(9)Date of origin of the prescription.
(10)Date of dispensing of the prescription.
(11)The serial number for the corresponding prescription form, if applicable.
(e)The Department of Justice may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. All prescriber and dispenser invitees shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.
(f)The Department of Justice shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).
(g)The Department of Justice may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.
(h)(1)The Department of Justice may enter into an agreement with any entity operating an interstate data sharing hub, or any agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information.
(2)Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the Department of Justice pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the Department of Justice for interstate data sharing of prescription drug monitoring program information.
(3)Any agreement entered into by the Department of Justice for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.
(4)For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if he or she is registered and in good standing with that states prescription drug monitoring program.
(5)The Department of Justice shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).
SEC. 3.Section 2.5 of this bill incorporates amendments to Section 11165 of the Health and Safety Code proposed by both this bill and Assembly Bill 1753. That section of this bill shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2019, (2) each bill amends Section 11165 of the Health and Safety Code, and (3) this bill is enacted after Assembly Bill 1753, in which case Section 2 of this bill shall not become operative.
An agency shall not disclose any personal information in a manner that would link the information disclosed to the individual to whom it pertains unless the information is disclosed, as follows:
(a)To the individual to whom the information pertains.
(b)With the prior written voluntary consent of the individual to whom the information pertains, but only if that consent has been obtained not more than 30 days before the disclosure, or in the time limit agreed to by the individual in the written consent.
(c)To the duly appointed guardian or conservator of the individual or a person representing the individual if it can be proven with reasonable certainty through the possession of agency forms, documents, or correspondence that this person is the authorized representative of the individual to whom the information pertains.
(d)To those officers, employees, attorneys, agents, or volunteers of the agency that has custody of the information if the disclosure is relevant and necessary in the ordinary course of the performance of their official duties and is related to the purpose for which the information was acquired.
(e)To a person, or to another agency if the transfer is necessary for the transferee agency to perform its constitutional or statutory duties, and the use is compatible with a purpose for which the information was collected and the use or transfer is in accordance with Section 1798.25. With respect to information transferred from a law enforcement or regulatory agency, or information transferred to another law enforcement or regulatory agency, a use is compatible if the use of the information requested is needed in an investigation of unlawful activity under the jurisdiction of the requesting agency or for licensing, certification, or regulatory purposes by that agency.
(f)To a governmental entity if required by state or federal law.
(g)Pursuant to the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1 of the Government Code).
(h)To a person who has provided the agency with advance, adequate written assurance that the information will be used solely for statistical research or reporting purposes, but only if the information to be disclosed is in a form that will not identify any individual.
(i)Pursuant to a determination by the agency that maintains information that compelling circumstances exist that affect the health or safety of an individual, if upon the disclosure notification is transmitted to the individual to whom the information pertains at his or her last known address. Disclosure shall not be made if it is in conflict with other state or federal laws.
(j)To the State Archives as a record that has sufficient historical or other value to warrant its continued preservation by the California state government, or for evaluation by the Director of General Services or his or her designee to determine whether the record has further administrative, legal, or fiscal value.
(k)To any person pursuant to a subpoena, court order, or other compulsory legal process if, before the disclosure, the agency reasonably attempts to notify the individual to whom the record pertains, and if the notification is not prohibited by law.
(l)To any person pursuant to a search warrant.
(m)Pursuant to Article 3 (commencing with Section 1800) of Chapter 1 of Division 2 of the Vehicle Code.
(n)For the sole purpose of verifying and paying government health care service claims made pursuant to Division 9 (commencing with Section 10000) of the Welfare and Institutions Code.
(o)To a law enforcement or regulatory agency when required for an investigation of unlawful activity or for licensing, certification, or regulatory purposes, unless the disclosure is otherwise prohibited by law.
(p)To another person or governmental organization to the extent necessary to obtain information from the person or governmental organization for an investigation by the agency of a failure to comply with a specific state law that the agency is responsible for enforcing.
(q)To an adopted person and is limited to general background information pertaining to the adopted persons biological parents, if the information does not include or reveal the identity of the biological parents.
(r)To a child or a grandchild of an adopted person and disclosure is limited to medically necessary information pertaining to the adopted persons biological parents. However, the information, or the process for obtaining the information, shall not include or reveal the identity of the biological parents. The State Department of Social Services shall adopt regulations governing the release of information pursuant to this subdivision. The regulations shall require licensed adoption agencies to provide the same services provided by the department as established by this subdivision.
(s)To a committee of the Legislature or to a Member of the Legislature, or his or her staff if authorized in writing by the member, if the member has permission to obtain the information from the individual to whom it pertains or if the member provides reasonable assurance that he or she is acting on behalf of the individual.
(t)(1)To the University of California, a nonprofit educational institution, or, in the case of education-related data, another nonprofit entity, conducting scientific research, if the request for information is approved by the Committee for the Protection of Human Subjects (CPHS) for the California Health and Human Services Agency (CHHSA) or an institutional review board, as authorized in paragraphs (4) and (5). The approval shall include a review and determination that all the following criteria have been satisfied:
(A)The researcher has provided a plan sufficient to protect personal information from improper use and disclosures, including sufficient administrative, physical, and technical safeguards to protect personal information from reasonable anticipated threats to the security or confidentiality of the information.
(B)The researcher has provided a sufficient plan to destroy or return all personal information as soon as it is no longer needed for the research project, unless the researcher has demonstrated an ongoing need for the personal information for the research project and has provided a long-term plan sufficient to protect the confidentiality of that information.
(C)The researcher has provided sufficient written assurances that the personal information will not be reused or disclosed to any other person or entity, or used in any manner, not approved in the research protocol, except as required by law or for authorized oversight of the research project.
(2)The CPHS or institutional review board shall, at a minimum, accomplish all of the following as part of its review and approval of the research project for the purpose of protecting personal information held in agency databases:
(A)Determine whether the requested personal information is needed to conduct the research.
(B)Permit access to personal information only if it is needed for the research project.
(C)Permit access only to the minimum necessary personal information needed for the research project.
(D)Require the assignment of unique subject codes that are not derived from personal information in lieu of social security numbers if the research can still be conducted without social security numbers.
(E)If feasible, and if cost, time, and technical expertise permit, require the agency to conduct a portion of the data processing for the researcher to minimize the release of personal information.
(3)Reasonable costs to the agency associated with the agencys process of protecting personal information under the conditions of CPHS approval may be billed to the researcher, including, but not limited to, the agencys costs for conducting a portion of the data processing for the researcher, removing personal information, encrypting or otherwise securing personal information, or assigning subject codes.
(4)The CPHS may enter into written agreements to enable other institutional review boards to provide the data security approvals required by this subdivision, if the data security requirements set forth in this subdivision are satisfied.
(5)Pursuant to paragraph (4), the CPHS shall enter into a written agreement with the institutional review board established pursuant to former Section 49079.6 of the Education Code. The agreement shall authorize, commencing July 1, 2010, or the date upon which the written agreement is executed, whichever is later, that board to provide the data security approvals required by this subdivision, if the data security requirements set forth in this subdivision and the act specified in subdivision (a) of Section 49079.5 of the Education Code are satisfied.
(u)To an insurer if authorized by Chapter 5 (commencing with Section 10900) of Division 4 of the Vehicle Code.
(v)Pursuant to Section 450, 452, 8009, or 18396 of the Financial Code.
(w)For the sole purpose of participation in interstate data sharing of prescription drug monitoring program information pursuant to the California Uniform Controlled Substances Act (Division 10 (commencing with Section 11000) of the Health and Safety Code), if disclosure is limited to prescription drug monitoring program information.
This article does not require the disclosure of personal information to the individual to whom the information pertains if that information may otherwise be withheld as set forth in Section 1798.40.
SEC. 2.Section 11165 of the Health and Safety Code is amended to read:11165.(a)To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and Internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.
(b)The Department of Justice may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.
(c)(1)The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.
(2)(A)CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the Department of Justice, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the Department of Justice, for educational, peer review, statistical, or research purposes, if patient information, including any information that may identify the patient, is not compromised. Further, data disclosed to any individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to any third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The Department of Justice shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.
(B)Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.
(3)The Department of Justice shall, no later than July 1, 2020, adopt regulations regarding the access and use of the information within CURES. The Department of Justice shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:
(A)The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.
(B)The purposes for which a health care practitioner may access information in CURES.
(C)The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.
(D)The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.
(4)In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and keep a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.
(d)For each prescription for a Schedule II, Schedule III, or Schedule IV controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, and 1308.14, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the Department of Justice as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed, in a format specified by the Department of Justice:
(1)Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.
(2)The prescribers category of licensure, license number, national provider identifier (NPI) number, the federal controlled substance registration number, and the state medical license number of any prescriber using the federal controlled substance registration number of a government-exempt facility, if provided.
(3)Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.
(4)National Drug Code (NDC) number of the controlled substance dispensed.
(5)Quantity of the controlled substance dispensed.
(6)International Statistical Classification of Diseases, 9th revision (ICD-9) or 10th revision (ICD-10) Code, if available.
(7)Number of refills ordered.
(8)Whether the drug was dispensed as a refill of a prescription or as a first-time request.
(9)Date of origin of the prescription.
(10)Date of dispensing of the prescription.
(e)The Department of Justice may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. All prescriber and dispenser invitees shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.
(f)The Department of Justice shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).
(g)The Department of Justice may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.
(h)(1)The Department of Justice may enter into an agreement with any entity operating an interstate data sharing hub, or any agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information.
(2)Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the Department of Justice pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the Department of Justice for interstate data sharing of prescription drug monitoring program information.
(3)Any agreement entered into by the Department of Justice for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.
(4)For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if he or she is registered and in good standing with that states prescription drug monitoring program.
(5)The Department of Justice shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).
SEC. 2.5.Section 11165 of the Health and Safety Code is amended to read:11165.(a)To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and Internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.
(b)The Department of Justice may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.
(c)(1)The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.
(2)(A)CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the Department of Justice, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the Department of Justice, for educational, peer review, statistical, or research purposes, if patient information, including any information that may identify the patient, is not compromised. Further, data disclosed to any individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to any third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The Department of Justice shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.
(B)Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.
(3)The Department of Justice shall, no later than July 1, 2020, adopt regulations regarding the access and use of the information within CURES. The Department of Justice shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:
(A)The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.
(B)The purposes for which a health care practitioner may access information in CURES.
(C)The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.
(D)The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.
(4)In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and keep a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.
(d)For each prescription for a Schedule II, Schedule III, or Schedule IV controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, and 1308.14, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the Department of Justice as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed, in a format specified by the Department of Justice:
(1)Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.
(2)The prescribers category of licensure, license number, national provider identifier (NPI) number, the federal controlled substance registration number, and the state medical license number of any prescriber using the federal controlled substance registration number of a government-exempt facility, if provided.
(3)Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.
(4)National Drug Code (NDC) number of the controlled substance dispensed.
(5)Quantity of the controlled substance dispensed.
(6)International Statistical Classification of Diseases, 9th revision (ICD-9) or 10th revision (ICD-10) Code, if available.
(7)Number of refills ordered.
(8)Whether the drug was dispensed as a refill of a prescription or as a first-time request.
(9)Date of origin of the prescription.
(10)Date of dispensing of the prescription.
(11)The serial number for the corresponding prescription form, if applicable.
(e)The Department of Justice may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. All prescriber and dispenser invitees shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.
(f)The Department of Justice shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).
(g)The Department of Justice may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.
(h)(1)The Department of Justice may enter into an agreement with any entity operating an interstate data sharing hub, or any agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information.
(2)Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the Department of Justice pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the Department of Justice for interstate data sharing of prescription drug monitoring program information.
(3)Any agreement entered into by the Department of Justice for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.
(4)For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if he or she is registered and in good standing with that states prescription drug monitoring program.
(5)The Department of Justice shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).
SEC. 3.Section 2.5 of this bill incorporates amendments to Section 11165 of the Health and Safety Code proposed by both this bill and Assembly Bill 1753. That section of this bill shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2019, (2) each bill amends Section 11165 of the Health and Safety Code, and (3) this bill is enacted after Assembly Bill 1753, in which case Section 2 of this bill shall not become operative.
An agency shall not disclose any personal information in a manner that would link the information disclosed to the individual to whom it pertains unless the information is disclosed, as follows:
(a)To the individual to whom the information pertains.
(b)With the prior written voluntary consent of the individual to whom the information pertains, but only if that consent has been obtained not more than 30 days before the disclosure, or in the time limit agreed to by the individual in the written consent.
(c)To the duly appointed guardian or conservator of the individual or a person representing the individual if it can be proven with reasonable certainty through the possession of agency forms, documents, or correspondence that this person is the authorized representative of the individual to whom the information pertains.
(d)To those officers, employees, attorneys, agents, or volunteers of the agency that has custody of the information if the disclosure is relevant and necessary in the ordinary course of the performance of their official duties and is related to the purpose for which the information was acquired.
(e)To a person, or to another agency if the transfer is necessary for the transferee agency to perform its constitutional or statutory duties, and the use is compatible with a purpose for which the information was collected and the use or transfer is in accordance with Section 1798.25. With respect to information transferred from a law enforcement or regulatory agency, or information transferred to another law enforcement or regulatory agency, a use is compatible if the use of the information requested is needed in an investigation of unlawful activity under the jurisdiction of the requesting agency or for licensing, certification, or regulatory purposes by that agency.
(f)To a governmental entity if required by state or federal law.
(g)Pursuant to the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1 of the Government Code).
(h)To a person who has provided the agency with advance, adequate written assurance that the information will be used solely for statistical research or reporting purposes, but only if the information to be disclosed is in a form that will not identify any individual.
(i)Pursuant to a determination by the agency that maintains information that compelling circumstances exist that affect the health or safety of an individual, if upon the disclosure notification is transmitted to the individual to whom the information pertains at his or her last known address. Disclosure shall not be made if it is in conflict with other state or federal laws.
(j)To the State Archives as a record that has sufficient historical or other value to warrant its continued preservation by the California state government, or for evaluation by the Director of General Services or his or her designee to determine whether the record has further administrative, legal, or fiscal value.
(k)To any person pursuant to a subpoena, court order, or other compulsory legal process if, before the disclosure, the agency reasonably attempts to notify the individual to whom the record pertains, and if the notification is not prohibited by law.
(l)To any person pursuant to a search warrant.
(m)Pursuant to Article 3 (commencing with Section 1800) of Chapter 1 of Division 2 of the Vehicle Code.
(n)For the sole purpose of verifying and paying government health care service claims made pursuant to Division 9 (commencing with Section 10000) of the Welfare and Institutions Code.
(o)To a law enforcement or regulatory agency when required for an investigation of unlawful activity or for licensing, certification, or regulatory purposes, unless the disclosure is otherwise prohibited by law.
(p)To another person or governmental organization to the extent necessary to obtain information from the person or governmental organization for an investigation by the agency of a failure to comply with a specific state law that the agency is responsible for enforcing.
(q)To an adopted person and is limited to general background information pertaining to the adopted persons biological parents, if the information does not include or reveal the identity of the biological parents.
(r)To a child or a grandchild of an adopted person and disclosure is limited to medically necessary information pertaining to the adopted persons biological parents. However, the information, or the process for obtaining the information, shall not include or reveal the identity of the biological parents. The State Department of Social Services shall adopt regulations governing the release of information pursuant to this subdivision. The regulations shall require licensed adoption agencies to provide the same services provided by the department as established by this subdivision.
(s)To a committee of the Legislature or to a Member of the Legislature, or his or her staff if authorized in writing by the member, if the member has permission to obtain the information from the individual to whom it pertains or if the member provides reasonable assurance that he or she is acting on behalf of the individual.
(t)(1)To the University of California, a nonprofit educational institution, or, in the case of education-related data, another nonprofit entity, conducting scientific research, if the request for information is approved by the Committee for the Protection of Human Subjects (CPHS) for the California Health and Human Services Agency (CHHSA) or an institutional review board, as authorized in paragraphs (4) and (5). The approval shall include a review and determination that all the following criteria have been satisfied:
(A)The researcher has provided a plan sufficient to protect personal information from improper use and disclosures, including sufficient administrative, physical, and technical safeguards to protect personal information from reasonable anticipated threats to the security or confidentiality of the information.
(B)The researcher has provided a sufficient plan to destroy or return all personal information as soon as it is no longer needed for the research project, unless the researcher has demonstrated an ongoing need for the personal information for the research project and has provided a long-term plan sufficient to protect the confidentiality of that information.
(C)The researcher has provided sufficient written assurances that the personal information will not be reused or disclosed to any other person or entity, or used in any manner, not approved in the research protocol, except as required by law or for authorized oversight of the research project.
(2)The CPHS or institutional review board shall, at a minimum, accomplish all of the following as part of its review and approval of the research project for the purpose of protecting personal information held in agency databases:
(A)Determine whether the requested personal information is needed to conduct the research.
(B)Permit access to personal information only if it is needed for the research project.
(C)Permit access only to the minimum necessary personal information needed for the research project.
(D)Require the assignment of unique subject codes that are not derived from personal information in lieu of social security numbers if the research can still be conducted without social security numbers.
(E)If feasible, and if cost, time, and technical expertise permit, require the agency to conduct a portion of the data processing for the researcher to minimize the release of personal information.
(3)Reasonable costs to the agency associated with the agencys process of protecting personal information under the conditions of CPHS approval may be billed to the researcher, including, but not limited to, the agencys costs for conducting a portion of the data processing for the researcher, removing personal information, encrypting or otherwise securing personal information, or assigning subject codes.
(4)The CPHS may enter into written agreements to enable other institutional review boards to provide the data security approvals required by this subdivision, if the data security requirements set forth in this subdivision are satisfied.
(5)Pursuant to paragraph (4), the CPHS shall enter into a written agreement with the institutional review board established pursuant to former Section 49079.6 of the Education Code. The agreement shall authorize, commencing July 1, 2010, or the date upon which the written agreement is executed, whichever is later, that board to provide the data security approvals required by this subdivision, if the data security requirements set forth in this subdivision and the act specified in subdivision (a) of Section 49079.5 of the Education Code are satisfied.
(u)To an insurer if authorized by Chapter 5 (commencing with Section 10900) of Division 4 of the Vehicle Code.
(v)Pursuant to Section 450, 452, 8009, or 18396 of the Financial Code.
(w)For the sole purpose of participation in interstate data sharing of prescription drug monitoring program information pursuant to the California Uniform Controlled Substances Act (Division 10 (commencing with Section 11000) of the Health and Safety Code), if disclosure is limited to prescription drug monitoring program information.
This article does not require the disclosure of personal information to the individual to whom the information pertains if that information may otherwise be withheld as set forth in Section 1798.40.
SEC. 2.Section 11165 of the Health and Safety Code is amended to read:11165.(a)To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and Internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.
(b)The Department of Justice may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.
(c)(1)The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.
(2)(A)CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the Department of Justice, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the Department of Justice, for educational, peer review, statistical, or research purposes, if patient information, including any information that may identify the patient, is not compromised. Further, data disclosed to any individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to any third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The Department of Justice shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.
(B)Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.
(3)The Department of Justice shall, no later than July 1, 2020, adopt regulations regarding the access and use of the information within CURES. The Department of Justice shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:
(A)The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.
(B)The purposes for which a health care practitioner may access information in CURES.
(C)The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.
(D)The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.
(4)In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and keep a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.
(d)For each prescription for a Schedule II, Schedule III, or Schedule IV controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, and 1308.14, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the Department of Justice as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed, in a format specified by the Department of Justice:
(1)Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.
(2)The prescribers category of licensure, license number, national provider identifier (NPI) number, the federal controlled substance registration number, and the state medical license number of any prescriber using the federal controlled substance registration number of a government-exempt facility, if provided.
(3)Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.
(4)National Drug Code (NDC) number of the controlled substance dispensed.
(5)Quantity of the controlled substance dispensed.
(6)International Statistical Classification of Diseases, 9th revision (ICD-9) or 10th revision (ICD-10) Code, if available.
(7)Number of refills ordered.
(8)Whether the drug was dispensed as a refill of a prescription or as a first-time request.
(9)Date of origin of the prescription.
(10)Date of dispensing of the prescription.
(e)The Department of Justice may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. All prescriber and dispenser invitees shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.
(f)The Department of Justice shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).
(g)The Department of Justice may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.
(h)(1)The Department of Justice may enter into an agreement with any entity operating an interstate data sharing hub, or any agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information.
(2)Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the Department of Justice pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the Department of Justice for interstate data sharing of prescription drug monitoring program information.
(3)Any agreement entered into by the Department of Justice for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.
(4)For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if he or she is registered and in good standing with that states prescription drug monitoring program.
(5)The Department of Justice shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).
SEC. 2.5.Section 11165 of the Health and Safety Code is amended to read:11165.(a)To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and Internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.
(b)The Department of Justice may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.
(c)(1)The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.
(2)(A)CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the Department of Justice, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the Department of Justice, for educational, peer review, statistical, or research purposes, provided that if patient information, including any information that may identify the patient, is not compromised. Further, data disclosed to any individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to any third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The Department of Justice shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.
(B)Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.
(3)The Department of Justice shall, no later than July 1, 2020, adopt regulations regarding the access and use of the information within CURES. The Department of Justice shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:
(A)The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.
(B)The purposes for which a health care practitioner may access information in CURES.
(C)The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.
(D)The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.
(3)(4)In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data is are provided and keep a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.
(d)For each prescription for a Schedule II, Schedule III, or Schedule IV controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, and 1308.14, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the Department of Justice as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed, in a format specified by the Department of Justice:
(1)Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.
(2)The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of any prescriber using the federal controlled substance registration number of a government-exempt facility. facility, if provided.
(3)Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.
(4)National Drug Code (NDC) number of the controlled substance dispensed.
(5)Quantity of the controlled substance dispensed.
(6)International Statistical Classification of Diseases, 9th revision (ICD-9) or 10th revision (ICD-10) Code, if available.
(7)Number of refills ordered.
(8)Whether the drug was dispensed as a refill of a prescription or as a first-time request.
(9)Date of origin of the prescription.
(10)Date of dispensing of the prescription.
(11)The serial number for the corresponding prescription form, if applicable.
(e)The Department of Justice may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. All prescriber and dispenser invitees shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.
(f)The Department of Justice shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).
(g)The Department of Justice may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.
(h)(1)The Department of Justice may enter into an agreement with any entity operating an interstate data sharing hub, or any agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information.
(2)Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the Department of Justice pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the Department of Justice for interstate data sharing of prescription drug monitoring program information.
(3)Any agreement entered into by the Department of Justice for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.
(4)For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if he or she is registered and in good standing with that states prescription drug monitoring program.
(5)The Department of Justice shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).
SEC. 3.Section 2.5 of this bill incorporates amendments to Section 11165 of the Health and Safety Code proposed by both this bill and Assembly Bill 1753. That section of this bill shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2019, (2) each bill amends Section 11165 of the Health and Safety Code, and (3) this bill is enacted after Assembly Bill 1753, in which case Section 2 of this bill shall not become operative.
An agency shall not disclose any personal information in a manner that would identify link the information disclosed to the individual to whom it pertains unless the information is disclosed, as follows:
(a)To the individual to whom the information pertains.
(b)With the prior written voluntary consent of the individual to whom the information pertains, but only if that consent has been obtained not more than 30 days before the disclosure, or in the time limit agreed to by the individual in the written consent.
(c)To the duly appointed guardian or conservator of the individual or a person representing the individual if it can be proven with reasonable certainty through the possession of agency forms, documents, or correspondence that this person is the authorized representative of the individual to whom the information pertains.
(d)To those officers, employees, attorneys, agents, or volunteers of the agency that has custody of the information if the disclosure is relevant and necessary in the ordinary course of the performance of their official duties and is related to the purpose for which the information was acquired.
(e)To a person, or to another agency if the transfer is necessary for the transferee agency to perform its constitutional or statutory duties, and the use is compatible with a purpose for which the information was collected and the use or transfer is in accordance with Section 1798.25. With respect to information transferred from a law enforcement or regulatory agency, or information transferred to another law enforcement or regulatory agency, a use is compatible if the use of the information requested is needed in an investigation of unlawful activity under the jurisdiction of the requesting agency or for licensing, certification, or regulatory purposes by that agency.
(f)To a governmental entity if required by state or federal law.
(g)Pursuant to the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1 of the Government Code).
(h)To a person who has provided the agency with advance, adequate written assurance that the information will be used solely for statistical research or reporting purposes, but only if the information to be disclosed is in a form that will not identify any individual.
(i)Pursuant to a determination by the agency that maintains information that compelling circumstances exist that affect the health or safety of an individual, if upon the disclosure notification is transmitted to the individual to whom the information pertains at his or her last known address. Disclosure shall not be made if it is in conflict with other state or federal laws.
(j)To the State Archives as a record that has sufficient historical or other value to warrant its continued preservation by the California state government, or for evaluation by the Director of General Services or his or her designee to determine whether the record has further administrative, legal, or fiscal value.
(k)To any person pursuant to a subpoena, court order, or other compulsory legal process if, before the disclosure, the agency reasonably attempts to notify the individual to whom the record pertains, and if the notification is not prohibited by law.
(l)To any person pursuant to a search warrant.
(m)Pursuant to Article 3 (commencing with Section 1800) of Chapter 1 of Division 2 of the Vehicle Code.
(n)For the sole purpose of verifying and paying government health care service claims made pursuant to Division 9 (commencing with Section 10000) of the Welfare and Institutions Code.
(o)To a law enforcement or regulatory agency when required for an investigation of unlawful activity or for licensing, certification, or regulatory purposes, unless the disclosure is otherwise prohibited by law.
(p)To another person or governmental organization to the extent necessary to obtain information from the person or governmental organization for an investigation by the agency of a failure to comply with a specific state law that the agency is responsible for enforcing.
(q)To an adopted person and is limited to general background information pertaining to the adopted persons biological parents, if the information does not include or reveal the identity of the biological parents.
(r)To a child or a grandchild of an adopted person and disclosure is limited to medically necessary information pertaining to the adopted persons biological parents. However, the information, or the process for obtaining the information, shall not include or reveal the identity of the biological parents. The State Department of Social Services shall adopt regulations governing the release of information pursuant to this subdivision. The regulations shall require licensed adoption agencies to provide the same services provided by the department as established by this subdivision.
(s)To a committee of the Legislature or to a Member of the Legislature, or his or her staff if authorized in writing by the member, if the member has permission to obtain the information from the individual to whom it pertains or if the member provides reasonable assurance that he or she is acting on behalf of the individual.
(t)(1)To the University of California, a nonprofit educational institution, or, in the case of education-related data, another nonprofit entity, conducting scientific research, if the request for information is approved by the Committee for the Protection of Human Subjects (CPHS) for the California Health and Human Services Agency (CHHSA) or an institutional review board, as authorized in paragraphs (4) and (5). The approval shall include a review and determination that all the following criteria have been satisfied:
(A)The researcher has provided a plan sufficient to protect personal information from improper use and disclosures, including sufficient administrative, physical, and technical safeguards to protect personal information from reasonable anticipated threats to the security or confidentiality of the information.
(B)The researcher has provided a sufficient plan to destroy or return all personal information as soon as it is no longer needed for the research project, unless the researcher has demonstrated an ongoing need for the personal information for the research project and has provided a long-term plan sufficient to protect the confidentiality of that information.
(C)The researcher has provided sufficient written assurances that the personal information will not be reused or disclosed to any other person or entity, or used in any manner, not approved in the research protocol, except as required by law or for authorized oversight of the research project.
(2)The CPHS or institutional review board shall, at a minimum, accomplish all of the following as part of its review and approval of the research project for the purpose of protecting personal information held in agency databases:
(A)Determine whether the requested personal information is needed to conduct the research.
(B)Permit access to personal information only if it is needed for the research project.
(C)Permit access only to the minimum necessary personal information needed for the research project.
(D)Require the assignment of unique subject codes that are not derived from personal information in lieu of social security numbers if the research can still be conducted without social security numbers.
(E)If feasible, and if cost, time, and technical expertise permit, require the agency to conduct a portion of the data processing for the researcher to minimize the release of personal information.
(3)Reasonable costs to the agency associated with the agencys process of protecting personal information under the conditions of CPHS approval may be billed to the researcher, including, but not limited to, the agencys costs for conducting a portion of the data processing for the researcher, removing personal information, encrypting or otherwise securing personal information, or assigning subject codes.
(4)The CPHS may enter into written agreements to enable other institutional review boards to provide the data security approvals required by this subdivision, if the data security requirements set forth in this subdivision are satisfied.
(5)Pursuant to paragraph (4), the CPHS shall enter into a written agreement with the institutional review board established pursuant to former Section 49079.6 of the Education Code. The agreement shall authorize, commencing July 1, 2010, or the date upon which the written agreement is executed, whichever is later, that board to provide the data security approvals required by this subdivision, if the data security requirements set forth in this subdivision and the act specified in subdivision (a) of Section 49079.5 of the Education Code are satisfied.
(u)To an insurer if authorized by Chapter 5 (commencing with Section 10900) of Division 4 of the Vehicle Code.
(v)Pursuant to Section 450, 452, 8009, or 18396 of the Financial Code.
(w)For the sole purpose of participation in interstate data sharing of prescription drug monitoring program information pursuant to the California Uniform Controlled Substances Act (Division 10 (commencing with Section 11000) of the Health and Safety Code), if disclosure is limited to prescription drug monitoring program information.
This article does not require the disclosure of personal information to the individual to whom the information pertains if that information may otherwise be withheld as set forth in Section 1798.40.
SEC. 2.Section 11165 of the Health and Safety Code is amended to read:11165.(a)To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and Internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.
(b)The Department of Justice may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.
(c)(1)The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.
(2)(A)CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the Department of Justice, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the Department of Justice, for educational, peer review, statistical, or research purposes, if patient information, including any information that may identify the patient, is not compromised. Further, data disclosed to any individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to any third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The Department of Justice shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.
(B)Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.
(3)The Department of Justice shall, no later than July 1, 2020, adopt regulations regarding the access and use of the information within CURES. The Department of Justice shall consult with all stakeholders representing law enforcement agencies, the licensed prescriber and dispenser communities, and any other stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:
(A)The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.
(B)The purposes for which a health care practitioner may access information in CURES.
(C)The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation of a patient or health care practitioner, respectively. investigation.
(D)The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.
(4)Consistent with this subdivision, a health care practitioner otherwise eligible for access to CURES, or a pharmacist who is employed by a health insurer or health care service plan and is involved in accepting, denying, or adjusting a claim for health insurance policy benefits or health care service plan contract benefits related to controlled substances, may access CURES for purposes of reviewing a claim.(5)(4)In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and keep a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.
(d)For each prescription for a Schedule II, Schedule III, or Schedule IV controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, and 1308.14, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the Department of Justice as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed, in a format specified by the Department of Justice:
(1)Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.
(2)The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of any prescriber using the federal controlled substance registration number of a government-exempt facility. facility, if provided.
(3)Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.
(4)National Drug Code (NDC) number of the controlled substance dispensed.
(5)Quantity of the controlled substance dispensed.
(6)International Statistical Classification of Diseases, 9th revision (ICD-9) or 10th revision (ICD-10) Code, if available.
(7)Number of refills ordered.
(8)Whether the drug was dispensed as a refill of a prescription or as a first-time request.
(9)Date of origin of the prescription.
(10)Date of dispensing of the prescription.
(e)The Department of Justice may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. All prescriber and dispenser invitees shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.
(f)The Department of Justice shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).
(g)The Department of Justice may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.
(h)(1)The Department of Justice may enter into an agreement with any entity operating an interstate data sharing hub, or any agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information.
(2)Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the Department of Justice pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the Department of Justice for interstate data sharing of prescription drug monitoring program information.
(3)Any agreement entered into by the Department of Justice for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES complies and the handling of data contained within CURES comply with California law, including regulations, and meets meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.
(4)For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if he or she is registered and in good standing with that states prescription drug monitoring program.
(5)The Department of Justice shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).
SEC. 3.Section 11165.1 of the Health and Safety Code is amended to read:11165.1.(a)(1)(A)(i)A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, or Schedule IV controlled substances pursuant to Section 11150 shall, before July 1, 2016, or upon receipt of a federal Drug Enforcement Administration (DEA) registration, whichever occurs later, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to that practitioner the electronic history of controlled substances dispensed to an individual under his or her care, or for whom the practitioner is involved in accepting, denying, or adjusting a claim for health insurance policy benefits or health care service plan contract benefits related to controlled substances, based on data contained in the CURES Prescription Drug Monitoring Program (PDMP).(ii)A pharmacist shall, before July 1, 2016, or upon licensure, whichever occurs later, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to that pharmacist the electronic history of controlled substances dispensed to an individual under his or her care, or for whom the pharmacist is involved in accepting, denying, or adjusting a claim for health insurance policy benefits or health care service plan contract benefits related to controlled substances, based on data contained in the CURES PDMP.(B)An application may be denied, or a subscriber may be suspended, for reasons that include, but are not limited to, the following:(i)Materially falsifying an application to access information contained in the CURES database.(ii)Failing to maintain effective controls for access to the patient activity report.(iii)Having his or her federal DEA registration suspended or revoked.(iv)Violating a law governing controlled substances or any other law for which the possession or use of a controlled substance is an element of the crime.(v)Accessing information for a reason other than to diagnose or treat his or her patients, or to assess or ensure patient safety, or to make a determination regarding accepting, denying, or adjusting a claim for health insurance policy benefits or health care service plan contract benefits, or to document compliance with the law.(C)An authorized subscriber shall notify the department within 30 days of any changes to the subscriber account.(D)Commencing no later than October 1, 2018, an approved health care practitioner, pharmacist, and any person acting on behalf of a health care practitioner or pharmacist pursuant to subdivision (b) of Section 209 of the Business and Professions Code may use the departments online portal or a health information technology system that meets the criteria required in subparagraph (E) to access information in the CURES database pursuant to this section. A subscriber who uses a health information technology system that meets the criteria required in subparagraph (E) to access the CURES database may submit automated queries to the CURES database that are triggered by predetermined criteria.(E)Commencing no later than October 1, 2018, an approved health care practitioner or pharmacist may submit queries to the CURES database through a health information technology system if the entity that operates the health information technology system can certify all of the following:(i)The entity will not use or disclose data received from the CURES database for any purpose other than delivering the data to an approved health care practitioner or pharmacist or performing data processing activities that may be necessary to enable the delivery unless authorized by, and pursuant to, state and federal privacy and security laws and regulations.(ii)The health information technology system will authenticate the identity of an authorized health care practitioner or pharmacist initiating queries to the CURES database and, at the time of the query to the CURES database, the health information technology system submits the following data regarding the query to CURES:(I)The date of the query.(II)The time of the query.(III)The first and last name of the patient queried.(IV)The date of birth of the patient queried.(V)The identification of the CURES user for whom the system is making the query.(iii)The health information technology system meets applicable patient privacy and information security requirements of state and federal law.(iv)The entity has entered into a memorandum of understanding with the department that solely addresses the technical specifications of the health information technology system to ensure the security of the data in the CURES database and the secure transfer of data from the CURES database. The technical specifications shall be universal for all health information technology systems that establish a method of system integration to retrieve information from the CURES database. The memorandum of understanding shall not govern, or in any way impact or restrict, the use of data received from the CURES database or impose any additional burdens on covered entities in compliance with the regulations promulgated pursuant to the federal Health Insurance Portability and Accountability Act of 1996 found in Parts 160 and 164 of Title 45 of the Code of Federal Regulations.(F)No later than October 1, 2018, the department shall develop a programming interface or other method of system integration to allow health information technology systems that meet the requirements in subparagraph (E) to retrieve information in the CURES database on behalf of an authorized health care practitioner or pharmacist.(G)The department shall not access patient-identifiable information in an entitys health information technology system.(H)An entity that operates a health information technology system that is requesting to establish an integration with the CURES database shall pay a reasonable fee to cover the cost of establishing and maintaining integration with the CURES database.(I)The department may prohibit integration or terminate a health information technology systems ability to retrieve information in the CURES database if the health information technology system fails to meet the requirements of subparagraph (E), or the entity operating the health information technology system does not fulfill its obligation under subparagraph (H).(2)A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, or Schedule IV controlled substances pursuant to Section 11150 or a pharmacist shall be deemed to have complied with paragraph (1) if the licensed health care practitioner or pharmacist has been approved to access the CURES database through the process developed pursuant to subdivision (a) of Section 209 of the Business and Professions Code.(b)A request for, or release of, a controlled substance history pursuant to this section shall be made in accordance with guidelines developed by the department.(c)In order to prevent the inappropriate, improper, or illegal use of Schedule II, Schedule III, or Schedule IV controlled substances, the department may initiate the referral of the history of controlled substances dispensed to an individual based on data contained in CURES to licensed health care practitioners, pharmacists, or both, providing care or services to the individual, including services provided by a practitioner or pharmacist employed by a health insurer or health care service plan who reviews claims related to that individual.(d)The history of controlled substances dispensed to an individual based on data contained in CURES that is received by a practitioner or pharmacist from the department pursuant to this section is medical information subject to the provisions of the Confidentiality of Medical Information Act contained in Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code.(e)Information concerning a patients controlled substance history provided to a practitioner or pharmacist pursuant to this section shall include prescriptions for controlled substances listed in Sections 1308.12, 1308.13, and 1308.14 of Title 21 of the Code of Federal Regulations.(f)A health care practitioner, pharmacist, and any person acting on behalf of a health care practitioner or pharmacist, when acting with reasonable care and in good faith, is not subject to civil or administrative liability arising from any false, incomplete, inaccurate, or misattributed information submitted to, reported by, or relied upon in the CURES database or for any resulting failure of the CURES database to accurately or timely report that information.(g)For purposes of this section, the following terms have the following meanings:(1)Automated basis means using predefined criteria to trigger an automated query to the CURES database, which can be attributed to a specific health care practitioner or pharmacist.(2)Department means the Department of Justice.(3)Entity means an organization that operates, or provides or makes available, a health information technology system to a health care practitioner or pharmacist.(4)Health information technology system means an information processing application using hardware and software for the storage, retrieval, sharing of or use of patient data for communication, decisionmaking, coordination of care, or the quality, safety, or efficiency of the practice of medicine or delivery of health care services, including, but not limited to, electronic medical record applications, health information exchange systems, or other interoperable clinical or health care information system.(5)User-initiated basis means an authorized health care practitioner or pharmacist has taken an action to initiate the query to the CURES database, such as clicking a button, issuing a voice command, or taking some other action that can be attributed to a specific health care practitioner or pharmacist.An agency shall not disclose any personal information in a manner that would link the information disclosed to identify the individual to whom it pertains unless the information is disclosed, as follows:
(a)To the individual to whom the information pertains.
(b)With the prior written voluntary consent of the individual to whom the record information pertains, but only if that consent has been obtained not more than 30 days before the disclosure, or in the time limit agreed to by the individual in the written consent.
(c)To the duly appointed guardian or conservator of the individual or a person representing the individual if it can be proven with reasonable certainty through the possession of agency forms, documents documents, or correspondence that this person is the authorized representative of the individual to whom the information pertains.
(d)To those officers, employees, attorneys, agents, or volunteers of the agency that has custody of the information if the disclosure is relevant and necessary in the ordinary course of the performance of their official duties and is related to the purpose for which the information was acquired.
(e)To a person, or to another agency where if the transfer is necessary for the transferee agency to perform its constitutional or statutory duties, and the use is compatible with a purpose for which the information was collected and the use or transfer is accounted for in accordance with Section 1798.25. With respect to information transferred from a law enforcement or regulatory agency, or information transferred to another law enforcement or regulatory agency, a use is compatible if the use of the information requested is needed in an investigation of unlawful activity under the jurisdiction of the requesting agency or for licensing, certification, or regulatory purposes by that agency.
(f)To a governmental entity when if required by state or federal law.
(g)Pursuant to the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1 of the Government Code).
(h)To a person who has provided the agency with advance, adequate written assurance that the information will be used solely for statistical research or reporting purposes, but only if the information to be disclosed is in a form that will not identify any individual.
(i)Pursuant to a determination by the agency that maintains information that compelling circumstances exist that affect the health or safety of an individual, if upon the disclosure notification is transmitted to the individual to whom the information pertains at his or her last known address. Disclosure shall not be made if it is in conflict with other state or federal laws.
(j)To the State Archives as a record that has sufficient historical or other value to warrant its continued preservation by the California state government, or for evaluation by the Director of General Services or his or her designee to determine whether the record has further administrative, legal, or fiscal value.
(k)To any person pursuant to a subpoena, court order, or other compulsory legal process if, before the disclosure, the agency reasonably attempts to notify the individual to whom the record pertains, and if the notification is not prohibited by law.
(l)To any person pursuant to a search warrant.
(m)Pursuant to Article 3 (commencing with Section 1800) of Chapter 1 of Division 2 of the Vehicle Code.
(n)For the sole purpose of verifying and paying government health care service claims made pursuant to Division 9 (commencing with Section 10000) of the Welfare and Institutions Code.
(o)To a law enforcement or regulatory agency when required for an investigation of unlawful activity or for licensing, certification, or regulatory purposes, unless the disclosure is otherwise prohibited by law.
(p)To another person or governmental organization to the extent necessary to obtain information from the person or governmental organization as necessary for an investigation by the agency of a failure to comply with a specific state law that the agency is responsible for enforcing.
(q)To an adopted person and is limited to general background information pertaining to the adopted persons natural biological parents, provided that if the information does not include or reveal the identity of the natural biological parents.
(r)To a child or a grandchild of an adopted person and disclosure is limited to medically necessary information pertaining to the adopted persons natural biological parents. However, the information, or the process for obtaining the information, shall not include or reveal the identity of the natural biological parents. The State Department of Social Services shall adopt regulations governing the release of information pursuant to this subdivision by July 1, 1985. subdivision. The regulations shall require licensed adoption agencies to provide the same services provided by the department as established by this subdivision.
(s)To a committee of the Legislature or to a Member of the Legislature, or his or her staff when if authorized in writing by the member, where if the member has permission to obtain the information from the individual to whom it pertains or where if the member provides reasonable assurance that he or she is acting on behalf of the individual.
(t)(1)To the University of California, a nonprofit educational institution, or, in the case of education-related data, another nonprofit entity, conducting scientific research, provided if the request for information is approved by the Committee for the Protection of Human Subjects (CPHS) for the California Health and Human Services Agency (CHHSA) or an institutional review board, as authorized in paragraphs (4) and (5). The approval required under this subdivision shall include a review and determination that all the following criteria have been satisfied:
(A)The researcher has provided a plan sufficient to protect personal information from improper use and disclosures, including sufficient administrative, physical, and technical safeguards to protect personal information from reasonable anticipated threats to the security or confidentiality of the information.
(B)The researcher has provided a sufficient plan to destroy or return all personal information as soon as it is no longer needed for the research project, unless the researcher has demonstrated an ongoing need for the personal information for the research project and has provided a long-term plan sufficient to protect the confidentiality of that information.
(C)The researcher has provided sufficient written assurances that the personal information will not be reused or disclosed to any other person or entity, or used in any manner, not approved in the research protocol, except as required by law or for authorized oversight of the research project.
(2)The CPHS or institutional review board shall, at a minimum, accomplish all of the following as part of its review and approval of the research project for the purpose of protecting personal information held in agency databases:
(A)Determine whether the requested personal information is needed to conduct the research.
(B)Permit access to personal information only if it is needed for the research project.
(C)Permit access only to the minimum necessary personal information needed for the research project.
(D)Require the assignment of unique subject codes that are not derived from personal information in lieu of social security numbers if the research can still be conducted without social security numbers.
(E)If feasible, and if cost, time, and technical expertise permit, require the agency to conduct a portion of the data processing for the researcher to minimize the release of personal information.
(3)Reasonable costs to the agency associated with the agencys process of protecting personal information under the conditions of CPHS approval may be billed to the researcher, including, but not limited to, the agencys costs for conducting a portion of the data processing for the researcher, removing personal information, encrypting or otherwise securing personal information, or assigning subject codes.
(4)The CPHS may enter into written agreements to enable other institutional review boards to provide the data security approvals required by this subdivision, provided if the data security requirements set forth in this subdivision are satisfied.
(5)Pursuant to paragraph (4), the CPHS shall enter into a written agreement with the institutional review board established pursuant to former Section 49079.5 49079.6 of the Education Code. The agreement shall authorize, commencing July 1, 2010, or the date upon which the written agreement is executed, whichever is later, that board to provide the data security approvals required by this subdivision, provided if the data security requirements set forth in this subdivision and the act specified in paragraph (1) of subdivision (a) of Section 49079.5 of the Education Code are satisfied.
(u)To an insurer if authorized by Chapter 5 (commencing with Section 10900) of Division 4 of the Vehicle Code.
(v)Pursuant to Section 450, 452, 8009, or 18396 of the Financial Code.
(w)For the sole purpose of participation in interstate data sharing of prescription drug monitoring program information pursuant to the California Uniform Controlled Substances Act (Division 10 (commencing with Section 11000) of the Health and Safety Code), if disclosure is limited to prescription drug monitoring program information.
This article shall does not be construed to require the disclosure of personal information to the individual to whom the information pertains when if that information may otherwise be withheld as set forth in Section 1798.40.
SECTION 1.SEC. 2.Section 11165 of the Health and Safety Code is amended to read:11165.(a)To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and Internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.
(b)The Department of Justice may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.
(c)(1)The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.
(2)(A)CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the Department of Justice, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the Department of Justice, for educational, peer review, statistical, or research purposes, provided that if patient information, including any information that may identify the patient, is not compromised. Further, data disclosed to any individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to any third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The Department of Justice shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.
(B)Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.
(3)The Department of Justice shall, no later than July 1, 2020, adopt regulations regarding the access and use of the information within CURES. The Department of Justice shall consult with stakeholders representing law enforcement agencies, the licensed prescriber and dispenser communities, and any other stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:
(A)The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.
(B)The purposes for which a health care practitioner may access information in CURES.
(C)The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation of a patient or health care practitioner, respectively.
(D)The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.
(4)Consistent with this subdivision, a health care practitioner otherwise eligible for access to CURES, or a pharmacist who is employed by a health insurer or health care service plan and is involved in accepting, denying, or adjusting a claim for health insurance policy benefits or health care service plan contract benefits related to controlled substances, may access CURES for purposes of reviewing a claim.
(3)(5)In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data is are provided and keep a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.
(d)For each prescription for a Schedule II, Schedule III, or Schedule IV controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, and 1308.14, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the Department of Justice as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed, in a format specified by the Department of Justice:
(1)Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.
(2)The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of any prescriber using the federal controlled substance registration number of a government-exempt facility.
(3)Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.
(4)National Drug Code (NDC) number of the controlled substance dispensed.
(5)Quantity of the controlled substance dispensed.
(6)International Statistical Classification of Diseases, 9th revision (ICD-9) or 10th revision (ICD-10) Code, if available.
(7)Number of refills ordered.
(8)Whether the drug was dispensed as a refill of a prescription or as a first-time request.
(9)Date of origin of the prescription.
(10)Date of dispensing of the prescription.
(e)The Department of Justice may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. All prescriber and dispenser invitees shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.
(f)The Department of Justice shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).
(g)The Department of Justice may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.
(h)(1)The Department of Justice may enter into an agreement with an any entity operating an interstate data share hub for purposes of participating in interjurisdictional information sharing between prescription drug monitoring programs across state lines. sharing hub, or any agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information.
(2)Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the Department of Justice pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the Department of Justice for interstate data sharing of prescription drug monitoring program information.
(2)(3)Any agreement entered into by the Department of Justice for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data within obtained from CURES complies with California law law, including regulations, and meets the same patient privacy privacy, audit, and data security standards employed and required for direct access of to CURES.
(4)For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if he or she is registered and in good standing with that states prescription drug monitoring program.
(5)The Department of Justice shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).
SEC. 3.Section 11165.1 of the Health and Safety Code is amended to read:11165.1.(a)(1)(A)(i)A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, or Schedule IV controlled substances pursuant to Section 11150 shall, before July 1, 2016, or upon receipt of a federal Drug Enforcement Administration (DEA) registration, whichever occurs later, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to that practitioner the electronic history of controlled substances dispensed to an individual under his or her care care, or for whom the practitioner is involved in accepting, denying, or adjusting a claim for health insurance policy benefits or health care service plan contract benefits related to controlled substances, based on data contained in the CURES Prescription Drug Monitoring Program (PDMP).
(ii)A pharmacist shall, before July 1, 2016, or upon licensure, whichever occurs later, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to that pharmacist the electronic history of controlled substances dispensed to an individual under his or her care care, or for whom the pharmacist is involved in accepting, denying, or adjusting a claim for health insurance policy benefits or health care service plan contract benefits related to controlled substances, based on data contained in the CURES PDMP.
(B)An application may be denied, or a subscriber may be suspended, for reasons which that include, but are not limited to, the following:
(i)Materially falsifying an application to access information contained in the CURES database.
(ii)Failing to maintain effective controls for access to the patient activity report.
(iii)Having his or her federal DEA registration suspended or revoked.
(iv)Violating a law governing controlled substances or any other law for which the possession or use of a controlled substance is an element of the crime.
(v)Accessing information for a reason other than to diagnose or treat his or her patients, or to assess or ensure patient safety, or to make a determination regarding accepting, denying, or adjusting a claim for health insurance policy benefits or health care service plan contract benefits, or to document compliance with the law.
(C)An authorized subscriber shall notify the department within 30 days of any changes to the subscriber account.
(D)Commencing no later than October 1, 2018, an approved health care practitioner, pharmacist, and any person acting on behalf of a health care practitioner or pharmacist pursuant to subdivision (b) of Section 209 of the Business and Professions Code may use the departments online portal or a health information technology system that meets the criteria required in subparagraph (E) to access information in the CURES database pursuant to this section. A subscriber who uses a health information technology system that meets the criteria required in subparagraph (E) to access the CURES database may submit automated queries to the CURES database that are triggered by predetermined criteria.
(E)Commencing no later than October 1, 2018, an approved health care practitioner or pharmacist may submit queries to the CURES database through a health information technology system if the entity that operates the health information technology system can certify all of the following:
(i)The entity will not use or disclose data received from the CURES database for any purpose other than delivering the data to an approved health care practitioner or pharmacist or performing data processing activities that may be necessary to enable the delivery unless authorized by, and pursuant to, state and federal privacy and security laws and regulations.
(ii)The health information technology system will authenticate the identity of an authorized health care practitioner or pharmacist initiating queries to the CURES database and, at the time of the query to the CURES database, the health information technology system submits the following data regarding the query to CURES:
(I)The date of the query.
(II)The time of the query.
(III)The first and last name of the patient queried.
(IV)The date of birth of the patient queried.
(V)The identification of the CURES user for whom the system is making the query.
(iii)The health information technology system meets applicable patient privacy and information security requirements of state and federal law.
(iv)The entity has entered into a memorandum of understanding with the department that solely addresses the technical specifications of the health information technology system to ensure the security of the data in the CURES database and the secure transfer of data from the CURES database. The technical specifications shall be universal for all health information technology systems that establish a method of system integration to retrieve information from the CURES database. The memorandum of understanding shall not govern, or in any way impact or restrict, the use of data received from the CURES database or impose any additional burdens on covered entities in compliance with the regulations promulgated pursuant to the federal Health Insurance Portability and Accountability Act of 1996 found in Parts 160 and 164 of Title 45 of the Code of Federal Regulations.
(F)No later than October 1, 2018, the department shall develop a programming interface or other method of system integration to allow health information technology systems that meet the requirements in subparagraph (E) to retrieve information in the CURES database on behalf of an authorized health care practitioner or pharmacist.
(G)The department shall not access patient-identifiable information in an entitys health information technology system.
(H)An entity that operates a health information technology system that is requesting to establish an integration with the CURES database shall pay a reasonable fee to cover the cost of establishing and maintaining integration with the CURES database.
(I)The department may prohibit integration or terminate a health information technology systems ability to retrieve information in the CURES database if the health information technology system fails to meet the requirements of subparagraph (E), or the entity operating the health information technology system does not fulfill its obligation under subparagraph (H).
(2)A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, or Schedule IV controlled substances pursuant to Section 11150 or a pharmacist shall be deemed to have complied with paragraph (1) if the licensed health care practitioner or pharmacist has been approved to access the CURES database through the process developed pursuant to subdivision (a) of Section 209 of the Business and Professions Code.
(b)A request for, or release of, a controlled substance history pursuant to this section shall be made in accordance with guidelines developed by the department.
(c)In order to prevent the inappropriate, improper, or illegal use of Schedule II, Schedule III, or Schedule IV controlled substances, the department may initiate the referral of the history of controlled substances dispensed to an individual based on data contained in CURES to licensed health care practitioners, pharmacists, or both, providing care or services to the individual. individual, including services provided by a practitioner or pharmacist employed by a health insurer or health care service plan who reviews claims related to that individual.
(d)The history of controlled substances dispensed to an individual based on data contained in CURES that is received by a practitioner or pharmacist from the department pursuant to this section is medical information subject to the provisions of the Confidentiality of Medical Information Act contained in Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code.
(e)Information concerning a patients controlled substance history provided to a practitioner or pharmacist pursuant to this section shall include prescriptions for controlled substances listed in Sections 1308.12, 1308.13, and 1308.14 of Title 21 of the Code of Federal Regulations.
(f)A health care practitioner, pharmacist, and any person acting on behalf of a health care practitioner or pharmacist, when acting with reasonable care and in good faith, is not subject to civil or administrative liability arising from any false, incomplete, inaccurate, or misattributed information submitted to, reported by, or relied upon in the CURES database or for any resulting failure of the CURES database to accurately or timely report that information.
(g)For purposes of this section, the following terms have the following meanings:
(1)Automated basis means using predefined criteria to trigger an automated query to the CURES database, which can be attributed to a specific health care practitioner or pharmacist.
(2)Department means the Department of Justice.
(3)Entity means an organization that operates, or provides or makes available, a health information technology system to a health care practitioner or pharmacist.
(4)Health information technology system means an information processing application using hardware and software for the storage, retrieval, sharing of or use of patient data for communication, decisionmaking, coordination of care, or the quality, safety, or efficiency of the practice of medicine or delivery of health care services, including, but not limited to, electronic medical record applications, health information exchange systems, or other interoperable clinical or health care information system.
(5)User-initiated basis means an authorized health care practitioner or pharmacist has taken an action to initiate the query to the CURES database, such as clicking a button, issuing a voice command, or taking some other action that can be attributed to a specific health care practitioner or pharmacist.
(a)To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and Internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.
(b)The Department of Justice may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.
(c)(1)The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.
(2)(A)CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the Department of Justice, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the Department of Justice, for educational, peer review, statistical, or research purposes, provided that patient information, including any information that may identify the patient, is not compromised. Further, data disclosed to any individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to any third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The Department of Justice shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.
(B)Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.
(3)In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data is provided and keep a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.
(d)For each prescription for a Schedule II, Schedule III, or Schedule IV controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, and 1308.14, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the Department of Justice as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed, in a format specified by the Department of Justice:
(1)Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.
(2)The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of any prescriber using the federal controlled substance registration number of a government-exempt facility.
(3)Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.
(4)National Drug Code (NDC) number of the controlled substance dispensed.
(5)Quantity of the controlled substance dispensed.
(6)International Statistical Classification of Diseases, 9th revision (ICD-9) or 10th revision (ICD-10) Code, if available.
(7)Number of refills ordered.
(8)Whether the drug was dispensed as a refill of a prescription or as a first-time request.
(9)Date of origin of the prescription.
(10)Date of dispensing of the prescription.
(e)The Department of Justice may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. All prescriber and dispenser invitees shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.
(f)The Department of Justice shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).
(g)The Department of Justice may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.
(h)(1)The Department of Justice may enter into an agreement with an entity operating an interstate data share hub for purposes of participating in interjurisdictional information sharing between prescription drug monitoring programs across state lines.
(2)Any agreement entered into by the Department of Justice for purposes of interstate data sharing shall ensure that all access to data within CURES complies with California law and meets the same patient privacy and data security standards employed and required for direct access of CURES.
|
Date
|
Status
|
|---|---|
| Sep 18, 2018 | Chaptered by Secretary of State - Chapter 478, Statutes of 2018. |
| Sep 18, 2018 | Approved by the Governor. |
| Sep 10, 2018 | Enrolled and presented to the Governor at 3:30 p.m. |
| Aug 30, 2018 | Senate amendments concurred in. To Engrossing and Enrolling. |
| Aug 29, 2018 | In Assembly. Concurrence in Senate amendments pending. |
| Aug 29, 2018 | Read third time. Passed. Ordered to the Assembly. |
| Aug 27, 2018 | Read second time. Ordered to third reading. |
| Aug 24, 2018 | Read third time and amended. Ordered to second reading. |
| Aug 20, 2018 | Read second time. Ordered to third reading. |
| Aug 17, 2018 | From committee: Amend, and do pass as amended. (Ayes 7. Noes 0.) (August 16). |
| Aug 6, 2018 | In committee: Referred to APPR. suspense file. |
| Jul 5, 2018 | Read second time and amended. Re-referred to Com. on APPR. |
| Jul 3, 2018 | From committee: Amend, and do pass as amended and re-refer to Com. on APPR. (Ayes 7. Noes 0.) (June 26). |
| Jun 19, 2018 | From committee: Do pass and re-refer to Com. on PUB. S. (Ayes 8. Noes 0.) (June 18). Re-referred to Com. on PUB. S. |
| Jun 7, 2018 | Referred to Coms. on B., P. & E.D. and PUB. S. |
| May 30, 2018 | In Senate. Read first time. To Com. on RLS. for assignment. |
| May 29, 2018 | Read third time. Passed. Ordered to the Senate. |
| May 25, 2018 | From committee: Do pass. (Ayes 16. Noes 0.) (May 25). |
| May 2, 2018 | In committee: Set, first hearing. Referred to APPR. suspense file. |
| Apr 25, 2018 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 6. Noes 0.) (April 24). Re-referred to Com. on APPR. |
| Apr 10, 2018 | From committee: Do pass and re-refer to Com. on PUB. S. (Ayes 16. Noes 0.) (April 10). Re-referred to Com. on PUB. S. |
| Jan 16, 2018 | Referred to Coms. on B. & P. and PUB. S. |
| Jan 4, 2018 | From printer. May be heard in committee February 3. |
| Jan 3, 2018 | Read first time. To print. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Aug 30, 2018 | AB 1751 LOW Concurrence in Senate Amendments | Assembly Floor |
Passed |
|
| Aug 29, 2018 | Assembly 3rd Reading AB1751 Low By Bates | Senate Floor |
Passed |
|
| Aug 16, 2018 | Do pass as amended | Senate Standing Committee on Appropriations |
Passed |
|
| Aug 6, 2018 | Placed on suspense file | Senate Standing Committee on Appropriations |
Passed |
|
| Jun 26, 2018 | Do pass as amended, but first amend, and re-refer to the Committee on [Appropriations] | Senate Standing Committee on Public Safety |
Passed |
|
| Jun 18, 2018 | Do pass, but first be re-referred to the Committee on [Public Safety] | Senate Standing Committee on Business, Professions and Economic Development |
Passed |
|
| May 29, 2018 | AB 1751 LOW Assembly Third Reading | Assembly Floor |
Passed |
|
| May 25, 2018 | Do pass. | Assembly Standing Committee on Appropriations |
Passed |
|
| Apr 24, 2018 | Do pass and be re-referred to the Committee on [Appropriations] | Assembly Standing Committee on Public Safety |
Passed |
|
| Apr 10, 2018 | Do pass and be re-referred to the Committee on [Public Safety] | Assembly Standing Committee on Business and Professions |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| According To The California Medical Association: | ** Against | Jun 25, 2018 |
| America'S Physician Groups | ** Support | Aug 27, 2018 |
| American Civil Liberties Union | ** Against | Aug 27, 2018 |
| Argument In Support | ** Against | Jun 25, 2018 |
| Assembly Floor Vote: 75 - 0 | ** Against | Jun 25, 2018 |
| Assembly Floor: 75-0, 5 | ** Against | Aug 27, 2018 |
| Association of Deputy District Attorneys | * Support | Jun 18, 2018 |
| Biocom | ** Support | Aug 27, 2018 |
| Blue Shield Of California | * Support | Apr 24, 2018 |
| California Academy Of Family Physicians | * Against Unless Amend | Jun 18, 2018 |
| California Association Of Code Enforcement Officers | * Support | Jun 18, 2018 |
| California Association Of Health Underwriters | ** Support | Aug 27, 2018 |
| California Board of Pharmacy | * Support | Apr 24, 2018 |
| California Chiropractic Association | ** Support | Aug 27, 2018 |
| California College And University Police Chiefs Association | * Support | Jun 18, 2018 |
| California College and University Policy Chiefs Association | ** Support | Jun 15, 2018 |
| California Dental Association | ** Support | Aug 27, 2018 |
| California District Attorneys Association | ** Support | Aug 27, 2018 |
| California Life Sciences Association | * Support | Jun 18, 2018 |
| California Narcotic Officers Association | * Support | Jun 18, 2018 |
| California Pharmacists Association | ** Support | Aug 27, 2018 |
| California Physical Therapy Association | * Support | Apr 10, 2018 |
| California Police Chiefs Association | ** Support | Aug 27, 2018 |
| California Privacy Law | ** Against | Jun 25, 2018 |
| California Society Of Anesthesiologists | * Support | Jun 18, 2018 |
| California Society Of Health-System Pharmacists | ** Support | Apr 23, 2018 |
| California State Board of Pharmacy | ** Support | Aug 27, 2018 |
| California State Sheriffs' Association | ** Support | Aug 27, 2018 |
| CaliforniaHealth+ Advocates | ** Support | Jun 15, 2018 |
| Consumer Attorneys Of California | ** Support | Aug 27, 2018 |
| Consumer Watchdog | * Support | Jun 18, 2018 |
| County Behavioral Health Directors Association | * Support | Jun 18, 2018 |
| County Behavioral Health Directors Association of California | ** Support | Jun 15, 2018 |
| County Health Executives Association Of California | ** Support | Aug 27, 2018 |
| Double-Referral To Senate Public Safety Committee, Second. | ** Support | Jun 15, 2018 |
| Drugoverdose | ** Against | Jun 25, 2018 |
| Electronic Frontier Foundation | ** Against | Aug 27, 2018 |
| Initiatives | ** Against | Jun 25, 2018 |
| Kaiser Permanente | ** Support | Aug 27, 2018 |
| Los Angeles County Professional Peace Officers Association | * Support | Jun 18, 2018 |
| Medical Board of California | ** Support | Aug 27, 2018 |
| Nabp.Pharmacy | ** Against | Jun 25, 2018 |
| Need For This Bill | ** Against | Jun 25, 2018 |
| No Vote Recorded: Kamlager-Dove, Mathis, Quirk | ** Against | Aug 27, 2018 |
| Note: | ** Support | Jun 15, 2018 |
| OCHIN | ** Support | Aug 27, 2018 |
| Pdmp | ** Against | Jun 25, 2018 |
| Pmp-Interconnect | ** Against | Jun 25, 2018 |
| Prescription Drug Monitoring Programs | ** Against | Jun 25, 2018 |
| PURPOSE | ** Against | Jun 25, 2018 |
| San Diego County District Attorney Summer Stephan | ** Support | Aug 27, 2018 |
| Shatterproof | * Support | Apr 24, 2018 |
| Support And Opposition: | ** Support | Jun 15, 2018 |
| troy and alana pack foundation | ** Support | Aug 27, 2018 |
| Weideman Group Inc | * Support | Apr 10, 2018 |
| Www.Cdc.Gov | ** Against | Jun 25, 2018 |
CONCURRENCE IN SENATE AMENDMENTS
CSA1 Bill Id:AB 1751
Author:(Low)
As Amended Ver:August 24, 2018
Majority vote
ASSEMBLY: | 75-0 | (May 29, 2018) | SENATE: | 38-0 | (August 29, 2018) |
Original Committee Reference: B. & P.
SUMMARY: Authorizes the California Department of Justice (DOJ) to share prescription records between the state's prescription drug monitoring program (PDMP), Controlled Substance Utilization Review and Evaluation System (CURES), and other databases across state lines, with a requirement that other states meet California's patient privacy and data security standards.
The Senate amendments:
- Require the DOJ to, no later than July 1, 2020, memorialize its policies regarding the access and use of the information within CURES through the public rulemaking process, which must among other things include regulations dictating when a warrant is required for searches of the system as part of a criminal investigation.
- Allows the DOJ to enter into a datasharing agreement directly with another state's PDMP without going through a data share hub.
- Delays implementation of the bill until the required regulations are final.
- Make necessary changes to the Information Practices Act to authorize datasharing.
- Add chaptering language to avoid conflicts with changes made in AB 1753 (Low) of the current legislative session.
EXISTING LAW:
- Establishes the Controlled Substance Utilization Review and Evaluation System (CURES), a PDMP maintained by the DOJ for the purposes of collecting records of dispensed controlled substances for review by licensed prescribers and dispensers, regulatory investigators, law enforcement, and statistical researchers. (Health and Safety Code Section (HSC) 11165(a))
- Requires pharmacists and other dispensers to report information to CURES within seven days relating to prescriptions of Schedule II, III, and IV controlled substances. (HSC 11165(d))
- Requires health care practitioners in receipt of a federal Drug Enforcement Administration (DEA) certificate providing authorization to prescribe controlled substances, as well as pharmacists, to register for access to the CURES database. (HSC 11165.1(a))
- Beginning October 2, 2018, requires certain health care practitioners to consult the CURES database to review a patient's controlled substance history before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every four months thereafter if the substance remains part of the treatment of the patient, with certain exceptions. (HSC 11165.4)
- Requires the DOJ to upgrade CURES to allow health information technology systems that meet certain patient privacy and data security requirements to interoperate with the database, allowing prescribers and dispensers to make queries through their electronic health record applications. (HSC 11165.1)
- Provides dedicated funding for the CURES program through an annual license fee of $6 assessed for licensees authorized to prescribe or dispense controlled substances in California. (Business and Professions Code (BPC) 208)
- Authorizes the DOJ to seek voluntarily contributed private funds from insurers, health care service plans, qualified manufacturers, and other donors for the purpose of supporting CURES. (HSC 11165.5)
- Allows the DOJ to conduct audits of CURES and its users and issue citations and fines for system misuse. (HSC 11165.2)
- Requires the CURES database to comply with all applicable federal and state privacy and security laws and regulations and requires the DOJ to establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES. (HSC 11165(c))
FISCAL EFFECT: According to the Senate Committee on Appropriations, one-time costs of $516,000 and $2.5 million ongoing for increased administrative workload to promulgate regulations, develop and maintain an interstate data sharing agreement, increase legal workload for out-of-state cases, to responding to public inquiries and provide technical assistance to users, and for costs for IT analysis, design, and infrastructure. However, Appropriations staff noted that costs for the bill could decrease, depending on how the DOJ implements the bill and engages with other states and their relevant data sharing hubs.
COMMENTS:
Purpose. This bill is sponsored by the author. According to the author:
As the opioid crisis receives growing national attention as one of the most devastating public health epidemics in modern history, California is fortunate to have CURES, a powerful tool to promote safe prescribing and curb illicit doctor-shopping. With the Attorney General's successful launch of a state-of-the-art 'CURES 2.0' prescription drug monitoring program, it is now the Legislature's imperative to identify ways to further empower data-driven solutions to preventing prescription drug abuse and diversion. Upgrading CURES to allow the DOJ to enter into interstate data sharing agreements will provide invaluable cross-jurisdictional information to health professionals seeking to make informed decisions on behalf of their patients, particularly those practicing in communities neighboring other states.
Background. CURES Database. CURES was first established in 1996 as a “technologically sophisticated” database currently containing records of all Schedule II-IV drug prescriptions dispensed within the state. In 2013, the Attorney General sponsored legislation to overhaul the database with revenue newly derived from a license fee for healing arts professionals. The resulting system, commonly referred to as “CURES 2.0,” is considered to be a significantly improved, state-of-the-art tool for addressing the abuse and diversion of opioids and other prescription drugs.
Every dispenser of controlled substances and every health practitioner authorized by the DEA to prescribe controlled substances is required to obtain a login for access to CURES. For each dispensed Schedule II, III, or IV drug, pharmacists are required to report basic information about the patient and their prescription within seven days. This information is then made available to other system users in a variety of possible contexts. For example, physicians may query a patient's prescription history prior to writing a new prescription; pharmacists can check the system before agreeing to fill a prescription for a controlled substance; regulators may review a licensee's prescribing practices as part of a disciplinary investigation; and law enforcement can incorporate a search of the system into a potential criminal case of drug diversion.
Over 50 million prescription records have been uploaded into the system by dispensing pharmacists since the beginning of the CURES program. As of January 1, 2018, 170,422 users had been approved for access to the system. Last year, close to 10 million activity reports had been processed by practitioners, pharmacists, law enforcement, and regulatory users. The vast majority of these searches (over 99%) were queries made by prescribers and dispensers seeking to review a patient's prescription history as a component of exercising informed clinical judgment before providing access to opioids or other controlled substances.
Beginning October 2, 2018, health practitioners will be required to consult the CURES database prior to writing a prescription for a Schedule II, III, or IV drug for the first time, and then at least once every four months as long as the prescription continues to be renewed. Other recently enacted statutes require the DOJ to facilitate interoperability between health information technology systems and the CURES database, subject to a memorandum of understanding setting minimum security and privacy requirements. As attention to the opioid crisis continues to grow, PDMPs are regularly mentioned as powerful tools for curbing the abuse of prescription drugs.
Interstate PDMP Datasharing. Currently, the CURES database only contains information related to prescriptions dispensed within California. This means that when a health practitioner consults a patient's prescription history prior to writing a new prescription, information relating to prescriptions written in other states are not reflected in the activity report. For true “doctor shoppers,” traveling across state lines to secure prescriptions of opioids is not uncommon. This is especially true in communities located near California's borders.
49 states including California and the District of Columbia currently have a PDMP. (Missouri has begun creating a PDMP pursuant to executive order in July of 2017.) Many of these states already participate in one of several interstate data share hubs that allow for the exchange of prescription information. For example, the National Association of Boards of Pharmacy administers PMP InterConnect, a technology solution developed in partnership with Appriss Health that currently connects 46 state PDMPs, including Nevada, Oregon, and Arizona. Another interstate data share hub, RxCheck, is operated by the federal Bureau of Justice Assistant using Prescription Monitoring Information Exchange National Architecture specifications developed by a PDMP Training and Technical Assistance Center housed within Brandeis University. These examples are in addition to other interstate data share hubs available, and additional health technology vendors will likely develop interconnection solutions as the importance of PDMPs continues to be recognized.
The provisions of this bill do not dictate that any current or prospective interstate data share hub be utilized for purposes of enabling CURES to exchange information with other PDMPs. The DOJ would retain the discretion to determine what entity to contract with for purposes of providing interjurisdictional prescription information sharing. This bill does, however, contain a requirement that any agreement entered into by the DOJ include language ensuring that all access to CURES data through the data share hub meet the same patient privacy and data security standards that apply for direct access to CURES under California law.
Access to CURES is limited by a number of state and federal privacy laws. This includes the Health Insurance Portability and Accountability Act (HIPAA), the California Medical Information Act, and the Information Practices Act. Whether law enforcement use of the system implicates the Fourth Amendment's protections against unreasonable searches remains a topic of debate. In 2017, the Supreme Court of California ruled in Lewis v. Superior Court that privacy interests are justified by the state's interest in preventing drug diversion and protecting patients.
Amendments to this bill would require the Attorney General to engage in rulemaking to formally establish policies regarding access to CURES by various user types. The required regulations would include policies as to when a warrant is required to access the system as part of a criminal investigation. The requirement that the Attorney General promulgate regulations was added to this bill in response to stakeholder concerns that California's patient privacy and data security policies for CURES have not been sufficiently subjected to public input or adequately memorialized to hold up as a standard for other states accessing data in CURES. This bill's datasharing provisions would be delayed until these regulations are complete.
Analysis Prepared by: Robert Sumner / B. & P. / (916) 319-3301 FN: 0005154
Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | AB |
THIRD READING
Bill No: AB 1751
:
SENATE BUS., PROF. & ECON. DEV. COMMITTEE: 8-0, 6/18/18
AYES: Hill, Fuller, Allen, Dodd, Galgiani, Glazer, Hernandez, Wilk
NO VOTE RECORDED: Pan
SENATE PUBLIC SAFETY COMMITTEE: 7-0, 6/26/18
AYES: Skinner, Anderson, Bradford, Jackson, Mitchell, Stone, Wiener
SENATE APPROPRIATIONS COMMITTEE: 7-0, 8/16/18
AYES: Portantino, Bates, Beall, Bradford, Hill, Nielsen, Wiener
ASSEMBLY FLOOR: 75-0, 5/29/18 - See last page for vote
SUBJECT: Controlled substances: CURES database
DIGEST:
This bill provides a framework for the Controlled Substances Utilization Review and Evaluation System (CURES) to connect with other states that comply with California’s patient privacy and data security standards.
Senate Floor Amendments of 8/24/18 resolve chaptering conflicts with AB 1753 (Low).
Existing law:
- Establishes CURES for the electronic monitoring of Schedule II, III and IV controlled substance prescriptions. CURES provides for the electronic transmission of Schedule II, III and IV controlled substance prescription information to the Department of Justice (DOJ) no more than seven days from the time prescriptions are dispensed. (HSC § 11165)
- States that the purpose of CURES is to assist law enforcement and regulatory agencies in controlling diversion and abuse of Schedule II, III and IV controlled substances and for statistical analysis, education and research. (HSC § 11165 (a))
- Establishes privacy protections for patient data and specifies that the operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations. Specifies that CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Specifies that data obtained from CURES can only be accessed by appropriate state, local and federal persons or public agencies for disciplinary, civil or criminal actions. Specifies that CURES data shall also only be provided, as determined by DOJ, to other agencies or entities for educating practitioners and others, in lieu of disciplinary, civil or criminal actions. Authorizes non-identifying CURES data to be provided to public and private entities for education, research, peer review and statistical analysis. Requires DOJ to establish policies, procedures and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES. (HSC § 11165 (c) (1) and (c) (2) (A))
This bill:
- Requires DOJ, no later than July 1, 2020, to adopt regulations regarding the access and use of the information within CURES. Requires DOJ to consult with all stakeholders identified during the rulemaking process. Requires the regulations to address:
- The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.
- The purposes for which a health care practitioner may access information in CURES.
- The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.
- The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.
- Authorizes DOJ to enter into an agreement with an entity operating an interstate data share hub for purposes of participating in interjurisdictional information sharing between prescription drug monitoring programs across state lines.
- Requires any agreement entered into by DOJ for purposes of interstate data sharing to ensure that all access to data within CURES, and handling of CURES data, complies with California law and meets the same patient privacy and data security standards employed and required for direct access of CURES.
Background
CURES currently only contains information related to prescriptions dispensed within California. This means that when a health practitioner consults a patient’s prescription history prior to writing a new prescription, information relating to prescriptions written in other states are not reflected in the activity report. For true “doctor shoppers,” traveling across state lines to secure prescriptions of opioids is not uncommon. This is especially true in communities located near California’s borders.
Forty-nine states, including California and the District of Columbia, currently have a prescription drug monitoring program (PDMP). (Missouri has begun creating a PDMP pursuant to executive order in July of 2017.) Many of these states already participate in one of several interstate data share hubs that allow for the exchange of prescription information. For example, the National Association of Boards of Pharmacy administers PMP InterConnect, a technology solution developed in partnership with Appriss Health that currently connects 46 state PDMPs, including Nevada, Oregon, and Arizona. Another interstate data share hub, RxCheck, is operated by the federal Bureau of Justice Assistant using Prescription Monitoring Information Exchange National Architecture specifications developed by a PDMP Training and Technical Assistance Center housed within Brandeis University. These examples are in addition to other interstate data share hubs available, and additional health technology vendors will likely develop interconnection solutions as the importance of PDMPs continues to be recognized.
As attention to the opioid crisis continues to grow, CURES and other PDMPs are regularly mentioned as powerful tools for curbing the abuse of prescription drugs.
FISCAL EFFECT: Appropriation: Fiscal Com.: Local:
According to the Senate Appropriations Committee analysis dated 8/16/18, this bill will result $516,000 total funds ($409,000 Legal Services Revolving Fund, $78,000 reimbursements, and $29,000 General Fund) and 4.0 PYs in FY 2018-19; $2.5 million total funds ($33,000 General Fund, $1.8 million reimbursements, $705,000 special fund) and 11.0 PYs in FY 2019-20; and $1.4 million total funds ($743,000 reimbursements, $705,000 special fund) and 9.0 PYs in FY 2020-21 and ongoing, for increased administrative workload to promulgate regulations, develop and maintain an interstate data sharing agreement, increase legal workload for out-of-state cases, to responding to public inquiries and provide technical assistance to users, and for costs for IT analysis, design, and infrastructure. The analysis notes that to the extent that the DOJ anticipates reimbursement costs from DCA as the client entity, the DCA would have to increases its budgeted spending authority. According to the analysis, as of July 30, 2018, the projected CURES Fund balance for FY 2018-19 would be $2.0 million with 10.6 months in reserve; but by FY 2019-20, the fund balance would have a negative balance of $29,000, growing to a negative $2.3 million by FY 2022-2023. The CURES fund is funded by $6 fees on prescribing licensees. The bill’s implementation costs appear to exceed the current fund balance. Staff notes that an increase on fees on licensees would need to occur to stabilize the fund condition.
America’s Physician Groups
Biocom
California Association of Health Underwriters
California Chiropractic Association
California Dental Association
California District Attorneys Association
California Pharmacists Association
California Police Chiefs Association
California State Board of Pharmacy
California State Sheriffs’ Association
Consumer Attorneys of California
County Health Executives Association of California
Kaiser Permanente
Medical Board of California
OCHIN
San Diego County District Attorney Summer Stephan
Troy and Alana Pack Foundation
OPPOSITION: (Verified 8/24/18)
American Civil Liberties Union
Electronic Frontier Foundation
ARGUMENTS IN SUPPORT: Supporters cite this bill as a tool in the fight against opioid addiction and improper prescribing practices. The California Dental Association notes that enhancing CURES to allow prescribers, dispensers, regulators and law enforcement to share information across state lines will help curb the overprescribing of controlled substances and prevent unlawful doctor shopping.
According to the California Pharmacists Association, this bill addresses a glaring deficiency in the current CURES system. The California State Board of Pharmacy notes that 45 states currently share, or are in the process of setting up arrangements to share information about dispensed controlled substances and adds that one benefit of this bill is securing more complete medication histories of patients than are currently available to California’s practitioners since mail order pharmacies in other states represent a significant portion of prescription drug sales. The County Health Executives Association of California states that this bill would allow for the provision of more efficient and appropriate care both within and outside of the state. The Troy and Alana Pack Foundation supports the bill’s data-driven solution to prescription drug abuse.
ARGUMENTS IN OPPOSITION: The American Civil Liberties Union (ACLU) is opposed to this bill unless it is amended. According to the ACLU, the bill should prohibit federal, state and local agencies from accessing personal information in CURES without a warrant based on probable cause. ACLU states that as currently drafted, the bill would allow disclosure of private details without any checks to ensure Californians’ privacy is protected. ACLU also requests amendments to better clarify whether out-of-state recipients must comply with California privacy and data security standards with regards to the way they access CURES or the information contained within CURES and believes that the Author should include language that directs DOJ to comply with the requirements for providers in the Confidentiality of Medical Information Act.
The Electronic Frontier Foundation is opposed to this bill unless it is amended, stating similar arguments raised by ACLU.
ASSEMBLY FLOOR: 75-0, 5/29/18
AYES: Acosta, Aguiar-Curry, Travis Allen, Arambula, Baker, Berman, Bigelow, Bloom, Bonta, Brough, Burke, Caballero, Calderon, Carrillo, Cervantes, Chau, Chávez, Chen, Chiu, Choi, Chu, Cooley, Cooper, Cunningham, Dahle, Daly, Eggman, Flora, Fong, Frazier, Friedman, Gallagher, Cristina Garcia, Eduardo Garcia, Gipson, Gloria, Gonzalez Fletcher, Gray, Grayson, Harper, Holden, Irwin, Jones-Sawyer, Kalra, Kiley, Lackey, Levine, Limón, Low, Maienschein, Mayes, McCarty, Medina, Melendez, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Patterson, Quirk-Silva, Reyes, Rodriguez, Rubio, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Voepel, Waldron, Weber, Wood, Rendon
NO VOTE RECORDED: Kamlager-Dove, Mathis, Quirk
8/27/18 20:36:42
**** END ****
Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | AB |
THIRD READING
Bill No: AB 1751
:
SENATE BUS., PROF. & ECON. DEV. COMMITTEE: 8-0, 6/18/18
AYES: Hill, Fuller, Allen, Dodd, Galgiani, Glazer, Hernandez, Wilk
NO VOTE RECORDED: Pan
SENATE PUBLIC SAFETY COMMITTEE: 7-0, 6/26/18
AYES: Skinner, Anderson, Bradford, Jackson, Mitchell, Stone, Wiener
SENATE APPROPRIATIONS COMMITTEE: 7-0, 8/16/18
AYES: Portantino, Bates, Beall, Bradford, Hill, Nielsen, Wiener
ASSEMBLY FLOOR: 75-0, 5/29/18 - See last page for vote
SUBJECT: Controlled substances: CURES database
DIGEST:
This bill provides a framework for the Controlled Substances Utilization Review and Evaluation System (CURES) to connect with other states that comply with California’s patient privacy and data security standards.
Existing law:
- Establishes CURES for the electronic monitoring of Schedule II, III and IV controlled substance prescriptions. CURES provides for the electronic transmission of Schedule II, III and IV controlled substance prescription information to the Department of Justice (DOJ) no more than seven days from the time prescriptions are dispensed. (HSC § 11165)
- States that the purpose of CURES is to assist law enforcement and regulatory agencies in controlling diversion and abuse of Schedule II, III and IV controlled substances and for statistical analysis, education and research. (HSC § 11165 (a))
- Establishes privacy protections for patient data and specifies that the operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations. Specifies that CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Specifies that data obtained from CURES can only be accessed by appropriate state, local and federal persons or public agencies for disciplinary, civil or criminal actions. Specifies that CURES data shall also only be provided, as determined by DOJ, to other agencies or entities for educating practitioners and others, in lieu of disciplinary, civil or criminal actions. Authorizes non-identifying CURES data to be provided to public and private entities for education, research, peer review and statistical analysis. Requires DOJ to establish policies, procedures and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES. (HSC § 11165 (c) (1) and (c) (2) (A))
This bill:
- Requires DOJ, no later than July 1, 2020, to adopt regulations regarding the access and use of the information within CURES. Requires DOJ to consult with all stakeholders identified during the rulemaking process. Requires the regulations to address:
- The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.
- The purposes for which a health care practitioner may access information in CURES.
- The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.
- The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.
- Authorizes DOJ to enter into an agreement with an entity operating an interstate data share hub for purposes of participating in interjurisdictional information sharing between prescription drug monitoring programs across state lines.
- Requires any agreement entered into by DOJ for purposes of interstate data sharing to ensure that all access to data within CURES, and handling of CURES data, complies with California law and meets the same patient privacy and data security standards employed and required for direct access of CURES.
Background
CURES currently only contains information related to prescriptions dispensed within California. This means that when a health practitioner consults a patient’s prescription history prior to writing a new prescription, information relating to prescriptions written in other states are not reflected in the activity report. For true “doctor shoppers,” traveling across state lines to secure prescriptions of opioids is not uncommon. This is especially true in communities located near California’s borders.
Forty-nine states, including California and the District of Columbia, currently have a prescription drug monitoring program (PDMP). (Missouri has begun creating a PDMP pursuant to executive order in July of 2017.) Many of these states already participate in one of several interstate data share hubs that allow for the exchange of prescription information. For example, the National Association of Boards of Pharmacy administers PMP InterConnect, a technology solution developed in partnership with Appriss Health that currently connects 46 state PDMPs, including Nevada, Oregon, and Arizona. Another interstate data share hub, RxCheck, is operated by the federal Bureau of Justice Assistant using Prescription Monitoring Information Exchange National Architecture specifications developed by a PDMP Training and Technical Assistance Center housed within Brandeis University. These examples are in addition to other interstate data share hubs available, and additional health technology vendors will likely develop interconnection solutions as the importance of PDMPs continues to be recognized.
As attention to the opioid crisis continues to grow, CURES and other PDMPs are regularly mentioned as powerful tools for curbing the abuse of prescription drugs.
FISCAL EFFECT: Appropriation: Fiscal Com.: Local:
According to the Senate Appropriations Committee analysis dated 8/16/18, this bill will result $516,000 total funds ($409,000 Legal Services Revolving Fund, $78,000 reimbursements, and $29,000 General Fund) and 4.0 PYs in FY 2018-19; $2.5 million total funds ($33,000 General Fund, $1.8 million reimbursements, $705,000 special fund) and 11.0 PYs in FY 2019-20; and $1.4 million total funds ($743,000 reimbursements, $705,000 special fund) and 9.0 PYs in FY 2020-21 and ongoing, for increased administrative workload to promulgate regulations, develop and maintain an interstate data sharing agreement, increase legal workload for out-of-state cases, to responding to public inquiries and provide technical assistance to users, and for costs for IT analysis, design, and infrastructure. The analysis notes that to the extent that the DOJ anticipates reimbursement costs from DCA as the client entity, the DCA would have to increases its budgeted spending authority. According to the analysis, as of July 30, 2018, the projected CURES Fund balance for FY 2018-19 would be $2.0 million with 10.6 months in reserve; but by FY 2019-20, the fund balance would have a negative balance of $29,000, growing to a negative $2.3 million by FY 2022-2023. The CURES fund is funded by $6 fees on prescribing licensees. The bill’s implementation costs appear to exceed the current fund balance. Staff notes that an increase on fees on licensees would need to occur to stabilize the fund condition.
America’s Physician Groups
Biocom
California Association of Health Underwriters
California Chiropractic Association
California Dental Association
California District Attorneys Association
California Pharmacists Association
California Police Chiefs Association
California State Board of Pharmacy
California State Sheriffs’ Association
Consumer Attorneys of California
County Health Executives Association of California
Kaiser Permanente
Medical Board of California
OCHIN
San Diego County District Attorney Summer Stephan
Troy and Alana Pack Foundation
OPPOSITION: (Verified 8/17/18)
American Civil Liberties Union
Electronic Frontier Foundation
ARGUMENTS IN SUPPORT: Supporters cite this bill as a tool in the fight against opioid addiction and improper prescribing practices. The California Dental Association notes that enhancing CURES to allow prescribers, dispensers, regulators and law enforcement to share information across state lines will help curb the overprescribing of controlled substances and prevent unlawful doctor shopping.
According to the California Pharmacists Association, this bill addresses a glaring deficiency in the current CURES system. The California State Board of Pharmacy notes that 45 states currently share, or are in the process of setting up arrangements to share information about dispensed controlled substances and adds that one benefit of this bill is securing more complete medication histories of patients than are currently available to California’s practitioners since mail order pharmacies in other states represent a significant portion of prescription drug sales. The County Health Executives Association of California states that this bill would allow for the provision of more efficient and appropriate care both within and outside of the state. The Troy and Alana Pack Foundation supports the bill’s data-driven solution to prescription drug abuse.
ARGUMENTS IN OPPOSITION: The American Civil Liberties Union (ACLU) is opposed to this bill unless it is amended. According to the ACLU, the bill should prohibit federal, state and local agencies from accessing personal information in CURES without a warrant based on probable cause. ACLU states that as currently drafted, the bill would allow disclosure of private details without any checks to ensure Californians’ privacy is protected. ACLU also requests amendments to better clarify whether out-of-state recipients must comply with California privacy and data security standards with regards to the way they access CURES or the information contained within CURES and believes that the Author should include language that directs DOJ to comply with the requirements for providers in the Confidentiality of Medical Information Act.
The Electronic Frontier Foundation is opposed to this bill unless it is amended, stating similar arguments raised by ACLU.
ASSEMBLY FLOOR: 75-0, 5/29/18
AYES: Acosta, Aguiar-Curry, Travis Allen, Arambula, Baker, Berman, Bigelow, Bloom, Bonta, Brough, Burke, Caballero, Calderon, Carrillo, Cervantes, Chau, Chávez, Chen, Chiu, Choi, Chu, Cooley, Cooper, Cunningham, Dahle, Daly, Eggman, Flora, Fong, Frazier, Friedman, Gallagher, Cristina Garcia, Eduardo Garcia, Gipson, Gloria, Gonzalez Fletcher, Gray, Grayson, Harper, Holden, Irwin, Jones-Sawyer, Kalra, Kiley, Lackey, Levine, Limón, Low, Maienschein, Mayes, McCarty, Medina, Melendez, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Patterson, Quirk-Silva, Reyes, Rodriguez, Rubio, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Voepel, Waldron, Weber, Wood, Rendon
NO VOTE RECORDED: Kamlager-Dove, Mathis, Quirk
8/20/18 9:50:21
**** END ****
SENATE COMMITTEE ON APPROPRIATIONS
Senator Anthony Portantino, Chair
2017 - 2018 Regular Session
AB 1751 (Low) - Controlled substances: CURES database
Version: July 5, 2018 | Policy Vote: B., P. & E.D. 8 - 0, PUB. S. 7 - 0 |
Urgency: No | Mandate: No |
Hearing Date: August 16, 2018 | Consultant: Samantha Lui |
Bill Summary:
Requires, no later than July 1, 2020, the DOJ to adopt regulations, regarding the access and use of information within CURES, through stakeholder consultation. Authorizes DOJ to enter into an agreement with any entity operating an interstate data sharing hub, or any agency operating a prescription drug monitoring program (PDMP) in another state, if the entity complies with California’s patient privacy and data security standards.
*********** ANALYSIS ADDENDUM – SUSPENSE FILE ***********
The following information is revised to reflect amendments
adopted by the committee on August 16, 2018
Fiscal Impact:
- The Department of Justice (DOJ) anticipates: $516,000 total funds ($409,000 Legal Services Revolving Fund, $78,000 reimbursements, and $29,000 General Fund) and 4.0 PYs in FY 2018-19; $2.5 million total funds ($33,000 General Fund, $1.8 million reimbursements, $705,000 special fund) and 11.0 PYs in FY 2019-20; and $1.4 million total funds ($743,000 reimbursements, $705,000 special fund) and 9.0 PYs in FY 2020-21 and ongoing, for increased administrative workload to promulgate regulations, develop and maintain an interstate data sharing agreement, increase legal workload for out-of-state cases, to responding to public inquiries and provide technical assistance to users, and for costs for IT analysis, design, and infrastructure.
- Commensurate spending authority for DCA to reimburse DOJ for costs.
The Department of Consumer Affairs notes no direct impact as a result of the bill at this time. However, staff notes, to the extent that the DOJ anticipates reimbursement costs from DCA as the client entity, the DCA would have to increases its budgeted spending authority. In addition, staff notes the costs for the bill could decrease, depending on how DOJ implements the bill and engages with other states’ and their relevant data sharing hubs.
Staff notes, as of July 30, 2018, the projected CURES Fund balance for FY 2018-19 would be $2.0 million with 10.6 months in reserve; but by FY 2019-20, the fund balance would have a negative balance of $29,000, growing to a negative $2.3 million by FY 2022-2023. The CURES fund is funded by $6 fees on prescribing licensees. The bill’s implementation costs appear to exceed the current fund balance. Staff notes that an increase on fees on licensees would need to occur to stabilize the fund condition.
Author Amendments:
- Clarifies an agency must not disclose any personal information in a manner that would link information disclosed, as specified.
- Provides that DOJ must adopt regulations which must include conditions under which a warrant, subpoena, or court order is required to obtain information from CURES as part of a criminal investigation.
- Require other states comply with CA's privacy laws;
- Removes authorization for, and all language regarding, insurers and plans access to CURES through a health care practitioner for claim validation;
- Expands stakeholder list for whom DOJ must consult during regulation development; and,
- Makes other technical changes.
-- END --
SENATE COMMITTEE ON APPROPRIATIONS
Senator Anthony Portantino, Chair
2017 - 2018 Regular Session
AB 1751 (Low) - Controlled substances: CURES database
Version: July 5, 2018 | Policy Vote: B., P. & E.D. 8 - 0, PUB. S. 7 - 0 |
Urgency: No | Mandate: No |
Hearing Date: August 6, 2018 | Consultant: Samantha Lui |
This bill meets the criteria for referral to the Suspense File.
Bill Summary:
Requires, no later than July 1, 2020, the DOJ to adopt regulations, regarding the access and use of information within CURES, through stakeholder consultation. Authorizes DOJ to enter into an agreement with any entity operating an interstate data sharing hub, or any agency operating a prescription drug monitoring program (PDMP) in another state, if the entity complies with California’s patient privacy and data security standards.
Fiscal Impact:
The Department of Consumer Affairs and the Department of Justice provided the following fiscal estimates to implement the bill, respectively:
- The Department of Consumer Affairs notes no direct impact as a result of the bill at this time. However, staff notes, to the extent that the DOJ anticipates reimbursement costs from DCA as the client entity, the department would have to increases its budgeted spending authority and there may be potential impact on existing pro rata calculations.
- The Department of Justice (DOJ) anticipates: $516,000 total funds ($409,000 Legal Services Revolving Fund, $78,000 reimbursements, and $29,000 General Fund) and 4.0 PYs in FY 2018-19; $2.5 million total funds ($33,000 General Fund, $1.8 million reimbursements, $705,000 special fund) and 11.0 PYs in FY 2019-20; and $1.4 million total funds ($743,000 reimbursements, $705,000 special fund) and 9.0 PYs in FY 2020-21 and ongoing, for increased administrative workload to promulgate regulations, develop and maintain an interstate data sharing agreement, increase legal workload for out-of-state cases, to responding to public inquiries and provide technical assistance to users, and for costs for IT analysis, design, and infrastructure.
- Commensurate spending authority for DCA to reimburse DOJ for costs.
Staff notes, as of July 30, 2018, the projected CURES Fund balance for FY 2018-19 would be $2.0 million with 10.6 months in reserve; but by FY 2019-20, the fund balance would have a negative balance of $29,000, growing to a negative $2.3 million by FY 2022-2023. The CURES fund is funded by $6 fees on prescribing licensees. The bill’s implementation costs appear to exceed the current fund balance. Staff notes that an increase on fees on licensees would need to occur to stabilize the fund condition.
Background:
The federal Controlled Substances Act of 1970 regulates the manufacture, distribution and dispensing of controlled substances. The act ranks into five schedules those drugs known to have potential for physical or psychological harm, based on their potential for abuse; their accepted medical use; and, their accepted safety under medical supervision. Specifically:
- Schedule I controlled substances have a high potential for abuse and no generally accepted medical use, such as heroin, ecstasy, and LSD.
- Schedule II controlled substances have a currently accepted medical use in treatment, or a currently accepted medical use with severe restrictions, and have a high potential for abuse and psychological or physical dependence. Schedule II drugs can be narcotics or non-narcotic. Examples of Schedule II controlled substances include combination products with less than 15 milligrams of hydrocodone per dosage unit (Vicodin), morphine, methadone, Ritalin, Demerol, Percocet, Percodan, fentanyl and Oxycontin.
- Schedule III and IV controlled substances have a currently accepted medical use in treatment, less potential for abuse but are known to be mixed in specific ways to achieve a narcotic-like end product. Examples include Tylenol with codeine, testosterone, Xanax, Ambien and other anti-anxiety drugs.
- Schedule V drugs have a low potential for abuse relative to substances listed in Schedule IV and consist primarily of preparations containing limited quantities of certain narcotics. Schedule V drugs are generally used for antidiarrheal, antitussive, and analgesic purposes.
The DOJ manages CURES, which is an electronic tracking program that reports all California pharmacy (and specified types of prescriber) dispensing of certain schedules of controlled drugs by drug name, quantity, prescriber, patient, and pharmacy. The system can also report on the top drugs prescribed for a specific time period, drugs prescribed in a particular county, doctor prescribing data, pharmacy dispensing data, and is a critical tool for assessing whether multiple prescriptions for the same patient may exist. Access to CURES is limited by a number of state and federal privacy laws, including HIPAA and CMIA. Last year, close to 10 million activity reports had been processed by practitioners, pharmacists, law enforcement, and regulatory users. Prescribers and dispensers made 99 percent of the queries, in order to review a patient’s prescription history as a component of exercising informed clinical judgment before providing access to opioids or other controlled substances.
Proposed Law:
- The bill includes the following provisions, among others:
- Requires, no later than July 1, 2020, the DOJ to adopt regulations, regarding the access and use of information within CURES, through stakeholder consultation. Specifies the regulations must address all of the following:
- The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.
- The purposes for which a health care practitioner may access information in CURES.
- The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation of a patient or health care practitioner, respectively.
- The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.
- Authorizes DOJ to enter into an agreement with any entity operating an interstate data sharing hub, or any agency operating a prescription drug monitoring program (PDMP) in another state, for purposes of interstate sharing of PDMP information.
- Provides that data obtained by CURES may be provided to authorized users of another state’s PDMP if the entity operating the interstate data sharing hub has entered into an agreement with the DOJ.
- Requires any agreement entered into by DOJ for purposes of interstate data sharing to ensure that all access to data within CURES complies with California law and meets the same patient privacy and data security standards employed and required for direct access of CURES.
- Prohibits the DOJ from entering into an agreement with an entity operating an interstate data sharing hub until the DOJ has issued final regulations regarding the access and use of information within CURES, as specified.
Related Legislation:
The Legislature has considered several proposals related to CURES and opioid prescribing policies, including:
- SB 1240 (Stone) expands the drugs required to be reported and monitored in CURES to include all dangerous drugs and Schedule V controlled substances and requires inclusion of a description of the diagnosis, condition, or purpose for which the prescription was issued and the directions for use to the list of information pharmacies are required to report to CURES for each prescription. The bill’s was not heard at the request of the author in the Senate Business, Professions, and Economic Development Committee.
- AB 1752 (Low) adds Schedule V drugs to CURES, changes the required timeframe in which pharmacists are required to report dispensed prescriptions from seven days to the following business day, and makes other technical changes. This bill is being considered by this committee at its August 6, 2018 hearing.
- AB 1753 (Low) would limit the number of security printers authorized to manufacture prescription pads and linking uniquely serialized pads with CURES. This bill is being considered by this committee at its August 6, 2018 hearing.
- AB 2086 (Gallagher) would allow prescribers of controlled substances to review a list of patients for whom they are listed as being the prescriber. The bill is pending on the Senate Floor.
- AB 2783 (O’Donnell) would reconcile discrepancies between California’s controlled substance schedules and the corresponding federal controlled substance schedules. (Status: The bill is pending in the Senate Committee on Public Safety.)
- AB 2789 (Wood) would require that prescriptions be submitted electronically, with limited exceptions. This bill is being considered by this committee at its August 6, 2018 hearing.
Staff Comments:
49 states including California and the District of Columbia currently have a prescription drug monitoring program (PDMP). Many of these states already participate in one of several interstate data share hubs, like PMP InterConnect or RxCheck, that allow for the exchange of prescription information. Staff notes it is unclear whether workload associated with the design, development, and implementation to modifying the CURES application would necessitate a new-IT solution, or if implementation of the interstate data sharing hub could be leveraged, similar to other states’ approach, resulting in potential reductions in projected costs.
-- END --
SENATE COMMITTEE ON PUBLIC SAFETY
Senator Nancy Skinner, Chair
2017 - 2018 Regular
Bill No: AB 1751 Hearing Date: June 26, 2018
Author: | Low | ||
Version: | January 3, 2018 | ||
Urgency: | No | Fiscal: | Yes |
Consultant: | SJ | ||
Subject: Controlled Substances: CURES Database
HISTORY
Source: Author
Prior Legislation: AB 40 (Santiago), Ch. 607, Stats. 2017
SB 641 (Lara), was not heard in Assembly Public Safety 2017
SB 482 (Lara), Ch. 708. Stats. 2016
SB 360 (DeSaulnier), Ch.418, Stats. 2011
SB 151 (Burton), Ch. 406, Stats. 2003
AB 3042 (Takasugi), Ch.738, Stats. 1996
Support: America’s Physician Groups; Biocom; California Association of Health Underwriters; California Chiropractic Association; California Dental Association; California District Attorneys Association; California Health + Advocates; California Life Sciences Association; California Medical Association; California Pharmacists Association; California Police Chiefs Association; California State Board of Pharmacy; California State Sheriffs’ Association; Consumer Attorneys of California; County Behavioral Health Directors Association of California; County Health Executives Association of California; Kaiser Permanente; Medical Board of California; OCHIN; San Diego County District Attorney; Troy and Alana Pack Foundation
Opposition: ACLU of California (unless amended); California Academy of Family Physicians (unless amended); California Medical Association (unless amended); Electronic Frontier Foundation (unless amended)
Assembly Floor Vote: 75 - 0
PURPOSE
The purpose of this bill is to authorize the Department of Justice (DOJ) to enter into an agreement with an entity operating an interstate data share hub for the purposes of participating in interjurisdictional information sharing between prescription drug monitoring programs across state lines.
Existing law classifies controlled substances into five schedules according to their danger and potential for abuse. (Health & Saf. Code, §§ 11054-11058.)
Existing law authorizes a physician and surgeon to prescribe for, or dispense or administer to, a person under his or her treatment for a medical condition dangerous drugs or prescription controlled substances for the treatment of pain or a condition causing pain, including, but not limited to, intractable pain. (Bus. & Prof. Code, § 2241.5.)
Existing law specifies which types of health care professionals may write or issue a prescription. (Health & Saf. Code, § 11150.)
Existing law specifies that a prescription for a controlled substance shall only be issued for a legitimate medical purpose and establishes responsibility for proper prescribing on the prescribing practitioner. A violation shall result in imprisonment for up to one year or a fine of up to $20,000, or both. (Health & Saf. Code, § 11153.)
Existing law establishes the Controlled Substances Utilization Review and Evaluation System (CURES), a prescription drug monitoring program (PDMP) maintained by the DOJ. States that the purpose of CURES is to assist law enforcement and regulatory agencies in controlling diversion and abuse of Schedule II, III and IV controlled substances and for statistical analysis, education and research. (Health & Saf. Code, § 11165, subd. (a).)
Existing law requires pharmacists and other dispensers to report information relating to prescriptions of Schedule II, III, and IV controlled substances to CURES as soon as reasonably possible but not more than seven days after the date a controlled substance is dispensed. (Health & Saf. Code, § 11165, subd. (d).)
Existing law requires health care practitioners in receipt of a Federal Drug Enforcement Administration (DEA) certificate providing authorization to prescribe controlled substances, as well as pharmacists, to register for access to the CURES database. (Health & Saf. Code, § 11165.1, subd. (a).)
Existing law requires certain health care practitioners to consult the CURES database to review a patient’s controlled substance history before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every four months thereafter if the substance remains part of the treatment of the patient, with certain exceptions. Provides that this requirement is not operative until six months after DOJ certifies that CURES is ready for statewide use. (Health & Saf. Code, § 11165.4.)
Existing law authorizes information technology systems that meet certain patient privacy and data security requirements to interoperate with the database, allowing prescribers and dispensers to make queries through their electronic health record applications. (Health & Saf. Code, § 11165.1.)
Existing law requires the CURES database to comply with all applicable federal and state privacy and security laws and regulations. Requires the DOJ to establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES. (Health & Saf. Code, § 11165, subd. (c).)
Existing law prohibits any person from obtaining or attempting to obtain a prescription for controlled substances, by fraud, deceit, misrepresentation, subterfuge, or the concealment of a material fact. (Health & Saf. Code, § 11173.)
This bill authorizes DOJ to enter into an agreement with an entity operating an interstate data share hub for purposes of participating in interjurisdictional information sharing between prescription drug monitoring programs across state lines.
This bill requires any agreement entered into by DOJ for purposes of interstate data sharing complies with California law and meets the same patient privacy and data security standards employed and required for direct access of CURES.
COMMENTS
- Need for This Bill
According to the author:
Currently, the CURES prescription drug monitoring program database contains information related to Schedule II-IV prescriptions dispensed only within California. This means that when a health practitioner consults a patient’s prescription history prior to writing a new prescription, information relating to prescriptions written in other states are not reflected in the activity report. For true “doctor shoppers,” traveling across state lines to secure prescriptions of opioids is not uncommon. This is especially true in communities located near California’s borders.
Forty-nine states including California and the District of Columbia currently have a PDMP. . . . Many of these states already participate in one of several interstate data share hubs that allow for the exchange of prescription information. For example, the National Association of Boards of Pharmacy administers PMP InterConnect, a technology solution developed in partnership with Appriss Health that currently connects 46 state PDMPs, including Nevada, Oregon, and Arizona. . . .
The CURES statute (HSC §§ 11165 et seq.) does not currently include interstate hub sharing among the expressly authorized uses of data within CURES. There is also no framework provided requiring the Department of Justice (DOJ) to insist on certain privacy and security minimums as part of any agreement it does choose to enter into. This bill would provide that framework and include those safeguards.
- Prescription Drug Monitoring Programs
A PDMP is “an electronic database that tracks controlled substance prescriptions in a state. PDMPs can provide health authorities timely information about prescribing and patient behaviors.” (https://www.cdc.gov/drugoverdose/pdmp/states.html.) With rising levels of abuse, law enforcement and regulatory bodies view PDMPs as a critical tool in assisting with their efforts to reduce drug diversion. Forty-nine states currently have monitoring programs.
California’s PDMP is known as CURES. Data from CURES is managed by DOJ to assist state law enforcement and regulatory agencies in their efforts to reduce prescription drug diversion. CURES provides information that offers the ability to identify if a person is “doctor shopping,” a term used to describe a person who visits multiple doctors to obtain multiple prescriptions for drugs, or who uses multiple pharmacies to obtain prescription drugs. Information tracked in CURES contains the patient name, prescriber name, pharmacy name, drug name, amount and dosage, and is available to law enforcement agencies, regulatory bodies and qualified researchers. (https://oag.ca.gov/cures.) CURES can also report on the top drugs prescribed for a specific time period, drugs prescribed in a particular county, doctor prescribing data, pharmacy dispensing data, and is a critical tool for assessing whether multiple prescriptions for the same patient may exist.
There currently is momentum to share data across these programs from state to state. The National Boards of Pharmacy (NABP) currently operates a PDMP, InterConnect, that allows participating states to be linked, providing a more effective means of combating drug diversion and drug abuse nationwide. Over 40 states are sharing data using InterConnect and several other are in the process of signing a Memorandum of Understanding to share data, or have expressed intent to do so. (https://nabp.pharmacy/initiatives/pmp-interconnect/.)
This bill would authorize the DOJ to enter into an agreement for interstate data sharing.
- Privacy Implications of PDMPs
Data obtained from CURES can be provided to “appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes.” (Health & Saf. Code, § 11165, subd. (c)(2)(A).) Data may be also provided to public or private entities, as approved by the DOJ, for educational, peer review, statistical, or research purposes, provided that patient information, including any information that may identify the patient, is not compromised. (Ibid.) Access to information in CURES depends on who is conducting the search as well as what information is sought.
A health care professional who prescribes or dispenses controlled substances checks CURES before prescribing or dispensing a controlled substance to a patient. In order to do so, the prescriber or dispenser will sign on to the database with a username and password and can query a patient’s records based on last name, first name, and date of birth.
The process for law enforcement differs slightly and depends on whether law enforcement is seeking data on a patient or prescriber or dispenser. When law enforcement is seeking patient data, they must enter a patient’s last name, first name, and date of birth. This committee has been informed that DOJ’s policy requires law enforcement to additionally upload a case number, criminal code, and search warrant into CURES when accessing patient data. In contrast, to access prescriber or dispenser data in CURES, DOJ does not require a search warrant. Again, the search warrant practice is not codified in state law—it is part of current DOJ policy which is subject to change. SB 641 (Lara), a bill introduced during the 2017-2018 Legislative Session, sought to codify a warrant requirement.
The CURES statute generally mandates that the database comply with all applicable federal and state privacy and security laws and regulations. (Health & Saf. Code, § 11165, subd. (c)(2)(A).) However, whether a disclosure of CURES information violates a patient’s right to privacy either under state or federal law has been the subject of litigation.
- California Privacy Law
The California Constitution expressly provides for the right of privacy among the inalienable rights it guarantees the citizens of the State. (Cal. Const. art. I, § 1.)
Additionally, prescription information, when in a person’s medical record, has the protections of the Confidential Medical Information Act (CMIA). The CMIAprovides that a health care provider is prohibited from disclosing a patient’s medical information without his or her authorization except in specified circumstances. One such exception exists where a search warrant has been lawfully issued to a governmental law enforcement agency. (Cal. Civ. Code, § 56.10, subd. (b)(6).)
In Lewis v. Superior Court, the California Supreme Court addressed the constitutional right to privacy in the context of CURES. (Lewis v. Superior Court (2017) 3 Cal.5th 561.) The question before the court was whether the Medical Board of California violated the privacy rights of patients under the state constitution when it obtained data from CURES without a warrant or subpoena when it investigated the patients’ physician. (Id. at 565.) The board, which investigates physicians based on complaints or on its own initiative, is charged with the duty to protect the public against incompetent, impaired or negligent physicians. (Id. at p. 567.) The board’s investigators are peace officers. (Ibid.)
In deciding the case, the court balanced the patients’ right to privacy in their controlled substance prescription records against the state’s interest in protecting public from unlawful use and diversion of dangerous prescription drugs and protecting the public form negligent or incompetent physicians. (Lewis, supra, 3 Cal.5th at pp. 572-574.) The court found that while patients retain a reasonable expectation of privacy in their prescription records, it is not as high as the privacy interest associated with medical records. (Id. at p. 575.) The court noted that there are safeguards in statute to limit the degree to which a patient’s privacy is invaded when the board examines prescription records. (Id. at p. 577.) Accordingly, the court concluded that the board did not violate the patients’ constitutional right to privacy by examining the patient prescription records in CURES. (Ibid.)
- Fourth Amendment Protections
In Lewis, supra, 3 Cal.5th 561, the Supreme Court declined to consider the petitioner’s claim that the Medical Board’s access CURES records violated the Fourth Amendment of the United States Constitution because that claim was not raised in the administrative proceedings. (Id. at p. 578.)
The Fourth Amendment guarantees “[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.” Application of the Fourth Amendment depends on whether the person invoking its protection can claim a justifiable, a reasonable, or a legitimate expectation of privacy that has been invaded by government action. Whether the Fourth Amendment protections apply to CURES and other PDMPs is an open question.
However, several federal courts have held that the federal DEA need not secure a warrant to access data in a PDMP. Recently, in Oregon Prescription Drug Monitoring Program v. United States DEA (9th Cir. 2017) 800 F.3d 1228, the Ninth Circuit Court of Appeals ruled that the federal Drug Enforcement Agency does not need a court order to subpoena Oregon’s PDMP. Oregon’s statute requires a court order in order for a federal, state, or local law enforcement agency engaged in a drug-related investigation to obtain prescription monitoring information. (Id. at p. 1232, citing Or. Rev. Stat. § 431A.865(2)(a)(F).) The DEA sought the PDMP records of a patient and of two doctors. Oregon argued that, under state law, it could not be compelled to produce the records without a federal court order. The American Civil Liberties Union (ACLU) sought to intervene in the case on behalf of four patients and a physician and argued that the use of investigative subpoenas violated the Fourth Amendment. (Ibid.) The court held that Oregon’s statutory requirement for a court order in all cases conflicted with, and was preempted by the federal Controlled Substances Act, which authorizes the Attorney General to issue administrative subpoenas to investigate drug crimes. (Id. at pp. 1236-1237.) This authority has been delegated to the DEA. (Id. at pp. 1231.)
The court’s ruling left open the question of whether administrative subpoenas by the DEA of the information in the PDMP would violate Fourth Amendment protections against unreasonable searches and seizures. That claim was not addressed because the court determined that the individuals represented by the ACLU did not have standing to seek relief that was different from the State of Oregon. (Oregon Prescription Drug Monitoring Program, supra, 800 F.3d at pp. 1231, & 1234-1235.)
To address privacy implications, this bill would require that any agreement entered into by DOJ for purposes of interstate data sharing to ensure complies with California law and meets the same patient privacy and data security standards used and required for direct access of CURES.
The ACLU, Electronic Frontier Foundation, California Medical Association, and the California Academy of Family Physicians have each opposed this bill based on privacy concerns. Opponents argue that given the lack of privacy protections currently in place for CURES records, it would be imprudent to allow other states’ PDMPs to access CURES data. The author and committee may wish to consider if providing additional privacy protections would improve the bill.
- Argument in Support
The California State Board of Pharmacy supports this bill, writing:
This bill would enable California’s prescription drug monitoring program (CURES) to share data with prescription drug monitoring programs in other states. The result will be more complete information for California’s health care providers when prescribing or dispensing controlled substances.
Currently 45 states either share, or are in the process of setting up arrangements to share, dispensing information on controlled substances provided to patients in other states. California is not part of this system. Assembly Bill 1751 would correct this situation when the other states’ systems meet the same patient privacy and security standards as CURES.
- Argument in Opposition
According to the California Medical Association:
While CMA believes participation in an interstate system will help in identifying opioid-abusing patients shopping for medications across state lines, we have serious concerns with the lack of adequate privacy protections for the confidential patient information contained in CURES when accessed from within California. As such, we strongly oppose efforts to grant access to this data across state lines without first establishing sufficient patient protections.
…California’s CURES database has some qualities that put it outside standard practice. First, according to the National Alliance for Model State Drug laws (NAMSDL), California is one of three states which house its PDMP in a law enforcement entity. The majority are housed in a health department or Board of Pharmacy. Additionally, California is one of the few states that does not specify in statute the authorized recipients of information from [CURES].
The sensitive and confidential nature of the information in the database requires a thoughtful sharing approach that balances California’s longstanding policy of protecting patient privacy while also weighing the needs of the many different types of entities who may use CURES data, including for public health and safety purposes. The explicit delineation of privacy and access to information is a best practice that California has yet to implement and until implemented, the patient records contained in CURES should be vigorously protected, not opened for sharing through databases across the country.
The Electronic Frontier Foundation writes:
[AB 1751] is unclear on whether out-of-state recipients must comply with California privacy and security standards with respect to access to the CURES database and the protection of Californians’ personal information once accessed, and how Californians can hold out-of-state actors accountable for violating their privacy as a result of data sharing under AB 1751.
EFF has had grave concerns about the inadequacy of privacy protections for the sensitive patient information contained in CURES when accessed from within California. We strongly oppose efforts to grant access to this data throughout the United States unless the bill is amended to protect patients’ personal information from unnecessary or wrongful disclosure and from access by federal, state, and local agencies without a warrant based on probable cause.
-- END --
SENATE COMMITTEE ON
BUSINESS, PROFESSIONS AND ECONOMIC DEVELOPMENT
Senator Jerry Hill, Chair
2017 - 2018 Regular
Bill No: AB 1751 Hearing Date: June 18, 2018
Author: | Low | ||
Version: |
| ||
Urgency: | Fiscal: | ||
Consultant: | |||
Subject: Controlled substances: CURES database
SUMMARY: Provides a framework for the Controlled Substances Utilization Review and Evaluation System (CURES) to connect with other states that comply with California’s patient privacy and data security standards.
Existing law:
- Establishes various practice acts in the Business and Professions Code (BPC) governed by various boards within the Department of Consumer Affairs (DCA) which provide for the licensing and regulation of health care professionals including: physicians and surgeons (under the Medical Practice Act), dentists (under the Dental Practice Act), veterinarians (under the Veterinary Medicine Practice Act); registered nurses, nurse practitioners (NP) and certified nurse-midwives (CNM) (under the Nursing Practice Act); physician assistants (PA) (under the Physician Assistant Practice Act); osteopathic physicians and surgeons (under the Osteopathic Medical Practice Act); naturopathic doctors (ND) (under the Naturopathic Doctors Act); optometrists (under the Optometry Practice Act); doctors of podiatric medicine (under the Podiatric Act) and; pharmacies, pharmacists and wholesalers of dangerous drugs or devices (under the Pharmacy Law). (Business and Professions Code (BPC) §§ 500 et seq.)
- Defines “dispense” as the furnishing of drugs or devices upon a prescription from a physician, dentist, optometrist, podiatrist, veterinarian, or ND or upon an order to furnish drugs or transmit a prescription from a CNM, NP, PA, ND, or pharmacist acting within the scope of his or her practice. Dispense also means and refers to the furnishing of drugs or devices directly to a patient by a physician, dentist, optometrist, podiatrist, or veterinarian, or by a CNM, NP, ND, PA or pharmacist acting within the scope of his or her practice. (BPC § 4024)
- Specifies certain requirements regarding the dispensing and furnishing of dangerous drugs and devices, and prohibits a person from furnishing any dangerous drug or device except upon the prescription of a physician, dentist, podiatrist, optometrist, veterinarian or ND. (BPC § 4059)
- Establishes the Uniform Controlled Substances Act which regulates controlled substances and defines an opiate as any substance having an addiction-forming or addiction-sustaining liability similar to morphine or being capable of conversion into a drug having addiction-forming or addiction-sustaining liability. (Health and Safety Code (HSC) § 11020)
- Classifies controlled substances into five schedules according to their danger and potential for abuse. (HSC §§ 11054-11058)
- Prohibits any person other than a physician, dentist, podiatrist, veterinarian, ND (according to certain supervision and protocol requirements), pharmacist (according to certain authorization and according to certain policies and procedures), CNM (if furnished or ordered incidentally to the provision of family planning services, routine health care or perinatal care, or care rendered consistent with the CNM’s practice; occurs under physician and surgeon supervision; and is in accordance with standardized procedures or protocols as specified), NP (if it is consistent with a NP’s educational preparation or for which clinical competency has been established and maintained; occurs under physician and surgeon supervision; and is in accordance with standardized procedures or protocols as specified); a pharmacist or registered nurse or PA acting within the scope of an experimental health workforce project authorized by the Office of Statewide Health Planning and Development (HSC § 128125 et seq.); an optometrist licensed under the Optometry Practice Act, or an out-of-state prescriber acting in an emergency situation from writing or issuing a prescription for a controlled substance.
(HSC § 11150) - Establishes CURES for the electronic monitoring of Schedule II, III and IV controlled substance prescriptions. CURES provides for the electronic transmission of Schedule II, III and IV controlled substance prescription information to the Department of Justice (DOJ) no more than seven days from the time prescriptions are dispensed. (HSC § 11165)
- States that the purpose of CURES is to assist law enforcement and regulatory agencies in controlling diversion and abuse of Schedule II, III and IV controlled substances and for statistical analysis, education and research. (HSC § 11165 (a))
- Establishes privacy protections for patient data and specifies that the operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations. Specifies that CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Specifies that data obtained from CURES can only be accessed by appropriate state, local and federal persons or public agencies for disciplinary, civil or criminal actions. Specifies that CURES data shall also only be provided, as determined by DOJ, to other agencies or entities for educating practitioners and others, in lieu of disciplinary, civil or criminal actions. Authorizes non-identifying CURES data to be provided to public and private entities for education, research, peer review and statistical analysis. Requires DOJ to establish policies, procedures and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES. (HSC § 11165 (c) (1) and (c) (2) (A))
- Specifies that a regulatory board whose licensees do not prescribe, order, administer, furnish or dispense controlled substances shall not be provided data obtained from CURES. (HSC § 11165(c)(2)(B))
- Requires DOJ to upgrade CURES to allow health information technology systems that meet certain patient privacy and data security requirements to interoperate with the database, allowing prescribers and dispensers to make queries through their electronic health record applications. (HSC § 11165.1)
- Requires health care practitioners in receipt of a federal Drug Enforcement Administration (DEA) registration providing authorization to prescribe controlled substances, as well as pharmacists, to register for access to the CURES database. (HSC § 11165.1(a))
- Authorizes a health care practitioner to provide a patient with a copy of the patient’s CURES patient activity report as long as no additional CURES data is provided and authorizes a health care practitioner to keep a copy of the report in the patient’s medical record. (HSC § 11165 (c)(3))
- Requires certain health care practitioners to consult the CURES database to review a patient’s controlled substance history before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every four months thereafter if the substance remains part of the treatment of the patient, with certain exceptions. (HSC § 11165.4)
- Establishes, pursuant to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. HIPAA prohibits a covered entity that uses electronic means to perform HIPAA-covered transactions, from using or disclosing personal health information except pursuant to a written authorization signed by the patient or for treatment, payment, or health care operations. Notwithstanding those provisions, HIPAA allows a covered entity to maintain a directory of patients in its facility for specified purposes, and to disclose the protected health information of a patient to family members, relatives, or other persons identified by the patient, if certain conditions are met. Covered entities include health plans, health care clearinghouses, such as billing services and community health information systems, and health care providers that transmit health care data in a way that is regulated by HIPAA. HIPAA further provides that if its provisions conflict with a provision of state law, the provision that is most protective of patient privacy prevails. (Public Law 104–191, 104th Congress)
- Prohibits, pursuant to the state Confidentiality of Medical Information Act (CMIA), a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. A violation of the provisions of this act that results in economic loss or personal injury to a patient is a crime. (Civil Code Sections (CC) 56, et seq.)
- Defines, for purposes of the CMIA, “medical information” to mean “any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment.” “Individually identifiable” means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity.” (CC § 56.05(g))
This bill:
- Authorizes DOJ to enter into an agreement with an entity operating an interstate data share hub for purposes of participating in interjurisdictional information sharing between prescription drug monitoring programs across state lines.
- Requires any agreement entered into by DOJ for purposes of interstate data sharing to ensure that all access to data within CURES complies with California law and meets the same patient privacy and data security standards employed and required for direct access of CURES.
FISCAL EFFECT:
This bill is keyed fiscal by Legislative Counsel. According to the Assembly Committee on Appropriations analysis dated May 2, 2018, this bill will result in one-time costs of $1 million General Fund (GF) monies for DOJ to manage the required information technology project and ongoing costs of $700,000 annually to DOJ for increased legal workload as a result of out-of-state cases, in addition to $300,000 GF annually for development and maintenance of the interstate memoranda of understanding and to provide technical assistance to users.
COMMENTS:
- Purpose. The Author is the Sponsor of this bill. According to the Author, “As the opioid crisis receives growing national attention as one of the most devastating public health epidemics in modern history, California is fortunate to have CURES, a powerful tool to promote safe prescribing and curb illicit doctor-shopping. With the Attorney General’s successful launch of a state-of-the-art ‘CURES 2.0’ prescription drug monitoring program, it is now the Legislature’s imperative to identify ways to further empower data-driven solutions to preventing prescription drug abuse and diversion. Upgrading CURES to allow the DOJ to enter into interstate data sharing agreements will provide invaluable cross-jurisdictional information to health professionals seeking to make informed decisions on behalf of their patients, particularly those practicing in communities neighboring other states.”
- Background.
Controlled Substances, PDMPs and CURES. Through the Controlled Substances Act of 1970, the federal government regulates the manufacture, distribution and dispensing of controlled substances. The act ranks into five schedules those drugs known to have potential for physical or psychological harm, based on three considerations: (a) their potential for abuse; (b) their accepted medical use; and,
(c) their accepted safety under medical supervision.
Schedule I controlled substances have a high potential for abuse and no generally accepted medical use such as heroin, ecstasy, and LSD.
Schedule II controlled substances have a currently accepted medical use in treatment, or a currently accepted medical use with severe restrictions, and have a high potential for abuse and psychological or physical dependence. Schedule II drugs can be narcotics or non-narcotic. Examples of Schedule II controlled substances include combination products with less than 15 milligrams of hydrocodone per dosage unit (Vicodin), morphine, methadone, Ritalin, Demerol, Percocet, Percodan, fentanyl and Oxycontin.
Schedule III and IV controlled substances have a currently accepted medical use in treatment, less potential for abuse but are known to be mixed in specific ways to achieve a narcotic-like end product. Examples include Tylenol with codeine, testosterone, Xanax, Ambien and other anti-anxiety drugs.
Schedule V drugs have a low potential for abuse relative to substances listed in Schedule IV and consist primarily of preparations containing limited quantities of certain narcotics. Schedule V drugs are generally used for antidiarrheal, antitussive, and analgesic purposes.
With rising levels of prescription drug abuse, prescription drug monitoring programs (PDMPs) assist law enforcement and regulatory bodies with their efforts to reduce drug abuse and diversion. In California, CURES is an electronic tracking program that reports all pharmacy (and specified types of prescriber) dispensing of certain schedules of controlled drugs by drug name, quantity, prescriber, patient, and pharmacy. Data from CURES is managed by DOJ. Information tracked in CURES contains the patient name, prescriber name, pharmacy name, drug name, amount and dosage, and is available to law enforcement agencies, regulatory bodies, prescribers, dispensers, and qualified researchers. CURES provides information to identify if a person is “doctor shopping” (when a patient, often a prescription-drug addict, visits multiple doctors to obtain multiple prescriptions for drugs, or uses multiple pharmacies to obtain prescription drugs). The system can also report on the top drugs prescribed for a specific time period, drugs prescribed in a particular county, doctor prescribing data, pharmacy dispensing data, and is a critical tool for assessing whether multiple prescriptions for the same patient may exist.
Every dispenser of controlled substances and every health practitioner authorized by the DEA to prescribe controlled substances is required to obtain a login for access to CURES. For each dispensed Schedule II, III, or IV drug, pharmacists and other dispensers are required to report basic information about the patient and their prescription within 7 days. This information is then made available to other system users in a variety of possible contexts. For example, physicians may query a patient’s prescription history prior to writing a new prescription; pharmacists can check the system before agreeing to fill a prescription for a controlled substance; regulators may review a licensee’s prescribing practices as part of a disciplinary investigation; and law enforcement can incorporate a search of the system into a potential criminal case of drug diversion.
Over 50 million prescription records have been uploaded into the system by dispensers since the beginning of the CURES program. As of January 1, 2018, 170,422 users had been approved for access to the system. Last year, close to 10 million activity reports had been processed by practitioners, pharmacists, law enforcement, and regulatory users. The vast majority of these searches (over 99 percent) were queries made by prescribers and dispensers seeking to review a patient’s prescription history as a component of exercising informed clinical judgment before providing access to opioids or other controlled substances.
Health practitioners will soon be required to consult the CURES database prior to writing a prescription for a Schedule II, III, or IV drug for the first time, and then at least once every four months as long as the prescription continues to be renewed (DOJ certified the system for statewide use on March 31, 2017; consultation requirements for prescribers outlined in SB 482 [Lara, Chapter 708, Statutes of 2016] take effect six months after DOJ certifies the system). Other recently enacted statutes require the DOJ to facilitate interoperability between health information technology systems and the CURES database, subject to a memorandum of understanding setting minimum security and privacy requirements.
Access to CURES is limited by a number of state and federal privacy laws, including HIPAA and CMIA. In 2017, the Supreme Court of California ruled in Lewis v. Superior Court that privacy interests are justified by the state’s interest in preventing drug diversion and protecting patients.
Interstate PDMP Datasharing. CURES currently only contains information related to prescriptions dispensed within California. This means that when a health practitioner consults a patient’s prescription history prior to writing a new prescription, information relating to prescriptions written in other states are not reflected in the activity report. For true “doctor shoppers,” traveling across state lines to secure prescriptions of opioids is not uncommon. This is especially true in communities located near California’s borders.
49 states including California and the District of Columbia currently have a PDMP. (Missouri has begun creating a PDMP pursuant to executive order in July of 2017.) Many of these states already participate in one of several interstate data share hubs that allow for the exchange of prescription information. For example, the National Association of Boards of Pharmacy administers PMP InterConnect, a technology solution developed in partnership with Appriss Health that currently connects 46 state PDMPs, including Nevada, Oregon, and Arizona. Another interstate data share hub, RxCheck, is operated by the federal Bureau of Justice Assistant using Prescription Monitoring Information Exchange National Architecture specifications developed by a PDMP Training and Technical Assistance Center housed within Brandeis University. These examples are in addition to other interstate data share hubs available, and additional health technology vendors will likely develop interconnection solutions as the importance of PDMPs continues to be recognized.
As attention to the opioid crisis continues to grow, CURES and other PDMPs are regularly mentioned as powerful tools for curbing the abuse of prescription drugs.
- Related Legislation This Year. CURES has been the focus of ongoing discussions in the Legislature, as California and the nation face an epidemic of prescription drug abuse and related overdose deaths.
SB 1240 (Stone) expands the drugs required to be reported and monitored in CURES to include all dangerous drugs and Schedule V controlled substances and requires inclusion of a description of the diagnosis, condition, or purpose for which the prescription was issued and the directions for use to the list of information pharmacies are required to report to CURES for each prescription. (Status: This bill is also pending in this committee.)
AB 1752 (Low) adds Schedule V drugs to CURES, changes the required timeframe in which pharmacists are required to report dispensed prescriptions from seven days to the following business day, and makes other technical changes. (Status: This bill is also pending in this committee.)
AB 1753 (Low) would limit the number of security printers authorized to manufacture prescription pads and linking uniquely serialized pads with CURES. (Status: This bill is also pending in this committee.)
AB 2086 (Gallagher) would allow prescribers of controlled substances to review a list of patients for whom they are listed as being the prescriber. (Status: This bill is also pending in this committee.)
AB 2783 (O’Donnell) would reconcile discrepancies between California’s controlled substance schedules and the corresponding federal controlled substance schedules. (Status: The bill is pending in the Senate Committee on Public Safety.)
AB 2789 (Wood) would require that prescriptions be submitted electronically, with limited exceptions. (Status: This bill is also pending in this committee.)
- Prior Related Legislation. AB 40 (Santiago, Chapter 607, Statutes of 2017) authorized an entity that operates a health information technology system to establish an integration with, and submit queries to CURES on either a user-initiated basis or automated basis, according to certain requirements.
SB 641 (Lara) of 2016 would have prohibited the DOJ from releasing data in CURES to a law enforcement agency except pursuant to a warrant. (Status: The measure did not move from the Assembly Committee on Public Safety.)
SB 482 (Lara, Chapter 708, Statutes of 2016) required a health care provider authorized to prescribe, order, administer, or furnish a controlled substance to consult CURES prior to prescribing a Schedule II, III or IV drug to a patient for the first time and at least once every four months thereafter if the substance remains part of the patient’s treatment. The bill provided exemptions from the responsibility to consult the CURES system, including while a patient is admitted to a certain type of facility, if a patient receives a non-refillable five-day supply or less prescription in conjunction with a surgery, and in the event of a technological failure or inability to access the CURES system.
SB 1258 (DeSaulnier) of 2014 would have made several changes to the ways that controlled substances are prescribed and tracked in the CURES and would have required medical providers to use electronic prescribing systems, would have required additional reporting of controlled substance prescribing, and would have placed additional restrictions on the prescribing of controlled substances.
(Status: The bill was held in the Senate Committee on Appropriations.)
SB 809 (De Saulnier, Chapter 400, Statutes of 2013) established a funding mechanism to update and maintain CURES, required all prescribing health care practitioners to apply to access CURES information, and established processes and procedures for regulating prescribing licensees through CURES and securing private information.
SB 151 (Burton, Chapter 406, Statutes of 2003) made the CURES program permanent.
AB 2655 (Matthews, Chapter 345, Statutes of 2002) extended the CURES program to 2008 and provided access to CURES data by licensed health care providers.
SB 1308 (Committee on Business and Professions, Chapter 655, Statutes of 1999) extended the sunset date on the CURES program to July 1, 2003 and required DOJ to submit annual status reports on the program to the Legislature.
AB 3042 (Takasugi, Chapter 738, Statutes of 1996) established a three year pilot program, beginning in July 1997, for the electronic monitoring of prescribing and dispensing of Schedule II controlled substances.
- Arguments in Support. Supporters cite this bill as a tool in the fight against opioid addiction and improper prescribing practices. The California Dental Association notes that enhancing CURES to allow prescribers, dispensers, regulators and law enforcement to share information across state lines will help curb the overprescribing of controlled substances and prevent unlawful doctor shopping. California Health+ Advocates states that this bill will enhance the state’s ability to monitor prescription drug use and abuse across state lines and the California Life Sciences Association notes that California collectively shares over one thousand miles of border with other states and without effective means of sharing prescription information, a greater probability exists of a doctor-shopping patient being able to elude detection.
According to the California Pharmacists Association, this bill addresses a glaring deficiency in the current CURES system. The California State Board of Pharmacy notes that 45 states currently share, or are in the process of setting up arrangements to share information about dispensed controlled substances and adds that one benefit of this bill is securing more complete medication histories of patients than are currently available to California’s practitioners since mail order pharmacies in other states represent a significant portion of prescription drug sales. The County Health Executives Association of California states that this bill would allow for the provision of more efficient and appropriate care both within and outside of the state. The Troy and Alana Pack Foundation supports the bill’s data-driven solution to prescription drug abuse.
- Arguments in Opposition. The American Civil Liberties Union (ACLU) is opposed to this bill unless it is amended. According to the ACLU, the bill should prohibit federal, state and local agencies from accessing personal information in CURES without a warrant based on probable cause. ACLU states that as currently drafted, the bill would allow disclosure of private details without any checks to ensure Californians’ privacy is protected. ACLU also requests amendments to better clarify whether out-of-state recipients must comply with California privacy and data security standards with regards to the way they access CURES or the information contained within CURES and believes that the Author should include language that directs DOJ to comply with the requirements for providers in the CMIA.
The California Medical Association (CMA) and California Academy of Family Physicians (CAFP) are also opposed to this bill unless it is amended, citing serious concerns with the lack of adequate privacy protections for the confidential patient information contained in CURES. According to CMA and CAFP, the explicit delineation of privacy and access to the information is a best practice that California has yet to implement and until it implements, the patient records contained in CURES should not be opened for sharing through state databases across the country.
The Electronic Frontier Foundation is opposed to this bill unless it is amended, stating similar arguments raised by ACLU above.
NOTE:
Double-referral to Senate Public Safety Committee, second.
SUPPORT AND OPPOSITION:
Support:
America’s Physician Groups
Biocom
California Association of Code Enforcement Officers
California Association of Health Underwriters
California Chiropractic Association
California College and University Policy Chiefs Association
California Dental Association
California District Attorneys Association
CaliforniaHealth+ Advocates
California Life Sciences Association
California Narcotics Officers Association
California Pharmacists Association
California Police Chiefs Association
California State Board of Pharmacy
California State Sheriffs’ Association
Consumer Attorneys of California
County Behavioral Health Directors Association of California
County Health Executives Association of California
Kaiser Permanente
Los Angeles County Professional Peace Officers Association
Medical Board of California
OCHIN
Office of the District Attorney of San Diego County
Troy and Alana Pack Foundation
Opposition:
American Civil Liberties Union
California Academy of Family Physicians
California Medical Association
Electronic Frontier Foundation
-- END --
ASSEMBLY THIRD READING
ATR Bill Id:AB 1751
Author:(Low)
As Introduced Ver:January 3, 2018
Majority vote
Committee | Votes | Ayes | Noes |
Business & Professions | 16-0 | Low, Brough, Arambula, Baker, Bloom, Chen, Chiu, Cunningham, Eggman, Fong, Gipson, Grayson, Holden, Irwin, Mullin, Ting | |
Public Safety | 6-0 | Jones-Sawyer, Lackey, Carrillo, Kamlager-Dove, Kiley, Santiago | |
Appropriations | 16-0 | Gonzalez Fletcher, Bigelow, Bloom, Bonta, Calderon, Carrillo, Chau, Eggman, Fong, Friedman, Gallagher, Eduardo Garcia, Nazarian, Obernolte, Quirk, Reyes |
|
SUMMARY: Authorizes the Department of Justice (DOJ) to share prescription records between its CURES prescription drug monitoring program (PDMP) and other databases across state lines, with a requirement that other states meet California's patient privacy and data security standards.
FISCAL EFFECT: According to the Assembly Committee on Appropriations, one-time costs of up to $1 million to DOJ to manage the required information technology project and potential ongoing costs of $700,000 annually to the DOJ for increased legal workload as a result of out-of-state cases, and $300,000 annually for development and maintenance of the interstate memoranda of understanding and to provide technical assistance to users.
COMMENTS:
Purpose. This bill is sponsored by the author. According to the author:
"As the opioid crisis receives growing national attention as one of the most devastating public health epidemics in modern history, California is fortunate to have CURES [Controlled Substance Utilization Review and Evaluation System], a powerful tool to promote safe prescribing and curb illicit doctor-shopping. With the Attorney General's successful launch of a state-of-the-art 'CURES 2.0' prescription drug monitoring program, it is now the Legislature's imperative to identify ways to further empower data-driven solutions to preventing prescription drug abuse and diversion. Upgrading CURES to allow the DOJ to enter into interstate data sharing agreements will provide invaluable cross-jurisdictional information to health professionals seeking to make informed decisions on behalf of their patients, particularly those practicing in communities neighboring other states."
Background.
CURES Database. CURES, established in 1996, is a database containing records of all Schedule II, II, and IV prescriptions dispensed in California. All prescribers and dispensers of controlled substances are required to obtain a login for access to CURES. For each dispensed Schedule II, III, or IV drug, pharmacists are required to report basic information about the patient and their prescription within seven days. Over 50 million prescription records have been uploaded into the system by dispensing pharmacists since the beginning of the CURES program.
CURES data is made available to other system users in a variety of possible contexts. Physicians may query a patient's prescription history prior to writing a new prescription; pharmacists can check the system before filling a prescription; regulators may review a licensee's prescribing practices as part of a disciplinary investigation; and law enforcement can incorporate a search of the system into a potential criminal case of drug diversion. Beginning October 2, 2018, health practitioners will be required to consult the CURES database prior to writing a prescription for a Schedule II, III, or IV drug for the first time, and then at least once every four months.
Last year, close to 10 million activity reports had been processed by practitioners, pharmacists, law enforcement, and regulatory users. Over 99% of these queries were made by prescribers and dispensers. Access to CURES is limited by a number of state and federal privacy laws. This includes the Health Insurance Portability and Accountability Act, the California Medical Information Act, and the Information Practices Act. Whether law enforcement use of the system implicates the Fourth Amendment's protections against unreasonable searches remains a topic of debate. In 2017, the Supreme Court of California ruled that any privacy intrusions are justified by the state's interest in preventing drug diversion and protecting patients.
Interstate PDMP Datasharing. Currently, the CURES database only contains information related to prescriptions dispensed within California. This means that when a health practitioner consults a patient's prescription history prior to writing a new prescription, information relating to prescriptions written in other states are not reflected in the activity report. For true "doctor shoppers," traveling across state lines to secure prescriptions of opioids is not uncommon. This is especially true in communities located near California's borders.
49 states including California and the District of Columbia currently have a PDMP. (Missouri has begun creating a PDMP pursuant to executive order in July of 2017.) Many of these states already participate in one of several interstate data share hubs that allow for the exchange of prescription information. For example, the National Association of Boards of Pharmacy administers PMP InterConnect, a technology solution developed in partnership with Appriss Health that currently connects 46 state PDMPs, including Nevada, Oregon, and Arizona. Another interstate data share hub, RxCheck, is operated by the federal Bureau of Justice Assistant using Prescription Monitoring Information Exchange National Architecture specifications developed by a PDMP Training and Technical Assistance Center housed within Brandeis University. These examples are in addition to other interstate data share hubs available, and additional health technology vendors will likely develop interconnection solutions as the importance of PDMPs continues to be recognized.
The provisions of this bill do not dictate that any current or prospective interstate data share hub be utilized for purposes of enabling CURES to exchange information with other PDMPs. The DOJ would retain the discretion to determine what entity to contract with for purposes of providing interjurisdictional prescription information sharing. The bill does, however, contain a requirement that any agreement entered into by the DOJ include language ensuring that all access to CURES data through the data share hub meet the same patient privacy and data security standards that apply for direct access to CURES under California law.
Analysis Prepared by: Robert Sumner / B. & P. / (916) 319-3301 FN: 0003315
Date of Hearing: May 2, 2018
ASSEMBLY COMMITTEE ON APPROPRIATIONS
Lorena Gonzalez Fletcher, Chair
ABPCA Bill Id:AB 1751
Author:(Low) – As Introduced Ver:January 3, 2018
Policy Committee: | Business and Professions Public Safety | Vote: Vote: | 16 - 0 6 - 0 |
Urgency: No State Mandated Local Program: No Reimbursable: No
SUMMARY:
This bill authorizes the Department of Justice to enter into an agreement with an entity operating an interstate data share hub to share prescription drug monitoring program (PDMP) data across state lines, and requires interstate agreements to uphold existing state patient privacy and data security standards.
FISCAL EFFECT:
- One-time costs of $1 million GF to DOJ to manage the required information technology project.
- Ongoing costs of $700,000 annually (Legal Services Revolving Fund) to the DOJ for increased legal workload as a result of out-of-state cases, and $300,000 GF annually for development and maintenance of the interstate memoranda of understanding and to provide technical assistance to users.
COMMENTS:
- Purpose. In light of the nationwide opioid crisis, this bill is intended to prevent drug diversion and "doctor-shopping" by patients by sharing data about drug prescribing and dispensing across state lines.
- Background. Prescription drug monitoring programs are critical to curbing prescription drug abuse. The state system, CURES, allows health professionals, regulators, and law enforcement personnel to conduct web-based searches of prescription drug data in order to inform prescribing and dispensing practices and to aid in investigations. CURES was established in its current form in 2008 and recently upgraded to “CURES 2.0,” which is a state-of-the-art tool. Prescribers and dispensers of controlled substances are required to obtain a login to access CURES. The vast majority of queries are from health care personnel seeking to review a patient’s prescription history. The National Boards of Pharmacy currently operates a PDMP called InterConnect that allows participating states to be linked. This bill will authorize DOJ, which houses CURES, to connect to this interstate hub to share data with other states.
- Related Legislation. There is a large number of bills introduced this year addressing various aspects of the opioid epidemic, including improvements to CURES, limits on opioid prescribing, higher reimbursement for drug treatment providers, and improved access to naloxone, which can prevent death from overdose.
- Support. A broad array of health care and public safety stakeholders support this bill, including various health care provider groups, pharmaceutical manufacturers, health plans and insurers, the California Police Chiefs, and the State Sheriff's Association. California Pharmacists Association indicates the bill will afford California pharmacists the opportunity to work across state lines to combat the opioid crisis.
- Opposition. The California Medical Association, California Academy of Family Physicians, and American Civil Liberties Union (ACLU) California oppose this bill, citing insufficient protections of patient privacy.
Analysis Prepared by: Lisa Murawski / APPR. / (916) 319-2081
Date of Hearing: April 24, 2018
Counsel: Sandra Uribe
ASSEMBLY COMMITTEE ON
Reginald Byron Jones-Sawyer, Sr., Chair
ABPCA Bill Id:
Author:() – As Ver:
SUMMARY:
Authorizes the Department of Justice (DOJ) to contract with an entity operating an interstate data-share hub for the purposes of participating in information sharing between prescription drug monitoring programs (PDMP) in other states. Specifically, this bill:
- Permits the DOJ to enter into an agreement with an entity operating an interstate data-sharing hub for the purposes of sharing information with PDMPs in other states.
- Requires that any such agreement ensure that all access to data within the Controlled Substance Utilization Review and Evaluation System (CURES) complies with California law and meets the same patient privacy and data security standards used and required for direct access of CURES.
EXISTING LAW:
- Authorizes a physician and surgeon to prescribe for, or dispense or administer to, a person under his or her treatment for a medical condition dangerous drugs or prescription controlled substances for the treatment of pain or a condition causing pain, including, but not limited to, intractable pain. (Bus. & Prof. Code, § 2241.5.)
- Specifies that a prescription for a controlled substance shall only be issued for a legitimate medical purpose and establishes responsibility for proper prescribing on the prescribing practitioner. A violation shall result in imprisonment for up to one year or a fine of up to $20,000, or both. (Health & Saf. Code, § 11153.)
- Establishes the CURES, a PDMP maintained by the DOJ, for the purposes of collecting records of dispensed controlled substances for review by licensed prescribers and dispensers, regulatory investigators, law enforcement, and statistical researchers. (Health & Saf. Code, § 11165, subd. (a).)
- Requires pharmacists and other dispensers to report information to CURES within seven days relating to prescriptions of Schedule II, III, and IV controlled substances. (Health & Saf. Code, § 11165, subd. (d).)
- Requires health care practitioners in receipt of a Federal Drug Enforcement Administration (DEA) certificate providing authorization to prescribe controlled substances, as well as pharmacists, to register for access to the CURES database. (Health & Saf. Code, § 11165.1, subd. (a).)
- Requires certain health care practitioners to consult the CURES database to review a patient’s controlled substance history before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every four months thereafter if the substance remains part of the treatment of the patient, with certain exceptions. This requirement is pending certification of readiness by the DOJ. (Health & Saf. Code, § 11165.4.)
- Requires the DOJ to upgrade CURES to allow health information technology systems that meet certain patient privacy and data security requirements to interoperate with the database, allowing prescribers and dispensers to make queries through their electronic health record applications. (Health & Saf. Code, § 11165.1.)
- Requires the CURES database to comply with all applicable federal and state privacy and security laws and regulations and requires the DOJ to establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES. (Health & Saf. Code, § 11165, subd. (c).)
- Prohibits any person from obtaining or attempting to obtain a prescription for controlled substances, by fraud, deceit, misrepresentation, subterfuge, or the concealment of a material fact. (Health & Saf. Code, § 11173.)
FISCAL EFFECT:
Unknown
COMMENTS:
- Author's Statement: According to the author, “As the opioid crisis receives growing national attention as one of the most devastating public health epidemics in modern history, California is fortunate to have CURES, a powerful tool to promote safe prescribing and curb illicit doctor-shopping. With the Attorney General’s successful launch of a state-of-the-art ‘CURES 2.0’ prescription drug monitoring program, it is now the Legislature’s imperative to identify ways to further empower data-driven solutions to preventing prescription drug abuse and diversion. Upgrading CURES to allow the DOJ to enter into interstate data sharing agreements will provide invaluable cross-jurisdictional information to health professionals seeking to make informed decisions on behalf of their patients, particularly those practicing in communities neighboring other states.”
- Prescription Drug Monitoring and CURES: A PDMP “an electronic database that tracks controlled substance prescriptions in a state. PDMPs can provide health authorities timely information about prescribing and patient behaviors.” (https://www.cdc.gov/drugoverdose/pdmp/states.html.) With rising levels of abuse, PDMPs are a critical tool in assisting law enforcement and regulatory bodies with their efforts to reduce drug diversion.
Forty-nine states currently have monitoring programs (Missouri is the only state currently without a PDMP). Of these 50 programs throughout the nation, seven are or will be housed at the state’s Department of Justice, 18 are or will be housed at a state Department of Health or substance abuse agency and 25 are or will be housed at a state Board of Pharmacy or state professional licensing agency. (http://www.pdmpassist.org/content/prescription-drug-monitoring-frequently-asked-questions-faq)
California’s PDMP is known as CURES. Data from CURES is managed by DOJ to assist state law enforcement and regulatory agencies in their efforts to reduce prescription drug diversion. CURES provides information that offers the ability to identify if a person is “doctor shopping” (when a prescription-drug addict visits multiple doctors to obtain multiple prescriptions for drugs, or uses multiple pharmacies to obtain prescription drugs). Information tracked in the system contains the patient name, prescriber name, pharmacy name, drug name, amount and dosage, and is available to law enforcement agencies, regulatory bodies and qualified researchers. (https://oag.ca.gov/cures) The system can also report on the top drugs prescribed for a specific time period, drugs prescribed in a particular county, doctor prescribing data, pharmacy dispensing data, and is a critical tool for assessing whether multiple prescriptions for the same patient may exist.
There currently is momentum to share data across these programs from state to state. The National Boards of Pharmacy (NABP) currently operates a PDMP, InterConnect, that allows participating states to be linked, providing a more effective means of combating drug diversion and drug abuse nationwide. Over 40 states are sharing data using InterConnect and several other are in the process of signing a Memorandum of Understanding to share data, or have expressed intent to do so. (https://nabp.pharmacy/initiatives/pmp-interconnect/)
This bill would authorize the DOJ to enter into an agreement for interstate data sharing.
- Privacy Implications of PDMPs: Data obtained from CURES can be provided to “appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes.” (Health & Saf. Code, § 11165, subd. (c)(2)(A).) Data may be also provided to public or private entities, as approved by the DOJ , for educational, peer review, statistical, or research purposes, provided that patient information, including any information that may identify the patient, is not compromised (Ibid.) Last year, the DOJ informed this committee that access to information in CURES depends on who is conducting the search as well as what information is sought.
When a health care professional that prescribes or dispenses controlled substances checks CURES before prescribing or dispensing a controlled substance to a patient, the physician, dentist, or pharmacist will sign on to the database with a username and password and can query a patient’s records based on last name, first name, and date of birth.
The process for law enforcement differs slightly and depends on whether law enforcement is seeking patient data or prescriber/pharmacist data. If law enforcement is seeking patient data, they must upload a case number, criminal code, and search warrant into the system, in addition to the patient’s last name, first name, and date of birth. In contrast, for prescriber or dispenser data, a search warrant is not required. This practice however is not codified in state law.
The CURES statute generally mandates that the database comply with all applicable federal and state privacy and security laws and regulations. (Health & Saf. Code, § 11165, subd. (c)(2)(A).) The question is whether this disclosure from CURES violates a patient’s right to privacy either under state or federal law.- California Privacy Law: The California Constitution expressly provides for the right of privacy among the inalienable rights it guarantees the citizens of the State. (Cal. Const. art. I, § 1.).
Additionally, prescription medical information, when in a person’s medical record, has the protections of the Confidential Medical Information Act. The Act provides that a health care provider is prohibited from disclosing a patient’s medical information without his or her authorization except in specified circumstances. One such exception exists where a search warrant has been lawfully issued to a governmental law enforcement agency. (Cal. Civ. Code, § 56.10, subd. (b)(6).)
In Lewis v. Superior Court (2017) 3 Cal.5th 561, the California Supreme Court addressed the constitutional right to privacy in context of CURES. The question before the court was whether the Medical Board violated the privacy rights of patients under the state constitution when it obtained data from CURES without a warrant or subpoena when it investigated the patients’ physician. (Id. at 565.) The board, which investigates physicians based on complaints or on its own initiative, is charged with the duty to protect the public against incompetent, impaired or negligent physicians. (Id. at p. 567.) The board’s investigators are peace officers. (Ibid.)
The Supreme Court balanced the patients’ right to privacy in their controlled substance prescription records against the state’s interest in protecting public from unlawful use and diversion of dangerous prescription drugs and protecting the public form negligent or incompetent physicians. (Lewis, supra, 3 Cal.5th at pp. 572-574.) The court found that while patients retain a reasonable expectation of privacy in their prescription records, it is not as high as the privacy interest associated with medical records. (Id. at p. 575.) The court noted that there are safeguards in statute to limit the degree to which a patient’s privacy is invaded when the board examines prescription records. (Id. at p. 577.) Accordingly, the court concluded that the board did not violate the patients’ constitutional right to privacy by examining the patient prescription records in CURES. (Ibid.) - Fourth Amendment Protections: In Lewis, supra, 3 Cal.5th 561, the Supreme Court declined to consider the petitioner’s claim that the Medical Board’s access CURES records violated the Fourth Amendment to the United States Constitution because that claim was not raised in the administrative proceedings. (Id. at p. 578.)
The Fourth Amendment guarantees “[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.” Application of the Fourth Amendment depends on whether the person invoking its protection can claim a justifiable, a reasonable, or a legitimate expectation of privacy that has been invaded by government action. Whether the Fourth Amendment protections apply to CURES and other PDMPs is an open question.
However, several federal courts have held that the federal DEA need not secure a warrant to access data in a PDMP. Recently, in Oregon Prescription Drug Monitoring Program v. United States DEA (9th Cir. 2017) 800 F.3d 1228, the Ninth Circuit Court of Appeals ruled that the federal Drug Enforcement Agency does not need a court order to subpoena Oregon’s PDMP. Oregon’s statute requires a court order in order for a federal, state, or local law enforcement agency engaged in a drug-related investigation to obtain prescription monitoring information. (Id. at p. 1232, citing Or. Rev. Stat. § 431A.865(2)(a)(F).) The DEA sought the PDMP records of a patient and of two doctors. Oregon argued that, under state law, it could not be compelled to produce the records without a federal court order. The American Civil Liberties Union (ACLU) sought to intervene in the case on behalf of four patients and a physician and argued that the use of investigative subpoenas violated the Fourth Amendment. (Ibid.) The court held that Oregon’s statutory requirement for a court order in all cases conflicted with, and was preempted by, federal law, the Controlled Substances Act, which authorizes the Attorney General to issue administrative subpoenas to investigate drug crimes. (Id. at pp. 1236-1237.) This authority has been delegated to the DEA. (Id. at pp. 1231.)
The court’s ruling left open the question of whether administrative subpoenas by the DEA of the information in the PDMP would violate Fourth Amendment protections against unreasonable searches and seizures. That claim was not addressed because the court determined that the individuals represented by the ACLU did not have standing to seek relief that was different from the State of Oregon. (Oregon Prescription Drug Monitoring Program, supra, 800 F.3d at pp. 1231, & 1234-1235.)
- California Privacy Law: The California Constitution expressly provides for the right of privacy among the inalienable rights it guarantees the citizens of the State. (Cal. Const. art. I, § 1.).
To address privacy implications, this bill would provide that any interstate data sharing complies with California law and meets the same patient privacy and data security standards used and required for direct access of CURES.
- Argument in Support: According to the California Pharmacists Association, “CPhA is fully aware of the gravity of the opioid epidemic gripping California and has been on the forefront of addressing opioid overdose deaths. We are pleased to see your efforts to address a glaring deficiency in the current CURES system, which currently has no ability to track a patient’s prescription usage across our borders. Interstate integration is key to addressing the prescription drug abuse crisis by preventing ‘doctor shopping.’
“39 states, including our neighboring states already utilize a system which provides the healthcare team the ability to access the health records of patients from states who use an integrated, interstate system. Allowing California pharmacists the opportunity to work with our colleagues across state lines will provide another tool in combatting this growing crisis.” - Argument in Opposition: According to the California Medical Association, “While we believe participation in an interstate system will help in indentifying opiod-abusing patients shopping for medications across state lines, we have serious concerns with the lack of adequate privacy protections for the confidential patient information contained in CURES when accessed within California. As such we strongly oppose efforts to grant access to this data across state lines without first establishing sufficient patient protections.
“Though each state’s Prescription Drug Monitoring Program (PDMP) has its own unique statutory authority, California’s CURES Database has some qualities that put it outside standard practice. First, according to the National Alliance for Model State Drug Laws (NAMSDL), California is one of three states which houses its PDMP in a law enforcement entity. The majority are housed in a health department or Board of Pharmacy. Additionally, California is one of the few states that does not specify in statute the authorized recipients of information from the PDMP.
“The sensitive and confidential nature of the information in the database requires a thoughtful sharing approach that balances California’s longstanding policy of protecting patient privacy while also weighing the needs of the many different types of entities who may use CURES data, including for public health and safety purposes. The explicit delineation of privacy and access to the information is a best practice that California has yet to implement and until implemented, the patient records contained in CURES should be vigorously protected, not opened for sharing through state databases across the country.” - Related Legislation:
- AB 1752 (Low) requires the prescribing and dispensing of Schedule V controlled substances to be monitored in CURES. AB 1752 will be heard in this committee today.
- AB 1753 (Low) would limit the number of security printers authorized to manufacture prescription pads and link uniquely serialized pads with CURES. AB 1753 will be heard in this committee today.
- AB 2086 (Gallagher) would allow prescribers of controlled substances to review a list of patients for whom they are listed as being the prescriber. AB 2086 is pending in the Assembly Appropriations Committee.
- Prior Legislation:
- AB 40 (Santiago), Chapter 607, Statutes of 2017, requires the DOJ to make electronic prescription drug records contained in CURES accessible through integration with a health information technology system no later than October 1, 2018, if that system meets certain information security and patient privacy requirements.
- SB 641 (Lara), of the 2017-2018 Legislative Session, would have prohibited the DOJ from releasing data in CURES to a law enforcement agency except pursuant to a warrant. SB 641 was never heard in this committee.
- SB 482 (Lara), Chapter 708, Statutes of 2016, required prescribers to consult the CURES prior to prescribing a drug to a patient, as specified.
- SB 360 (DeSaulnier), Chapter 418, Statutes of 2011, updated CURES to reflect the new PDMP and authorizes DOJ to initiate administrative enforcement actions to prevent the misuse of confidential information collected through CURES.
- AB 40 (Santiago), Chapter 607, Statutes of 2017, requires the DOJ to make electronic prescription drug records contained in CURES accessible through integration with a health information technology system no later than October 1, 2018, if that system meets certain information security and patient privacy requirements.
REGISTERED SUPPORT / OPPOSITION:
Support
America’s Physician Groups
Biocom
Blue Shield of California
California Association of Health Underwriters
California Chiropractic Association
California Dental Association
California District Attorneys Association
California Health Advocates
California Life Sciences Association
California Pharmacists Association
California Police Chiefs
California Society of Anesthesiologists
California Society of Health-System Pharmacists
California State Board of Pharmacy
California State Sheriffs’ Association
Consumer Attorneys of California
County Health Executives Association of California
Medical Board of California
Kaiser Permanente
Ochin
San Diego County District Attorney
Troy and Alana Pack Foundation
Opposition
American Civil Liberties Union of California
California Academy of Family Physicians
California Medical Association
Analysis Prepared by:
Date of Hearing: April 10, 2018
ASSEMBLY COMMITTEE ON BUSINESS AND PROFESSIONS
Evan Low, Chair
ABPCA Bill Id:AB 1751
Author:(Low) – As Introduced Ver:January 3, 2018
SUBJECT: Controlled substances: CURES database.
SUMMARY: Authorizes the California Department of Justice (DOJ) to share prescription records between the state’s prescription drug monitoring program (PDMP) and other databases across state lines, with a requirement that other states meet California’s patient privacy and data security standards.
EXISTING LAW:
- Allows only a physician, dentist, podiatrist, veterinarian, naturopathic doctor, registered nurse, certified nurse-midwife, optometrist, or out-of-state prescriber to write or issue a prescription. (Health and Safety Code (HSC) § 11150)
- States that a prescription for a controlled substance shall only be issued for a legitimate medical purpose by an individual practitioner acting in the usual course of his or her professional practice, and that the responsibility for the proper prescribing and dispensing of controlled substances is upon the prescribing practitioner, but a corresponding responsibility rests with the pharmacist who fills the prescription. (HSC § 11153)
- Prohibits medical professionals from prescribing, administering, or dispensing a controlled substance to an addict, as defined. (HSC § 11156)
- Establishes the Controlled Substance Utilization Review and Evaluation System (CURES), a PDMP maintained by the DOJ for the purposes of collecting records of dispensed controlled substances for review by licensed prescribers and dispensers, regulatory investigators, law enforcement, and statistical researchers. (HSC § 11165(a))
- Requires pharmacists and other dispensers to report information to CURES within 7 days relating to prescriptions of Schedule II, III, and IV controlled substances. (HSC § 11165(d))
- Requires health care practitioners in receipt of a federal Drug Enforcement Administration (DEA) certificate providing authorization to prescribe controlled substances, as well as pharmacists, to register for access to the CURES database. (HSC § 11165.1(a))
- Pending certification of readiness by the DOJ, requires certain health care practitioners to consult the CURES database to review a patient’s controlled substance history before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every four months thereafter if the substance remains part of the treatment of the patient, with certain exceptions. (HSC § 11165.4)
- Requires the DOJ to upgrade CURES to allow health information technology systems that meet certain patient privacy and data security requirements to interoperate with the database, allowing prescribers and dispensers to make queries through their electronic health record applications. (HSC § 11165.1)
- Prohibits any person from obtaining or attempting to obtain a prescription for controlled substances, by fraud, deceit, misrepresentation, subterfuge, or the concealment of a material fact. (HSC § 11173)
- Enables security printers and prescribers to report stolen or lost prescription pads to the DOJ through CURES. (HSC § 11165.3)
- Provides dedicated funding for the CURES program through an annual license fee of $6 assessed for licensees authorized to prescribe or dispense controlled substances in California. (Business and Professions Code (BPC) § 208)
- Authorizes the DOJ to seek voluntarily contributed private funds from insurers, health care service plans, qualified manufacturers, and other donors for the purpose of supporting CURES. (HSC § 11165.5)
- Allows the DOJ to conduct audits of CURES and its users and issue citations and fines for system misuse. (HSC § 11165.2)
- Requires the CURES database to comply with all applicable federal and state privacy and security laws and regulations and requires the DOJ to establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES. (HSC § 11165(c))
THIS BILL:
- Permits the DOJ to enter into an agreement with an entity operating an interstate data share hub for purposes of participating in interjurisdictional information sharing between prescription drug monitoring programs across state lines.
- Requires that any agreement entered into by the DOJ for purposes of interstate data sharing shall ensure that all access to data within CURES complies with California law and meets the same patient privacy and data security standards employed and required for direct access of CURES.
FISCAL EFFECT: Unknown; this bill is keyed fiscal by the Legislative Counsel.
COMMENTS:
Purpose. This bill is sponsored by the author. According to the author:
“As the opioid crisis receives growing national attention as one of the most devastating public health epidemics in modern history, California is fortunate to have CURES, a powerful tool to promote safe prescribing and curb illicit doctor-shopping. With the Attorney General’s successful launch of a state-of-the-art ‘CURES 2.0’ prescription drug monitoring program, it is now the Legislature’s imperative to identify ways to further empower data-driven solutions to preventing prescription drug abuse and diversion. Upgrading CURES to allow the DOJ to enter into interstate data sharing agreements will provide invaluable cross-jurisdictional information to health professionals seeking to make informed decisions on behalf of their patients, particularly those practicing in communities neighboring other states.”
Background.
Overview of the Opioid Crisis. In October of 2017, the White House declared the opioid crisis a public health emergency, formally recognizing what had long been understood to be a growing epidemic responsible for devastation in communities across the country. According to the Centers for Disease Control and Prevention, as many as 50,000 Americans died of an opioid overdose in 2016, representing a 28 percent increase over the previous year. Additionally, the number of Americans who died of an overdose of fentanyl and other opioids more than doubled during that time with nearly 20,000 deaths. These death rates compare to, and potentially exceed, those at the height of the AIDS epidemic.
Opioids are a class of drugs prescribed and administered by health professionals to manage pain. Modern use of the term “opioid” typically describes both naturally occurring opiates derived from the opium poppy as well as their manufactured synthetics. Common examples of prescription opioids include oxycodone (OxyContin, Percocet); hydrocodone (Vicodin, Norco, Lorcet); codeine; morphine; and fentanyl. Heroin is also an opioid.
In addition to providing pain relief, opioids can be used as a cough suppressant, an antidiarrheal, a method of sedation, and a treatment for shortness of breath. The majority of pharmaceutical opioids are Schedule II drugs under the federal Controlled Substances Act, considered by the federal Drug Enforcement Agency (DEA) to have a high potential for abuse that may lead to severe psychological or physical dependence. However, combination drugs containing lower doses of opioids combined with other active ingredients are typically less restricted; for example, cough syrups containing low doses of codeine are frequently classified Schedule V medications.
The abuse of prescription drugs was historically viewed as a criminal concern analogous to street narcotics cases regularly investigated by law enforcement. In recent years, however, an expert consensus has evolved around the opinion that the opioid crisis must be addressed through the lens of public health policy. This belief is supported by research demonstrating how health professionals may have inadvertently contributed to the origins of the crisis. It is widely accepted that health professionals will play a necessarily critical role in any meaningful solutions.
In the opioid crisis’s broader national context, there has been a persistent perception that California represents a relatively minor segment of an epidemic more typically identified with states like New Hampshire and West Virginia. However, there is substantial evidence that communities in California have been much harder hit than may be generally believed. For example, in 2015, several rural counties in California saw as many or more drug overdose deaths per 100,000 residents than some Midwestern states. It has been reported than some small counties had more opioid prescriptions than residents. In total, the California Department of Public Health estimates that nearly 2,000 Californians died of an opioid overdose in 2016.
In February of 2018, a bipartisan coalition of California State Assemblymembers announced a package of legislation aimed at combating the opioid crisis. The bills have been presented as representing a diversity of approaches to curbing overprescription, encouraging treatment, and preventing diversion. The potential of each proposed measure to effectively address the epidemic of prescription drug abuse must be evaluated in proportion to any added burden to those health professionals who remain tasked with ensuring that legitimate treatment continues to be provided to patients with pain management needs.
CURES Database. CURES was first established in 1996 as a “technologically sophisticated” database containing prescription records collected through California’s Triplicate Prescription Program, which provided the DOJ with copies of all Schedule II drug prescriptions. Subsequent legislation made CURES the state’s sole prescription record repository and added Schedule III and IV drugs to the database. In 2008, CURES was upgraded to function as a PDMP, allowing health professionals, regulators, and law enforcement to conduct web-based searches of the system to inform prescribing practices and support investigations.
Budget problems later plagued the database as the elimination of the DOJ’s Bureau of Narcotics Enforcement effectively defunded the CURES program. Users of the system complained that the PDMP offered insufficient client support and was plagued with technical issues. In response, Attorney General Kamala D. Harris sponsored legislation to overhaul the database with revenue newly derived from a $6 license fee for healing arts professionals. The resulting system, commonly referred to as “CURES 2.0,” is considered to be a significantly improved, state-of-the-art tool for addressing the abuse and diversion of opioids and other prescription drugs.
Every dispenser of controlled substances and every health practitioner authorized by the DEA to prescribe controlled substances is required to obtain a login for access to CURES. For each dispensed Schedule II, III, or IV drug, pharmacists are required to report basic information about the patient and their prescription within 7 days. This information is then made available to other system users in a variety of possible contexts. For example, physicians may query a patient’s prescription history prior to writing a new prescription; pharmacists can check the system before agreeing to fill a prescription for a controlled substance; regulators may review a licensee’s prescribing practices as part of a disciplinary investigation; and law enforcement can incorporate a search of the system into a potential criminal case of drug diversion.
Over 50 million prescription records have been uploaded into the system by dispensing pharmacists since the beginning of the CURES program. As of January 1, 2018, 170,422 users had been approved for access to the system. Last year, close to 10 million activity reports had been processed by practitioners, pharmacists, law enforcement, and regulatory users. The vast majority of these searches (over 99%) were queries made by prescribers and dispensers seeking to review a patient’s prescription history as a component of exercising informed clinical judgment before providing access to opioids or other controlled substances.
Access to CURES is limited by a number of state and federal privacy laws. This includes the Health Insurance Portability and Accountability Act (HIPAA), the California Medical Information Act, and the Information Practices Act. Whether law enforcement use of the system implicates the Fourth Amendment’s protections against unreasonable searches remains a topic of debate. In 2017, the Supreme Court of California ruled in Lewis v. Superior Court that privacy interests are justified by the state’s interest in preventing drug diversion and protecting patients.
Beginning six months from a to-be-announced date of certification by the Attorney General, health practitioners will be required to consult the CURES database prior to writing a prescription for a Schedule II, III, or IV drug for the first time, and then at least once every four months as long as the prescription continues to be renewed. Other recently enacted statutes require the DOJ to facilitate interoperability between health information technology systems and the CURES database, subject to a memorandum of understanding setting minimum security and privacy requirements. As attention to the opioid crisis continues to grow, CURES and other PDMPs are regularly mentioned as powerful tools for curbing the abuse of prescription drugs.
Interstate PDMP Datasharing. Currently, the CURES database only contains information related to prescriptions dispensed within California. This means that when a health practitioner consults a patient’s prescription history prior to writing a new prescription, information relating to prescriptions written in other states are not reflected in the activity report. For true “doctor shoppers,” traveling across state lines to secure prescriptions of opioids is not uncommon. This is especially true in communities located near California’s borders.
49 states including California and the District of Columbia currently have a PDMP. (Missouri has begun creating a PDMP pursuant to executive order in July of 2017.) Many of these states already participate in one of several interstate data share hubs that allow for the exchange of prescription information. For example, the National Association of Boards of Pharmacy administers PMP InterConnect, a technology solution developed in partnership with Appriss Health that currently connects 46 state PDMPs, including Nevada, Oregon, and Arizona. Another interstate data share hub, RxCheck, is operated by the federal Bureau of Justice Assistant using Prescription Monitoring Information Exchange National Architecture specifications developed by a PDMP Training and Technical Assistance Center housed within Brandeis University. These examples are in addition to other interstate data share hubs available, and additional health technology vendors will likely develop interconnection solutions as the importance of PDMPs continues to be recognized.
The provisions of this bill do not dictate that any current or prospective interstate data share hub be utilized for purposes of enabling CURES to exchange information with other PDMPs. The DOJ would retain the discretion to determine what entity to contract with for purposes of providing interjurisdictional prescription information sharing. The bill does, however, contain a requirement that any agreement entered into by the DOJ include language ensuring that all access to CURES data through the data share hub meet the same patient privacy and data security standards that apply for direct access to CURES under California law.
Current Related Legislation. AB 1752 (Low) would add Schedule V drugs to the CURES database and change the requirement for pharmacists to report dispensed prescriptions from seven days to the following business day.
AB 1753 (Low) would limit the number of security printers authorized to manufacture prescription pads and linking uniquely serialized pads with CURES.
AB 2384 (Arambula) would remove barriers to medication-assisted treatment, such as prior authorization requirements and limits on coverage.
AB 2741 (Burke) would limit all opioid prescriptions for minors to a maximum of 5 days, with exceptions, and require a prescriber to discuss risks related to opioid medication with the minor and the minor’s parent or guardian and obtain written consent prior to writing the prescription.
AB 2859 (Caballero) would increase safe storage practices among parents to prevent access to prescription drugs in the home by children and adolescents.
AB 2086 (Gallagher) would allow prescribers of controlled substances to review a list of patients for whom they are listed as being the prescriber.
AB 2487 (McCarty) would add opioid addiction training as a continuing medical education requirement for certain physicians to increase the availability of buprenorphine treatment.
AB 2486 (McCarty) would establish the Opioid Prevention and Rehabilitation Program Fund to treat opioid addiction by providing existing programs the additional funding.
AB 2783 (O’Donnell) would reconcile discrepancies between California’s controlled substance schedules and the corresponding federal controlled substance schedules.
AB 1963 (Waldron) would incentivize medical providers to become certified prescribers of medication-assisted treatment by increasing the reimbursement rates for providers who prescribe these drug treatments.
AB 2789 (Wood) would require that prescriptions be submitted electronically, with limited exceptions.
AB 2760 (Wood) would require certain prescriptions for opioids to also include a co-prescription for naloxone.
Prior Related Legislation. AB 3042 (Takasugi, Chapter 345, Statutes of 2002) first established CURES as a pilot project operating concurrently with the state’s Triplicate Prescription Program.
SB 151 (Burton, Chapter 406, Statutes of 2003) made CURES the state’s permanent prescription tracking program and added Schedule III drugs to the database.
SB 734 (Torlakson, Chapter 487, Statutes of 2005) created the framework to upgrade the CURES prescription database into a searchable, client-facing PDMP.
AB 2986 (Mullin, Chapter 286, Statutes of 2006) added Schedule IV drugs to the CURES database.
SB 809 (DeSaulnier, Chapter 400, Statutes of 2013) established new healing arts license fees to fund the development and maintenance a new and improved “CURES 2.0” database.
SB 482 (Lara, Chapter 708, Statutes of 2016) mandated that health practitioners consult a patient’s history in CURES prior to prescribing them a Schedule II, III, or IV controlled substance for the first time and then at least once every four months as long as the prescription continued to be renewed.
AB 40 (Santiago, Chapter 607, Statutes of 2017) required the DOJ to facilitate interoperability between health information technology systems and the CURES database, subject to a memorandum of understanding setting minimum security and privacy requirements.
ARGUMENTS IN SUPPORT:
The California Dental Association (CDA), representing 27,000 dentists across the state, supports AB 1751. CDA writes that “enhancing CURES to allow California’s prescribers, dispensers, regulators, and law enforcement to share information across state lines will help curb the overprescribing of controlled substances and prevent unlawful ‘doctor shopping.’ As an organization representing providers committed to seriously combatting the urgent opioid crisis, CDA wholeheartedly supports this data-driven solution to prescription drug abuse. As national attention toward the opioid epidemic grows, it is important that California continues to lead the way in innovative and responsive policy.”
The California State Board of Pharmacy, long supportive of allowing for interstate PDMP data sharing and a member of the CURES program’s executive-level Change Control Board, supports the bill. The board’s executive officer writes that AB 1751 would provide “more complete information for California’s health care providers when prescribing or dispensing controlled substances.” The board also notes that a specific benefit of sharing information between states is that it would capture prescriptions dispensed through mail order pharmacies, “which sometimes are located outside California” and represent “24 percent of the $650 billion in manufacturers’ sales of prescription drugs in 2016.”
The Medical Board of California (MBC), another member of the CURES program’s Change Control Board, is also in support. The MBC believes that “CURES is a very important enforcement tool and an effective aid for physicians to use to prevent doctor shopping. This bill will give physicians access to prescription drug information from other states, which will help to further the Board’s mission of consumer protection.”
America’s Physician Groups (APG) supports the bill. APG describes itself as “the nation’s largest professional association for accountable physician groups, composed of about 300 medical groups and independent practice associations across 44 states.” Acknowledging the urgency of addressing the opioid abuse crisis, APG states that “combatting abuses can be helped by encouraging interjurisdictional data sharing as this problem crosses state boundaries.
Kaiser Permanente, the country’s largest managed care organization representing one of the state’s broadest networks of hospitals, supports AB 1751. Kaiser Permanente states that it is “committed to providing safe, appropriate care to our members, and to ensure that we give our physicians the tools and support needed for consistent opioid prescribing, monitoring, and documentation. This legislation is important to fill that commitment, allowing us to track the medication history of patients who move between multiple states or who live close to the state’s border.”
The California Pharmacists Association (CPhA) is also in support of AB 1751. As the largest state association representing pharmacists, CPhA states that it is “fully aware of the gravity of the opioid epidemic gripping California and has been on the forefront of addressing opioid overdose deaths.” CPhA describes the bill as resolving “a glaring deficiency in the current CURES system, which currently has no ability to track a patient’s prescription usage across our borders. Interstate integration is key to addressing the prescription drug abuse crisis by preventing ‘doctor shopping’.”
OCHIN, describing itself as “one of the largest and most successful health information and innovation networks in the United States,” writes in support of AB 1751. OCHIN writes that the bill aligns with its commitment to “improve the integration and delivery of health care services across a wide variety of practices, with an emphasis on safety net clinics and small practices as well as critical access and rural hospitals.” OCHIN states that “allowing health care providers in one state to see what others are doing in other states just makes sense.”
The County Health Executives Association of California (CHEAC), representing the local health departments, supports AB 1751. According to CHEAC, “allowing the DOJ to participate across state lines to share prescription drug dispensing information would provide California with a more comprehensive view of prescribing patterns particularly for California communities that border other states. The interstate cooperation and data sharing AB 1751 authorizes would allow for the provision of more efficient and appropriate care both within and outside California.”
ARGUMENTS IN OPPOSITION:
The California Medical Association (CMA) has taken an “oppose unless amended” position on the bill. CMA acknowledges that “participation in an interstate system will help in identifying opioid-abusing patients shopping for medications across state lines.” However, CMA states that it has “serious concerns with the lack of adequate privacy protections for the confidential patient information contained in CURES when accessed from within California.” CMA therefore states that it must oppose the bill unless “sufficient patient protections” are enacted for existing use of the database. CMA additionally notes that “California is one of the few states that does not specify in statute the authorized recipients of information from the PDMP.”
The American Civil Liberties Union (ACLU) also holds an “oppose unless amended” position on the bill. The ACLU argues that “prescription history contained in CURES” represents “some of the most sensitive personal information,” because prescriptions of certain specific medications could theoretically be linked to possible health conditions considered to be of a sensitive nature. The ACLU argues that “these are private details that should not be disclosed to law enforcement agencies or others without judicial oversight to ensure there is probable cause of wrongdoing that requires such a government invasion of private information.” The ACLU therefore requests that the bill be amended “to protect patients’ extremely sensitive medical information from unnecessary disclosure by prohibiting federal, state, and local agencies from accessing personal information in [CURES] without a warrant based on probable cause.”
REGISTERED SUPPORT:
America’s Physician Groups
Biocom
California Association of Health Underwriters
California Chiropractic Association
California Dental Association
California District Attorneys Association
CaliforniaHealth+ Advocates
California Life Sciences Association
California Pharmacists Association
California Police Chiefs Association
California State Board of Pharmacy
California State Sheriffs’ Association
Consumer Attorneys of California
County Health Executives Association of California
Kaiser Permanente
Medical Board of California
OCHIN
San Diego County District Attorney Summer Stephan
Troy and Alana Pack Foundation
REGISTERED OPPOSITION:
American Civil Liberties Union
California Medical Association
Analysis Prepared by: Robert Sumner / B. & P. / (916) 319-3301
Discussed in Hearing
38SEC
Assembly Floor
3MIN
Senate Floor
1H
Senate Standing Committee on Appropriations
12MIN
Senate Standing Committee on Public Safety
18MIN
Senate Standing Committee on Business, Professions and Economic Development
43SEC
Assembly Floor
7MIN
Assembly Standing Committee on Public Safety
7MIN
Assembly Standing Committee on Business and Professions
Bill Author
Bill Co-Author(s):