Bill Text

Bill Information

PDF |Add To My Favorites |Track Bill | print page

AB-40 CURES database: health information technology system.(2017-2018)

SHARE THIS:share this bill in Facebookshare this bill in Twitter
Date Published: 05/27/2017 04:00 AM
AB40:v97#DOCUMENT

Amended  IN  Assembly  May 26, 2017
Amended  IN  Assembly  April 19, 2017

CALIFORNIA LEGISLATURE— 2017–2018 REGULAR SESSION

Assembly Bill No. 40


Introduced by Assembly Member Santiago

December 05, 2016


An act to amend Section 11165.1 of the Health and Safety Code, relating to controlled substances, and declaring the urgency thereof, to take effect immediately.


LEGISLATIVE COUNSEL'S DIGEST


AB 40, as amended, Santiago. CURES database: health information technology system.
Existing law classifies certain controlled substances into designated schedules. Existing law requires the Department of Justice to maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense a Schedule II, Schedule III, or Schedule IV controlled substance.
This bill would require the Department of Justice to make the electronic history of controlled substances dispensed to an individual under a health care practitioner’s care, based on data contained in the CURES database, available to the practitioner through either an online Internet Web portal or an authorized health information technology system, as defined. The bill would authorize an entity that operates a health information technology system to establish an integration with and submit queries to the CURES database if the system entity can certify, among other requirements, that the data received from the CURES database will not be used for any purpose other than delivering the data to an authorized health care practitioner or performing data processing activities necessary to enable delivery, and that the system meets applicable patient privacy and information security requirements of state and federal law. The bill would also authorize the Department of Justice to require an entity operating a health information technology system that is requesting to establish an integration with the CURES database to enter into a memorandum of understanding or other agreement setting forth terms and conditions with which the entity must comply.
This bill would declare that it is to take effect immediately as an urgency statute.
Vote: 2/3   Appropriation: NO   Fiscal Committee: YES   Local Program: NO  

The people of the State of California do enact as follows:


SECTION 1.

 Section 11165.1 of the Health and Safety Code, as amended by Section 2 of Chapter 708 of the Statutes of 2016, is amended to read:

11165.1.
 (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, or Schedule IV controlled substances pursuant to Section 11150 shall, before July 1, 2016, or upon receipt of a federal Drug Enforcement Administration (DEA) registration, whichever occurs later, submit an application developed by the department to obtain approval to access information regarding the controlled substance history of a patient through an online Internet Web portal that is maintained by the department, or through an authorized health information technology system, and, upon approval, the department shall release to that practitioner, through an online Internet Web portal or an authorized health information technology system, the electronic history of controlled substances dispensed to an individual under his or her care based on data contained in the CURES Prescription Drug Monitoring Program (PDMP).
(ii) A pharmacist shall, before July 1, 2016, or upon licensure, whichever occurs later, submit an application developed by the department to obtain approval to access information online regarding the controlled substance history of a patient that is stored on the Internet and maintained within the department, and, upon approval, the department shall release to that pharmacist the electronic history of controlled substances dispensed to an individual under his or her care based on data contained in the CURES PDMP.
(B) An application may be denied, or a subscriber may be suspended, for reasons which include, but are not limited to, the following:
(i) Materially falsifying an application for a subscriber.
(ii) Failure to maintain effective controls for access to the patient activity report.
(iii) Suspended or revoked federal DEA registration.
(iv) Any subscriber who is arrested for a violation of law governing controlled substances or any other law for which the possession or use of a controlled substance is an element of the crime.
(v) Any subscriber accessing information for any other reason than caring for his or her patients.
(C) Any authorized subscriber shall notify the department within 30 days of any changes to the subscriber account.
(D) A An entity that operates a health information technology system may establish an integration with and submit queries to the CURES database on either a user-initiated basis or an automated basis if the system entity can certify all of the following:
(i) The health information technology system can establish it has been is authorized to query the CURES database on behalf of an authorized health care practitioner on either a user-initiated basis, an automated basis, or both, for purposes of delivering patient data from the CURES database to assist an authorized health care practitioner with evaluating the need for medical or pharmaceutical treatment or providing medical or pharmaceutical treatment to a patient for whom a health care practitioner is providing or has provided care.
(ii) The health information technology system entity will not use or disclose data received from the CURES database for any purpose other than delivering the data to an authorized health care practitioner or performing data processing activities that may be necessary to enable this delivery.
(iii) The health information technology system authenticates will authenticate the identity of any authorized health care practitioner initiating queries to the CURES database on either a user-initiated basis or an automated basis and, at the time of the query to the CURES database, the health information technology system submits the following data regarding the query to CURES:
(I) The date of the query.
(II) The time of the query.
(III) The first and last name of the patient queried.
(IV) The date of birth of the patient queried.
(V) The identification of the CURES user for whom the system is making the query.
(iv) The health information technology system meets applicable patient privacy and information security requirements of state and federal law.
(E) The department may, in its discretion, determine whether to establish a direct system integration between one or more health information technology systems and the CURES database, or whether to develop a gateway system to which multiple health information technology systems can establish an integration for purposes of accessing the CURES database.
(F) The department may require an entity that operates a health information technology system that is requesting to establish an integration with the CURES database to enter into a memorandum of understanding or other agreement that sets forth terms and conditions with which the entity shall comply, including, but not limited to, all of the following:
(i) Paying a reasonable fee to cover the cost of establishing and maintaining integration with the CURES database.
(ii) Enforcement mechanisms for failure to comply with oversight or audit activities by the department, up to and including termination of access to the CURES database.
(iii) Any other term or condition that the department may determine in its reasonable discretion is necessary to carry out the intent of this section.
(2) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, or Schedule IV controlled substances pursuant to Section 11150 or a pharmacist shall be deemed to have complied with paragraph (1) if the licensed health care practitioner or pharmacist has been approved to access the CURES database through the process developed pursuant to subdivision (a) of Section 209 of the Business and Professions Code.
(b) Any request for, or release of, a controlled substance history pursuant to this section shall be made in accordance with guidelines developed by the department.
(c) In order to prevent the inappropriate, improper, or illegal use of Schedule II, Schedule III, or Schedule IV controlled substances, the department may initiate the referral of the history of controlled substances dispensed to an individual based on data contained in CURES to licensed health care practitioners, pharmacists, or both, providing care or services to the individual. An authorized health care practitioner may use a health information technology system, either on a user-initiated basis or an automated basis, to initiate the referral of the history of controlled substances dispensed to an individual based on data contained in CURES to other licensed health care practitioners, pharmacists, or both.
(d) The history of controlled substances dispensed to an individual based on data contained in CURES that is received by a practitioner or pharmacist from the department pursuant to this section is medical information subject to the provisions of the Confidentiality of Medical Information Act contained in Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code.
(e) Information concerning a patient’s controlled substance history provided to a prescriber or pharmacist pursuant to this section shall include prescriptions for controlled substances listed in Sections 1308.12, 1308.13, and 1308.14 of Title 21 of the Code of Federal Regulations.
(f) A health care practitioner, pharmacist, and any person acting on behalf of a health care practitioner or pharmacist, when acting with reasonable care and in good faith, is not subject to civil or administrative liability arising from any false, incomplete, inaccurate, or misattributed information submitted to, reported by, or relied upon in the CURES database or for any resulting failure of the CURES database to accurately or timely report that information.
(g) For purposes of this section, the following terms have the following meanings:
(1) “Automated basis” means using predefined criteria established or approved by a health care practitioner to trigger an automated query to the CURES database, which can be attributed to a specific health care practitioner by an audit trail in the health information technology system.
(2) “Department” means the Department of Justice.
(3) “Health information technology system” means an information processing application using hardware and software for the storage, retrieval, sharing of or use of patient data for communication, decisionmaking, coordination of care, or the quality, safety, or efficiency of the practice of medicine or delivery of health care services, including, but not limited to, electronic medical record applications, health information exchange systems, or other interoperable clinical or health care information system.
(4) “User-initiated basis” means an authorized health care practitioner has taken an action to initiate the query to the CURES database, such as clicking a button, issuing a voice command, or taking some other action that can be attributed to a specific health care practitioner by an audit trail in the health information technology system.

SEC. 2.

 This act is an urgency statute necessary for the immediate preservation of the public peace, health, or safety within the meaning of Article IV of the California Constitution and shall go into immediate effect. The facts constituting the necessity are:
In order to ensure that information in the CURES database is available to prescribing physicians so they may prevent the dangerous abuse of prescription drugs and to safeguard the health and safety of the people of this state, it is necessary that this act take effect immediately.