Bill Text

Bill Information

PDF |Add To My Favorites |Track Bill | print page

AB-40 CURES database: health information technology system.(2017-2018)

SHARE THIS:share this bill in Facebookshare this bill in Twitter
Date Published: 07/10/2017 02:00 PM
AB40:v95#DOCUMENT

Amended  IN  Senate  July 10, 2017
Amended  IN  Senate  July 05, 2017
Amended  IN  Assembly  May 26, 2017
Amended  IN  Assembly  April 19, 2017

CALIFORNIA LEGISLATURE— 2017–2018 REGULAR SESSION

Assembly Bill No. 40


Introduced by Assembly Member Santiago

December 05, 2016


An act to amend Section 11165.1 of the Health and Safety Code, relating to controlled substances, and declaring the urgency thereof, to take effect immediately.


LEGISLATIVE COUNSEL'S DIGEST


AB 40, as amended, Santiago. CURES database: health information technology system.
Existing law classifies certain controlled substances into designated schedules. Existing law requires the Department of Justice to maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense a Schedule II, Schedule III, or Schedule IV controlled substance.
This bill would require the Department of Justice to make the electronic history of controlled substances dispensed to an individual under a health care practitioner’s care, based on data contained in the CURES database, available to the practitioner practitioner, or a pharmacist, as specified, through either an online Internet Web portal or an authorized health information technology system, as defined. The bill would authorize an entity that operates a health information technology system to establish an integration with and submit queries to the CURES database if the entity can certify, among other requirements, that the data received from the CURES database will not be used for any purpose other than delivering the data to an authorized health care practitioner or performing data processing activities necessary to enable delivery, and that the system meets applicable patient privacy and information security requirements of state and federal law. The bill would also require an entity operating a health information technology system that is requesting to establish an integration with the CURES database to pay a reasonable system maintenance fee and be subject to enforcement mechanisms, as specified. fee. The bill would prohibit the department from accessing patient-identifiable information in an entity’s health information technology system. The bill would authorize the department to prohibit integration or terminate a health information technology system’s ability to retrieve information in the CURES database if the health information technology system or the entity operating the health information technology system does not comply with specified provision of the bill.
This bill would declare that it is to take effect immediately as an urgency statute.
Vote: 2/3   Appropriation: NO   Fiscal Committee: YES   Local Program: NO  

The people of the State of California do enact as follows:


SECTION 1.

 Section 11165.1 of the Health and Safety Code, as amended by Section 2 of Chapter 708 of the Statutes of 2016, is amended to read:

11165.1.
 (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, or Schedule IV controlled substances pursuant to Section 11150 shall, before July 1, 2016, or upon receipt of a federal Drug Enforcement Administration (DEA) registration, whichever occurs later, submit an application developed by the department to obtain approval to access information regarding the controlled substance history of a patient through an online Internet Web portal that is maintained by the department, or through an authorized health information technology system. Upon approval, the department shall release to that practitioner, through an online Internet Web portal or an authorized health information technology system, the electronic history of controlled substances dispensed to an individual under his or her care based on data contained in the CURES Prescription Drug Monitoring Program (PDMP).
(ii) A pharmacist shall, before July 1, 2016, or upon licensure, whichever occurs later, submit an application developed by the department to obtain approval to access information online regarding the controlled substance history of a patient that is stored on the Internet and maintained within the department. department, or through an authorized health information technology system. Upon approval, the department shall release to that pharmacist the electronic history of controlled substances dispensed to an individual under his or her care based on data contained in the CURES PDMP.
(B) An application may be denied, or a subscriber may be suspended, for reasons which include, but are not limited to, the following:
(i) Materially falsifying an application to access information contained in the CURES database.
(ii) Failing to maintain effective controls for access to the patient activity report.
(iii) Having his or her federal DEA registration suspended or revoked.
(iv) Violating a law governing controlled substances or any other law for which the possession or use of a controlled substance is an element of the crime.
(v) Accessing information for a reason other than to diagnose or treat his or her patients, or to document compliance with the law.
(C) An authorized subscriber shall notify the department within 30 days of any changes to the subscriber account.
(D) An entity that operates a health information technology system may establish an integration with and submit queries to the CURES database on either a user-initiated basis or an automated basis if the entity can certify all of the following:
(i) The health information technology system is authorized to query the CURES database on behalf of an authorized health care practitioner or pharmacist on either a user-initiated basis, an automated basis, or both, for purposes of delivering patient data from the CURES database to assist an authorized health care practitioner or pharmacist to evaluate the need for medical or pharmaceutical treatment or provide medical or pharmaceutical treatment to a patient for whom a health care practitioner or pharmacist is providing or has provided care.

(ii)The entity will not use or disclose data received from the CURES database for any purpose other than delivering the data to an authorized health care practitioner or performing data processing activities that may be necessary to enable this delivery.

(iii)

(ii) The health information technology system will authenticate the identity of an authorized health care practitioner or pharmacist initiating queries to the CURES database on either a user-initiated basis or an automated basis and, at the time of the query to the CURES database, the health information technology system submits the following data regarding the query to CURES:
(I) The date of the query.
(II) The time of the query.
(III) The first and last name of the patient queried.
(IV) The date of birth of the patient queried.
(V) The identification of the CURES user for whom the system is making the query.

(iv)

(iii) The health information technology system meets applicable patient privacy and information security requirements of state and federal law.

(E)The department may, in its discretion, determine whether to establish a direct system integration between one or more health information technology systems and the CURES database, or whether to develop a gateway system to which multiple health information technology systems can establish an integration for purposes of accessing the CURES database. The CURES database shall not permit access to patient-identifiable information in an entity’s health information technology system.

(E) The department shall develop a programming interface or other method of system integration to allow health information technology systems that meet the requirements in subparagraph (D) to retrieve information in the CURES database on behalf of an authorized health care practitioner or pharmacist.
(F) The department shall not access patient-identifiable information in an entity’s health information technology system.

(F)

(G) An entity that operates a health information technology system that is requesting to establish an integration with the CURES database shall: shall pay a reasonable fee to cover the cost of establishing and maintaining integration with the CURES database.

(i)Pay a reasonable fee to cover the cost of establishing and maintaining integration with the CURES database.

(ii)Be subject to enforcement mechanisms for failure to comply with oversight or audit activities by the department, up to and including termination of access to the CURES database.

(H) The department may prohibit integration or terminate a health information technology system’s ability to retrieve information in the CURES database if the health information technology system fails to meet the requirements of subparagraph (D), or the entity operating the health information technology system does not fulfill its obligation under subparagraph (G).
(2) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, or Schedule IV controlled substances pursuant to Section 11150 or a pharmacist shall be deemed to have complied with paragraph (1) if the licensed health care practitioner or pharmacist has been approved to access the CURES database through the process developed pursuant to subdivision (a) of Section 209 of the Business and Professions Code.
(b) A request for, or release of, a controlled substance history pursuant to this section shall be made in accordance with guidelines developed by the department.
(c) In order to prevent the inappropriate, improper, or illegal use of Schedule II, Schedule III, or Schedule IV controlled substances, the department may initiate the referral of the history of controlled substances dispensed to an individual based on data contained in CURES to licensed health care practitioners, pharmacists, or both, providing care or services to the individual. An authorized health care practitioner may use a health information technology system, either on a user-initiated basis or an automated basis, to initiate the referral of the history of controlled substances dispensed to an individual based on data contained in CURES to other licensed health care practitioners, pharmacists, or both.
(d) The history of controlled substances dispensed to an individual based on data contained in CURES that is received by a practitioner or pharmacist from the department pursuant to this section is medical information subject to the provisions of the Confidentiality of Medical Information Act contained in Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code.
(e) Information concerning a patient’s controlled substance history provided to a practitioner or pharmacist pursuant to this section shall include prescriptions for controlled substances listed in Sections 1308.12, 1308.13, and 1308.14 of Title 21 of the Code of Federal Regulations.
(f) A health care practitioner, pharmacist, and any person acting on behalf of a health care practitioner or pharmacist, when acting with reasonable care and in good faith, is not subject to civil or administrative liability arising from any false, incomplete, inaccurate, or misattributed information submitted to, reported by, or relied upon in the CURES database or for any resulting failure of the CURES database to accurately or timely report that information.
(g) For purposes of this section, the following terms have the following meanings:
(1) “Automated basis” means using predefined criteria established or approved by a health care practitioner or pharmacist to trigger an automated query to the CURES database, which can be attributed to a specific health care practitioner by an audit trail in the health information technology system. or pharmacist.
(2) “Department” means the Department of Justice.
(3) “Health information technology system” means an information processing application using hardware and software for the storage, retrieval, sharing of or use of patient data for communication, decisionmaking, coordination of care, or the quality, safety, or efficiency of the practice of medicine or delivery of health care services, including, but not limited to, electronic medical record applications, health information exchange systems, or other interoperable clinical or health care information system.
(4) “User-initiated basis” means an authorized health care practitioner or pharmacist has taken an action to initiate the query to the CURES database, such as clicking a button, issuing a voice command, or taking some other action that can be attributed to a specific health care practitioner by an audit trail in the health information technology system. or pharmacist.

SEC. 2.

 This act is an urgency statute necessary for the immediate preservation of the public peace, health, or safety within the meaning of Article IV of the California Constitution and shall go into immediate effect. The facts constituting the necessity are:
In order to ensure that information in the CURES database is available to prescribing physicians so they may prevent the dangerous abuse of prescription drugs and to safeguard the health and safety of the people of this state, it is necessary that this act take effect immediately.