Bill Text

Bill Information

PDF |Add To My Favorites |Track Bill | print page

SB-641 Controlled Substance Utilization Review and Evaluation System: privacy.(2017-2018)

SHARE THIS:share this bill in Facebookshare this bill in Twitter
Date Published: 02/17/2017 09:00 PM
SB641:v99#DOCUMENT


CALIFORNIA LEGISLATURE— 2017–2018 REGULAR SESSION

Senate Bill No. 641


Introduced by Senator Lara

February 17, 2017


An act to amend Sections 11165 and 11165.1 of, and to add Section 11165.6 to, the Health and Safety Code, relating to controlled substances.


LEGISLATIVE COUNSEL'S DIGEST


SB 641, as introduced, Lara. Controlled Substance Utilization Review and Evaluation System: privacy.
Existing law requires the Department of Justice to maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe or dispense these controlled substances. Existing law requires the operation of CURES to comply with all applicable federal and state privacy and security laws and regulations. Under existing law, data obtained from CURES may only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Existing law allows data obtained from CURES to be provided to public or private entities for statistical or research purposes, as approved by the department.
This bill would revise and recast the CURES privacy provisions. The bill would specify that, except as specified, information within CURES is confidential, not subject to discovery or admissible in any civil or administrative action, and exempt from public inspection, copying, and disclosure pursuant to the California Public Records Act. The bill would specify to whom the information within CURES may be disclosed or released, including, among others, to a health care practitioner providing care to a current patient, to a pharmacist dispensing a controlled substance to a current patient, and, upon a written request, to certain regulatory boards. The bill would require a pharmacy to provide a specific notification about CURES to each patient who is dispensed a Schedule II, Schedule III, or Schedule IV controlled substance.
Existing law authorizes the department to invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database.
The bill would instead require the department to appoint a multidisciplinary advisory committee, as specified, to assist, advise, and make recommendations for the establishment of rules and regulations relating to the proper administration and enforcement of the CURES database.
Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.
This bill would make legislative findings to that effect.
Vote: MAJORITY   Appropriation: NO   Fiscal Committee: YES   Local Program: NO  

The people of the State of California do enact as follows:


SECTION 1.

 Section 11165 of the Health and Safety Code is amended to read:

11165.
 (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and Internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.
(b) The Department of Justice may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.
(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations. Information within CURES pertaining to a patient or a patient’s representative, health care practitioner, dispenser, an employee of the health care practitioner acting on behalf of and at the direction of the practitioner, a pharmacist, or a pharmacy is confidential and may only be used, accessed, or disclosed pursuant to Section 11165.1.

(2)(A)CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the Department of Justice, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the Department of Justice, for educational, peer review, statistical, or research purposes, provided that patient information, including any information that may identify the patient, is not compromised. Further, data disclosed to any individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to any third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The

(2) The Department of Justice shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision. Section 11165.1.

(B)Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.

(3)In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patient’s CURES patient activity report as long as no additional CURES data is provided and keep a copy of the report in the patient’s medical record in compliance with subdivision (d) of Section 11165.1.

(3) Information within CURES is not subject to discovery and is not admissible in any civil or administrative action, except in an investigation and disciplinary proceeding by the appropriate regulatory board responsible for licensure, regulation, or discipline of health care practitioners and pharmacists authorized to prescribe, order, administer, furnish, or dispense controlled substances. A regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.
(4) All information within CURES, including records related to the requests for accessor disclosure, or both, of information and data, is confidential and exempt from public inspection, copying, and disclosure pursuant to the California Public Records Act(Chapter 3.5 (commencing Section 6250) of Division 7 of Title 1) of the Government Code.
(d) For each prescription for a Schedule II, Schedule III, or Schedule IV controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, and 1308.14, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the Department of Justice as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed, in a format specified by the Department of Justice:
(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.
(2) The prescriber’s category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of any prescriber using the federal controlled substance registration number of a government-exempt facility.
(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.
(4) National Drug Code (NDC) number of the controlled substance dispensed.
(5) Quantity of the controlled substance dispensed.
(6) International Statistical Classification of Diseases, 9th revision (ICD-9) or 10th revision (ICD-10) Code, if available.
(7) Number of refills ordered.
(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.
(9) Date of origin of the prescription.
(10) Date of dispensing of the prescription.

(e)The Department of Justice may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. All prescriber and dispenser invitees shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.

(f)

(e) The Department of Justice shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).

(g)

(f) The Department of Justice may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.
(g) The Department of Justice shall appoint a multidisciplinary advisory committee to assist, advise, and make recommendations for the establishment of rules and regulations necessary to insure the proper administration and enforcement of the CURES database. Appointments shall be made from lists of nominees solicited by the department and shall provide adequate and proper representation of all licensees affected by this chapter and a person who administers addiction services. All members shall be licensed, in active practice in California, and a regular user of the CURES database. Subcommittees of the committee may be appointed consisting of committee members and consultants having particular knowledge in a subject area for the purpose of assisting the department on special administrative problems and in making recommendations to the committee for consideration in the establishment of rules and regulations.

SEC. 2.

 Section 11165.1 of the Health and Safety Code is amended to read:

11165.1.
 (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, or Schedule IV controlled substances pursuant to Section 11150 shall, before July 1, 2016, or upon receipt of a federal Drug Enforcement Administration (DEA) registration, whichever occurs later, submit an application developed by the Department of Justice to obtain approval to access information online regarding the controlled substance history of a patient that is stored on the Internet and maintained within by the Department of Justice, and, upon approval, the department shall release to that practitioner the electronic history of controlled substances dispensed to an individual under his or her care based on data contained in the CURES Prescription Drug Monitoring Program (PDMP).
(ii) A pharmacist shall, before July 1, 2016, or upon licensure, whichever occurs later, submit an application developed by the Department of Justice to obtain approval to access information online regarding the controlled substance history of a patient that is stored on the Internet and maintained within by the Department of Justice, and, upon approval, the department shall release to that pharmacist the electronic history of controlled substances dispensed to an individual under his or her care based on data contained in the CURES PDMP.
(B) An application may be denied, or a subscriber may be suspended, subscriber’s access may be suspended or terminated, for reasons which include, but are not limited to, the following:
(i) Materially falsifying an application for a subscriber.
(ii) Failure to maintain effective controls for access to the patient activity report.
(iii) Suspended or revoked federal DEA registration.
(iv) Any subscriber who is arrested for a violation of law governing controlled substances or any other law for which the possession or use of a controlled substance is an element of the crime.
(v) Any subscriber accessing information for any other reason than caring for his or her patients.
(C) Any authorized subscriber shall notify the Department of Justice within 30 days of any changes to the subscriber account.
(2) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, or Schedule IV controlled substances pursuant to Section 11150 or a pharmacist shall be deemed to have complied with paragraph (1) if the licensed health care practitioner or pharmacist has been approved to access the CURES database through the process developed pursuant to subdivision (a) of Section 209 of the Business and Professions Code.

(b)Any request for, or release of, a controlled substance history pursuant to this section shall be made in accordance with guidelines developed by the Department of Justice.

(b) All information within CURES is confidential, subject to all applicable federal and state privacy and security laws and regulations, including, but not limited to, regulations promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996 (Parts 160 and 164 of Title 45 of the Code of Federal Regulations) and the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), and shall only be disclosed or released as follows:
(1) The Department of Justice shall allow the following individuals to directly access information within the CURES database for purposes of reviewing a patient’s controlled substance prescription history:
(A) A health care practitioner who is providing care to a current patient and who has obtained approval to access CURES pursuant to subdivision (a).
(B) A pharmacist who is dispensing a controlled substance to a current patient and who has obtained approval to access CURES pursuant to subdivision (a).
(2) Upon a written request, the Department of Justice shall disclose information within CURES relating to a patient or patient’s representative, health care practitioner, dispenser, an employee of the health care practitioner acting on behalf of and at the direction of the practitioner, a pharmacist, or a pharmacy to any of the following entities:
(A) Relevant regulatory boards responsible for the licensure, regulation, or discipline of health care practitioners and pharmacists authorized to prescribe, order, administer, furnish, or dispense controlled substances that certify that the requested information is necessary for an active investigation relating to prescribed controlled substances involving a designated applicant or licensee.
(B) Federal, state, or local law enforcement pursuant to a valid court order or warrant based on probable cause and issued at the request of a federal, state, or local law enforcement agency engaged in an open and active investigation regarding prescription drug abuse or diversion of prescription controlled substances involving the individual to whom the requested information pertains.
(C) A medical examiner, forensic pathologist, or coroner who is an officer of or employed by a state or local government, pursuant to his or her official duties.
(3) The Department of Justice may disclose information within CURES that does not identify a patient or practitioner and is fully deidentified to entities approved by the department for educational, peer review, statistical, research, or public health purposes.
(4) A health care practitioner may provide a patient with a copy of the patient’s CURES patient activity report as long as no additional CURES data is provided and the practitioner keeps a copy of the report in the patient’s medical record in compliance with subdivision (d).
(c) In order to prevent the inappropriate, improper, or illegal use of Schedule II, Schedule III, or Schedule IV controlled substances, the Department of Justice may initiate the referral of the history of controlled substances dispensed to an individual based on data contained in CURES to licensed health care practitioners, pharmacists, or both, providing care or services to the individual.
(d) (1) The history of controlled substances dispensed to an individual based on data contained in CURES that is received by a practitioner or pharmacist from the Department of Justice pursuant to this section is medical information subject to the provisions of the Confidentiality of Medical Information Act contained in Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code.
(2) Any person or entity that obtains or accesses confidential CURES information pursuant to this section shall maintain its confidentiality under applicable federal and state privacy laws and shall not further disclose, sell, or transfer the information to any third party, unless authorized by, or pursuant to, this section or applicable state and federal privacy and security laws and regulations.
(e) Information concerning a patient’s controlled substance history provided to a prescriber or pharmacist pursuant to this section shall include prescriptions for controlled substances listed in Sections 1308.12, 1308.13, and 1308.14 of Title 21 of the Code of Federal Regulations.
(f) A health care practitioner, pharmacist, and any person acting on behalf of a health care practitioner or pharmacist, when acting with reasonable care and in good faith, is not subject to civil or administrative liability arising from any false, incomplete, inaccurate, or misattributed information submitted to, reported by, or relied upon in the CURES database or for any resulting failure of the CURES database to accurately or timely report that information.

SEC. 3.

 Section 11165.6 is added to the Health and Safety Code, to read:

11165.6.
 A pharmacy shall notify each patient who is dispensed a Schedule II, Schedule III, or Schedule IV controlled substance about CURES before, or at the time of, dispensing the controlled substance to the patient. The notification shall state the following, in at least 14-point font:

“California’s Controlled Substance Utilization Review and Evaluation System (CURES) is the state prescription drug monitoring program to help health care providers and pharmacists provide better patient care in managing patients’ prescriptions. They can access the CURES database to view more complete patient prescription information. Information about this prescription will be reported to CURES by the pharmacy, as required by law. For more information, visit https://oag.ca.gov/cures-pdmp or call (916) 227-3843.

SEC. 4.

 The Legislature finds and declares that Section 1 of this act, which amends Section 11165 of the Health and Safety Code, and Section 2, which amends Section 11165.1 of the Health and Safety Code, impose a limitation on the public’s right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:
In order to preserve patients’ right to privacy in their medical information, it is necessary for information in the Controlled Substance Utilization Review and Evaluation System to remain confidential.