Garfield Beach CVS v. Board of Pharmacy etc. CA4/1

Filed 7/18/25 Garfield Beach CVS v. Board of Pharmacy etc. CA4/1

NOT TO BE PUBLISHED IN OFFICIAL REPORTS

California Rules of Court, rule 8.1115(a), prohibits courts and parties from citing or relying on opinions not certified for publication or

ordered published, except as specified by rule 8.1115(b). This opinion has not been certified for publication or ordered published for

purposes of rule 8.1115.

COURT OF APPEAL, FOURTH APPELLATE DISTRICT

DIVISION ONE

STATE OF CALIFORNIA

GARFIELD BEACH CVS, LLC, D083962

Plaintiff and Appellant,

v. (Super. Ct. No. 37-2023-

00006013-CU-WM-CTL)

BOARD OF PHARMACY,

DEPARTMENT OF CONSUMER

AFFAIRS,

Defendant and Respondent.

APPEAL from a judgment of the Superior Court of San Diego County,

Carolyn M. Caietti, Judge. Affirmed.

Much Shelist and Ryan N. Burns, for Plaintiff and Appellant.

Rob Bonta, Attorney General, Carl W. Sonne, Assistant Attorney

General, Gregory J. Salute and Nicole R. Trama, Deputy Attorneys General,

for Defendant and Respondent.

In 2020, the Board of Pharmacy, Department of Consumer Affairs cited

Garfield Beach CVS, LLC for failure to maintain prescription records at CVS

pharmacy number 5837 (Buena Park CVS) in a secure manner preserving

patient confidentiality in violation of title 16 of the California Code of

Regulations sections 1714, subdivision (d) and 1707, subdivision (g)(2), as

well as Civil Code section 56.101. After the Board affirmed the citation, CVS

petitioned for a writ of administrative mandate to compel the Board to set

aside its decision and order. The court denied the petition. On appeal, CVS

raises three arguments.

First, CVS argues substantial evidence was not presented that an

alarmed but unlocked door inadequately secures prescription records and

protects their confidentiality. We determine, however, that the record

contains substantial evidence, including reasonable inferences drawn from

the record evidence, to support that finding.

Second, CVS contends the Board was collaterally estopped from

affirming the citation given its prior dismissal of a similar citation against

CVS pharmacy number 6755 (Long Beach CVS). Yet because (1) the citations

arose out of different transactions and (2) the Long Beach CVS prescription

records were stored behind a locked door, whereas the doors to the storage

area of the Buena Park CVS were alarmed but unlocked, we conclude the

issues are not identical, so collateral estoppel does not apply.

Finally, CVS claims the Board abused its discretion in interpreting the

relevant regulations and statute to require that access to prescription records

be restricted to pharmacy employees. But the record, which shows the Board

was concerned about non-employees’ access to the records as well, does not

support CVS’s argument.

Accordingly, we affirm the court’s dismissal of the petition.

2

I.

A.

The Buena Park CVS has a “typical” layout, in which the front of the

store carries general merchandise and groceries while a pharmacy at the

back of the store fills and dispenses medications.

A storage room sits at the back of the Buena Park CVS. The only way

to enter the storage room is through a set of double doors. To enter the

storage room without setting off an alarm, a person needs to input a code

onto a keypad next to the door. The keypad has no locking mechanism, so it

does not physically prevent anyone from opening the doors. A single code is

shared by all employees of the store, and the district leader—who oversees

14 CVS pharmacies, including Buena Park—was uncertain how often, if at

all, the code was changed, even after employee terminations.

The Buena Park CVS keeps prescription records in the upstairs portion

of the storage room. The records are kept in closed cardboard boxes, at least

some of which are labeled as containing “Confidential Hardcopy Pharmacy

Records.” Some boxes are taped shut.

At the administrative hearing, the district leader agreed “there are

security cameras at the entry to the storage room or in the storage room.”

(Italics added.) She later explained there is one security camera inside the

storage room, but not in the upstairs portion where pharmacy records are

kept.

CVS’s policy is that vendors or delivery persons must be accompanied

by a CVS employee to enter the storage room. Additionally, it is CVS’s policy

to keep documents containing confidential information in a locked file cabinet

or desk drawer. The district leader acknowledged the prescription records

were not maintained according to policy.

3

B.

In October 2019, Board inspector Sejal Desai inspected the Buena Park

CVS in response to a complaint. As part of her inspection, Desai inspected

the prescription records kept in the storage room and found the way they

were stored “problematic.”

That same day, Desai issued a notice of citation for a violation of

section 1714(d) of title 16 of the California Code of Regulations “[a]s it relates

to” section 1707(g)(2) and Civil Code section 56.101, noting “the prescription

records were store[d] upstairs in the stock room with other store merchandise

and records” and “not in a secured manner.”

In November 2020, the Board issued a citation and fine alleging CVS

violated the above provisions because it “did not have effective control against

theft and diversion of records for drugs/devices” and the “prescription records

were not secure to maintain patient confidentiality” at the Buena Park CVS.

CVS was to pay a fine of $2,500.

CVS contested the citation and requested an office conference. In

February 2021, following the office conference, the Board affirmed the

citation and fine. An administrative hearing was scheduled for October 2022.

At the administrative hearing, the Attorney General focused on non-

pharmacy employees’ access to the prescription records. Desai, however,

testified the storage room was “accessible” to CVS customers “because you

can walk in and the alarm would still go off, but it is accessible because it’s

not locked.” She also testified she was not aware of any material differences

between the physical security measures employed by the Buena Park CVS

and the Long Beach CVS in storing their records.

There was no evidence any unauthorized person ever accessed or stole

the prescription records from the Buena Park CVS.

4

C.

During the administrative hearing, CVS argued collateral estoppel

barred the Board’s claims given its prior decision to dismiss a citation issued

in similar circumstances to the Long Beach CVS.

In December 2019, Desai inspected the Long Beach CVS. The Long

Beach CVS stored prescription records in the upstairs portion of a storage

room that also held regular store merchandise. The boxes were labeled

“‘Confidential Hardcopy Pharmacy Records,’” but some boxes were broken

and papers were visible inside. The storage room was accessible through “a

door with a keypad that required a code to be entered to unlock.” There was

“a camera in the receiving area where the keypad on the door permits access

from the store,” as well as “a camera that covers the top of the stairs.”

The Board issued a citation and fine alleging violations of the same

regulations and statute as the Buena Park CVS.

Following an administrative hearing, the Board dismissed the citation.

It found the Long Beach CVS’s security measures “sufficient” because, among

other measures, “access to the storage room was limited by means of a

keypad whose combination was given to CVS employees only” and “the

bottom of the stairs and the top of the stairs leading to the storage room were

monitored by security cameras.”

D.

In November 2022, an administrative law judge issued a proposed

decision affirming the Buena Park CVS’s citation. In December, the Board

adopted the proposed decision as its decision.

In February 2023, CVS filed a petition for writ of administrative

mandate in which it sought to compel the Board to set aside its decision. As

here, CVS contended (1) the Board abused its discretion in concluding

5

collateral estoppel did not bar its claim, (2) no evidence established that the

keypad alarm was insufficient to safeguard the security or confidentiality of

the prescription records, and (3) CVS did not violate the asserted regulations

and statutes in allowing front-of-store employees access to the storage room

containing the records.

The court denied the writ. It concluded collateral estoppel did not bar

the Board’s claim because “a critical difference between the two cases” was

that the storage room access door at the Long Beach CVS was “locked” while

the door at the Buena Park CVS was “always unlocked and only had a code to

enter on a keypad to prevent an alarm from sounding” that “did not prevent

anyone from entering the storage room.”

The court also found substantial evidence supported the Board’s

decision. It concluded evidence of actual unauthorized access to the records

was not required because “the Board was not required to wait for patient

harm before taking action.” The record further established that “non-

pharmacy employees and members of the public” could enter the “unlocked

storage area,” which was “substantial evidence of CVS not preserving the

confidentiality of patient records.”

The court entered judgment accordingly.

II.

“Our standard of review of a judgment denying a petition for writ of

administrative mandate is the same as that of the trial court when it reviews

the determination of the administrative board.” (Blazevich v. State Bd. of

Control (1987) 191 Cal.App.3d 1121, 1125.) Here, the trial court reviewed the

Board’s decision for abuse of discretion and substantial evidence.

Code of Civil Procedure section 1094.5(a) lets courts “inquir[e] into the

validity of any final administrative order or decision made as the result of a

6

proceeding in which by law a hearing is required to be given, evidence is

required to be taken, and discretion in the determination of facts is vested in

the inferior tribunal, corporation, board, or officer.” We review the

administrative decision to determine if it was “without, or in excess of,

jurisdiction; whether there was a fair trial; and whether there was any

prejudicial abuse of discretion.” (§ 1094.5(b).) An abuse of discretion occurs

“if the respondent has not proceeded in the manner required by law, the

order or decision is not supported by the findings, or the findings are not

supported by the evidence.” (Ibid.) We “resolv[e] all evidentiary conflicts and

draw[ ] all legitimate and reasonable inferences in favor of the court’s

decision.” (Cassidy v. California Bd. of Accountancy (2013) 220 Cal.App.4th

620, 627.)

A.

CVS claims there was “no evidence, never mind substantial evidence,”

to support a conclusion that the Buena Park CVS’s keypad alarm system was

less secure and less preserving of confidentiality than the Long Beach CVS’s

keypad lock system. We conclude otherwise.

Our review for substantial evidence “begins and ends with the

determination as to whether, on the entire record, there is substantial

evidence, contradicted or uncontradicted, which will support the

determination, and when two or more inferences can reasonably be deduced

from the facts, a reviewing court is without power to substitute its deductions

for those of the trial court.” (Bowers v. Bernards (1984) 150 Cal.App.3d 870,

873-874.) “Substantial evidence is evidence of ponderable legal significance,

reasonable in nature, credible, and of solid value.” (Ermoian v. Desert

Hospital (2007) 152 Cal.App.4th 475, 501.)

7

Here, as the Board states, “[i]t is undisputed that the [Buena Park

CVS’s] patient records were stored in an unlocked storage area.” Nor were

the records monitored by security cameras. Meanwhile, the Long Beach CVS

stored its records in a locked storage area with security cameras covering

both the bottom and the top of the stairs leading to the records. As the Board

argues, a reasonable inference from the evidence is “that a locked door is

more secure than an unlocked door.” We agree such an inference is

permissible and constitutes substantial evidence. (See Moran v. Foster

Wheeler Energy Corp. (2016) 246 Cal.App.4th 500, 518.) Desai’s testimony

that she was aware of no material differences between the physical security

measures employed by the two CVS locations does not compel a contrary

result because other evidence belies her statement. Nor does the lack of any

testimony about an alarm being inadequate, as that fact could be permissibly

inferred from the evidence before the court.

B.

CVS also claims the Board was collaterally estopped from “relitigating”

the alleged violation against the Buena Park CVS given the dismissal of the

citation against the Long Beach CVS. We disagree.

“Collateral estoppel precludes relitigation of issues argued and decided

in prior proceedings” if (1) the relevant issue is “identical to that decided in a

former proceeding,” (2) the issue was “actually litigated” and “necessarily

decided,” (3) “the decision in the former proceeding” is “final and on the

merits,” and (4) “the party against whom preclusion is sought” is “the same

as, or in privity with, the party to the former proceeding.” (Lucido v.

Superior Court (1990) 51 Cal.3d 335, 341.) Here, only the first requirement is

contested.

8

“The ‘identical issue’ requirement addresses whether ‘identical factual

allegations’ are at stake in the two proceedings, not whether the ultimate

issues or dispositions are the same.” (Lucido, 51 Cal.3d at p. 342.) Thus,

“‘where the subsequent action involves parallel facts, but a different

historical transaction, the application of the law to the facts is not subject to

collateral estoppel.’” (Chern v. Bank of America (1976) 15 Cal.3d 866, 871.)

“The party asserting collateral estoppel bears the burden of establishing” the

issues are identical. (Lucido, at p. 341.)

We review collateral estoppel determinations de novo. (Murphy v.

Murphy (2008) 164 Cal.App.4th 376, 399.)

Given these principles, we agree with the Board that CVS failed to

satisfy its burden of establishing the issues in the Buena Park and Long

Beach CVS matters are identical. Here, the citations arose from different

inspections of different CVS locations at different times; accordingly, they

arose out of different transactions. (Chern, 15 Cal.3d at p. 871.) Even were

that not so, as the Board aptly points out, the facts are not identical given the

Long Beach CVS’s prescriptions records were kept behind a locked door while

the Buena Park CVS’s records were kept behind an alarmed but unlocked

door. Accordingly, neither the Board nor the court erred in finding this

“critical difference” made collateral estoppel inapplicable here.

CVS claims the issue raised in this case was whether, “for records to be

secure and confidential, access must be limited to pharmacists and

technicians.” While the Board primarily argued during the hearing that

access by other CVS employees was problematic, the citation was not so

limited. Instead, it broadly alleged the Buena Park CVS “did not have

effective control against theft and diversion of records for drugs/devices” and

because “[t]he prescription records were not secure to maintain patient

9

confidentiality.” The administrative law judge similarly defined the relevant

issue as “whether [CVS] complied with the requirements as set forth in” the

asserted regulations and statute. Because the issue and allegations were not

limited to the access of non-pharmacy CVS employees, neither the

administrative law judge nor the court erred in concluding the potential for

access by members of the public was also problematic. To the extent CVS

asserted for the first time at oral argument that the shift in focus from non-

pharmacy CVS employees to members of the public violated its right to due

process, the claim is forfeited. (People v. Carrasco (2014) 59 Cal.4th 924, 990

[“‘Obvious reasons of fairness militate against consideration of an issue

raised initially’ at oral argument.”].)

C.

Finally, CVS claims it did not violate the asserted regulations or

statute “by storing records in a warehouse accessible to CVS employees other

than pharmacists and pharmacy technicians” because “those provisions

simply do not impose the restrictions” the Board asserts. On this record,

however, we conclude the administrative law judge and trial court did not err

in upholding at least one of the violations determined by the Board.

“‘The standard for judicial review of agency interpretation of law is the

independent judgment of the court, giving deference to the determination of

the agency appropriate to the circumstances of the agency action.’” (Yamaha

Corp. of America v. State Bd. of Equalization (1998) 19 Cal.4th 1, 8.) “A court

is more likely to defer to an agency’s interpretation of its own regulation than

to its interpretation of a statute.” (Id. at p. 12.)

Section 1707(g) requires, when pharmacy prescription records are

stored “in a storage area at the same address or adjoining the licensed

premises” rather than within the pharmacy itself, “[t]he storage area” to be

10

“maintained so that the records are secure and so that the confidentiality of

any patient-related information is maintained.”

As explained above, it is reasonable to conclude an unlocked storage

room with no security cameras trained on its entrance or the access point to

patients’ confidential prescription records is not “secure” and fails to

maintain the confidentiality of patients’ information. As CVS argues, the

regulation cannot reasonably be read to require that access be limited to

pharmacists or pharmacy technicians, but the Board’s citation and the

administrative law judge’s decision that CVS violated the regulation do not

rely on such an interpretation. Thus, is does not matter if the Board

advanced such an argument at the hearing. Nor did the administrative law

judge conclude, as CVS claims, a locked door is required. Instead, the

administrative law judge reasonably concluded something more than an

alarm on an unlocked door was required to preserve patient confidentiality.

Because we determine the administrative law judge and trial court

properly concluded at least one regulation the Board alleged CVS violated

was, in fact, violated, we need not reach CVS’s arguments as to the

remaining regulation or statute, including its contention that

section 56.101(a) requires “an actual breach of confidentiality.” CVS did not

raise a similar argument as to section 1707(g), and we agree with the trial

court that the Board is not required to wait to enforce its regulations until

harm has already occurred.

11

III.

We affirm and award the Board of Pharmacy, Department of Consumer

Affairs its costs on appeal.

CASTILLO, J.

WE CONCUR:

DO, Acting P. J.

KELETY, J.

12