The opinion
Filed 5/29/14
CERTIFIED FOR PUBLICATION
IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA
SECOND APPELLATE DISTRICT
DIVISION THREE
ALWIN CARL LEWIS, B252032
Petitioner, (Los Angeles County
Super. Ct. No. BS139289)
v.
THE SUPERIOR COURT OF
LOS ANGELES COUNTY,
Respondent;
MEDICAL BOARD OF CALIFORNIA,
Real Party in Interest.
ORIGINAL PROCEEDINGS in mandate. Joanne B. O’Donnell, Judge.
Petition denied.
Fenton Nelson, Henry R. Fenton, Dennis E. Lee and Benjamin J. Fenton for
Petitioner.
Francisco J. Silva, Long X. Do and Lisa Matsubara for California Medical
Association as Amicus Curiae on behalf of Petitioner.
No appearance for Respondent.
Kamala D. Harris, Attorney General, Gloria L. Castro, Assistant Attorney General,
E.A. Jones III and Edward K. Kim, Deputy Attorneys General, for Real Party in Interest.
_____________________
In this case, we determine whether the Medical Board of California (hereafter, the
Board) violated patients’ informational privacy rights in their controlled substances
prescription records when the Board obtained that data from the Controlled Substance
Utilization Review and Evaluation System (CURES) (Health & Saf. Code, § 11165)
during a disciplinary investigation of their physician. Alwin Carl Lewis, M.D., contends
the CURES statute violates his patients’ informational privacy rights, as the statute
permits the Board to access data before obtaining a warrant or administrative subpoena
demonstrating good cause.
California’s Constitution grants an express right to privacy (art. I, § 1), thus our
focus is on California case law rather than federal law or the federal Constitution. The
Board’s statutory authority to access CURES during the course of an investigation into
Lewis’s alleged unprofessional conduct requires balancing his patients’ right to privacy
in their controlled substances prescription records against the state’s interest in protecting
the public health by regulating the abuse and diversion of controlled substances, and in
protecting the public against incompetent, impaired, or negligent physicians. We
conclude on balance, the CURES statute does not amount to an impermissible invasion of
Lewis’s patients’ state constitutional right to privacy, as there are sufficient safeguards to
prevent unwarranted public disclosure and unauthorized access to CURES data. Thus,
we deny the petition.1
FACTUAL AND PROCEDURAL BACKGROUND
The Board, through its Division of Medical Quality, has statutory authority to
investigate, and to take and commence disciplinary action against a physician guilty of
unprofessional conduct. (Bus. & Prof. Code, §§ 2220, subd. (a), 2227, 2234, 2241.5,
subd. (c)(7); Arnett v. Dal Cielo (1996) 14 Cal.4th 4, 7; see also Stiger v. Flippin (2011)
1
The privacy issue presented here also was addressed in Medical Board of
California v. Chiarottino (Apr. 15, 2014, No. A138420) 225 Cal.App.4th 623 [2014 WL
1427466]). The First District concluded the Board did not violate a physician’s patients’
constitutional right to privacy by accessing CURES before issuing administrative
subpoenas for medical records.
2
201 Cal.App.4th 646, 651-652.) The Board enforces the Medical Practice Act (Bus. &
Prof. Code, § 2000 et seq.), and several statutory provisions address prescribing
controlled substances by licensee-physicians. (Bus. & Prof. Code, §§ 2238 [violation of
state or federal statute regulating dangerous drugs or controlled substances], 2241
[furnishing drugs to addicts], 2241.5 [prescribing, dispensing, or administering to a
person under his or her treatment for medical condition, dangerous drugs or prescription
controlled substances for treatment of pain], 2242 [furnishing dangerous drugs without
examination].) To assist regulatory agencies, such as the Board, in their efforts to control
the diversion and resultant abuse of controlled substances, CURES electronically
monitors the prescribing and dispensing of these prescription drugs. (Health & Saf.
Code, § 11165, former subd. (c).)2
1. Access To CURES During Investigation and Disciplinary Proceedings
The Board began its investigation after one of Lewis’s patients complained about
the quality of care and treatment that she received during her initial consultation in May
2008. The patient’s complaint focused on Lewis’s recommendation that she lose weight
and start a diet that the patient considered to be unhealthful.
During the course of the investigation, the Board investigator obtained CURES
reports for Lewis’s prescribing practices from November 1, 2005 through November 25,
2008, and from December 16, 2008 through December 16, 2009. The investigator
testified that it was a common practice during the course of an investigation to “run” a
CURES report on the physician.
Based upon a review of these CURES reports, the Board sent releases to six of
Lewis’s patients to obtain their medical records. The Board received signed releases
from three patients, and the Board obtained the other two patients’ records after an
2
At the time of these administrative proceedings, Health and Safety Code section
11165, subdivision (c) applied. The Legislature has since amended the statute.
Subdivision (c) of Health and Safety Code section 11165 was renumbered (c)(2).
(See post.)
3
administrative subpoena was issued and notice was sent to the patients that their medical
records were being subpoenaed.3
The operative second amended accusation (accusation) filed by the Board against
Lewis alleged, as to the initial patient, gross negligence in her care and treatment by
failing to focus on her chief complaints, repeated negligent acts in her care and treatment,
failure to maintain adequate/accurate medical records, and general unprofessional
conduct. With respect to the additional patients, the accusation alleged prescribing
without an appropriate prior examination, excessive prescribing, failure to maintain
adequate/accurate medical records, general unprofessional conduct, and violation of drug
statutes.
At the conclusion of the eight-day administrative hearing, the administrative law
judge (ALJ) submitted a proposed decision. As to the initial patient, the ALJ concluded
that Lewis engaged in unprofessional conduct by failing to maintain adequate records.
With respect to the additional patients, the ALJ found that two of Lewis’s patients had
been over-prescribed controlled substances during a short period of time. The ALJ,
however, concluded it had not been established that Lewis engaged in repeated acts of
excessive prescribing of dangerous drugs or furnished dangerous drugs without
appropriate prior examinations. Lewis was disciplined for failing to maintain accurate
prescription records. The ALJ recommended revoking Lewis’s license, but the
revocation was stayed. Lewis was placed on probation for three years with certain
conditions. The Board adopted the ALJ’s proposed decision.
2. Mandamus Proceeding in Superior Court, Petition for Writ of Mandate
Lewis filed a petition for writ of administrative mandamus in the trial court
seeking to set aside the Board’s decision. Lewis did not challenge the Board’s factual
findings and legal conclusions as to the initial patient, but challenged the factual findings
and legal conclusions with respect to the additional patients. Lewis argued the Board
3
Three of Lewis’s patients voluntarily consented to the release of their medical
records. Lewis has no standing to assert their privacy rights. (See Pating v. Board of
Medical Quality Assurance (1982) 130 Cal.App.3d 608, 621.)
4
violated his patients’ informational privacy rights under article I, section 1 of the
California Constitution by accessing CURES during the course of an investigation
unrelated to improper prescription practices, and also violated their rights not to be
subjected to unwarranted searches and seizures.
The trial court denied the petition, concluding CURES permitted the Board to
access the data without an administrative subpoena or other showing of good cause. In
the extensive written order, the court further stated that Lewis “provide[d] no authority
suggesting that an authorized government body’s review of the CURES system’s data
violate[d] a right to privacy.” The trial court noted that even if the constitutional right to
privacy were implicated, the right to privacy is not absolute and “must be weighed
against the compelling public interest in controlling potentially dangerous
pharmaceuticals to prevent their abuse.” In weighing these competing interests, “[t]he
public health and safety concern[s] served by the monitoring and regulation of the
prescription of controlled substances serves a compelling public interest that justifie[d]
disclosure of prescription records without notification or consent.” Judgment was entered
denying the petition for writ of administrative mandamus.
Lewis filed a petition for writ of mandate in this court to set aside the judgment. A
writ petition is the only authorized mode of appellate review. (Bus. & Prof. Code,
§ 2337; Leone v. Medical Board (2000) 22 Cal.4th 660, 663-664, 670.) We issued an
order to show cause. For the reasons stated, we discharge the order to show cause and
deny Lewis’s petition.
CONSTITUTIONAL ISSUE
Lewis presents the following issue for review: “[W]hether the Medical Board of
California is permitted to conduct searches, without any showing of any kind—whether
good cause, reasonable suspicion, or some other similar standard—and without warrant
or subpoena—of the controlled substances prescription records of patients throughout the
State, via the State’s computerized Controlled Substance Utilization Review and
5
Evaluation System.”4 As stated, the challenge to CURES appears to be based upon the
protections of the Fourth Amendment,5 but Lewis makes clear that he is asserting his
patients’ right to informational privacy in their controlled substances prescription records.
Lewis has standing to assert his patients’ right to privacy under article I, section 1 of the
California Constitution. (Wood v. Superior Court (1985) 166 Cal.App.3d 1138, 1145.)
As presented, the issue also appears to be a facial attack to the constitutional
validity of CURES. “A facial challenge to the constitutional validity of a statute or
ordinance considers only the text of the measure itself, not its application to the particular
circumstances of an individual.” (Tobe v. City of Santa Ana (1995) 9 Cal.4th 1069,
1084.) The relief typically sought is total invalidation of the law. Therefore, cases hold
that the challenger must demonstrate “a present total and fatal conflict with applicable
constitutional prohibitions.” (Ibid., citations and internal quotation marks omitted.) In
contrast, an as applied challenge to a statute or ordinance involves an otherwise facially
valid measure that has been applied in a constitutionally impermissible manner. (Ibid.)
This type of challenge “contemplates analysis of the facts of a particular case or cases to
determine the circumstances in which the statute or ordinance has been applied and to
4
Because Lewis uses the words “subpoena” and “warrant,” we assume his use of
“warrant” is in the traditional Fourth Amendment sense to refer to criminal proceedings.
The United States Supreme Court, however, uses the term “warrant” also to refer to
administrative subpoenas that are the usual method by which an administrative agency
obtains records from private parties. (See De La Cruz v. Quackenbush (2000) 80
Cal.App.4th 775, 779, fn. 1.) “The right at stake is the right to a front-end or back-end
judicial review of the reasonableness of the search.” (Ibid.)
5
The Fourth Amendment of the United States Constitution, which is enforceable
against the states as a component of the Fourteenth Amendment’s guarantee of due
process of law provides in relevant part: “The right of the people to be secure in their
persons, houses, papers, and effects against unreasonable searches and seizures, shall not
be violated . . . .” (U.S. Const., 4th Amend.; Mapp v. Ohio (1961) 367 U.S. 643, 655.)
“ ‘Fourth Amendment rights are personal rights which, like some other constitutional
rights, may not be vicariously asserted.’ ” (Rakas v. Illinois (1978) 439 U.S. 128, 133-
134; In re Lance W. (1985) 37 Cal.3d 873, 890.)
6
consider whether in those particular circumstances the application deprived the individual
to whom it was applied of a protected right.” (Ibid.)
Lewis clarifies that his constitutional challenge does not seek to invalidate the
CURES statute. He does not challenge the CURES statute insofar as the state requires
the collection of his patients’ controlled substances prescription records in a centralized
database. Nor does he “contend here that a warrant or showing of good cause is required
in all CURES searches. Rather, he contends that such a requirement applies when the
purpose of the CURES search is the investigation of physicians rather than pharmacies.”
(Emphasis in original.) This distinction is based on the physician-patient relationship.
As it applies to him, Lewis’s constitutional attack is narrowly focused on the Board’s
access to his patients’ CURES data during an investigation unrelated to improper
prescription practices without patient consent or prior judicial approval upon a showing
of good cause.6
Accordingly, Lewis presents an as applied challenge to the CURES statute, in
which we analyze the facts of his case to determine the circumstances in which CURES
has been applied and consider whether the application deprived Lewis’s patients of a
protected privacy right. (See Tobe v. City of Santa Ana, supra, 9 Cal.4th at p. 1084.)
Whether a statute is challenged facially or as applied, when the facts are not disputed, the
determination of its constitutionality is a question of law that we review de novo.
(Alviso v. Sonoma County Sheriff’s Dept. (2010) 186 Cal.App.4th 198, 204.)
DISCUSSION
The constitutional issue presented here implicates the informational privacy rights
of patients in the highly regulated area of controlled substances. We present a brief
overview of these statutes before addressing the privacy issues.
6
We focus solely on Lewis’s patient’s right to informational privacy because Lewis
has no reasonable expectation of privacy in his prescribing practices of controlled
substances. (Health & Saf. Code, § 11190.) As discussed, post, controlled substances are
highly regulated by the state.
7
1. Regulation of Controlled Substances
The prescribing and dispensing of controlled substances in California is regulated
by the California Uniform Controlled Substances Act (the Act). (Health & Saf. Code,
§ 11000 et seq.) The Act classifies controlled substances into five schedules. (Health &
Saf. Code, §§ 11053-11058.) For example, codeine, hydrocodone, morphine, and
methadone are examples of Schedule II drugs. (Health & Saf. Code, § 11055, subds.
(b)(1)(G), (I), (L) & (c)(14).) With the exception of a 72-hour supply for a patient, or an
order for use by a hospital patient, no controlled substance classified in Schedule II “shall
be dispensed without a prescription.” (Health & Saf. Code, §§ 11158, subds. (a), (b),
11159.) Except when ordered for use by a hospital patient, “or when dispensed directly
to an ultimate user by a practitioner, other than a pharmacist or pharmacy, no controlled
substance classified in Schedule III, IV, or V may be dispensed without a prescription.”
(Health & Saf. Code, §§ 11158, subd. (a), 11159.)
Prescriptions for Schedule II through V drugs must be made on an official form,
but Schedule III through V drugs may be dispensed upon an oral or electronically
transmitted prescription. (Health & Saf. Code, § 11164, subds. (a), (b).) If orally or
electronically transmitted, a hard copy must be produced and “signed and dated by the
pharmacist filling the prescription” or other authorized person. (Health & Saf. Code,
§ 11164, subd. (b)(1).) These prescription forms must contain the address for whom the
controlled substance is prescribed. (Health & Saf. Code, § 11164, subd. (a)(2).) If the
prescription is orally or electronically transmitted, the hard copy need not include the
address if that information is readily retrievable in the pharmacy. (Health & Saf. Code,
§ 11164, subd. (b)(2).)
Every practitioner, other than a pharmacist, who prescribes a controlled substance
classified in Schedule II through IV has a duty to keep records of controlled substances
dispensed. (Health & Saf. Code, § 11190, subds. (a)-(c).) “Each prescriber that
dispenses controlled substances shall provide the Department of Justice the information
required by this subdivision on a weekly basis in a format set by the Department of
Justice pursuant to regulation.” (Health & Saf. Code, § 11190, subd. (c)(2)(A).) Certain
8
exceptions to the reporting requirements apply to Schedule II, III, and IV controlled
substances but are not at issue here. (Health & Saf. Code, § 11190, subds. (e), (f).)
2. Health and Safety Code section 11165 (CURES)
The Department of Justice maintains CURES to electronically monitor the
prescribing and dispensing of Schedule II through IV controlled substances by all
practitioners authorized to prescribe or dispense these controlled substances. (Health &
Saf. Code, § 11165, subd. (a).) Although the Legislature has since amended subdivision
(a) of Health and Safety Code section 11165, at the time of these administrative
proceedings, the statute stated in pertinent part: “To assist law enforcement and
regulatory agencies in their efforts to control the diversion and resultant abuse of
Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical
analysis, education, and research, the Department of Justice shall . . . maintain the
Controlled Substance Utilization Review and Evaluation System (CURES) for the
electronic monitoring of, and Internet access to information regarding, the prescribing
and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all
practitioners authorized to prescribe or dispense these controlled substances.”7
The Department of Justice receives weekly reports from dispensing pharmacies for
Schedule II through IV controlled substances prescriptions. (Health & Saf. Code,
§ 11165, subd. (d).) These reports include the name, address, and telephone number of
the “ultimate user,” the prescriber’s license number, the pharmacy prescription number,
7
Health and Safety Code section 11165, subdivision (a) now reads: “To assist
health care practitioners in their efforts to ensure appropriate prescribing, ordering,
administering, furnishing, and dispensing of controlled substances, law enforcement and
regulatory agencies in their efforts to control the diversion and resultant abuse of
Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical
analysis, education, and research, the Department of Justice shall . . . maintain the
Controlled Substance Utilization Review and Evaluation System (CURES) for the
electronic monitoring of, and Internet access to information regarding, the prescribing
and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all
practitioners authorized to prescribe, order, administer, furnish, or dispense these
controlled substances.”
9
the National Drug Code (NDC) of the controlled substance dispensed, the quantity of the
controlled substance dispensed, and the number of refills ordered. (Health & Saf. Code,
§ 11165, subd. (d).)
The Department of Justice provides CURES reports to the Board without use of a
subpoena. (Health & Saf. Code, § 11165, former subd. (c).) “Data obtained from
CURES shall only be provided to appropriate state, local, and federal persons or public
agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as
determined by the Department of Justice, for the purpose of educating practitioners and
others in lieu of disciplinary, civil, or criminal actions.”8 (Health & Saf. Code, § 11165,
former subd. (c).) Former subdivision (c) of Health and Safety Code section 11165 was
renumbered as subdivision (c)(2) without substantive changes to the quoted provision.9
The CURES statute prohibits the disclosure, sale, or transfer of data to any third party.
(Health & Saf. Code, § 11165, former subd. (c).)
At the time of these proceedings, the statute provided that “CURES shall operate
under existing provisions of law to safeguard the privacy and confidentiality of patients.”
(Health & Saf. Code, § 11165, former subd. (c).) Subdivision (c)(1) of Health and Safety
Code section 11165 now states: “The operation of CURES shall comply with all
applicable federal and state privacy and security laws and regulations.”
The Information Practices Act of 1977 (Civ. Code, § 1798 et seq.) places strict
limits on the dissemination of personal information to protect an individual’s right to
privacy. (Civ. Code, § 1798.1.) Subdivision (e) of Civil Code section 1798.24, permits
8
We deferred ruling on the Board’s request for judicial notice. We grant judicial
notice of Exhibits E and F and deny the request as to the remaining exhibits. It appears
from these exhibits that the legislative intent was to establish CURES to provide
instantaneous access for authorized entities.
9
The following sentence was added to Health and Safety Code section 11165,
subdivision (c)(2): “The Department of Justice shall establish policies, procedures, and
regulations regarding the use, access, evaluation, management, implementation,
operation, storage, disclosure, and security of the information within CURES, consistent
with this subdivision.”
10
disclosure “[t]o a person, or to another agency where the transfer is necessary for the
transferee agency to perform its constitutional or statutory duties, and the use is
compatible with a purpose for which the information was collected and the use or transfer
is accounted for in accordance with Section 1798.25.” “[A] use is compatible if the use
of the information requested is needed in an investigation of unlawful activity under the
jurisdiction of the requesting agency or for licensing, certification, or regulatory purposes
by that agency.” (Civ. Code, § 1798.24, subd. (e).) The Board qualifies for authorization
under CURES to access and review controlled substances prescription records.
3. The State Constitutional Right to Privacy
The California Constitution contains an explicit guarantee of the right of privacy.
(art. I, § 1; American Academy of Pediatrics v. Lungren (1997) 16 Cal.4th 307, 326
(plur. opn. of George, C.J.).) The constitutional provision states: “All people are by
nature free and independent and have inalienable rights. Among these are enjoying and
defending life and liberty, acquiring, possessing, and protecting property, and pursuing
and obtaining safety, happiness, and privacy.” (Cal. Const., art. I, § 1.) The privacy
protected by the California Constitution “is no broader in the area of search and seizure
than the ‘privacy’ protected by the Fourth Amendment or by article I, section 13 of the
California Constitution.” (Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1,
30, fn. 9 (Hill).) The privacy right at issue here is Lewis’s patients’ interest in preventing
the disclosure or misuse of their controlled substances prescription records, which falls
into the category of “informational privacy.”
The U.S. Supreme Court in Whalen v. Roe (1977) 429 U.S. 589, 599-600, assumed
a right to informational privacy existed under the federal Constitution in controlled
substances prescription records. (See National Aero. and Space Admin. v. Nelson (2011)
__ U.S. __, [131 S.Ct. 746, 756-757 & fn. 10]; People v. Gonzales (2013) 56 Cal.4th 353,
384.) “[I]n many contexts, the scope and application of the state constitutional right of
privacy is broader and more protective of privacy than the federal constitutional right of
privacy as interpreted by the federal courts. [Citations.]” (American Academy of
Pediatrics v. Lungren, supra, 16 Cal.4th at pp. 326-327.) The state constitutional right of
11
privacy, and the privacy right protected by the federal Constitution are not absolute.
Rather, the right to privacy is a conditional right that may be infringed upon by balancing
the intrusion with a showing of the proper governmental interest. (Whalen v. Roe, supra,
at p. 598; Tucson Woman’s Clinic v. Eden (9th Cir. 2004) 379 F.3d 531, 551; Hill, supra,
7 Cal.4th at pp. 34-35.) As previously stated, our analysis focuses on the express
guarantee of the right to privacy under the California Constitution.
4. The Board Did Not Violate Lewis’s Patients’ Right to Informational Privacy
Article I, section 1 of the California Constitution creates a “ ‘legal and enforceable
right of privacy for every Californian.’ ” (White v. Davis (1975) 13 Cal.3d 757, 775.)
“The party claiming a violation of the constitutional right of privacy established in article
I, section 1 of the California Constitution must establish (1) a legally protected privacy
interest, (2) a reasonable expectation of privacy under the circumstances, and (3) a
serious invasion of the privacy interest.” (International Federation of Professional &
Technical Engineers, Local 21, AFL-CIO v. Superior Court (2007) 42 Cal.4th 319, 338,
citing Hill, supra, 7 Cal.4th at pp. 39-40.) These “threshold elements” screen out claims
that otherwise do not implicate significant intrusions on a privacy interest protected by
the state constitutional privacy provision. (American Academy of Pediatrics v. Lungren,
supra, 16 Cal.4th at pp. 330-331.) Once these elements are established, the court must
then weigh and balance the justification for the conduct in question against the severity of
the intrusion on privacy. (Id. at p. 331.)
If these threshold elements are proved, the Hill decision sets the standard in which
a proffered justification for alleged interferences with the right to privacy will be
measured. “Where the case involves an obvious invasion of an interest fundamental to
personal autonomy, e.g., freedom from involuntary sterilization or the freedom to pursue
consensual familial relationships, a ‘compelling interest’ must be present to overcome the
vital privacy interest. If, in contrast, the privacy interest is less central, or in bona fide
dispute, general balancing tests are employed.” (Hill, supra, 7 Cal.4th at p. 34.)
“Whether a legally recognized privacy interest is present in a given case is a
question of law to be decided by the court. [Citations.] Whether plaintiff has a
12
reasonable expectation of privacy in the circumstances and whether defendant’s conduct
constitutes a serious invasion of privacy are mixed questions of law and fact.”
(Hill, supra, 7 Cal.4th at p. 40.)
a. Legally Protected Privacy Right
The right to privacy extends to medical records. (John B. v. Superior Court
(2006) 38 Cal.4th 1177, 1198; Board of Medical Quality Assurance v. Gherardini (1979)
93 Cal.App.3d 669, 678-679.) “The state of a person’s gastro-intestinal tract is as much
entitled to privacy from unauthorized public or bureaucratic snooping as is that person’s
bank account, the contents of his library or his membership in the NAACP.” (Board of
Medical Quality Assurance v. Gherardini, supra, at p. 679.)
Like medical records, prescription records contain identifying information and
sensitive information related to drugs used to treat a person’s medical condition and also
reveal medical decisions concerning the course of treatment. What medication a person
takes to treat a gastro-intestinal condition also is entitled to privacy from unauthorized
public and bureaucratic snooping.
By statute, there also is a legally protected privacy interest in controlled
substances prescription records stored in CURES. Health and Safety Code section
11165.1, which permits a treating physician or pharmacist to access CURES data,
specifically states that this information is considered medical information subject to the
provisions of the Confidentiality of Medical Information Act (Civ. Code, § 56 et seq.).10
(Health & Saf. Code, § 11165.1, subd. (d).) Moreover, the CURES statute prohibits
unauthorized public disclosure and operates under existing law to safeguard privacy and
confidentiality. (Health & Saf. Code, § 11165, former subd. (c); Civ. Code, § 1798.24,
subd. (e).) Thus, a patient who has obtained a prescription for a controlled substance has
10
Civil Code section 56.05, subdivision (j) provides in pertinent part: “ ‘Medical
information’ means any individually identifiable information, in electronic or physical
form, in possession of or derived from a provider of health care, health care service plan,
pharmaceutical company, or contractor regarding a patient’s medical history, mental or
physical condition, or treatment.”
13
a legally protected privacy interest in unwarranted public disclosure and unauthorized
access to information contained in those records.
b. Reasonable Expectation of Privacy
“Even when a legally cognizable privacy interest is present, other factors may
affect a person’s reasonable expectation of privacy.” (Hill, supra, 7 Cal.4th at pp. 36-37.)
Citing Whalen v. Roe, supra, 429 U.S. at page 602, the Hill court noted that “customs,
practices, and physical settings . . . may create or inhibit reasonable expectations of
privacy.” (Hill, supra, at p. 36.)
In Whalen v. Roe, supra, 429 U.S. 589, the U.S. Supreme Court upheld a New
York statute that required reporting Schedule II prescription records to the state
department of health. The information included the name of the prescribing physician,
the dispensing pharmacy, the drug and dosage, and the name, address, and age of the
patient. (Id. at p. 593.) This data was recorded into a centralized computer system.
(Ibid.) The collection of this data, as part of the state’s oversight of controlled
substances, was not an unwarranted disclosure of private information in violation of
federal constitutionally protected privacy rights. (Id. at pp. 591, 592-593.) The Whalen
court concluded collecting this centralized data was supported by established law and not
“meaningfully distinguishable from a host of other unpleasant invasions of privacy that
are associated with many facets of health care.” (Id. at p. 602.) Thus, the New York
statute did not violate “any right or liberty protected by the Fourteenth Amendment.”
(Id. at pp. 603-604, 606.)
Addressing the threat of public disclosure, the Whalen court noted there was a
possibility that the data may be offered in a judicial proceeding if a doctor or patient is
accused of a violation of the law. (Whalen v. Roe, supra, 429 U.S. at p. 600.) The court
reasoned, however, that the remote possibility judicial supervision of the evidentiary use
of this data would provide inadequate privacy protection was insufficient to hold the
New York statute facially unconstitutional. (Id. at pp. 601-602.)
We recognize the privacy issue in Whalen v. Roe was limited to collecting
centralized data by the state, and thus the court did not address the issue presented here,
14
that is, a patient’s right to informational privacy when these centralized controlled
substances prescription records are accessed by a state, local, or federal agency for
disciplinary, civil, or criminal purposes.11 Nevertheless, we find Whalen v. Roe to be
persuasive, as did the California Supreme Court in Hill, to illustrate what constitutes a
reasonable expectation of privacy.
There is a diminished expectation of privacy in controlled substances prescription
records maintained in CURES. Contrary to Lewis’s contention, it does not follow that a
patient’s expectation of privacy in his or her controlled substances prescription records is
the same as the expectation of privacy in medical records. Unlike medical records,
prescriptions of controlled substances are subject to regular scrutiny by law enforcement
and regulatory agencies as part of the pervasive regulation of controlled substances. A
reasonable patient filling a prescription for a controlled substance knows or should know
that the state, which prohibits the distribution and use of such drugs without a
prescription, will monitor the flow of these drugs from pharmacies to patients.
Pharmacies are required to maintain records of prescriptions filled for controlled
substances and present them to “authorized officers of the law” without a warrant.
(People v. Doss (1992) 4 Cal.App.4th 1585, 1597-1598; see also Bus. & Prof. Code,
§§ 4081, subd. (a), 4333, subd. (a).) A pharmacist also has a statutory obligation to
provide data of controlled substances prescriptions to the Department of Justice on a
weekly basis for electronic monitoring in CURES. (Health & Saf. Code, § 11165,
subd. (d).) This well-known and long-established regulatory history significantly
diminishes any reasonable expectation of privacy against the release of controlled
substances prescription records to state, local, or federal agencies for purposes of
criminal, civil, or disciplinary investigations.12
11
The centralized data, however, was available for use by state department of health
investigators, and had been used in at least two investigations. (Whalen v. Roe, supra,
429 U.S. at p. 595.)
12
The California Medical Association (CMA) has filed an amicus curiae letter brief
on behalf of Lewis. CMA argues the Board’s position is absurd that a patient’s
15
Both federal and state courts also have recognized that “closely regulated”
businesses have a reduced expectation of privacy whether analyzed as creating an
unreasonable expectation of privacy or a reasonable expectation of privacy justified by a
competing state interest. (E.g., New York v. Burger (1987) 482 U.S. 691, 702; People v.
Doss, supra, 4 Cal.App.4th at p. 1598.) While the reasonable expectation of privacy is
diminished here, it is not de minimus. A patient has a reasonable expectation that
sufficient statutory safeguards in CURES prevent unwarranted public disclosure and
unauthorized access to their controlled substances prescription records.
c. Seriousness of Invasion
Not every intrusion of privacy gives rise to a cause of action for invasion of
privacy. (Hill, supra, 7 Cal.4th at p. 37.) “Actionable invasions of privacy must be
sufficiently serious in their nature, scope, and actual or potential impact to constitute an
egregious breach of the social norms underlying the privacy right.” (Ibid.) Lewis
contends that when the Board accessed CURES, a serious invasion of his patients’
privacy rights occurred because (1) there are no criminal or civil sanctions in the CURES
statute to safeguard against unwarranted public disclosure, and (2) there is no statutory
requirement of a showing of good cause or other judicial determination before the Board
accessed his patients’ CURES data.13
controlled substances prescription records may be subject to different privacy protections
depending on whether the information is contained in CURES or in medical records.
This argument mischaracterizes the Board’s position. Prescriptions for controlled
substances are highly regulated and whether the information is housed in CURES or at
the local pharmacy, there is a statutory obligation to provide controlled substances
prescription records to the state without a warrant or administrative subpoena, reducing
any reasonable expectation of privacy.
13
CMA offers a third reason, that is, patients are not the subject of the investigation.
CMA focuses on the deficiencies of CURES to provide notice to patients, or to permit
patients to have access to their CURES data. These deficiencies are not pertinent to our
resolution of the issue presented here, and these concerns are better directed to the
Legislature.
16
(1). Unwarranted Public Disclosure
The fear, not present here, that the Board will publicly disclose CURES data
obtained during the course of a licensee-physician investigation does not constitute a
serious invasion of privacy. The Board has statutory and regulatory duties to protect
against the public release of a patient’s CURES data. As noted, the Board may lawfully
obtain CURES data as authorized by statute for disciplinary purposes. (Health & Saf.
Code, § 11165, former subd. (c).) Data disclosed to any individual agency cannot be sold
or transferred to a third party. (Ibid.) The Board also must secure CURES data against
unauthorized disclosure and has an independent statutory duty to protect the privacy and
confidentiality of any information it obtains in the discharge of its duties. (Ibid.; Bus. &
Prof. Code, § 2225.) Civil Code section 1798.24, subdivision (e) further requires the
Board to protect CURES data from unwarranted public disclosure. Here, there is no
contention that the Board publicly disclosed Lewis’s patients’ information to third parties
or failed to protect the confidentiality of the CURES data it received during the course of
its investigation.
Lewis relies on Tucson Woman’s Clinic v. Eden, supra, 379 F.3d 531, in which
the Ninth Circuit concluded that the informational privacy rights of patients were violated
by Arizona regulations that required disclosure of (1) unredacted medical records to the
Arizona Department of Health Services (DHS), and (2) ultrasound pictures with patient
identifying information to a private contractor for review. (Id. at pp. 551-554.) The
Ninth Circuit employed a balancing test to weigh the privacy interest against the state
intrusion, noting the safeguards to prevent unauthorized disclosure of unredacted medical
records and ultrasound pictures to members of the public were inadequate. (Id. at
pp. 552-553.) Citing Whalen v. Roe, supra, 429 U.S. at pages 594 through 595, the Ninth
Circuit reasoned that, unlike the Arizona regulations, the New York statute imposed
criminal penalties for such unauthorized disclosures. (Tucson Woman’s Clinic v. Eden,
supra, at p. 552.) Additionally, there were no safeguards in the Arizona regulations to
limit access to these records, which on balance constituted a violation of the patients’
informational privacy rights. (Id. at pp. 552-553.)
17
The Ninth Circuit’s analysis, however, was decidedly different concerning the
regulation that required licensee-physicians to release information, including the name of
a patient, to a professional licensing board if an incident arose with the patient.
(Tucson Woman’s Clinic v. Eden, supra, 379 F.3d at pp. 553-554.) The court recognized
that although a professional licensing board was not covered by the statutory scheme’s
prohibitions on information disclosure, other established safeguards prohibited release of
patient information to the public when any incident was reported to the Arizona Medical
Board or the Board of Osteopathic Examiners in Medicine and Surgery. (Id. at p. 554.)
The requested information was limited, and the state had a strong interest in the licensing
board investigating serious patient incidents. Employing the balancing test, the Ninth
Circuit concluded there was no violation of patients’ informational privacy rights.14
(Ibid.)
Here, although there are no penalties in CURES for unwarranted public disclosure,
other safeguards prohibit release of patient information to the public. Thus, we conclude
the release of CURES data to the Board during an investigation of a licensee-physician is
not a serious invasion of privacy because sufficient safeguards are in place.
(2). Access to CURES Data Without a Warrant or Subpoena
Lewis next contends the Board’s access to CURES during an investigation of a
licensee-physician is a serious invasion of his patients’ privacy rights because there is a
reasonable societal expectation that to conduct such a search there must be a showing of
good cause (or other reasonableness standard) to obtain an administrative subpoena or
warrant. Lewis argues the Board must make this showing before accessing CURES.
14
In Tucson Woman’s Clinic v. Eden, supra, 379 F.3d 531, the Ninth Circuit also
considered the constitutionality of the regulatory scheme permitting warrantless
inspections of abortion clinics. (Id. at p. 549.) The Ninth Circuit held the regulatory
scheme violated physicians’ Fourth Amendment rights, and the administrative exception
applicable to closely regulated businesses was inapplicable to the searches authorized by
the Arizona regulations. (Id. at pp. 550-551.) The balancing test the Ninth Circuit used
to address informational privacy rights under the Fourteenth Amendment was not
applicable to its Fourth Amendment analysis.
18
Lewis’s argument is a challenge to the Board’s authority to access CURES to
compile the facts necessary to obtain administrative subpoenas for his patients’ medical
records. To support his argument, Lewis principally relies on State v. Skinner (La. 2009)
10 So.3d 1212, which held that a warrantless search of a criminal defendant’s pharmacy
records during a criminal investigation violated the defendant’s Fourth Amendment
privacy interests and the state constitutional right to privacy.15 (Id. at p. 1218.) The court
addressed whether Louisiana’s citizens have a reasonable expectation of privacy in their
pharmaceutical prescriptions and medical records such that a warrant is required for a
search of those records in a criminal investigation. (Id. at p. 1215.) Analyzing federal
jurisprudence under the Fourth Amendment privacy interest and the state’s heightened
privacy interest, the Skinner court concluded “the right to privacy in one’s medical and
prescription records is an expectation of privacy that society is prepared to recognize as
reasonable.” (Id. at p. 1218.) Thus, a warrant was required.
Absent from Lewis’s discussion of Skinner is a distinction critical here, that is, a
balancing test was inapplicable to the court’s Fourth Amendment analysis of the intrusion
into individual privacy during the course of a criminal investigation. (State v. Skinner,
supra, 10 So.3d at p. 1218.) In Whalen v. Roe, supra, 429 U.S. 589, the United States
Supreme Court dismissed the claims raised pursuant to the Fourth Amendment, noting
that the cases cited in support of that argument involved “affirmative, unannounced,
narrowly focused intrusions into individual privacy during the course of criminal
investigations.” (Id. at p. 604, fn. 32.) The Whalen court declined to extend the Fourth
Amendment protections to the informational privacy interest at stake in that case. (Ibid.)
Like the informational privacy rights under the federal Constitution at issue in
Whalen v. Roe and Tucson Woman’s Clinic v. Eden, under this state’s constitutional right
to privacy (art. I, sec. 1), we must balance the justification against the intrusion when a
15
Skinner did not involve access to a centralized database maintained by the state.
The Board points out that access to state records by another state agency is not a search
from the standpoint of the patient.
19
case involves a genuine, nontrivial invasion of a privacy interest.16 Thus, Skinner, which
is non-binding authority, is not persuasive.
Focusing on the Fourth Amendment privacy interest, Lewis further argues that
access to CURES without an administrative subpoena (or warrant) is a serious invasion
of privacy that cannot be justified under the “closely regulated” business exception to the
warrant requirement. The rationale for this exception is the owner or operator of a
closely regulated business has a reduced expectation of privacy.
A warrantless search of a “closely regulated” business is deemed reasonable if
certain criteria are met. (New York v. Burger, supra, 482 U.S. at p. 702; De La Cruz v.
Quackenbush, supra, 80 Cal.App.4th at pp. 781-782.) To pass constitutional muster, one
criterion is that the inspection program must provide a constitutionally adequate
substitute for a warrant. (New York v. Burger, supra, at pp. 702-703.) The regulatory
statute must advise the owner of the commercial premises that the search is being made
pursuant to the law, have a properly defined scope, and limit the discretion of the
inspecting officers. (Id. at p. 703.)
Lewis contends that the CURES statute imposes no limits on the discretion of the
inspecting officer, which we presume in this context is the Board investigator. We
disagree. Access to CURES in compliance with the statutory procedures satisfies this
requirement and is a reasonable search.
As a preliminary matter, there is a diminished expectation of privacy in the highly
regulated area of prescription drugs, as a warrantless search of a patient’s pharmacy
16
In Medical Board of California v. Chiarottino, supra, 225 Cal.App.4th 623
[2014 WL 1427466], the court cited out-of-state cases relying on Whalen v. Roe to
conclude the Board did not violate patients’ privacy interests in accessing CURES and
using that information to obtain administrative subpoenas. (Id. at pp. *7-*8.)
We granted Lewis’s request to bring to our attention another out-of-state case
recently filed in the United States District Court in Oregon, Oregon Prescription Drug
Monitoring Program v. United States Drug Enforcement Administration (D.Or. 2014)
__ F.Supp.2d __ [2014 WL 562938]. That case is inapposite. The statutory scheme at
issue is not similar to the CURES statute, and the Fourth Amendment issue presented was
the right of a federal agency to obtain centralized records from a state prescription drug
monitoring program by issuing administrative subpoenas rather than obtaining warrants.
20
records is statutorily authorized. (Bus. & Prof. Code, § 4081, subd. (a).) There is no
greater right to privacy in controlled substances prescription records stored in CURES
than the privacy rights in the same prescription records housed at CVS or Rite-Aid.
Unlike De La Cruz v. Quackenbush, supra, 80 Cal.App.4th 775, where the
regulatory scheme did not define a routine inspection program, the CURES statute
informs patients and physicians that controlled substances prescription records are subject
to disclosure to the state for electronic monitoring by the Department of Justice. (Health
& Saf. Code, § 11165, former subd. (c).) Access to CURES data is limited to state and
federal agencies for civil, criminal, and disciplinary purposes. Thus, under the statutory
scheme, the physician and patient know who is authorized to receive CURES data and
under what narrow circumstances.
In sum, we conclude that the Board’s access to CURES during the course of a
disciplinary investigation did not constitute a serious invasion of Lewis’s patients’ right
to informational privacy.
d. Balancing the Justification Against the Intrusion
Even if we were to conclude that Lewis had established the threshold elements to
establish a right to informational privacy on behalf of his patients, we must balance the
justification for permitting the Board to access CURES during an investigation of a
licensee-physician against the intrusion. (See Hill, supra, 7 Cal.4th at p. 40.) An
invasion of privacy is justified if it substantively furthers one or more countervailing
interests. (Ibid.)
Lewis and the Board do not agree on the level of scrutiny required to balance these
interests. In Whalen v. Roe, supra, 429 U.S. 589, the court invoked a rational basis test,
concluding the New York statute was a reasonable exercise of the state’s broad police
powers. (Id. at p. 598.) In Hill, the Supreme Court declined to hold that every assertion
of a privacy interest under article I, section 1 must be overcome by a “ ‘compelling
interest.’ ” (Hill, supra, 7 Cal.4th at pp. 32-35.) Board of Medical Quality Assurance v.
Gherardini, supra, 93 Cal.App.3d 669, decided before Hill, held that when balancing the
intrusion into the patients’ informational privacy rights in their medical records, the state
21
must establish a compelling state interest. (Id. at p. 679.) Although the privacy issue
here relates to informational privacy, which is similar to the constitutional question
addressed by the Whalen court, we assume without deciding that the state must establish
a compelling interest.
The Board advances two compelling state interests to access CURES during an
investigation of a licensee-physician.
First, there is no dispute that the state has a compelling interest in controlling the
diversion and abuse of controlled substances. Pursuant to its police power to protect the
public health and welfare, a state has the power to regulate and control the sale, use, and
traffic of habit-forming drugs. (Whipple v. Martinson (1921) 256 U.S. 41, 45; People v.
Privitera (1979) 23 Cal.3d 697, 704-705, cert. den. sub nom. Privitera v. California
(1979) 444 U.S. 949.) As the U.S. Supreme Court stated when examining a California
statute that regulated morphine: “There can be no question of the authority of the State in
the exercise of its police power to regulate the administration, sale, prescription and use
of dangerous and habit-forming drugs, such as are named in the statute. The right to
exercise this power is so manifest in the interest of the public health and welfare, that it is
unnecessary to enter upon a discussion of it beyond saying that it is too firmly established
to be successfully called in question.” (Whipple v. Martinson, supra, at p. 45; see also
People v. Privitera, supra, at p. 731 (dis. opn. of Bird, C.J.).)
Second, the state has a compelling interest in exercising its regulatory power to
protect the public against incompetent, impaired, or negligent physicians. (Arnett v.
Dal Cielo, supra, 14 Cal.4th at p. 7.) “Protection of the public shall be the highest
priority for the Medical Board of California in exercising its licensing, regulatory, and
disciplinary functions. Whenever the protection of the public is inconsistent with other
interests sought to be promoted, the protection of the public shall be paramount.”
(Bus. & Prof. Code, § 2001.1.) Vesting the Board with the authority to investigate
complaints against licensee-physicians is an integral part of the oversight of professional
practice.
22
Lewis contends that his patients’ informational privacy rights in their controlled
substances prescription records outweighs these compelling state interests because the
CURES statute permits the Board to access data before demonstrating good cause. We
disagree.
The Legislature has determined that CURES may be accessed as a tool to monitor
abuse and diversion of controlled substances. To impose a good cause requirement
before accessing CURES data would necessarily involve litigating the privacy issue in
advance. As the court stated in Reynaud v. Superior Court (1982) 138 Cal.App.3d 1,
when addressing a similar argument, the scope of the privacy clause is “potentially
enormous” and the “variety of circumstances in which it might be invoked is essentially
infinite.” (Id. at p. 8.) This delay defeats the legislative purpose of CURES. One of the
real-time benefits of access to CURES is to permit a physician, who is authorized to
prescribe or dispense a controlled substance, to instantly look up a new patient’s
controlled substances history to determine whether the patient legitimately needs pain
medicine or is “doctor shopping.”
Real-time access to CURES also protects patients from incompetent and
unprofessional doctors. If the privacy issue were litigated before accessing CURES, the
prescribing physician under investigation could stall release of these records, which
would prevent the state from exercising its police power to protect the public health.
The Board’s access to CURES also should not be limited based upon the nature of
the complaint lodged against the licensee-physician. From the patients’ perspective, the
privacy interest in their controlled substances prescription records is no different if the
Board were investigating unprofessional conduct in their care and treatment or in
improper prescription practices. Even if the Board is investigating the former, as was the
case here, a physician’s prescribing practices are directly related to medical care and
treatment afforded to his patients. A complaint regarding the quality of care and
treatment by a diet doctor, for example, might often reveal improper prescribing practices
that could be deadly. Likewise, a complaint regarding the quality of care or treatment
may be related to a physician’s substance abuse problem that poses a threat to public
23
health. Limits such as Lewis proposes would compromise the Board’s paramount
concern to protect public health.
Balancing the state’s substantial interest in preventing the abuse and diversion of
controlled substances and protecting the public health against the minor intrusion upon a
patient’s informational privacy in his or her controlled substances prescription records
stored in CURES, we conclude the Board’s actions here in accessing and compiling data
from CURES did not violate article I, section 1 of the California Constitution. There are
sufficient safeguards in the CURES statute and other regulatory duties to protect patients’
informational privacy and confidentiality from unwarranted public disclosure and
unfettered access to CURES data. Thus, we conclude the Board’s access to CURES
while investigating a consumer complaint against Lewis that was unrelated to his
prescription practices did not violate his patients’ state constitutional right to privacy in
their controlled substances prescription records. Accordingly, the trial court did not err in
denying Lewis’s petition to set aside the Board’s disciplinary action against him.
24
DISPOSITION
The order to show cause is discharged. The petition for writ of mandate is denied.
The parties are to bear their own costs.
CERTIFIED FOR PUBLICATION
ALDRICH, J.
We concur:
KLEIN, P. J.
CROSKEY, J.
25