County of Los Angeles v. Superior Ct.

Filed 6/15/21

CERTIFIED FOR PUBLICATION

COURT OF APPEAL, FOURTH APPELLATE DISTRICT

DIVISION ONE

STATE OF CALIFORNIA

COUNTY OF LOS ANGELES, D077794

Petitioner, (Super. Ct. No. 30-2014-00725287-

CU-BT-CXC)

v.

THE SUPERIOR COURT OF

ORANGE COUNTY,

Respondent;

JOHNSON & JOHNSON et al.,

Real Parties in Interest.

COUNTY OF ALAMEDA, D077795

Petitioner, (Super. Ct. No. 30-2014-00725287-

CU-BT-CXC)

v.

THE SUPERIOR COURT OF

ORANGE COUNTY,

Respondent;

JOHNSON & JOHNSON et al.,

Real Parties in Interest.

CONSOLIDATED ORIGINAL PROCEEDINGS in mandate.

Peter J. Wilson, Judge. Petitions granted.

Mary C. Wickham and Rodrigo A. Castro-Silva, County Counsel,

Robert E. Ragland, Scott Kuhn, Andrea Ross, Tracy Hughes, Deputies

County Counsel; Bradley Bernstein Sands and Erin B. Bernstein for

Petitioner County of Los Angeles.

Donna R. Ziegler, County Counsel, Kathleen A. Pacheco, Raymond J.

Leung, Deputies County Counsel, for Petitioner County of Alameda.

O’Melveny & Myers, Michael G. Yoder, Amy J. Laurendeau, Charles C.

Lifland, Sabrina H. Strong, Amy R. Lucas, Jonathan P. Schneller for Real

Parties in Interest Johnson & Johnson et al.

I.

INTRODUCTION

In the lawsuit underlying these consolidated writ proceedings, the

People of the State of California, by and through the Santa Clara County

Counsel, the Orange County District Attorney, the Los Angeles County

Counsel, and the Oakland City Attorney, filed an action against defendants—

various pharmaceutical companies involved in the manufacture, marketing,

distribution, and sale of prescription opioid medications. (People v. Purdue

Pharma (Super Ct. Orange County, 2014, No. 30-2014-00725287-CU-BT-

CXC) (“Underlying Action”).)

In the operative sixth amended complaint, the People allege that the

defendants made false and misleading statements as part of a deceptive

marketing scheme designed to minimize the risks of opioid medications and

inflate their benefits. This scheme, the People allege, caused a public health

crisis in California by dramatically increasing the number of opioid

2

prescriptions, the use and abuse of opioids, and opioid-related deaths. The

operative complaint contains causes of action for violations of the False

Advertising Law (Bus. & Prof. Code, § 17500 et seq.), the Unfair Competition

Law (Bus & Prof. Code, § 17200 et seq.), and the public nuisance statutes

(Civ. Code, §§ 3479, 3480) and seeks declaratory and injunctive relief, as well

as civil penalties.

In Board of Registered Nursing v. Superior Court (2021) 59 Cal.App.5th

1011 (Board of Registered Nursing), this court recently considered the

propriety of several discovery orders in the Underlying Action that compelled

four nonparty state agencies to produce to defendants various categories of

documents related to opioids.1 (Id. at p. 1021.) Of relevance to these writ

proceedings, the Board of Registered Nursing court considered the legality of

a superior court order requiring the production of prescription records

contained in the state’s Controlled Substance Utilization Review and

Evaluation System (CURES) database. (Id. at p. 1022.) The order required

the Department of Justice to produce CURES prescription records for

individually identified patients to an outside vendor. The vendor would then

replace patient names with unique identifiers, cross-reference the records

with other datasets in the vendor’s possession, and provide the linked

deidentified datasets to the defendants. (Id. at p. 1045.)2

1 The Board of Registered Nursing court noted that the discovery was

sought on behalf of all defendants in the Underlying Case and that all

defendants appeared as real parties in the writ proceedings in this court.

(Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1024, fn. 2.)

2 The court’s order compelling production required either “(1) the

production of patient identifying data to defendants’ vendor or (2) the

production of data with patient identifying data replaced with a unique

identifier supplied by defendants’ vendor that would allow the vendor to

3

In a writ proceeding challenging the propriety of the order, after

observing that the production of identified patient data to an outside vendor

for deidentification “would . . . implicate the privacy rights of the patients”

(Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1045), the Board of

Registered Nursing court concluded that defendants “ha[d] not justified such

a sweeping production of personal and private medical data” under the law

governing nonparty discovery. (Id. at p. 1038, citing Calcor Space Facility,

Inc. v. Superior Court (1997) 53 Cal.App.4th 216, 223 (Calcor).) Accordingly,

the Board of Registered Nursing court held that the superior court abused its

discretion in ordering production of the CURES records.

The present writ proceedings pertain to another discovery dispute in

the Underlying Action. The dispute arose after several of the defendants in

the Underlying Action (“Johnson & Johnson defendants”),3 served subpoenas

on two nonparty counties, petitioners County of Los Angeles and County of

Alameda, seeking records of patients in various county programs, including

individual prescription data and individual patient records related to

substance abuse treatment.

In its petition, the County of Los Angeles describes the documents at

issue as including “detailed data for over one million dispensed medications,

along with pharmacy and prescriber identifiers, as well as over 1.7 million

associated encounters, including diagnoses, procedures, medical service,

treating provider and attending (billing) provider” (italics omitted) and

cross-reference CURES data with other data in its possession (e.g., insurance

claim data).” (Board of Registered Nursing, supra, 59 Cal.App.5th at

p. 1045.)

3 The Johnson & Johnson defendants are real parties Johnson &

Johnson, Janssen Pharmaceuticals, Inc., and Ortho-McNeil-Janssen

Pharmaceuticals, Inc.

4

“records for 5,867 individuals and over 65,000 associated encounters,

including diagnoses, procedures, and other clinical information,” pertaining

to “patients diagnosed with or treated for opioid use disorder, opioid

addiction, or overdose at LA County facilities.” In its petition, the County of

Alameda describes the documents as including “patient-level data related to

substance use treatment, pharmacy records, encounter data, and other

sensitive information.”4

After petitioners and the Johnson & Johnson defendants engaged in

various informal and formal means to attempt to resolve the dispute, the

superior court issued a discovery order granting the Johnson & Johnson

defendants’ motions to compel production of the records. As with the CURES

data at issue in Board of Registered Nursing, the court’s order directed

petitioners to provide the records on a personally “identified” basis to a

vendor that would “de-identify [the] data and make it cross-referenceable

against other de-identified data processed by [the vendor] in this case.” The

4 Similarly, in their informal response in this court, the Johnson &

Johnson defendants summarized the records at issue as follows:

“The specific records at issue here are: (1) opioid

prescription records and healthcare services records for

patients with opioid-related diagnoses from the Los Angeles

County Department of Health’s Online Real-time

Centralized Health Information Database (‘ORCHID’),

which tracks healthcare services provided by publicly

funded healthcare centers in Los Angeles County [citation];

(2) patient-level data from the Los Angeles County

Participant Reporting System (‘LACPRS’), a repository of

data used to measure substance abuse treatment and/or

recovery outcomes measures [citation]; and (3) Medi-Cal

data involving opioids for all patients treated by Alameda

County, including prescription data, claims data, or

encounter data [citation].”

5

court’s order specifies that “[o]nly fully de-identified data will be provided by

[the vendor] to defendants (or any other party in this case).”

Each petitioner filed a petition for writ of mandate in this court,

seeking vacatur of the superior court’s order compelling production of the

documents. The petitioners claim that the discovery order implicates the

state constitutional privacy rights of the individuals whose records the

superior court ordered produced, among other arguments. We consolidated

the petitions and issued an order to show cause.

In determining whether a discovery order would violate state

constitutional privacy rights, we apply the framework established in Hill v.

National Collegiate Athletic Assn. (1994) 7 Cal.4th 1 (Hill). (See Williams v.

Superior Court (2017) 3 Cal.5th 531, 552, 556 (Williams) [stating that Hill

applies to a discovery dispute that “requires a court to reconcile asserted

privacy interests with competing claims for access”].) In applying the Hill

test, “[t]he party asserting a privacy right must establish a legally protected

privacy interest, an objectively reasonable expectation of privacy in the given

circumstances, and a threatened intrusion that is serious.” (Williams, supra,

at p. 552, citing Hill, supra, at pp. 35–37.) “The party seeking information

may raise in response whatever legitimate and important countervailing

interests [the] disclosure serves,” and “[a] court must then balance these

competing considerations.” (Williams, supra, at p. 552, citing Hill, supra, at

pp. 37–40.)

As we explain in part III, post, we conclude that petitioners have

established that the superior court’s order threatens a serious intrusion into

the privacy interests of the patients whose records are at issue. In

considering whether the Johnson & Johnson defendants have “demonstrated,

under the heightened standard applicable to constitutional rights of privacy,

6

a practical necessity for discovery [of the records],” (John B. v. Superior Court

(2006) 38 Cal.4th 1177, 1201), we observe that the Johnson & Johnson

defendants seek to obtain opioid prescription data similar to the CURES data

at issue in Board of Registered Nursing, as well as substance abuse treatment

records, which threatens to cause an even more substantial invasion of

privacy rights. Yet, the Johnson & Johnson defendants fail to provide a

justification for the discovery of such records that differs in any material way

from that which this court found insufficient in Board of Registered Nursing

to justify discovery under the broad Calcor standard applicable to nonparty

discovery requests generally. (See Board of Registered Nursing, supra,

59 Cal.App.5th at p. 1039 [“ ‘Although the scope of civil discovery is broad, it

is not limitless,’ ” quoting Calcor, supra, 53 Cal.App.4th at p. 223].)

Therefore, and for reasons we explain more fully in part III, post, we conclude

that the Johnson & Johnson defendants have failed to demonstrate that their

interests in obtaining “such a vast production of medical information” (Board

of Registered Nursing, supra, at p. 1046) outweigh the significant privacy

interests that the nonparty petitioners have identified. (See Williams, supra,

3 Cal.5th at p. 556 [where “a discovery request seeks information implicating

the constitutional right of privacy,” the party seeking discovery must make a

showing of need greater than that needed for discovery requests generally].)

Accordingly, we grant petitioners’ writ petitions and direct the superior

court to vacate its order compelling production of the requested documents

and to enter a new order denying Johnson & Johnson defendants’ motions to

compel.5

5 The petitioners also contend that the superior court’s order should be

vacated because it orders disclosure of substance use disorder patient

records, in violation of federal law (42 C.F.R § 2 et seq.) and because the

superior court lacked authority to order the public entities to enter into a

7

II.

FACTUAL AND PROCEDURAL BACKGROUND

A. The operative complaint

In June 2018, the People filed the operative complaint against

defendants. According to the operative complaint, the defendants engaged in

wide ranging illegal misconduct designed to promote the use of opioids. The

People alleged that defendants targeted susceptible prescribers and

vulnerable patient populations with false and misleading statements about

opioids. Specifically, according to the People, the defendants falsely

downplayed, and failed to disclose, the known risks of long-term opioid use.

Defendants also “[g]rossly [o]verstated” the benefits of chronic opioid therapy.

The operative complaint alleges that defendants carried on this “marketing

scheme” through varied means, including the use of direct marketing of

branded opioids and the use of “seemingly independent third parties.” The

People further allege that defendants’ efforts led to a huge increase in the

number of opioid prescriptions and the use of such drugs, which has resulted

in a public health crisis that includes high rates of opioid abuse and addiction

and ancillary social costs.

The operative complaint relies on such allegations to state causes of

action for false advertising (Bus & Prof. Code, § 17500), unfair competition

(Bus & Prof. Code, § 17200), and public nuisance. (Civ. Code, §§ 3479, 3480.)

The People seek civil penalties for each act of false advertising and

unfair competition and an order requiring defendants to abate the public

nuisance. In addition, the People seek declaratory and injunctive relief.

contract with an intermediary for the purpose of deidentifying the

documents. In light of our granting the petitions for the reasons stated in the

text, we need not, and do not, address these additional arguments for

vacatur.

8

B. The underlying discovery dispute

In December 2018, the Johnson & Johnson defendants6 served

business record subpoenas on two agencies of the County of Los Angeles

seeking claims data for opioid prescriptions, healthcare services, and

substance-abuse treatment. The subpoenas sought broad categories of

information including:

“All Documents and Communications concerning or

relating to any assessment of actual or potential harm to

specific Patients or other specific individuals as a result of

any Subject Opioid or any Defendant’s Marketing,

Educational Activities, or statements about any Subject

Opioid.”

“Participant-level Claims Data showing the full Medicaid or

other Program Claims history for prescriptions and other

health care services submitted to Medicaid or any other

Program, whether reimbursed or not, for all Patients who

received a prescription for any Subject Opioid.”

The Johnson & Johnson defendants served similar subpoenas on

various County of Alameda agencies.

The County of Los Angeles identified two sets of responsive data:

(1) opioid prescription and medical encounter data from publicly funded

healthcare centers tracked by the County of Los Angeles Department of

Health Services’ Online Real-time Centralized Health Information Database

(“ORCHID”); and (2) patient-level claims data measuring substance-abuse

6 Although the December 6, 2018 subpoena contained in the exhibits to

the County of Los Angeles’s writ petition appears to have been served by

defendants other than the Johnson & Johnson defendants, the Johnson &

Johnson defendants admit in their return “that they served [County of Los

Angeles] with a subpoena on December 6, 2018.” Accordingly, we refer to the

discovery sought in this case from the County of Los Angeles as having been

sought by the Johnson & Johnson defendants.

9

treatment recovery outcomes tracked by the Los Angeles County Participant

Reporting System (“LACPRS”). The County of Alameda identified data for

patients that the county treats through its implementation of the Medi-Cal

program “including prescription data, claims data, [and] encounter data.”

After engaging in various informal discovery efforts, the Johnson &

Johnson defendants filed motions to compel the petitioners to provide the

requested data on an identified basis7 to an outside vendor, Rawlings &

Associations (Rawlings). Rawlings would in turn “de-identify” the data by

assigning unique identifiers to each record that would make the data “cross-

walkable,” with other data processed by Rawlings. The deidentified, but

cross-walkable, records would then be shared with the Johnson & Johnson

defendants.

Petitioners opposed the motions on several grounds, including that

privacy protections bar the production of identifiable patient data to a third

party. The Johnson & Johnson defendants argued in turn that a March 2019

Stipulated Qualified Protective Order for Protected Health Information

(Protective Order) previously entered in the case would sufficiently protect

any privacy interests.

C. The discovery referee’s reports and recommendations

After the parties submitted briefing and a discovery referee held

several hearings on the discovery issues presented in these writ proceedings

as well as numerous other discovery disputes, the discovery referee issued

two reports and recommendations to grant the Johnson & Johnson

defendants’ motions to compel. As to the County of Los Angeles, with respect

to the ORCHID data, the referee agreed that the Protective Order “in

7 By “on an identified basis,” we mean “containing personal information

sufficient to identify an individual person.”

10

practice, requires that the County produce its data to Rawlings so that

Rawlings can de-identify the data and make it cross-walkable.”8 With

respect to the LACPRS data, the referee rejected the County of Los Angeles’s

privacy arguments based on federal regulations governing substance abuse

treatment records, reasoning that “the focus must be on whether the

requesting party receives the data in de-identified form, not a third-party

vendor.” With respect to the County of Alameda, the referee issued a report

determining that “[County of] Alameda fails to provide a sufficient basis to

object to the production of the requested information where, as here, the

information will be produced pursuant to a stringent . . . Protective Order.”

D. Petitioners’ objections to the discovery referee’s report and

recommendations

Petitioners each filed objections to the discovery referee’s report and

recommendations. Among other arguments, the County of Los Angeles

argued that “[t]here is no basis, legal or factual, to order the reproduction of

identified patient data,” and that “[t]he Protective Order does not

contemplate, let alone require, that any entity must contract with and

produce identified heath data to a third-party vendor, and such a

requirement would violate the Protective Order as well as numerous privacy

law protections.” Specifically, the County of Los Angeles contended that “to

produce identifiable protected health information to any party or third party

would violate . . . the constitutional rights of third parties,” among other

laws.

8 The County of Los Angeles had previously produced the ORCHID data

in a deidentified format and the referee noted that the county argued that it

should not be compelled to “re-produce its ORCHID data in a manner which

would allow the datasets to be cross-referenced with other datasets.”

11

In its objection, the County of Alameda raised numerous arguments,

including those rooted in the privacy rights of the patients whose medical

data would be impacted by the production. Specifically, the County of

Alameda referred to the “privacy objections over having to produce

completely unredacted patient health information, including substance use

disorder information, to Rawlings,” that it had raised before the discovery

referee. For example, the County of Alameda referred to a supplemental

brief that it had filed opposing the Johnson & Johnson defendants’ motion to

compel that stated the following:

“[The Johnson & Johnson] Defendants have made NO

showing of why patient level data for the entirety of

Alameda County. . . are relevant. And they certainly do not

present any viable argument that the privacy interests of

these individuals are outweighed by what is, in essence, a

fishing expedition that casts a wide net for information

from a non-party.”

E. The Johnson & Johnson defendants’ responses

The Johnson & Johnson defendants filed responses to the petitioners’

objections. With respect to the County of Los Angeles’s objections, the

Johnson & Johnson defendants noted that the County had “mention[ed]—

again, without explanation—‘the constitutional rights of third parties.’ ” The

Johnson & Johnson defendants argued that the superior court had ruled,

with respect to previous discovery issues in the case, that deidentification

and the Protective Order would suffice to protect constitutional privacy rights

and that “ ‘[t]he limited invasion being permitted here is justified due to the

relevance of the discovery to Plaintiffs[’] claims.’ ” The Johnson & Johnson

defendants argued that the court should reach the same conclusion with

respect to the County of Los Angeles’s production.

12

In their opposition to the County of Alameda’s objections, the Johnson

& Johnson defendants argued that the Protective Order and “precautions

taken by the parties and third parties operating under it ensure that privacy

laws will be fully complied with while providing the parties access to claims

data critical to testing Plaintiff[s’] theory of the case.”

F. The superior court’s order granting the Johnson & Johnson defendants’

motions to compel

After a hearing, the superior court entered an order on July 6, 2020

granting the Johnson & Johnson defendants’ motions to compel. The court

ordered the County of Los Angeles “to provide to Rawlings the identified data

for the County’s previous ORCHID production to defendants, so that

Rawlings can de-identify all such data and make it cross-referenceable

against other de-identified data processed by Rawlings in this case.” The

court also ordered the County of Los Angeles to produce the LACPRS data to

Rawlings for deidentification. The court specified that “[o]nly fully de-

identified data will be provided by Rawlings to defendants (or any other party

in this case).” The court also ordered the County of Alameda to provide the

“Medi-Cal claims and prescription data,” specified in the discovery referee’s

report and recommendations on the same terms as the court specified for the

County of Los Angeles’s production.

The superior court also directed the Johnson & Johnson defendants to

modify the Protective Order to make Rawlings subject to the Protective

Order; to ensure that Rawlings expressly consented to such modification and

agreed to act in compliance with various provisions of federal law; and to

provide that all information produced by a nonparty would be subject to the

Protective Order.

13

G. Writ proceedings in this court

In August 2020, petitioners filed petitions for writ of mandate9 seeking

reversal of the superior court’s July 6 order, together with requests that this

court take judicial notice of the state agencies’ petitions for writ of mandate

in Board of Registered Nursing.

After soliciting and receiving informal responses from the Johnson &

Johnson defendants with respect to each petition, this court summarily

denied the petitions.

The Supreme Court granted petitioners’ petitions for review and

transferred the matters to this court with directions to vacate our orders

denying the petitions for writ of mandate and to issue orders directing

respondent superior court to show cause why the relief sought in the petitions

should not be granted. We acted in accordance with the Supreme Court’s

directions and consolidating the proceedings.

The Johnson & Johnson defendants filed a return by way of

answer/demurrer and a request that we take judicial notice of: (1) the June

8, 2018 operative sixth amended complaint in the Underlying Action; (2) the

Protective Order as revised pursuant to the July 6 order, and (3) the

February 26, 2020 hearing transcript of the discovery proceedings that led to

the writ proceedings in this court in Board of Registered Nursing.

9 The day after filing their initial petitions, petitioners each filed

amended petitions. For ease of reference, we refer to the amended petitions

as the petitions at issue in these proceedings. Although the writ petitions

were initially filed in Court of Appeal, Fourth District, Division Three, the

administrative presiding justice transferred the petitions to this division

pursuant to California Rules of Court, rule 10.1000(b)(1)(A).

14

Petitioners thereafter filed a reply, and both parties, pursuant to our

request, filed supplemental letter briefs concerning Board of Registered

Nursing.10

III.

DISCUSSION

Petitioners claim that the superior court’s July 6 discovery order

threatens to intrude on the state constitutional privacy rights (Cal. Const.,

art. I, § 1) of the patients whose medical information would be affected by the

order.11

10 We grant petitioners’ August 11, 2020 unopposed requests that we take

judicial notice of the state agencies’ petitions for writ of mandate in the

Board of Registered Nursing proceedings in this court. (See Evid. Code,

§§ 452, subd. (c) [permitting the taking of judicial notice of the “[o]fficial acts

of the legislative, executive, and judicial departments of the United States

and of any state of the United States”], 455, subd. (a), 459, subd. (c)

[specifying the manner by which a reviewing court may take judicial notice of

a “matter was not theretofore judicially noticed in the action”].)

We also grant the Johnson & Johnson defendants’ unopposed December

16, 2020 request that we take judicial notice of: (1) the June 8, 2018

operative sixth amended complaint in the Underlying Action; (2) the August

17, 2020 revised Protective Order, and (3) the February 26, 2020 hearing

transcript of the discovery proceedings that led to the writ proceedings in this

court in Board of Registered Nursing. (See Evid. Code, §§ 452, subd. (c), 455,

subd. (a), 459, subd. (c) [specifying the manner by which reviewing courts

may take judicial notice of judicial records].)

11 Although petitioners filed separate writ petitions in this court, they

joined in each other’s petitions and filed a consolidated reply. In addition,

petitioners’ state constitutional privacy claims are not materially distinct.

Thus, we address the state constitutional privacy claims raised in the writ

petitions jointly as a single claim.

15

A. Preliminary matters

Before considering the merits of petitioners’ claim, we address three

preliminary matters presented by their writ petitions.

First, although not specifically addressed in the briefing in these writ

proceedings, it is well established that, under appropriate circumstances, a

litigant “may assert the privacy rights of third parties.” (Tien v. Superior

Court (2006) 139 Cal.App.4th 528, 539.) One such circumstance is where the

litigant’s interests align with those of the third party and the third party’s

“rights are ‘likely to be diluted or adversely affected’ unless [the litigant] is

permitted to assert their rights on their behalf.” (Lewis v. Superior Court

(2017) 3 Cal.5th 561, 570 (Lewis) [concluding that physician had standing to

assert privacy rights of patients whose prescription records had been

accessed by state board].) For the same reasons that the Lewis court

concluded that a doctor could assert his patients’ privacy interests in their

prescription records, we conclude that the petitioners’ may assert the privacy

interests of the patients whose medical information they possess. (See ibid.

[doctor could assert privacy rights of patients because: (1) patients might

“hesitate to seek appropriate medical treatment,” if records were disclosed

and doctor shared patients’ interest in seeking appropriate medical treatment

and; (2) patients were “unable to assert their own rights because they were

never given notice that their records were accessed”].)

Second, although discovery orders are ordinarily not reviewable on an

interlocutory basis (City of Petaluma v. Superior Court (2016)

248 Cal.App.4th 1023, 1031), writ review is appropriate “[w]here, as here, an

order will effectively . . . infringe on privacy rights.” (Los Angeles Gay &

Lesbian Center v. Superior Court (2011) 194 Cal.App.4th 288, 300

(Los Angeles Gay & Lesbian Center).) In such an instance, “review on appeal

16

is deemed inadequate because reversal on appeal will not cure the disclosure

of protected information.” (Ibid.) Accordingly, because petitioners lack an

“adequate remedy at law” to vindicate the third-party privacy rights at stake

in their petitions and those third parties “will suffer an irreparable injury”

(ibid.) if a writ is not granted, we conclude that writ review is appropriate.

Finally, although petitioners did not discuss Hill or present a developed

state constitutional argument in the superior court, for the following reasons,

we exercise our discretion to reach the merits of their state constitutional

claim, notwithstanding any possible forfeiture. (See People v. Williams

(1998) 17 Cal.4th 148, 161 [“An appellate court is generally not prohibited

from reaching a question that has not been preserved for review by a party”].)

To begin with, the privacy rights at stake are those of the petitioners’

patients, and we are therefore disinclined to conclude that petitioners’ briefing

in the superior court precludes our consideration of these rights. (See Boler

v. Superior Court (1987) 201 Cal.App.3d 467, 472, fn. 1.) In Boler, the court

considered whether the defendant had forfeited his right to object on privacy

grounds to deposition questions pertaining to the defendant’s prior sexual

history with certain nonparties. The Boler court rejected this argument,

reasoning in part:

“[T]he privacy protection extends to the unknown,

unnamed female partners of Boler who have neither

executed a waiver nor are even necessarily aware their

privacy interests are endangered by the deposition

question. Indeed, where third-party privacy interests are

involved, the target of discovery has an affirmative duty to

notify the third parties of the discovery request and give

them an opportunity to appear and object. [Citations.] An

inflexible waiver rule would defeat the exercise of this duty

and infringe upon the constitutional privacy rights of

citizens not participating in this lawsuit. [¶] Given the

fundamentality of the sexual privacy issue and the

17

interests of nonparties not present to object and the fact

that the trial court reached the merits, we decline to rule

that Boler has waived his sexual privacy objections.” (Ibid.)

In addition, although petitioners did not develop a state constitutional

privacy argument in the superior court, in their oppositions to the discovery

referee’s recommendations and reports, the County of Los Angeles specifically

mentioned “the constitutional rights of third parties” and the County of

Alameda reiterated its privacy objections to having to produce unredacted

patient health information. In addition, in its briefing before the discovery

referee, the County of Alameda argued that the Johnson & Johnson

defendants had failed to demonstrate that the “privacy interests of [patients]

are outweighed by what is, in essence, a fishing expedition.” Further,

petitioners alerted the superior court to the third-party privacy interests at

stake by extensively arguing that the requested discovery sought materials

protected by federal privacy regulations governing substance abuse

treatment records.

Moreover, the Johnson & Johnson defendants do not present any

forfeiture argument in this court,12 nor do they argue that there are disputed

facts relevant to a Hill analysis. (Williams, supra, 3 Cal.5th at p. 554, fn. 7

[“Because there are no disputed material facts, we may conduct a Hill

analysis for the first time on appeal”].) Indeed, in their return, the Johnson

& Johnson defendants argue that the superior court considered the state

constitutional privacy interests of third parties, contending that the

12 In their consolidated answer to petitioners’ petitions for review of our

initial summary denials of their writ petitions in the Supreme Court, the

Johnson & Johnson defendants did argue that petitioners “never raised Hill

or constitutional privacy rights below.” (Boldface & some italics omitted.)

18

“Superior Court performed its balancing obligation under Hill.” Under these

circumstances, we conclude that it is appropriate to consider petitioners’ state

constitutional privacy claim on the merits.13

B. Standard of review

Ordinarily, “[w]e review the trial court's grant or denial of a motion to

compel discovery for an abuse of discretion. [Citation.] . . . A circumspect

approach to appellate review of discovery orders ensures an appropriate

degree of trial court latitude in the exercise of that discretion.” (Williams,

supra, 3 Cal.5th at p. 540.) However, the Williams court cautioned that such

deference comes with a significant “caveat[ ].” (Ibid.)14 “ ‘ “[T]he scope of

discretion always resides in the particular law being applied, i.e., in the ‘legal

principles governing the subject of [the] action . . . .’ Action that transgresses

the confines of the applicable principles of law is outside the scope of

13 Notwithstanding our consideration of the merits of petitioners’ state

constitutional privacy claim under Hill, we find petitioners’ argument that

“the [superior] court erred in neglecting to apply the Hill test,” (first italics

added) and petitioners’ chiding of the Johnson & Johnson defendants’

“attempts to apply the Hill factors post hoc,” (second italics added) to be

misleading because petitioners failed to cite Hill or present an argument

based on the Hill framework in the superior court.

14 The Williams court also referred to a second “caveat[ ]” namely “the

prodiscovery policies of the statutory scheme.” (Williams, supra, 3 Cal.5th at

p. 540.) Without disregarding the statutory “preference for discovery” (ibid.),

we observe that the discovery at issue in this writ proceeding is sought from

nonparty petitioners, while in Williams, the discovery was sought from the

defendant. (See id. at p. 538.) As this court observed in Board of Registered

Nursing, the Supreme Court has cautioned that “[t]he permissible scope of

discovery in general is not as broad with respect to nonparties as it is with

respect to parties.” (Catholic Mutual Relief Society v. Superior Court (2007)

42 Cal.4th 358, 366, fn. 6 (Catholic Mutual Relief Society); see Board of

Registered Nursing, supra, 59 Cal.App.5th at p. 1039, citing Catholic Mutual

Relief Society, supra, at p. 366, fn. 6.)

19

discretion and we call such action an ‘abuse’ of discretion.” ’ [Citation.] An

order that implicitly or explicitly rests on an erroneous reading of the law

necessarily is an abuse of discretion. [Citation.]” (Ibid.)

The Williams court also noted that the application of Hill to requested

discovery constitutes one such principle of law that may be applied by a

reviewing court “as a matter of law,” where there are no disputed material

facts. (Williams, supra, 3 Cal.5th at p. 554, fn. 7.) Thus, because a

determination of whether the superior court’s discovery order implicates

constitutional privacy rights under Hill rests upon undisputed facts (see pt.

III.A, ante), we review this question of constitutional law de novo. (See, e.g.,

Alfaro v. Superior Court (2020) 58 Cal.App.5th 371, 384 [“Although in general

discovery rulings are reviewed for abuse of discretion, where, as here, ‘ “ ‘the

propriety of a discovery order turns on . . . a question of law,’ we ‘determine

the issue de novo’ ” ’ ”]; City of Los Angeles v. Superior Court (2017)

9 Cal.App.5th 272, 282 [when “ ‘the propriety of a discovery order turns on . .

. a question of law,’ we ‘determine the issue de novo’ ”].)

C. Governing law

1. Relevant principles of the law governing discovery from nonparties

In Board of Registered Nursing, supra, this court recently provided an

overview of the law governing discovery from nonparties:

“ ‘Although the scope of civil discovery is broad, it is not

limitless.’ (Calcor[, supra,] 53 Cal.App.4th [at p.] 223 . . . .)

In general, ‘any party may obtain discovery regarding any

matter, not privileged, that is relevant to the subject

matter involved in the pending action or to the

determination of any motion made in that action, if the

matter either is itself admissible in evidence or appears

reasonably calculated to lead to the discovery of admissible

evidence.’ (Code Civ. Proc., § 2017.010.) To meet this

standard, a party seeking to compel production of records

from a nonparty must articulate specific facts justifying the

20

discovery sought; it may not rely on mere generalities.

(Calcor, at p. 224.) In assessing the party’s proffered

justification, courts must keep in mind the more limited

scope of discovery available from nonparties. (See Catholic

Mutual Relief Society[, supra, at p. 366, fn. 6.])” (Board of

Registered Nursing, supra, 59 Cal.App.5th at p. 1039.)

“Even if information is otherwise discoverable, it may be protected by a

constitutional . . . privilege . . . [including] . . . the right to privacy . . . .”

(Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1039; Williams,

supra, 3 Cal.5th at p. 554 [stating that a trial court’s order denying a request

for discovery may be “affirmed on privacy grounds if . . . such concerns

supported denial of discovery”]; see Weil & Brown, Cal. Practice Guide: Civil

Procedure Before Trial (The Rutter Group 2020) ¶ 8:293 [“Even highly

relevant, nonprivileged information may be shielded from discovery if its

disclosure would impair a person’s ‘inalienable right of privacy’ provided by

Calif. Const. Art. 1, § 1”].)

2. The right to privacy under the California Constitution

a. The state constitutional amendment adding a right of privacy

“In November 1972, the voters of California specifically amended

article I, section 1 of our state Constitution to include among the various

‘inalienable’ rights of ‘all people’ the right of ‘privacy.’ ” (White v. Davis

(1975) 13 Cal.3d 757, 773.)15 Among the “principal ‘mischiefs’ ” that the

constitutional amendment addressed was “the improper use of information

properly obtained for a specific purpose, for example, the use of it for another

purpose or the disclosure of it to some third party . . . .” (Id. at p. 775; see

15 “All people are by nature free and independent and have inalienable

rights. Among these are enjoying and defending life and liberty, acquiring,

possessing, and protecting property, and pursuing and obtaining safety,

happiness, and privacy.” (Cal. Const., art I, § 1, italics added.)

21

Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1039 [“Protection of

informational privacy is the provision’s central concern”]; see also Grafilo v.

Wolfsohn (2019) 33 Cal.App.5th 1024, 1033–1034 (Grafilo) [“[t]he provision’s

‘central concern’ is the ‘[p]rotection of informational privacy’ [citation]; that

is, the interest ‘in precluding the dissemination or misuse of sensitive and

confidential information’ ”].)

b. The Hill framework

In Hill, the California Supreme Court “articulated a two-part inquiry

for determining whether the right to privacy under article I, section 1 has

been violated.” (Lewis, supra, 3 Cal.5th at p. 571, citing Hill, supra, 7 Cal.4th

at p. 26.) “First, the complaining party must meet three ‘ “threshold

elements” . . . utilized to screen out claims that do not involve a significant

intrusion on a privacy interest protected by the state constitutional privacy

provision.’ [Citation.] The party must demonstrate ‘(1) a legally protected

privacy interest; (2) a reasonable expectation of privacy in the circumstances;

and (3) conduct by defendant constituting a serious invasion of privacy.’

[Citation.] This initial inquiry is necessary to ‘permit courts to weed out

claims that involve so insignificant or de minimis an intrusion on a

constitutionally protected privacy interest as not even to require an

explanation or justification by the defendant.’ [Citation.]” (Lewis, supra, at

p. 571.)

Second, if a claimant satisfies the threshold inquiry, “ ‘[a] defendant

may prevail in a state constitutional privacy case by negating any of the

three elements just discussed or by pleading and proving, as an affirmative

defense, that the invasion of privacy is justified because it substantively

22

furthers one or more countervailing interests.’ [Citation.]” (Lewis, supra,

3 Cal.5th at p. 572, citing Hill, supra, 7 Cal.4th at p. 40.)16

As alluded to in our discussion of the applicable standard of review (see

pt. III.B, ante), “The Hill test, conceived in the context of a pleaded cause of

action for invasion of privacy, has been applied more broadly, including to

circumstances where litigation requires a court to reconcile asserted privacy

interests with competing claims for access to third party contact

information.” (Williams, supra, 3 Cal.5th at p. 552.) A reviewing court “may

conduct a Hill analysis for the first time,” in a case in which “there are no

disputed material facts.” (Id. at p. 554, fn. 7.)

D. Application

We apply the Hill framework in considering whether the superior

court’s order implicates state constitutional privacy rights (Cal. Const., art. I,

§ 1) of the patients whose medical information would be affected by the order.

1. Petitioners have established the threshold elements of a Hill claim

We first consider whether petitioners have carried their threshold

burden of demonstrating that the superior court’s discovery order threatens a

serious invasion of privacy.

16 If a defendant makes such a showing, “ ‘[t]he [claimant], in turn, may

rebut a defendant’s assertion of countervailing interests by showing there are

feasible and effective alternatives to defendant’s conduct which have a lesser

impact on privacy interests.’ [Citation.]” (Lewis, supra, 3 Cal.5th at p. 572,

citing Hill, supra, 7 Cal.4th at p. 40.) We need not discuss the rebuttal prong

further in this case, because, for the reasons discussed in part III.D, post, we

conclude that the Johnson & Johnson defendants have not identified

countervailing interests that outweigh the serious invasion of privacy

interests at issue in this case.

23

a. Legally protected privacy interest

In considering the first of the three factors comprising the threshold

inquiry, it is clear that patients “have a bona fide interest in the

confidentiality of their [medical] information.” (Williams, supra, 3 Cal.5th at

p. 554.) “[P]atients have a right to privacy with respect to information

contained in . . . medical records. Indeed, that right is well[-]settled.”

(Grafilo, supra, 33 Cal.App.5th at p. 1034, citing numerous cases].) It is a

right that is protected by case law as well as state and federal statutes and

regulations. (See, e.g., Civ. Code, § 56 et seq. [“This part may be cited as the

Confidentiality of Medical Information Act”]; 42 U.S.C. § 1320d et seq. Health

Insurance Portability and Accountability Act (HIPAA) of 1996 [providing that

health care providers generally may not disclose medical information without

a patient’s authorization or court order]; Citizens for Health v. Leavitt,

428 F.3d 167, 172 (3d Cir. 2005) [describing administrative privacy

regulations promulgated pursuant to HIPAA].)

“Medical patients’ privacy interest, our Supreme Court has observed,

derives from their expectation of privacy in their physician’s files, which ‘may

include descriptions of symptoms, family history, diagnoses, test results, and

other intimate details concerning treatment.’ ” (Grafilo, supra,

33 Cal.App.5th at p. 1034, citing Lewis, supra, 3 Cal.5th at p. 575.) “ ‘[T]he

matters disclosed to the physician arise in most sensitive areas often difficult

to reveal even to the doctor. Their unauthorized disclosure can provoke more

than just simple humiliation in a fragile personality. . . . The individual’s

right to privacy encompasses not only the state of his mind, but also his

viscera, detailed complaints of physical ills, and their emotional overtones.

The state of a person’s gastro-intestinal tract is as much entitled to privacy

from unauthorized public or bureaucratic snooping as is that person’s bank

24

account, the contents of his library or his membership in the NAACP.’ ”

(Grafilo, supra, at p. 1034, quoting Board of Medical Quality Assurance v.

Gherardini (1979) 93 Cal.App.3d 669, 679.) As one court explained in

discussing the “examination of medical records within the purview of the

privacy amendment”:

“The information that may be recorded in a doctor’s files is

broad[-]ranging. The chronology of ailments and treatment

is potentially sensitive. Patients may disclose highly

personal details of lifestyle and information concerning

sources of stress and anxiety. These are matters of great

sensitivity going to the core of the concerns for the privacy

of information about an individual. The intrusion upon

personal privacy when a state agency examines such

records is substantial.” (Wood v. Superior Court (1985)

166 Cal.App.3d 1138, 1147 (Wood).)

Medical records pertaining to substance abuse treatment, such as those

at issue in this case, are an example of such “highly personal details” (Wood,

supra, 166 Cal.App.3d at p. 1147) that are entitled to even greater privacy

protections under both state and federal law. (See Health & Saf.,

§ 11845.5;17 42 U.S.C. § 290dd-2; 42 C.F.R. § 2.1 et seq.) One court

17 Health & Safety Code section 11845.5 provides:

“(a) The identity and records of the identity, diagnosis,

prognosis, or treatment of any patient, which identity and

records are maintained in connection with the performance

of any alcohol and other drug abuse treatment or

prevention effort or function conducted, regulated, or

directly or indirectly assisted by the department shall,

except as provided in subdivision (c), be confidential and be

disclosed only for the purposes and under the

circumstances expressly authorized under subdivision (b).

“(b) The content of any records referred to in subdivision (a)

may be disclosed in accordance with the prior written

consent of the client with respect to whom the record is

25

maintained, but only to the extent, under the

circumstances, and for the purposes as clearly stated in the

release of information signed by the client.

“(c) Whether or not the client, with respect to whom any

given record referred to in subdivision (a) is maintained,

gives his or her written consent, the content of the record

may be disclosed as follows:

“(1) In communications between qualified professional

persons employed by the treatment or prevention program

in the provision of service.

“(2) To qualified medical persons not employed by the

treatment program to the extent necessary to meet a bona

fide medical emergency.

“(3) To qualified personnel for the purpose of conducting

scientific research, management audits, financial and

compliance audits, or program evaluation, but the

personnel may not identify, directly or indirectly, any

individual client in any report of the research, audit, or

evaluation, or otherwise disclose patient identities in any

manner. For purposes of this paragraph, the term

‘qualified personnel’ means persons whose training and

experience are appropriate to the nature and level of work

in which they are engaged, and who, when working as part

of an organization, are performing that work with adequate

administrative safeguards against unauthorized

disclosures.

“(4) If the recipient of services is a minor, ward, or

conservatee, and his or her parent, guardian, or

conservator designates, in writing, persons to whom his or

her identity in records or information may be disclosed,

except that nothing in this section shall be construed to

compel a physician and surgeon, psychologist, social

worker, nurse, attorney, or other professional person to

reveal information that has been given to him or her in

confidence by members of the client’s family.

“(5) If authorized by a court of competent jurisdiction

granted after application showing probable cause therefor,

26

summarized federal law pertaining to substance abuse treatment records as

follows:

“ ‘Federal law restricts the disclosure of information

obtained “in connection with the performance of any

program or activity relating to substance abuse education,

prevention, training, treatment, rehabilitation or research”

conducted by the United States or with federal money.’

[Citations.] The purpose of such restrictions is ‘to protect

“the patient, the physician-patient relationship, and the

treatment programs.” ’ [Citations.] ‘It is not only the

privacy rights of individual patients that are at stake here,

but also the continued effectiveness and viability of

important substance abuse treatment programs.’

[Citations]; see also Whyte v. Connecticut Mut. Life Ins.

Co., 818 F.2d 1005, 1010 (1st Cir. 1987) (‘[A]bsolute

confidentiality is an indispensable prerequisite to

successful [substance abuse] research . . . [and]

treatment.’). ‘Without guarantees of confidentiality, many

individuals with [substance abuse] problems would be

reluctant to participate fully in [substance abuse]

programs.’ [Citations.]” (United States ex rel. Gelfand v.

Special Care Hosp. Mgmt. Corp. (E.D.N.Y., June 10, 2010,

No. CV 02-6079 (LDW) (ETB) 2010 U.S.Dist. Lexis 57456,

*8–*9.)

With respect to the subset of records that may be said to constitute

“prescription records,”18 patients “retain a reasonable expectation of privacy”

in such records. (Lewis, supra, 3 Cal.5th at p. 575.) While we acknowledge

that patients’ privacy interest in prescription records is “less robust than the

as provided in subdivision (c) of Section 1524 of the Penal

Code.”

18 Such records include the data on “dispensed medications, along with

pharmacy and prescriber identifiers,” referred to in the County of Los

Angeles’s writ petition, and the “pharmacy records,” referred to in the County

of Alameda’s writ petition. (See generally pts. I, II.B, ante.)

27

privacy interest associated with medical records” (ibid.; see also ibid.

[“medical records contain far more sensitive information than do prescription

records”]), patients nevertheless maintain a significant privacy interest in

such records, particularly those for opioids, given the stigma associated with

substance abuse disorders.

b. Reasonable expectation of privacy

We also think it clear that patients have “a reasonable expectation of

privacy under the [particular] circumstances.” (Hill, supra, 7 Cal.4th at

p. 50.) To begin with, patients could reasonably rely on the statutory and

case law described in part III.D.1.a, ante, in expecting that their medical

information would not be used to facilitate the construction of a database for

litigation purposes.19

Further, the patients whose records are being sought have not taken

any litigation position that could possibly constitute a waiver of their privacy

rights. (See Britt v. Superior Court (1978) 20 Cal.3d 844, 864 [“while

[plaintiffs] may not withhold information which relates to any physical or

mental condition which they have put in issue by bringing this lawsuit, they

are entitled to retain the confidentiality of all unrelated medical . . .

treatment they may have undergone in the past” (fn. omitted)].) Nor have

such patients performed some other act that might indicate a willingness to

have their records disclosed. (Compare with Pioneer Electronics (USA), Inc.

v. Superior Court (2007) (Pioneer Electronics (USA), Inc.) 40 Cal.4th 360, 363,

372 [in consumer class action against the seller of allegedly defective

products in which plaintiff sought personal identifying information of

19 With respect to the substance abuse treatment records at issue in this

case, patients could have additionally reasonably relied on federally

mandated notices stating that, “federal law and regulations protect the

confidentiality of substance use disorder patient records.” (42 C.F.R. § 2.22.)

28

customers who had filed complaints with seller, concluding that complainants

had a reduced expectation of privacy because “complainants might

reasonably expect, and even hope, that their names and addresses would be

given to any such class action plaintiff”].)

In particular, the patients whose records were ordered disclosed are not

seeking to have their interests furthered by facilitating the payment of

insurance payments to their providers. Thus, we are unpersuaded by the

Johnson & Johnson defendants’ argument that such patients’ privacy rights

would not be invaded by the ordered production because the Confidentiality

of Medical Information Act permits patients’ medical information to be

“disclosed to a person or entity that provides billing, claims management,

medical data processing, or other administrative services for providers of

health care or health care service plans . . . .” (Civ. Code, § 56.10(c)(3).)

Nor can it be said that the patients’ reasonable expectation of privacy

was reduced because the Johnson & Johnson defendants are seeking to use

the requested discovery to further patients’ interests generally. (Compare

with Williams, supra, 3 Cal.5th at p. 554 [in considering whether plaintiff

employee was entitled to disclosure of contact information of defendant

employer’s other employees, stating “we doubt . . . fellow employees would

expect that information to be withheld from a plaintiff seeking to prove labor

law violations committed against them and to recover civil penalties on their

behalf,” citing numerous cases].)

Finally, we are not aware of, and the Johnson & Johnson defendants

have not cited, any historical practice, social norm, cultural practice or

physical setting that would reduce such patients’ expectations of privacy in

the present context. (See County of Los Angeles v. Los Angeles County

Employee Relations Com. (2013) 56 Cal.4th 905, 927 (County of Los Angeles)

29

[“ ‘customs, practices, and physical settings surrounding particular activities

may create or inhibit reasonable expectations of privacy’ ”]; compare with

Lewis, supra, 3 Cal.5th at pp. 568–569 [noting Court of Appeal’s conclusion

that release of CURES prescription data to Medical Board for investigative

purposes was supported by the fact that “ ‘well-known and long-established

regulatory history significantly diminishes any reasonable expectation of

privacy against the release of controlled substances prescription records to

state, local, or federal agencies for purposes of criminal, civil, or disciplinary

investigations’ ”].)

c. Serious invasion of privacy

In determining whether petitioners have established “ ‘a serious

invasion of privacy’ ” (Lewis, supra, 3 Cal.5th at p. 571), we must ask whether

the ordered disclosure is “ ‘sufficiently serious in [its] nature, scope, and

actual or potential impact to constitute an egregious breach of the social

norms underlying the privacy right.’ ” (County of Los Angeles, supra,

56 Cal.4th at p. 929, quoting Hill, supra, 7 Cal.4th at p. 37; see also County of

Los Angeles, supra, at p. 929 [“The disclosure contemplated in this case was

more than trivial. It rose to the level of a “ ‘serious’ ” invasion of privacy

under Hill”].)20

As discussed in part I, ante, as with the CURES prescription record

data at issue in Board of Registered Nursing, the court’s order directed

petitioners to provide the records on a personally identified basis to Rawlings

so that Rawlings could deidentify the data and make it cross-referenceable

against other deidentified data in the case. In Board of Registered Nursing,

20 The County of Los Angeles court considered whether the County, as an

employer, was required to provide a union with the home addresses and

telephone numbers of all represented employees, including those who had not

joined the union. (County of Los Angeles, supra, 56 Cal.4th at p. 912.)

30

this court stated that such disclosure “implicate[s] the privacy rights of the

patients.” (Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1045.)

For the reasons that follow, we reach a similar conclusion with respect to the

prescription records and substance abuse treatment records at issue in these

writ proceedings.

In considering the first of the Hill factors—the nature of the

disclosure—as discussed above, the order pertains, in part, to medical

records, “which may contain ‘matters of great sensitivity going to the core of

the concerns for the privacy of information about an individual.’ ” (Grafilo v.

Soorani (2019) 41 Cal.App.5th 497, 507.) Further, the nature of the medical

records at issue in this case—treatment records for a stigmatized condition—

only heightens the need for “robust protection.” (Ibid. [“The privacy interest

in psychiatric records is particularly strong and, in some respects, entitled to

more robust protection than other types of medical records”]; cf. Los Angeles

Gay & Lesbian Center, supra, 194 Cal.App.4th at p. 308 [“unnamed plaintiffs

have a reasonable expectation in the privacy of their medical records at the

Center given the extremely sensitive nature of the information contained in

them (sexually transmitted disease, possible HIV status, and sexual

orientation)”]; compare with Pioneer Electronics (USA), Inc., supra,

40 Cal.4th at p. 372 [“the proposed disclosure was not ‘particularly sensitive,’

as it involved disclosing neither one’s personal medical history [n]or current

medical condition”].) Moreover, patients were not notified of the ordered

disclosure, and while petitioners have asserted the rights of such patients, no

provision was made for a representative or multiple representatives of the

31

patients21 to participate in the discovery proceedings in the superior court.

(See Valley Bank of Nevada v. Superior Court (1975) 15 Cal.3d 652, 657 [“The

protection of [nonparty’s privacy right] should not be left entirely to the

election of third persons who may have their own personal reasons for

permitting or resisting disclosure of confidential information received from

others”].) Further, it is also almost certain that many such patients would

have strongly objected to the superior court’s disclosure order and would have

desired to participate in the proceedings to protect against disclosure. (Cf.

Sander v. Superior Court (2018) 26 Cal.App.5th 651, 655–657 (Sander) [in

case involving whether State Bar was required to disclose “individually

unidentifiable records,” (id. at p. 655, italics added) pertaining to bar

applicants’ “race or ethnicity, law school, transfer status, year of law school

graduation, law school and undergraduate GPA, LSAT scores, and

performance on the bar examination,” (ibid.) “more than a dozen individuals,”

and “two nonprofit professional associations of African American lawyers,”

intervened on the side of the State Bar, in order “ ‘to protect privacy and

reputational interests that are at the heart of the litigation between

Petitioners and the State Bar,’ ” (id. at pp. 656–657)].)

In sum, the nature of the disclosure—the production of patients’ opioid

prescription treatment history and/or substance abuse treatment records,

without notice to the patients—is consistent with a serious invasion of

privacy interests.

The scope of the disclosure ordered is also extremely broad, whether

considered as applied to an individual patient or with respect to the number

21 It is not difficult to imagine that there may be many different privacy

interests that patients might wish to assert, given the number of patient

records implicated by the superior court’s order.

32

of records implicated by the order. As to individual patients, the documents

to be produced include “encounter data” containing “diagnoses, procedures,

and other clinical information.” (See pt. I, ante.) As to the number of patient

records implicated by the order, the superior court ordered petitioners to

disclose all of the relevant patient records. (Compare with Snibbe v. Superior

Court (2014) 224 Cal.App.4th 184, 188–189 (Snibbe) [real party sought to

“discover all postoperative orders signed by petitioner between June 2010

and June 2011 and by [petitioner’s assistant] between June 2009 and June

2011,” but trial court “limited the scope of discovery to 160 postoperative

orders including provisions for the administration of opioids”].) As a result,

the number of patient records implicated by the court’s order is staggering.

For example, the County of Los Angeles states in their petition that the

records include “over 1.7 million associated encounters.” (Italics altered.)

The Johnson & Johnson defendants do not dispute this number or argue that

the order does not require—like the production at issue in Board of

Registered Nursing—a “vast production of medical information from the

nonparties here.” (Board of Registered Nursing, supra, 59 Cal.App.5th at

p. 1011.) Thus, the scope of the disclosure at issue also supports the

conclusion that the superior court’s order threatens a serious invasion of

privacy interests.

With respect to the “actual or potential impact,” (Hill, supra, 7 Cal.4th

at p. 37, italics added) of the ordered production on privacy rights, we

acknowledge that the trial court’s discovery order does not contemplate

public disclosure of the records, or even identified disclosure to the Johnson &

Johnson defendants. However, as the Supreme Court cautioned in a case

involving the disclosure of prescription records, constitutional privacy

concerns are not eliminated by the existence of protections against public

33

disclosure. (See Lewis, supra, 3 Cal.5th at p. 577 [“adequate protections

against public disclosure do not obviate constitutional concerns as privacy

interests are still implicated when the government accesses personal

information without disseminating it”]; accord Board of Registered Nursing,

supra, 59 Cal.App.5th at p. 1045 [“production of patient identifying

information” to defendants’ vendor for deidentification “would . . . implicate

the privacy rights of the patients” (citing Lewis)].)

Indeed, under the circumstances of this case, for the following reasons,

we conclude that the “actual or potential,” (Hill, supra, 7 Cal.4th at p. 37)

impact on patient privacy rights is substantial. With respect to “actual”

impact (ibid.), as petitioners remind us throughout their briefing, the

superior court’s order requires the production of fully identified data to

Rawlings. Thus, it cannot be disputed that the superior court’s order will

have some actual impact on patients’ privacy rights in that the court ordered

the production of their highly sensitive medical records and prescription data

on a fully personally identified basis to an outside entity without the notice or

consent of the patients.

This fact distinguishes this case from Snibbe, supra, 224 Cal.App.4th

190 and the case law on which Snibbe relied. In Snibbe, a patient died after

receiving pain medication after surgery. (Id. at p. 187.) The deceased

patient’s family members sued the petitioner surgeon for wrongful death.

(Ibid.) The family members sought to discover postoperative orders involving

other patients of the surgeon in an attempt to show that the surgeon had a

practice of permitting his physician’s assistant “ ‘to rely on boilerplate drug

orders for the administration of opioid pain medication.’ ” (Id. at p. 190.) The

family members’ “requests allowed for the redaction of patients’ names and

personal identifying information.” (Id. at p. 188.) After the surgeon objected

34

to the discovery on various grounds, the trial court granted the family

members’ motion to compel in part, limiting, as mentioned above, the scope of

discovery to 160 postoperative orders including provisions for the

administration of opioids. (Id. at p. 189.) The surgeon petitioned for a writ of

mandate to compel the trial court to vacate the discovery order for various

reasons, including that the order violated his patients’ privacy rights. (Id. at

p. 187.)

The Snibbe court recognized the privacy rights at stake,

notwithstanding the redacted nature of the records:

“As it stands, the discovery order is too broad. Based on

[the family members’] limited showing and the trial court’s

finding of relevance only as to the opioid provisions of

postoperative orders, allowing discovery of the orders in

their entirety is unreasonable. It is all the more so because

production of entire orders may raise legitimate concerns

about the scope of intrusion into patient privacy

rights . . . . ” (Snibbe, supra, 224 Cal.App.4th at p. 190.)

However, the Snibbe court concluded that patients lacked a privacy

interest in the “pain management provisions of otherwise redacted

postoperative orders.” (Snibbe, supra, 224 Cal.App.4th at pp. 191; see id. at

pp. 194–195.) The Snibbe court reasoned in part:

“[P]atients’ privacy rights are not infringed if ‘neither

disclosure of the patients’ identities nor disclosure of

identifying medical information was requested.’ (Board of

Medical Quality Assurance v. Hazel Hawkins Memorial

Hospital (1982) 135 Cal.App.3d 561, 565 [request for

unnamed charts of four patients did not infringe on

patients’ privacy rights] [(Board of Medical Quality

Assurance)]; see Kizer v. Sulnick (1988) 202 Cal.App.3d

431, 439 [(Kizer)] [privacy rights require no more than

deletion of named medical records in health study or ‘if

feasible, the deletion of information which individually

identifies the participants’].) The limited production of

35

redacted postoperative orders cannot be said to infringe on

patients’ privacy rights any more than the production of

unnamed patients’ charts.” (Id. at pp. 194–195.)22

The productions mandated by the courts in Snibbe and Board of

Medical Quality Assurance pertained to records that did not contain

personally identifying information. (See Snibbe, supra, 224 Cal.App.4th at

p. 191; Board of Medical Quality Assurance, supra, 135 Cal.App.3d at p. 566.)

In Kizer, supra, 202 Cal.App.3d at pp. 438–442, the court stated that “ ‘the

record does not disclose whether the study[23] refers to individually

22 Neither petitioners nor the Johnson & Johnson defendants cited

Snibbe, Board of Medical Quality Assurance, or Kizer in their briefing.

Further, while the Johnson & Johnson defendants assert in their

supplemental letter brief that there is a line of “unbroken case law[,] holding

that production of anonymized data for purposes of litigation does not violate

the right to privacy,” (italics added) they do not cite to any such cases in their

supplemental letter brief.

In their return, the Johnson & Johnson defendants cite Padron v.

Watchtower Bible & Tract Society of New York, Inc. (2017) 16 Cal.App.5th

1246, in which this court concluded that the third-party privacy rights at

issue in that case were adequately protected by the production of documents

in which “personal identifying information” was redacted (id. at p. 1270) and

Poway Unified School Dist. v. Superior Court (1998) 62 Cal.App.4th 1496 in

which this court concluded that “privacy concerns” (id. at p. 1506) related to

the disclosure of a minor’s tort claim form to a newspaper could be

“address[ed],” by “redacting released materials.” (Ibid.) We disagree that

these few fact-specific cases stand for the broad proposition that individuals

never maintain a privacy interest in anonymized data under California law.

(See fn. 25, post, and accompanying text.) However, as discussed in the text,

even assuming that patients do not maintain a privacy interest in

anonymized medical data, the discovery order at issue in these proceedings

mandates the production of identified data to Rawlings, and thus is not

governed by Snibbe or cases mandating the production of anonymized data.

23 Kizer involved a government agency’s request to obtain a “medical

study of the health effects on persons living near [a waste] facility,” which

36

identifiable medical records,’ ” but “[i]f such records are part of the study, the

right to privacy would justify, at most, either the deletion of any named

medical records upon the remainder of the health study being produced or, if

feasible, the deletion of information which individually identifies the

participants.”24 In contrast, in this case, the superior court’s order expressly

mandates that petitioners “provide to Rawlings the identified data.” More

generally, Snibbe, Board of Medical Quality Assurance, and Kizer do not

address whether the production of vast amounts of personally identifiable

medical data to a third-party vendor for deidentification purposes implicates

the privacy rights of the patients whose records are to be produced.

We assume, without deciding, that the Snibbe court and the cases on

which it relied were correct in concluding that patients have no privacy

interest in data that does not contain personally identifiable information.

(See also Sander v. State Bar of California (2013) 58 Cal.4th 300, 311 [stating

“If the applicant cannot be identified, disclosure of information does not

had been commissioned by a law firm representing plaintiffs in a civil action

against the facility. (Kizer, supra, 202 Cal.App.3d at p. 435.)

24 Kizer, supra, 202 Cal.App.3d at p. 439 was decided before Hill and thus

did not apply the Hill framework. However, to the extent that Kizer may be

read as stating that the study should be produced with personally identifiable

medical records to the extent that it was infeasible to delete such

information, we understand the case as being premised on the conclusion

that the invasion of privacy implicated by such disclosure would be

outweighed by the need for a government agency to “investigate . . . possible

health hazards posed by [a] waste facility.” (Kizer, supra, at p. 441.) The

Kizer court did not state that the production of identified medical records

would not constitute a serious invasion of privacy rights.

37

impair his or her privacy interests”].)25 We also observe that the Snibbe line

of cases, as well as Sander v. State Bar of California, supra, 58 Cal.4th 300,

were all decided before Lewis, and thus, those courts did not consider the

Lewis court’s observation that privacy concerns are not necessarily

eliminated with “adequate protections against public disclosure.” (Lewis,

supra, 3 Cal.5th at p. 577; see also id. at p. 581 (conc. opn. of Liu, J.) [“The

electorate was concerned about more than public disclosure when it passed

the privacy initiative in 1972, which amended the Constitution. The voters

were concerned that their privacy was violated whenever their personal

information was used or accessed without reason”].)

Irrespective of whether patients maintain privacy rights in their

deidentified data, the superior court’s order mandates the production of

“identified data” to Rawlings. (Italics added.) As to that data, the patients

whose records are at issue clearly maintain privacy rights. (See pt. III.D.1,

ante.) Moreover, petitioners’ briefing identifies at least three “potential

impact[s]” (Hill, supra, 7 Cal.4th at p. 37) related to such rights that are of

25 Whether an individual may have a privacy interest in information

pertaining to that individual even where that data is not linked to the

individual is an important legal question on which commentators have

expressed diverse views, given the many contexts in which the issue arises.

(Compare, e.g., Dunkel, Medical Privacy Rights in Anonymous Data:

Discussion of Rights in the United Kingdom and the United States in Light of

the Source Informatics Cases (2001) 23 Loyola L.A. Internat. & Comparative

L.Rev. 41, 41 [“a patient’s right to privacy is violated when personal medical

information is revealed to an unauthorized third party . . . this should hold

true even if such information is rendered anonymous by the removal of all

data relating to the patient’s identity” (fn. omitted)] with Charkow, The

Control over the De-Identification of Data (2003) 21 Cardozo Arts & Ent. L.J.

195, 197 [“the informational privacy interest for a data subject should extend

only to the use and sharing of personally identifiable information with

unauthorized persons” (fn. omitted)].)

38

significance. First, there is the potential for a data breach, whether

inadvertent or malicious, that might reveal identified patient data.26 Even

assuming that this risk is small, given the extremely sensitive nature of the

data at issue in this case, it is a risk that must be considered in determining

whether petitioners have demonstrated a “potential impact” on privacy

rights. (Ibid.)

Second, petitioners argue that “mass disclosure to an out-of-state data

miner would surely discourage meaningful treatment and impair trust

between [p]etitioners and their current, former, and future patients.” We

agree that there is, at a minimum, a potential that some persons might be

discouraged from seeking or continuing with treatment if they were to

become aware of the discovery order in this case, given the highly sensitive

nature of the data.27

Finally, and as emphasized by petitioners in reply,28 there maintains

the potential of “re-identification,” or the possibility that someone could “ ‘use

reasonable effort to match the person’s identity to details in the released

dataset sufficient to know enough information about the person to identify

him or her as a specific person.’ ” (Sander, supra, 26 Cal.App.5th at p. 658

26 The County of Los Angeles argued in its writ petition, “And if the

database that Defendants create is ordered to be produced in other cases,

unforeseen breaches are not out of the question.”

27 That potential was lessened by the protections fashioned by the

superior court to attempt to prevent public disclosure of identifiable patient

data.

28 The County of Los Angeles did reference this issue in its writ petition,

arguing, “One potential misuse of the database that Defendants seek to

create is the real possibility that it will include enough data points to allow

re-identification of the patients that Rawlings has purported to anonymize.”

39

[quoting a data privacy expert].) While the superior court’s discovery order

mandates that Rawlings “de-identify” the data, the possibility that

deidentified data may be reidentified when such data is made cross-

referenceable with other data sets is well documented. (See, e.g., id. at p. 659

[summarizing expert testimony to the effect that “[d]ata analytic companies

that deal in data compilations and derivations to link disparate datasets are

also becoming increasingly able to re-identify data historically regarded as

anonymous”]; Brasher, Addressing the Failure of Anonymization: Guidance

from the European Union’s General Data Protection Regulation (2018) 2018

Colum. Bus. L.Rev. 209, 211 [“In practice . . . anonymization fails to

permanently obstruct the identities of data subjects due to the potential for

deanonymization—the linking of anonymized data to ‘auxiliary’ information

to re-identify data subjects”]; Ohm, Broken Promises of Privacy: Responding

to the Surprising Failure of Anonymization (2010) 57 UCLA L.Rev. 1701,

1742 [stating that “we must abandon the pervasively held idea that we can

protect privacy by simply removing personally identifiable information,” as a

“discredited approach”].)

As one commentator noted in discussing the “well-documented failures

of anonymization”:

“Historically, the way to share private information without

betraying privacy was through anonymization, stripping

away all identifiers that could potentially uniquely identify

an individual or group of individuals. Anonymization,

however, proved to be anything but a ‘silver bullet.’ ”

(Bellovin et. al., Privacy and Synthetic Datasets (2019)

22 Stan. Tech. L.Rev. 3–4 (Bellovin).)

Bellovin argues that various high-profile reidentification incidents

suggest that it is often possible with “even novice computer aptitude to ‘join’

40

auxiliary information with a series of ‘perturbed’[29] data points and unveil

the very data that anonymization was designed to protect.” (Bellovin, supra,

at 4.)

Commentators have suggested various “[r]isk [f]actors,” to consider in

assessing the risk of reidentification, including the “[v]olume of [d]ata,”

because “large data sets have a high degree of unicity, which makes it easier

to launch reidentification attacks.” (Rubinstein & Hartzog, Anonymization

and Risk (2016) 91 Wash. L. Rev. 703, 741.) The Johnson & Johnson

defendants both acknowledge that Rawlings has “previously anonymized over

a dozen other databases containing tens of millions of records from

government agencies, private insurers, and the People in this case,” and seek

to make petitioners’ own massive datasets cross-referenceable with these

“multiple datasets.” Another risk factor for reidentification is the

“[s]ensitivity of the [d]ata,” because “[s]ome information, like health . . .

information, is more sensitive and thus more likely to be targeted by

attackers,” (ibid.). As discussed throughout this opinion, the disclosure

ordered in this case involves extremely sensitive medical and substance

abuse treatment information.

Finally, and critically, while the discovery order directs Rawlings to

“de-identify” the data, it contains no protocols or requirements as to how such

deidentification must be carried out. (Compare with Sander, supra,

26 Cal.App.5th at p. 658 [noting that “[a] primary issue [at trial] was whether

the four different protocols proposed by Petitioners to de-identify or

‘anonymize’ the data were sufficient to prevent matching a record in the

29 “ ‘Perturbed’ here refers to the traditional, remove-name-and-zip-code

styled sanitization techniques which often fail to exclude information which

may be linked together to reidentify individuals.” (Id. at p. 4, fn. 9.)

41

supposedly anonymous data to either an individual or a small group of

individuals”]; see also id. at pp. 659–663 [describing four different complex

deidentification protocols and noting “[p]rotocols 2 and 4 employ variations of

a concept known as ‘k-anonymity,’ ” in which “ ‘[t]he proper size of k (i.e. how

much anonymity to provide) is a policy question depending on the sensitivity

of the data and how ambiguous an identification is considered

permissible’ ”].) Given the massive size of the ordered production, the

multiple datasets, and the high sensitivity of the materials to be produced,

the risks associated with an order to provide identified data to a third-party

vendor with vague directions to “de-identify” such data, without any

specification as to how such deidentification must occur, presents a clear

potential threat to patient privacy.

d. Petitioners met their threshold burden to establish a serious

invasion of privacy interests

In sum, given the nature, scope and the actual and potential impact on

patient privacy, we conclude that petitioners have carried their threshold

burden of demonstrating that the superior court’s discovery order threatens a

serious invasion of privacy.

2. The Johnson & Johnson defendants have not identified interests in

favor of disclosure that outweigh the serious invasion of privacy that

such disclosure would entail

We next must consider whether the Johnson & Johnson defendants

have identified interests in favor of disclosure that outweigh the serious

invasion of privacy described in part III.D.1, ante. (See Williams, supra,

3 Cal.5th at p. 557 [describing the shifting burdens in applying the Hill

framework]; Tom v. City and County of San Francisco (2004) 120 Cal.App.4th

674, 686 [“Because we conclude that respondents carried their burden of

demonstrating a serious invasion of their reasonable privacy interests, the

42

burden shifted to the City to show ‘that the invasion of privacy is justified

because it substantively furthers one or more countervailing interests’ ”].) In

conducting such inquiry, we may consider “the interest of the requesting

party, fairness to litigants in conducting the litigation, and the consequences

of granting or restricting access to the information.” (Los Angeles Gay &

Lesbian Center, supra, 194 Cal.App.4th at p. 307, citing Hill, supra, 7 Cal.4th

at p. 37.)

In considering the interests of the requesting party, we observe that the

Board of Registered Nursing court noted that defendants contended that the

CURES prescription data sought in that case was “relevant and

discoverable,” because it would demonstrate “whether defendants’ drugs were

associated with opioid abuse and overdoses,” and “whether patients were

engaged in illicit activities or whether they obtained prescriptions from

unauthorized prescribers.” (Board of Registered Nursing, supra,

59 Cal.App.5th at pp. 1045–1046.) The Board of Registered Nursing court

concluded that such interests were insufficient to justify the discovery of the

CURES prescription records —even when considering the broad scope of

discovery allowed from nonparties generally. (Id. at p. 1046, citing Calcor,

supra, 53 Cal.App.4th at p. 224.)

In this case, the Johnson & Johnson defendants seek to obtain opioid

prescription data similar to the CURES data at issue in Board of Registered

Nursing as well as substance abuse treatment records that threaten an even

more substantial invasion of privacy rights (see Lewis, supra, 3 Cal.5th at

p. 575, see also ibid. [“medical records contain far more sensitive information

than do prescription records”]).30 And, like the defendants in Board of

30 In their supplemental letter brief concerning Board of Registered

Nursing, the Johnson & Johnson defendants do not argue that the

43

Registered Nursing, the Johnson & Johnson defendants argue that such data

is necessary to determine “any ‘causal chain’ (or lack thereof) between

Defendants’ conduct and any alleged “adverse consequences” as alleged by

the People.” More specifically, as in Board of Registered Nursing, the

Johnson & Johnson defendants maintain that the discovery is relevant to

their contention “that any increase in opioid misuse, abuse, and overdose was

a function of illegal prescribing and dispensing, widespread criminal

diversion, and illicit drug trafficking.” Indeed, in the section of their return

arguing that the superior court’s order comports with Hill, the only legal

argument as to the relevance of the petitioners’ prescription and substance

treatment data that the Johnson & Johnson defendants advance is the

superior court’s relevance finding as to the discoverability of the state

agency’s CURES data that this court reversed in Board of Registered

Nursing.31

Given that the Board of Registered Nursing court concluded that such

interests were insufficient to justify disclosure under the broad Calcor

discovery standard (Board of Registered Nursing, supra, 59 Cal.App.5th

1011), we think it necessarily follows that such interests are not sufficient to

justify disclosure in light of the serious potential invasion of privacy rights

that exists in this case. This conclusion is strengthened by the Johnson &

Johnson defendants’ failure to provide any discussion of the elements of

prescription data differs from the CURES data at issue in Board of Registered

Nursing, nor do they dispute that the discovery of substance abuse treatment

records poses even greater privacy concerns.

31 While the Johnson & Johnson defendants provide additional details as

to these arguments in their supplemental letter brief, the underlying theory

of discoverability, which the Board of Registered Nursing court rejected,

remains the same.

44

plaintiffs’ causes of action or any case law bearing on such causes of action to

attempt to demonstrate a theory of discoverability of the sensitive medical

information at issue in these writ proceedings. Simply put, the Johnson &

Johnson defendants fail to provide any “cogent legal argument” (Board of

Registered Nursing, supra, 59 Cal.App.5th at p. 1041) as to how the discovery

that they seek would be admissible or lead to the discovery of admissible

evidence.

This omission is particularly striking given that, in their reply,

petitioners noted that the Johnson & Johnson defendants failed to provide

any argument as to how the requested discovery “could be used to defend

against causes of action that do not require a link between an individual

harm and their particular product,” (italics omitted) and the Board of

Registered Nursing court rejected the superior court’s finding of relevance on

which the Johnson & Johnson defendants relied in their return.32 Yet, as

with their return, the Johnson & Johnson defendants’ supplemental brief

32 Instead, and straining credulity, the Johnson & Johnson defendants

argue in their supplemental brief that the Board of Registered Nursing

opinion has “no bearing” on our consideration of the writ petitions in this

case, because, according to the Johnson & Johnson defendants, “the decision

in Board of Registered Nursing turned chiefly on relevance and burden

concerns that are not at issue in this case . . . .”

“[R]elevance and burden concerns,” are clearly factors that not only

may, but must be considered in determining whether a defendant has

demonstrated that “the interest of the requesting party, fairness to litigants

in conducing the litigation, and the consequences of granting or restricting

access to the information” outweigh the privacy interests at stake in a case.

(Los Angeles Gay & Lesbian Center, supra, 194 Cal.App.4th at p. 307.)

Indeed, the Johnson & Johnson defendants argued in their return that they

had carried their Hill burden by quoting the superior court’s determination

that the discovery of CURES data was “relevant” in the proceedings that led

to Board of Registered Nursing.

45

concerning Board of Registered Nursing fails to provide any discussion of the

causes of action against which they are defending, a fact that supports the

conclusion that the Johnson & Johnson defendants have failed to identify

countervailing interests supporting the discovery order that outweigh the

privacy interests at stake.33 In short, much like the general references to

“ ‘measur[ing] trends and test[ing] causal relationships’ ” (Board of Registered

Nursing, supra, 59 Cal.App.5th at p. 1046) that the Board of Registered

Nursing court concluded was insufficient to justify the discovery at issue in

that case, we conclude that the Johnson & Johnson defendants’ vague

arguments that the data sought from petitioners goes “to the heart of the

People’s causation theories,” and “apportionment in the event the Superior

Court finds liability,” are “insufficient to justify such a vast production of

medical information from the nonparties” (ibid.), particularly in light of the

serious competing privacy interests at stake.

The Johnson & Johnson defendants also have not made any persuasive

argument that fairness to the litigants in conducing the litigation outweighs

the privacy interests at stake. (Los Angeles Gay & Lesbian Center, supra,

194 Cal.App.4th at p. 307.) To begin with, the Johnson & Johnson

defendants do not argue that they bear the burden of proof with respect to

either causation or damages, the two general areas for which the Johnson &

33 In their supplemental brief, the Johnson & Johnson defendants argue

that “[i]f this Court is inclined to consider relevance or burden arguments

raised for the first time in Petitioners’ Reply, [the Johnson & Johnson

defendants] request leave to expand the record to include additional evidence

supporting these newly raised theories, which they would have done in

connection with their Return had the relevance arguments been raised at any

time below or in the Petitions.” We do not consider “relevance or burden

arguments” outside the context of petitioners’ Hill argument, which was

clearly and distinctly raised in their writ petitions. Accordingly, we decline

the Johnson & Johnson defendants’ request to “expand the record.”

46

Johnson defendants have argued that the requested discovery is relevant.

Further, the Johnson & Johnson defendants do not make any argument that

plaintiffs have sought to discover the prescription records and substance

abuse treatment records at issue in these writ proceedings. Thus, the

Johnson & Johnson defendants have not shown that they are being deprived

of any discovery on which plaintiffs may rely in proving their case, nor have

they demonstrated that any other fairness concerns mandate disclosure.

The Johnson & Johnson defendants also have not demonstrated that

the consequences of granting or restricting access to the information support

disclosure. (Los Angeles Gay & Lesbian Center, supra, 194 Cal.App.4th at

p. 307.) To begin with, while the Johnson & Johnson defendants vaguely

refer to the need to cross-reference “multiple datasets,” they provide but one

example of such cross-referencing in their return.34 (Italics added.) Given

the highly sensitive nature of the data requested, a far more detailed showing

is required as to the precise nature of the datasets to which the discovery in

this case would be linked and exactly how such data would be cross-

referenced.

Relatedly, the Johnson & Johnson defendants do not discuss in any

detail the other discovery that has been produced in this case in attempting

to explain their need for the specific discovery at issue in these writ

proceedings. The Board of Registered Nursing court noted the lack of any

such showing in that case:

“[Defendants fail to] persuasively explain why such a large

amount of personal and private data, on millions of

Californians, is necessary in light of the extensive

34 The one example provided is the Johnson & Johnson defendants’

statement that “[p]etitioners’ claims data can be cross-referenced with

already provided statewide mortality data to illustrate whether, and the

extent to which, any harms befell County-specific and California patients.”

47

information already available to them. For example,

defendants admit they have ‘insurance claims data and

hospital claims data’ from the plaintiff jurisdictions and

other private entities, as well as comprehensive mortality

data from the California Department of Health. The

department already releases data on opioid-related deaths,

emergency room visits, hospitalizations, and county-level

prescriptions. The [Department of Justice] releases

aggregate statistics from the CURES database across

numerous dimensions.” (Board of Registered Nursing,

supra, 59 Cal.App.5th at p. 1046.)

Similarly, in these writ proceedings, the Johnson & Johnson

defendants acknowledge having access to multiple datasets in preparing their

defense and fail to demonstrate why the discovery they seek from petitioners

is critical in defending against plaintiffs’ claims.

3. After applying the Hill framework, we conclude that the superior

court erred in granting the Johnson & Johnson defendants’ motions

to compel

Petitioners have established a legally protected privacy interest, an

objectively reasonable expectation of privacy in the given circumstances, and

a threatened intrusion that is serious. The Johnson & Johnson defendants

have not established countervailing interests that outweigh this serious

potential invasion of privacy rights. Accordingly, we conclude that the

superior court erred in granting the Johnson & Johnson defendants’ motions

to compel.

IV.

DISPOSITION

The Johnson & Johnson defendants’ demurrer to the petitions is

overruled. The petitions are granted. Let a peremptory writ of mandate

issue directing the superior court to vacate its order compelling production of

documents from petitioners County of Los Angeles and County of Alameda

48

and enter a new order denying the Johnson & Johnson defendants’ motions

to compel. Petitioners shall recover their costs in this original proceeding.

(Cal. Rules of Court, rule 8.493(a)(2).)

AARON, J.

WE CONCUR:

BENKE, Acting P. J.

IRION, J.

49