Amended IN Senate July 03, 2019 Amended IN Senate June 19, 2019 CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION Assembly Bill No. 528Introduced by Assembly Member LowFebruary 13, 2019 An act to amend Sections 11164.1, 11165, 11165.1, and 11165.4 of the Health and Safety Code, relating to controlled substances.LEGISLATIVE COUNSEL'S DIGESTAB 528, as amended, Low. Controlled substances: CURES database.(1) Existing law classifies certain controlled substances into Schedules I to V, inclusive. Existing law requires the Department of Justice to maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense a Schedule II, Schedule III, or Schedule IV controlled substance. Existing law requires a dispensing pharmacy, clinic, or other dispenser to report specified information to the department as soon as reasonably possible, but no more than 7 days after a controlled substance is dispensed.This bill would require a dispensing pharmacy, clinic, or other dispenser to report the information required by the CURES database no more than one working day after a controlled substance is dispensed. The bill would similarly require the dispensing of a controlled substance included on Schedule V to be reported to the department using the CURES database. The bill would make conforming changes to related provisions. The bill would prohibit an insurer providing workers compensation coverage from using information obtained from the CURES database as the sole factor in approving or denying a workers compensation claim.(2) Existing law requires a health care practitioner authorized to prescribe, order, administer, furnish, or dispense controlled substances included on Schedule II, Schedule III, or Schedule IV, and a pharmacist upon licensure, to submit an application to obtain approval to electronically access information in the CURES database.This bill would permit a licensed physician and surgeon to submit an application to obtain approval to electronically access information in the CURES database.(3) Existing law requires an authorized health care practitioner to consult the CURES database to review a patients controlled substance history before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every 4 months thereafter if the controlled substance remains part of the treatment of the patient.This bill would instead require the authorized health care practitioner to consult the CURES database to review the patients controlled substance history at least once every 6 months after the first time the substance is prescribed.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO Bill TextThe people of the State of California do enact as follows:SECTION 1. It is the intent of the Legislature that state laws regarding the operation and use of prescription drug monitoring programs continue to empower health care-oriented technology solutions to the opioid crisis.SEC. 2. Section 11164.1 of the Health and Safety Code is amended to read:11164.1. (a) (1) Notwithstanding any other law, a prescription for a controlled substance issued by a prescriber in another state for delivery to a patient in another state may be dispensed by a California pharmacy, if the prescription conforms with the requirements for controlled substance prescriptions in the state in which the controlled substance was prescribed.(2) A prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance dispensed pursuant to this subdivision shall be reported by the dispensing pharmacy to the Department of Justice in the manner prescribed by subdivision (d) of Section 11165.(b) A pharmacy may dispense a prescription for a Schedule III, Schedule IV, or Schedule V controlled substance from an out-of-state prescriber pursuant to Section 4005 of the Business and Professions Code and Section 1717 of Title 16 of the California Code of Regulations.SEC. 3. Section 11165 of the Health and Safety Code is amended to read:11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(3) The department shall, no later than January 1, 2021, adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(E)The conditions under which an insurer providing workers compensation coverage may access information in CURES for purposes of reviewing a workers compensation claim, which shall at a minimum prohibit an insurer from using information obtained from the CURES database as the sole factor in evaluating a claim for approval or denial.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15 respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department as soon as reasonably possible, but not more than one working day after the date a controlled substance is dispensed, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.SEC. 4. Section 11165.1 of the Health and Safety Code is amended to read:11165.1. (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 shall, upon receipt of a federal Drug Enforcement Administration (DEA) registration, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the practitioner or their delegate the electronic history of controlled substances dispensed to an individual under the practitioners care based on data contained in the CURES Prescription Drug Monitoring Program (PDMP).(ii) A pharmacist shall, upon licensure, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the pharmacist or their delegate the electronic history of controlled substances dispensed to an individual under the pharmacists care based on data contained in the CURES PDMP.(iii) A licensed physician and surgeon who does not hold a DEA registration may submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of the patient that is maintained by the department. Upon approval, the department shall release to the physician and surgeon or their delegate the electronic history of controlled substances dispensed to a patient under their care based on data contained in the CURES PDMP.(B) The department may deny an application or suspend a subscriber, for reasons which include, but are not limited to, the following:(i) Materially falsifying an application to access information contained in the CURES database.(ii) Failing to maintain effective controls for access to the patient activity report.(iii) Having their federal DEA registration suspended or revoked.(iv) Violating a law governing controlled substances or another law for which the possession or use of a controlled substance is an element of the crime.(v) Accessing information for a reason other than to diagnose or treat a patient, or to document compliance with the law.(C) An authorized subscriber shall notify the department within 30 days of a change to the subscriber account.(D) An approved health care practitioner, pharmacist, or a person acting on behalf of a health care practitioner or pharmacist pursuant to subdivision (b) of Section 209 of the Business and Professions Code may use the departments online portal or a health information technology system that meets the criteria required in subparagraph (E) to access information in the CURES database pursuant to this section. A subscriber who uses a health information technology system that meets the criteria required in subparagraph (E) to access the CURES database may submit automated queries to the CURES database that are triggered by predetermined criteria.(E) An approved health care practitioner or pharmacist may submit queries to the CURES database through a health information technology system if the entity that operates the health information technology system certifies all of the following:(i) The entity will not use or disclose data received from the CURES database for a purpose other than delivering the data to an approved health care practitioner or pharmacist or performing data processing activities that may be necessary to enable the delivery unless authorized by, and pursuant to, state and federal privacy and security laws and regulations.(ii) The health information technology system will authenticate the identity of an authorized health care practitioner or pharmacist initiating queries to the CURES database and, at the time of the query to the CURES database, the health information technology system submits the following data regarding the query to CURES:(I) The date of the query.(II) The time of the query.(III) The first and last name of the patient queried.(IV) The date of birth of the patient queried.(V) The identification of the CURES user for whom the system is making the query.(iii) The health information technology system meets applicable patient privacy and information security requirements of state and federal law.(iv) The entity has entered into a memorandum of understanding with the department that solely addresses the technical specifications of the health information technology system to ensure the security of the data in the CURES database and the secure transfer of data from the CURES database. The technical specifications shall be universal for all health information technology systems that establish a method of system integration to retrieve information from the CURES database. The memorandum of understanding shall not govern, or in any way impact or restrict, the use of data received from the CURES database or impose any additional burdens on covered entities in compliance with the regulations promulgated pursuant to the federal Health Insurance Portability and Accountability Act of 1996 found in Parts 160 and 164 of Title 45 of the Code of Federal Regulations.(F) No later than October 1, 2018, the department shall develop a programming interface or other method of system integration to allow health information technology systems that meet the requirements in subparagraph (E) to retrieve information in the CURES database on behalf of an authorized health care practitioner or pharmacist.(G) The department shall not access patient-identifiable information in an entitys health information technology system.(H) An entity that operates a health information technology system that is requesting to establish an integration with the CURES database shall pay a reasonable fee to cover the cost of establishing and maintaining integration with the CURES database.(I) The department may prohibit integration or terminate a health information technology systems ability to retrieve information in the CURES database if the health information technology system fails to meet the requirements of subparagraph (E), or the entity operating the health information technology system does not fulfill its obligation under subparagraph (H).(2) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 or a pharmacist shall be deemed to have complied with paragraph (1) if the licensed health care practitioner or pharmacist has been approved to access the CURES database through the process developed pursuant to subdivision (a) of Section 209 of the Business and Professions Code.(b) A request for, or release of, a controlled substance history pursuant to this section shall be made in accordance with guidelines developed by the department.(c) In order to prevent the inappropriate, improper, or illegal use of Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances, the department may initiate the referral of the history of controlled substances dispensed to an individual based on data contained in CURES to licensed health care practitioners, pharmacists, or both, providing care or services to the individual.(d) The history of controlled substances dispensed to an individual based on data contained in CURES that is received by a practitioner or pharmacist from the department pursuant to this section is medical information subject to the provisions of the Confidentiality of Medical Information Act contained in Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code.(e) Information concerning a patients controlled substance history provided to a practitioner or pharmacist pursuant to this section shall include prescriptions for controlled substances listed in Sections 1308.12, 1308.13, 1308.14, and 1308.15 of Title 21 of the Code of Federal Regulations.(f) A health care practitioner, pharmacist, or a person acting on behalf of a health care practitioner or pharmacist, when acting with reasonable care and in good faith, is not subject to civil or administrative liability arising from false, incomplete, inaccurate, or misattributed information submitted to, reported by, or relied upon in the CURES database or for a resulting failure of the CURES database to accurately or timely report that information.(g) For purposes of this section, the following terms have the following meanings:(1) Automated basis means using predefined criteria to trigger an automated query to the CURES database, which can be attributed to a specific health care practitioner or pharmacist.(2) Department means the Department of Justice.(3) Entity means an organization that operates, or provides or makes available, a health information technology system to a health care practitioner or pharmacist.(4) Health information technology system means an information processing application using hardware and software for the storage, retrieval, sharing of or use of patient data for communication, decisionmaking, coordination of care, or the quality, safety, or efficiency of the practice of medicine or delivery of health care services, including, but not limited to, electronic medical record applications, health information exchange systems, or other interoperable clinical or health care information system.SEC. 5. Section 11165.4 of the Health and Safety Code is amended to read:11165.4. (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance shall consult the patient activity report or information from the patient activity report obtained from the CURES database to review a patients controlled substance history for the past 12 months before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every six months thereafter if the substance remains part of the treatment of the patient. A health care practitioner shall document that they consulted the patients controlled substance history in the patients medical record if that health care practitioner was not the practitioner that accessed the patient activity report from the CURES database.(ii) If a health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance is not required, pursuant to an exemption described in subdivision (c), to consult the patient activity report from the CURES database the first time the health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient, the health care practitioner shall consult the patient activity report from the CURES database to review the patients controlled substance history before subsequently prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient and at least once every six months thereafter if the prescriber renews the prescription and the substance remains part of the treatment of the patient.(B) For purposes of this paragraph, first time means the initial occurrence in which a health care practitioner, in their role as a health care practitioner, intends to prescribe, order, administer, or furnish a Schedule II, Schedule III, or Schedule IV controlled substance to a patient and has not previously prescribed a controlled substance to the patient.(2) A health care practitioner shall review a patients controlled substance history that has been obtained from the CURES database no earlier than 24 hours, or the previous business day, before the health care practitioner prescribes, orders, administers, or furnishes a Schedule II, Schedule III, or Schedule IV controlled substance to the patient.(b) The duty to consult the CURES database, as described in subdivision (a), does not apply to veterinarians or pharmacists.(c) The duty to consult the CURES database, as described in subdivision (a), does not apply to a health care practitioner in any of the following circumstances:(1) If a health care practitioner prescribes, orders, or furnishes a controlled substance to be administered to a patient in any of the following facilities or during a transfer between any of the following facilities, or for use while on facility premises:(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.(E) Another medical facility, including, but not limited to, an office of a health care practitioner and an imaging center.(2) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance in the emergency department of a general acute care hospital and the quantity of the controlled substance does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use.(3) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient as part of the patients treatment for a surgical, radiotherapeutic, or diagnostic procedure and the quantity of the controlled substance does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use, in any of the following facilities:(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.(E) A place of practice, as defined in Section 1658 of the Business and Professions Code.(F) Another medical facility where surgical procedures are permitted to take place, including, but not limited to, the office of a health care practitioner.(4) If a health care practitioner is a designated practitioner serving in the absence of the patients physician and surgeon and orders a renewal request of a medically indicated controlled substance prescription for an amount not exceeding the original prescription strength or amount or for more than one refill pursuant to paragraph (3) of subdivision (b) of Section 2242 of the Business and Professions Code.(5) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient who is terminally ill, as defined in subdivision (c) of Section 11159.2.(6) (A) If all of the following circumstances are satisfied:(i) It is not reasonably possible for a health care practitioner to access the information in the CURES database in a timely manner.(ii) Another health care practitioner or designee authorized to access the CURES database is not reasonably available.(iii) The quantity of controlled substance prescribed, ordered, administered, or furnished does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use and no refill of the controlled substance is allowed.(B) A health care practitioner who does not consult the CURES database under subparagraph (A) shall document the reason they did not consult the database in the patients medical record.(7) If the CURES database is not operational, as determined by the department, or when it cannot be accessed by a health care practitioner because of a temporary technological or electrical failure. A health care practitioner shall, without undue delay, seek to correct the cause of the temporary technological or electrical failure that is reasonably within the health care practitioners control.(8) If the CURES database cannot be accessed because of technological limitations that are not reasonably within the control of a health care practitioner.(9) If consultation of the CURES database would, as determined by the health care practitioner, result in a patients inability to obtain a prescription in a timely manner and thereby adversely impact the patients medical condition, provided that the quantity of the controlled substance does not exceed a nonrefillable seven-day supply if the controlled substance were used in accordance with the directions for use.(d) (1) A health care practitioner who fails to consult the CURES database, as described in subdivision (a), shall be referred to the appropriate state professional licensing board solely for administrative sanctions, as deemed appropriate by that board.(2) This section does not create a private cause of action against a health care practitioner. This section does not limit a health care practitioners liability for the negligent failure to diagnose or treat a patient.(e) All applicable state and federal privacy laws govern the duties required by this section.(f) The provisions of this section are severable. If any provision of this section or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
Amended IN Senate July 03, 2019 Amended IN Senate June 19, 2019 CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION Assembly Bill No. 528Introduced by Assembly Member LowFebruary 13, 2019 An act to amend Sections 11164.1, 11165, 11165.1, and 11165.4 of the Health and Safety Code, relating to controlled substances.LEGISLATIVE COUNSEL'S DIGESTAB 528, as amended, Low. Controlled substances: CURES database.(1) Existing law classifies certain controlled substances into Schedules I to V, inclusive. Existing law requires the Department of Justice to maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense a Schedule II, Schedule III, or Schedule IV controlled substance. Existing law requires a dispensing pharmacy, clinic, or other dispenser to report specified information to the department as soon as reasonably possible, but no more than 7 days after a controlled substance is dispensed.This bill would require a dispensing pharmacy, clinic, or other dispenser to report the information required by the CURES database no more than one working day after a controlled substance is dispensed. The bill would similarly require the dispensing of a controlled substance included on Schedule V to be reported to the department using the CURES database. The bill would make conforming changes to related provisions. The bill would prohibit an insurer providing workers compensation coverage from using information obtained from the CURES database as the sole factor in approving or denying a workers compensation claim.(2) Existing law requires a health care practitioner authorized to prescribe, order, administer, furnish, or dispense controlled substances included on Schedule II, Schedule III, or Schedule IV, and a pharmacist upon licensure, to submit an application to obtain approval to electronically access information in the CURES database.This bill would permit a licensed physician and surgeon to submit an application to obtain approval to electronically access information in the CURES database.(3) Existing law requires an authorized health care practitioner to consult the CURES database to review a patients controlled substance history before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every 4 months thereafter if the controlled substance remains part of the treatment of the patient.This bill would instead require the authorized health care practitioner to consult the CURES database to review the patients controlled substance history at least once every 6 months after the first time the substance is prescribed.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO
Amended IN Senate July 03, 2019 Amended IN Senate June 19, 2019
Amended IN Senate July 03, 2019
Amended IN Senate June 19, 2019
CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION
Assembly Bill
No. 528
Introduced by Assembly Member LowFebruary 13, 2019
Introduced by Assembly Member Low
February 13, 2019
An act to amend Sections 11164.1, 11165, 11165.1, and 11165.4 of the Health and Safety Code, relating to controlled substances.
LEGISLATIVE COUNSEL'S DIGEST
## LEGISLATIVE COUNSEL'S DIGEST
AB 528, as amended, Low. Controlled substances: CURES database.
(1) Existing law classifies certain controlled substances into Schedules I to V, inclusive. Existing law requires the Department of Justice to maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense a Schedule II, Schedule III, or Schedule IV controlled substance. Existing law requires a dispensing pharmacy, clinic, or other dispenser to report specified information to the department as soon as reasonably possible, but no more than 7 days after a controlled substance is dispensed.This bill would require a dispensing pharmacy, clinic, or other dispenser to report the information required by the CURES database no more than one working day after a controlled substance is dispensed. The bill would similarly require the dispensing of a controlled substance included on Schedule V to be reported to the department using the CURES database. The bill would make conforming changes to related provisions. The bill would prohibit an insurer providing workers compensation coverage from using information obtained from the CURES database as the sole factor in approving or denying a workers compensation claim.(2) Existing law requires a health care practitioner authorized to prescribe, order, administer, furnish, or dispense controlled substances included on Schedule II, Schedule III, or Schedule IV, and a pharmacist upon licensure, to submit an application to obtain approval to electronically access information in the CURES database.This bill would permit a licensed physician and surgeon to submit an application to obtain approval to electronically access information in the CURES database.(3) Existing law requires an authorized health care practitioner to consult the CURES database to review a patients controlled substance history before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every 4 months thereafter if the controlled substance remains part of the treatment of the patient.This bill would instead require the authorized health care practitioner to consult the CURES database to review the patients controlled substance history at least once every 6 months after the first time the substance is prescribed.
(1) Existing law classifies certain controlled substances into Schedules I to V, inclusive. Existing law requires the Department of Justice to maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense a Schedule II, Schedule III, or Schedule IV controlled substance. Existing law requires a dispensing pharmacy, clinic, or other dispenser to report specified information to the department as soon as reasonably possible, but no more than 7 days after a controlled substance is dispensed.
This bill would require a dispensing pharmacy, clinic, or other dispenser to report the information required by the CURES database no more than one working day after a controlled substance is dispensed. The bill would similarly require the dispensing of a controlled substance included on Schedule V to be reported to the department using the CURES database. The bill would make conforming changes to related provisions. The bill would prohibit an insurer providing workers compensation coverage from using information obtained from the CURES database as the sole factor in approving or denying a workers compensation claim.
(2) Existing law requires a health care practitioner authorized to prescribe, order, administer, furnish, or dispense controlled substances included on Schedule II, Schedule III, or Schedule IV, and a pharmacist upon licensure, to submit an application to obtain approval to electronically access information in the CURES database.
This bill would permit a licensed physician and surgeon to submit an application to obtain approval to electronically access information in the CURES database.
(3) Existing law requires an authorized health care practitioner to consult the CURES database to review a patients controlled substance history before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every 4 months thereafter if the controlled substance remains part of the treatment of the patient.
This bill would instead require the authorized health care practitioner to consult the CURES database to review the patients controlled substance history at least once every 6 months after the first time the substance is prescribed.
## Digest Key
## Bill Text
The people of the State of California do enact as follows:SECTION 1. It is the intent of the Legislature that state laws regarding the operation and use of prescription drug monitoring programs continue to empower health care-oriented technology solutions to the opioid crisis.SEC. 2. Section 11164.1 of the Health and Safety Code is amended to read:11164.1. (a) (1) Notwithstanding any other law, a prescription for a controlled substance issued by a prescriber in another state for delivery to a patient in another state may be dispensed by a California pharmacy, if the prescription conforms with the requirements for controlled substance prescriptions in the state in which the controlled substance was prescribed.(2) A prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance dispensed pursuant to this subdivision shall be reported by the dispensing pharmacy to the Department of Justice in the manner prescribed by subdivision (d) of Section 11165.(b) A pharmacy may dispense a prescription for a Schedule III, Schedule IV, or Schedule V controlled substance from an out-of-state prescriber pursuant to Section 4005 of the Business and Professions Code and Section 1717 of Title 16 of the California Code of Regulations.SEC. 3. Section 11165 of the Health and Safety Code is amended to read:11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(3) The department shall, no later than January 1, 2021, adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(E)The conditions under which an insurer providing workers compensation coverage may access information in CURES for purposes of reviewing a workers compensation claim, which shall at a minimum prohibit an insurer from using information obtained from the CURES database as the sole factor in evaluating a claim for approval or denial.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15 respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department as soon as reasonably possible, but not more than one working day after the date a controlled substance is dispensed, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.SEC. 4. Section 11165.1 of the Health and Safety Code is amended to read:11165.1. (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 shall, upon receipt of a federal Drug Enforcement Administration (DEA) registration, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the practitioner or their delegate the electronic history of controlled substances dispensed to an individual under the practitioners care based on data contained in the CURES Prescription Drug Monitoring Program (PDMP).(ii) A pharmacist shall, upon licensure, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the pharmacist or their delegate the electronic history of controlled substances dispensed to an individual under the pharmacists care based on data contained in the CURES PDMP.(iii) A licensed physician and surgeon who does not hold a DEA registration may submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of the patient that is maintained by the department. Upon approval, the department shall release to the physician and surgeon or their delegate the electronic history of controlled substances dispensed to a patient under their care based on data contained in the CURES PDMP.(B) The department may deny an application or suspend a subscriber, for reasons which include, but are not limited to, the following:(i) Materially falsifying an application to access information contained in the CURES database.(ii) Failing to maintain effective controls for access to the patient activity report.(iii) Having their federal DEA registration suspended or revoked.(iv) Violating a law governing controlled substances or another law for which the possession or use of a controlled substance is an element of the crime.(v) Accessing information for a reason other than to diagnose or treat a patient, or to document compliance with the law.(C) An authorized subscriber shall notify the department within 30 days of a change to the subscriber account.(D) An approved health care practitioner, pharmacist, or a person acting on behalf of a health care practitioner or pharmacist pursuant to subdivision (b) of Section 209 of the Business and Professions Code may use the departments online portal or a health information technology system that meets the criteria required in subparagraph (E) to access information in the CURES database pursuant to this section. A subscriber who uses a health information technology system that meets the criteria required in subparagraph (E) to access the CURES database may submit automated queries to the CURES database that are triggered by predetermined criteria.(E) An approved health care practitioner or pharmacist may submit queries to the CURES database through a health information technology system if the entity that operates the health information technology system certifies all of the following:(i) The entity will not use or disclose data received from the CURES database for a purpose other than delivering the data to an approved health care practitioner or pharmacist or performing data processing activities that may be necessary to enable the delivery unless authorized by, and pursuant to, state and federal privacy and security laws and regulations.(ii) The health information technology system will authenticate the identity of an authorized health care practitioner or pharmacist initiating queries to the CURES database and, at the time of the query to the CURES database, the health information technology system submits the following data regarding the query to CURES:(I) The date of the query.(II) The time of the query.(III) The first and last name of the patient queried.(IV) The date of birth of the patient queried.(V) The identification of the CURES user for whom the system is making the query.(iii) The health information technology system meets applicable patient privacy and information security requirements of state and federal law.(iv) The entity has entered into a memorandum of understanding with the department that solely addresses the technical specifications of the health information technology system to ensure the security of the data in the CURES database and the secure transfer of data from the CURES database. The technical specifications shall be universal for all health information technology systems that establish a method of system integration to retrieve information from the CURES database. The memorandum of understanding shall not govern, or in any way impact or restrict, the use of data received from the CURES database or impose any additional burdens on covered entities in compliance with the regulations promulgated pursuant to the federal Health Insurance Portability and Accountability Act of 1996 found in Parts 160 and 164 of Title 45 of the Code of Federal Regulations.(F) No later than October 1, 2018, the department shall develop a programming interface or other method of system integration to allow health information technology systems that meet the requirements in subparagraph (E) to retrieve information in the CURES database on behalf of an authorized health care practitioner or pharmacist.(G) The department shall not access patient-identifiable information in an entitys health information technology system.(H) An entity that operates a health information technology system that is requesting to establish an integration with the CURES database shall pay a reasonable fee to cover the cost of establishing and maintaining integration with the CURES database.(I) The department may prohibit integration or terminate a health information technology systems ability to retrieve information in the CURES database if the health information technology system fails to meet the requirements of subparagraph (E), or the entity operating the health information technology system does not fulfill its obligation under subparagraph (H).(2) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 or a pharmacist shall be deemed to have complied with paragraph (1) if the licensed health care practitioner or pharmacist has been approved to access the CURES database through the process developed pursuant to subdivision (a) of Section 209 of the Business and Professions Code.(b) A request for, or release of, a controlled substance history pursuant to this section shall be made in accordance with guidelines developed by the department.(c) In order to prevent the inappropriate, improper, or illegal use of Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances, the department may initiate the referral of the history of controlled substances dispensed to an individual based on data contained in CURES to licensed health care practitioners, pharmacists, or both, providing care or services to the individual.(d) The history of controlled substances dispensed to an individual based on data contained in CURES that is received by a practitioner or pharmacist from the department pursuant to this section is medical information subject to the provisions of the Confidentiality of Medical Information Act contained in Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code.(e) Information concerning a patients controlled substance history provided to a practitioner or pharmacist pursuant to this section shall include prescriptions for controlled substances listed in Sections 1308.12, 1308.13, 1308.14, and 1308.15 of Title 21 of the Code of Federal Regulations.(f) A health care practitioner, pharmacist, or a person acting on behalf of a health care practitioner or pharmacist, when acting with reasonable care and in good faith, is not subject to civil or administrative liability arising from false, incomplete, inaccurate, or misattributed information submitted to, reported by, or relied upon in the CURES database or for a resulting failure of the CURES database to accurately or timely report that information.(g) For purposes of this section, the following terms have the following meanings:(1) Automated basis means using predefined criteria to trigger an automated query to the CURES database, which can be attributed to a specific health care practitioner or pharmacist.(2) Department means the Department of Justice.(3) Entity means an organization that operates, or provides or makes available, a health information technology system to a health care practitioner or pharmacist.(4) Health information technology system means an information processing application using hardware and software for the storage, retrieval, sharing of or use of patient data for communication, decisionmaking, coordination of care, or the quality, safety, or efficiency of the practice of medicine or delivery of health care services, including, but not limited to, electronic medical record applications, health information exchange systems, or other interoperable clinical or health care information system.SEC. 5. Section 11165.4 of the Health and Safety Code is amended to read:11165.4. (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance shall consult the patient activity report or information from the patient activity report obtained from the CURES database to review a patients controlled substance history for the past 12 months before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every six months thereafter if the substance remains part of the treatment of the patient. A health care practitioner shall document that they consulted the patients controlled substance history in the patients medical record if that health care practitioner was not the practitioner that accessed the patient activity report from the CURES database.(ii) If a health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance is not required, pursuant to an exemption described in subdivision (c), to consult the patient activity report from the CURES database the first time the health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient, the health care practitioner shall consult the patient activity report from the CURES database to review the patients controlled substance history before subsequently prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient and at least once every six months thereafter if the prescriber renews the prescription and the substance remains part of the treatment of the patient.(B) For purposes of this paragraph, first time means the initial occurrence in which a health care practitioner, in their role as a health care practitioner, intends to prescribe, order, administer, or furnish a Schedule II, Schedule III, or Schedule IV controlled substance to a patient and has not previously prescribed a controlled substance to the patient.(2) A health care practitioner shall review a patients controlled substance history that has been obtained from the CURES database no earlier than 24 hours, or the previous business day, before the health care practitioner prescribes, orders, administers, or furnishes a Schedule II, Schedule III, or Schedule IV controlled substance to the patient.(b) The duty to consult the CURES database, as described in subdivision (a), does not apply to veterinarians or pharmacists.(c) The duty to consult the CURES database, as described in subdivision (a), does not apply to a health care practitioner in any of the following circumstances:(1) If a health care practitioner prescribes, orders, or furnishes a controlled substance to be administered to a patient in any of the following facilities or during a transfer between any of the following facilities, or for use while on facility premises:(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.(E) Another medical facility, including, but not limited to, an office of a health care practitioner and an imaging center.(2) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance in the emergency department of a general acute care hospital and the quantity of the controlled substance does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use.(3) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient as part of the patients treatment for a surgical, radiotherapeutic, or diagnostic procedure and the quantity of the controlled substance does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use, in any of the following facilities:(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.(E) A place of practice, as defined in Section 1658 of the Business and Professions Code.(F) Another medical facility where surgical procedures are permitted to take place, including, but not limited to, the office of a health care practitioner.(4) If a health care practitioner is a designated practitioner serving in the absence of the patients physician and surgeon and orders a renewal request of a medically indicated controlled substance prescription for an amount not exceeding the original prescription strength or amount or for more than one refill pursuant to paragraph (3) of subdivision (b) of Section 2242 of the Business and Professions Code.(5) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient who is terminally ill, as defined in subdivision (c) of Section 11159.2.(6) (A) If all of the following circumstances are satisfied:(i) It is not reasonably possible for a health care practitioner to access the information in the CURES database in a timely manner.(ii) Another health care practitioner or designee authorized to access the CURES database is not reasonably available.(iii) The quantity of controlled substance prescribed, ordered, administered, or furnished does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use and no refill of the controlled substance is allowed.(B) A health care practitioner who does not consult the CURES database under subparagraph (A) shall document the reason they did not consult the database in the patients medical record.(7) If the CURES database is not operational, as determined by the department, or when it cannot be accessed by a health care practitioner because of a temporary technological or electrical failure. A health care practitioner shall, without undue delay, seek to correct the cause of the temporary technological or electrical failure that is reasonably within the health care practitioners control.(8) If the CURES database cannot be accessed because of technological limitations that are not reasonably within the control of a health care practitioner.(9) If consultation of the CURES database would, as determined by the health care practitioner, result in a patients inability to obtain a prescription in a timely manner and thereby adversely impact the patients medical condition, provided that the quantity of the controlled substance does not exceed a nonrefillable seven-day supply if the controlled substance were used in accordance with the directions for use.(d) (1) A health care practitioner who fails to consult the CURES database, as described in subdivision (a), shall be referred to the appropriate state professional licensing board solely for administrative sanctions, as deemed appropriate by that board.(2) This section does not create a private cause of action against a health care practitioner. This section does not limit a health care practitioners liability for the negligent failure to diagnose or treat a patient.(e) All applicable state and federal privacy laws govern the duties required by this section.(f) The provisions of this section are severable. If any provision of this section or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
The people of the State of California do enact as follows:
## The people of the State of California do enact as follows:
SECTION 1. It is the intent of the Legislature that state laws regarding the operation and use of prescription drug monitoring programs continue to empower health care-oriented technology solutions to the opioid crisis.
SECTION 1. It is the intent of the Legislature that state laws regarding the operation and use of prescription drug monitoring programs continue to empower health care-oriented technology solutions to the opioid crisis.
SECTION 1. It is the intent of the Legislature that state laws regarding the operation and use of prescription drug monitoring programs continue to empower health care-oriented technology solutions to the opioid crisis.
### SECTION 1.
SEC. 2. Section 11164.1 of the Health and Safety Code is amended to read:11164.1. (a) (1) Notwithstanding any other law, a prescription for a controlled substance issued by a prescriber in another state for delivery to a patient in another state may be dispensed by a California pharmacy, if the prescription conforms with the requirements for controlled substance prescriptions in the state in which the controlled substance was prescribed.(2) A prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance dispensed pursuant to this subdivision shall be reported by the dispensing pharmacy to the Department of Justice in the manner prescribed by subdivision (d) of Section 11165.(b) A pharmacy may dispense a prescription for a Schedule III, Schedule IV, or Schedule V controlled substance from an out-of-state prescriber pursuant to Section 4005 of the Business and Professions Code and Section 1717 of Title 16 of the California Code of Regulations.
SEC. 2. Section 11164.1 of the Health and Safety Code is amended to read:
### SEC. 2.
11164.1. (a) (1) Notwithstanding any other law, a prescription for a controlled substance issued by a prescriber in another state for delivery to a patient in another state may be dispensed by a California pharmacy, if the prescription conforms with the requirements for controlled substance prescriptions in the state in which the controlled substance was prescribed.(2) A prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance dispensed pursuant to this subdivision shall be reported by the dispensing pharmacy to the Department of Justice in the manner prescribed by subdivision (d) of Section 11165.(b) A pharmacy may dispense a prescription for a Schedule III, Schedule IV, or Schedule V controlled substance from an out-of-state prescriber pursuant to Section 4005 of the Business and Professions Code and Section 1717 of Title 16 of the California Code of Regulations.
11164.1. (a) (1) Notwithstanding any other law, a prescription for a controlled substance issued by a prescriber in another state for delivery to a patient in another state may be dispensed by a California pharmacy, if the prescription conforms with the requirements for controlled substance prescriptions in the state in which the controlled substance was prescribed.(2) A prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance dispensed pursuant to this subdivision shall be reported by the dispensing pharmacy to the Department of Justice in the manner prescribed by subdivision (d) of Section 11165.(b) A pharmacy may dispense a prescription for a Schedule III, Schedule IV, or Schedule V controlled substance from an out-of-state prescriber pursuant to Section 4005 of the Business and Professions Code and Section 1717 of Title 16 of the California Code of Regulations.
11164.1. (a) (1) Notwithstanding any other law, a prescription for a controlled substance issued by a prescriber in another state for delivery to a patient in another state may be dispensed by a California pharmacy, if the prescription conforms with the requirements for controlled substance prescriptions in the state in which the controlled substance was prescribed.(2) A prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance dispensed pursuant to this subdivision shall be reported by the dispensing pharmacy to the Department of Justice in the manner prescribed by subdivision (d) of Section 11165.(b) A pharmacy may dispense a prescription for a Schedule III, Schedule IV, or Schedule V controlled substance from an out-of-state prescriber pursuant to Section 4005 of the Business and Professions Code and Section 1717 of Title 16 of the California Code of Regulations.
11164.1. (a) (1) Notwithstanding any other law, a prescription for a controlled substance issued by a prescriber in another state for delivery to a patient in another state may be dispensed by a California pharmacy, if the prescription conforms with the requirements for controlled substance prescriptions in the state in which the controlled substance was prescribed.
(2) A prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance dispensed pursuant to this subdivision shall be reported by the dispensing pharmacy to the Department of Justice in the manner prescribed by subdivision (d) of Section 11165.
(b) A pharmacy may dispense a prescription for a Schedule III, Schedule IV, or Schedule V controlled substance from an out-of-state prescriber pursuant to Section 4005 of the Business and Professions Code and Section 1717 of Title 16 of the California Code of Regulations.
SEC. 3. Section 11165 of the Health and Safety Code is amended to read:11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(3) The department shall, no later than January 1, 2021, adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(E)The conditions under which an insurer providing workers compensation coverage may access information in CURES for purposes of reviewing a workers compensation claim, which shall at a minimum prohibit an insurer from using information obtained from the CURES database as the sole factor in evaluating a claim for approval or denial.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15 respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department as soon as reasonably possible, but not more than one working day after the date a controlled substance is dispensed, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.
SEC. 3. Section 11165 of the Health and Safety Code is amended to read:
### SEC. 3.
11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(3) The department shall, no later than January 1, 2021, adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(E)The conditions under which an insurer providing workers compensation coverage may access information in CURES for purposes of reviewing a workers compensation claim, which shall at a minimum prohibit an insurer from using information obtained from the CURES database as the sole factor in evaluating a claim for approval or denial.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15 respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department as soon as reasonably possible, but not more than one working day after the date a controlled substance is dispensed, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.
11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(3) The department shall, no later than January 1, 2021, adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(E)The conditions under which an insurer providing workers compensation coverage may access information in CURES for purposes of reviewing a workers compensation claim, which shall at a minimum prohibit an insurer from using information obtained from the CURES database as the sole factor in evaluating a claim for approval or denial.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15 respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department as soon as reasonably possible, but not more than one working day after the date a controlled substance is dispensed, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.
11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(3) The department shall, no later than January 1, 2021, adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(E)The conditions under which an insurer providing workers compensation coverage may access information in CURES for purposes of reviewing a workers compensation claim, which shall at a minimum prohibit an insurer from using information obtained from the CURES database as the sole factor in evaluating a claim for approval or denial.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15 respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department as soon as reasonably possible, but not more than one working day after the date a controlled substance is dispensed, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.
11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.
(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.
(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.
(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.
(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.
(3) The department shall, no later than January 1, 2021, adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:
(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.
(B) The purposes for which a health care practitioner may access information in CURES.
(C) The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.
(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.
(E)The conditions under which an insurer providing workers compensation coverage may access information in CURES for purposes of reviewing a workers compensation claim, which shall at a minimum prohibit an insurer from using information obtained from the CURES database as the sole factor in evaluating a claim for approval or denial.
(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.
(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15 respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department as soon as reasonably possible, but not more than one working day after the date a controlled substance is dispensed, in a format specified by the department:
(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.
(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.
(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.
(4) National Drug Code (NDC) number of the controlled substance dispensed.
(5) Quantity of the controlled substance dispensed.
(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.
(7) Number of refills ordered.
(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.
(9) Prescribing date of the prescription.
(10) Date of dispensing of the prescription.
(11) The serial number for the corresponding prescription form, if applicable.
(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.
(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).
(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.
(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information.
(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.
(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.
(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.
(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).
(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.
SEC. 4. Section 11165.1 of the Health and Safety Code is amended to read:11165.1. (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 shall, upon receipt of a federal Drug Enforcement Administration (DEA) registration, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the practitioner or their delegate the electronic history of controlled substances dispensed to an individual under the practitioners care based on data contained in the CURES Prescription Drug Monitoring Program (PDMP).(ii) A pharmacist shall, upon licensure, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the pharmacist or their delegate the electronic history of controlled substances dispensed to an individual under the pharmacists care based on data contained in the CURES PDMP.(iii) A licensed physician and surgeon who does not hold a DEA registration may submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of the patient that is maintained by the department. Upon approval, the department shall release to the physician and surgeon or their delegate the electronic history of controlled substances dispensed to a patient under their care based on data contained in the CURES PDMP.(B) The department may deny an application or suspend a subscriber, for reasons which include, but are not limited to, the following:(i) Materially falsifying an application to access information contained in the CURES database.(ii) Failing to maintain effective controls for access to the patient activity report.(iii) Having their federal DEA registration suspended or revoked.(iv) Violating a law governing controlled substances or another law for which the possession or use of a controlled substance is an element of the crime.(v) Accessing information for a reason other than to diagnose or treat a patient, or to document compliance with the law.(C) An authorized subscriber shall notify the department within 30 days of a change to the subscriber account.(D) An approved health care practitioner, pharmacist, or a person acting on behalf of a health care practitioner or pharmacist pursuant to subdivision (b) of Section 209 of the Business and Professions Code may use the departments online portal or a health information technology system that meets the criteria required in subparagraph (E) to access information in the CURES database pursuant to this section. A subscriber who uses a health information technology system that meets the criteria required in subparagraph (E) to access the CURES database may submit automated queries to the CURES database that are triggered by predetermined criteria.(E) An approved health care practitioner or pharmacist may submit queries to the CURES database through a health information technology system if the entity that operates the health information technology system certifies all of the following:(i) The entity will not use or disclose data received from the CURES database for a purpose other than delivering the data to an approved health care practitioner or pharmacist or performing data processing activities that may be necessary to enable the delivery unless authorized by, and pursuant to, state and federal privacy and security laws and regulations.(ii) The health information technology system will authenticate the identity of an authorized health care practitioner or pharmacist initiating queries to the CURES database and, at the time of the query to the CURES database, the health information technology system submits the following data regarding the query to CURES:(I) The date of the query.(II) The time of the query.(III) The first and last name of the patient queried.(IV) The date of birth of the patient queried.(V) The identification of the CURES user for whom the system is making the query.(iii) The health information technology system meets applicable patient privacy and information security requirements of state and federal law.(iv) The entity has entered into a memorandum of understanding with the department that solely addresses the technical specifications of the health information technology system to ensure the security of the data in the CURES database and the secure transfer of data from the CURES database. The technical specifications shall be universal for all health information technology systems that establish a method of system integration to retrieve information from the CURES database. The memorandum of understanding shall not govern, or in any way impact or restrict, the use of data received from the CURES database or impose any additional burdens on covered entities in compliance with the regulations promulgated pursuant to the federal Health Insurance Portability and Accountability Act of 1996 found in Parts 160 and 164 of Title 45 of the Code of Federal Regulations.(F) No later than October 1, 2018, the department shall develop a programming interface or other method of system integration to allow health information technology systems that meet the requirements in subparagraph (E) to retrieve information in the CURES database on behalf of an authorized health care practitioner or pharmacist.(G) The department shall not access patient-identifiable information in an entitys health information technology system.(H) An entity that operates a health information technology system that is requesting to establish an integration with the CURES database shall pay a reasonable fee to cover the cost of establishing and maintaining integration with the CURES database.(I) The department may prohibit integration or terminate a health information technology systems ability to retrieve information in the CURES database if the health information technology system fails to meet the requirements of subparagraph (E), or the entity operating the health information technology system does not fulfill its obligation under subparagraph (H).(2) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 or a pharmacist shall be deemed to have complied with paragraph (1) if the licensed health care practitioner or pharmacist has been approved to access the CURES database through the process developed pursuant to subdivision (a) of Section 209 of the Business and Professions Code.(b) A request for, or release of, a controlled substance history pursuant to this section shall be made in accordance with guidelines developed by the department.(c) In order to prevent the inappropriate, improper, or illegal use of Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances, the department may initiate the referral of the history of controlled substances dispensed to an individual based on data contained in CURES to licensed health care practitioners, pharmacists, or both, providing care or services to the individual.(d) The history of controlled substances dispensed to an individual based on data contained in CURES that is received by a practitioner or pharmacist from the department pursuant to this section is medical information subject to the provisions of the Confidentiality of Medical Information Act contained in Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code.(e) Information concerning a patients controlled substance history provided to a practitioner or pharmacist pursuant to this section shall include prescriptions for controlled substances listed in Sections 1308.12, 1308.13, 1308.14, and 1308.15 of Title 21 of the Code of Federal Regulations.(f) A health care practitioner, pharmacist, or a person acting on behalf of a health care practitioner or pharmacist, when acting with reasonable care and in good faith, is not subject to civil or administrative liability arising from false, incomplete, inaccurate, or misattributed information submitted to, reported by, or relied upon in the CURES database or for a resulting failure of the CURES database to accurately or timely report that information.(g) For purposes of this section, the following terms have the following meanings:(1) Automated basis means using predefined criteria to trigger an automated query to the CURES database, which can be attributed to a specific health care practitioner or pharmacist.(2) Department means the Department of Justice.(3) Entity means an organization that operates, or provides or makes available, a health information technology system to a health care practitioner or pharmacist.(4) Health information technology system means an information processing application using hardware and software for the storage, retrieval, sharing of or use of patient data for communication, decisionmaking, coordination of care, or the quality, safety, or efficiency of the practice of medicine or delivery of health care services, including, but not limited to, electronic medical record applications, health information exchange systems, or other interoperable clinical or health care information system.
SEC. 4. Section 11165.1 of the Health and Safety Code is amended to read:
### SEC. 4.
11165.1. (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 shall, upon receipt of a federal Drug Enforcement Administration (DEA) registration, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the practitioner or their delegate the electronic history of controlled substances dispensed to an individual under the practitioners care based on data contained in the CURES Prescription Drug Monitoring Program (PDMP).(ii) A pharmacist shall, upon licensure, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the pharmacist or their delegate the electronic history of controlled substances dispensed to an individual under the pharmacists care based on data contained in the CURES PDMP.(iii) A licensed physician and surgeon who does not hold a DEA registration may submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of the patient that is maintained by the department. Upon approval, the department shall release to the physician and surgeon or their delegate the electronic history of controlled substances dispensed to a patient under their care based on data contained in the CURES PDMP.(B) The department may deny an application or suspend a subscriber, for reasons which include, but are not limited to, the following:(i) Materially falsifying an application to access information contained in the CURES database.(ii) Failing to maintain effective controls for access to the patient activity report.(iii) Having their federal DEA registration suspended or revoked.(iv) Violating a law governing controlled substances or another law for which the possession or use of a controlled substance is an element of the crime.(v) Accessing information for a reason other than to diagnose or treat a patient, or to document compliance with the law.(C) An authorized subscriber shall notify the department within 30 days of a change to the subscriber account.(D) An approved health care practitioner, pharmacist, or a person acting on behalf of a health care practitioner or pharmacist pursuant to subdivision (b) of Section 209 of the Business and Professions Code may use the departments online portal or a health information technology system that meets the criteria required in subparagraph (E) to access information in the CURES database pursuant to this section. A subscriber who uses a health information technology system that meets the criteria required in subparagraph (E) to access the CURES database may submit automated queries to the CURES database that are triggered by predetermined criteria.(E) An approved health care practitioner or pharmacist may submit queries to the CURES database through a health information technology system if the entity that operates the health information technology system certifies all of the following:(i) The entity will not use or disclose data received from the CURES database for a purpose other than delivering the data to an approved health care practitioner or pharmacist or performing data processing activities that may be necessary to enable the delivery unless authorized by, and pursuant to, state and federal privacy and security laws and regulations.(ii) The health information technology system will authenticate the identity of an authorized health care practitioner or pharmacist initiating queries to the CURES database and, at the time of the query to the CURES database, the health information technology system submits the following data regarding the query to CURES:(I) The date of the query.(II) The time of the query.(III) The first and last name of the patient queried.(IV) The date of birth of the patient queried.(V) The identification of the CURES user for whom the system is making the query.(iii) The health information technology system meets applicable patient privacy and information security requirements of state and federal law.(iv) The entity has entered into a memorandum of understanding with the department that solely addresses the technical specifications of the health information technology system to ensure the security of the data in the CURES database and the secure transfer of data from the CURES database. The technical specifications shall be universal for all health information technology systems that establish a method of system integration to retrieve information from the CURES database. The memorandum of understanding shall not govern, or in any way impact or restrict, the use of data received from the CURES database or impose any additional burdens on covered entities in compliance with the regulations promulgated pursuant to the federal Health Insurance Portability and Accountability Act of 1996 found in Parts 160 and 164 of Title 45 of the Code of Federal Regulations.(F) No later than October 1, 2018, the department shall develop a programming interface or other method of system integration to allow health information technology systems that meet the requirements in subparagraph (E) to retrieve information in the CURES database on behalf of an authorized health care practitioner or pharmacist.(G) The department shall not access patient-identifiable information in an entitys health information technology system.(H) An entity that operates a health information technology system that is requesting to establish an integration with the CURES database shall pay a reasonable fee to cover the cost of establishing and maintaining integration with the CURES database.(I) The department may prohibit integration or terminate a health information technology systems ability to retrieve information in the CURES database if the health information technology system fails to meet the requirements of subparagraph (E), or the entity operating the health information technology system does not fulfill its obligation under subparagraph (H).(2) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 or a pharmacist shall be deemed to have complied with paragraph (1) if the licensed health care practitioner or pharmacist has been approved to access the CURES database through the process developed pursuant to subdivision (a) of Section 209 of the Business and Professions Code.(b) A request for, or release of, a controlled substance history pursuant to this section shall be made in accordance with guidelines developed by the department.(c) In order to prevent the inappropriate, improper, or illegal use of Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances, the department may initiate the referral of the history of controlled substances dispensed to an individual based on data contained in CURES to licensed health care practitioners, pharmacists, or both, providing care or services to the individual.(d) The history of controlled substances dispensed to an individual based on data contained in CURES that is received by a practitioner or pharmacist from the department pursuant to this section is medical information subject to the provisions of the Confidentiality of Medical Information Act contained in Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code.(e) Information concerning a patients controlled substance history provided to a practitioner or pharmacist pursuant to this section shall include prescriptions for controlled substances listed in Sections 1308.12, 1308.13, 1308.14, and 1308.15 of Title 21 of the Code of Federal Regulations.(f) A health care practitioner, pharmacist, or a person acting on behalf of a health care practitioner or pharmacist, when acting with reasonable care and in good faith, is not subject to civil or administrative liability arising from false, incomplete, inaccurate, or misattributed information submitted to, reported by, or relied upon in the CURES database or for a resulting failure of the CURES database to accurately or timely report that information.(g) For purposes of this section, the following terms have the following meanings:(1) Automated basis means using predefined criteria to trigger an automated query to the CURES database, which can be attributed to a specific health care practitioner or pharmacist.(2) Department means the Department of Justice.(3) Entity means an organization that operates, or provides or makes available, a health information technology system to a health care practitioner or pharmacist.(4) Health information technology system means an information processing application using hardware and software for the storage, retrieval, sharing of or use of patient data for communication, decisionmaking, coordination of care, or the quality, safety, or efficiency of the practice of medicine or delivery of health care services, including, but not limited to, electronic medical record applications, health information exchange systems, or other interoperable clinical or health care information system.
11165.1. (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 shall, upon receipt of a federal Drug Enforcement Administration (DEA) registration, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the practitioner or their delegate the electronic history of controlled substances dispensed to an individual under the practitioners care based on data contained in the CURES Prescription Drug Monitoring Program (PDMP).(ii) A pharmacist shall, upon licensure, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the pharmacist or their delegate the electronic history of controlled substances dispensed to an individual under the pharmacists care based on data contained in the CURES PDMP.(iii) A licensed physician and surgeon who does not hold a DEA registration may submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of the patient that is maintained by the department. Upon approval, the department shall release to the physician and surgeon or their delegate the electronic history of controlled substances dispensed to a patient under their care based on data contained in the CURES PDMP.(B) The department may deny an application or suspend a subscriber, for reasons which include, but are not limited to, the following:(i) Materially falsifying an application to access information contained in the CURES database.(ii) Failing to maintain effective controls for access to the patient activity report.(iii) Having their federal DEA registration suspended or revoked.(iv) Violating a law governing controlled substances or another law for which the possession or use of a controlled substance is an element of the crime.(v) Accessing information for a reason other than to diagnose or treat a patient, or to document compliance with the law.(C) An authorized subscriber shall notify the department within 30 days of a change to the subscriber account.(D) An approved health care practitioner, pharmacist, or a person acting on behalf of a health care practitioner or pharmacist pursuant to subdivision (b) of Section 209 of the Business and Professions Code may use the departments online portal or a health information technology system that meets the criteria required in subparagraph (E) to access information in the CURES database pursuant to this section. A subscriber who uses a health information technology system that meets the criteria required in subparagraph (E) to access the CURES database may submit automated queries to the CURES database that are triggered by predetermined criteria.(E) An approved health care practitioner or pharmacist may submit queries to the CURES database through a health information technology system if the entity that operates the health information technology system certifies all of the following:(i) The entity will not use or disclose data received from the CURES database for a purpose other than delivering the data to an approved health care practitioner or pharmacist or performing data processing activities that may be necessary to enable the delivery unless authorized by, and pursuant to, state and federal privacy and security laws and regulations.(ii) The health information technology system will authenticate the identity of an authorized health care practitioner or pharmacist initiating queries to the CURES database and, at the time of the query to the CURES database, the health information technology system submits the following data regarding the query to CURES:(I) The date of the query.(II) The time of the query.(III) The first and last name of the patient queried.(IV) The date of birth of the patient queried.(V) The identification of the CURES user for whom the system is making the query.(iii) The health information technology system meets applicable patient privacy and information security requirements of state and federal law.(iv) The entity has entered into a memorandum of understanding with the department that solely addresses the technical specifications of the health information technology system to ensure the security of the data in the CURES database and the secure transfer of data from the CURES database. The technical specifications shall be universal for all health information technology systems that establish a method of system integration to retrieve information from the CURES database. The memorandum of understanding shall not govern, or in any way impact or restrict, the use of data received from the CURES database or impose any additional burdens on covered entities in compliance with the regulations promulgated pursuant to the federal Health Insurance Portability and Accountability Act of 1996 found in Parts 160 and 164 of Title 45 of the Code of Federal Regulations.(F) No later than October 1, 2018, the department shall develop a programming interface or other method of system integration to allow health information technology systems that meet the requirements in subparagraph (E) to retrieve information in the CURES database on behalf of an authorized health care practitioner or pharmacist.(G) The department shall not access patient-identifiable information in an entitys health information technology system.(H) An entity that operates a health information technology system that is requesting to establish an integration with the CURES database shall pay a reasonable fee to cover the cost of establishing and maintaining integration with the CURES database.(I) The department may prohibit integration or terminate a health information technology systems ability to retrieve information in the CURES database if the health information technology system fails to meet the requirements of subparagraph (E), or the entity operating the health information technology system does not fulfill its obligation under subparagraph (H).(2) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 or a pharmacist shall be deemed to have complied with paragraph (1) if the licensed health care practitioner or pharmacist has been approved to access the CURES database through the process developed pursuant to subdivision (a) of Section 209 of the Business and Professions Code.(b) A request for, or release of, a controlled substance history pursuant to this section shall be made in accordance with guidelines developed by the department.(c) In order to prevent the inappropriate, improper, or illegal use of Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances, the department may initiate the referral of the history of controlled substances dispensed to an individual based on data contained in CURES to licensed health care practitioners, pharmacists, or both, providing care or services to the individual.(d) The history of controlled substances dispensed to an individual based on data contained in CURES that is received by a practitioner or pharmacist from the department pursuant to this section is medical information subject to the provisions of the Confidentiality of Medical Information Act contained in Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code.(e) Information concerning a patients controlled substance history provided to a practitioner or pharmacist pursuant to this section shall include prescriptions for controlled substances listed in Sections 1308.12, 1308.13, 1308.14, and 1308.15 of Title 21 of the Code of Federal Regulations.(f) A health care practitioner, pharmacist, or a person acting on behalf of a health care practitioner or pharmacist, when acting with reasonable care and in good faith, is not subject to civil or administrative liability arising from false, incomplete, inaccurate, or misattributed information submitted to, reported by, or relied upon in the CURES database or for a resulting failure of the CURES database to accurately or timely report that information.(g) For purposes of this section, the following terms have the following meanings:(1) Automated basis means using predefined criteria to trigger an automated query to the CURES database, which can be attributed to a specific health care practitioner or pharmacist.(2) Department means the Department of Justice.(3) Entity means an organization that operates, or provides or makes available, a health information technology system to a health care practitioner or pharmacist.(4) Health information technology system means an information processing application using hardware and software for the storage, retrieval, sharing of or use of patient data for communication, decisionmaking, coordination of care, or the quality, safety, or efficiency of the practice of medicine or delivery of health care services, including, but not limited to, electronic medical record applications, health information exchange systems, or other interoperable clinical or health care information system.
11165.1. (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 shall, upon receipt of a federal Drug Enforcement Administration (DEA) registration, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the practitioner or their delegate the electronic history of controlled substances dispensed to an individual under the practitioners care based on data contained in the CURES Prescription Drug Monitoring Program (PDMP).(ii) A pharmacist shall, upon licensure, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the pharmacist or their delegate the electronic history of controlled substances dispensed to an individual under the pharmacists care based on data contained in the CURES PDMP.(iii) A licensed physician and surgeon who does not hold a DEA registration may submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of the patient that is maintained by the department. Upon approval, the department shall release to the physician and surgeon or their delegate the electronic history of controlled substances dispensed to a patient under their care based on data contained in the CURES PDMP.(B) The department may deny an application or suspend a subscriber, for reasons which include, but are not limited to, the following:(i) Materially falsifying an application to access information contained in the CURES database.(ii) Failing to maintain effective controls for access to the patient activity report.(iii) Having their federal DEA registration suspended or revoked.(iv) Violating a law governing controlled substances or another law for which the possession or use of a controlled substance is an element of the crime.(v) Accessing information for a reason other than to diagnose or treat a patient, or to document compliance with the law.(C) An authorized subscriber shall notify the department within 30 days of a change to the subscriber account.(D) An approved health care practitioner, pharmacist, or a person acting on behalf of a health care practitioner or pharmacist pursuant to subdivision (b) of Section 209 of the Business and Professions Code may use the departments online portal or a health information technology system that meets the criteria required in subparagraph (E) to access information in the CURES database pursuant to this section. A subscriber who uses a health information technology system that meets the criteria required in subparagraph (E) to access the CURES database may submit automated queries to the CURES database that are triggered by predetermined criteria.(E) An approved health care practitioner or pharmacist may submit queries to the CURES database through a health information technology system if the entity that operates the health information technology system certifies all of the following:(i) The entity will not use or disclose data received from the CURES database for a purpose other than delivering the data to an approved health care practitioner or pharmacist or performing data processing activities that may be necessary to enable the delivery unless authorized by, and pursuant to, state and federal privacy and security laws and regulations.(ii) The health information technology system will authenticate the identity of an authorized health care practitioner or pharmacist initiating queries to the CURES database and, at the time of the query to the CURES database, the health information technology system submits the following data regarding the query to CURES:(I) The date of the query.(II) The time of the query.(III) The first and last name of the patient queried.(IV) The date of birth of the patient queried.(V) The identification of the CURES user for whom the system is making the query.(iii) The health information technology system meets applicable patient privacy and information security requirements of state and federal law.(iv) The entity has entered into a memorandum of understanding with the department that solely addresses the technical specifications of the health information technology system to ensure the security of the data in the CURES database and the secure transfer of data from the CURES database. The technical specifications shall be universal for all health information technology systems that establish a method of system integration to retrieve information from the CURES database. The memorandum of understanding shall not govern, or in any way impact or restrict, the use of data received from the CURES database or impose any additional burdens on covered entities in compliance with the regulations promulgated pursuant to the federal Health Insurance Portability and Accountability Act of 1996 found in Parts 160 and 164 of Title 45 of the Code of Federal Regulations.(F) No later than October 1, 2018, the department shall develop a programming interface or other method of system integration to allow health information technology systems that meet the requirements in subparagraph (E) to retrieve information in the CURES database on behalf of an authorized health care practitioner or pharmacist.(G) The department shall not access patient-identifiable information in an entitys health information technology system.(H) An entity that operates a health information technology system that is requesting to establish an integration with the CURES database shall pay a reasonable fee to cover the cost of establishing and maintaining integration with the CURES database.(I) The department may prohibit integration or terminate a health information technology systems ability to retrieve information in the CURES database if the health information technology system fails to meet the requirements of subparagraph (E), or the entity operating the health information technology system does not fulfill its obligation under subparagraph (H).(2) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 or a pharmacist shall be deemed to have complied with paragraph (1) if the licensed health care practitioner or pharmacist has been approved to access the CURES database through the process developed pursuant to subdivision (a) of Section 209 of the Business and Professions Code.(b) A request for, or release of, a controlled substance history pursuant to this section shall be made in accordance with guidelines developed by the department.(c) In order to prevent the inappropriate, improper, or illegal use of Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances, the department may initiate the referral of the history of controlled substances dispensed to an individual based on data contained in CURES to licensed health care practitioners, pharmacists, or both, providing care or services to the individual.(d) The history of controlled substances dispensed to an individual based on data contained in CURES that is received by a practitioner or pharmacist from the department pursuant to this section is medical information subject to the provisions of the Confidentiality of Medical Information Act contained in Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code.(e) Information concerning a patients controlled substance history provided to a practitioner or pharmacist pursuant to this section shall include prescriptions for controlled substances listed in Sections 1308.12, 1308.13, 1308.14, and 1308.15 of Title 21 of the Code of Federal Regulations.(f) A health care practitioner, pharmacist, or a person acting on behalf of a health care practitioner or pharmacist, when acting with reasonable care and in good faith, is not subject to civil or administrative liability arising from false, incomplete, inaccurate, or misattributed information submitted to, reported by, or relied upon in the CURES database or for a resulting failure of the CURES database to accurately or timely report that information.(g) For purposes of this section, the following terms have the following meanings:(1) Automated basis means using predefined criteria to trigger an automated query to the CURES database, which can be attributed to a specific health care practitioner or pharmacist.(2) Department means the Department of Justice.(3) Entity means an organization that operates, or provides or makes available, a health information technology system to a health care practitioner or pharmacist.(4) Health information technology system means an information processing application using hardware and software for the storage, retrieval, sharing of or use of patient data for communication, decisionmaking, coordination of care, or the quality, safety, or efficiency of the practice of medicine or delivery of health care services, including, but not limited to, electronic medical record applications, health information exchange systems, or other interoperable clinical or health care information system.
11165.1. (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 shall, upon receipt of a federal Drug Enforcement Administration (DEA) registration, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the practitioner or their delegate the electronic history of controlled substances dispensed to an individual under the practitioners care based on data contained in the CURES Prescription Drug Monitoring Program (PDMP).
(ii) A pharmacist shall, upon licensure, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the pharmacist or their delegate the electronic history of controlled substances dispensed to an individual under the pharmacists care based on data contained in the CURES PDMP.
(iii) A licensed physician and surgeon who does not hold a DEA registration may submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of the patient that is maintained by the department. Upon approval, the department shall release to the physician and surgeon or their delegate the electronic history of controlled substances dispensed to a patient under their care based on data contained in the CURES PDMP.
(B) The department may deny an application or suspend a subscriber, for reasons which include, but are not limited to, the following:
(i) Materially falsifying an application to access information contained in the CURES database.
(ii) Failing to maintain effective controls for access to the patient activity report.
(iii) Having their federal DEA registration suspended or revoked.
(iv) Violating a law governing controlled substances or another law for which the possession or use of a controlled substance is an element of the crime.
(v) Accessing information for a reason other than to diagnose or treat a patient, or to document compliance with the law.
(C) An authorized subscriber shall notify the department within 30 days of a change to the subscriber account.
(D) An approved health care practitioner, pharmacist, or a person acting on behalf of a health care practitioner or pharmacist pursuant to subdivision (b) of Section 209 of the Business and Professions Code may use the departments online portal or a health information technology system that meets the criteria required in subparagraph (E) to access information in the CURES database pursuant to this section. A subscriber who uses a health information technology system that meets the criteria required in subparagraph (E) to access the CURES database may submit automated queries to the CURES database that are triggered by predetermined criteria.
(E) An approved health care practitioner or pharmacist may submit queries to the CURES database through a health information technology system if the entity that operates the health information technology system certifies all of the following:
(i) The entity will not use or disclose data received from the CURES database for a purpose other than delivering the data to an approved health care practitioner or pharmacist or performing data processing activities that may be necessary to enable the delivery unless authorized by, and pursuant to, state and federal privacy and security laws and regulations.
(ii) The health information technology system will authenticate the identity of an authorized health care practitioner or pharmacist initiating queries to the CURES database and, at the time of the query to the CURES database, the health information technology system submits the following data regarding the query to CURES:
(I) The date of the query.
(II) The time of the query.
(III) The first and last name of the patient queried.
(IV) The date of birth of the patient queried.
(V) The identification of the CURES user for whom the system is making the query.
(iii) The health information technology system meets applicable patient privacy and information security requirements of state and federal law.
(iv) The entity has entered into a memorandum of understanding with the department that solely addresses the technical specifications of the health information technology system to ensure the security of the data in the CURES database and the secure transfer of data from the CURES database. The technical specifications shall be universal for all health information technology systems that establish a method of system integration to retrieve information from the CURES database. The memorandum of understanding shall not govern, or in any way impact or restrict, the use of data received from the CURES database or impose any additional burdens on covered entities in compliance with the regulations promulgated pursuant to the federal Health Insurance Portability and Accountability Act of 1996 found in Parts 160 and 164 of Title 45 of the Code of Federal Regulations.
(F) No later than October 1, 2018, the department shall develop a programming interface or other method of system integration to allow health information technology systems that meet the requirements in subparagraph (E) to retrieve information in the CURES database on behalf of an authorized health care practitioner or pharmacist.
(G) The department shall not access patient-identifiable information in an entitys health information technology system.
(H) An entity that operates a health information technology system that is requesting to establish an integration with the CURES database shall pay a reasonable fee to cover the cost of establishing and maintaining integration with the CURES database.
(I) The department may prohibit integration or terminate a health information technology systems ability to retrieve information in the CURES database if the health information technology system fails to meet the requirements of subparagraph (E), or the entity operating the health information technology system does not fulfill its obligation under subparagraph (H).
(2) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 or a pharmacist shall be deemed to have complied with paragraph (1) if the licensed health care practitioner or pharmacist has been approved to access the CURES database through the process developed pursuant to subdivision (a) of Section 209 of the Business and Professions Code.
(b) A request for, or release of, a controlled substance history pursuant to this section shall be made in accordance with guidelines developed by the department.
(c) In order to prevent the inappropriate, improper, or illegal use of Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances, the department may initiate the referral of the history of controlled substances dispensed to an individual based on data contained in CURES to licensed health care practitioners, pharmacists, or both, providing care or services to the individual.
(d) The history of controlled substances dispensed to an individual based on data contained in CURES that is received by a practitioner or pharmacist from the department pursuant to this section is medical information subject to the provisions of the Confidentiality of Medical Information Act contained in Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code.
(e) Information concerning a patients controlled substance history provided to a practitioner or pharmacist pursuant to this section shall include prescriptions for controlled substances listed in Sections 1308.12, 1308.13, 1308.14, and 1308.15 of Title 21 of the Code of Federal Regulations.
(f) A health care practitioner, pharmacist, or a person acting on behalf of a health care practitioner or pharmacist, when acting with reasonable care and in good faith, is not subject to civil or administrative liability arising from false, incomplete, inaccurate, or misattributed information submitted to, reported by, or relied upon in the CURES database or for a resulting failure of the CURES database to accurately or timely report that information.
(g) For purposes of this section, the following terms have the following meanings:
(1) Automated basis means using predefined criteria to trigger an automated query to the CURES database, which can be attributed to a specific health care practitioner or pharmacist.
(2) Department means the Department of Justice.
(3) Entity means an organization that operates, or provides or makes available, a health information technology system to a health care practitioner or pharmacist.
(4) Health information technology system means an information processing application using hardware and software for the storage, retrieval, sharing of or use of patient data for communication, decisionmaking, coordination of care, or the quality, safety, or efficiency of the practice of medicine or delivery of health care services, including, but not limited to, electronic medical record applications, health information exchange systems, or other interoperable clinical or health care information system.
SEC. 5. Section 11165.4 of the Health and Safety Code is amended to read:11165.4. (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance shall consult the patient activity report or information from the patient activity report obtained from the CURES database to review a patients controlled substance history for the past 12 months before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every six months thereafter if the substance remains part of the treatment of the patient. A health care practitioner shall document that they consulted the patients controlled substance history in the patients medical record if that health care practitioner was not the practitioner that accessed the patient activity report from the CURES database.(ii) If a health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance is not required, pursuant to an exemption described in subdivision (c), to consult the patient activity report from the CURES database the first time the health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient, the health care practitioner shall consult the patient activity report from the CURES database to review the patients controlled substance history before subsequently prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient and at least once every six months thereafter if the prescriber renews the prescription and the substance remains part of the treatment of the patient.(B) For purposes of this paragraph, first time means the initial occurrence in which a health care practitioner, in their role as a health care practitioner, intends to prescribe, order, administer, or furnish a Schedule II, Schedule III, or Schedule IV controlled substance to a patient and has not previously prescribed a controlled substance to the patient.(2) A health care practitioner shall review a patients controlled substance history that has been obtained from the CURES database no earlier than 24 hours, or the previous business day, before the health care practitioner prescribes, orders, administers, or furnishes a Schedule II, Schedule III, or Schedule IV controlled substance to the patient.(b) The duty to consult the CURES database, as described in subdivision (a), does not apply to veterinarians or pharmacists.(c) The duty to consult the CURES database, as described in subdivision (a), does not apply to a health care practitioner in any of the following circumstances:(1) If a health care practitioner prescribes, orders, or furnishes a controlled substance to be administered to a patient in any of the following facilities or during a transfer between any of the following facilities, or for use while on facility premises:(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.(E) Another medical facility, including, but not limited to, an office of a health care practitioner and an imaging center.(2) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance in the emergency department of a general acute care hospital and the quantity of the controlled substance does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use.(3) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient as part of the patients treatment for a surgical, radiotherapeutic, or diagnostic procedure and the quantity of the controlled substance does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use, in any of the following facilities:(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.(E) A place of practice, as defined in Section 1658 of the Business and Professions Code.(F) Another medical facility where surgical procedures are permitted to take place, including, but not limited to, the office of a health care practitioner.(4) If a health care practitioner is a designated practitioner serving in the absence of the patients physician and surgeon and orders a renewal request of a medically indicated controlled substance prescription for an amount not exceeding the original prescription strength or amount or for more than one refill pursuant to paragraph (3) of subdivision (b) of Section 2242 of the Business and Professions Code.(5) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient who is terminally ill, as defined in subdivision (c) of Section 11159.2.(6) (A) If all of the following circumstances are satisfied:(i) It is not reasonably possible for a health care practitioner to access the information in the CURES database in a timely manner.(ii) Another health care practitioner or designee authorized to access the CURES database is not reasonably available.(iii) The quantity of controlled substance prescribed, ordered, administered, or furnished does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use and no refill of the controlled substance is allowed.(B) A health care practitioner who does not consult the CURES database under subparagraph (A) shall document the reason they did not consult the database in the patients medical record.(7) If the CURES database is not operational, as determined by the department, or when it cannot be accessed by a health care practitioner because of a temporary technological or electrical failure. A health care practitioner shall, without undue delay, seek to correct the cause of the temporary technological or electrical failure that is reasonably within the health care practitioners control.(8) If the CURES database cannot be accessed because of technological limitations that are not reasonably within the control of a health care practitioner.(9) If consultation of the CURES database would, as determined by the health care practitioner, result in a patients inability to obtain a prescription in a timely manner and thereby adversely impact the patients medical condition, provided that the quantity of the controlled substance does not exceed a nonrefillable seven-day supply if the controlled substance were used in accordance with the directions for use.(d) (1) A health care practitioner who fails to consult the CURES database, as described in subdivision (a), shall be referred to the appropriate state professional licensing board solely for administrative sanctions, as deemed appropriate by that board.(2) This section does not create a private cause of action against a health care practitioner. This section does not limit a health care practitioners liability for the negligent failure to diagnose or treat a patient.(e) All applicable state and federal privacy laws govern the duties required by this section.(f) The provisions of this section are severable. If any provision of this section or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
SEC. 5. Section 11165.4 of the Health and Safety Code is amended to read:
### SEC. 5.
11165.4. (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance shall consult the patient activity report or information from the patient activity report obtained from the CURES database to review a patients controlled substance history for the past 12 months before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every six months thereafter if the substance remains part of the treatment of the patient. A health care practitioner shall document that they consulted the patients controlled substance history in the patients medical record if that health care practitioner was not the practitioner that accessed the patient activity report from the CURES database.(ii) If a health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance is not required, pursuant to an exemption described in subdivision (c), to consult the patient activity report from the CURES database the first time the health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient, the health care practitioner shall consult the patient activity report from the CURES database to review the patients controlled substance history before subsequently prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient and at least once every six months thereafter if the prescriber renews the prescription and the substance remains part of the treatment of the patient.(B) For purposes of this paragraph, first time means the initial occurrence in which a health care practitioner, in their role as a health care practitioner, intends to prescribe, order, administer, or furnish a Schedule II, Schedule III, or Schedule IV controlled substance to a patient and has not previously prescribed a controlled substance to the patient.(2) A health care practitioner shall review a patients controlled substance history that has been obtained from the CURES database no earlier than 24 hours, or the previous business day, before the health care practitioner prescribes, orders, administers, or furnishes a Schedule II, Schedule III, or Schedule IV controlled substance to the patient.(b) The duty to consult the CURES database, as described in subdivision (a), does not apply to veterinarians or pharmacists.(c) The duty to consult the CURES database, as described in subdivision (a), does not apply to a health care practitioner in any of the following circumstances:(1) If a health care practitioner prescribes, orders, or furnishes a controlled substance to be administered to a patient in any of the following facilities or during a transfer between any of the following facilities, or for use while on facility premises:(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.(E) Another medical facility, including, but not limited to, an office of a health care practitioner and an imaging center.(2) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance in the emergency department of a general acute care hospital and the quantity of the controlled substance does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use.(3) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient as part of the patients treatment for a surgical, radiotherapeutic, or diagnostic procedure and the quantity of the controlled substance does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use, in any of the following facilities:(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.(E) A place of practice, as defined in Section 1658 of the Business and Professions Code.(F) Another medical facility where surgical procedures are permitted to take place, including, but not limited to, the office of a health care practitioner.(4) If a health care practitioner is a designated practitioner serving in the absence of the patients physician and surgeon and orders a renewal request of a medically indicated controlled substance prescription for an amount not exceeding the original prescription strength or amount or for more than one refill pursuant to paragraph (3) of subdivision (b) of Section 2242 of the Business and Professions Code.(5) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient who is terminally ill, as defined in subdivision (c) of Section 11159.2.(6) (A) If all of the following circumstances are satisfied:(i) It is not reasonably possible for a health care practitioner to access the information in the CURES database in a timely manner.(ii) Another health care practitioner or designee authorized to access the CURES database is not reasonably available.(iii) The quantity of controlled substance prescribed, ordered, administered, or furnished does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use and no refill of the controlled substance is allowed.(B) A health care practitioner who does not consult the CURES database under subparagraph (A) shall document the reason they did not consult the database in the patients medical record.(7) If the CURES database is not operational, as determined by the department, or when it cannot be accessed by a health care practitioner because of a temporary technological or electrical failure. A health care practitioner shall, without undue delay, seek to correct the cause of the temporary technological or electrical failure that is reasonably within the health care practitioners control.(8) If the CURES database cannot be accessed because of technological limitations that are not reasonably within the control of a health care practitioner.(9) If consultation of the CURES database would, as determined by the health care practitioner, result in a patients inability to obtain a prescription in a timely manner and thereby adversely impact the patients medical condition, provided that the quantity of the controlled substance does not exceed a nonrefillable seven-day supply if the controlled substance were used in accordance with the directions for use.(d) (1) A health care practitioner who fails to consult the CURES database, as described in subdivision (a), shall be referred to the appropriate state professional licensing board solely for administrative sanctions, as deemed appropriate by that board.(2) This section does not create a private cause of action against a health care practitioner. This section does not limit a health care practitioners liability for the negligent failure to diagnose or treat a patient.(e) All applicable state and federal privacy laws govern the duties required by this section.(f) The provisions of this section are severable. If any provision of this section or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
11165.4. (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance shall consult the patient activity report or information from the patient activity report obtained from the CURES database to review a patients controlled substance history for the past 12 months before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every six months thereafter if the substance remains part of the treatment of the patient. A health care practitioner shall document that they consulted the patients controlled substance history in the patients medical record if that health care practitioner was not the practitioner that accessed the patient activity report from the CURES database.(ii) If a health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance is not required, pursuant to an exemption described in subdivision (c), to consult the patient activity report from the CURES database the first time the health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient, the health care practitioner shall consult the patient activity report from the CURES database to review the patients controlled substance history before subsequently prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient and at least once every six months thereafter if the prescriber renews the prescription and the substance remains part of the treatment of the patient.(B) For purposes of this paragraph, first time means the initial occurrence in which a health care practitioner, in their role as a health care practitioner, intends to prescribe, order, administer, or furnish a Schedule II, Schedule III, or Schedule IV controlled substance to a patient and has not previously prescribed a controlled substance to the patient.(2) A health care practitioner shall review a patients controlled substance history that has been obtained from the CURES database no earlier than 24 hours, or the previous business day, before the health care practitioner prescribes, orders, administers, or furnishes a Schedule II, Schedule III, or Schedule IV controlled substance to the patient.(b) The duty to consult the CURES database, as described in subdivision (a), does not apply to veterinarians or pharmacists.(c) The duty to consult the CURES database, as described in subdivision (a), does not apply to a health care practitioner in any of the following circumstances:(1) If a health care practitioner prescribes, orders, or furnishes a controlled substance to be administered to a patient in any of the following facilities or during a transfer between any of the following facilities, or for use while on facility premises:(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.(E) Another medical facility, including, but not limited to, an office of a health care practitioner and an imaging center.(2) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance in the emergency department of a general acute care hospital and the quantity of the controlled substance does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use.(3) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient as part of the patients treatment for a surgical, radiotherapeutic, or diagnostic procedure and the quantity of the controlled substance does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use, in any of the following facilities:(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.(E) A place of practice, as defined in Section 1658 of the Business and Professions Code.(F) Another medical facility where surgical procedures are permitted to take place, including, but not limited to, the office of a health care practitioner.(4) If a health care practitioner is a designated practitioner serving in the absence of the patients physician and surgeon and orders a renewal request of a medically indicated controlled substance prescription for an amount not exceeding the original prescription strength or amount or for more than one refill pursuant to paragraph (3) of subdivision (b) of Section 2242 of the Business and Professions Code.(5) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient who is terminally ill, as defined in subdivision (c) of Section 11159.2.(6) (A) If all of the following circumstances are satisfied:(i) It is not reasonably possible for a health care practitioner to access the information in the CURES database in a timely manner.(ii) Another health care practitioner or designee authorized to access the CURES database is not reasonably available.(iii) The quantity of controlled substance prescribed, ordered, administered, or furnished does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use and no refill of the controlled substance is allowed.(B) A health care practitioner who does not consult the CURES database under subparagraph (A) shall document the reason they did not consult the database in the patients medical record.(7) If the CURES database is not operational, as determined by the department, or when it cannot be accessed by a health care practitioner because of a temporary technological or electrical failure. A health care practitioner shall, without undue delay, seek to correct the cause of the temporary technological or electrical failure that is reasonably within the health care practitioners control.(8) If the CURES database cannot be accessed because of technological limitations that are not reasonably within the control of a health care practitioner.(9) If consultation of the CURES database would, as determined by the health care practitioner, result in a patients inability to obtain a prescription in a timely manner and thereby adversely impact the patients medical condition, provided that the quantity of the controlled substance does not exceed a nonrefillable seven-day supply if the controlled substance were used in accordance with the directions for use.(d) (1) A health care practitioner who fails to consult the CURES database, as described in subdivision (a), shall be referred to the appropriate state professional licensing board solely for administrative sanctions, as deemed appropriate by that board.(2) This section does not create a private cause of action against a health care practitioner. This section does not limit a health care practitioners liability for the negligent failure to diagnose or treat a patient.(e) All applicable state and federal privacy laws govern the duties required by this section.(f) The provisions of this section are severable. If any provision of this section or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
11165.4. (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance shall consult the patient activity report or information from the patient activity report obtained from the CURES database to review a patients controlled substance history for the past 12 months before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every six months thereafter if the substance remains part of the treatment of the patient. A health care practitioner shall document that they consulted the patients controlled substance history in the patients medical record if that health care practitioner was not the practitioner that accessed the patient activity report from the CURES database.(ii) If a health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance is not required, pursuant to an exemption described in subdivision (c), to consult the patient activity report from the CURES database the first time the health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient, the health care practitioner shall consult the patient activity report from the CURES database to review the patients controlled substance history before subsequently prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient and at least once every six months thereafter if the prescriber renews the prescription and the substance remains part of the treatment of the patient.(B) For purposes of this paragraph, first time means the initial occurrence in which a health care practitioner, in their role as a health care practitioner, intends to prescribe, order, administer, or furnish a Schedule II, Schedule III, or Schedule IV controlled substance to a patient and has not previously prescribed a controlled substance to the patient.(2) A health care practitioner shall review a patients controlled substance history that has been obtained from the CURES database no earlier than 24 hours, or the previous business day, before the health care practitioner prescribes, orders, administers, or furnishes a Schedule II, Schedule III, or Schedule IV controlled substance to the patient.(b) The duty to consult the CURES database, as described in subdivision (a), does not apply to veterinarians or pharmacists.(c) The duty to consult the CURES database, as described in subdivision (a), does not apply to a health care practitioner in any of the following circumstances:(1) If a health care practitioner prescribes, orders, or furnishes a controlled substance to be administered to a patient in any of the following facilities or during a transfer between any of the following facilities, or for use while on facility premises:(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.(E) Another medical facility, including, but not limited to, an office of a health care practitioner and an imaging center.(2) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance in the emergency department of a general acute care hospital and the quantity of the controlled substance does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use.(3) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient as part of the patients treatment for a surgical, radiotherapeutic, or diagnostic procedure and the quantity of the controlled substance does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use, in any of the following facilities:(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.(E) A place of practice, as defined in Section 1658 of the Business and Professions Code.(F) Another medical facility where surgical procedures are permitted to take place, including, but not limited to, the office of a health care practitioner.(4) If a health care practitioner is a designated practitioner serving in the absence of the patients physician and surgeon and orders a renewal request of a medically indicated controlled substance prescription for an amount not exceeding the original prescription strength or amount or for more than one refill pursuant to paragraph (3) of subdivision (b) of Section 2242 of the Business and Professions Code.(5) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient who is terminally ill, as defined in subdivision (c) of Section 11159.2.(6) (A) If all of the following circumstances are satisfied:(i) It is not reasonably possible for a health care practitioner to access the information in the CURES database in a timely manner.(ii) Another health care practitioner or designee authorized to access the CURES database is not reasonably available.(iii) The quantity of controlled substance prescribed, ordered, administered, or furnished does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use and no refill of the controlled substance is allowed.(B) A health care practitioner who does not consult the CURES database under subparagraph (A) shall document the reason they did not consult the database in the patients medical record.(7) If the CURES database is not operational, as determined by the department, or when it cannot be accessed by a health care practitioner because of a temporary technological or electrical failure. A health care practitioner shall, without undue delay, seek to correct the cause of the temporary technological or electrical failure that is reasonably within the health care practitioners control.(8) If the CURES database cannot be accessed because of technological limitations that are not reasonably within the control of a health care practitioner.(9) If consultation of the CURES database would, as determined by the health care practitioner, result in a patients inability to obtain a prescription in a timely manner and thereby adversely impact the patients medical condition, provided that the quantity of the controlled substance does not exceed a nonrefillable seven-day supply if the controlled substance were used in accordance with the directions for use.(d) (1) A health care practitioner who fails to consult the CURES database, as described in subdivision (a), shall be referred to the appropriate state professional licensing board solely for administrative sanctions, as deemed appropriate by that board.(2) This section does not create a private cause of action against a health care practitioner. This section does not limit a health care practitioners liability for the negligent failure to diagnose or treat a patient.(e) All applicable state and federal privacy laws govern the duties required by this section.(f) The provisions of this section are severable. If any provision of this section or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
11165.4. (a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance shall consult the patient activity report or information from the patient activity report obtained from the CURES database to review a patients controlled substance history for the past 12 months before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every six months thereafter if the substance remains part of the treatment of the patient. A health care practitioner shall document that they consulted the patients controlled substance history in the patients medical record if that health care practitioner was not the practitioner that accessed the patient activity report from the CURES database.
(ii) If a health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance is not required, pursuant to an exemption described in subdivision (c), to consult the patient activity report from the CURES database the first time the health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient, the health care practitioner shall consult the patient activity report from the CURES database to review the patients controlled substance history before subsequently prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient and at least once every six months thereafter if the prescriber renews the prescription and the substance remains part of the treatment of the patient.
(B) For purposes of this paragraph, first time means the initial occurrence in which a health care practitioner, in their role as a health care practitioner, intends to prescribe, order, administer, or furnish a Schedule II, Schedule III, or Schedule IV controlled substance to a patient and has not previously prescribed a controlled substance to the patient.
(2) A health care practitioner shall review a patients controlled substance history that has been obtained from the CURES database no earlier than 24 hours, or the previous business day, before the health care practitioner prescribes, orders, administers, or furnishes a Schedule II, Schedule III, or Schedule IV controlled substance to the patient.
(b) The duty to consult the CURES database, as described in subdivision (a), does not apply to veterinarians or pharmacists.
(c) The duty to consult the CURES database, as described in subdivision (a), does not apply to a health care practitioner in any of the following circumstances:
(1) If a health care practitioner prescribes, orders, or furnishes a controlled substance to be administered to a patient in any of the following facilities or during a transfer between any of the following facilities, or for use while on facility premises:
(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.
(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.
(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.
(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.
(E) Another medical facility, including, but not limited to, an office of a health care practitioner and an imaging center.
(2) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance in the emergency department of a general acute care hospital and the quantity of the controlled substance does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use.
(3) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient as part of the patients treatment for a surgical, radiotherapeutic, or diagnostic procedure and the quantity of the controlled substance does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use, in any of the following facilities:
(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.
(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.
(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.
(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.
(E) A place of practice, as defined in Section 1658 of the Business and Professions Code.
(F) Another medical facility where surgical procedures are permitted to take place, including, but not limited to, the office of a health care practitioner.
(4) If a health care practitioner is a designated practitioner serving in the absence of the patients physician and surgeon and orders a renewal request of a medically indicated controlled substance prescription for an amount not exceeding the original prescription strength or amount or for more than one refill pursuant to paragraph (3) of subdivision (b) of Section 2242 of the Business and Professions Code.
(5) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient who is terminally ill, as defined in subdivision (c) of Section 11159.2.
(6) (A) If all of the following circumstances are satisfied:
(i) It is not reasonably possible for a health care practitioner to access the information in the CURES database in a timely manner.
(ii) Another health care practitioner or designee authorized to access the CURES database is not reasonably available.
(iii) The quantity of controlled substance prescribed, ordered, administered, or furnished does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use and no refill of the controlled substance is allowed.
(B) A health care practitioner who does not consult the CURES database under subparagraph (A) shall document the reason they did not consult the database in the patients medical record.
(7) If the CURES database is not operational, as determined by the department, or when it cannot be accessed by a health care practitioner because of a temporary technological or electrical failure. A health care practitioner shall, without undue delay, seek to correct the cause of the temporary technological or electrical failure that is reasonably within the health care practitioners control.
(8) If the CURES database cannot be accessed because of technological limitations that are not reasonably within the control of a health care practitioner.
(9) If consultation of the CURES database would, as determined by the health care practitioner, result in a patients inability to obtain a prescription in a timely manner and thereby adversely impact the patients medical condition, provided that the quantity of the controlled substance does not exceed a nonrefillable seven-day supply if the controlled substance were used in accordance with the directions for use.
(d) (1) A health care practitioner who fails to consult the CURES database, as described in subdivision (a), shall be referred to the appropriate state professional licensing board solely for administrative sanctions, as deemed appropriate by that board.
(2) This section does not create a private cause of action against a health care practitioner. This section does not limit a health care practitioners liability for the negligent failure to diagnose or treat a patient.
(e) All applicable state and federal privacy laws govern the duties required by this section.
(f) The provisions of this section are severable. If any provision of this section or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.