California 2025-2026 Regular Session

California Senate Bill SB497 Compare Versions

OldNewDifferences
1-Amended IN Senate April 21, 2025 Amended IN Senate March 28, 2025 CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION Senate Bill No. 497Introduced by Senator Wiener(Coauthors: Senators Arregun, Cabaldon, Cervantes, Gonzalez, Laird, and Padilla)(Coauthors: Assembly Members Haney, Lee, Stefani, and Ward)February 19, 2025 An act to amend Section 56.109 of the Civil Code, to amend Sections 2029.300 and 2029.350 of the Code of Civil Procedure, to amend Section 11165 of the Health and Safety Code, and to amend Section 1326 of the Penal Code, relating to health care. LEGISLATIVE COUNSEL'S DIGESTSB 497, as amended, Wiener. Legally protected health care activity.The United States Constitution generally requires a state to give full faith and credit to the public acts, records, and judicial proceedings of every other state. Existing law generally authorizes a California court or attorney to issue a subpoena if a foreign subpoena has been sought in this state, but prohibits the issuance of a subpoena based on another states law that interferes with a persons right to allow a child to receive gender-affirming health care or gender-affirming mental health care. Existing law generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless an exception applies, including that the disclosure is in response to a subpoena. Existing law prohibits a provider of health care, a health care service plan, or a contractor from releasing medical information related to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to a civil action, including a foreign subpoena, based on another states law that authorizes a person to bring a civil action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.This bill would additionally prohibit a provider of health care, a health care service plan, or a contractor from releasing medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care in response to a criminal or civil action, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care. The bill would also prohibit a provider of health care, health care service plan, contractor, or employer from cooperating with or providing medical information to an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care, as specified. The bill would prohibit these entities from releasing medical information related to sensitive services, as defined, in response to a foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for provision or receipt of legally protected health care activity, as defined. The bill would also generally prohibit the issuance of a subpoena based on a violation of another states law that interferes with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care, as specified. Existing law requires the Department of Justice to maintain the Controlled Substances Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of certain controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense those controlled substances. Existing law authorizes the department to enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information. Existing law limits the entities to which data may be provided from CURES, as well as the type of data that may be released and the uses to which it may be put.This bill would prohibit a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency from providing any CURES data or expend knowingly providing any CURES data or knowingly expending any resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined. The bill would prohibit out-of-state law enforcement from having access to CURES data through the interstate data sharing hub and would prohibit the department from sharing data with an out-of-state law enforcement agency without a warrant, subpoena, or court order, and would prohibit an out-of-state user from providing any data in furtherance of an investigation or proceeding to impose liability for the provision or receipt of legally protected health care activity.This bill would make it a misdemeanor for a person to access the CURES database when not authorized by law, and would make it a misdemeanor for a person who is authorized to access the database to knowingly furnish information from the CURES database to a person who is not authorized by law to receive that information. By creating new crimes, the bill would impose a state-mandated local program.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that no reimbursement is required by this act for a specified reason.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YES Bill TextThe people of the State of California do enact as follows:SECTION 1. (a) The Legislature find and declares that California residents and visitors, especially transgender and gender nonconforming people, are being targeted for harassment, intimidation, and other harm, as are family members, teachers, and others who support them. The Legislature intends to comprehensively protect these Californians and visitors from both instate and out-of-state abuse, including from individuals purporting to act on behalf of the United States Government.(b) It is the intent of the Legislature to ensure that educators that may face retaliation or prosecution under President Trumps Executive Order on Ending Radical Indoctrination in K12 Schooling for prioritizing the safety and well-being of transgender youth are protected.SEC. 2. Section 56.109 of the Civil Code is amended to read:56.109. (a) Notwithstanding subdivision (b) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any subpoena or request, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care or authorizes a person to bring a civil or criminal action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(b) Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the information is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care, and the information is being requested pursuant to another states law that authorizes a person to bring a civil or criminal action against a person or entity that provides, seeks, obtains, or receives gender-affirming health care or gender-affirming mental health care or who allows a child to receive gender-affirming health care or gender-affirming mental health care.(c) Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care that is lawful under the laws of this state.(d) This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.(e) For the purposes of this section, the following terms have the following meanings:(1) Gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) Person means an individual or governmental subdivision, agency, or instrumentality.SEC. 3. Section 2029.300 of the Code of Civil Procedure is amended to read:2029.300. (a) To request issuance of a subpoena under this section, a party shall submit the original or a true and correct copy of a foreign subpoena to the clerk of the superior court in the county in which discovery is sought to be conducted in this state. A request for the issuance of a subpoena under this section does not constitute making an appearance in the courts of this state.(b) In addition to submitting a foreign subpoena under subdivision (a), a party seeking discovery shall do both of the following:(1) Submit an application requesting that the superior court issue a subpoena with the same terms as the foreign subpoena. The application shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390. No civil case cover sheet is required.(2) Pay the fee specified in Section 70626 of the Government Code.(c) When a party submits a foreign subpoena to the clerk of the superior court in accordance with subdivision (a), and satisfies the requirements of subdivision (b), the clerk shall promptly issue a subpoena for service upon the person to which the foreign subpoena is directed.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the court that issues it.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.(e) Notwithstanding subdivision (a), a subpoena shall not be issued pursuant to this section in any of the following circumstances:(1) If the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care. For the purpose of this paragraph, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) If the submitted foreign subpoena relates to a foreign penal civil action and would require disclosure of information related to sensitive services. For purposes of this paragraph, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.SEC. 4. Section 2029.350 of the Code of Civil Procedure is amended to read:2029.350. (a) Notwithstanding Sections 1986 and 2029.300, if a party to a proceeding pending in a foreign jurisdiction retains an attorney licensed to practice in this state, who is an active member of the State Bar, and that attorney receives the original or a true and correct copy of a foreign subpoena, the attorney may issue a subpoena under this article.(b) (1) Notwithstanding subdivision (a), an authorized attorney shall not issue a subpoena pursuant to subdivision (a) if the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(c) Notwithstanding subdivision (a), an attorney shall not issue a subpoena under this article based on a foreign subpoena that relates to a foreign penal civil action and that would require disclosure of information related to sensitive services. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the superior court of the county in which the discovery is to be conducted.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.SEC. 5. Section 11165 of the Health and Safety Code is amended to read:11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. The University of California shall be provided access to identifiable data for research purposes if the requirements of subdivision (t) of Section 1798.24 of the Civil Code are satisfied. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(C) (i) Notwithstanding subparagraph (A) or any other law, a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency shall not provide any CURES data or expend knowingly provide any CURES data or knowingly expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(ii) This section does not prohibit the investigation of any activity that is punishable as a crime under the laws of this state so long as no CURES data related to any legally protected health care activity, as defined in Section 1798.300 of the Civil Code, is not knowingly shared with any individual or entity from another state.(3) The department may adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department or contracted prescription data processing vendor as soon as reasonably possible, but not more than one working day after the date a controlled substance is released to the patient or patients representative, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information. An out-of-state authorized user who obtains CURES data through the interstate data sharing hub shall not provide any CURES data in furtherance of any investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(6) Notwithstanding subdivision (c), the department shall not provide CURES data to out-of-state law enforcement absent a warrant, subpoena, or court order, issued pursuant to Section 2029.300 or 2029.350 of the Code of Civil Procedure, or Section 1326 of the Penal Code.(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.(j) If the dispensing pharmacy, clinic, or other dispenser experiences a temporary technological or electrical failure, it shall, without undue delay, seek to correct any cause of the temporary technological or electrical failure that is reasonably within its control. The deadline for transmitting prescription information to the department or contracted prescription data processing vendor pursuant to subdivision (d) shall be extended until the failure is corrected. If the dispensing pharmacy, clinic, or other dispenser experiences technological limitations that are not reasonably within its control, or is impacted by a natural or manmade disaster, the deadline for transmitting prescription information to the department or contracted prescription data processing vendor shall be extended until normal operations have resumed.(k) (1) Any person who accesses the CURES database and who is not authorized by law to do so is guilty of a misdemeanor.(2) Any person authorized by law to access the CURES database and who knowingly furnishes the information from the CURES database to a person who is not authorized by law to receive that information is guilty of a misdemeanor.(3) This subdivision does not apply to a provider of health care as defined in Section 56.06 of the Civil Code that is subject to applicable state and federal medical privacy laws.SEC. 6. Section 1326 of the Penal Code is amended to read:1326. (a) The process by which the attendance of a witness before a court or magistrate is required is a subpoena. It may be signed and issued by any of the following:(1) A magistrate before whom a complaint is laid or their clerk, the district attorney or their investigator, or the public defender or their investigator, for witnesses in the state.(2) The district attorney, their investigator, or, upon request of the grand jury, any judge of the superior court, for witnesses in the state, in support of an indictment or information, to appear before the court in which it is to be tried.(3) The district attorney or their investigator, the public defender or their investigator, or the clerk of the court in which a criminal action is to be tried. The clerk shall, at any time, upon application of the defendant, and without charge, issue as many blank subpoenas, subscribed by them, for witnesses in the state, as the defendant may require.(4) The attorney of record for the defendant.(b) A subpoena issued in a criminal action that commands the custodian of records or other qualified witness of a business to produce books, papers, documents, or records shall direct that those items be delivered by the custodian or qualified witness in the manner specified in subdivision (b) of Section 1560 of the Evidence Code. Subdivision (e) of Section 1560 of the Evidence Code shall not apply to criminal cases.(c) (1) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action that interferes with an individuals rights to seek or obtain gender-affirming health care or gender-affirming mental health care or against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(d) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to sensitive services in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(e) In a criminal action, no party, or attorney or representative of a party, may issue a subpoena commanding the custodian of records or other qualified witness of a business to provide books, papers, documents, or records, or copies thereof, relating to a person or entity other than the subpoenaed person or entity in any manner other than that specified in subdivision (b) of Section 1560 of the Evidence Code. When a defendant has issued a subpoena to a person or entity that is not a party for the production of books, papers, documents, or records, or copies thereof, the court may order an in camera hearing to determine whether or not the defense is entitled to receive the documents. The court may not order the documents disclosed to the prosecution except as required by Section 1054.3.(f) This section shall not be construed to prohibit obtaining books, papers, documents, or records with the consent of the person to whom the books, papers, documents, or records relate.SEC. 7. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
1+Amended IN Senate March 28, 2025 CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION Senate Bill No. 497Introduced by Senator Wiener(Coauthors: Senators Arregun, Cabaldon, Cervantes, Gonzalez, Laird, and Padilla)(Coauthors: Assembly Members Haney, Lee, Stefani, and Ward)February 19, 2025 An act to amend Section 56.109 of the Civil Code, to amend Sections 2029.300 and 2029.350 of the Code of Civil Procedure, to amend Section 11165 of the Health and Safety Code, and to amend Section 1326 of the Penal Code, relating to health care. LEGISLATIVE COUNSEL'S DIGESTSB 497, as amended, Wiener. Legally protected health care activity.The United States Constitution generally requires a state to give full faith and credit to the public acts, records, and judicial proceedings of every other state. Existing law generally authorizes a California court or attorney to issue a subpoena if a foreign subpoena has been sought in this state, but prohibits the issuance of a subpoena based on another states law that interferes with a persons right to allow a child to receive gender-affirming health care or gender-affirming mental health care. Existing law generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless an exception applies, including that the disclosure is in response to a subpoena. Existing law prohibits a provider of health care, a health care service plan, or a contractor from releasing medical information related to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to a civil action, including a foreign subpoena, based on another states law that authorizes a person to bring a civil action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.This bill would additionally prohibit a provider of health care, a health care service plan, or a contractor from releasing medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care in response to a criminal or civil action, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care. The bill would also prohibit a provider of health care, health care service plan, contractor, or employer from cooperating with or providing medical information to an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care, as specified. The bill would prohibit these entities from releasing medical information related to sensitive services, as defined, in response to a foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for provision or receipt of legally protected health care activity, as defined. The bill would also generally prohibit the issuance of a subpoena based on a violation of another states law that interferes with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care, as specified. Existing law requires the Department of Justice to maintain the Controlled Substances Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of certain controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense those controlled substances. Existing law authorizes the department to enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information. Existing law limits the entities to which data may be provided from CURES, as well as the type of data that may be released and the uses to which it may be put.This bill would prohibit a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency from providing any CURES data or expend any resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined. The bill would prohibit out-of-state law enforcement from having access to CURES data through the interstate data sharing hub and would require a warrant, subpoena, or court order for a law enforcement agency to obtain information from CURES as part of a criminal investigation. prohibit the department from sharing data with an out-of-state law enforcement agency without a warrant, subpoena, or court order, and would prohibit an out-of-state user from providing any data in furtherance of an investigation or proceeding to impose liability for the provision or receipt of legally protected health care activity.This bill would make it a misdemeanor for a person to access the CURES database when not authorized by law, and would make it a misdemeanor for a person who is authorized to access the database to knowingly furnish information from the CURES database to a person who is not authorized by law to receive that information. By creating new crimes, the bill would impose a state-mandated local program.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that no reimbursement is required by this act for a specified reason.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YES Bill TextThe people of the State of California do enact as follows:SECTION 1. (a) The Legislature find and declares that California residents and visitors, especially transgender and gender nonconforming people, are being targeted for harassment, intimidation, and other harm, as are family members, teachers, and others who support them. The Legislature intends to comprehensively protect these Californians and visitors from both instate and out-of-state abuse, including from individuals purporting to act on behalf of the United States Government.(b) It is the intent of the Legislature to ensure that educators that may face retaliation or prosecution under President Trumps Executive Order on Ending Radical Indoctrination in K12 Schooling for prioritizing the safety and well-being of transgender youth are protected.SEC. 2. Section 56.109 of the Civil Code is amended to read:56.109. (a) Notwithstanding subdivision (b) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any subpoena or request, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care or authorizes a person to bring a civil or criminal action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(b) Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the information is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care, and the information is being requested pursuant to another states law that authorizes a person to bring a civil or criminal action against a person or entity that provides, seeks, obtains, or receives gender-affirming health care or gender-affirming mental health care or who allows a child to receive gender-affirming health care or gender-affirming mental health care.(c) Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care that is lawful under the laws of this state.(d)This section does not prohibit compliance with the investigation of an activity that is punishable as a crime under the laws of this state as long as no medical information related to gender-affirming health care and gender-affirming mental health care is shared with an out-of-state agency or any other individual.(d) This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.(e) For the purposes of this section, the following terms have the following meanings:(1) Gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) Person means an individual or governmental subdivision, agency, or instrumentality.SEC. 3. Section 2029.300 of the Code of Civil Procedure is amended to read:2029.300. (a) To request issuance of a subpoena under this section, a party shall submit the original or a true and correct copy of a foreign subpoena to the clerk of the superior court in the county in which discovery is sought to be conducted in this state. A request for the issuance of a subpoena under this section does not constitute making an appearance in the courts of this state.(b) In addition to submitting a foreign subpoena under subdivision (a), a party seeking discovery shall do both of the following:(1) Submit an application requesting that the superior court issue a subpoena with the same terms as the foreign subpoena. The application shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390. No civil case cover sheet is required.(2) Pay the fee specified in Section 70626 of the Government Code.(c) When a party submits a foreign subpoena to the clerk of the superior court in accordance with subdivision (a), and satisfies the requirements of subdivision (b), the clerk shall promptly issue a subpoena for service upon the person to which the foreign subpoena is directed.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the court that issues it.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.(e) Notwithstanding subdivision (a), a subpoena shall not be issued pursuant to this section in any of the following circumstances:(1) If the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care. For the purpose of this paragraph, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) If the submitted foreign subpoena relates to a foreign penal civil action and would require disclosure of information related to sensitive services. For purposes of this paragraph, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.SEC. 4. Section 2029.350 of the Code of Civil Procedure is amended to read:2029.350. (a) Notwithstanding Sections 1986 and 2029.300, if a party to a proceeding pending in a foreign jurisdiction retains an attorney licensed to practice in this state, who is an active member of the State Bar, and that attorney receives the original or a true and correct copy of a foreign subpoena, the attorney may issue a subpoena under this article.(b) (1) Notwithstanding subdivision (a), an authorized attorney shall not issue a subpoena pursuant to subdivision (a) if the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(c) Notwithstanding subdivision (a), an attorney shall not issue a subpoena under this article based on a foreign subpoena that relates to a foreign penal civil action and that would require disclosure of information related to sensitive services. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the superior court of the county in which the discovery is to be conducted.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.SEC. 5. Section 11165 of the Health and Safety Code is amended to read:11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. The University of California shall be provided access to identifiable data for research purposes if the requirements of subdivision (t) of Section 1798.24 of the Civil Code are satisfied. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(C) (i) Notwithstanding subparagraph (A) or any other law, a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency shall not provide any CURES data or expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(ii) This section does not prohibit the investigation of any activity that is punishable as a crime under the laws of this state so long as no CURES data related to any legally protected health care activity, as defined in Section 1798.300 of the Civil Code, is shared with any individual or entity from another state.(3) The department shall may adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) Require a warrant, subpoena, or court order The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department or contracted prescription data processing vendor as soon as reasonably possible, but not more than one working day after the date a controlled substance is released to the patient or patients representative, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information with out-of-state authorized users so long as the entity operating an interstate data sharing hub, the interstate data sharing hub itself, and any information. An out-of-state authorized user who obtains CURES data through the interstate data sharing hub shall not provide any CURES data in furtherance of any investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(6)Out-of-state law enforcement shall not have access to CURES data through the interstate data sharing hub but may request CURES data from the department.(6) Notwithstanding subdivision (c), the department shall not provide CURES data to out-of-state law enforcement absent a warrant, subpoena, or court order, issued pursuant to Section 2029.300 or 2029.350 of the Code of Civil Procedure, or Section 1326 of the Penal Code.(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.(j) If the dispensing pharmacy, clinic, or other dispenser experiences a temporary technological or electrical failure, it shall, without undue delay, seek to correct any cause of the temporary technological or electrical failure that is reasonably within its control. The deadline for transmitting prescription information to the department or contracted prescription data processing vendor pursuant to subdivision (d) shall be extended until the failure is corrected. If the dispensing pharmacy, clinic, or other dispenser experiences technological limitations that are not reasonably within its control, or is impacted by a natural or manmade disaster, the deadline for transmitting prescription information to the department or contracted prescription data processing vendor shall be extended until normal operations have resumed.(k) (1) Any person who accesses the CURES database and who is not authorized by law to do so is guilty of a misdemeanor.(2) Any person authorized by law to access the CURES database and who knowingly furnishes the information from the CURES database to a person who is not authorized by law to receive that information is guilty of a misdemeanor.(3) This subdivision does not apply to a provider of health care as defined in Section 56.06 of the Civil Code that is subject to applicable state and federal medical privacy laws.SEC. 6. Section 1326 of the Penal Code is amended to read:1326. (a) The process by which the attendance of a witness before a court or magistrate is required is a subpoena. It may be signed and issued by any of the following:(1) A magistrate before whom a complaint is laid or their clerk, the district attorney or their investigator, or the public defender or their investigator, for witnesses in the state.(2) The district attorney, their investigator, or, upon request of the grand jury, any judge of the superior court, for witnesses in the state, in support of an indictment or information, to appear before the court in which it is to be tried.(3) The district attorney or their investigator, the public defender or their investigator, or the clerk of the court in which a criminal action is to be tried. The clerk shall, at any time, upon application of the defendant, and without charge, issue as many blank subpoenas, subscribed by them, for witnesses in the state, as the defendant may require.(4) The attorney of record for the defendant.(b) A subpoena issued in a criminal action that commands the custodian of records or other qualified witness of a business to produce books, papers, documents, or records shall direct that those items be delivered by the custodian or qualified witness in the manner specified in subdivision (b) of Section 1560 of the Evidence Code. Subdivision (e) of Section 1560 of the Evidence Code shall not apply to criminal cases.(c) (1) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action that interferes with an individuals rights to seek or obtain gender-affirming health care or gender-affirming mental health care or against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(d) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to sensitive services in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(e) In a criminal action, no party, or attorney or representative of a party, may issue a subpoena commanding the custodian of records or other qualified witness of a business to provide books, papers, documents, or records, or copies thereof, relating to a person or entity other than the subpoenaed person or entity in any manner other than that specified in subdivision (b) of Section 1560 of the Evidence Code. When a defendant has issued a subpoena to a person or entity that is not a party for the production of books, papers, documents, or records, or copies thereof, the court may order an in camera hearing to determine whether or not the defense is entitled to receive the documents. The court may not order the documents disclosed to the prosecution except as required by Section 1054.3.(f) This section shall not be construed to prohibit obtaining books, papers, documents, or records with the consent of the person to whom the books, papers, documents, or records relate.SEC. 7. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
22
3-Amended IN Senate April 21, 2025 Amended IN Senate March 28, 2025 CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION Senate Bill No. 497Introduced by Senator Wiener(Coauthors: Senators Arregun, Cabaldon, Cervantes, Gonzalez, Laird, and Padilla)(Coauthors: Assembly Members Haney, Lee, Stefani, and Ward)February 19, 2025 An act to amend Section 56.109 of the Civil Code, to amend Sections 2029.300 and 2029.350 of the Code of Civil Procedure, to amend Section 11165 of the Health and Safety Code, and to amend Section 1326 of the Penal Code, relating to health care. LEGISLATIVE COUNSEL'S DIGESTSB 497, as amended, Wiener. Legally protected health care activity.The United States Constitution generally requires a state to give full faith and credit to the public acts, records, and judicial proceedings of every other state. Existing law generally authorizes a California court or attorney to issue a subpoena if a foreign subpoena has been sought in this state, but prohibits the issuance of a subpoena based on another states law that interferes with a persons right to allow a child to receive gender-affirming health care or gender-affirming mental health care. Existing law generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless an exception applies, including that the disclosure is in response to a subpoena. Existing law prohibits a provider of health care, a health care service plan, or a contractor from releasing medical information related to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to a civil action, including a foreign subpoena, based on another states law that authorizes a person to bring a civil action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.This bill would additionally prohibit a provider of health care, a health care service plan, or a contractor from releasing medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care in response to a criminal or civil action, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care. The bill would also prohibit a provider of health care, health care service plan, contractor, or employer from cooperating with or providing medical information to an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care, as specified. The bill would prohibit these entities from releasing medical information related to sensitive services, as defined, in response to a foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for provision or receipt of legally protected health care activity, as defined. The bill would also generally prohibit the issuance of a subpoena based on a violation of another states law that interferes with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care, as specified. Existing law requires the Department of Justice to maintain the Controlled Substances Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of certain controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense those controlled substances. Existing law authorizes the department to enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information. Existing law limits the entities to which data may be provided from CURES, as well as the type of data that may be released and the uses to which it may be put.This bill would prohibit a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency from providing any CURES data or expend knowingly providing any CURES data or knowingly expending any resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined. The bill would prohibit out-of-state law enforcement from having access to CURES data through the interstate data sharing hub and would prohibit the department from sharing data with an out-of-state law enforcement agency without a warrant, subpoena, or court order, and would prohibit an out-of-state user from providing any data in furtherance of an investigation or proceeding to impose liability for the provision or receipt of legally protected health care activity.This bill would make it a misdemeanor for a person to access the CURES database when not authorized by law, and would make it a misdemeanor for a person who is authorized to access the database to knowingly furnish information from the CURES database to a person who is not authorized by law to receive that information. By creating new crimes, the bill would impose a state-mandated local program.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that no reimbursement is required by this act for a specified reason.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YES
3+ Amended IN Senate March 28, 2025 CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION Senate Bill No. 497Introduced by Senator Wiener(Coauthors: Senators Arregun, Cabaldon, Cervantes, Gonzalez, Laird, and Padilla)(Coauthors: Assembly Members Haney, Lee, Stefani, and Ward)February 19, 2025 An act to amend Section 56.109 of the Civil Code, to amend Sections 2029.300 and 2029.350 of the Code of Civil Procedure, to amend Section 11165 of the Health and Safety Code, and to amend Section 1326 of the Penal Code, relating to health care. LEGISLATIVE COUNSEL'S DIGESTSB 497, as amended, Wiener. Legally protected health care activity.The United States Constitution generally requires a state to give full faith and credit to the public acts, records, and judicial proceedings of every other state. Existing law generally authorizes a California court or attorney to issue a subpoena if a foreign subpoena has been sought in this state, but prohibits the issuance of a subpoena based on another states law that interferes with a persons right to allow a child to receive gender-affirming health care or gender-affirming mental health care. Existing law generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless an exception applies, including that the disclosure is in response to a subpoena. Existing law prohibits a provider of health care, a health care service plan, or a contractor from releasing medical information related to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to a civil action, including a foreign subpoena, based on another states law that authorizes a person to bring a civil action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.This bill would additionally prohibit a provider of health care, a health care service plan, or a contractor from releasing medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care in response to a criminal or civil action, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care. The bill would also prohibit a provider of health care, health care service plan, contractor, or employer from cooperating with or providing medical information to an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care, as specified. The bill would prohibit these entities from releasing medical information related to sensitive services, as defined, in response to a foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for provision or receipt of legally protected health care activity, as defined. The bill would also generally prohibit the issuance of a subpoena based on a violation of another states law that interferes with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care, as specified. Existing law requires the Department of Justice to maintain the Controlled Substances Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of certain controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense those controlled substances. Existing law authorizes the department to enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information. Existing law limits the entities to which data may be provided from CURES, as well as the type of data that may be released and the uses to which it may be put.This bill would prohibit a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency from providing any CURES data or expend any resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined. The bill would prohibit out-of-state law enforcement from having access to CURES data through the interstate data sharing hub and would require a warrant, subpoena, or court order for a law enforcement agency to obtain information from CURES as part of a criminal investigation. prohibit the department from sharing data with an out-of-state law enforcement agency without a warrant, subpoena, or court order, and would prohibit an out-of-state user from providing any data in furtherance of an investigation or proceeding to impose liability for the provision or receipt of legally protected health care activity.This bill would make it a misdemeanor for a person to access the CURES database when not authorized by law, and would make it a misdemeanor for a person who is authorized to access the database to knowingly furnish information from the CURES database to a person who is not authorized by law to receive that information. By creating new crimes, the bill would impose a state-mandated local program.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that no reimbursement is required by this act for a specified reason.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YES
44
5-Amended IN Senate April 21, 2025 Amended IN Senate March 28, 2025
6-
7-Amended IN Senate April 21, 2025
85 Amended IN Senate March 28, 2025
96
10-
7+Amended IN Senate March 28, 2025
118
129 CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION
1310
1411 Senate Bill
1512
1613 No. 497
1714
1815 Introduced by Senator Wiener(Coauthors: Senators Arregun, Cabaldon, Cervantes, Gonzalez, Laird, and Padilla)(Coauthors: Assembly Members Haney, Lee, Stefani, and Ward)February 19, 2025
1916
2017 Introduced by Senator Wiener(Coauthors: Senators Arregun, Cabaldon, Cervantes, Gonzalez, Laird, and Padilla)(Coauthors: Assembly Members Haney, Lee, Stefani, and Ward)
2118 February 19, 2025
2219
23-
24-
2520 An act to amend Section 56.109 of the Civil Code, to amend Sections 2029.300 and 2029.350 of the Code of Civil Procedure, to amend Section 11165 of the Health and Safety Code, and to amend Section 1326 of the Penal Code, relating to health care.
2621
2722 LEGISLATIVE COUNSEL'S DIGEST
2823
2924 ## LEGISLATIVE COUNSEL'S DIGEST
3025
3126 SB 497, as amended, Wiener. Legally protected health care activity.
3227
33-The United States Constitution generally requires a state to give full faith and credit to the public acts, records, and judicial proceedings of every other state. Existing law generally authorizes a California court or attorney to issue a subpoena if a foreign subpoena has been sought in this state, but prohibits the issuance of a subpoena based on another states law that interferes with a persons right to allow a child to receive gender-affirming health care or gender-affirming mental health care. Existing law generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless an exception applies, including that the disclosure is in response to a subpoena. Existing law prohibits a provider of health care, a health care service plan, or a contractor from releasing medical information related to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to a civil action, including a foreign subpoena, based on another states law that authorizes a person to bring a civil action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.This bill would additionally prohibit a provider of health care, a health care service plan, or a contractor from releasing medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care in response to a criminal or civil action, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care. The bill would also prohibit a provider of health care, health care service plan, contractor, or employer from cooperating with or providing medical information to an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care, as specified. The bill would prohibit these entities from releasing medical information related to sensitive services, as defined, in response to a foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for provision or receipt of legally protected health care activity, as defined. The bill would also generally prohibit the issuance of a subpoena based on a violation of another states law that interferes with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care, as specified. Existing law requires the Department of Justice to maintain the Controlled Substances Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of certain controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense those controlled substances. Existing law authorizes the department to enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information. Existing law limits the entities to which data may be provided from CURES, as well as the type of data that may be released and the uses to which it may be put.This bill would prohibit a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency from providing any CURES data or expend knowingly providing any CURES data or knowingly expending any resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined. The bill would prohibit out-of-state law enforcement from having access to CURES data through the interstate data sharing hub and would prohibit the department from sharing data with an out-of-state law enforcement agency without a warrant, subpoena, or court order, and would prohibit an out-of-state user from providing any data in furtherance of an investigation or proceeding to impose liability for the provision or receipt of legally protected health care activity.This bill would make it a misdemeanor for a person to access the CURES database when not authorized by law, and would make it a misdemeanor for a person who is authorized to access the database to knowingly furnish information from the CURES database to a person who is not authorized by law to receive that information. By creating new crimes, the bill would impose a state-mandated local program.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that no reimbursement is required by this act for a specified reason.
28+The United States Constitution generally requires a state to give full faith and credit to the public acts, records, and judicial proceedings of every other state. Existing law generally authorizes a California court or attorney to issue a subpoena if a foreign subpoena has been sought in this state, but prohibits the issuance of a subpoena based on another states law that interferes with a persons right to allow a child to receive gender-affirming health care or gender-affirming mental health care. Existing law generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless an exception applies, including that the disclosure is in response to a subpoena. Existing law prohibits a provider of health care, a health care service plan, or a contractor from releasing medical information related to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to a civil action, including a foreign subpoena, based on another states law that authorizes a person to bring a civil action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.This bill would additionally prohibit a provider of health care, a health care service plan, or a contractor from releasing medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care in response to a criminal or civil action, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care. The bill would also prohibit a provider of health care, health care service plan, contractor, or employer from cooperating with or providing medical information to an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care, as specified. The bill would prohibit these entities from releasing medical information related to sensitive services, as defined, in response to a foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for provision or receipt of legally protected health care activity, as defined. The bill would also generally prohibit the issuance of a subpoena based on a violation of another states law that interferes with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care, as specified. Existing law requires the Department of Justice to maintain the Controlled Substances Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of certain controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense those controlled substances. Existing law authorizes the department to enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information. Existing law limits the entities to which data may be provided from CURES, as well as the type of data that may be released and the uses to which it may be put.This bill would prohibit a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency from providing any CURES data or expend any resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined. The bill would prohibit out-of-state law enforcement from having access to CURES data through the interstate data sharing hub and would require a warrant, subpoena, or court order for a law enforcement agency to obtain information from CURES as part of a criminal investigation. prohibit the department from sharing data with an out-of-state law enforcement agency without a warrant, subpoena, or court order, and would prohibit an out-of-state user from providing any data in furtherance of an investigation or proceeding to impose liability for the provision or receipt of legally protected health care activity.This bill would make it a misdemeanor for a person to access the CURES database when not authorized by law, and would make it a misdemeanor for a person who is authorized to access the database to knowingly furnish information from the CURES database to a person who is not authorized by law to receive that information. By creating new crimes, the bill would impose a state-mandated local program.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that no reimbursement is required by this act for a specified reason.
3429
3530 The United States Constitution generally requires a state to give full faith and credit to the public acts, records, and judicial proceedings of every other state. Existing law generally authorizes a California court or attorney to issue a subpoena if a foreign subpoena has been sought in this state, but prohibits the issuance of a subpoena based on another states law that interferes with a persons right to allow a child to receive gender-affirming health care or gender-affirming mental health care. Existing law generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless an exception applies, including that the disclosure is in response to a subpoena. Existing law prohibits a provider of health care, a health care service plan, or a contractor from releasing medical information related to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to a civil action, including a foreign subpoena, based on another states law that authorizes a person to bring a civil action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.
3631
3732 This bill would additionally prohibit a provider of health care, a health care service plan, or a contractor from releasing medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care in response to a criminal or civil action, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care. The bill would also prohibit a provider of health care, health care service plan, contractor, or employer from cooperating with or providing medical information to an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care, as specified. The bill would prohibit these entities from releasing medical information related to sensitive services, as defined, in response to a foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for provision or receipt of legally protected health care activity, as defined. The bill would also generally prohibit the issuance of a subpoena based on a violation of another states law that interferes with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care, as specified.
3833
3934 Existing law requires the Department of Justice to maintain the Controlled Substances Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of certain controlled substances by a health care practitioner authorized to prescribe, order, administer, furnish, or dispense those controlled substances. Existing law authorizes the department to enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information. Existing law limits the entities to which data may be provided from CURES, as well as the type of data that may be released and the uses to which it may be put.
4035
41-This bill would prohibit a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency from providing any CURES data or expend knowingly providing any CURES data or knowingly expending any resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined. The bill would prohibit out-of-state law enforcement from having access to CURES data through the interstate data sharing hub and would prohibit the department from sharing data with an out-of-state law enforcement agency without a warrant, subpoena, or court order, and would prohibit an out-of-state user from providing any data in furtherance of an investigation or proceeding to impose liability for the provision or receipt of legally protected health care activity.
36+This bill would prohibit a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency from providing any CURES data or expend any resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined. The bill would prohibit out-of-state law enforcement from having access to CURES data through the interstate data sharing hub and would require a warrant, subpoena, or court order for a law enforcement agency to obtain information from CURES as part of a criminal investigation. prohibit the department from sharing data with an out-of-state law enforcement agency without a warrant, subpoena, or court order, and would prohibit an out-of-state user from providing any data in furtherance of an investigation or proceeding to impose liability for the provision or receipt of legally protected health care activity.
4237
4338 This bill would make it a misdemeanor for a person to access the CURES database when not authorized by law, and would make it a misdemeanor for a person who is authorized to access the database to knowingly furnish information from the CURES database to a person who is not authorized by law to receive that information. By creating new crimes, the bill would impose a state-mandated local program.
4439
4540 The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
4641
4742 This bill would provide that no reimbursement is required by this act for a specified reason.
4843
4944 ## Digest Key
5045
5146 ## Bill Text
5247
53-The people of the State of California do enact as follows:SECTION 1. (a) The Legislature find and declares that California residents and visitors, especially transgender and gender nonconforming people, are being targeted for harassment, intimidation, and other harm, as are family members, teachers, and others who support them. The Legislature intends to comprehensively protect these Californians and visitors from both instate and out-of-state abuse, including from individuals purporting to act on behalf of the United States Government.(b) It is the intent of the Legislature to ensure that educators that may face retaliation or prosecution under President Trumps Executive Order on Ending Radical Indoctrination in K12 Schooling for prioritizing the safety and well-being of transgender youth are protected.SEC. 2. Section 56.109 of the Civil Code is amended to read:56.109. (a) Notwithstanding subdivision (b) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any subpoena or request, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care or authorizes a person to bring a civil or criminal action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(b) Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the information is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care, and the information is being requested pursuant to another states law that authorizes a person to bring a civil or criminal action against a person or entity that provides, seeks, obtains, or receives gender-affirming health care or gender-affirming mental health care or who allows a child to receive gender-affirming health care or gender-affirming mental health care.(c) Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care that is lawful under the laws of this state.(d) This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.(e) For the purposes of this section, the following terms have the following meanings:(1) Gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) Person means an individual or governmental subdivision, agency, or instrumentality.SEC. 3. Section 2029.300 of the Code of Civil Procedure is amended to read:2029.300. (a) To request issuance of a subpoena under this section, a party shall submit the original or a true and correct copy of a foreign subpoena to the clerk of the superior court in the county in which discovery is sought to be conducted in this state. A request for the issuance of a subpoena under this section does not constitute making an appearance in the courts of this state.(b) In addition to submitting a foreign subpoena under subdivision (a), a party seeking discovery shall do both of the following:(1) Submit an application requesting that the superior court issue a subpoena with the same terms as the foreign subpoena. The application shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390. No civil case cover sheet is required.(2) Pay the fee specified in Section 70626 of the Government Code.(c) When a party submits a foreign subpoena to the clerk of the superior court in accordance with subdivision (a), and satisfies the requirements of subdivision (b), the clerk shall promptly issue a subpoena for service upon the person to which the foreign subpoena is directed.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the court that issues it.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.(e) Notwithstanding subdivision (a), a subpoena shall not be issued pursuant to this section in any of the following circumstances:(1) If the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care. For the purpose of this paragraph, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) If the submitted foreign subpoena relates to a foreign penal civil action and would require disclosure of information related to sensitive services. For purposes of this paragraph, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.SEC. 4. Section 2029.350 of the Code of Civil Procedure is amended to read:2029.350. (a) Notwithstanding Sections 1986 and 2029.300, if a party to a proceeding pending in a foreign jurisdiction retains an attorney licensed to practice in this state, who is an active member of the State Bar, and that attorney receives the original or a true and correct copy of a foreign subpoena, the attorney may issue a subpoena under this article.(b) (1) Notwithstanding subdivision (a), an authorized attorney shall not issue a subpoena pursuant to subdivision (a) if the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(c) Notwithstanding subdivision (a), an attorney shall not issue a subpoena under this article based on a foreign subpoena that relates to a foreign penal civil action and that would require disclosure of information related to sensitive services. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the superior court of the county in which the discovery is to be conducted.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.SEC. 5. Section 11165 of the Health and Safety Code is amended to read:11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. The University of California shall be provided access to identifiable data for research purposes if the requirements of subdivision (t) of Section 1798.24 of the Civil Code are satisfied. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(C) (i) Notwithstanding subparagraph (A) or any other law, a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency shall not provide any CURES data or expend knowingly provide any CURES data or knowingly expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(ii) This section does not prohibit the investigation of any activity that is punishable as a crime under the laws of this state so long as no CURES data related to any legally protected health care activity, as defined in Section 1798.300 of the Civil Code, is not knowingly shared with any individual or entity from another state.(3) The department may adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department or contracted prescription data processing vendor as soon as reasonably possible, but not more than one working day after the date a controlled substance is released to the patient or patients representative, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information. An out-of-state authorized user who obtains CURES data through the interstate data sharing hub shall not provide any CURES data in furtherance of any investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(6) Notwithstanding subdivision (c), the department shall not provide CURES data to out-of-state law enforcement absent a warrant, subpoena, or court order, issued pursuant to Section 2029.300 or 2029.350 of the Code of Civil Procedure, or Section 1326 of the Penal Code.(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.(j) If the dispensing pharmacy, clinic, or other dispenser experiences a temporary technological or electrical failure, it shall, without undue delay, seek to correct any cause of the temporary technological or electrical failure that is reasonably within its control. The deadline for transmitting prescription information to the department or contracted prescription data processing vendor pursuant to subdivision (d) shall be extended until the failure is corrected. If the dispensing pharmacy, clinic, or other dispenser experiences technological limitations that are not reasonably within its control, or is impacted by a natural or manmade disaster, the deadline for transmitting prescription information to the department or contracted prescription data processing vendor shall be extended until normal operations have resumed.(k) (1) Any person who accesses the CURES database and who is not authorized by law to do so is guilty of a misdemeanor.(2) Any person authorized by law to access the CURES database and who knowingly furnishes the information from the CURES database to a person who is not authorized by law to receive that information is guilty of a misdemeanor.(3) This subdivision does not apply to a provider of health care as defined in Section 56.06 of the Civil Code that is subject to applicable state and federal medical privacy laws.SEC. 6. Section 1326 of the Penal Code is amended to read:1326. (a) The process by which the attendance of a witness before a court or magistrate is required is a subpoena. It may be signed and issued by any of the following:(1) A magistrate before whom a complaint is laid or their clerk, the district attorney or their investigator, or the public defender or their investigator, for witnesses in the state.(2) The district attorney, their investigator, or, upon request of the grand jury, any judge of the superior court, for witnesses in the state, in support of an indictment or information, to appear before the court in which it is to be tried.(3) The district attorney or their investigator, the public defender or their investigator, or the clerk of the court in which a criminal action is to be tried. The clerk shall, at any time, upon application of the defendant, and without charge, issue as many blank subpoenas, subscribed by them, for witnesses in the state, as the defendant may require.(4) The attorney of record for the defendant.(b) A subpoena issued in a criminal action that commands the custodian of records or other qualified witness of a business to produce books, papers, documents, or records shall direct that those items be delivered by the custodian or qualified witness in the manner specified in subdivision (b) of Section 1560 of the Evidence Code. Subdivision (e) of Section 1560 of the Evidence Code shall not apply to criminal cases.(c) (1) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action that interferes with an individuals rights to seek or obtain gender-affirming health care or gender-affirming mental health care or against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(d) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to sensitive services in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(e) In a criminal action, no party, or attorney or representative of a party, may issue a subpoena commanding the custodian of records or other qualified witness of a business to provide books, papers, documents, or records, or copies thereof, relating to a person or entity other than the subpoenaed person or entity in any manner other than that specified in subdivision (b) of Section 1560 of the Evidence Code. When a defendant has issued a subpoena to a person or entity that is not a party for the production of books, papers, documents, or records, or copies thereof, the court may order an in camera hearing to determine whether or not the defense is entitled to receive the documents. The court may not order the documents disclosed to the prosecution except as required by Section 1054.3.(f) This section shall not be construed to prohibit obtaining books, papers, documents, or records with the consent of the person to whom the books, papers, documents, or records relate.SEC. 7. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
48+The people of the State of California do enact as follows:SECTION 1. (a) The Legislature find and declares that California residents and visitors, especially transgender and gender nonconforming people, are being targeted for harassment, intimidation, and other harm, as are family members, teachers, and others who support them. The Legislature intends to comprehensively protect these Californians and visitors from both instate and out-of-state abuse, including from individuals purporting to act on behalf of the United States Government.(b) It is the intent of the Legislature to ensure that educators that may face retaliation or prosecution under President Trumps Executive Order on Ending Radical Indoctrination in K12 Schooling for prioritizing the safety and well-being of transgender youth are protected.SEC. 2. Section 56.109 of the Civil Code is amended to read:56.109. (a) Notwithstanding subdivision (b) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any subpoena or request, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care or authorizes a person to bring a civil or criminal action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(b) Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the information is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care, and the information is being requested pursuant to another states law that authorizes a person to bring a civil or criminal action against a person or entity that provides, seeks, obtains, or receives gender-affirming health care or gender-affirming mental health care or who allows a child to receive gender-affirming health care or gender-affirming mental health care.(c) Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care that is lawful under the laws of this state.(d)This section does not prohibit compliance with the investigation of an activity that is punishable as a crime under the laws of this state as long as no medical information related to gender-affirming health care and gender-affirming mental health care is shared with an out-of-state agency or any other individual.(d) This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.(e) For the purposes of this section, the following terms have the following meanings:(1) Gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) Person means an individual or governmental subdivision, agency, or instrumentality.SEC. 3. Section 2029.300 of the Code of Civil Procedure is amended to read:2029.300. (a) To request issuance of a subpoena under this section, a party shall submit the original or a true and correct copy of a foreign subpoena to the clerk of the superior court in the county in which discovery is sought to be conducted in this state. A request for the issuance of a subpoena under this section does not constitute making an appearance in the courts of this state.(b) In addition to submitting a foreign subpoena under subdivision (a), a party seeking discovery shall do both of the following:(1) Submit an application requesting that the superior court issue a subpoena with the same terms as the foreign subpoena. The application shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390. No civil case cover sheet is required.(2) Pay the fee specified in Section 70626 of the Government Code.(c) When a party submits a foreign subpoena to the clerk of the superior court in accordance with subdivision (a), and satisfies the requirements of subdivision (b), the clerk shall promptly issue a subpoena for service upon the person to which the foreign subpoena is directed.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the court that issues it.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.(e) Notwithstanding subdivision (a), a subpoena shall not be issued pursuant to this section in any of the following circumstances:(1) If the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care. For the purpose of this paragraph, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) If the submitted foreign subpoena relates to a foreign penal civil action and would require disclosure of information related to sensitive services. For purposes of this paragraph, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.SEC. 4. Section 2029.350 of the Code of Civil Procedure is amended to read:2029.350. (a) Notwithstanding Sections 1986 and 2029.300, if a party to a proceeding pending in a foreign jurisdiction retains an attorney licensed to practice in this state, who is an active member of the State Bar, and that attorney receives the original or a true and correct copy of a foreign subpoena, the attorney may issue a subpoena under this article.(b) (1) Notwithstanding subdivision (a), an authorized attorney shall not issue a subpoena pursuant to subdivision (a) if the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(c) Notwithstanding subdivision (a), an attorney shall not issue a subpoena under this article based on a foreign subpoena that relates to a foreign penal civil action and that would require disclosure of information related to sensitive services. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the superior court of the county in which the discovery is to be conducted.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.SEC. 5. Section 11165 of the Health and Safety Code is amended to read:11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. The University of California shall be provided access to identifiable data for research purposes if the requirements of subdivision (t) of Section 1798.24 of the Civil Code are satisfied. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(C) (i) Notwithstanding subparagraph (A) or any other law, a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency shall not provide any CURES data or expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(ii) This section does not prohibit the investigation of any activity that is punishable as a crime under the laws of this state so long as no CURES data related to any legally protected health care activity, as defined in Section 1798.300 of the Civil Code, is shared with any individual or entity from another state.(3) The department shall may adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) Require a warrant, subpoena, or court order The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department or contracted prescription data processing vendor as soon as reasonably possible, but not more than one working day after the date a controlled substance is released to the patient or patients representative, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information with out-of-state authorized users so long as the entity operating an interstate data sharing hub, the interstate data sharing hub itself, and any information. An out-of-state authorized user who obtains CURES data through the interstate data sharing hub shall not provide any CURES data in furtherance of any investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(6)Out-of-state law enforcement shall not have access to CURES data through the interstate data sharing hub but may request CURES data from the department.(6) Notwithstanding subdivision (c), the department shall not provide CURES data to out-of-state law enforcement absent a warrant, subpoena, or court order, issued pursuant to Section 2029.300 or 2029.350 of the Code of Civil Procedure, or Section 1326 of the Penal Code.(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.(j) If the dispensing pharmacy, clinic, or other dispenser experiences a temporary technological or electrical failure, it shall, without undue delay, seek to correct any cause of the temporary technological or electrical failure that is reasonably within its control. The deadline for transmitting prescription information to the department or contracted prescription data processing vendor pursuant to subdivision (d) shall be extended until the failure is corrected. If the dispensing pharmacy, clinic, or other dispenser experiences technological limitations that are not reasonably within its control, or is impacted by a natural or manmade disaster, the deadline for transmitting prescription information to the department or contracted prescription data processing vendor shall be extended until normal operations have resumed.(k) (1) Any person who accesses the CURES database and who is not authorized by law to do so is guilty of a misdemeanor.(2) Any person authorized by law to access the CURES database and who knowingly furnishes the information from the CURES database to a person who is not authorized by law to receive that information is guilty of a misdemeanor.(3) This subdivision does not apply to a provider of health care as defined in Section 56.06 of the Civil Code that is subject to applicable state and federal medical privacy laws.SEC. 6. Section 1326 of the Penal Code is amended to read:1326. (a) The process by which the attendance of a witness before a court or magistrate is required is a subpoena. It may be signed and issued by any of the following:(1) A magistrate before whom a complaint is laid or their clerk, the district attorney or their investigator, or the public defender or their investigator, for witnesses in the state.(2) The district attorney, their investigator, or, upon request of the grand jury, any judge of the superior court, for witnesses in the state, in support of an indictment or information, to appear before the court in which it is to be tried.(3) The district attorney or their investigator, the public defender or their investigator, or the clerk of the court in which a criminal action is to be tried. The clerk shall, at any time, upon application of the defendant, and without charge, issue as many blank subpoenas, subscribed by them, for witnesses in the state, as the defendant may require.(4) The attorney of record for the defendant.(b) A subpoena issued in a criminal action that commands the custodian of records or other qualified witness of a business to produce books, papers, documents, or records shall direct that those items be delivered by the custodian or qualified witness in the manner specified in subdivision (b) of Section 1560 of the Evidence Code. Subdivision (e) of Section 1560 of the Evidence Code shall not apply to criminal cases.(c) (1) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action that interferes with an individuals rights to seek or obtain gender-affirming health care or gender-affirming mental health care or against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(d) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to sensitive services in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(e) In a criminal action, no party, or attorney or representative of a party, may issue a subpoena commanding the custodian of records or other qualified witness of a business to provide books, papers, documents, or records, or copies thereof, relating to a person or entity other than the subpoenaed person or entity in any manner other than that specified in subdivision (b) of Section 1560 of the Evidence Code. When a defendant has issued a subpoena to a person or entity that is not a party for the production of books, papers, documents, or records, or copies thereof, the court may order an in camera hearing to determine whether or not the defense is entitled to receive the documents. The court may not order the documents disclosed to the prosecution except as required by Section 1054.3.(f) This section shall not be construed to prohibit obtaining books, papers, documents, or records with the consent of the person to whom the books, papers, documents, or records relate.SEC. 7. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
5449
5550 The people of the State of California do enact as follows:
5651
5752 ## The people of the State of California do enact as follows:
5853
5954 SECTION 1. (a) The Legislature find and declares that California residents and visitors, especially transgender and gender nonconforming people, are being targeted for harassment, intimidation, and other harm, as are family members, teachers, and others who support them. The Legislature intends to comprehensively protect these Californians and visitors from both instate and out-of-state abuse, including from individuals purporting to act on behalf of the United States Government.(b) It is the intent of the Legislature to ensure that educators that may face retaliation or prosecution under President Trumps Executive Order on Ending Radical Indoctrination in K12 Schooling for prioritizing the safety and well-being of transgender youth are protected.
6055
6156 SECTION 1. (a) The Legislature find and declares that California residents and visitors, especially transgender and gender nonconforming people, are being targeted for harassment, intimidation, and other harm, as are family members, teachers, and others who support them. The Legislature intends to comprehensively protect these Californians and visitors from both instate and out-of-state abuse, including from individuals purporting to act on behalf of the United States Government.(b) It is the intent of the Legislature to ensure that educators that may face retaliation or prosecution under President Trumps Executive Order on Ending Radical Indoctrination in K12 Schooling for prioritizing the safety and well-being of transgender youth are protected.
6257
6358 SECTION 1. (a) The Legislature find and declares that California residents and visitors, especially transgender and gender nonconforming people, are being targeted for harassment, intimidation, and other harm, as are family members, teachers, and others who support them. The Legislature intends to comprehensively protect these Californians and visitors from both instate and out-of-state abuse, including from individuals purporting to act on behalf of the United States Government.
6459
6560 ### SECTION 1.
6661
6762 (b) It is the intent of the Legislature to ensure that educators that may face retaliation or prosecution under President Trumps Executive Order on Ending Radical Indoctrination in K12 Schooling for prioritizing the safety and well-being of transgender youth are protected.
6863
69-SEC. 2. Section 56.109 of the Civil Code is amended to read:56.109. (a) Notwithstanding subdivision (b) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any subpoena or request, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care or authorizes a person to bring a civil or criminal action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(b) Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the information is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care, and the information is being requested pursuant to another states law that authorizes a person to bring a civil or criminal action against a person or entity that provides, seeks, obtains, or receives gender-affirming health care or gender-affirming mental health care or who allows a child to receive gender-affirming health care or gender-affirming mental health care.(c) Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care that is lawful under the laws of this state.(d) This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.(e) For the purposes of this section, the following terms have the following meanings:(1) Gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) Person means an individual or governmental subdivision, agency, or instrumentality.
64+SEC. 2. Section 56.109 of the Civil Code is amended to read:56.109. (a) Notwithstanding subdivision (b) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any subpoena or request, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care or authorizes a person to bring a civil or criminal action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(b) Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the information is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care, and the information is being requested pursuant to another states law that authorizes a person to bring a civil or criminal action against a person or entity that provides, seeks, obtains, or receives gender-affirming health care or gender-affirming mental health care or who allows a child to receive gender-affirming health care or gender-affirming mental health care.(c) Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care that is lawful under the laws of this state.(d)This section does not prohibit compliance with the investigation of an activity that is punishable as a crime under the laws of this state as long as no medical information related to gender-affirming health care and gender-affirming mental health care is shared with an out-of-state agency or any other individual.(d) This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.(e) For the purposes of this section, the following terms have the following meanings:(1) Gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) Person means an individual or governmental subdivision, agency, or instrumentality.
7065
7166 SEC. 2. Section 56.109 of the Civil Code is amended to read:
7267
7368 ### SEC. 2.
7469
75-56.109. (a) Notwithstanding subdivision (b) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any subpoena or request, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care or authorizes a person to bring a civil or criminal action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(b) Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the information is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care, and the information is being requested pursuant to another states law that authorizes a person to bring a civil or criminal action against a person or entity that provides, seeks, obtains, or receives gender-affirming health care or gender-affirming mental health care or who allows a child to receive gender-affirming health care or gender-affirming mental health care.(c) Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care that is lawful under the laws of this state.(d) This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.(e) For the purposes of this section, the following terms have the following meanings:(1) Gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) Person means an individual or governmental subdivision, agency, or instrumentality.
70+56.109. (a) Notwithstanding subdivision (b) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any subpoena or request, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care or authorizes a person to bring a civil or criminal action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(b) Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the information is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care, and the information is being requested pursuant to another states law that authorizes a person to bring a civil or criminal action against a person or entity that provides, seeks, obtains, or receives gender-affirming health care or gender-affirming mental health care or who allows a child to receive gender-affirming health care or gender-affirming mental health care.(c) Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care that is lawful under the laws of this state.(d)This section does not prohibit compliance with the investigation of an activity that is punishable as a crime under the laws of this state as long as no medical information related to gender-affirming health care and gender-affirming mental health care is shared with an out-of-state agency or any other individual.(d) This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.(e) For the purposes of this section, the following terms have the following meanings:(1) Gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) Person means an individual or governmental subdivision, agency, or instrumentality.
7671
77-56.109. (a) Notwithstanding subdivision (b) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any subpoena or request, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care or authorizes a person to bring a civil or criminal action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(b) Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the information is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care, and the information is being requested pursuant to another states law that authorizes a person to bring a civil or criminal action against a person or entity that provides, seeks, obtains, or receives gender-affirming health care or gender-affirming mental health care or who allows a child to receive gender-affirming health care or gender-affirming mental health care.(c) Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care that is lawful under the laws of this state.(d) This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.(e) For the purposes of this section, the following terms have the following meanings:(1) Gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) Person means an individual or governmental subdivision, agency, or instrumentality.
72+56.109. (a) Notwithstanding subdivision (b) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any subpoena or request, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care or authorizes a person to bring a civil or criminal action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(b) Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the information is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care, and the information is being requested pursuant to another states law that authorizes a person to bring a civil or criminal action against a person or entity that provides, seeks, obtains, or receives gender-affirming health care or gender-affirming mental health care or who allows a child to receive gender-affirming health care or gender-affirming mental health care.(c) Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care that is lawful under the laws of this state.(d)This section does not prohibit compliance with the investigation of an activity that is punishable as a crime under the laws of this state as long as no medical information related to gender-affirming health care and gender-affirming mental health care is shared with an out-of-state agency or any other individual.(d) This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.(e) For the purposes of this section, the following terms have the following meanings:(1) Gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) Person means an individual or governmental subdivision, agency, or instrumentality.
7873
79-56.109. (a) Notwithstanding subdivision (b) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any subpoena or request, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care or authorizes a person to bring a civil or criminal action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(b) Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the information is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care, and the information is being requested pursuant to another states law that authorizes a person to bring a civil or criminal action against a person or entity that provides, seeks, obtains, or receives gender-affirming health care or gender-affirming mental health care or who allows a child to receive gender-affirming health care or gender-affirming mental health care.(c) Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care that is lawful under the laws of this state.(d) This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.(e) For the purposes of this section, the following terms have the following meanings:(1) Gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) Person means an individual or governmental subdivision, agency, or instrumentality.
74+56.109. (a) Notwithstanding subdivision (b) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any subpoena or request, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care or authorizes a person to bring a civil or criminal action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(b) Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the information is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care, and the information is being requested pursuant to another states law that authorizes a person to bring a civil or criminal action against a person or entity that provides, seeks, obtains, or receives gender-affirming health care or gender-affirming mental health care or who allows a child to receive gender-affirming health care or gender-affirming mental health care.(c) Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care that is lawful under the laws of this state.(d)This section does not prohibit compliance with the investigation of an activity that is punishable as a crime under the laws of this state as long as no medical information related to gender-affirming health care and gender-affirming mental health care is shared with an out-of-state agency or any other individual.(d) This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.(e) For the purposes of this section, the following terms have the following meanings:(1) Gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) Person means an individual or governmental subdivision, agency, or instrumentality.
75+
76+
8077
8178 56.109. (a) Notwithstanding subdivision (b) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any subpoena or request, including a foreign subpoena, based on another states law that interferes with an individuals right to seek or obtain gender-affirming health care or gender-affirming mental health care or authorizes a person to bring a civil or criminal action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.
82-
83-###### 56.109.
8479
8580 (b) Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the information is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care, and the information is being requested pursuant to another states law that authorizes a person to bring a civil or criminal action against a person or entity that provides, seeks, obtains, or receives gender-affirming health care or gender-affirming mental health care or who allows a child to receive gender-affirming health care or gender-affirming mental health care.
8681
8782 (c) Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care that is lawful under the laws of this state.
83+
84+(d)This section does not prohibit compliance with the investigation of an activity that is punishable as a crime under the laws of this state as long as no medical information related to gender-affirming health care and gender-affirming mental health care is shared with an out-of-state agency or any other individual.
85+
86+
8887
8988 (d) This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.
9089
9190 (e) For the purposes of this section, the following terms have the following meanings:
9291
9392 (1) Gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.
9493
9594 (2) Person means an individual or governmental subdivision, agency, or instrumentality.
9695
9796 SEC. 3. Section 2029.300 of the Code of Civil Procedure is amended to read:2029.300. (a) To request issuance of a subpoena under this section, a party shall submit the original or a true and correct copy of a foreign subpoena to the clerk of the superior court in the county in which discovery is sought to be conducted in this state. A request for the issuance of a subpoena under this section does not constitute making an appearance in the courts of this state.(b) In addition to submitting a foreign subpoena under subdivision (a), a party seeking discovery shall do both of the following:(1) Submit an application requesting that the superior court issue a subpoena with the same terms as the foreign subpoena. The application shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390. No civil case cover sheet is required.(2) Pay the fee specified in Section 70626 of the Government Code.(c) When a party submits a foreign subpoena to the clerk of the superior court in accordance with subdivision (a), and satisfies the requirements of subdivision (b), the clerk shall promptly issue a subpoena for service upon the person to which the foreign subpoena is directed.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the court that issues it.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.(e) Notwithstanding subdivision (a), a subpoena shall not be issued pursuant to this section in any of the following circumstances:(1) If the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care. For the purpose of this paragraph, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) If the submitted foreign subpoena relates to a foreign penal civil action and would require disclosure of information related to sensitive services. For purposes of this paragraph, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.
9897
9998 SEC. 3. Section 2029.300 of the Code of Civil Procedure is amended to read:
10099
101100 ### SEC. 3.
102101
103102 2029.300. (a) To request issuance of a subpoena under this section, a party shall submit the original or a true and correct copy of a foreign subpoena to the clerk of the superior court in the county in which discovery is sought to be conducted in this state. A request for the issuance of a subpoena under this section does not constitute making an appearance in the courts of this state.(b) In addition to submitting a foreign subpoena under subdivision (a), a party seeking discovery shall do both of the following:(1) Submit an application requesting that the superior court issue a subpoena with the same terms as the foreign subpoena. The application shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390. No civil case cover sheet is required.(2) Pay the fee specified in Section 70626 of the Government Code.(c) When a party submits a foreign subpoena to the clerk of the superior court in accordance with subdivision (a), and satisfies the requirements of subdivision (b), the clerk shall promptly issue a subpoena for service upon the person to which the foreign subpoena is directed.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the court that issues it.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.(e) Notwithstanding subdivision (a), a subpoena shall not be issued pursuant to this section in any of the following circumstances:(1) If the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care. For the purpose of this paragraph, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) If the submitted foreign subpoena relates to a foreign penal civil action and would require disclosure of information related to sensitive services. For purposes of this paragraph, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.
104103
105104 2029.300. (a) To request issuance of a subpoena under this section, a party shall submit the original or a true and correct copy of a foreign subpoena to the clerk of the superior court in the county in which discovery is sought to be conducted in this state. A request for the issuance of a subpoena under this section does not constitute making an appearance in the courts of this state.(b) In addition to submitting a foreign subpoena under subdivision (a), a party seeking discovery shall do both of the following:(1) Submit an application requesting that the superior court issue a subpoena with the same terms as the foreign subpoena. The application shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390. No civil case cover sheet is required.(2) Pay the fee specified in Section 70626 of the Government Code.(c) When a party submits a foreign subpoena to the clerk of the superior court in accordance with subdivision (a), and satisfies the requirements of subdivision (b), the clerk shall promptly issue a subpoena for service upon the person to which the foreign subpoena is directed.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the court that issues it.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.(e) Notwithstanding subdivision (a), a subpoena shall not be issued pursuant to this section in any of the following circumstances:(1) If the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care. For the purpose of this paragraph, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) If the submitted foreign subpoena relates to a foreign penal civil action and would require disclosure of information related to sensitive services. For purposes of this paragraph, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.
106105
107106 2029.300. (a) To request issuance of a subpoena under this section, a party shall submit the original or a true and correct copy of a foreign subpoena to the clerk of the superior court in the county in which discovery is sought to be conducted in this state. A request for the issuance of a subpoena under this section does not constitute making an appearance in the courts of this state.(b) In addition to submitting a foreign subpoena under subdivision (a), a party seeking discovery shall do both of the following:(1) Submit an application requesting that the superior court issue a subpoena with the same terms as the foreign subpoena. The application shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390. No civil case cover sheet is required.(2) Pay the fee specified in Section 70626 of the Government Code.(c) When a party submits a foreign subpoena to the clerk of the superior court in accordance with subdivision (a), and satisfies the requirements of subdivision (b), the clerk shall promptly issue a subpoena for service upon the person to which the foreign subpoena is directed.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the court that issues it.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.(e) Notwithstanding subdivision (a), a subpoena shall not be issued pursuant to this section in any of the following circumstances:(1) If the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care. For the purpose of this paragraph, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(2) If the submitted foreign subpoena relates to a foreign penal civil action and would require disclosure of information related to sensitive services. For purposes of this paragraph, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.
108107
108+
109+
109110 2029.300. (a) To request issuance of a subpoena under this section, a party shall submit the original or a true and correct copy of a foreign subpoena to the clerk of the superior court in the county in which discovery is sought to be conducted in this state. A request for the issuance of a subpoena under this section does not constitute making an appearance in the courts of this state.
110-
111-###### 2029.300.
112111
113112 (b) In addition to submitting a foreign subpoena under subdivision (a), a party seeking discovery shall do both of the following:
114113
115114 (1) Submit an application requesting that the superior court issue a subpoena with the same terms as the foreign subpoena. The application shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390. No civil case cover sheet is required.
116115
117116 (2) Pay the fee specified in Section 70626 of the Government Code.
118117
119118 (c) When a party submits a foreign subpoena to the clerk of the superior court in accordance with subdivision (a), and satisfies the requirements of subdivision (b), the clerk shall promptly issue a subpoena for service upon the person to which the foreign subpoena is directed.
120119
121120 (d) A subpoena issued under this section shall satisfy all of the following conditions:
122121
123122 (1) It shall incorporate the terms used in the foreign subpoena.
124123
125124 (2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.
126125
127126 (3) It shall bear the caption and case number of the out-of-state case to which it relates.
128127
129128 (4) It shall state the name of the court that issues it.
130129
131130 (5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.
132131
133132 (e) Notwithstanding subdivision (a), a subpoena shall not be issued pursuant to this section in any of the following circumstances:
134133
135134 (1) If the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care. For the purpose of this paragraph, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.
136135
137136 (2) If the submitted foreign subpoena relates to a foreign penal civil action and would require disclosure of information related to sensitive services. For purposes of this paragraph, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.
138137
139138 SEC. 4. Section 2029.350 of the Code of Civil Procedure is amended to read:2029.350. (a) Notwithstanding Sections 1986 and 2029.300, if a party to a proceeding pending in a foreign jurisdiction retains an attorney licensed to practice in this state, who is an active member of the State Bar, and that attorney receives the original or a true and correct copy of a foreign subpoena, the attorney may issue a subpoena under this article.(b) (1) Notwithstanding subdivision (a), an authorized attorney shall not issue a subpoena pursuant to subdivision (a) if the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(c) Notwithstanding subdivision (a), an attorney shall not issue a subpoena under this article based on a foreign subpoena that relates to a foreign penal civil action and that would require disclosure of information related to sensitive services. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the superior court of the county in which the discovery is to be conducted.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.
140139
141140 SEC. 4. Section 2029.350 of the Code of Civil Procedure is amended to read:
142141
143142 ### SEC. 4.
144143
145144 2029.350. (a) Notwithstanding Sections 1986 and 2029.300, if a party to a proceeding pending in a foreign jurisdiction retains an attorney licensed to practice in this state, who is an active member of the State Bar, and that attorney receives the original or a true and correct copy of a foreign subpoena, the attorney may issue a subpoena under this article.(b) (1) Notwithstanding subdivision (a), an authorized attorney shall not issue a subpoena pursuant to subdivision (a) if the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(c) Notwithstanding subdivision (a), an attorney shall not issue a subpoena under this article based on a foreign subpoena that relates to a foreign penal civil action and that would require disclosure of information related to sensitive services. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the superior court of the county in which the discovery is to be conducted.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.
146145
147146 2029.350. (a) Notwithstanding Sections 1986 and 2029.300, if a party to a proceeding pending in a foreign jurisdiction retains an attorney licensed to practice in this state, who is an active member of the State Bar, and that attorney receives the original or a true and correct copy of a foreign subpoena, the attorney may issue a subpoena under this article.(b) (1) Notwithstanding subdivision (a), an authorized attorney shall not issue a subpoena pursuant to subdivision (a) if the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(c) Notwithstanding subdivision (a), an attorney shall not issue a subpoena under this article based on a foreign subpoena that relates to a foreign penal civil action and that would require disclosure of information related to sensitive services. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the superior court of the county in which the discovery is to be conducted.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.
148147
149148 2029.350. (a) Notwithstanding Sections 1986 and 2029.300, if a party to a proceeding pending in a foreign jurisdiction retains an attorney licensed to practice in this state, who is an active member of the State Bar, and that attorney receives the original or a true and correct copy of a foreign subpoena, the attorney may issue a subpoena under this article.(b) (1) Notwithstanding subdivision (a), an authorized attorney shall not issue a subpoena pursuant to subdivision (a) if the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(c) Notwithstanding subdivision (a), an attorney shall not issue a subpoena under this article based on a foreign subpoena that relates to a foreign penal civil action and that would require disclosure of information related to sensitive services. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(d) A subpoena issued under this section shall satisfy all of the following conditions:(1) It shall incorporate the terms used in the foreign subpoena.(2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.(3) It shall bear the caption and case number of the out-of-state case to which it relates.(4) It shall state the name of the superior court of the county in which the discovery is to be conducted.(5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.
150149
150+
151+
151152 2029.350. (a) Notwithstanding Sections 1986 and 2029.300, if a party to a proceeding pending in a foreign jurisdiction retains an attorney licensed to practice in this state, who is an active member of the State Bar, and that attorney receives the original or a true and correct copy of a foreign subpoena, the attorney may issue a subpoena under this article.
152-
153-###### 2029.350.
154153
155154 (b) (1) Notwithstanding subdivision (a), an authorized attorney shall not issue a subpoena pursuant to subdivision (a) if the foreign subpoena is based on a violation of another states laws that interfere with a persons right to seek or obtain gender-affirming health care or gender-affirming mental health care or to allow a child to receive gender-affirming health care or gender-affirming mental health care.
156155
157156 (2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.
158157
159158 (c) Notwithstanding subdivision (a), an attorney shall not issue a subpoena under this article based on a foreign subpoena that relates to a foreign penal civil action and that would require disclosure of information related to sensitive services. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.
160159
161160 (d) A subpoena issued under this section shall satisfy all of the following conditions:
162161
163162 (1) It shall incorporate the terms used in the foreign subpoena.
164163
165164 (2) It shall contain or be accompanied by the names, addresses, and telephone numbers of all counsel of record in the proceeding to which the subpoena relates and of any party not represented by counsel.
166165
167166 (3) It shall bear the caption and case number of the out-of-state case to which it relates.
168167
169168 (4) It shall state the name of the superior court of the county in which the discovery is to be conducted.
170169
171170 (5) It shall be on a form prescribed by the Judicial Council pursuant to Section 2029.390.
172171
173-SEC. 5. Section 11165 of the Health and Safety Code is amended to read:11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. The University of California shall be provided access to identifiable data for research purposes if the requirements of subdivision (t) of Section 1798.24 of the Civil Code are satisfied. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(C) (i) Notwithstanding subparagraph (A) or any other law, a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency shall not provide any CURES data or expend knowingly provide any CURES data or knowingly expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(ii) This section does not prohibit the investigation of any activity that is punishable as a crime under the laws of this state so long as no CURES data related to any legally protected health care activity, as defined in Section 1798.300 of the Civil Code, is not knowingly shared with any individual or entity from another state.(3) The department may adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department or contracted prescription data processing vendor as soon as reasonably possible, but not more than one working day after the date a controlled substance is released to the patient or patients representative, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information. An out-of-state authorized user who obtains CURES data through the interstate data sharing hub shall not provide any CURES data in furtherance of any investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(6) Notwithstanding subdivision (c), the department shall not provide CURES data to out-of-state law enforcement absent a warrant, subpoena, or court order, issued pursuant to Section 2029.300 or 2029.350 of the Code of Civil Procedure, or Section 1326 of the Penal Code.(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.(j) If the dispensing pharmacy, clinic, or other dispenser experiences a temporary technological or electrical failure, it shall, without undue delay, seek to correct any cause of the temporary technological or electrical failure that is reasonably within its control. The deadline for transmitting prescription information to the department or contracted prescription data processing vendor pursuant to subdivision (d) shall be extended until the failure is corrected. If the dispensing pharmacy, clinic, or other dispenser experiences technological limitations that are not reasonably within its control, or is impacted by a natural or manmade disaster, the deadline for transmitting prescription information to the department or contracted prescription data processing vendor shall be extended until normal operations have resumed.(k) (1) Any person who accesses the CURES database and who is not authorized by law to do so is guilty of a misdemeanor.(2) Any person authorized by law to access the CURES database and who knowingly furnishes the information from the CURES database to a person who is not authorized by law to receive that information is guilty of a misdemeanor.(3) This subdivision does not apply to a provider of health care as defined in Section 56.06 of the Civil Code that is subject to applicable state and federal medical privacy laws.
172+SEC. 5. Section 11165 of the Health and Safety Code is amended to read:11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. The University of California shall be provided access to identifiable data for research purposes if the requirements of subdivision (t) of Section 1798.24 of the Civil Code are satisfied. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(C) (i) Notwithstanding subparagraph (A) or any other law, a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency shall not provide any CURES data or expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(ii) This section does not prohibit the investigation of any activity that is punishable as a crime under the laws of this state so long as no CURES data related to any legally protected health care activity, as defined in Section 1798.300 of the Civil Code, is shared with any individual or entity from another state.(3) The department shall may adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) Require a warrant, subpoena, or court order The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department or contracted prescription data processing vendor as soon as reasonably possible, but not more than one working day after the date a controlled substance is released to the patient or patients representative, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information with out-of-state authorized users so long as the entity operating an interstate data sharing hub, the interstate data sharing hub itself, and any information. An out-of-state authorized user who obtains CURES data through the interstate data sharing hub shall not provide any CURES data in furtherance of any investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(6)Out-of-state law enforcement shall not have access to CURES data through the interstate data sharing hub but may request CURES data from the department.(6) Notwithstanding subdivision (c), the department shall not provide CURES data to out-of-state law enforcement absent a warrant, subpoena, or court order, issued pursuant to Section 2029.300 or 2029.350 of the Code of Civil Procedure, or Section 1326 of the Penal Code.(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.(j) If the dispensing pharmacy, clinic, or other dispenser experiences a temporary technological or electrical failure, it shall, without undue delay, seek to correct any cause of the temporary technological or electrical failure that is reasonably within its control. The deadline for transmitting prescription information to the department or contracted prescription data processing vendor pursuant to subdivision (d) shall be extended until the failure is corrected. If the dispensing pharmacy, clinic, or other dispenser experiences technological limitations that are not reasonably within its control, or is impacted by a natural or manmade disaster, the deadline for transmitting prescription information to the department or contracted prescription data processing vendor shall be extended until normal operations have resumed.(k) (1) Any person who accesses the CURES database and who is not authorized by law to do so is guilty of a misdemeanor.(2) Any person authorized by law to access the CURES database and who knowingly furnishes the information from the CURES database to a person who is not authorized by law to receive that information is guilty of a misdemeanor.(3) This subdivision does not apply to a provider of health care as defined in Section 56.06 of the Civil Code that is subject to applicable state and federal medical privacy laws.
174173
175174 SEC. 5. Section 11165 of the Health and Safety Code is amended to read:
176175
177176 ### SEC. 5.
178177
179-11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. The University of California shall be provided access to identifiable data for research purposes if the requirements of subdivision (t) of Section 1798.24 of the Civil Code are satisfied. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(C) (i) Notwithstanding subparagraph (A) or any other law, a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency shall not provide any CURES data or expend knowingly provide any CURES data or knowingly expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(ii) This section does not prohibit the investigation of any activity that is punishable as a crime under the laws of this state so long as no CURES data related to any legally protected health care activity, as defined in Section 1798.300 of the Civil Code, is not knowingly shared with any individual or entity from another state.(3) The department may adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department or contracted prescription data processing vendor as soon as reasonably possible, but not more than one working day after the date a controlled substance is released to the patient or patients representative, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information. An out-of-state authorized user who obtains CURES data through the interstate data sharing hub shall not provide any CURES data in furtherance of any investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(6) Notwithstanding subdivision (c), the department shall not provide CURES data to out-of-state law enforcement absent a warrant, subpoena, or court order, issued pursuant to Section 2029.300 or 2029.350 of the Code of Civil Procedure, or Section 1326 of the Penal Code.(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.(j) If the dispensing pharmacy, clinic, or other dispenser experiences a temporary technological or electrical failure, it shall, without undue delay, seek to correct any cause of the temporary technological or electrical failure that is reasonably within its control. The deadline for transmitting prescription information to the department or contracted prescription data processing vendor pursuant to subdivision (d) shall be extended until the failure is corrected. If the dispensing pharmacy, clinic, or other dispenser experiences technological limitations that are not reasonably within its control, or is impacted by a natural or manmade disaster, the deadline for transmitting prescription information to the department or contracted prescription data processing vendor shall be extended until normal operations have resumed.(k) (1) Any person who accesses the CURES database and who is not authorized by law to do so is guilty of a misdemeanor.(2) Any person authorized by law to access the CURES database and who knowingly furnishes the information from the CURES database to a person who is not authorized by law to receive that information is guilty of a misdemeanor.(3) This subdivision does not apply to a provider of health care as defined in Section 56.06 of the Civil Code that is subject to applicable state and federal medical privacy laws.
178+11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. The University of California shall be provided access to identifiable data for research purposes if the requirements of subdivision (t) of Section 1798.24 of the Civil Code are satisfied. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(C) (i) Notwithstanding subparagraph (A) or any other law, a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency shall not provide any CURES data or expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(ii) This section does not prohibit the investigation of any activity that is punishable as a crime under the laws of this state so long as no CURES data related to any legally protected health care activity, as defined in Section 1798.300 of the Civil Code, is shared with any individual or entity from another state.(3) The department shall may adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) Require a warrant, subpoena, or court order The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department or contracted prescription data processing vendor as soon as reasonably possible, but not more than one working day after the date a controlled substance is released to the patient or patients representative, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information with out-of-state authorized users so long as the entity operating an interstate data sharing hub, the interstate data sharing hub itself, and any information. An out-of-state authorized user who obtains CURES data through the interstate data sharing hub shall not provide any CURES data in furtherance of any investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(6)Out-of-state law enforcement shall not have access to CURES data through the interstate data sharing hub but may request CURES data from the department.(6) Notwithstanding subdivision (c), the department shall not provide CURES data to out-of-state law enforcement absent a warrant, subpoena, or court order, issued pursuant to Section 2029.300 or 2029.350 of the Code of Civil Procedure, or Section 1326 of the Penal Code.(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.(j) If the dispensing pharmacy, clinic, or other dispenser experiences a temporary technological or electrical failure, it shall, without undue delay, seek to correct any cause of the temporary technological or electrical failure that is reasonably within its control. The deadline for transmitting prescription information to the department or contracted prescription data processing vendor pursuant to subdivision (d) shall be extended until the failure is corrected. If the dispensing pharmacy, clinic, or other dispenser experiences technological limitations that are not reasonably within its control, or is impacted by a natural or manmade disaster, the deadline for transmitting prescription information to the department or contracted prescription data processing vendor shall be extended until normal operations have resumed.(k) (1) Any person who accesses the CURES database and who is not authorized by law to do so is guilty of a misdemeanor.(2) Any person authorized by law to access the CURES database and who knowingly furnishes the information from the CURES database to a person who is not authorized by law to receive that information is guilty of a misdemeanor.(3) This subdivision does not apply to a provider of health care as defined in Section 56.06 of the Civil Code that is subject to applicable state and federal medical privacy laws.
180179
181-11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. The University of California shall be provided access to identifiable data for research purposes if the requirements of subdivision (t) of Section 1798.24 of the Civil Code are satisfied. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(C) (i) Notwithstanding subparagraph (A) or any other law, a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency shall not provide any CURES data or expend knowingly provide any CURES data or knowingly expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(ii) This section does not prohibit the investigation of any activity that is punishable as a crime under the laws of this state so long as no CURES data related to any legally protected health care activity, as defined in Section 1798.300 of the Civil Code, is not knowingly shared with any individual or entity from another state.(3) The department may adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department or contracted prescription data processing vendor as soon as reasonably possible, but not more than one working day after the date a controlled substance is released to the patient or patients representative, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information. An out-of-state authorized user who obtains CURES data through the interstate data sharing hub shall not provide any CURES data in furtherance of any investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(6) Notwithstanding subdivision (c), the department shall not provide CURES data to out-of-state law enforcement absent a warrant, subpoena, or court order, issued pursuant to Section 2029.300 or 2029.350 of the Code of Civil Procedure, or Section 1326 of the Penal Code.(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.(j) If the dispensing pharmacy, clinic, or other dispenser experiences a temporary technological or electrical failure, it shall, without undue delay, seek to correct any cause of the temporary technological or electrical failure that is reasonably within its control. The deadline for transmitting prescription information to the department or contracted prescription data processing vendor pursuant to subdivision (d) shall be extended until the failure is corrected. If the dispensing pharmacy, clinic, or other dispenser experiences technological limitations that are not reasonably within its control, or is impacted by a natural or manmade disaster, the deadline for transmitting prescription information to the department or contracted prescription data processing vendor shall be extended until normal operations have resumed.(k) (1) Any person who accesses the CURES database and who is not authorized by law to do so is guilty of a misdemeanor.(2) Any person authorized by law to access the CURES database and who knowingly furnishes the information from the CURES database to a person who is not authorized by law to receive that information is guilty of a misdemeanor.(3) This subdivision does not apply to a provider of health care as defined in Section 56.06 of the Civil Code that is subject to applicable state and federal medical privacy laws.
180+11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. The University of California shall be provided access to identifiable data for research purposes if the requirements of subdivision (t) of Section 1798.24 of the Civil Code are satisfied. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(C) (i) Notwithstanding subparagraph (A) or any other law, a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency shall not provide any CURES data or expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(ii) This section does not prohibit the investigation of any activity that is punishable as a crime under the laws of this state so long as no CURES data related to any legally protected health care activity, as defined in Section 1798.300 of the Civil Code, is shared with any individual or entity from another state.(3) The department shall may adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) Require a warrant, subpoena, or court order The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department or contracted prescription data processing vendor as soon as reasonably possible, but not more than one working day after the date a controlled substance is released to the patient or patients representative, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information with out-of-state authorized users so long as the entity operating an interstate data sharing hub, the interstate data sharing hub itself, and any information. An out-of-state authorized user who obtains CURES data through the interstate data sharing hub shall not provide any CURES data in furtherance of any investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(6)Out-of-state law enforcement shall not have access to CURES data through the interstate data sharing hub but may request CURES data from the department.(6) Notwithstanding subdivision (c), the department shall not provide CURES data to out-of-state law enforcement absent a warrant, subpoena, or court order, issued pursuant to Section 2029.300 or 2029.350 of the Code of Civil Procedure, or Section 1326 of the Penal Code.(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.(j) If the dispensing pharmacy, clinic, or other dispenser experiences a temporary technological or electrical failure, it shall, without undue delay, seek to correct any cause of the temporary technological or electrical failure that is reasonably within its control. The deadline for transmitting prescription information to the department or contracted prescription data processing vendor pursuant to subdivision (d) shall be extended until the failure is corrected. If the dispensing pharmacy, clinic, or other dispenser experiences technological limitations that are not reasonably within its control, or is impacted by a natural or manmade disaster, the deadline for transmitting prescription information to the department or contracted prescription data processing vendor shall be extended until normal operations have resumed.(k) (1) Any person who accesses the CURES database and who is not authorized by law to do so is guilty of a misdemeanor.(2) Any person authorized by law to access the CURES database and who knowingly furnishes the information from the CURES database to a person who is not authorized by law to receive that information is guilty of a misdemeanor.(3) This subdivision does not apply to a provider of health care as defined in Section 56.06 of the Civil Code that is subject to applicable state and federal medical privacy laws.
182181
183-11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. The University of California shall be provided access to identifiable data for research purposes if the requirements of subdivision (t) of Section 1798.24 of the Civil Code are satisfied. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(C) (i) Notwithstanding subparagraph (A) or any other law, a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency shall not provide any CURES data or expend knowingly provide any CURES data or knowingly expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(ii) This section does not prohibit the investigation of any activity that is punishable as a crime under the laws of this state so long as no CURES data related to any legally protected health care activity, as defined in Section 1798.300 of the Civil Code, is not knowingly shared with any individual or entity from another state.(3) The department may adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department or contracted prescription data processing vendor as soon as reasonably possible, but not more than one working day after the date a controlled substance is released to the patient or patients representative, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information. An out-of-state authorized user who obtains CURES data through the interstate data sharing hub shall not provide any CURES data in furtherance of any investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(6) Notwithstanding subdivision (c), the department shall not provide CURES data to out-of-state law enforcement absent a warrant, subpoena, or court order, issued pursuant to Section 2029.300 or 2029.350 of the Code of Civil Procedure, or Section 1326 of the Penal Code.(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.(j) If the dispensing pharmacy, clinic, or other dispenser experiences a temporary technological or electrical failure, it shall, without undue delay, seek to correct any cause of the temporary technological or electrical failure that is reasonably within its control. The deadline for transmitting prescription information to the department or contracted prescription data processing vendor pursuant to subdivision (d) shall be extended until the failure is corrected. If the dispensing pharmacy, clinic, or other dispenser experiences technological limitations that are not reasonably within its control, or is impacted by a natural or manmade disaster, the deadline for transmitting prescription information to the department or contracted prescription data processing vendor shall be extended until normal operations have resumed.(k) (1) Any person who accesses the CURES database and who is not authorized by law to do so is guilty of a misdemeanor.(2) Any person authorized by law to access the CURES database and who knowingly furnishes the information from the CURES database to a person who is not authorized by law to receive that information is guilty of a misdemeanor.(3) This subdivision does not apply to a provider of health care as defined in Section 56.06 of the Civil Code that is subject to applicable state and federal medical privacy laws.
182+11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.(b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. The University of California shall be provided access to identifiable data for research purposes if the requirements of subdivision (t) of Section 1798.24 of the Civil Code are satisfied. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.(C) (i) Notwithstanding subparagraph (A) or any other law, a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency shall not provide any CURES data or expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(ii) This section does not prohibit the investigation of any activity that is punishable as a crime under the laws of this state so long as no CURES data related to any legally protected health care activity, as defined in Section 1798.300 of the Civil Code, is shared with any individual or entity from another state.(3) The department shall may adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:(A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.(B) The purposes for which a health care practitioner may access information in CURES.(C) Require a warrant, subpoena, or court order The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.(D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.(4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.(d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department or contracted prescription data processing vendor as soon as reasonably possible, but not more than one working day after the date a controlled substance is released to the patient or patients representative, in a format specified by the department:(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender and date of birth of the ultimate user.(2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.(4) National Drug Code (NDC) number of the controlled substance dispensed.(5) Quantity of the controlled substance dispensed.(6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.(7) Number of refills ordered.(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.(9) Prescribing date of the prescription.(10) Date of dispensing of the prescription.(11) The serial number for the corresponding prescription form, if applicable.(e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.(f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).(g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information with out-of-state authorized users so long as the entity operating an interstate data sharing hub, the interstate data sharing hub itself, and any information. An out-of-state authorized user who obtains CURES data through the interstate data sharing hub shall not provide any CURES data in furtherance of any investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.(2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.(3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.(4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.(5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).(6)Out-of-state law enforcement shall not have access to CURES data through the interstate data sharing hub but may request CURES data from the department.(6) Notwithstanding subdivision (c), the department shall not provide CURES data to out-of-state law enforcement absent a warrant, subpoena, or court order, issued pursuant to Section 2029.300 or 2029.350 of the Code of Civil Procedure, or Section 1326 of the Penal Code.(i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.(j) If the dispensing pharmacy, clinic, or other dispenser experiences a temporary technological or electrical failure, it shall, without undue delay, seek to correct any cause of the temporary technological or electrical failure that is reasonably within its control. The deadline for transmitting prescription information to the department or contracted prescription data processing vendor pursuant to subdivision (d) shall be extended until the failure is corrected. If the dispensing pharmacy, clinic, or other dispenser experiences technological limitations that are not reasonably within its control, or is impacted by a natural or manmade disaster, the deadline for transmitting prescription information to the department or contracted prescription data processing vendor shall be extended until normal operations have resumed.(k) (1) Any person who accesses the CURES database and who is not authorized by law to do so is guilty of a misdemeanor.(2) Any person authorized by law to access the CURES database and who knowingly furnishes the information from the CURES database to a person who is not authorized by law to receive that information is guilty of a misdemeanor.(3) This subdivision does not apply to a provider of health care as defined in Section 56.06 of the Civil Code that is subject to applicable state and federal medical privacy laws.
183+
184+
184185
185186 11165. (a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, Schedule IV, and Schedule V controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.
186-
187-###### 11165.
188187
189188 (b) The department may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.
190189
191190 (c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.
192191
193192 (2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. The University of California shall be provided access to identifiable data for research purposes if the requirements of subdivision (t) of Section 1798.24 of the Civil Code are satisfied. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.
194193
195194 (B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.
196195
197-(C) (i) Notwithstanding subparagraph (A) or any other law, a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency shall not provide any CURES data or expend knowingly provide any CURES data or knowingly expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.
196+(C) (i) Notwithstanding subparagraph (A) or any other law, a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency shall not provide any CURES data or expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.
198197
199-(ii) This section does not prohibit the investigation of any activity that is punishable as a crime under the laws of this state so long as no CURES data related to any legally protected health care activity, as defined in Section 1798.300 of the Civil Code, is not knowingly shared with any individual or entity from another state.
198+(ii) This section does not prohibit the investigation of any activity that is punishable as a crime under the laws of this state so long as no CURES data related to any legally protected health care activity, as defined in Section 1798.300 of the Civil Code, is shared with any individual or entity from another state.
200199
201-(3) The department may adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:
200+(3) The department shall may adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:
202201
203202 (A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.
204203
205204 (B) The purposes for which a health care practitioner may access information in CURES.
206205
207-(C) The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.
206+(C) Require a warrant, subpoena, or court order The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.
208207
209208 (D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.
210209
211210 (4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patients CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patients medical record in compliance with subdivision (d) of Section 11165.1.
212211
213212 (d) For each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department or contracted prescription data processing vendor as soon as reasonably possible, but not more than one working day after the date a controlled substance is released to the patient or patients representative, in a format specified by the department:
214213
215214 (1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender and date of birth of the ultimate user.
216215
217216 (2) The prescribers category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.
218217
219218 (3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.
220219
221220 (4) National Drug Code (NDC) number of the controlled substance dispensed.
222221
223222 (5) Quantity of the controlled substance dispensed.
224223
225224 (6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.
226225
227226 (7) Number of refills ordered.
228227
229228 (8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.
230229
231230 (9) Prescribing date of the prescription.
232231
233232 (10) Date of dispensing of the prescription.
234233
235234 (11) The serial number for the corresponding prescription form, if applicable.
236235
237236 (e) The department may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. A prescriber or dispenser invitee shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.
238237
239238 (f) The department shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).
240239
241240 (g) The department may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.
242241
243-(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information. An out-of-state authorized user who obtains CURES data through the interstate data sharing hub shall not provide any CURES data in furtherance of any investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.
242+(h) (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information with out-of-state authorized users so long as the entity operating an interstate data sharing hub, the interstate data sharing hub itself, and any information. An out-of-state authorized user who obtains CURES data through the interstate data sharing hub shall not provide any CURES data in furtherance of any investigation or proceeding seeking to impose civil, criminal, or disciplinary liability upon the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.
244243
245244 (2) Data obtained from CURES may be provided to authorized users of another states prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.
246245
247246 (3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.
248247
249248 (4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another states prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that states prescription drug monitoring program.
250249
251250 (5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).
251+
252+(6)Out-of-state law enforcement shall not have access to CURES data through the interstate data sharing hub but may request CURES data from the department.
253+
254+
252255
253256 (6) Notwithstanding subdivision (c), the department shall not provide CURES data to out-of-state law enforcement absent a warrant, subpoena, or court order, issued pursuant to Section 2029.300 or 2029.350 of the Code of Civil Procedure, or Section 1326 of the Penal Code.
254257
255258 (i) Notwithstanding subdivision (d), a veterinarian shall report the information required by that subdivision to the department as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.
256259
257260 (j) If the dispensing pharmacy, clinic, or other dispenser experiences a temporary technological or electrical failure, it shall, without undue delay, seek to correct any cause of the temporary technological or electrical failure that is reasonably within its control. The deadline for transmitting prescription information to the department or contracted prescription data processing vendor pursuant to subdivision (d) shall be extended until the failure is corrected. If the dispensing pharmacy, clinic, or other dispenser experiences technological limitations that are not reasonably within its control, or is impacted by a natural or manmade disaster, the deadline for transmitting prescription information to the department or contracted prescription data processing vendor shall be extended until normal operations have resumed.
258261
259262 (k) (1) Any person who accesses the CURES database and who is not authorized by law to do so is guilty of a misdemeanor.
260263
261264 (2) Any person authorized by law to access the CURES database and who knowingly furnishes the information from the CURES database to a person who is not authorized by law to receive that information is guilty of a misdemeanor.
262265
263266 (3) This subdivision does not apply to a provider of health care as defined in Section 56.06 of the Civil Code that is subject to applicable state and federal medical privacy laws.
264267
265268 SEC. 6. Section 1326 of the Penal Code is amended to read:1326. (a) The process by which the attendance of a witness before a court or magistrate is required is a subpoena. It may be signed and issued by any of the following:(1) A magistrate before whom a complaint is laid or their clerk, the district attorney or their investigator, or the public defender or their investigator, for witnesses in the state.(2) The district attorney, their investigator, or, upon request of the grand jury, any judge of the superior court, for witnesses in the state, in support of an indictment or information, to appear before the court in which it is to be tried.(3) The district attorney or their investigator, the public defender or their investigator, or the clerk of the court in which a criminal action is to be tried. The clerk shall, at any time, upon application of the defendant, and without charge, issue as many blank subpoenas, subscribed by them, for witnesses in the state, as the defendant may require.(4) The attorney of record for the defendant.(b) A subpoena issued in a criminal action that commands the custodian of records or other qualified witness of a business to produce books, papers, documents, or records shall direct that those items be delivered by the custodian or qualified witness in the manner specified in subdivision (b) of Section 1560 of the Evidence Code. Subdivision (e) of Section 1560 of the Evidence Code shall not apply to criminal cases.(c) (1) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action that interferes with an individuals rights to seek or obtain gender-affirming health care or gender-affirming mental health care or against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(d) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to sensitive services in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(e) In a criminal action, no party, or attorney or representative of a party, may issue a subpoena commanding the custodian of records or other qualified witness of a business to provide books, papers, documents, or records, or copies thereof, relating to a person or entity other than the subpoenaed person or entity in any manner other than that specified in subdivision (b) of Section 1560 of the Evidence Code. When a defendant has issued a subpoena to a person or entity that is not a party for the production of books, papers, documents, or records, or copies thereof, the court may order an in camera hearing to determine whether or not the defense is entitled to receive the documents. The court may not order the documents disclosed to the prosecution except as required by Section 1054.3.(f) This section shall not be construed to prohibit obtaining books, papers, documents, or records with the consent of the person to whom the books, papers, documents, or records relate.
266269
267270 SEC. 6. Section 1326 of the Penal Code is amended to read:
268271
269272 ### SEC. 6.
270273
271274 1326. (a) The process by which the attendance of a witness before a court or magistrate is required is a subpoena. It may be signed and issued by any of the following:(1) A magistrate before whom a complaint is laid or their clerk, the district attorney or their investigator, or the public defender or their investigator, for witnesses in the state.(2) The district attorney, their investigator, or, upon request of the grand jury, any judge of the superior court, for witnesses in the state, in support of an indictment or information, to appear before the court in which it is to be tried.(3) The district attorney or their investigator, the public defender or their investigator, or the clerk of the court in which a criminal action is to be tried. The clerk shall, at any time, upon application of the defendant, and without charge, issue as many blank subpoenas, subscribed by them, for witnesses in the state, as the defendant may require.(4) The attorney of record for the defendant.(b) A subpoena issued in a criminal action that commands the custodian of records or other qualified witness of a business to produce books, papers, documents, or records shall direct that those items be delivered by the custodian or qualified witness in the manner specified in subdivision (b) of Section 1560 of the Evidence Code. Subdivision (e) of Section 1560 of the Evidence Code shall not apply to criminal cases.(c) (1) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action that interferes with an individuals rights to seek or obtain gender-affirming health care or gender-affirming mental health care or against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(d) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to sensitive services in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(e) In a criminal action, no party, or attorney or representative of a party, may issue a subpoena commanding the custodian of records or other qualified witness of a business to provide books, papers, documents, or records, or copies thereof, relating to a person or entity other than the subpoenaed person or entity in any manner other than that specified in subdivision (b) of Section 1560 of the Evidence Code. When a defendant has issued a subpoena to a person or entity that is not a party for the production of books, papers, documents, or records, or copies thereof, the court may order an in camera hearing to determine whether or not the defense is entitled to receive the documents. The court may not order the documents disclosed to the prosecution except as required by Section 1054.3.(f) This section shall not be construed to prohibit obtaining books, papers, documents, or records with the consent of the person to whom the books, papers, documents, or records relate.
272275
273276 1326. (a) The process by which the attendance of a witness before a court or magistrate is required is a subpoena. It may be signed and issued by any of the following:(1) A magistrate before whom a complaint is laid or their clerk, the district attorney or their investigator, or the public defender or their investigator, for witnesses in the state.(2) The district attorney, their investigator, or, upon request of the grand jury, any judge of the superior court, for witnesses in the state, in support of an indictment or information, to appear before the court in which it is to be tried.(3) The district attorney or their investigator, the public defender or their investigator, or the clerk of the court in which a criminal action is to be tried. The clerk shall, at any time, upon application of the defendant, and without charge, issue as many blank subpoenas, subscribed by them, for witnesses in the state, as the defendant may require.(4) The attorney of record for the defendant.(b) A subpoena issued in a criminal action that commands the custodian of records or other qualified witness of a business to produce books, papers, documents, or records shall direct that those items be delivered by the custodian or qualified witness in the manner specified in subdivision (b) of Section 1560 of the Evidence Code. Subdivision (e) of Section 1560 of the Evidence Code shall not apply to criminal cases.(c) (1) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action that interferes with an individuals rights to seek or obtain gender-affirming health care or gender-affirming mental health care or against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(d) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to sensitive services in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(e) In a criminal action, no party, or attorney or representative of a party, may issue a subpoena commanding the custodian of records or other qualified witness of a business to provide books, papers, documents, or records, or copies thereof, relating to a person or entity other than the subpoenaed person or entity in any manner other than that specified in subdivision (b) of Section 1560 of the Evidence Code. When a defendant has issued a subpoena to a person or entity that is not a party for the production of books, papers, documents, or records, or copies thereof, the court may order an in camera hearing to determine whether or not the defense is entitled to receive the documents. The court may not order the documents disclosed to the prosecution except as required by Section 1054.3.(f) This section shall not be construed to prohibit obtaining books, papers, documents, or records with the consent of the person to whom the books, papers, documents, or records relate.
274277
275278 1326. (a) The process by which the attendance of a witness before a court or magistrate is required is a subpoena. It may be signed and issued by any of the following:(1) A magistrate before whom a complaint is laid or their clerk, the district attorney or their investigator, or the public defender or their investigator, for witnesses in the state.(2) The district attorney, their investigator, or, upon request of the grand jury, any judge of the superior court, for witnesses in the state, in support of an indictment or information, to appear before the court in which it is to be tried.(3) The district attorney or their investigator, the public defender or their investigator, or the clerk of the court in which a criminal action is to be tried. The clerk shall, at any time, upon application of the defendant, and without charge, issue as many blank subpoenas, subscribed by them, for witnesses in the state, as the defendant may require.(4) The attorney of record for the defendant.(b) A subpoena issued in a criminal action that commands the custodian of records or other qualified witness of a business to produce books, papers, documents, or records shall direct that those items be delivered by the custodian or qualified witness in the manner specified in subdivision (b) of Section 1560 of the Evidence Code. Subdivision (e) of Section 1560 of the Evidence Code shall not apply to criminal cases.(c) (1) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action that interferes with an individuals rights to seek or obtain gender-affirming health care or gender-affirming mental health care or against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.(2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.(d) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to sensitive services in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.(e) In a criminal action, no party, or attorney or representative of a party, may issue a subpoena commanding the custodian of records or other qualified witness of a business to provide books, papers, documents, or records, or copies thereof, relating to a person or entity other than the subpoenaed person or entity in any manner other than that specified in subdivision (b) of Section 1560 of the Evidence Code. When a defendant has issued a subpoena to a person or entity that is not a party for the production of books, papers, documents, or records, or copies thereof, the court may order an in camera hearing to determine whether or not the defense is entitled to receive the documents. The court may not order the documents disclosed to the prosecution except as required by Section 1054.3.(f) This section shall not be construed to prohibit obtaining books, papers, documents, or records with the consent of the person to whom the books, papers, documents, or records relate.
276279
280+
281+
277282 1326. (a) The process by which the attendance of a witness before a court or magistrate is required is a subpoena. It may be signed and issued by any of the following:
278-
279-###### 1326.
280283
281284 (1) A magistrate before whom a complaint is laid or their clerk, the district attorney or their investigator, or the public defender or their investigator, for witnesses in the state.
282285
283286 (2) The district attorney, their investigator, or, upon request of the grand jury, any judge of the superior court, for witnesses in the state, in support of an indictment or information, to appear before the court in which it is to be tried.
284287
285288 (3) The district attorney or their investigator, the public defender or their investigator, or the clerk of the court in which a criminal action is to be tried. The clerk shall, at any time, upon application of the defendant, and without charge, issue as many blank subpoenas, subscribed by them, for witnesses in the state, as the defendant may require.
286289
287290 (4) The attorney of record for the defendant.
288291
289292 (b) A subpoena issued in a criminal action that commands the custodian of records or other qualified witness of a business to produce books, papers, documents, or records shall direct that those items be delivered by the custodian or qualified witness in the manner specified in subdivision (b) of Section 1560 of the Evidence Code. Subdivision (e) of Section 1560 of the Evidence Code shall not apply to criminal cases.
290293
291294 (c) (1) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action that interferes with an individuals rights to seek or obtain gender-affirming health care or gender-affirming mental health care or against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.
292295
293296 (2) For the purpose of this subdivision, gender-affirming health care and gender-affirming mental health care shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.
294297
295298 (d) Notwithstanding subdivision (b), a provider of health care, health care service plan, or contractor shall not release medical information related to sensitive services in response to any foreign subpoena that is based on a violation of another states laws authorizing a criminal action against a person or entity for the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code. For purposes of this subdivision, sensitive services has the same meaning as defined in Section 791.02 of the Insurance Code.
296299
297300 (e) In a criminal action, no party, or attorney or representative of a party, may issue a subpoena commanding the custodian of records or other qualified witness of a business to provide books, papers, documents, or records, or copies thereof, relating to a person or entity other than the subpoenaed person or entity in any manner other than that specified in subdivision (b) of Section 1560 of the Evidence Code. When a defendant has issued a subpoena to a person or entity that is not a party for the production of books, papers, documents, or records, or copies thereof, the court may order an in camera hearing to determine whether or not the defense is entitled to receive the documents. The court may not order the documents disclosed to the prosecution except as required by Section 1054.3.
298301
299302 (f) This section shall not be construed to prohibit obtaining books, papers, documents, or records with the consent of the person to whom the books, papers, documents, or records relate.
300303
301304 SEC. 7. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
302305
303306 SEC. 7. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
304307
305308 SEC. 7. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
306309
307310 ### SEC. 7.