In this case, we determine whether the Medical Board of California (hereafter, the Board) violated patients' informational privacy rights in their controlled substances prescription records when the Board obtained that data from the Controlled Substance Utilization Review and Evaluation System (CURES) (Health & Saf. Code, § 11165) during a disciplinary investigation of their physician. Alwin Carl Lewis, M.D., contends the CURES statute violates his patients' informational privacy rights, as the statute permits the Board to access data before obtaining a warrant or administrative subpoena demonstrating good cause.
California's Constitution grants an express right to privacy (art. I, § 1), thus our focus is on California case law rather than federal law or the federal Constitution. The Board's statutory authority to access CURES during the
The Board, through its division of medical quality, has statutory authority to investigate, and to take and commence disciplinary action against a physician guilty of unprofessional conduct. (Bus. & Prof. Code, §§ 2220, subd. (a), 2227, 2234, 2241.5, subd. (c)(7); Arnett v. Dal Cielo (1996) 14 Cal.4th 4, 7 [56 Cal.Rptr.2d 706, 923 P.2d 1]; see Stiger v. Flippin (2011) 201 Cal.App.4th 646, 651-652 [135 Cal.Rptr.3d 168].) The Board enforces the Medical Practice Act (Bus. & Prof. Code, § 2000 et seq.), and several statutory provisions address prescribing controlled substances by licensee-physicians. (Bus. & Prof. Code, §§ 2238 [violation of state or federal statute regulating dangerous drugs or controlled substances], 2241 [furnishing drugs to addicts], 2241.5 [prescribing, dispensing, or administering to a person under his or her treatment for medical condition, dangerous drugs or prescription controlled substances for treatment of pain], 2242 [furnishing dangerous drugs without examination].) To assist regulatory agencies, such as the Board, in their efforts to control the diversion and resultant abuse of controlled substances, CURES electronically monitors the prescribing and dispensing of these prescription drugs. (Health & Saf. Code, § 11165, former subd. (c).)
The Board began its investigation after one of Lewis's patients complained about the quality of care and treatment that she received during her initial consultation in May 2008. The patient's complaint focused on Lewis's recommendation that she lose weight and start a diet that the patient considered to be unhealthful.
Based upon a review of these CURES reports, the Board sent releases to six of Lewis's patients to obtain their medical records. The Board received signed releases from three patients, and the Board obtained the other two patients' records after an administrative subpoena was issued and notice was sent to the patients that their medical records were being subpoenaed.
The operative second amended accusation (accusation) filed by the Board against Lewis alleged, as to the initial patient, gross negligence in her care and treatment by failing to focus on her chief complaints, repeated negligent acts in her care and treatment, failure to maintain adequate/accurate medical records, and general unprofessional conduct. With respect to the additional patients, the accusation alleged prescribing without an appropriate prior examination, excessive prescribing, failure to maintain adequate/accurate medical records, general unprofessional conduct, and violation of drug statutes.
At the conclusion of the eight-day administrative hearing, the administrative law judge (ALJ) submitted a proposed decision. As to the initial patient, the ALJ concluded that Lewis engaged in unprofessional conduct by failing to maintain adequate records. With respect to the additional patients, the ALJ found that two of Lewis's patients had been over-prescribed controlled substances during a short period of time. The ALJ, however, concluded it had not been established that Lewis engaged in repeated acts of excessive prescribing of dangerous drugs or furnished dangerous drugs without appropriate prior examinations. Lewis was disciplined for failing to maintain accurate prescription records. The ALJ recommended revoking Lewis's license, but the revocation was stayed. Lewis was placed on probation for three years with certain conditions. The Board adopted the ALJ's proposed decision.
Lewis filed a petition for writ of administrative mandamus in the trial court seeking to set aside the Board's decision. Lewis did not challenge the Board's
The trial court denied the petition, concluding CURES permitted the Board to access the data without an administrative subpoena or other showing of good cause. In the extensive written order, the court further stated that Lewis "provide[d] no authority suggesting that an authorized government body's review of the CURES system's data violate[d] a right to privacy." The trial court noted that even if the constitutional right to privacy were implicated, the right to privacy is not absolute and "must be weighed against the compelling public interest in controlling potentially dangerous pharmaceuticals to prevent their abuse." In weighing these competing interests, "[t]he public health and safety concern[s] served by the monitoring and regulation of the prescription of controlled substances serves a compelling public interest that justifie[d] disclosure of prescription records without notification or consent." Judgment was entered denying the petition for writ of administrative mandamus.
Lewis filed a petition for writ of mandate in this court to set aside the judgment. A writ petition is the only authorized mode of appellate review. (Bus. & Prof. Code, § 2337; Leone v. Medical Board (2000) 22 Cal.4th 660, 663-664, 670 [94 Cal.Rptr.2d 61, 995 P.2d 191].) We issued an order to show cause. For the reasons stated, we discharge the order to show cause and deny Lewis's petition.
As presented, the issue also appears to be a facial attack to the constitutional validity of CURES. "A facial challenge to the constitutional validity of a statute or ordinance considers only the text of the measure itself, not its application to the particular circumstances of an individual." (Tobe v. City of Santa Ana (1995) 9 Cal.4th 1069, 1084 [40 Cal.Rptr.2d 402, 892 P.2d 1145].) The relief typically sought is total invalidation of the law. Therefore, cases hold that the challenger must demonstrate "`"a present total and fatal conflict with applicable constitutional prohibitions."'" (Ibid.) In contrast, an as applied challenge to a statute or ordinance involves an otherwise facially valid measure that has been applied in a constitutionally impermissible manner. (Ibid.) This type of challenge "contemplates analysis of the facts of a particular case or cases to determine the circumstances in which the statute or ordinance has been applied and to consider whether in those particular circumstances the application deprived the individual to whom it was applied of a protected right." (Ibid.)
Lewis clarifies that his constitutional challenge does not seek to invalidate the CURES statute. He does not challenge the CURES statute insofar as the state requires the collection of his patients' controlled substances prescription records in a centralized database. Nor does he "contend here that a warrant or showing of good cause is required in
Accordingly, Lewis presents an as applied challenge to the CURES statute, in which we analyze the facts of his case to determine the circumstances in which CURES has been applied and consider whether the application deprived Lewis's patients of a protected privacy right. (See Tobe v. City of Santa Ana, supra, 9 Cal.4th at p. 1084.) Whether a statute is challenged facially or as applied, when the facts are not disputed, the determination of its constitutionality is a question of law that we review de novo. (Alviso v. Sonoma County Sheriff's Dept. (2010) 186 Cal.App.4th 198, 204 [111 Cal.Rptr.3d 775].)
The constitutional issue presented here implicates the informational privacy rights of patients in the highly regulated area of controlled substances. We present a brief overview of these statutes before addressing the privacy issues.
The prescribing and dispensing of controlled substances in California is regulated by the California Uniform Controlled Substances Act (the Act). (Health & Saf. Code, § 11000 et seq.) The Act classifies controlled substances into five schedules. (Health & Saf. Code, §§ 11053-11058.) For example, codeine, hydrocodone, morphine, and methadone are examples of schedule II drugs. (Health & Saf. Code, § 11055, subds. (b)(1)(G), (I), (L) & (c)(14).) With the exception of a 72-hour supply for a patient, or an order for use by a hospital patient, no controlled substance classified in schedule II "shall" be dispensed without a prescription." (Health & Saf. Code, §§ 11158, subds. (a), (b), 11159.) Except when ordered for use by a hospital patient, "or when dispensed directly to an ultimate user by a practitioner, other than a pharmacist or pharmacy, no controlled substance classified in Schedule III, IV, or V may be dispensed without a prescription." (Health & Saf. Code, §§ 11158, subd. (a); see id., § 11159.)
Prescriptions for schedules II through V drugs must be made on an official form, but schedules III through V drugs may be dispensed upon an oral or electronically transmitted prescription. (Health & Saf. Code, § 11164, subds.
Every practitioner, other than a pharmacist, who prescribes a controlled substance classified in schedules II through IV has a duty to keep records of controlled substances dispensed. (Health & Saf. Code, § 11190, subds. (a)-(c).) "Each prescriber that dispenses controlled substances shall provide the Department of Justice the information required by this subdivision on a weekly basis in a format set by the Department of Justice pursuant to regulation." (Health & Saf. Code, § 11190, subd. (c)(2)(A).) Certain exceptions to the reporting requirements apply to schedules II, III, and IV controlled substances but are not at issue here. (Health & Saf. Code, § 11190, subds. (e), (f).)
The Department of Justice maintains CURES to electronically monitor the prescribing and dispensing of schedules II through IV controlled substances by all practitioners authorized to prescribe or dispense these controlled substances. (Health & Saf. Code, § 11165, subd. (a).) Although the Legislature has since amended subdivision (a) of Health and Safety Code section 11165, at the time of these administrative proceedings, the statute stated in pertinent part: "To assist law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical analysis, education, and research, the Department of Justice shall ... maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and Internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe or dispense these controlled substances."
At the time of these proceedings, the statute provided that "CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients." (Health & Saf. Code, § 11165, former subd. (c).) Subdivision (c)(1) of Health and Safety Code section 11165 now states: "The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations."
The Information Practices Act of 1977 (Civ. Code, § 1798 et seq.) places strict limits on the dissemination of personal information to protect an individual's right to privacy. (Civ. Code, § 1798.1.) Subdivision (e) of Civil Code section 1798.24 permits disclosure "[t]o a person, or to another agency
The United States Supreme Court in Whalen v. Roe (1977) 429 U.S. 589, 599-600 [51 L.Ed.2d 64, 97 S.Ct. 869] assumed a right to informational privacy existed under the federal Constitution in controlled substances prescription records. (See National Aero. and Space Admin. v. Nelson (2011) 562 U.S. ___, ___ - ___ & fn. 10 [178 L.Ed2d 667, 131 S.Ct. 746, 756-757 & fn. 10]; People v. Gonzales (2013) 56 Cal.4th 353, 384 [154 Cal.Rptr.3d 38, 296 P.3d 945].) "[I]n many contexts, the scope and application of the state constitutional right of privacy is broader and more protective of privacy than the federal constitutional right of privacy as interpreted by the federal courts. [Citations.]" (American Academy of Pediatrics v. Lungren, supra, 16 Cal.4th at pp. 326-327.) The state constitutional right of privacy, and the privacy right protected by the federal Constitution are not absolute. Rather, the right to privacy is a conditional right that may be infringed upon by balancing the intrusion with a showing of the proper governmental interest. (Whalen v. Roe, supra, at p. 598; Tucson Woman's Clinic v. Eden (9th Cir. 2004) 379 F.3d 531, 551; Hill, supra, 7 Cal.4th at pp. 34-35.) As previously stated, our analysis focuses on the express guarantee of the right to privacy under the California Constitution.
If these threshold elements are proved, the Hill decision sets the standard in which a proffered justification for alleged interferences with the right to privacy will be measured. "Where the case involves an obvious invasion of an interest fundamental to personal autonomy, e.g., freedom from involuntary sterilization or the freedom to pursue consensual familial relationships, a `compelling interest' must be present to overcome the vital privacy interest. If, in contrast, the privacy interest is less central, or in bona fide dispute, general balancing tests are employed." (Hill, supra, 7 Cal.4th at p. 34.)
"Whether a legally recognized privacy interest is present in a given case is a question of law to be decided by the court. [Citations.] Whether plaintiff has a reasonable expectation of privacy in the circumstances and whether defendant's conduct constitutes a serious invasion of privacy are mixed questions of law and fact." (Hill, supra, 7 Cal.4th at p. 40.)
By statute, there also is a legally protected privacy interest in controlled substances prescription records stored in CURES. Health and Safety Code section 11165.1, which permits a treating physician or pharmacist to access CURES data, specifically states that this information is considered medical information subject to the provisions of the Confidentiality of Medical Information Act (Civ. Code, § 56 et seq.).
In Whalen v. Roe, supra, 429 U.S. 589, the United States Supreme Court upheld a New York statute that required reporting schedule II prescription records to the state department of health. The information included the name of the prescribing physician, the dispensing pharmacy, the drug and dosage, and the name, address, and age of the patient. (Id. at p. 593.) This data was recorded into a centralized computer system. (Ibid.) The collection of this data, as part of the state's oversight of controlled substances, was not an unwarranted disclosure of private information in violation of federal constitutionally protected privacy rights. (Id. at pp. 591, 592-593.) The Whalen court concluded collecting this centralized data was supported by established law and not "meaningfully distinguishable from a host of other unpleasant
Addressing the threat of public disclosure, the Whalen court noted there was a possibility that the data may be offered in a judicial proceeding if a doctor or patient is accused of a violation of the law. (Whalen v. Roe, supra, 429 U.S. at p. 600.) The court reasoned, however, that the remote possibility judicial supervision of the evidentiary use of this data would provide inadequate privacy protection was insufficient to hold the New York statute facially unconstitutional. (Id. at pp. 601-602.)
We recognize the privacy issue in Whalen v. Roe was limited to collecting centralized data by the state, and thus the court did not address the issue presented here, that is, a patient's right to informational privacy when these centralized controlled substances prescription records are accessed by a state, local, or federal agency for disciplinary, civil, or criminal purposes.
Not every intrusion of privacy gives rise to a cause of action for invasion of privacy. (Hill, supra, 7 Cal.4th at p. 37.) "Actionable invasions of privacy must be sufficiently serious in their nature, scope, and actual or potential impact to constitute an egregious breach of the social norms underlying the privacy right." (Ibid.) Lewis contends that when the Board accessed CURES, a serious invasion of his patients' privacy rights occurred because (1) there are no criminal or civil sanctions in the CURES statute to safeguard against unwarranted public disclosure, and (2) there is no statutory requirement of a showing of good cause or other judicial determination before the Board accessed his patients' CURES data.
The fear, not present here, that the Board will publicly disclose CURES data obtained during the course of a licensee-physician investigation does not constitute a serious invasion of privacy. The Board has statutory and regulatory duties to protect against the public release of a patient's CURES data. As
Lewis relies on Tucson Woman's Clinic v. Eden, supra, 379 F.3d 531, in which the Ninth Circuit concluded that the informational privacy rights of patients were violated by Arizona regulations that required disclosure of (1) unredacted medical records to the Arizona Department of Health Services (DHS), and (2) ultrasound pictures with patient identifying information to a private contractor for review. (Id. at pp. 551-554.) The Ninth Circuit employed a balancing test to weigh the privacy interest against the state intrusion, noting the safeguards to prevent unauthorized disclosure of unredacted medical records and ultrasound pictures to members of the public were inadequate. (Id. at pp. 552-553.) Citing Whalen v. Roe, supra, 429 U.S. at pages 594 through 595, the Ninth Circuit reasoned that, unlike the Arizona regulations, the New York statute imposed criminal penalties for such unauthorized disclosures. (Tucson Woman's Clinic v. Eden, supra, at p. 552.) Additionally, there were no safeguards in the Arizona regulations to limit access to these records, which on balance constituted a violation of the patients' informational privacy rights. (Id. at pp. 552-553.)
The Ninth Circuit's analysis, however, was decidedly different concerning the regulation that required licensee-physicians to release information, including the name of a patient, to a professional licensing board if an incident arose with the patient. (Tucson Woman's Clinic v. Eden, supra, 379 F.3d at pp. 553-554.) The court recognized that although a professional licensing board was not covered by the statutory scheme's prohibitions on information disclosure, other established safeguards prohibited release of patient information to the public when any incident was reported to the Arizona Medical Board or the Board of Osteopathic Examiners in Medicine and Surgery. (Id. at p. 554.) The requested information was limited, and the state had a strong
Lewis next contends the Board's access to CURES during an investigation of a licensee-physician is a serious invasion of his patients' privacy rights because there is a reasonable societal expectation that to conduct such a search there must be a showing of good cause (or other reasonableness standard) to obtain an administrative subpoena or warrant. Lewis argues the Board must make this showing before accessing CURES.
Lewis's argument is a challenge to the Board's authority to access CURES to compile the facts necessary to obtain administrative subpoenas for his patients' medical records. To support his argument, Lewis principally relies on State v. Skinner (La. 2009) 10 So.3d 1212, which held that a warrantless search of a criminal defendant's pharmacy records during a criminal investigation violated the defendant's Fourth Amendment privacy interests and the state constitutional right to privacy.
Like the informational privacy rights under the federal Constitution at issue in Whalen v. Roe and Tucson Woman's Clinic v. Eden, under this state's constitutional right to privacy (Cal. Const., art. I, § 1), we must balance the justification against the intrusion when a case involves a genuine, nontrivial invasion of a privacy interest.
Focusing on the Fourth Amendment privacy interest, Lewis further argues that access to CURES without an administrative subpoena (or warrant) is a serious invasion of privacy that cannot be justified under the "closely regulated" business exception to the warrant requirement. The rationale for this exception is the owner or operator of a closely regulated business has a reduced expectation of privacy.
As a preliminary matter, there is a diminished expectation of privacy in the highly regulated area of prescription drugs, as a warrantless search of a patient's pharmacy records is statutorily authorized. (Bus. & Prof. Code, § 4081, subd. (a).) There is no greater right to privacy in controlled substances prescription records stored in CURES than the privacy rights in the same prescription records housed at CVS or Rite Aid Pharmacy.
Unlike De La Cruz v. Quackenbush, supra, 80 Cal.App.4th 775, where the regulatory scheme did not define a routine inspection program, the CURES statute informs patients and physicians that controlled substances prescription records are subject to disclosure to the state for electronic monitoring by the Department of Justice. (Health & Saf. Code, § 11165, former subd. (c).) Access to CURES data is limited to state and federal agencies for civil, criminal, and disciplinary purposes. Thus, under the statutory scheme, the physician and patient know who is authorized to receive CURES data and under what narrow circumstances.
In sum, we conclude that the Board's access to CURES during the course of a disciplinary investigation did not constitute a serious invasion of Lewis's patients' right to informational privacy.
Even if we were to conclude that Lewis had established the threshold elements to establish a right to informational privacy on behalf of his patients, we must balance the justification for permitting the Board to access CURES during an investigation of a licensee-physician against the intrusion. (See Hill, supra, 7 Cal.4th at p. 40.) An invasion of privacy is justified if it substantively furthers one or more countervailing interests. (Ibid.)
Lewis and the Board do not agree on the level of scrutiny required to balance these interests. In Whalen v. Roe, supra, 429 U.S. 589, the court invoked a rational basis test, concluding the New York statute was a reasonable exercise of the state's broad police powers. (Id. at p. 598.) In Hill, the Supreme Court declined to hold that every assertion of a privacy interest under article I, section 1 must be overcome by a "`compelling interest.'" (Hill, supra, 7 Cal.4th at pp. 32-35.) Board of Medical Quality Assurance v. Gherardini, supra, 93 Cal.App.3d 669, decided before Hill, held that when balancing the intrusion into the patients' informational privacy rights in their
The Board advances two compelling state interests to access CURES during an investigation of a licensee-physician.
Second, the state has a compelling interest in exercising its regulatory power to protect the public against incompetent, impaired, or negligent physicians. (Arnett v. Dal Cielo, supra, 14 Cal.4th at p. 7.) "Protection of the public shall be the highest priority for the Medical Board of California in exercising its licensing, regulatory, and disciplinary functions. Whenever the protection of the public is inconsistent with other interests sought to be promoted, the protection of the public shall be paramount." (Bus. & Prof. Code, § 2001.1.) Vesting the Board with the authority to investigate complaints against licensee-physicians is an integral part of the oversight of professional practice.
Lewis contends that his patients' informational privacy rights in their controlled substances prescription records outweighs these compelling state interests because the CURES statute permits the Board to access data before demonstrating good cause. We disagree.
The Legislature has determined that CURES may be accessed as a tool to monitor abuse and diversion of controlled substances. To impose a good
Real-time access to CURES also protects patients from incompetent and unprofessional doctors. If the privacy issue were litigated before accessing CURES, the prescribing physician under investigation could stall release of these records, which would prevent the state from exercising its police power to protect the public health.
The Board's access to CURES also should not be limited based upon the nature of the complaint lodged against the licensee-physician. From the patients' perspective, the privacy interest in their controlled substances prescription records is no different if the Board were investigating unprofessional conduct in their care and treatment or in improper prescription practices. Even if the Board is investigating the former, as was the case here, a physician's prescribing practices are directly related to medical care and treatment afforded to his patients. A complaint regarding the quality of care and treatment by a diet doctor, for example, might often reveal improper prescribing practices that could be deadly. Likewise, a complaint regarding the quality of care or treatment may be related to a physician's substance abuse problem that poses a threat to public health. Limits such as Lewis proposes would compromise the Board's paramount concern to protect public health.
Balancing the state's substantial interest in preventing the abuse and diversion of controlled substances and protecting the public health against the minor intrusion upon a patient's informational privacy in his or her controlled substances prescription records stored in CURES, we conclude the Board's actions here in accessing and compiling data from CURES did not violate article I, section 1 of the California Constitution. There are sufficient safeguards in the CURES statute and other regulatory duties to protect patients' informational privacy and confidentiality from unwarranted public disclosure and unfettered access to CURES data. Thus, we conclude the Board's access to CURES while investigating a consumer complaint against Lewis that was unrelated to his prescription practices did not violate his patients' state
The order to show cause is discharged. The petition for writ of mandate is denied. The parties are to bear their own costs.
Klein, P. J., and Croskey, J., concurred.
We granted Lewis's request to bring to our attention another out-of-state case recently filed in the United States District Court in Oregon, Oregon Prescription Drug Monitoring Program v. United States Drug Enforcement Administration (D.Or., Feb. 11, 2014, No. 3:12-cv-02023-HA) ___ F.Supp.2d ___ [2014 WL 562938]. That case is inapposite. The statutory scheme at issue is not similar to the CURES statute, and the Fourth Amendment issue presented was the right of a federal agency to obtain centralized records from a state prescription drug monitoring program by issuing administrative subpoenas rather than obtaining warrants.
