OPINION

LIU, J. —

The Controlled Substance Utilization Review and Evaluation System (CURES) is California's prescription drug monitoring program. By statute, every prescription of a schedule II, III, or IV controlled substance must be logged in CURES, along with the patient's name, address, telephone number, gender, date of birth, drug name, quantity, number of refills, and information about the prescribing physician and pharmacy. (Health & Saf. Code, § 11165, subd. (d); all undesignated statutory references are to this code.) The question in this case is whether the Medical Board of California (Board) violated patients' right to privacy under article I, section 1 of the California Constitution when it obtained data from CURES without a warrant or subpoena supported by good cause in the course of investigating the patients' physician, Dr. Alwin Carl Lewis. We hold that it did not because, even assuming that accessing prescription records without good cause constitutes a significant intrusion on a legally protected privacy interest, the Board's actions in this case were justified.

I.

CURES was created in 1996 in an effort to move California's preexisting drug monitoring program online. (Sen. Com. on Crim. Proc., Analysis of Assem. Bill No. 3042 (1995-1996 Reg. Sess.) as amended Mar. 28, 1996.) CURES is maintained by the California Department of Justice (DOJ) and is designed to "assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances," and to help "law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of [schedule II-IV] controlled substances." (§ 11165, subd. (a).)

CURES requires any pharmacy or dispenser that prescribes or dispenses controlled substances listed on schedules II, III, or IV to keep a record of the prescription and to report specific information to the DOJ as soon as reasonably possible, subject to certain exceptions. (§§ 11165, subd. (d), 11190.) This information includes the patient's full name, address, gender, date of birth, quantity of the drug dispensed, number of refills ordered, and date of the prescription. (§ 11165, subd. (d).) Data obtained from CURES can be provided to "appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the Department of Justice, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions." (§ 11165, subd. (c)(2)(A).) At the time of these proceedings, the statute provided that "CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients." (§ 11165, former subd. (c).) Section 11165, subdivision (c) now states: "(1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations. [P] (2)(A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients...." Data obtained from CURES "shall not be disclosed, sold, or transferred to any third party." (§ 11165, subd. (c)(2)(A).)

In 2009, the Attorney General launched the prescription drug monitoring program (PDMP) system, which allows preregistered users, including licensed health care prescribers, pharmacists, law enforcement, and regulatory boards, to obtain from CURES real-time patient history information concerning controlled substances. (Brown Unveils Real-Time Statewide Prescription Drug-Monitoring System (Sept. 15, 2009) <https://oag.ca.gov/news/press-releases/brown-unveils-real-time-statewide-prescription-drug-monitoring-system> [as of July 17, 2017].) Before the PDMP system, users had to request information from CURES by fax, mail, or phone, and had to wait a few days to receive the information. (Sen. Health Com., Analysis of Sen. Bill No. 1071 (2009-2010 Reg. Sess.) as amended Apr. 28, 2010, p. 4.)

The Board "has been charged with the duty to protect the public against incompetent, impaired, or negligent physicians." (Arnett v. Dal Cielo (1996) 14 Cal.4th 4, 7 [56 Cal.Rptr.2d 706, 923 P.2d 1] (Arnett).) It is responsible for enforcing disciplinary and criminal provisions of the Medical Practice Act, among other duties. (Bus. & Prof. Code, § 2004.) In particular, the Board may "[i]nvestigat[e] complaints from the public, from other licensees, from health care facilities, or from the board that a physician and surgeon may be guilty of unprofessional conduct." (Bus. & Prof. Code, § 2220, subd. (a).) The Board's investigators are peace officers. (Pen. Code, § 830.3, subd. (a); Bus. & Prof. Code, §§ 159.5, subd. (b)(1), 160, subd. (a).) The investigators may interview and take statements from witnesses, and they may issue subpoenas "for the attendance of witnesses and the production of papers, books, accounts, documents ... and testimony pertinent or material to any inquiry [or] investigation." (Gov. Code, § 11181, subd. (e); see also id., § 11182; Bus. & Prof. Code, § 101, subd. (b); Arnett, at p. 8.) The Board qualifies as one of the agencies authorized to access the CURES database.

The Board investigates physicians based on complaints or on its own initiative. (Bus. & Prof. Code, § 2220, subd. (a).) If after an investigation the Board determines there is sufficient evidence to warrant a formal disciplinary action against a licensee, it refers the matter to the Attorney General. The action is then prosecuted by the Senior Assistant Attorney General of the Health Quality Enforcement Section, and the proceedings are conducted in accordance with the Administrative Procedure Act. (Arnett, supra, 14 Cal.4th at p. 9; see Gov. Code, § 12529.)

II.

In November 2008, the Board initiated an investigation of Dr. Alwin Carl Lewis as a result of a patient's complaint in August 2008 alleging that Lewis recommended she lose weight by engaging in a "five-bite" diet. A participant in this diet does not eat breakfast, has five bites of food for lunch, and five bites of food for dinner.

In the initial stages of the investigation, the Board investigator assigned to the case obtained a CURES prescriber activity report on Lewis. The report was 205 pages long and contained the prescription information of hundreds of patients. Before obtaining the CURES report, the Board investigator did not obtain patient authorization or issue any subpoenas. After reviewing the report, the Board asked five of Lewis's patients for release of their full medical records. Three patients gave their consent, and the Board obtained the other two patients' records via administrative subpoenas. The investigator also requested and obtained a copy of Lewis's prescribing history from CVS Pharmacy, Inc. (CVS), for the prior three years.

As a result of this preliminary investigation, the Board filed an accusation against Lewis related to the original patient who complained, as well as the five additional patients. The charges included unprofessional conduct, prescribing dangerous drugs without an appropriate examination, excessive prescribing, and failure to maintain adequate and accurate medical records.

Prior to the administrative hearing, Lewis filed a motion to dismiss the allegations related to the five additional patients. Lewis argued that by obtaining the CURES reports without a warrant, subpoena, or good cause, the Board violated his patients' privacy rights. The administrative law judge (ALJ) denied Lewis's motion, stating that the government's interest in obtaining the reports in a highly regulated area outweighed the invasion of privacy.

Following the eight-day administrative hearing, the ALJ concluded that Lewis engaged in unprofessional conduct, engaged in negligent acts, and failed to maintain adequate records. The ALJ recommended revoking Lewis's license but staying the revocation and placing Lewis on probation for three years. The Board adopted the ALJ's recommendation.

Lewis next filed a writ of administrative mandamus in the Los Angeles County Superior Court seeking to set aside the Board's decision, arguing that the Medical Board violated "fundamental privacy protections guaranteed under state and federal law." The superior court denied Lewis's petition, concluding that "[t]he public health and safety concern served by the monitoring and regulation of the prescription of controlled substances serves a compelling public interest that justifies disclosure of prescription records without notification or consent."

Lewis then filed a petition for writ of mandate in the Court of Appeal, again seeking to set aside the Board's disciplinary decision because the Board's decision violated his patients' right to privacy. The court interpreted his challenge to be one based on the right to privacy under article I, section 1 of the California Constitution, stating that "Lewis makes clear that he is asserting his patients' right to informational privacy in their controlled substances prescription records."

Applying the framework set forth in Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1 [26 Cal.Rptr.2d 834, 865 P.2d 633] (Hill), the Court of Appeal determined that Lewis did not satisfy the threshold elements required to establish that the Board's actions involved a significant intrusion on a privacy interest protected by the state Constitution's privacy provision. Specifically, the court held that although there is a legally protected privacy right in medical records, the "well-known and long-established regulatory history significantly diminishes any reasonable expectation of privacy against the release of controlled substances prescription records to state, local, or federal agencies for purposes of criminal, civil, or disciplinary investigations," and "the release of CURES data to the Board during an investigation of a licensee-physician is not a serious invasion of privacy because sufficient safeguards are in place."

The Court of Appeal went on to conclude that even if Lewis had satisfied the threshold elements to establish a right to privacy on behalf of his patients, the invasion of privacy was justified because it furthered two compelling government interests: "controlling the diversion and abuse of controlled substances" and "protect[ing] the public against incompetent, impaired, or negligent physicians." "Balancing the state's substantial interest in preventing the abuse and diversion of controlled substances and protecting the public health against the minor intrusion upon a patient's informational privacy in his or her controlled substances prescription records stored in CURES," the court concluded that "the Board's actions here in accessing and compiling data from CURES did not violate article I, section 1 of the California Constitution." We granted review.

III.

(1) Article I, section 1 of the California Constitution guarantees certain inalienable rights. "Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy." (Cal. Const., art. I, § 1.) The electorate added this protection for "privacy" to the California Constitution by a ballot initiative (the Privacy Initiative) in 1972. The Privacy Initiative addressed the "accelerating encroachment on personal freedom and security caused by increased surveillance and data collection activity in contemporary society." (White v. Davis (1975) 13 Cal.3d 757, 774 [120 Cal.Rptr. 94, 533 P.2d 222].) The principal "`mischiefs'" that the Privacy Initiative addressed were "(1) `government snooping' and the secret gathering of personal information; (2) the overbroad collection and retention of unnecessary personal information by government and business interests; (3) the improper use of information properly obtained for a specific purpose, for example, the use of it for another purpose or the disclosure of it to some third party; and (4) the lack of a reasonable check on the accuracy of existing records." (Id. at p. 775.)

A.

We first address the Board's contention that Lewis lacks standing to assert his patients' privacy rights under article I, section 1 of the California Constitution.

(2) Although constitutional rights are "generally personal" (People v. Hazelton (1996) 14 Cal.4th 101, 109 [58 Cal.Rptr.2d 443, 926 P.2d 423]), the United States Supreme Court has departed from this rule when the third party right asserted by the litigant is "inextricably bound up with the activity the litigant wishes to pursue" and when some "genuine obstacle" prevents the absent party from asserting his or her own interest. (Singleton v. Wulff (1976) 428 U.S. 106, 114, 116 [49 L.Ed.2d 826, 96 S.Ct. 2868] (Singleton).) The Courts of Appeal have often permitted physicians to assert their patients' right to privacy under the California Constitution. (See Medical Bd. of California v. Chiarottino (2014) 225 Cal.App.4th 623, 630-631, fn. 3 [170 Cal.Rptr.3d 540] (Chiarottino); Whitney v. Montegut (2014) 222 Cal.App.4th 906, 918-921 [166 Cal.Rptr.3d 455] (Whitney); Wood v. Superior Court (1985) 166 Cal.App.3d 1138, 1143-1145 [212 Cal.Rptr. 811] (Wood); Board of Medical Quality Assurance v. Gherardini (1979) 93 Cal.App.3d 669, 675 [156 Cal.Rptr. 55] (Gherardini).) These cases stand for the principle that "[w]here the constitutionally protected privacy interests of absent patients are coincident with the interests of the doctor, the doctor must be permitted to speak for them." (Wood, at p. 1145.)

Although the Board recognizes that physicians may assert their patients' privacy interests in certain cases, it argues that those cases are limited to contexts where the physician is the custodian of the records or where his interests align with his patients' interests. The Board argues that because Lewis is not the custodian of the records in this case and his interests do not align with his patients', he should not be permitted to assert his patients' rights.

(3) We do not agree that Lewis's interests are at odds with his patients' interests. Because an individual's prescription records contain intimate details about his or her medical conditions, the government's ability to access these records may cause patients to hesitate to seek appropriate medical treatment. (Whalen v. Roe (1977) 429 U.S. 589, 602 [51 L.Ed.2d 64, 97 S.Ct. 869] (Whalen) ["Unquestionably, some individuals' concern for their own privacy may lead them to avoid or to postpone needed medical attention."]; Ferguson v. Charleston (2001) 532 U.S. 67, 78, fn. 14 [149 L.Ed.2d 205, 121 S.Ct. 1281] [an intrusion on privacy "may have adverse consequences because it may deter patients from receiving needed medical care"].) Because a physician has an interest in patients seeking appropriate treatment and using appropriate medication, the Board's actions are "inextricably bound up with the activity the litigant wishes to pursue" in this case. (Singleton, supra, 428 U.S. at p. 114.) Moreover, the patients' rights are "likely to be diluted or adversely affected" unless Lewis is permitted to assert their rights on their behalf. (Griswold v. Connecticut (1965) 381 U.S. 479, 481 [14 L.Ed.2d 510, 85 S.Ct. 1678].) In this case, the patients are unable to assert their own rights because they were never given notice that their records were accessed. Without notice, there was no way for them to know of the potential constitutional violation. "A physician has standing to assert his patient's rights where they may not otherwise be established." (People v. Barksdale (1972) 8 Cal.3d 320, 333 [105 Cal.Rptr. 1, 503 P.2d 257].)

The Board relies on Pating v. Board of Medical Quality Assurance (1982) 130 Cal.App.3d 608 [182 Cal.Rptr. 20], where the Court of Appeal held that the petitioner did not have standing to object to the introduction of third party medical records in part because a majority of the patients whose records were subpoenaed appeared at the administrative hearing and voluntarily consented to the introduction of their medical records. (Id. at p. 621.) The Board makes a similar argument here, contending that Lewis should not be permitted to assert his patients' privacy rights because after the access of the CURES records, when five of the patients were informed that the Board sought their complete medical records, three gave consent and the other two did not object. We need not decide what effect, if any, the subsequent consent of the three patients has on Lewis's standing because Lewis would still be entitled to assert the rights of the nonconsenting patients. Finally, the Board relies on Pating for the suggestion that "having allegedly victimized his patients, [Lewis] should not be permitted standing to thus assert their privacy rights for his own protection." (Ibid.) Even assuming this rule applies in some contexts, this line of reasoning is inapplicable where, as here, Lewis is not alleged to have victimized all of the patients whose rights he seeks to assert.

B.

(4) We now turn to the merits of Lewis's constitutional claim. In Hill, a case involving a challenge to the student-athlete drug testing policies of the National Collegiate Athletic Association (NCAA), we articulated a two-part inquiry for determining whether the right to privacy under article I, section 1 has been violated. (Hill, supra, 7 Cal.4th at p. 26.)

First, the complaining party must meet three "`threshold elements' ... utilized to screen out claims that do not involve a significant intrusion on a privacy interest protected by the state constitutional privacy provision." (Loder v. City of Glendale (1997) 14 Cal.4th 846, 893 [59 Cal.Rptr.2d 696, 927 P.2d 1200] (Loder).) The party must demonstrate "(1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of privacy." (Hill, supra, 7 Cal.4th at pp. 39-40.) This initial inquiry is necessary to "permit courts to weed out claims that involve so insignificant or de minimis an intrusion on a constitutionally protected privacy interest as not even to require an explanation or justification by the defendant." (Loder, at p. 893.)

Second, if a claimant satisfies the threshold inquiry, "[a] defendant may prevail in a state constitutional privacy case by negating any of the three elements just discussed or by pleading and proving, as an affirmative defense, that the invasion of privacy is justified because it substantively furthers one or more countervailing interests." (Hill, supra, 7 Cal.4th at p. 40.) "The plaintiff, in turn, may rebut a defendant's assertion of countervailing interests by showing there are feasible and effective alternatives to defendant's conduct which have a lesser impact on privacy interests." (Ibid.)

(5) The standard that a defendant's proffered countervailing interests must satisfy varies based on the privacy interest asserted: "Where the case involves an obvious invasion of an interest fundamental to personal autonomy, e.g., freedom from involuntary sterilization or the freedom to pursue consensual familial relationships, a `compelling interest' must be present to overcome the vital privacy interest. If, in contrast, the privacy interest is less central, or in bona fide dispute, general balancing tests are employed." (Hill, supra, 7 Cal.4th at p. 34.) "The existence of a sufficient countervailing interest or an alternative course of conduct present[s] threshold questions of law for the court. The relative strength of countervailing interests and the feasibility of alternatives present mixed questions of law and fact.... [I]n cases where material facts are undisputed, adjudication as a matter of law may be appropriate." (Id. at p. 40.)

1.

(6) Lewis claims that the Board violated article I, section 1 of the California Constitution by accessing his patients' CURES records. We reject this claim because, even assuming the Board's actions constituted a serious intrusion on a legally protected privacy interest, its review of these records was justified by the state's dual interest in protecting the public from the unlawful use and diversion of a particularly dangerous class of prescription drugs and protecting patients from negligent or incompetent physicians.

The Court of Appeal assumed without deciding that if Lewis were able to satisfy the three threshold elements, the Board would be required to establish a compelling interest. In Hill, we "decline[d] to hold that every assertion of a privacy interest under article I, section 1 must be overcome by a `compelling interest.'" (Hill, supra, 7 Cal.4th at pp. 34-35.) Instead, we limited the application of the "compelling interest test" to those cases that implicate an "obvious invasion of an interest fundamental to personal autonomy." (Id. at p. 34; see Hernandez v. Hillsides, Inc. (2009) 47 Cal.4th 272, 288 [97 Cal.Rptr.3d 274, 211 P.3d 1063] (Hernandez) ["except in the rare case in which a `fundamental' right of personal autonomy is involved[,] the defendant need not present a `"compelling"' countervailing interest"].)

In all but one of our cases applying Hill, we have applied a general balancing test without requiring the asserted countervailing interest to be compelling. (See Loder, supra, 14 Cal.4th at p. 898 [applying a general balancing test to an employer's suspicionless drug testing of a job applicant]; Pioneer Electronics (USA), Inc. v. Superior Court (2007) 40 Cal.4th 360, 373 [53 Cal.Rptr.3d 513, 150 P.3d 198] (Pioneer Electronics) [applying a general balancing test to plaintiff's request to obtain defendant's customer lists]; International Federation of Professional & Technical Engineers, Local 21, AFL-CIO v. Superior Court (2007) 42 Cal.4th 319, 339 [64 Cal.Rptr.3d 693, 165 P.3d 488] [the public's "strong" interest in public employees' salaries outweighed any privacy invasion]; Hernandez, supra, 47 Cal.4th at p. 287 [because a fundamental autonomy right was not implicated, the defendant did not need to present a compelling countervailing interest].) The only case requiring a compelling interest involved a challenge to a statute requiring a pregnant minor to obtain parental consent or judicial authorization before having an abortion, an issue that "unquestionably impinges upon `an interest fundamental to personal autonomy.'" (American Academy of Pediatrics v. Lungren (1997) 16 Cal.4th 307, 340 [66 Cal.Rptr.2d 210, 940 P.2d 797].)

The Board's actions in this case do not implicate a fundamental autonomy right. It is true that the disclosure of information from the CURES database may chill patients' willingness to pursue treatment. But it cannot "be said that any individual has been deprived of the right to decide independently, with the advice of his physician, to acquire and to use needed medication. Although the State no doubt could prohibit entirely the use of particular [schedule II, III, or IV] drugs, it has not done so. This case is therefore unlike those in which the Court has held that a total prohibition of certain conduct was an impermissible deprivation of liberty." (Whalen, supra, 429 U.S. at p. 603, fn. omitted.) The disclosure of information from CURES may be one consideration affecting a patient's choice to pursue treatment, but it does not significantly impair the patient's ultimate ability to make that choice on his or her own. Because the Board's actions do not intrude on a fundamental autonomy right, we apply a general balancing test to assess the Board's actions in this case.

(7) Under that test, the "[i]nvasion of a privacy interest is not a violation of the state constitutional right to privacy if the invasion is justified by a competing interest. Legitimate interests derive from the legally authorized and socially beneficial activities of government and private entities. Their relative importance is determined by their proximity to the central functions of a particular public or private enterprise. Conduct alleged to be an invasion of privacy is to be evaluated based on the extent to which it furthers legitimate and important competing interests." (Hill, supra, 7 Cal.4th at p. 38.)

(8) The Board asserts two countervailing interests to justify any potential invasion of privacy in this case: (1) protecting the public from unlawful use and diversion of a particularly dangerous class of prescription drugs and (2) protecting patients from negligent or incompetent physicians. There is no question that the state has a "vital interest in controlling the distribution of dangerous drugs" (Whalen, supra, 429 U.S. at p. 598), and Lewis does not contest that access to the CURES database furthers the state's interest in protecting patients and preventing the abuse of prescription medication. Lewis instead argues that the Board should be required to employ "less intrusive means" of monitoring controlled substance abuse by limiting searches of the CURES database to those involving good cause, as established by a warrant, subpoena, or similar legal mechanism.

The Board does not bear the burden of showing it adopted the least intrusive means of achieving its legitimate objectives. In Hill, we said that "[l]ike the `compelling interest' standard, the argument that such a `least restrictive alternative' burden must invariably be imposed on defendants in privacy cases derives from decisions that: (1) involve clear invasions of central, autonomy-based privacy rights, particularly in the areas of free expression and association, procreation, or government-provided benefits in areas of basic human need; or (2) are directed against the invasive conduct of government agencies rather than private, voluntary organizations." (Hill, supra, 7 Cal.4th at p. 49.) Seizing on the language directed at the "invasive conduct of government agencies" (ibid.), Lewis argues that any time we consider the impact of the government's actions on a privacy interest, the "least restrictive alternative" must be imposed. This interpretation ignores the footnote associated with this passage in Hill summarizing cases where the "least restrictive alternative" burden has been applied; that footnote says "at the roots of the `least restrictive alternative' burden lie cases of government infringement of fundamental freedoms of expression and association." (Id. at p. 49, fn. 16.) This case does not involve a government infringement of any fundamental freedom of expression and association.

(9) Although the Board does not bear the burden of showing it has adopted the least intrusive means to monitor the flow of prescription drugs, evidence of less intrusive alternatives is relevant in balancing the government's interests against the privacy intrusion at issue. (Hill, supra, 7 Cal.4th at p. 40 ["The plaintiff ... may rebut a defendant's assertion of countervailing interests by showing there are feasible and effective alternatives to defendant's conduct which have a lesser impact on privacy interests."].) In Hill, despite finding that the NCAA's drug testing program was reasonably calculated to further its legitimate interests in maintaining the integrity of athletic competition and the health and safety of student athletes, we went on to consider the alternative methods proposed by the plaintiffs. (Id. at p. 50.) Ultimately, we determined that, "[b]ecause plaintiffs failed to demonstrate with substantial evidence the presence of fully viable alternatives to monitoring, they stopped short of proving their case." (Id. at p. 51.) But our analysis demonstrates that a showing of viable less intrusive alternatives can carry weight in evaluating the reasonableness of a challenged policy and balancing privacy against any countervailing interests.

(10) Lewis asserts that a good cause requirement in this context is a feasible alternative, citing as examples several cases involving Board access to patients' medical records. (See Gherardini, supra, 93 Cal.App.3d at p. 680; Wood, supra, 166 Cal.App.3d at pp. 1148-1150; Bearman v. Superior Court (2004) 117 Cal.App.4th 463, 468-470 [11 Cal.Rptr.3d 644].) But medical records contain far more sensitive information than do prescription records. A patient's complete medical file may include descriptions of symptoms, family history, diagnoses, test results, and other intimate details concerning treatment. Moreover, a reasonable patient would know or should know that the government monitors the sale and distribution of controlled substances, and that prescription records are routinely reviewed by pharmacists and insurance companies. The same cannot be said of a patient's comprehensive medical record. Patients are also on notice that under the Information Practices Act of 1977, personal information may be shared among government agencies "in a manner that would link the information disclosed to the individual" so long as "the transfer is necessary for the transferee agency to perform its constitutional or statutory duties, and the use is compatible with a purpose for which the information was collected...." (Civ. Code, § 1798.24, subd. (e).) Therefore, although patients retain a reasonable expectation of privacy in their prescription records, that privacy interest is less robust than the privacy interest associated with medical records, and the cases on which Lewis relies are inapposite.

The Board argues that real-time access to CURES is essential to closely monitoring the prescribing and dispensing of controlled substances because it gives the Board the ability to "spot-check prescribers for compliance with both the laws and standards of care governing controlled substance prescriptions, potentially preventing the Board from detecting and addressing problems before they result in patient harm." The Board further argues that if it "were required to provide notice to patients and develop good cause as understood by the Courts of Appeal in the medical records context before obtaining records of controlled substances prescriptions from the Department, it would delay the Board's ability to identify and correct potentially dangerous practices." We agree that a good cause requirement would compromise the Board's ability to identify and address potentially dangerous prescribing practices. Requiring the Board to present evidence to a judicial officer establishing good cause as part of its preliminary investigations could result in protracted legal battles that effectively derail those investigations. Patients who objected to subpoenas to compel disclosure of their medical records on the ground that the Board lacked good cause have stalled investigations in the past. (See Chiarottino, supra, 225 Cal.App.4th 623 [records requested in Feb. 2012; appeal resolved in Apr. 2014]; Whitney, supra, 222 Cal.App.4th 906 [records requested in Jan. 2011; appeal resolved in Jan. 2014].) Such delay is tolerated in that context because of the heightened privacy interests implicated by government searches of medical records. For prescription records, however, delays of that magnitude would impede the Board's ability to swiftly identify and stop dangerous prescribing practices.

Thus, although Lewis's proposed alternative would reduce the impact on patients' privacy interests, it is not an equally effective or feasible alternative to the Board's current approach. It is possible there are ways to limit the privacy intrusion on patients without hampering the Board's ability to investigate unsafe medical practices. For instance, the Board could take steps to anonymize patients' prescription information prior to accessing the CURES database. But the parties do not propose this alternative or address its feasibility, and we do not consider the merits of such an approach here. Moreover, our rejection of an individualized good cause requirement should not be understood to suggest that Board investigators may access the CURES database for any reason. Such access must be for the purpose of aiding "law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of [schedule II-IV] controlled substances" (§ 11165, subd. (a)) and pursuant to the Board's duty "to protect the public against incompetent, impaired, or negligent physicians" (Arnett, supra, 14 Cal.4th at p. 7). The statutes governing the CURES database and the Board's functions limit the reasons for which the Board may access the database.

(11) The Board further argues that its review of the CURES data is not unconstitutional because there are sufficient protocols in place to prevent public disclosure. We have previously explained that "[p]rotective measures, safeguards and other alternatives may minimize the privacy intrusion" and thus should be considered when balancing a plaintiff's privacy interest against a defendant's countervailing interests. (Pioneer Electronics, supra, 40 Cal.4th at p. 371.) "`For example, if intrusion is limited and confidential information is carefully shielded from disclosure except to those who have a legitimate need to know, privacy concerns are assuaged.'" (Ibid., quoting Hill, supra, 7 Cal.4th at p. 38.)

Here, several provisions of law prohibit the wrongful public disclosure of personal information obtained from CURES. CURES data may only be provided to "appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes." (§ 11165, subd. (c)(2)(A).) The information reported to CURES is subject to "existing provisions of law to safeguard ... privacy and confidentiality" and "shall not be disclosed, sold, or transferred to any third party." (Ibid.) During the course of investigations, the Board is required to "keep in confidence ... the names of any patients whose records are reviewed and shall not disclose or reveal those names, except as is necessary during the course of an investigation, unless and until proceedings are instituted." (Bus. & Prof. Code, § 2225, subd. (a).) Failure to abide by these limitations may trigger criminal and civil liability: The Information Practices Act of 1977 provides that "[e]xcept for disclosures which are otherwise required or permitted by law, the intentional disclosure of medical, psychiatric, or psychological information ... is punishable as a misdemeanor if the wrongful disclosure results in economic loss or personal injury to the individual to whom the information pertains." (Civ. Code, § 1798.57.) Civil Code section 1798.45 further authorizes civil actions for the same unlawful conduct; in such an action, "the agency shall be liable to the individual in an amount equal to the sum of ... [¶] [a]ctual damages sustained by the individual, including damages for mental suffering" and "[t]he costs of the action together with reasonable attorney's fees." (Civ. Code, § 1798.48.)

We note that adequate protections against public disclosure do not obviate constitutional concerns as privacy interests are still implicated when the government accesses personal information without disseminating it. That said, we ultimately agree with the Board that the safeguards here limit the degree to which patients' privacy is invaded when the Board examines their prescription records.

In view of the considerations above, we find that the balance tips in favor of the Board's interests in protecting the public from unlawful use and diversion of a particularly dangerous class of prescription drugs and protecting patients from negligent or incompetent physicians. Because any potential invasion of privacy caused by the Board's actions was justified by countervailing interests, we conclude that the Board did not violate article I, section 1 of the California Constitution when it obtained patient prescription records from CURES.

2.

In addition to challenging the Board's review of the CURES records, Lewis asserts that the Board violated his patients' rights to privacy when, after searching the CURES database, it obtained prescription records from CVS without good cause, a warrant, or notice to his patients. Lewis has forfeited this claim.

Lewis's challenge at the administrative hearing, as well as his petition for a writ of administrative mandate before the superior court, focused entirely on the CURES report, with no mention of the subsequent records obtained from CVS. It does appear, as Lewis asserts, that there was some confusion as to whether the prescription records obtained from CVS were from the CURES database or from CVS. Even after this confusion was clarified, however, Lewis did not assert an additional objection to the CVS records until his reply brief before the Court of Appeal. As a result, there are gaps in the record pertaining to these records and neither the ALJ, the superior court, nor the Court of Appeal addressed this issue. Finding this claim forfeited, we decline to reach the merits for the first time on appeal. (Medical Bd. of California v. Superior Court (1991) 227 Cal.App.3d 1458, 1462 [278 Cal.Rptr. 247].)

IV.

Lewis also asserts that the Board's access of the CURES records violates the Fourth Amendment to the United States Constitution. We agree with the Board that Lewis has forfeited this claim on behalf of his patients by failing to raise it at the administrative proceedings or before the superior court. Lewis's fleeting references to "fundamental privacy protections guaranteed under state and federal law" were insufficient to preserve the issue. His claims before the Board and the trial court were supported entirely on the basis of the California Constitution. Lewis's argument may be more convincing if he had presented arguments under article I, section 13 of the California Constitution, the provision that explicitly protects against unreasonable searches and seizures. However, given that the thrust of his arguments before the Board and the trial court asserted a general right to informational privacy, with no mention of search or seizure, at most he can be said to have asserted a federal right to informational privacy under the Fourteenth Amendment, a claim that he does not pursue before this court.

CONCLUSION

For the reasons above, we affirm the judgment of the Court of Appeal.

Cantil-Sakauye, C. J., Werdegar, J., Chin, J., Corrigan, J., Cuéllar, J., and Kruger, J., concurred.

LIU, J., Concurring. —

In concluding that the government interests in protecting patients and the public justify the Medical Board of California's access to the prescription drug database here, our opinion today assumes without deciding that Dr. Alwin Carl Lewis has met the threshold elements of an invasion of privacy claim. (Maj. opn., ante, at p. 572.) I believe each of those elements is satisfied in this case.

Lewis contends that the Medical Board of California (Board) violated his patients' right to privacy under article I, section 1 of the California Constitution by examining, without good cause, their prescription records maintained in the Controlled Substance Utilization Review and Evaluation System (CURES) database. A party asserting such a claim must demonstrate "(1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of privacy." (Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 39-40 [26 Cal.Rptr.2d 834, 865 P.2d 633] (Hill).)

The Board concedes that the first element is satisfied here because patients have a legally recognized privacy interest in their prescription records. The records stored in CURES contain "sensitive and confidential information" (Hill, supra, 7 Cal.4th at p. 35) that is protected by the right to privacy under the California Constitution, and the sensitivity of this information is reflected in the confidentiality provision of the CURES statute itself. (Health & Saf. Code, § 11165, subd. (c)(2); all undesignated statutory references are to this code.)

As to the second element (reasonable expectation of privacy), it is relevant that "medical records contain far more sensitive information than do prescription records" and that patients "know or should know that the government monitors the sale and distribution of controlled substances, and that prescription records are routinely reviewed by pharmacists and insurance companies." (Maj. opn., ante, at p. 575.) But these considerations do not mean that patients have no reasonable expectation of privacy with regard to their prescription records. Many of the drugs classified as schedule II, schedule III, and schedule IV controlled substances are approved only for the treatment of specific and often sensitive medical conditions or symptoms. For example, testosterone, a schedule III controlled substance, is used to treat hypogonadism, a condition in which the male's testicles do not produce enough testosterone. (§ 11056, subd. (f)(30); see Mayo Clinic, Patient Care & Health Information <http://www.mayoclinic.org/diseases-conditions/male-hypogonadism/basics/definition/con-20014235> [as of July 17, 2017].) Alprazolam, a schedule IV controlled substance (commonly found in anti-anxiety drugs such as Xanax), is used to treat anxiety and panic disorders. (§ 11057, subd. (d)(1); see Prescribers' Digital Reference (2017) Alprazolam-Drug Summary <http://www.pdr.net/drug-summary/Xanax-alprazolam-1873.31> [as of July 17, 2017].) Patients retain a reasonable expectation of privacy in prescription drug records that can reveal their medical conditions. (See Douglas v. Dobbs (10th Cir. 2005) 419 F.3d 1097, 1102 ["we have no difficulty concluding that protection of a right to privacy in a person's prescription drug records, which contain intimate facts of a personal nature, is sufficiently similar to other areas already protected within the ambit of privacy"]; Doe v. Southeastern Pa. Transportation Authority (3d Cir. 1995) 72 F.3d 1133, 1138 ["[M]edical science has improved and specialized its medications. It is now possible from looking at an individual's prescription records to determine that person's illnesses...."].)

The fact that the government regulates controlled substances does not eliminate patients' reasonable expectation of privacy. A pervasive regulatory scheme has less significance when the area being regulated is particularly sensitive. (Cf. Tucson Woman's Clinic v. Eden (9th Cir. 2004) 379 F.3d 531, 550 [closely regulated industry exception to the warrant requirement does not apply to abortion clinics, "where the expectation of privacy is heightened"].) Moreover, "it plainly would defeat the voters' fundamental purpose in establishing a constitutional right of privacy if a defendant could defeat a constitutional claim simply by maintaining that statutory provisions or past practices that are inconsistent with the constitutionally protected right eliminate any `reasonable expectation of privacy' with regard to the constitutionally protected right." (American Academy of Pediatrics v. Lungren (1997) 16 Cal.4th 307, 339 [66 Cal.Rptr.2d 210, 940 P.2d 797]; see Delaware v. Prouse (1979) 440 U.S. 648, 662 [59 L.Ed.2d 660, 99 S.Ct. 1391] ["An individual... does not lose all reasonable expectation of privacy simply because [an activity is] subject to government regulation."].)

It is also relevant that patients do not choose to participate in the prescription drug monitoring program. Instead, patients typically take prescription drugs for nonvoluntary, legitimate medical purposes. (§ 11153 ["A prescription for a controlled substance shall only be issued for a legitimate medical purpose by an individual practitioner acting in the usual course of his or her professional practice."].) "[T]he presence or absence of opportunities to consent voluntarily to activities impacting privacy interests obviously affects the expectations of the participant." (Hill, supra, 7 Cal.4th at p. 37.) In Hill, we emphasized that the student athletes were choosing to participate in a voluntary extracurricular activity and that, "[a]s a result of its unique set of demands, athletic participation carries with it social norms that effectively diminish the athlete's reasonable expectation of personal privacy in his or her bodily condition, both internal and external." (Id. at p. 42.) Here, by contrast, "[t]he only way to avoid submission of prescription information ... is to forgo medical treatment or to leave the state[;] [t]his is not a meaningful choice." (Oregon Prescription Drug Monitoring Program v. U.S. Drug Enforcement Administration (D.Or. 2014) 998 F.Supp.2d 957, 967, revd. on other grounds (9th Cir. 2017) 860 F.3d 1228.) Furthermore, unlike the athletes in Hill, the patients were not given an opportunity to consent or refuse before their information was shared with the Board. Given the mandatory nature of CURES data collection, it is difficult to conclude that the monitoring scheme entirely negates patients' expectation of privacy.

Finally, Lewis has demonstrated "a serious invasion of privacy." (Hill, supra, 7 Cal.4th at p. 40.) "`[T]his element is intended simply to screen out intrusions on privacy that are de minimis or insignificant.'" (American Academy of Pediatrics v. Lungren, supra, 16 Cal.4th at p. 339.) The Board argues that any intrusion on patients' privacy is insignificant because there are sufficient protocols to prevent public disclosure. Although such protective measures may limit the extent of privacy invasion, they do not render an intrusion de minimis for purposes of this threshold inquiry. (See maj. opn., ante, at p. 577 ["privacy interests are still implicated when the government accesses personal information without disseminating it"]; Hill, at p. 27, fn. 7 ["Particularly when professional or fiduciary relationships premised on confidentiality are at issue (such as doctor and patient or psychotherapist and client), the state constitutional right to privacy may be invaded by a less-than-public dissemination of information."].)

The electorate was concerned about more than public disclosure when it passed the privacy initiative in 1972. The voters were concerned that their privacy was violated whenever their personal information was used or accessed without reason. (See White v. Davis (1975) 13 Cal.3d 757, 775 [120 Cal.Rptr. 94, 533 P.2d 222] [the initiative was intended to curtail "the improper use of information properly obtained for a specific purpose, for example, the use of it for another purpose or the disclosure of it to some third party"]; Ballot Pamp. (Gen. Elec. (Nov. 7, 1972) Proposed Stats. and Amends. to Cal. Const. with arguments to voters, p. 27 ["Fundamental to our privacy is the ability to control circulation of personal information.... The proliferation of government and business records over which we have no control limits our ability to control our personal lives. Often we do not know that these records even exist and we are certainly unable to determine who has access to them."].) This concern is even more pressing today because advances in data science have enabled sophisticated analyses of curated information as to a particular person. Where, as here, one government agency discloses patients' sensitive medical information to another, the privacy intrusion cannot be dismissed as trivial.

In sum, the disclosure of CURES data to the Board is not a de minimis intrusion on patients' reasonable and legally protected privacy interests. But, as today's opinion explains, the government interests behind the prescription drug monitoring program are sufficiently weighty to justify the privacy invasion here.

Kruger, J., concurred.