GUERRERO, J.

Xavier Becerra, Attorney General, Carl W. Sonne, Assistant Attorney General, Gregory J. Salute, Molly E. Selway, and Nicole R. Trama, Deputy Attorneys General, for Petitioners Board of Registered Nursing and California State Board of Pharmacy.

Xavier Becerra, Attorney General, Gloria L. Castro, Assistant Attorney General, Alexandra M. Alvarez, Matthew M. Davis, Rosemary F. Luzon, and Tessa L. Heunis, Deputy Attorneys General, for Petitioner Medical Board of California.

Xavier Becerra, Attorney General, Thomas S. Patterson, Assistant Attorney General, Anthony R. Hakl, and Natasha Saggar Sheth, Deputy Attorneys General, for Petitioner Department of Justice.

No appearance for Respondent.

O'Melveny & Myers, Michael G. Yoder, Newport Beach, Amy J. Laurendeau, Charles C. Lifland, Sabrina H. Strong, Amy R. Lucas, and Jonathan P. Schneller, Los Angeles, for Real Parties in Interest Johnson & Johnson, Janssen Pharmaceuticals, Inc., Ortho-McNeil-Janssen Pharmaceuticals, Inc., and Janssen Pharmaceutica, Inc.

Hueston Hennigan, Marshall A. Camp, Moez M. Kaba, Padraic W. Foran, Los Angeles, John C. Hueston, Newport Beach; Arnold & Porter Kaye Scholer, Sean O. Morris and Neda Hajian, Los Angeles, for Real Parties in Interest Endo Health Solutions Inc. and Endo Pharmaceuticals Inc.

Morgan, Lewis & Bockius and Collie F. James IV, Costa Mesa, for Real Parties in Interest Cephalon, Inc., Teva Pharmaceuticals USA, Inc., Actavis LLC, Actavis Pharma, Inc., and Watson Laboratories, Inc.

Kirkland & Ellis and Zachary Byer, Los Angeles, for Real Parties in Interest Allergan PLC and Allergan Finance, LLC.

No appearance for Real Party in Interest the People of the State of California.

GUERRERO, J. The People of the State of California, by and through the Santa Clara County Counsel, the Orange County District Attorney, the Los Angeles County Counsel, and the Oakland City Attorney, filed suit against various pharmaceutical companies involved in the manufacture, marketing, distribution, and sale of prescription opioid medications. The People allege the defendants made false and misleading statements as part of a deceptive marketing scheme designed to minimize the risks of opioid medications and inflate their benefits. This scheme, the People allege, caused a public health crisis in California by dramatically increasing opioid prescriptions, opioid use, opioid abuse, and opioid-related deaths. In their suit, the People allege causes of action for violations of the False Advertising Law ( Bus. & Prof. Code, § 17500 et seq. ), the Unfair Competition Law (id. , § 17200 et seq.), and the public nuisance statutes ( Civ. Code, §§ 3479 - 3480 ). The People seek declaratory and injunctive relief, as well as civil penalties.

After several years of litigation, the defendants served business record subpoenas on four nonparty state agencies: the California State Board of Registered Nursing (Nursing Board), the California State Board of Pharmacy (Pharmacy Board), the Medical Board of California (Medical Board), and the California Department of Justice (DOJ). The Nursing Board, the Pharmacy Board, and the Medical Board are responsible for licensing, regulation, enforcement, and disciplinary actions in their respective professions. The DOJ, headed by the Attorney General, is responsible for civil and criminal investigations of statewide interest, regulatory oversight, and related recordkeeping, among many other areas of concern.

The subpoenas demanded the production of documents in various extremely broad categories related to illicit drugs, opioid medications, opioid prescriptions, opioid overdoses, and opioid-related complaints and disciplinary proceedings. A representative request, to the DOJ, essentially sought all documents and communications related to the use and abuse of legal and illegal drugs in California, without limitation, over a period of 30 years.

The Pharmacy Board, the Medical Board, and the DOJ served objections to the subpoenas. After a meet and confer process, defendants filed motions to compel production of a subset of documents covered by the subpoenas. The Nursing Board, after a similar meet and confer process, filed a motion for a protective order seeking relief from the production obligations of its subpoena.

After further litigation, which is recounted below, the trial court ordered the state agencies to produce documents in response to the subpoenas. The documents include (1) administrative records of disciplinary proceedings against doctors, nurses, pharmacists, and others related to opioid prescriptions; (2) investigatory files of complaints against doctors, nurses, pharmacists, and others related to opioid prescriptions; (3) coroner's reports of opioid-related deaths that may have involved gross negligence or incompetence by a physician or surgeon ( Bus. & Prof. Code, § 802.5 ); and (4) hundreds of millions of prescription records for opioids, anti-depressants, and certain other drugs in California, as reflected in the Controlled Substance Utilization Review and Evaluation System (CURES) database maintained by the DOJ ( Health & Saf. Code, § 11165 ). The trial court allowed the redaction of some personal identifying information contained in these documents and records.

In these consolidated proceedings, the state agencies challenge the trial court's orders compelling production of documents. The Pharmacy Board and the Medical Board argue, as a threshold matter, that the motions to compel should have been denied as untimely. ( Code Civ. Proc., § 2025.480, subd. (b).) Additionally, the state agencies all argue that the motions to compel should have been denied because defendants did not provide notice to consumers whose personal information was sought by the subpoenas. (Id. , §§ 1985.3, 2020.410, subd. (d).) Regarding the requests themselves, the state agencies argue that the documents sought do not meet the standards for nonparty discovery (id. , § 2020.010 et seq.), they are protected by the constitutional right to privacy ( Cal. Const., art. I, § 1 ), they are protected by the statutory official information privilege and the related deliberative process privilege ( Evid. Code, § 1040 ), or they are otherwise exempted by statute from discovery.

We conclude the motions to compel against the Pharmacy Board and Medical Board were untimely, and the defendants were required to serve consumer notices on at least the doctors, nurses, pharmacists, and other health care professionals whose identities would be disclosed in the administrative records, investigatory files, and coroner's reports. We further conclude that the requests for complete administrative records and investigatory files, as well as millions of CURES database records, were overbroad and not reasonably calculated to lead to the discovery of admissible evidence. The requests for complete administrative records and investigatory files also ran afoul of the constitutional right to privacy and the statutory official information and deliberative process privileges. The trial court abused its discretion in finding otherwise. In light of these conclusions, we direct the trial court to vacate its orders compelling production of documents and enter new orders denying the motions to compel and, for the Nursing Board, granting its motion for a protective order.

FACTUAL AND PROCEDURAL BACKGROUND

As noted, the operative complaint filed by the People alleges a deceptive marketing scheme by the named pharmaceutical companies to encourage the prescription—and overprescription—of opioid pain medication. The People allege, "Defendants' false and misleading statements deceived doctors and patients about the risks and benefits of opioids and convinced them that opioids were not only appropriate but necessary for the treatment of chronic pain. Defendants targeted susceptible prescribers like family doctors as well as vulnerable patient populations like the elderly and veterans. And they tainted the sources that doctors and patients relied upon for guidance, including treatment guidelines, continuing medical education programs, medical conferences and seminars, and scientific articles. As a result, Defendants successfully transformed the way doctors treat chronic pain, opening the floodgates of opioid prescribing and use. Opioids are now the most prescribed class of drugs; they generated $11 billion in revenue for drug companies in 2014 alone. This explosion in opioid prescriptions and use has padded Defendants' profit margins at the expense of chronic pain patients. As the [Centers for Disease Control] recently concluded, ‘for the vast majority of [those] patients, the known, serious, and too-often-fatal risks far outweigh the unproven and transient benefits.’ "

The People allege that this "explosion" of opioid prescriptions and use has led to a public health crisis in California. "California faces skyrocketing opioid addiction and opioid-related overdoses and deaths as well as devastating social and economic consequences.... The effects of each Defendant's deceptive marketing scheme are catastrophic and are only getting worse." The People continue, "There is little doubt that each Defendant's deceptive marketing scheme has precipitated this public health crisis in California ... by dramatically increasing opioid prescriptions and use. An oversupply of prescription opioids has provided a source for illicit use or sale of opioids (the supply), while the widespread use of opioids has created a population of patients physically and psychologically dependent on them (the demand). And when those patients can no longer afford or legitimately obtain opioids, they often turn to the street to buy prescription opioids or even heroin."

Based on causes of action for false advertising, unfair competition, and public nuisance, the People sought civil penalties for each act of false advertising and unfair competition and an order requiring defendants to abate the public nuisance created by their allegedly deceptive marketing scheme. They also sought an injunction against any further acts of false advertising, unfair competition, or public nuisance.

The parties engaged in highly contentious litigation over a period of several years. The trial court appointed a discovery referee to address what appear to be numerous discovery disputes. Defendants sought and obtained extensive information regarding opioid prescriptions and use in California.

In early 2019, defendants served business records subpoenas on the Medical Board and Pharmacy Board. The subpoenas, which were similar, broadly sought all documents and communications related to opioid use, opioid abuse, opioid treatment, and opioid-related disciplinary proceedings over the preceding 30 years. The Medical Board and Pharmacy Board objected to the subpoenas on numerous grounds. Nine months after the subpoenas were served, defendants moved to compel the production of a subset of documents responsive to the subpoenas. As relevant here, defendants sought an order compelling production of (1) the entire administrative records of any disciplinary proceedings involving licensed health care professionals and opioid prescribing, dispensing, theft, recordkeeping, and controls; (2) all investigatory files involving complaints, investigations, or discipline related to opioids or opioid prescribing; (3) as to the Medical Board, any coroner's reports involving opioids submitted under Business and Professions Code section 802.5 ; and (4) any CURES data contained in the foregoing categories. The defendants argued that the documents were directly relevant to causation, comparative fault, apportionment, and damages.

The Medical Board and Pharmacy Board opposed the motions. They argued, as a threshold matter, that the motions were untimely because they were filed more than 60 days after the state agencies served their objections to the subpoenas. They also argued that the motions should be denied because defendants failed to provide notice to consumers whose personal information was contained in the requested documents, including physicians, pharmacists, and patients.

The Medical Board and Pharmacy Board maintained that the document categories at issue were not reasonably calculated to lead to the discovery of admissible evidence and would be unduly burdensome to produce. The Medical Board's interim executive director stated in a declaration that the Medical Board had undertaken more than 7,500 investigations over the past five years. The investigations are not organized by type of medication or violation. She explained that complaints and investigation files "invariably contain significant amounts of patients' personal or health information." Similarly, "[a]dministrative records typically include pleadings, motions, briefs, reporter's transcripts, and hundreds (if not thousands) of pages of exhibits admitted into evidence by the parties, the vast majority of which were developed during the investigation phase." Because the investigatory files and administrative records are not organized by medication or violation, "Board staff would be required to review each and every administrative case and investigatory file to determine whether they are the types of records Defendants are seeking." Investigators, on behalf of the Medical Board, are tasked with obtaining patient medical records where relevant. The investigators attempt to obtain those records consensually, if possible. They inform the patients that the Medical Board "is investigating the care provided by their physician, and that their medical records are required for that limited purpose. They are informed, further, that their medical information will be kept confidential to the extent possible." If the patient does not consent, investigators may serve and enforce an administrative subpoena to obtain the records. The Medical Board is empowered to obtain documents that would otherwise be shielded from civil discovery, including communications covered by the physician-patient privilege. (See Bus. & Prof. Code, § 2225, subd. (a).)

The Pharmacy Board's interim executive officer submitted a similar declaration describing the records at issue in the motion to compel. In the past ten years, the Pharmacy Board closed more than 35,000 investigations, of which more than 20,000 resulted in substantiated violations. They are not organized by the type of medication involved. Pharmacy Board administrative records contain the same types of documents as Medical Board administrative records.

Both the Medical Board and the Pharmacy Board emphasized the confidentiality of their files, and they contended they were protected by the official information privilege and the deliberative process privilege. They argued that confidentiality was essential to protect the integrity of their investigations, prevent witness intimidation, and avoid deterring future complainants or witnesses from coming forward. The Pharmacy Board also contended that production of the subpoenaed records would violate the privacy rights of nonparties, and the Medical Board relied on the highly confidential and privileged nature of patient medical records.

In reply, defendants disputed each of the points made by the Medical Board and Pharmacy Board. As to relevance, defendants argued that action or inaction by the state agencies against health care professionals who abuse or overprescribe opioids is "highly relevant to the creation and continuation of the alleged public nuisance." Likewise, evidence of health care professionals who overprescribed opioids "in order to line their own pockets with cash directly rebuts Plaintiff's theory that Defendants' marketing of prescription opioids caused Plaintiff's alleged harm."

Defendants maintained that their motions were timely, and that consumer notices were not required because the Medical Board and Pharmacy Board could redact the names of consumers whose complaints or medical records are produced. They claimed that concerns over burden were speculative and overblown. As to privilege and privacy, defendants contended that the Medical Board and Pharmacy Board had not shown the documents at issue were protected from discovery. They reiterated that patient names could be redacted and pointed out that any documents could be produced pursuant to the court's litigation protective order. They argued the Medical Board and Pharmacy Board had not met their burden of showing that any individual administrative record or investigatory file was protected by the official information or deliberative process privilege, especially in light of the redactions and protective order.

Following a hearing, the discovery referee issued two reports and recommendations granting the motions to compel in part. The referee found that the motions were timely and consumer notice was not required. He also found that the requested documents were relevant because they may show that the harms associated with opioid use and abuse were caused at least in part by the bad acts of physicians and pharmacists, rather than defendants' marketing scheme.

The discovery referee was unpersuaded by the privilege and privacy arguments offered by the Medical Board and the Pharmacy Board. He noted that the state agencies could redact the names of any patients and that any documents produced would be confidential under the court's protective order. He found unsupported the state agencies' concern that disclosure of administrative records and investigatory files would negatively impact the agencies' ability to handle complaints and investigations.

However, the discovery referee acknowledged the burden on the Medical Board and the Pharmacy Board. He therefore recommended that the agencies each be required to produce five administrative records and 50 investigatory files, in the first instance. If after review the defendants believed they needed additional documents, they could bring an appropriate motion before the discovery referee. The Medical Board and the Pharmacy Board objected to the recommendations and sought a hearing in the trial court.

Meanwhile, defendants served business records subpoenas on the Nursing Board and the DOJ. The subpoenas also sought broad swaths of opioid-related documents. After meet and confer efforts were unsuccessful, the Nursing Board filed a motion for protective order seeking relief from the subpoena. Its arguments largely mirrored those discussed above. In response, and in light of the discovery referee's recommendations, the defendants narrowed the scope of the subpoena to the administrative and investigative files of three individuals and other documents not relevant here.

Meet and confer efforts with the DOJ were similarly unsuccessful, and the defendants filed a motion to compel production of a subset of documents responsive to their subpoena. First, defendants sought production of all California prescription records for opioids and other specified drugs, as maintained in the CURES database. These records include patient names, dates of birth, prescription details (medication type, strength, and quantity), prescriber names, and pharmacy information. Defendants argued that such granular information was necessary to determine whether the patients allegedly harmed by defendants' marketing scheme "ever received a valid prescription for Defendants' products, and whether it had anything to do with Defendants' marketing." They sought an order requiring the DOJ to produce the raw data to an outside vendor, the Rawlings Group, which would replace patient names with a unique identifier that would allow Rawlings to cross-reference the CURES prescription records with other datasets in its possession. Defendants argued that they "must be able to cross-reference prescription data with outcome data for particular patients to analyze the People's theory that prescriptions of Defendants' drugs caused certain health outcomes." Defendants also sought the DOJ's investigative files on "less than 100 prescribers and physicians," which defendants claimed were necessary "to demonstrate that actions taken by prescribers and pharmacists contributed to the alleged public nuisance and not from Defendants' alleged marketing behavior."

In its opposition, the DOJ emphasized the breadth of defendants' request. The CURES database includes hundreds of millions of patient records, reflecting every prescription for a controlled substance in California over the past 30 years. The DOJ argued that these records were protected from disclosure by the official information privilege, the constitutional right to privacy, and the governing statutes of the CURES database itself. The DOJ also argued that defendants had not shown why they needed such granular information and why the information already in their possession was not a sufficient alternative. The DOJ maintained that its investigative files were likewise not discoverable for reasons already discussed above.

The Nursing Board objected to the discovery referee because he was involved in pending discovery proceedings against the Attorney General, who represents the Nursing Board. The DOJ joined in this objection. The trial court agreed that a person aware of the facts might reasonably entertain a doubt that the discovery referee would be able to be impartial, and it therefore ordered that any further proceedings involving the DOJ or any party represented by the Attorney General would be heard by the court directly, rather than the discovery referee.

After further briefing and argument, the trial court largely adopted the discovery referee's recommendations regarding the Medical Board and Pharmacy Board, denied in part the Nursing Board's motion for a protective order, and granted defendants' motion to compel against the DOJ. As to the Medical Board, the court ordered production of five complete administrative records, 30 complete investigatory files, and all coroner's reports involving opioids. The court allowed the defendants to request additional administrative records and investigatory files if needed. The court ordered that "all patient, complaining party, and witness personal identifying information is to be redacted" from the production. The court explicitly included in the production any CURES data reflected in the foregoing categories.

As to the Pharmacy Board, the court ordered the production of five complete administrative records and 30 complete investigatory files, including any CURES data therein. The court again ordered that "all patient, complaining party, and witness personal identifying information is to be redacted" from the production. It also allowed the defendants to request additional administrative records and investigatory files if needed.

As to the Nursing Board, the court ordered the production of the administrative and investigation files of three individuals, including any CURES data therein. The court allowed de-identification of "patients, complainants, and witnesses" but not "other individuals contained in the administrative and investigation files" (e.g., the nurses under investigation).

As to the DOJ, the court ordered the production of "all data from the CURES database related to opioids, anti-depressants, anti-convulsant/epileptic drugs (including muscle relaxers), and benzodiazepines, from 1990 to the present day." It directed the DOJ to provide the raw data to the Rawlings Group for de-identification or arrange for an alternate mechanism. However, "[a]ny redaction performed must allow Defendants to cross-reference the CURES data against other de-identified data Defendants have received." The court also ordered the DOJ to produce "a random sampling of 80 files of completed investigations that pertain or relate to opioid misuse by prescribers and pharmacists."

The four state agencies each filed a petition for writ of mandate directing the trial court to vacate the relevant order compelling production. We summarily denied the petitions. The California Supreme Court granted review and transferred the matters back to this court with directions to vacate our orders denying the petitions and issue orders to show cause why the relief sought in the petitions should not be granted. We issued the orders to show cause as directed and consolidated the proceedings for all purposes. DISCUSSION

I

Timeliness of the Motions to Compel

The Medical Board and the Pharmacy Board contend that defendants' motions to compel were untimely. Defendants served business records subpoenas on these state agencies on February 8, 2019. The subpoenas directed each agency to deliver a copy of the documents described in the subpoena to the named deposition officer (listed as defense counsel) on March 11, 2019 at 10:00 a.m. Rather than produce documents on that date, both agencies served objections. A lengthy meet and confer process followed, as the parties discussed the scope of the subpoena and the agencies produced some documents and information. Eventually, the parties reached an impasse, and defendants filed their motions to compel on November 18, 2019.

In California, discovery may be obtained from a nonparty through an oral deposition, a written deposition, or a deposition for the production of business records and things. ( Code Civ. Proc., § 2020.010, subd. (a).) To pursue the deposition of a nonparty, a party must generally serve a deposition subpoena. ( Id. , § 2020.010, subd. (b).) "A deposition subpoena that commands only the production of business records for copying shall designate the business records to be produced either by specifically describing each individual item or by reasonably particularizing each category of item, and shall specify the form in which any electronically stored information is to be produced, if a particular form is desired." ( Id. , § 2020.410, subd. (a).)

The discovery statutes require that the subpoena command compliance in accordance with the procedures specified therein. ( Code Civ. Proc., § 2020.410, subd. (c).) A subpoena may direct the deponent to (1) deliver a copy of the records to the deposition officer at the deposition officer's address (id. , § 2020.430, subd. (b)); (2) deliver a copy of the records to the deposition officer at the deponent's address (id. , § 2020.430, subd. (c)(2)); or (3) make the original records available for copying by the deposition officer at the deponent's address (id. , § 2020.430, subd. (c)(1)). The deposition officer must meet certain statutory requirements, but "[a]ny objection to the qualifications of the deposition officer is waived unless made before the date of production or as soon thereafter as the ground for that objection becomes known or could be discovered by reasonable diligence." (Id. , § 2020.420.)

Alternatively, the subpoena may direct the deponent to make the records available for inspection or copying by the subpoenaing party's attorney or the attorney's representative. ( Code Civ. Proc., § 2020.430, subd. (e).) "When provided with at least five business days' advance notice ..., the witness shall designate a time period of not less than six continuous hours on a date certain for copying of records subject to the subpoena ...." ( Evid. Code, § 1560, subd. (e).)

"Promptly on or after the deposition date and after the receipt or the making of a copy of business records under this article, the deposition officer shall provide that copy to the party at whose instance the deposition subpoena was served, and a copy of those records to any other party to the action who then or subsequently, within a period of six months following the settlement of the case, notifies the deposition officer that the party desires to purchase a copy of those records." ( Code Civ. Proc., § 2020.440.)

"If a deponent fails to answer any question or to produce any document, electronically stored information, or tangible thing under the deponent's control that is specified in the deposition notice or a deposition subpoena, the party seeking discovery may move the court for an order compelling that answer or production." ( Code Civ. Proc., § 2025.480, subd. (a).) "This motion shall be made no later than 60 days after the completion of the record of the deposition, and shall be accompanied by a meet and confer declaration ...." ( Id. , § 2025.480, subd. (b).) The parties dispute the meaning of this 60-day deadline, which presents a question of law that we consider de novo. ( Unzipped Apparel, LLC v. Bader (2007) 156 Cal.App.4th 123, 129, 67 Cal.Rptr.3d 111 ( Unzipped ).)

The Court of Appeal in Unzipped also considered the 60-day deadline in the context of a nonparty deposition for business records. A party to the litigation served two deposition subpoenas for business records with a specified production date. ( Unzipped, supra , 156 Cal.App.4th at p. 128, 67 Cal.Rptr.3d 111.) On the date of production, the nonparties objected and declined to produce any documents. ( Ibid. ) After discussing the matter, the parties were unable to reach agreement. ( Ibid. ) Almost three months after the date of production, the party filed a motion to compel production pursuant to the subpoena. ( Ibid. ) The trial court found the motion timely and granted it. ( Id. at p. 129, 67 Cal.Rptr.3d 111.)

On appeal, the reviewing court reversed. ( Unzipped, supra , 156 Cal.App.4th at p. 127, 67 Cal.Rptr.3d 111.) It reasoned that "discovery conducted by way of a business records subpoena is a ‘deposition.’ " ( Id. at p. 131, 67 Cal.Rptr.3d 111.) The record of such a deposition is the documentary record memorializing the nonparty's response to the subpoena. ( Id. at p. 132, 67 Cal.Rptr.3d 111.) "A business records subpoena often results in one of two responses: a partial production based on a few objections or no production based on more extensive objections. Under either scenario, upon receipt of the response, the subpoenaing party has all of the information it needs to prepare a motion to compel." ( Id. at p. 133, 67 Cal.Rptr.3d 111.) Thus, in Unzipped , the objections served by the nonparty constituted the record of the deposition. ( Id. at p. 136, 67 Cal.Rptr.3d 111.) "The record was complete as of the date set for the production ..., when Unzipped received the objections. Unzipped had 60 days thereafter ... to file a motion to compel." ( Ibid. )

In Rutledge v. Hewlett-Packard Co. (2015) 238 Cal.App.4th 1164, 1192, 190 Cal.Rptr.3d 411 ( Rutledge ), the court followed Unzipped and affirmed an order denying a motion to compel as untimely. In Rutledge , a party served a business records subpoena with an August 2004 date of production. ( Id. at p. 1191, 190 Cal.Rptr.3d 411.) The nonparty served objections and produced documents. ( Ibid. ) Over a period of years, the party engaged in additional discovery efforts. ( Ibid. ) Eventually, however, it moved to compel production in response to the 2004 subpoena. ( Ibid. ) The trial court denied the motion and awarded sanctions against the party. ( Id. at p. 1192, 190 Cal.Rptr.3d 411.) The reviewing court affirmed. ( Ibid. ) It explained that "the 60-day period during which a motion to compel must be filed, begins to run when the deponent serves objections on the party. At the time the objections are served, the record of deposition is complete." ( Ibid. ) It concluded, "If appellants were not satisfied with [the nonparty's] production of documents from its initial request, the time to file a motion to compel was within 60 days of ... the date on which [the nonparty] served its objections to the 2004 subpoena." ( Ibid. )

Here, the Medical Board and Pharmacy Board responded to defendants' subpoenas by serving objections. The deposition was therefore complete when these objections were served, and the 60-day period to file a motion to compel began on that date. (See Rutledge, supra , 238 Cal.App.4th at p. 1192, 190 Cal.Rptr.3d 411 ; Unzipped, supra , 156 Cal.App.4th at p. 136, 67 Cal.Rptr.3d 111.) Because defendants did not file their motions to compel until more than 60 days after the objections were served, their motions were untimely and should have been denied. ( Rutledge , at p. 1192, 190 Cal.Rptr.3d 411 ; Unzipped , at p. 136, 67 Cal.Rptr.3d 111.)

Defendants contend that Unzipped and Rutledge are distinguishable because the Medical Board and Pharmacy Board eventually agreed to produce a subset of documents responsive to the subpoenas. They argue that the subsequently-produced documents are part of the "record of the deposition" and therefore "the 60-day period does not begin to run until the production is complete." Defendants' position is contrary to the language and intent of the statutory scheme governing nonparty discovery. The discovery methods available against nonparties are more limited, and their procedures more streamlined. " ‘While all discovery devices are available against a party, only deposition subpoenas can be directed to a nonparty.... [¶] The distinction between parties and nonparties reflects the notion that, by engaging in litigation, the parties should be subject to the full panoply of discovery devices, while nonparty witnesses should be somewhat protected from the burdensome demands of litigation. ’ " ( Monarch Healthcare v. Superior Court (2000) 78 Cal.App.4th 1282, 1290, 93 Cal.Rptr.2d 619.)

The nonparty discovery statutes establish a one-step process for a nonparty responding to a business records subpoena. Upon receipt of the subpoena, a nonparty must make the production on the date and in the manner specified, unless grounds exist to object or disregard the subpoena. The nonparty's compliance with the subpoena is clear on the date specified for production. It has either produced documents as requested in the subpoena, or not. On that date, the subpoenaing party has all of the information it needs to meet and confer regarding the nonparty's compliance and, if unsatisfied, prepare a motion to compel.

This one-step process minimizes the burden on the nonparty. It may comply (or not) with the subpoena, and it can be confident that its obligations under the subpoena will be swiftly addressed and adjudicated. The one-step process also reflects the reality that the discovery demanded from a nonparty will generally be more limited, and consequently less subject to lengthy dispute, than discovery demanded from a party.

In contrast to the nonparty discovery statutes, the party discovery statutes establish a more involved, two-step process. First, upon receipt of a request for production of documents, a party must serve a written response stating that the party will comply, that it lacks the ability to comply, or that it objects to compliance. ( Code Civ. Proc., § 2031.210, subd. (a).) An opposing party unsatisfied with the party's response may file a motion to compel further responses within 45 days of service of the response. (Id. , § 2031.310.) Second, on the date specified for production of documents, the party must produce documents in accordance with its statement of compliance. (Id. , § 2031.280.) If the party fails to make a production in accordance with its statement of compliance, the opposing party may file another motion to compel seeking compliance. (Id. , § 2031.320.) "No time limit is placed on such a motion." ( Standon Co. v. Superior Court (1990) 225 Cal.App.3d 898, 903, 275 Cal.Rptr. 833.) We decline defendants' implicit invitation to import these concepts of party discovery into the nonparty context. Defendants rely on dicta in Unzipped , but it is inapplicable. The subpoenaing party in Unzipped appears to have argued that the statute was inapplicable to business records subpoenas because it refers to the " ‘completion’ " of the record of deposition, which was allegedly incongruous with a single moment of production (or objections). ( Unzipped, supra , 156 Cal.App.4th at p. 134, 67 Cal.Rptr.3d 111.) The court disagreed. It explained, "Not all document productions are completed on the date stated in the subpoena. If the subpoenaing party opts to inspect and copy the original documents at the office of the responding business, ‘the record’ of the production could take days to complete. This may occur in part because the subpoenaing party's access to the documents is limited by statute to either the business's normal hours—the time when the business is normally open to the public—or six hours a day, whichever is greater. (See [Code Civ. Proc.,] § 2020.430, subd. (c)(1) ; Evid. Code, § 1560, subd. (e).) Until the entire inspection is finished, including the raising of any objections during that process, the necessity and scope of a motion to compel may not be known. Consequently, if on the first day of an inspection, a party is escorted to a warehouse full of documents, the party can rest assured that the 60-day period will not begin to run until the production is over." ( Unzipped , at p. 134, 67 Cal.Rptr.3d 111.) Defendants argue that the 60-day deadline likewise did not begin here until the state agencies' productions were complete.

Rutledge rejected defendants' reading of Unzipped. It held that "the 60-day period during which a motion to compel must be filed, begins to run when the deponent serves objections on the party. At the time the objections are served, the record of deposition is complete." ( Rutledge, supra , 238 Cal.App.4th at p. 1192, 190 Cal.Rptr.3d 411.) The same is true here. An inspection, as discussed in Unzipped , is not at issue. Instead, defendants' subpoenas commanded a date for production. The Medical Board and Pharmacy Board did not produce documents; they responded with objections. The 60-day period in which to file a motion to compel began on that date.

Defendants point out that the Medical Board and Pharmacy Board eventually produced some documents in response to the subpoena. They argue that "requiring an earlier motion on some discrete portion of the discovery request—while production and negotiation on others continued—would encourage piecemeal litigation burdening not only courts, but nonparties forced to answer multiple motions arising from the same subpoena." Defendants misunderstand the statutory scheme. A nonparty must comply (or not) with the subpoena on the date specified for production. If a party is not satisfied with the nonparty's compliance, the party has 60 days in which to meet and confer with the nonparty. These meet and confer efforts do not affect the mandatory 60-day deadline. The meet and confer process is part of the 60-day period in which to file a motion; it does not extend it. If the party is still unsatisfied with the nonparty's compliance with any portion of the subpoena at the end of this period (because, for example, the nonparty still has not produced the requested documents), the party may file a motion to compel. This motion to compel must encompass any issue the subpoenaing party wishes to raise regarding the nonparty's compliance. There is no opportunity or occasion to file multiple, piecemeal motions to compel. Defendants served very broad subpoenas, which were met with objections from the Medical Board and Pharmacy Board. Defendants had 60 days in which to meet and confer with the state agencies and, if unsatisfied, file motions to compel. Defendants did not file their motions until six months after this deadline expired. Defendants' motions were untimely, and they should have been denied on this basis. The trial court erred by finding otherwise.

II

Consumer Notices

The Medical Board, Pharmacy Board, and Nursing Board argue that the subpoenas were defective because defendants did not provide notice to consumers whose personal information was responsive to the subpoenas. The DOJ incorporates these arguments by reference. Defendants respond that (1) the consumer notice requirement does not apply to state agencies and (2) consumer notice is unnecessary where the consumer's personal identifying information is redacted. We disagree that the consumer notice requirement does not apply to state agencies and conclude that defendants should have at least provided consumer notice to those individuals whose personal identifying information would not be redacted.

A deposition subpoena that seeks "personal records pertaining to a consumer" must be accompanied by proof that the consumer was served with notice of the subpoena or by the consumer's written authorization to release his or her personal records. ( Code Civ. Proc., § 2020.410, subd. (d).) The scope and nature of this notice is described by statute. (Id. , § 1985.3.)

"[T]he Legislature enacted [Code of Civil Procedure] section 1985.3 ... to establish a process by which an individual would learn of subpoenas for his or her confidential records and would have the time and opportunity to litigate the propriety of that subpoena prior to the release of the private records. The statute was an outgrowth of the then recent amendment to the California Constitution that elevated the right of privacy to an inalienable right, and the California Supreme Court decision in Valley Bank of Nevada v. Superior Court (1975) 15 Cal.3d 652, 125 Cal.Rptr. 553, 542 P.2d 977, in which the court held that before a bank could release confidential information to a civil litigant about a bank customer, the bank was first required to take ‘reasonable steps’ to notify the customer that the customer's records were being sought." ( Foothill Federal Credit Union v. Superior Court (2007) 155 Cal.App.4th 632, 638, 66 Cal.Rptr.3d 249.) The statute "requires that consumers be informed when certain personal records have been subpoenaed, and it offers them the opportunity to challenge that subpoena before the documents sought are produced. [Code of Civil Procedure s]ection 1985.3 offers a consumer a ‘statutory procedural mechanism for enforcing his or her right to privacy.’ " ( Id. at p. 639, 66 Cal.Rptr.3d 249.)

State agencies are specifically included in the consumer notice requirement. ( Code Civ. Proc., § 1985.4.) The statutory procedures are applicable to any subpoena seeking " ‘personal information’ " maintained by an agency that is otherwise exempt from public disclosure. (Ibid. ) The term "personal information," as adopted by the consumer notice statutes, means "any information that is maintained by an agency that identifies or describes an individual, including, but not limited to, his or her name, social security number, physical description, home address, home telephone number, education, financial matters, and medical or employment history. It includes statements made by, or attributed to, the individual." ( Civ. Code, § 1798.3, subd. (a), adopted by Code Civ. Proc., § 1985.4.) A "consumer," in this context, means any natural person. ( Code Civ. Proc., § 1985.4.)

The definition of "personal information" is taken from the Information Practices Act of 1977 (IPA; Civ. Code, § 1798 et seq. ), which limits the collection and disclosure of such information by state agencies. (See Perkey v. Dept. of Motor Vehicles (1986) 42 Cal.3d 185, 191-193, 228 Cal.Rptr. 169, 721 P.2d 50 ; Bates v. Franchise Tax Bd. (2004) 124 Cal.App.4th 367, 373, 21 Cal.Rptr.3d 285.) Under the IPA, "[a]n agency shall not disclose any personal information in a manner that would link the information disclosed to the individual to whom it pertains" except under defined circumstances. ( Civ. Code, § 1798.24.) Among these circumstances is disclosure "[t]o any person pursuant to a subpoena, court order, or other compulsory legal process if, before the disclosure, the agency reasonably attempts to notify the individual to whom the record pertains, and if the notification is not prohibited by law." ( Id. , § 1798.24, subd. (k).) The IPA supersedes any other provision of state law that "authorizes any agency to withhold from an individual any record containing personal information which is otherwise accessible under the provisions of this chapter." (Id. , § 1798.70.) It further provides, "Nothing in this chapter shall be construed to authorize the disclosure of any record containing personal information, other than to the subject of such records, in violation of any other law." (Id. , § 1798.72.) The IPA "shall be liberally construed so as to protect the rights of privacy arising under this chapter or under the Federal or State Constitution." (Id. , § 1798.63.)

The trial court here ordered the production of, among other things, investigatory files, administrative records of disciplinary proceedings, and coroner's reports of physician or surgeon negligence or incompetence. Although the court allowed the redaction of personal identifying information of patients, complaining parties, and witnesses, the personal identifying information of the investigated or disciplined health care professionals was not included. Defendants contend that the IPA supersedes any notice requirement for these individuals that would otherwise be applicable. This contention presents an issue of statutory interpretation, which we review de novo. (See Snibbe v. Superior Court (2014) 224 Cal.App.4th 184, 189, 168 Cal.Rptr.3d 548 ( Snibbe ).)

Defendants' contention is unpersuasive. As noted, the consumer notice provisions specifically include state agencies within their scope. ( Code Civ. Proc., § 1985.4.) The consumer notice provisions adopt the IPA's definition of "personal records" in describing the scope of the required notice. (Ibid. , citing Civ. Code, § 1798.3.) The IPA itself cautions that it should not be read to authorize the disclosure of records containing personal information "in violation of any other law"—other than to the subject of such records, which is not the situation here. ( Civ. Code, § 1798.72.) This cautionary provision limits the ostensibly more general authorization to disclose personal information in response to a subpoena. (Id. , § 1798.24, subd. (k).) Disclosure in response to a subpoena is authorized only if it would not violate any other law. Where, as here, a state agency is served with a subpoena seeking personal information that does not comply with the consumer notice provisions, disclosure of the personal information would violate the law, i.e., the consumer notice provisions, so it is not authorized by the IPA.

The fact that the IPA "supersedes" other statutes that allow an agency to withhold records does not affect this conclusion. (See Civ. Code, § 1798.70.) In the situation presented here, the IPA and the consumer notice provisions work together to maximize the privacy protection afforded to persons whose personal information is implicated. (See id. , § 1798.63.) There is no conflict between the statutory schemes that would require one statute to supersede the other. Because defendants' subpoenas seek the personal information of investigated or disciplined health care professionals, without redaction, defendants were required to provide notice to these persons. Defendants did not do so. The state agencies properly refused to produce such information. (See Code Civ. Proc., § 1985.3, subd. (k).) The trial court erred by ordering its production.

The state agencies argue that notice was required even to those persons whose personal identifying information would be redacted under the court's order compelling production, on the theory that sufficiently unique information would remain to discover the redacted identities and impact patient privacy rights. (Cf. Code Civ. Proc., § 1985.3, subd. (i).) We need not consider this argument because we conclude the court's orders compelling production of such records must be vacated for other reasons.

III

Categories of Documents to Be Produced

The state agencies contend the trial court erred by ordering production because the categories to be produced exceed the scope of permissible nonparty discovery and violate various privileges. The agencies also argue that CURES data is protected by statute from disclosure. "The standard of review for a discovery order is abuse of discretion. [Citation.] We also review an order granting or denying a motion for a discovery-related protective order under the abuse of discretion standard." ( People ex rel. Harris v. Sarpas (2014) 225 Cal.App.4th 1539, 1552, 172 Cal.Rptr.3d 25.)

We conclude the trial court abused its discretion in compelling production of the investigatory files, administrative records, and CURES data. These categories are overly broad, not reasonably calculated to lead to the discovery of admissible evidence, and violative of the official information privilege, the deliberative process privilege, and the right to privacy. The investigatory files and administrative records contain vast amounts of material, and defendants have not shown that these broad categories are reasonably calculated to lead to the discovery of admissible evidence. Moreover, even if these categories do contain some records that would be discoverable, their probative value is vastly outweighed by the privileged and private nature of the other records swept up in the production. As to the CURES data, we disagree that they are categorically protected by statute from disclosure. But we conclude that defendants have not justified such a sweeping production of personal and private medical data. Our conclusion is supported by an absence of any persuasive explanation why the voluminous data defendants already possess, or that is publicly available to them, is inadequate to mount an effective defense. As to the coroner's reports, the current record contains little detail regarding their contents. In light of our conclusion that the trial court erred in compelling their production in the absence of notice to the affected physicians and surgeons, we need not consider whether the trial court also abused its discretion in ordering this category produced.

"Although the scope of civil discovery is broad, it is not limitless." ( Calcor Space Facility v. Superior Court (1997) 53 Cal.App.4th 216, 223, 61 Cal.Rptr.2d 567 ( Calcor ).) In general, "any party may obtain discovery regarding any matter, not privileged, that is relevant to the subject matter involved in the pending action or to the determination of any motion made in that action, if the matter either is itself admissible in evidence or appears reasonably calculated to lead to the discovery of admissible evidence." ( Code Civ. Proc., § 2017.010.) To meet this standard, a party seeking to compel production of records from a nonparty must articulate specific facts justifying the discovery sought; it may not rely on mere generalities. ( Calcor , at p. 224, 61 Cal.Rptr.2d 567.) In assessing the party's proffered justification, courts must keep in mind the more limited scope of discovery available from nonparties. (See Catholic Mutual Relief Society v. Superior Court (2007) 42 Cal.4th 358, 366, fn. 6, 64 Cal.Rptr.3d 434, 165 P.3d 154.)

Even if information is otherwise discoverable, it may be protected by a constitutional or statutory privilege. Three such privileges are at issue here, the right to privacy, the official information privilege, and the deliberative process privilege.

The right to privacy applies in numerous contexts, inside and outside of government. "The state Constitution expressly grants Californians a right of privacy. ( Cal. Const., art. I, § 1.) Protection of informational privacy is the provision's central concern. [Citation.] In [Hill v. National Collegiate Athletic Association (1994) 7 Cal.4th 1, 26 Cal.Rptr.2d 834, 865 P.2d 633], [our Supreme Court] established a framework for evaluating potential invasions of privacy. The party asserting a privacy right must establish a legally protected privacy interest, an objectively reasonable expectation of privacy in the given circumstances, and a threatened intrusion that is serious. [Citation.] The party seeking information may raise in response whatever legitimate and important countervailing interests disclosure serves, while the party seeking protection may identify feasible alternatives that serve the same interests or protective measures that would diminish the loss of privacy. A court must then balance these competing considerations. [Citation.] [¶] The Hill test, conceived in the context of a pleaded cause of action for invasion of privacy, has been applied more broadly, including to circumstances where litigation requires a court to reconcile asserted privacy interests with competing claims for access to third party contact information." ( Williams v. Superior Court (2017) 3 Cal.5th 531, 552, 220 Cal.Rptr.3d 472, 398 P.3d 69.) The official information privilege and the related deliberative process privilege apply specifically to confidential information maintained by the government. "Under longstanding common law and statutory principles, information obtained through a promise of confidentiality is not subject to the right of public access when the public interest would be furthered by maintaining confidentiality. [Citations.] This principle is currently reflected in Evidence Code section 1040, which provides a privilege to a public entity to refuse to disclose information acquired in confidence if ‘there is a necessity for preserving the confidentiality of the information that outweighs the necessity for disclosure.’ " ( Sander v. State Bar of California (2013) 58 Cal.4th 300, 325, 165 Cal.Rptr.3d 250, 314 P.3d 488.) " ‘Under the deliberative process privilege, senior officials of all three branches of government enjoy a qualified, limited privilege not to disclose or to be examined concerning not only the mental processes by which a given decision was reached, but the substance of conversations, discussions, debates, deliberations and like materials reflecting advice, opinions, and recommendations by which government policy is processed and formulated.’ [Citation.] The privilege rests on the policy of protecting the ‘ " ‘decision making processes of government agencies.’ " ’ [Citation.] ‘The key question in every case is "whether the disclosure of materials would expose an agency's decisionmaking process in such a way as to discourage candid discussion within the agency and thereby undermine the agency's ability to perform its functions." ’ " ( San Joaquin County Local Agency Formation Commission v. Superior Court (2008) 162 Cal.App.4th 159, 170-171, 76 Cal.Rptr.3d 93 ; see generally Times Mirror Co. v. Superior Court (1991) 53 Cal.3d 1325, 1339-1344 & fn. 9, 283 Cal.Rptr. 893, 813 P.2d 240.)

Investigatory Files and Administrative Records. The trial court ordered production of investigative files from each of the state agencies, as well as administrative records of disciplinary proceedings from the Medical Board, Pharmacy Board, and Nursing Board. The investigative files are confidential (see, e.g., Bus. & Prof. Code, § 800, subd. (c)(1) ), and the administrative records are often sealed, in whole or in part. The record here shows that these categories encompass numerous documents that are neither relevant to the subject matter of the action nor reasonably calculated to lead to the discovery of admissible evidence. The investigative files appear to contain witness interviews and documentary evidence, including complete patient medical records. The administrative records are akin to appellate records and contain every notice, motion, pleading, order, transcript, and exhibit offered or admitted in the proceeding. (See Cal. Code Regs., tit. 1, § 1038, subd. (a).) Some of these documents may contain information, like physician-patient communications, that are otherwise shielded from civil discovery. (See, e.g., Bus. & Prof. Code, § 2225, subd. (a).) Defendants have made no showing that every such document, or even the majority of such documents, are discoverable from the nonparties here. They claim that investigatory files and administrative records are necessary to show that the bad acts of health professionals, or agency inaction, contributed to the opioid crisis in California. Setting aside the absence of any cogent legal argument supporting this theory, defendants' explanation is far too general to support the production of every document in these categories. (See Calcor, supra , 53 Cal.App.4th at p. 224, 61 Cal.Rptr.2d 567 ["The very vice of the subpoena's promiscuity is well illustrated by [the subpoenaing party's] inability to provide focused, fact-specific justifications for its demands."].) For example, these categories include extensive patient medical records and witness testimony, not to mention briefs, hearing transcripts, and documentary evidence. Defendants have not shown why they need all of this information to support their position that health professionals acted badly or state agencies failed to control bad actors. Defendants already have information regarding the state agencies' disciplinary proceedings, including the allegations against the health care professional, a summary of the evidence, and the agency's decision. And they have alternative methods of obtaining relevant information, including depositions of relevant state agency officials.

In contrast to the defendants' minimal showing of discoverability, the private and public interest in the confidentiality of the requested materials is substantial. The health care professionals named in the investigatory files and disciplinary proceedings have a legally protected privacy interest in their personal information reflected in the records, which may include not only their professional and financial details but also their own medical records. (See John B. v. Superior Court (2006) 38 Cal.4th 1177, 1198, 45 Cal.Rptr.3d 316, 137 P.3d 153 [medical information]; Alch v. Superior Court (2008) 165 Cal.App.4th 1412, 1426, 82 Cal.Rptr.3d 470 [professional work history]; Ameri-Medical Corp. v. Workers' Comp. Appeals Bd. (1996) 42 Cal.App.4th 1260, 1287, 50 Cal.Rptr.2d 366 [financial information].) This right to privacy is especially salient for those professionals who were investigated but never accused of wrongdoing. Disclosure of personal information would constitute a serious invasion of the privacy rights of these health care professionals, and defendants have fallen far short of establishing any countervailing interest that would justify indiscriminate disclosure of all personal information contained in the administrative records and investigatory files. (See Britt v. Superior Court (1978) 20 Cal.3d 844, 864, 143 Cal.Rptr. 695, 574 P.2d 766 ; Snibbe, supra , 224 Cal.App.4th at pp. 190, 196, 168 Cal.Rptr.3d 548 ["Generally, the least intrusive means must be utilized when privacy rights are at stake."].)

Likewise, the agencies themselves have an interest in protecting the integrity of their investigations and disciplinary proceedings. This interest is reflected in both the official information privilege and the related deliberative process privilege. The agencies rely on the confidentiality of complaints, witnesses, deliberations, and the proceedings in general to protect vulnerable patients and witnesses—including the colleagues of the investigated or disciplined health care professionals—and maximize the truth-seeking function of their efforts. Indiscriminate production of investigatory files and administrative records would discourage cooperation by persons outside the agencies and candid discussion by persons inside the agencies. (See Chronicle Publishing Co. v. Superior Court of San Francisco (1960) 54 Cal.2d 548, 570, 7 Cal.Rptr. 109, 354 P.2d 637.) The interest in confidentiality clearly outweighs defendants' interest in obtaining these broad categories of documents, many of which have little or no relevance to the claims and defenses at issue in this proceeding. (See City of Los Angeles v. Superior Court (1973) 33 Cal.App.3d 778, 785, 109 Cal.Rptr. 365 ["Such raw data ... is not lightly to be invaded."].) This conclusion is especially sound where the agency has ended an investigation without seeking discipline or other legal sanction. (See Chronicle , at p. 573, 7 Cal.Rptr. 109, 354 P.2d 637 ; see also Board of Trustees v. Superior Court of Santa Clara County (1981) 119 Cal.App.3d 516, 528, 174 Cal.Rptr. 160 ["[W]e are advised of no area of our law, or argument in reason, providing that an investigatory body finding no misconduct, must nevertheless allow discovery to the investigation's subject, of the evidence considered and its detailed conclusions thereon. Indeed, sound public policy appears to be otherwise."].)

The trial court abused its discretion in ordering the production of complete investigatory files and administrative records. We express no opinion whether a more limited order compelling production of specific documents within those categories, or aggregate statistics, would be proper.

CURES Data. "The Controlled Substance Utilization Review and Evaluation System (CURES) is California's prescription drug monitoring program." ( Lewis v. Superior Court (2017) 3 Cal.5th 561, 565, 220 Cal.Rptr.3d 319, 397 P.3d 1011 ( Lewis ).) The Legislature established the CURES database "[t]o assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical analysis, education, and research." ( Health & Saf. Code, § 11165, subd. (a).) Each pharmacy, clinic, or other prescription drug dispenser must provide a report containing the following information each time a controlled substance is dispensed: (1) full name, gender, date of birth, address, and telephone number (if available) of the ultimate user of the controlled substance (i.e., the patient); (2) the prescriber's license number, national provider identifier (NPI) number, federal controlled substance registration number, and state medical license number; (3) the pharmacy's prescription number, license number, NPI number, and federal controlled substance registration number; (4) National Drug Code (NDC) number of the controlled substance dispensed; (5) quantity of the controlled substance dispensed; (6) International Statistical Classification of Diseases Code, if available; (7) number of refills ordered; (8) whether the drug was dispensed as a refill or as a first-time request; (9) date of origin of the prescription; (10) date of dispensing of the prescription; and (11) the serial number of the prescription form, if applicable. ( Id. , § 11165, subd. (d).)

The statute governing CURES provides for robust confidentiality protections: "CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations." ( Health & Saf. Code, § 11165, subd. (c)(2)(A).)

The state agencies argue that these confidentiality protections amount to a privilege against disclosure in response to defendants' civil subpoena. We disagree. "Discovery ‘privileges are strictly statutory. Absent a statutory privilege, no person has a privilege to refuse to produce a writing in a legal proceeding.’ [Citations.] ‘The party claiming a privilege shoulders the burden of showing that the evidence it seeks to suppress falls within the terms of an applicable [privilege] statute.’ " ( Los Angeles Unified School Dist. v. Trustees of Southern Cal. IBEW-NECA Pension Plan (2010) 187 Cal.App.4th 621, 628, 114 Cal.Rptr.3d 440 ( LAUSD ).)

In Department of Motor Vehicles v. Superior Court (2002) 100 Cal.App.4th 363, 122 Cal.Rptr.2d 504 ( DMV ), the court considered a statute declaring that " ‘all records of the [DMV] relating to the physical or mental condition of any person [are] confidential and not open to public inspection.’ " ( Id. at pp. 370-371, 122 Cal.Rptr.2d 504, fn. omitted.) The court concluded that the statute did not establish a privilege against disclosure in discovery. "Characterizing information as confidential from public inspection is not the equivalent of establishing a privilege in a legal proceeding. [The statute] does not use the term ‘privilege’ nor does it invoke the concept of privilege as that term is used in the Evidence Code or discovery statutes." ( Id. at p. 371, 122 Cal.Rptr.2d 504.) "The obvious and stated purpose of [the statute] is to render physical and mental condition information ‘confidential and not open to public inspection.’ Placing this language in context confirms that it merely provides a limitation on public disclosure, not an evidentiary privilege." ( Ibid. ) Likewise, in LAUSD, supra , 187 Cal.App.4th at page 624, 114 Cal.Rptr.3d 440, the court considered whether a statute established a privilege against disclosure of employee information in third-party certified payroll records. It noted, "California courts have repeatedly held that statutes which simply characterize information as ‘confidential’ or otherwise limits its public disclosure do not create an absolute privilege ...." ( Id. at p. 629, 114 Cal.Rptr.3d 440.) "Rather, the language or structure of the statute must evince a legislative intent to bar disclosure even in the context of litigation. These holdings are consistent with the general rule that privileges are to be ‘narrowly construed ... because they operate to prevent the admission of relevant evidence and impede the correct determination of issues.’ " ( Id. at pp. 630-631, 114 Cal.Rptr.3d 440.) Because the statute at issue gave no indication that the Legislature intended to limit disclosure "for the purposes of litigation," the court found that the information was not absolutely privileged. ( Id. at p. 631, 114 Cal.Rptr.3d 440.)

Similarly here, the statute declares the CURES data confidential and places limits on its disclosure. We note that these limits are not particularly strict, since numerous governmental and nongovernmental entities and individuals have access or can obtain access to CURES data. ( Health & Saf. Code, § 11165, subd. (c)(2)(A).) Indeed, every authorized prescriber can access CURES data for his or her patients. (Id. , § 11165.6.) The implementing regulations promulgated by the DOJ expressly allow for disclosure in response to a subpoena if compelled by court order. ( Cal. Code Regs., tit. 11, § 826, subd. (d)(10).) Given this framework, we cannot conclude that the Legislature intended to establish a privilege against disclosure in civil discovery. "Confidentiality does not equate with privilege." ( DMV, supra , 100 Cal.App.4th at p. 373, 122 Cal.Rptr.2d 504 ; accord, LAUSD, supra , 187 Cal.App.4th at p. 629, 114 Cal.Rptr.3d 440.) The same reasoning precludes a finding that CURES data is absolutely privileged under Evidence Code section 1040, subdivision (b)(1). (See DMV , at p. 375, 122 Cal.Rptr.2d 504 ; LAUSD , at p. 631, 114 Cal.Rptr.3d 440.)

The state agencies rely on Kleitman v. Superior Court (1999) 74 Cal.App.4th 324, 87 Cal.Rptr.2d 813 and Richards v. Superior Court of Los Angeles County (1968) 258 Cal.App.2d 635, 65 Cal.Rptr. 917, but they are distinguishable. Kleitman interpreted the Ralph M. Brown Act ( Gov. Code, § 54950 et seq. ) to allow disclosure of a public agency's closed meeting sessions "in only two situations: (1) in camera review by the trial court of the minute book when it is alleged that a violation of the Brown Act has occurred during a closed session [citation]; and (2) in camera review and disclosure of the tape recording of a closed session where there exists a prior judgment that the legislative body held unlawful closed sessions, a court order to make tape recordings, and a factual showing that another violation has occurred [citation]." ( Kleitman , at p. 333, 87 Cal.Rptr.2d 813.) Richards interpreted an unemployment insurance statute declaring certain medical information " ‘confidential’ " and not " ‘open to public inspection in any manner.’ " ( Richards , at p. 637, 65 Cal.Rptr. 917.) The unemployment statutes went on to declare, " ‘Such records are not admissible in evidence in any action or special proceeding other [than] one arising under this division....’ " ( Ibid. )

In both Kleitman and Richards , the use of confidential materials was limited in litigation to specified instances. Here, by contrast, the CURES statute generally allows disclosure "to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes" and to other public and private entities for numerous other purposes. ( Health & Saf. Code, § 11165, subd. (c)(2)(A).) While the statute generally limits disclosure, it does not limit the use or admissibility of CURES data in litigation specifically. Kleitman and Richards are inapplicable.

Nonetheless, even though CURES data is not absolutely privileged from discovery, defendants have not justified the disclosure of hundreds of millions of CURES database records related to opioids and other specified drugs. We note initially that the court's order compelling production requires either (1) the production of patient identifying data to defendants' vendor or (2) the production of data with patient identifying data replaced with a unique identifier supplied by defendants' vendor that would allow the vendor to cross-reference CURES data with other data in its possession (e.g., insurance claim data). The production of patient identifying information would require defendants to serve consumer notices on those patients whose information would be produced. (See part II, ante. ) It would also implicate the privacy rights of the patients. (See Lewis, supra , 3 Cal.5th at pp. 575-577, 220 Cal.Rptr.3d 319, 397 P.3d 1011.) The production of data with unique identifiers may also require consumer notice, depending on the nature of the data and the ability of the vendor or the defendants to re-identify the patients. Parties to litigation cannot avoid the consumer notice provisions by using unique identifiers that can be decoded by the receiving party, as if the data were never de-identified in the first place. We need not consider this point, however, because we conclude the trial court erred by compelling production for other reasons.

Defendants contend that the CURES data is relevant and discoverable because they will establish defendants' market share, as compared to other manufacturers, and because they will show whether defendants' drugs were associated with opioid abuse and overdoses. They also contend the data is relevant and discoverable to show whether patients were engaged in illicit activities or whether they obtained prescriptions from unauthorized prescribers. Again, defendants do not offer any cogent legal argument supporting these theories of relevance. Nor do they persuasively explain why such a large amount of personal and private data, on millions of Californians, is necessary in light of the extensive information already available to them. For example, defendants admit they have "insurance claims data and hospital claims data" from the plaintiff jurisdictions and other private entities, as well as comprehensive mortality data from the California Department of Health. The Department already releases data on opioid-related deaths, emergency room visits, hospitalizations, and county-level prescriptions. The DOJ releases aggregate statistics from the CURES database across numerous dimensions. And presumably defendants themselves have their own sales and market share data. Defendants emphasize their desire to link CURES data to other datasets, but they do not explain why such a link is necessary beyond generalities like the need to "measure trends and test causal relationships." Such generalities are insufficient to justify such a vast production of medical information from the nonparties here. (See Calcor, supra , 53 Cal.App.4th at p. 224, 61 Cal.Rptr.2d 567.) The trial court abused its discretion in ordering production of hundreds of millions of CURES database records.

Coroner's Reports. The coroner's reports are statutorily-required submissions that must be made "[w]hen a coroner receives information that is based on findings that were reached by, or documented and approved by a board-certified ... pathologist indicating that a death may be the result of a physician and surgeon's, podiatrist's, or physician assistant's gross negligence or incompetence." ( Bus. & Prof. Code, § 802.5, subd. (a).) "The initial report shall include the name of the decedent, date and place of death, attending physicians or podiatrists, and all other relevant information available. The initial report shall be followed, within 90 days, by copies of the coroner's report, autopsy protocol, and all other relevant information." (Ibid. ) "The report required by this section shall be confidential." ( Id. , § 802.5, subd. (b).) The trial court ordered the Medical Board to produce every coroner's report involving opioids.

Like the investigatory files and administrative records, the coroner's reports encompass a wide variety of documents of varying relevance. And, like those categories, the private and public interests in confidentiality are strong. However, based on the current record, we are unable to fully assess the balance between defendants' interest in obtaining the information against the interest in maintaining confidentiality. Because we conclude the court erred by compelling production of the coroner's reports in the absence of a consumer notice to the affected physicians and surgeons (see part II, ante ), we need not further address this issue. On remand, if this issue is properly before the trial court again, the court shall take care to examine the contents of a typical coroner's report to determine whether the category is reasonably calculated to lead to the discovery of admissible evidence and, if so, whether defendants' interest in obtaining these reports is outweighed by private or public interests in maintaining confidentiality. The trial court should consider the burden on the Medical Board to identify, redact, and produce these reports. It should also consider whether a more targeted production of certain documents from the reports, or aggregate statistics based on the reports, is a reasonable alternative. DISPOSITION

Defendants' demurrer to the petitions is overruled. The petitions are granted. Let a peremptory writ of mandate issue directing the trial court to (1) vacate its orders compelling production of documents from the Medical Board, Pharmacy Board, and DOJ and enter new orders denying defendants' motions to compel; and (2) vacate its order denying in part the Nursing Board's motion for protective order and enter a new order granting it. Petitioners shall recover their costs in this original proceeding. ( Cal. Rules of Court, rule 8.493(a)(2).)

WE CONCUR:

HUFFMAN, Acting P. J.

IRION, J.