Opinion
No. B252032.
05-29-2014
MEDICAL BOARD OF CALIFORNIA, Real Party in Interest. ALWIN CARL LEWIS, Petitioner, v. THE SUPERIOR COURT OF LOS ANGELES COUNTY, Respondent
Fenton Nelson, Henry R. Fenton , Dennis E. Lee and Benjamin J. Fenton for Petitioner.
Francisco J. Silva , Long X. Do and Lisa Matsubara for California Medical Association as Amicus Curiae on behalf of Petitioner.
No appearance for Respondent.
Kamala D. Harris , Attorney General, Gloria L. Castro , Assistant Attorney General, E.A. Jones III and Edward K. Kim , Deputy Attorneys General, for Real Party in Interest.
OPINION
ALDRICH, J.
In this case, we determine whether the Medical Board of California (hereafter, the Board) violated patients' informational privacy rights in their controlled substances prescription records when the Board obtained that data from the Controlled Substance Utilization Review and Evaluation System (CURES) (Health & Saf. Code, § 11165) during a disciplinary investigation of their physician. Alwin Carl Lewis, M.D., contends the CURES statute violates his patients' informational privacy rights, as the statute permits the Board to access data before obtaining a warrant or administrative subpoena demonstrating good cause.
California's Constitution grants an express right to privacy (art. I, § 1), thus our focus is on California case law rather than federal law or the federal Constitution. The Board's statutory authority to access CURES during the course of an investigation into Lewis's alleged unprofessional conduct requires balancing his patients' right to privacy in their controlled substances prescription records against the state's interest in protecting the public health by regulating the abuse and diversion of controlled substances, and in protecting the public against incompetent, impaired, or negligent physicians. We conclude on balance, the CURES statute does not amount to an impermissible invasion of Lewis's patients' state constitutional right to privacy, as there are sufficient safeguards to prevent unwarranted public disclosure and unauthorized access to CURES data. Thus, we deny the petition.
The privacy issue presented here also was addressed in Medical Bd. of California v. Chiarottino (2014) [ ]). The First District concluded the Board did not violate a physician's patients' constitutional right to privacy by accessing CURES before issuing administrative subpoenas for medical records.
FACTUAL AND PROCEDURAL BACKGROUND
The Board, through its division of medical quality, has statutory authority to investigate, and to take and commence disciplinary action against a physician guilty of unprofessional conduct. (Bus. & Prof. Code, §§ 2220, subd. (a), 2227, 2234, 2241.5, subd. (c)(7); Arnett v. Dal Cielo (1996) 14 Cal.4th 4, 7 [56 Cal.Rptr.2d 706, 923 P.2d 1]; see Stiger v. Flippin (2011) 201 Cal.App.4th 646, 651-652 .) The Board enforces the Medical Practice Act (Bus. & Prof. Code, § 2000 et seq.), and several statutory provisions address prescribing controlled substances by licensee-physicians. (Bus. & Prof. Code, §§ 2238 [violation of state or federal statute regulating dangerous drugs or controlled substances], 2241 [furnishing drugs to addicts], 2241.5 [prescribing, dispensing, or administering to a person under his or her treatment for medical condition, dangerous drugs or prescription controlled substances for treatment of pain], 2242 [furnishing dangerous drugs without examination].) To assist regulatory agencies, such as the Board, in their efforts to control the diversion and resultant abuse of controlled substances, CURES electronically monitors the prescribing and dispensing of these prescription drugs. (Health & Saf. Code, § 11165, former subd. (c).)
At the time of these administrative proceedings, Health and Safety Code section 11165, subdivision (c) applied. The Legislature has since amended the statute. Subdivision (c) of Health and Safety Code section 11165 was renumbered (c)(2). (See post.)
1. Access to CURES During Investigation and Disciplinary Proceedings
The Board began its investigation after one of Lewis's patients complained about the quality of care and treatment that she received during her initial consultation in May 2008. The patient's complaint focused on Lewis's recommendation that she lose weight and start a diet that the patient considered to be unhealthful. During the course of the investigation, the Board investigator obtained CURES reports for Lewis's prescribing practices from November 1, 2005, through November 25, 2008, and from December 16, 2008, through December 16, 2009. The investigator testified that it was a common practice during the course of an investigation to "run" a CURES report on the physician.
Based upon a review of these CURES reports, the Board sent releases to six of Lewis's patients to obtain their medical records. The Board received signed releases from three patients, and the Board obtained the other two patients' records after an administrative subpoena was issued and notice was sent to the patients that their medical records were being subpoenaed.
Three of Lewis's patients voluntarily consented to the release of their medical records. Lewis has no standing to assert their privacy rights. (See Pating v. Board of Medical Quality Assurance (1982) , 621 [ ].)
The operative second amended accusation (accusation) filed by the Board against Lewis alleged, as to the initial patient, gross negligence in her care and treatment by failing to focus on her chief complaints, repeated negligent acts in her care and treatment, failure to maintain adequate/accurate medical records, and general unprofessional conduct. With respect to the additional patients, the accusation alleged prescribing without an appropriate prior examination, excessive prescribing, failure to maintain adequate/accurate medical records, general unprofessional conduct, and violation of drug statutes.
At the conclusion of the eight-day administrative hearing, the administrative law judge (ALJ) submitted a proposed decision. As to the initial patient, the ALJ concluded that Lewis engaged in unprofessional conduct by failing to maintain adequate records. With respect to the additional patients, the ALJ found that two of Lewis's patients had been over-prescribed controlled substances during a short period of time. The ALJ, however, concluded it had not been established that Lewis engaged in repeated acts of excessive prescribing of dangerous drugs or furnished dangerous drugs without appropriate prior examinations. Lewis was disciplined for failing to maintain accurate prescription records. The ALJ recommended revoking Lewis's license, but the revocation was stayed. Lewis was placed on probation for three years with certain conditions. The Board adopted the ALJ's proposed decision.
2. Mandamus Proceeding in Superior Court, Petition for Writ of Mandate
Lewis filed a petition for writ of administrative mandamus in the trial court seeking to set aside the Board's decision. Lewis did not challenge the Board's factual findings and legal conclusions as to the initial patient, but challenged the factual findings and legal conclusions with respect to the additional patients. Lewis argued the Board violated his patients' informational privacy rights under article I, section 1 of the California Constitution by accessing CURES during the course of an investigation unrelated to improper prescription practices, and also violated their rights not to be subjected to unwarranted searches and seizures.
The trial court denied the petition, concluding CURES permitted the Board to access the data without an administrative subpoena or other showing of good cause. In the extensive written order, the court further stated that Lewis "provide[d] no authority suggesting that an authorized government body's review of the CURES system's data violate[d] a right to privacy." The trial court noted that even if the constitutional right to privacy were implicated, the right to privacy is not absolute and "must be weighed against the compelling public interest in controlling potentially dangerous pharmaceuticals to prevent their abuse." In weighing these competing interests, "[t]he public health and safety concern[s] served by the monitoring and regulation of the prescription of controlled substances serves a compelling public interest that justifie[d] disclosure of prescription records without notification or consent." Judgment was entered denying the petition for writ of administrative mandamus.
Lewis filed a petition for writ of mandate in this court to set aside the judgment. A writ petition is the only authorized mode of appellate review. (Bus. & Prof. Code, § 2337; Leone v. Medical Board (2000) 22 Cal.4th 660, 663-664, 670 [94 Cal.Rptr.2d 61, 995 P.2d 191].) We issued an order to show cause. For the reasons stated, we discharge the order to show cause and deny Lewis's petition.
CONSTITUTIONAL ISSUE
(1) Lewis presents the following issue for review: "[W]hether the Medical Board of California is permitted to conduct searches, without any showing of any kind — whether good cause, reasonable suspicion, or some other similar standard — and without warrant or subpoena — of the controlled substances prescription records of patients throughout the State, via the State's computerized Controlled Substance Utilization Review and Evaluation System." As stated, the challenge to CURES appears to be based upon the protections of the Fourth Amendment, but Lewis makes clear that he is asserting his patients' right to informational privacy in their controlled substances prescription records. Lewis has standing to assert his patients' right to privacy under article I, section 1 of the California Constitution. (Wood v. Superior Court (1985) 166 Cal.App.3d 1138, 1145 .)
Because Lewis uses the words "subpoena" and "warrant," we assume his use of "warrant" is in the traditional Fourth Amendment sense to refer to criminal proceedings. The United States Supreme Court, however, uses the term "warrant" also to refer to administrative subpoenas that are the usual method by which an administrative agency obtains records from private parties. (See De La Cruz v. Quackenbush (2000) , 779, fn. 1 [ ].) "The right at stake is the right to a front-end or back-end judicial review of the reasonableness of the search." ( Ibid.)
The Fourth Amendment of the United States Constitution, which is enforceable against the states as a component of the Fourteenth Amendment's guarantee of due process of law provides in relevant part: "The right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures, shall not be violated ...." (U.S. Const., 4th Amend.; see Mapp v. Ohio (1961) , 655 [6 L.Ed.2d 1081, 81 S.Ct. 1684, 86 OhioLawAbs. 513].) "`Fourth Amendment rights are personal rights which, like some other constitutional rights, may not be vicariously asserted.'" ( Rakas v. Illinois (1978) , 133-134 [58 L.Ed.2d 387, 99 S.Ct. 421]; see In re Lance W. (1985) , 890 [ , ].)
As presented, the issue also appears to be a facial attack to the constitutional validity of CURES. "A facial challenge to the constitutional validity of a statute or ordinance considers only the text of the measure itself, not its application to the particular circumstances of an individual." (Tobe v. City of Santa Ana (1995) 9 Cal.4th 1069, 1084 [40 Cal.Rptr.2d 402, 892 P.2d 1145].) The relief typically sought is total invalidation of the law. Therefore, cases hold that the challenger must demonstrate "`"a present total and fatal conflict with applicable constitutional prohibitions."'" (Ibid.) In contrast, an as applied challenge to a statute or ordinance involves an otherwise facially valid measure that has been applied in a constitutionally impermissible manner. (Ibid.) This type of challenge "contemplates analysis of the facts of a particular case or cases to determine the circumstances in which the statute or ordinance has been applied and to consider whether in those particular circumstances the application deprived the individual to whom it was applied of a protected right." (Ibid.)
Lewis clarifies that his constitutional challenge does not seek to invalidate the CURES statute. He does not challenge the CURES statute insofar as the state requires the collection of his patients' controlled substances prescription records in a centralized database. Nor does he "contend here that a warrant or showing of good cause is required in all CURES searches. Rather, he contends that such a requirement applies when the purpose of the CURES search is the investigation of physicians rather than pharmacies." (Original underscoring.) This distinction is based on the physician-patient relationship. As it applies to him, Lewis's constitutional attack is narrowly focused on the Board's access to his patients' CURES data during an investigation unrelated to improper prescription practices without patient consent or prior judicial approval upon a showing of good cause.
We focus solely on Lewis's patients' right to informational privacy because Lewis has no reasonable expectation of privacy in his prescribing practices of controlled substances. (Health & Saf. Code, § 11190.) As discussed, post, controlled substances are highly regulated by the state.
Accordingly, Lewis presents an as applied challenge to the CURES statute, in which we analyze the facts of his case to determine the circumstances in which CURES has been applied and consider whether the application deprived Lewis's patients of a protected privacy right. (See Tobe v. City of Santa Ana, supra, 9 Cal.4th at p. 1084.) Whether a statute is challenged facially or as applied, when the facts are not disputed, the determination of its constitutionality is a question of law that we review de novo. (Alviso v. Sonoma County Sheriff's Dept. (2010) 186 Cal.App.4th 198, 204 .)
DISCUSSION
The constitutional issue presented here implicates the informational privacy rights of patients in the highly regulated area of controlled substances. We present a brief overview of these statutes before addressing the privacy issues.
1. Regulation of Controlled Substances
The prescribing and dispensing of controlled substances in California is regulated by the California Uniform Controlled Substances Act (the Act). (Health & Saf. Code, § 11000 et seq.) The Act classifies controlled substances into five schedules. (Health & Saf. Code, §§ 11053-11058.) For example, codeine, hydrocodone, morphine, and methadone are examples of schedule II drugs. (Health & Saf. Code, § 11055, subds. (b)(1)(G), (I), (L) & (c)(14).) With the exception of a 72-hour supply for a patient, or an order for use by a hospital patient, no controlled substance classified in schedule II "shall" be dispensed without a prescription." (Health & Saf. Code, §§ 11158, subds. (a), (b), 11159.) Except when ordered for use by a hospital patient, "or when dispensed directly to an ultimate user by a practitioner, other than a pharmacist or pharmacy, no controlled substance classified in Schedule III, IV, or V may be dispensed without a prescription." (Health & Saf. Code, §§ 11158, subd. (a); see id., § 11159.)
Prescriptions for schedules II through V drugs must be made on an official form, but schedules III through V drugs may be dispensed upon an oral or electronically transmitted prescription. (Health & Saf. Code, § 11164, subds. (a), (b).) If orally or electronically transmitted, a hard copy must be produced and "signed and dated by the pharmacist filling the prescription" or other authorized person. (Health & Saf. Code, § 11164, subd. (b)(1).) These prescription forms must contain the address for whom the controlled substance is prescribed. (Health & Saf. Code, § 11164, subd. (a)(2).) If the prescription is orally or electronically transmitted, the hard copy need not include the address if that information is readily retrievable in the pharmacy. (Health & Saf. Code, § 11164, subd. (b)(2).)
Every practitioner, other than a pharmacist, who prescribes a controlled substance classified in schedules II through IV has a duty to keep records of controlled substances dispensed. (Health & Saf. Code, § 11190, subds. (a)-(c).) "Each prescriber that dispenses controlled substances shall provide the Department of Justice the information required by this subdivision on a weekly basis in a format set by the Department of Justice pursuant to regulation." (Health & Saf. Code, § 11190, subd. (c)(2)(A).) Certain exceptions to the reporting requirements apply to schedules II, III, and IV controlled substances but are not at issue here. (Health & Saf. Code, § 11190, subds. (e), (f).)
2. Health and Safety Code Section 11165 (CURES)
The Department of Justice maintains CURES to electronically monitor the prescribing and dispensing of schedules II through IV controlled substances by all practitioners authorized to prescribe or dispense these controlled substances. (Health & Saf. Code, § 11165, subd. (a).) Although the Legislature has since amended subdivision (a) of Health and Safety Code section 11165, at the time of these administrative proceedings, the statute stated in pertinent part: "To assist law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical analysis, education, and research, the Department of Justice shall ... maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and Internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe or dispense these controlled substances." The Department of Justice receives weekly reports from dispensing pharmacies for schedules II through IV controlled substances prescriptions. (Health & Saf. Code, § 11165, subd. (d).) These reports include the name, address, and telephone number of the "ultimate user," the prescriber's license number, the pharmacy prescription number, the national drug code (NDC) of the controlled substance dispensed, the quantity of the controlled substance dispensed, and the number of refills ordered. (Health & Saf. Code, § 11165, subd. (d).)
Health and Safety Code section 11165, subdivision (a) now reads: "To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical analysis, education, and research, the Department of Justice shall ... maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and Internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances."
(2) The Department of Justice provides CURES reports to the Board without use of a subpoena. (Health & Saf. Code, § 11165, former subd. (c).) "Data obtained from CURES shall only be provided to appropriate state, local, and federal persons or public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the Department of Justice, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions." (Health & Saf. Code, § 11165, former subd. (c).) Former subdivision (c) of Health and Safety Code section 11165 was renumbered as subdivision (c)(2) without substantive changes to the quoted provision. The CURES statute prohibits the disclosure, sale, or transfer of data to any third party. (Health & Saf. Code, § 11165, former subd. (c).)
We deferred ruling on the Board's request for judicial notice. We grant judicial notice of exhibits E and F and deny the request as to the remaining exhibits. It appears from these exhibits that the legislative intent was to establish CURES to provide instantaneous access for authorized entities.
The following sentence was added to Health and Safety Code section 11165, subdivision (c)(2): "The Department of Justice shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision."
At the time of these proceedings, the statute provided that "CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients." (Health & Saf. Code, § 11165, former subd. (c).) Subdivision (c)(1) of Health and Safety Code section 11165 now states: "The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations."
The Information Practices Act of 1977 (Civ. Code, § 1798 et seq.) places strict limits on the dissemination of personal information to protect an individual's right to privacy. (Civ. Code, § 1798.1.) Subdivision (e) of Civil Code section 1798.24 permits disclosure "[t]o a person, or to another agency where the transfer is necessary for the transferee agency to perform its constitutional or statutory duties, and the use is compatible with a purpose for which the information was collected and the use or transfer is accounted for in accordance with Section 1798.25." "[A] use is compatible if the use of the information requested is needed in an investigation of unlawful activity under the jurisdiction of the requesting agency or for licensing, certification, or regulatory purposes by that agency." (Civ. Code, § 1798.24, subd. (e).) The Board qualifies for authorization under CURES to access and review controlled substances prescription records.
3. The State Constitutional Right to Privacy
(3) The California Constitution contains an explicit guarantee of the right of privacy. (Cal. Const., art. I, § 1; American Academy of Pediatrics v. Lungren (1997) 16 Cal.4th 307, 326 [66 Cal.Rptr.2d 210, 940 P.2d 797] (plur. opn. of George, C. J.).) The constitutional provision states: "All people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy." (Cal. Const., art. I, § 1.) The privacy protected by the California Constitution "is no broader in the area of search and seizure than the `privacy' protected by the Fourth Amendment or by article I, section 13 of the California Constitution." (Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 30, fn. 9 [26 Cal.Rptr.2d 834, 865 P.2d 633] (Hill).) The privacy right at issue here is Lewis's patients' interests in preventing the disclosure or misuse of their controlled substances prescription records, which falls into the category of "informational privacy."
The United States Supreme Court in Whalen v. Roe (1977) 429 U.S. 589, 599-600 [51 L.Ed.2d 64, 97 S.Ct. 869] assumed a right to informational privacy existed under the federal Constitution in controlled substances prescription records. (See National Aero. and Space Admin. v. Nelson (2011) 562 U.S. ___, ___ - ___ & fn. 10 [178 L.Ed2d 667, 131 S.Ct. 746, 756-757 & fn. 10]; People v. Gonzales (2013) 56 Cal.4th 353, 384 [154 Cal.Rptr.3d 38, 296 P.3d 945].) "[I]n many contexts, the scope and application of the state constitutional right of privacy is broader and more protective of privacy than the federal constitutional right of privacy as interpreted by the federal courts. [Citations.]" (American Academy of Pediatrics v. Lungren, supra, 16 Cal.4th at pp. 326-327.) The state constitutional right of privacy, and the privacy right protected by the federal Constitution are not absolute. Rather, the right to privacy is a conditional right that may be infringed upon by balancing the intrusion with a showing of the proper governmental interest. (Whalen v. Roe, supra, at p. 598; Tucson Woman's Clinic v. Eden (9th Cir. 2004) 379 F.3d 531, 551; Hill, supra, 7 Cal.4th at pp. 34-35.) As previously stated, our analysis focuses on the express guarantee of the right to privacy under the California Constitution. 4. The Board Did Not Violate Lewis's Patients' Right to Informational Privacy
(4) Article I, section 1 of the California Constitution creates a "`legal and enforceable right of privacy for every Californian.'" (White v. Davis (1975) 13 Cal.3d 757, 775 [120 Cal.Rptr. 94, 533 P.2d 222].) "The party claiming a violation of the constitutional right of privacy established in article I, section 1 of the California Constitution must establish (1) a legally protected privacy interest, (2) a reasonable expectation of privacy under the circumstances, and (3) a serious invasion of the privacy interest." (International Federation of Professional & Technical Engineers, Local 21, AFL-CIO v. Superior Court (2007) 42 Cal.4th 319, 338 [64 Cal.Rptr.3d 693, 165 P.3d 488], citing Hill, supra, 7 Cal.4th at pp. 39-40.) These "`threshold elements'" screen out claims that otherwise do not implicate significant intrusions on a privacy interest protected by the state constitutional privacy provision. (American Academy of Pediatrics v. Lungren, supra, 16 Cal.4th at pp. 330-331.) Once these elements are established, the court must then weigh and balance the justification for the conduct in question against the severity of the intrusion on privacy. (Id. at p. 331.)
If these threshold elements are proved, the Hill decision sets the standard in which a proffered justification for alleged interferences with the right to privacy will be measured. "Where the case involves an obvious invasion of an interest fundamental to personal autonomy, e.g., freedom from involuntary sterilization or the freedom to pursue consensual familial relationships, a `compelling interest' must be present to overcome the vital privacy interest. If, in contrast, the privacy interest is less central, or in bona fide dispute, general balancing tests are employed." (Hill, supra, 7 Cal.4th at p. 34.)
"Whether a legally recognized privacy interest is present in a given case is a question of law to be decided by the court. [Citations.] Whether plaintiff has a reasonable expectation of privacy in the circumstances and whether defendant's conduct constitutes a serious invasion of privacy are mixed questions of law and fact." (Hill, supra, 7 Cal.4th at p. 40.)
a. Legally Protected Privacy Right
(5) The right to privacy extends to medical records. (John B. v. Superior Court (2006) 38 Cal.4th 1177, 1198 [45 Cal.Rptr.3d 316, 137 P.3d 153]; Board of Medical Quality Assurance v. Gherardini (1979) 93 Cal.App.3d 669, 678-679 .) "The state of a person's gastro-intestinal tract is as much entitled to privacy from unauthorized public or bureaucratic snooping as is that person's bank account, the contents of his library or his membership in the NAACP." (Board of Medical Quality Assurance v. Gherardini, supra, at p. 679.) Like medical records, prescription records contain identifying information and sensitive information related to drugs used to treat a person's medical condition and also reveal medical decisions concerning the course of treatment. What medication a person takes to treat a gastrointestinal condition also is entitled to privacy from unauthorized public and bureaucratic snooping.
By statute, there also is a legally protected privacy interest in controlled substances prescription records stored in CURES. Health and Safety Code section 11165.1, which permits a treating physician or pharmacist to access CURES data, specifically states that this information is considered medical information subject to the provisions of the Confidentiality of Medical Information Act (Civ. Code, § 56 et seq.). (Health & Saf. Code, § 11165.1, subd. (d).) Moreover, the CURES statute prohibits unauthorized public disclosure and operates under existing law to safeguard privacy and confidentiality. (Health & Saf. Code, § 11165, former subd. (c); Civ. Code, § 1798.24, subd. (e).) Thus, a patient who has obtained a prescription for a controlled substance has a legally protected privacy interest in unwarranted public disclosure and unauthorized access to information contained in those records.
Civil Code section 56.05, subdivision (j) provides in pertinent part: "`Medical information' means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient's medical history, mental or physical condition, or treatment."
b. Reasonable Expectation of Privacy
(6) "Even when a legally cognizable privacy interest is present, other factors may affect a person's reasonable expectation of privacy." (Hill, supra, 7 Cal.4th at p. 36.) Citing Whalen v. Roe, supra, 429 U.S. at page 602, the Hill court noted that "customs, practices, and physical settings ... may create or inhibit reasonable expectations of privacy." (Hill, supra, at p. 36.)
In Whalen v. Roe, supra, 429 U.S. 589, the United States Supreme Court upheld a New York statute that required reporting schedule II prescription records to the state department of health. The information included the name of the prescribing physician, the dispensing pharmacy, the drug and dosage, and the name, address, and age of the patient. (Id. at p. 593.) This data was recorded into a centralized computer system. (Ibid.) The collection of this data, as part of the state's oversight of controlled substances, was not an unwarranted disclosure of private information in violation of federal constitutionally protected privacy rights. (Id. at pp. 591, 592-593.) The Whalen court concluded collecting this centralized data was supported by established law and not "meaningfully distinguishable from a host of other unpleasant invasions of privacy that are associated with many facets of health care." (Id. at p. 602.) Thus, the New York statute did not violate "any right or liberty protected by the Fourteenth Amendment." (Id. at pp. 603-604, 606.)
Addressing the threat of public disclosure, the Whalen court noted there was a possibility that the data may be offered in a judicial proceeding if a doctor or patient is accused of a violation of the law. (Whalen v. Roe, supra, 429 U.S. at p. 600.) The court reasoned, however, that the remote possibility judicial supervision of the evidentiary use of this data would provide inadequate privacy protection was insufficient to hold the New York statute facially unconstitutional. (Id. at pp. 601-602.)
We recognize the privacy issue in Whalen v. Roe was limited to collecting centralized data by the state, and thus the court did not address the issue presented here, that is, a patient's right to informational privacy when these centralized controlled substances prescription records are accessed by a state, local, or federal agency for disciplinary, civil, or criminal purposes. Nevertheless, we find Whalen v. Roe to be persuasive, as did the California Supreme Court in Hill, to illustrate what constitutes a reasonable expectation of privacy.
The centralized data, however, was available for use by state department of health investigators, and had been used in at least two investigations. ( Whalen v. Roe, supra, 429 U.S. at p. 595.)
(7) There is a diminished expectation of privacy in controlled substances prescription records maintained in CURES. Contrary to Lewis's contention, it does not follow that a patient's expectation of privacy in his or her controlled substances prescription records is the same as the expectation of privacy in medical records. Unlike medical records, prescriptions of controlled substances are subject to regular scrutiny by law enforcement and regulatory agencies as part of the pervasive regulation of controlled substances. A reasonable patient filling a prescription for a controlled substance knows or should know that the state, which prohibits the distribution and use of such drugs without a prescription, will monitor the flow of these drugs from pharmacies to patients. Pharmacies are required to maintain records of prescriptions filled for controlled substances and present them to "`authorized officers of the law'" without a warrant. (People v. Doss (1992) 4 Cal.App.4th 1585, 1597-1598 ; see Bus. & Prof. Code, §§ 4081, subd. (a), 4333, subd. (a).) A pharmacist also has a statutory obligation to provide data of controlled substances prescriptions to the Department of Justice on a weekly basis for electronic monitoring in CURES. (Health & Saf. Code, § 11165, subd. (d).) This well-known and long-established regulatory history significantly diminishes any reasonable expectation of privacy against the release of controlled substances prescription records to state, local, or federal agencies for purposes of criminal, civil, or disciplinary investigations.
The California Medical Association (CMA) has filed an amicus curiae letter brief on behalf of Lewis. CMA argues the Board's position is absurd that a patient's controlled substances prescription records may be subject to different privacy protections depending on whether the information is contained in CURES or in medical records. This argument mischaracterizes the Board's position. Prescriptions for controlled substances are highly regulated and whether the information is housed in CURES or at the local pharmacy, there is a statutory obligation to provide controlled substances prescription records to the state without a warrant or administrative subpoena, reducing any reasonable expectation of privacy.
(8) Both federal and state courts also have recognized that "closely regulated" businesses have a reduced expectation of privacy whether analyzed as creating an unreasonable expectation of privacy or a reasonable expectation of privacy justified by a competing state interest. (E.g., New York v. Burger (1987) 482 U.S. 691, 702 [96 L.Ed.2d 601, 107 S.Ct. 2636]; see People v. Doss, supra, 4 Cal.App.4th at p. 1598.) While the reasonable expectation of privacy is diminished here, it is not de minimis. A patient has a reasonable expectation that sufficient statutory safeguards in CURES prevent unwarranted public disclosure and unauthorized access to their controlled substances prescription records.
c. Seriousness of Invasion
Not every intrusion of privacy gives rise to a cause of action for invasion of privacy. (Hill, supra, 7 Cal.4th at p. 37.) "Actionable invasions of privacy must be sufficiently serious in their nature, scope, and actual or potential impact to constitute an egregious breach of the social norms underlying the privacy right." (Ibid.) Lewis contends that when the Board accessed CURES, a serious invasion of his patients' privacy rights occurred because (1) there are no criminal or civil sanctions in the CURES statute to safeguard against unwarranted public disclosure, and (2) there is no statutory requirement of a showing of good cause or other judicial determination before the Board accessed his patients' CURES data.
CMA offers a third reason, that is, patients are not the subject of the investigation. CMA focuses on the deficiencies of CURES to provide notice to patients, or to permit patients to have access to their CURES data. These deficiencies are not pertinent to our resolution of the issue presented here, and these concerns are better directed to the Legislature.
(1) Unwarranted Public Disclosure
The fear, not present here, that the Board will publicly disclose CURES data obtained during the course of a licensee-physician investigation does not constitute a serious invasion of privacy. The Board has statutory and regulatory duties to protect against the public release of a patient's CURES data. As noted, the Board may lawfully obtain CURES data as authorized by statute for disciplinary purposes. (Health & Saf. Code, § 11165, former subd. (c).) Data disclosed to any individual agency cannot be sold or transferred to a third party. (Ibid.) The Board also must secure CURES data against unauthorized disclosure and has an independent statutory duty to protect the privacy and confidentiality of any information it obtains in the discharge of its duties. (Health & Saf. Code, § 11165, former subd. (c); Bus. & Prof. Code, § 2225.) Civil Code section 1798.24, subdivision (e) further requires the Board to protect CURES data from unwarranted public disclosure. Here, there is no contention that the Board publicly disclosed Lewis's patients' information to third parties or failed to protect the confidentiality of the CURES data it received during the course of its investigation.
Lewis relies on Tucson Woman's Clinic v. Eden, supra, 379 F.3d 531, in which the Ninth Circuit concluded that the informational privacy rights of patients were violated by Arizona regulations that required disclosure of (1) unredacted medical records to the Arizona Department of Health Services (DHS), and (2) ultrasound pictures with patient identifying information to a private contractor for review. (Id. at pp. 551-554.) The Ninth Circuit employed a balancing test to weigh the privacy interest against the state intrusion, noting the safeguards to prevent unauthorized disclosure of unredacted medical records and ultrasound pictures to members of the public were inadequate. (Id. at pp. 552-553.) Citing Whalen v. Roe, supra, 429 U.S. at pages 594 through 595, the Ninth Circuit reasoned that, unlike the Arizona regulations, the New York statute imposed criminal penalties for such unauthorized disclosures. (Tucson Woman's Clinic v. Eden, supra, at p. 552.) Additionally, there were no safeguards in the Arizona regulations to limit access to these records, which on balance constituted a violation of the patients' informational privacy rights. (Id. at pp. 552-553.)
The Ninth Circuit's analysis, however, was decidedly different concerning the regulation that required licensee-physicians to release information, including the name of a patient, to a professional licensing board if an incident arose with the patient. (Tucson Woman's Clinic v. Eden, supra, 379 F.3d at pp. 553-554.) The court recognized that although a professional licensing board was not covered by the statutory scheme's prohibitions on information disclosure, other established safeguards prohibited release of patient information to the public when any incident was reported to the Arizona Medical Board or the Board of Osteopathic Examiners in Medicine and Surgery. (Id. at p. 554.) The requested information was limited, and the state had a strong interest in the licensing board investigating serious patient incidents. Employing the balancing test, the Ninth Circuit concluded there was no violation of patients' informational privacy rights. (379 F.3d at p. 554.)
In Tucson Woman's Clinic v. Eden, supra, , the Ninth Circuit also considered the constitutionality of the regulatory scheme permitting warrantless inspections of abortion clinics. ( Id. at p. 549.) The Ninth Circuit held the regulatory scheme violated physicians' Fourth Amendment rights, and the administrative exception applicable to closely regulated businesses was inapplicable to the searches authorized by the Arizona regulations. (379 F.3d at pp. 550-551.) The balancing test the Ninth Circuit used to address informational privacy rights under the Fourteenth Amendment was not applicable to its Fourth Amendment analysis.
(9) Here, although there are no penalties in CURES for unwarranted public disclosure, other safeguards prohibit release of patient information to the public. Thus, we conclude the release of CURES data to the Board during an investigation of a licensee-physician is not a serious invasion of privacy because sufficient safeguards are in place.
(2) Access to CURES Data Without a Warrant or Subpoena
Lewis next contends the Board's access to CURES during an investigation of a licensee-physician is a serious invasion of his patients' privacy rights because there is a reasonable societal expectation that to conduct such a search there must be a showing of good cause (or other reasonableness standard) to obtain an administrative subpoena or warrant. Lewis argues the Board must make this showing before accessing CURES.
Lewis's argument is a challenge to the Board's authority to access CURES to compile the facts necessary to obtain administrative subpoenas for his patients' medical records. To support his argument, Lewis principally relies on State v. Skinner (La. 2009) 10 So.3d 1212, which held that a warrantless search of a criminal defendant's pharmacy records during a criminal investigation violated the defendant's Fourth Amendment privacy interests and the state constitutional right to privacy. (10 So.3d at p. 1218.) The court addressed whether Louisiana's citizens have a reasonable expectation of privacy in their pharmaceutical prescriptions and medical records such that a warrant is required for a search of those records in a criminal investigation. (Id. at p. 1215.) Analyzing federal jurisprudence under the Fourth Amendment privacy interest and the state's heightened privacy interest, the Skinner court concluded "the right to privacy in one's medical and prescription records is an expectation of privacy that society is prepared to recognize as reasonable." (10 So.3d at p. 1218.) Thus, a warrant was required. Absent from Lewis's discussion of Skinner is a distinction critical here, that is, a balancing test was inapplicable to the court's Fourth Amendment analysis of the intrusion into individual privacy during the course of a criminal investigation. (State v. Skinner, supra, 10 So.3d at p. 1218.) In Whalen v. Roe, supra, 429 U.S. 589, the United States Supreme Court dismissed the claims raised pursuant to the Fourth Amendment, noting that the cases cited in support of that argument involved "affirmative, unannounced, narrowly focused intrusions into individual privacy during the course of criminal investigations." (Whalen, at p. 604, fn. 32.) The Whalen court declined to extend the Fourth Amendment protections to the informational privacy interest at stake in that case. (Whalen, at p. 604, fn. 32.)
Skinner did not involve access to a centralized database maintained by the state. The Board points out that access to state records by another state agency is not a search from the standpoint of the patient.
Like the informational privacy rights under the federal Constitution at issue in Whalen v. Roe and Tucson Woman's Clinic v. Eden, under this state's constitutional right to privacy (Cal. Const., art. I, § 1), we must balance the justification against the intrusion when a case involves a genuine, nontrivial invasion of a privacy interest. Thus, Skinner, which is non-binding authority, is not persuasive.
In Medical Bd. of California v. Chiarottino, supra, , the court cited out-of-state cases relying on Whalen v. Roe to conclude the Board did not violate patients' privacy interests in accessing CURES and using that information to obtain administrative subpoenas. (225 Cal.App.4th at pp. 634-635.)
We granted Lewis's request to bring to our attention another out-of-state case recently filed in the United States District Court in Oregon, Oregon Prescription Drug Monitoring Program v. United States Drug Enforcement Administration (D.Or., Feb. 11, 2014, No. 3:12-cv-02023-HA) ___ F.Supp.2d ___ . That case is inapposite. The statutory scheme at issue is not similar to the CURES statute, and the Fourth Amendment issue presented was the right of a federal agency to obtain centralized records from a state prescription drug monitoring program by issuing administrative subpoenas rather than obtaining warrants.
Focusing on the Fourth Amendment privacy interest, Lewis further argues that access to CURES without an administrative subpoena (or warrant) is a serious invasion of privacy that cannot be justified under the "closely regulated" business exception to the warrant requirement. The rationale for this exception is the owner or operator of a closely regulated business has a reduced expectation of privacy.
(10) A warrantless search of a "closely regulated" business is deemed reasonable if certain criteria are met. (New York v. Burger, supra, 482 U.S. at p. 702; De La Cruz v. Quackenbush, supra, 80 Cal.App.4th at pp. 781-782.) To pass constitutional muster, one criterion is that the inspection program must provide a constitutionally adequate substitute for a warrant. (New York v. Burger, supra, at pp. 702-703.) The regulatory statute must advise the owner of the commercial premises that the search is being made pursuant to the law, have a properly defined scope, and limit the discretion of the inspecting officers. (Id. at p. 703.) Lewis contends that the CURES statute imposes no limits on the discretion of the inspecting officer, which we presume in this context is the Board investigator. We disagree. Access to CURES in compliance with the statutory procedures satisfies this requirement and is a reasonable search.
As a preliminary matter, there is a diminished expectation of privacy in the highly regulated area of prescription drugs, as a warrantless search of a patient's pharmacy records is statutorily authorized. (Bus. & Prof. Code, § 4081, subd. (a).) There is no greater right to privacy in controlled substances prescription records stored in CURES than the privacy rights in the same prescription records housed at CVS or Rite Aid Pharmacy.
Unlike De La Cruz v. Quackenbush, supra, 80 Cal.App.4th 775, where the regulatory scheme did not define a routine inspection program, the CURES statute informs patients and physicians that controlled substances prescription records are subject to disclosure to the state for electronic monitoring by the Department of Justice. (Health & Saf. Code, § 11165, former subd. (c).) Access to CURES data is limited to state and federal agencies for civil, criminal, and disciplinary purposes. Thus, under the statutory scheme, the physician and patient know who is authorized to receive CURES data and under what narrow circumstances.
In sum, we conclude that the Board's access to CURES during the course of a disciplinary investigation did not constitute a serious invasion of Lewis's patients' right to informational privacy.
d. Balancing the Justification Against the Intrusion
Even if we were to conclude that Lewis had established the threshold elements to establish a right to informational privacy on behalf of his patients, we must balance the justification for permitting the Board to access CURES during an investigation of a licensee-physician against the intrusion. (See Hill, supra, 7 Cal.4th at p. 40.) An invasion of privacy is justified if it substantively furthers one or more countervailing interests. (Ibid.)
Lewis and the Board do not agree on the level of scrutiny required to balance these interests. In Whalen v. Roe, supra, 429 U.S. 589, the court invoked a rational basis test, concluding the New York statute was a reasonable exercise of the state's broad police powers. (Id. at p. 598.) In Hill, the Supreme Court declined to hold that every assertion of a privacy interest under article I, section 1 must be overcome by a "`compelling interest.'" (Hill, supra, 7 Cal.4th at pp. 32-35.) Board of Medical Quality Assurance v. Gherardini, supra, 93 Cal.App.3d 669, decided before Hill, held that when balancing the intrusion into the patients' informational privacy rights in their medical records, the state must establish a compelling state interest. (Id. at p. 679.) Although the privacy issue here relates to informational privacy, which is similar to the constitutional question addressed by the Whalen court, we assume without deciding that the state must establish a compelling interest.
The Board advances two compelling state interests to access CURES during an investigation of a licensee-physician.
(11) First, there is no dispute that the state has a compelling interest in controlling the diversion and abuse of controlled substances. Pursuant to its police power to protect the public health and welfare, a state has the power to regulate and control the sale, use, and traffic of habit-forming drugs. (Whipple v. Martinson (1921) 256 U.S. 41, 45 [65 L.Ed. 819, 41 S.Ct. 425]; People v. Privitera (1979) 23 Cal.3d 697, 704-705 [153 Cal.Rptr. 431, 591 P.2d 919], cert. den. sub nom. Privitera v. California (1979) 444 U.S. 949 [62 L.Ed.2d 318, 100 S.Ct. 419].) As the United States Supreme Court stated when examining a California statute that regulated morphine: "There can be no question of the authority of the State in the exercise of its police power to regulate the administration, sale, prescription and use of dangerous and habit-forming drugs, such as are named in the statute. The right to exercise this power is so manifest in the interest of the public health and welfare, that it is unnecessary to enter upon a discussion of it beyond saying that it is too firmly established to be successfully called in question." (Whipple v. Martinson, supra, at p. 45; see People v. Privitera, supra, at p. 731 (dis. opn. of Bird, C. J.).)
Second, the state has a compelling interest in exercising its regulatory power to protect the public against incompetent, impaired, or negligent physicians. (Arnett v. Dal Cielo, supra, 14 Cal.4th at p. 7.) "Protection of the public shall be the highest priority for the Medical Board of California in exercising its licensing, regulatory, and disciplinary functions. Whenever the protection of the public is inconsistent with other interests sought to be promoted, the protection of the public shall be paramount." (Bus. & Prof. Code, § 2001.1.) Vesting the Board with the authority to investigate complaints against licensee-physicians is an integral part of the oversight of professional practice.
Lewis contends that his patients' informational privacy rights in their controlled substances prescription records outweighs these compelling state interests because the CURES statute permits the Board to access data before demonstrating good cause. We disagree.
The Legislature has determined that CURES may be accessed as a tool to monitor abuse and diversion of controlled substances. To impose a good cause requirement before accessing CURES data would necessarily involve litigating the privacy issue in advance. As the court stated in Reynaud v. Superior Court (1982) 138 Cal.App.3d 1 , when addressing a similar argument, the scope of the privacy clause is "potentially enormous" and the "variety of circumstances in which it might be invoked is essentially infinite." (138 Cal.App.3d at p. 8.) This delay defeats the legislative purpose of CURES. One of the real-time benefits of access to CURES is to permit a physician, who is authorized to prescribe or dispense a controlled substance, to instantly look up a new patient's controlled substances history to determine whether the patient legitimately needs pain medicine or is "doctor shopping."
Real-time access to CURES also protects patients from incompetent and unprofessional doctors. If the privacy issue were litigated before accessing CURES, the prescribing physician under investigation could stall release of these records, which would prevent the state from exercising its police power to protect the public health.
The Board's access to CURES also should not be limited based upon the nature of the complaint lodged against the licensee-physician. From the patients' perspective, the privacy interest in their controlled substances prescription records is no different if the Board were investigating unprofessional conduct in their care and treatment or in improper prescription practices. Even if the Board is investigating the former, as was the case here, a physician's prescribing practices are directly related to medical care and treatment afforded to his patients. A complaint regarding the quality of care and treatment by a diet doctor, for example, might often reveal improper prescribing practices that could be deadly. Likewise, a complaint regarding the quality of care or treatment may be related to a physician's substance abuse problem that poses a threat to public health. Limits such as Lewis proposes would compromise the Board's paramount concern to protect public health.
Balancing the state's substantial interest in preventing the abuse and diversion of controlled substances and protecting the public health against the minor intrusion upon a patient's informational privacy in his or her controlled substances prescription records stored in CURES, we conclude the Board's actions here in accessing and compiling data from CURES did not violate article I, section 1 of the California Constitution. There are sufficient safeguards in the CURES statute and other regulatory duties to protect patients' informational privacy and confidentiality from unwarranted public disclosure and unfettered access to CURES data. Thus, we conclude the Board's access to CURES while investigating a consumer complaint against Lewis that was unrelated to his prescription practices did not violate his patients' state constitutional right to privacy in their controlled substances prescription records. Accordingly, the trial court did not err in denying Lewis's petition to set aside the Board's disciplinary action against him.
DISPOSITION
The order to show cause is discharged. The petition for writ of mandate is denied. The parties are to bear their own costs.
Klein, P. J., and Croskey, J., concurred.