The California Supreme Court this year is poised to decide what further limitations — if any — should be placed on third-party investigators’ access to the state’s prescription drug monitoring database.
At issue in Lewis v. The Superior Court of California is whether the state medical board’s access to records in the prescription drug monitoring program — called the Controlled Substance Utilization Review and Evaluation System, or CURES — violates patient privacy.
Background on CURES
CURES, maintained by the California Department of Justice, was established in 2009 to help physicians and law enforcement officers identify patterns of over-prescribing by doctors or prescription drug-shopping by patients. In addition, the database allows providers to make better-informed decisions by accessing a patient’s prescription drug history.
The database includes information on all controlled substances prescribed in the state and houses more than 100 million entries, according to the CURES website. Providers who prescribe Schedule II through IV controlled substances are required to submit information to the database. The program receives more than 60,000 annual requests for review from physicians and pharmacists.
According to the CURES website, access to the database is limited to:
- Licensed prescribers and pharmacists;
- Law enforcement personnel; and
- Regulatory board personnel when necessary for patient care or official investigatory/regulatory purposes.
Forty-nine states have similar prescription drug monitoring programs, according to the American Civil Liberties Union. And while access rules vary by state — some require court orders, while others don’t allow law enforcement access at all — the most stringent form of restriction among such databases is a requirement to demonstrate probable cause and obtain a warrant, said Nate Wessler, an attorney with the ACLU.
That’s not required in California … yet.
Under current rules, DOJ can provide “CURES reports” to certain users without first obtaining a subpoena. Under section 11165(d) of the state’s Health and Safety Code, such reports “shall only be provided to appropriate state, local and federal persons or public agencies for disciplinary, civil or criminal purposes and to other agencies or entities, as determined by [DOJ] for the purpose of educating practitioners and others in lieu of disciplinary, civil or criminal actions.”
About the Case
The case didn’t start as one about privacy.
In 2012, a patient filed a complaint against her physician — Alwin Lewis — alleging inadequate care, according to court filings. The patient alleged that Lewis recommended she lose weight and start a diet that the patient considered to be detrimental to her health.
During the subsequent investigation into Lewis, the state medical board examined the doctor’s prescribing history using CURES. (Under its Division of Medical Quality, the board has statutory authority to investigate and take disciplinary action against a physician guilty of unprofessional conduct.)
When researching Lewis’ prescribing history, the medical board issued an administrative subpoena for more information on several patients’ prescription records that it had flagged as questionable.
An administrative law judge found that Lewis had acted unprofessionally because he had failed to maintain adequate records on the patient who filed the complaint. The judge placed the doctor on a two-year probation.
Lewis appealed to the Superior Court of Los Angeles County over an alleged violation of his patients’ right to informational privacy.
In the appeal, the court denied Lewis’ petition to set aside the board’s disciplinary action, ruling that the medical board did not violate patient privacy “as there are sufficient safeguards to prevent unwarranted public disclosure and unauthorized access to CURES data.”
Lewis asked the California Supreme Court to review the case.
Arguments for Limiting Access
The question before the state Supreme Court “essentially” is about the medical board’s ability to access records without patient approval, according to Ben Fenton, the lawyer for the plaintiff.
The plaintiff argues that further limits should be placed on the board’s access by requiring the medical board to obtain a court order before it can review the database. The plaintiff contends that, under current rules, the medical board did not have the authority to query CURES without first obtaining a warrant or a subpoena.
“Because the information on CURES is, in our view, confidential patient information, there has to be some sort of good cause before it can access the database,” Fenton said.
Several organizations have filed amicus briefs in support of stronger protections of the database and limitations on access to its content. For example, the California Medical Association wrote that current access to the CURES database is “inconsistent with the broad scheme of federal and state laws protecting the confidentiality and privacy of patient medical information.”
Lisa Matsubara, legal counsel for CMA, said, “The duty of physicians to protect patient privacy is the cornerstone of the patient-physician relationship and essential to maintaining patient trust and successful medical information gathering for accurate diagnosis and treatment to provide good medicine and quality care.”
Arguments Against Limiting Access
The California Medical Board did not respond to requests for comment for this story.
However, the board in court filings argued that it is not unprecedented to access the database during an investigation. In testimony before the trial court, investigators called it a “common practice” to use CURES reports.
The board added that the state’s Health and Safety Code gives CURES officials the authority to grant and decline access to the database and therefore, it does not require a court order. Further, the board argued that the court must weigh a patient’s right to privacy against the public interest of controlling the prescription of drugs to prevent misuse.
Meanwhile, Kristin Ford, press secretary at the state DOJ, in an email said that CURES “complies with all applicable state and federal data security standards.”
While Ford said CURES could not disclose its specific security measures, she noted that privacy is protected through its extensive application process, including determining the “validity” of all licensed users.
Ford said CURES would not comment further on the case as it is pending in court.
Timeline of Case
On Feb. 18, Fenton filed the opening brief on merits — the first step in a potentially long process before the state’s high court will issue a decision.
In the brief, Fenton reiterated the plaintiff’s argument that the court should restrict access to the database by requiring the medical board in the future to show good cause before reviewing the available information.
The medical board has until mid-March — 30 days after the opening brief was submitted — to review the brief and respond. When the board submits a response, each side will have an additional 20 days to review all submissions and deliver any other opening material.
There is no hearing scheduled yet. But based on the timeline for submitting briefs, oral arguments still could be about two months away. According to a court spokesperson, the court likely won’t make a decision until a month or so after that.
Ultimately, “[d]epending on the scope of the decision by the California Supreme Court, the decision could set a precedence for how government agencies access patient data,” Matsubara said.
However, it is unclear how exactly the decision will affect the CURES database, according to Wessler.
In their most basic form, “these [prescription drug monitoring] programs are set up as public health tools,” Wessler said.
That means at the root, they’re used by physicians and pharmacists to flag whether their patients have exhibited “concerning” behavior in terms of doctor-shopping. Requiring investigators to obtain a warrant likely would not affect that specific function of the program, he said.
At the same time, as argued in court, the process of demonstrating good cause could affect the speed at which criminal investigations are conducted. Whether that would hurt the effectiveness of the program remains to be seen.