Lewis v. Superior Court of L. A. Cnty.

Filed 7/17/17
IN THE SUPREME COURT OF CALIFORNIA
ALWIN CARL LEWIS, )
)
Petitioner, ) S219811
)
v. )
) Ct.App. 2/3 B252032
THE SUPERIOR COURT OF )
LOS ANGELES COUNTY, )
) Los Angeles County
Respondent; ) Super. Ct. No. BS 139289
)
MEDICAL BOARD OF CALIFORNIA, )
)
Real Party in Interest. )
____________________________________)
The Controlled Substance Utilization Review and Evaluation System
(CURES) is California‟s prescription drug monitoring program. By statute, every
prescription of a Schedule II, III, or IV controlled substance must be logged in
CURES, along with the patient‟s name, address, telephone number, gender, date of
birth, drug name, quantity, number of refills, and information about the
prescribing physician and pharmacy. (Health & Saf. Code, § 11165, subd. (d); all
undesignated statutory references are to this code.) The question in this case is
whether the Medical Board of California (Board) violated patients‟ right to
privacy under article I, section 1 of the California Constitution when it obtained
data from CURES without a warrant or subpoena supported by good cause in the
course of investigating the patients‟ physician, Dr. Alwin Carl Lewis. We hold
SEE CONCURRING OPINION
that it did not because, even assuming that accessing prescription records without
good cause constitutes a significant intrusion on a legally protected privacy
interest, the Board‟s actions in this case were justified.
I.
CURES was created in 1996 in an effort to move California‟s preexisting
drug monitoring program online. (Sen. Com. on Crim. Proc., Analysis of Assem.
Bill No. 3042 (1995–1996 Reg. Sess.) as amended Mar. 28, 1996.) CURES is
maintained by the California Department of Justice (DOJ) and is designed to
“assist health care practitioners in their efforts to ensure appropriate prescribing,
ordering, administering, furnishing, and dispensing of controlled substances,” and
to help “law enforcement and regulatory agencies in their efforts to control the
diversion and resultant abuse of [Schedule II-IV] controlled substances.”
(§ 11165, subd. (a).)
CURES requires any pharmacy or dispenser that prescribes or dispenses
controlled substances listed on Schedules II, III, or IV to keep a record of the
prescription and to report specific information to the DOJ as soon as reasonably
possible, subject to certain exceptions. (§§ 11165, subd. (d), 11190.) This
information includes the patient‟s full name, address, gender, date of birth,
quantity of the drug dispensed, number of refills ordered, and date of the
prescription. (§ 11165, subd. (d).) Data obtained from CURES can be provided to
“appropriate state, local, and federal public agencies for disciplinary, civil, or
criminal purposes and to other agencies or entities, as determined by the
Department of Justice, for the purpose of educating practitioners and others in lieu
of disciplinary, civil, or criminal actions.” (§ 11165, subd. (c)(2)(A).) At the time
of these proceedings, the statute provided that “CURES shall operate under
existing provisions of law to safeguard the privacy and confidentiality of patients.”
(§ 11165, former subd. (c).) Section 11165, subdivision (c) now states: “(1) The
2
operation of CURES shall comply with all applicable federal and state privacy and
security laws and regulations. [¶] (2)(A) CURES shall operate under existing
provisions of law to safeguard the privacy and confidentiality of patients. . . .”
Data obtained from CURES “shall not be disclosed, sold, or transferred to any
third party.” (§ 11165, subd. (c)(2)(A).)
In 2009, the Attorney General launched the Prescription Drug Monitoring
Program (PDMP) system, which allows preregistered users, including licensed
health care prescribers, pharmacists, law enforcement, and regulatory boards, to
obtain from CURES real-time patient history information concerning controlled
substances. (Brown Unveils Real Time Statewide Prescription Drug Monitoring
System (Sept. 15, 2009) [as of July 17, 2017].)
Before the PDMP system, users had to request information from CURES by fax,
mail, or phone, and had to wait a few days to receive the information. (Sen.
Health Com., Analysis of Sen. Bill No. 1071 (2009–2010 Reg. Sess.) as
amended Apr. 28, 2010, p. 4.)
The Board “has been charged with the duty to protect the public against
incompetent, impaired, or negligent physicians.” (Arnett v. Dal Cielo (1996) 14
Cal. 4th 4, 7 (Arnett).) It is responsible for enforcing disciplinary and criminal
provisions of the Medical Practice Act, among other duties. (Bus. & Prof. Code,
§ 2004.) In particular, the Board may “investigat[e] complaints from the public,
from other licensees, from health care facilities, or from the board that a physician
and surgeon may be guilty of unprofessional conduct.” (Bus. & Prof. Code,
§ 2220, subd. (a).) The Board‟s investigators are peace officers. (Pen. Code,
§ 830.3, subd. (a); Bus. & Prof. Code, §§ 159.5, subd. (b)(1), 160, subd. (a).) The
investigators may interview and take statements from witnesses, and they may
issue subpoenas “for the attendance of witnesses and the production of papers,
3
books, accounts, documents . . . and testimony . . . pertinent or material to any
inquiry [or] investigation.” (Gov. Code, § 11181, subd. (e); see also id. § 11182;
Bus. & Prof. Code, § 101, subd. (b); Arnett, at p. 8.) The Board qualifies as one of
the agencies authorized to access the CURES database.
The Board investigates physicians based on complaints or on its own
initiative. (Bus. & Prof. Code, § 2220, subd. (a).) If after an investigation the
Board determines there is sufficient evidence to warrant a formal disciplinary
action against a licensee, it refers the matter to the Attorney General. The action is
then prosecuted by the Senior Assistant Attorney General of the Health Quality
Enforcement Section, and the proceedings are conducted in accordance with the
Administrative Procedure Act. (Arnett, supra, 14 Cal.4th at p. 9; see Gov. Code,
§ 12529.)
II.
In November 2008, the Board initiated an investigation of Dr. Alwin Carl
Lewis as a result of a patient‟s complaint in August 2008 alleging that Lewis
recommended she lose weight by engaging in a “five-bite” diet. A participant in
this diet does not eat breakfast, has five bites of food for lunch, and five bites of
food for dinner.
In the initial stages of the investigation, the Board investigator assigned to
the case obtained a CURES prescriber activity report on Lewis. The report was
205 pages long and contained the prescription information of hundreds of patients.
Before obtaining the CURES report, the Board investigator did not obtain patient
authorization or issue any subpoenas. After reviewing the report, the Board asked
five of Lewis‟s patients for release of their full medical records. Three patients
gave their consent, and the Board obtained the other two patients‟ records via
administrative subpoenas. The investigator also requested and obtained a copy of
4
Lewis‟s prescribing history from CVS Pharmacy, Inc. (CVS) for the prior three
years.
As a result of this preliminary investigation, the Board filed an accusation
against Lewis related to the original patient who complained, as well as the five
additional patients. The charges included unprofessional conduct, prescribing
dangerous drugs without an appropriate examination, excessive prescribing, and
failure to maintain adequate and accurate medical records.
Prior to the administrative hearing, Lewis filed a motion to dismiss the
allegations related to the five additional patients. Lewis argued that by obtaining
the CURES reports without a warrant, subpoena, or good cause, the Board
violated his patients‟ privacy rights. The administrative law judge (ALJ) denied
Lewis‟s motion, stating that the government‟s interest in obtaining the reports in a
highly regulated area outweighed the invasion of privacy.
Following the eight-day administrative hearing, the ALJ concluded that
Lewis engaged in unprofessional conduct, engaged in negligent acts, and failed to
maintain adequate records. The ALJ recommended revoking Lewis‟s license but
staying the revocation and placing Lewis on probation for three years. The Board
adopted the ALJ‟s recommendation.
Lewis next filed a writ of administrative mandamus in the Los Angeles
County Superior Court seeking to set aside the Board‟s decision, arguing that the
Medical Board violated “fundamental privacy protections guaranteed under state
and federal law.” The superior court denied Lewis‟s petition, concluding that
“[t]he public health and safety concern served by the monitoring and regulation of
the prescription of controlled substances serves a compelling public interest that
justifies disclosure of prescription records without notification or consent.”
Lewis then filed a petition for writ of mandate in the Court of Appeal, again
seeking to set aside the Board‟s disciplinary decision because the Board‟s decision
5
violated his patients‟ right to privacy. The court interpreted his challenge to be
one based on the right to privacy under article I, section 1 of the California
Constitution, stating that “Lewis makes clear that he is asserting his patients‟ right
to informational privacy in their controlled substances prescription records.”
Applying the framework set forth in Hill v. National Collegiate Athletic
Association (1994) 7 Cal. 4th 1 (Hill), the Court of Appeal determined that Lewis
did not satisfy the threshold elements required to establish that the Board‟s actions
involved a significant intrusion on a privacy interest protected by the state
Constitution‟s privacy provision. Specifically, the court held that although there is
a legally protected privacy right in medical records, the “well-known and long-
established regulatory history significantly diminishes any reasonable expectation
of privacy against the release of controlled substances prescription records to state,
local, or federal agencies for purposes of criminal, civil, or disciplinary
investigations,” and “the release of CURES data to the Board during an
investigation of a licensee-physician is not a serious invasion of privacy because
sufficient safeguards are in place.”
The Court of Appeal went on to conclude that even if Lewis had satisfied
the threshold elements to establish a right to privacy on behalf of his patients, the
invasion of privacy was justified because it furthered two compelling government
interests: “controlling the diversion and abuse of controlled substances” and
“protect[ing] the public against incompetent, impaired, or negligent physicians.”
“Balancing the state‟s substantial interest in preventing the abuse and diversion of
controlled substances and protecting the public health against the minor intrusion
upon a patient‟s informational privacy in his or her controlled substances
prescription records stored in CURES,” the court concluded that “the Board‟s
actions here in accessing and compiling data from CURES did not violate article I,
section 1 of the California Constitution.” We granted review.
6
III.
Article I, section 1 of the California Constitution guarantees certain
inalienable rights. “Among these are enjoying and defending life and liberty,
acquiring, possessing, and protecting property, and pursuing and obtaining safety,
happiness, and privacy.” (Cal. Const., art. I, § 1.) The electorate added this
protection for “privacy” to the California Constitution by a ballot initiative (the
Privacy Initiative) in 1972. The Privacy Initiative addressed the “accelerating
encroachment on personal freedom and security caused by increased surveillance
and data collection activity in contemporary society.” (White v. Davis (1975) 13
Cal. 3d 757, 774.) The principal “ „mischiefs‟ ” that the Privacy Initiative
addressed were: “(1) „government snooping‟ and the secret gathering of personal
information; (2) the overbroad collection and retention of unnecessary personal
information by government and business interests; (3) the improper use of
information properly obtained for a specific purpose, for example, the use of it for
another purpose or the disclosure of it to some third party; and (4) the lack of a
reasonable check on the accuracy of existing records.” (Id. at p. 775.)
A.
We first address the Board‟s contention that Lewis lacks standing to assert
his patients‟ privacy rights under article I, section 1 of the California Constitution.
Although constitutional rights are “generally personal” (People v. Hazelton
(1996) 14 Cal. 4th 101, 109), the United States Supreme Court has departed from
this rule when the third-party right asserted by the litigant is “inextricably bound
up with the activity the litigant wishes to pursue” and when some “genuine
obstacle” prevents the absent party from asserting his or her own interest.
(Singleton v. Wulff (1976) 428 U.S. 106, 114, 116 (Singleton).) The Courts of
Appeal have often permitted physicians to assert their patients‟ right to privacy
under the California Constitution. (See Medical Bd. of California v. Chiarottino
7
(2014) 225 Cal. App. 4th 623, 630–631, fn. 3 (Chiarottino); Whitney v. Montegut
(2014) 222 Cal. App. 4th 906, 918–921 (Whitney); Wood v. Superior Court (1985)
166 Cal. App. 3d 1138, 1143–1145 (Wood); Board of Medical Quality Assurance v.
Gherardini (1979) 93 Cal. App. 3d 669, 675 (Gherardini).) These cases stand for
the principle that “[w]here the constitutionally protected privacy interests of absent
patients are coincident with the interests of the doctor, the doctor must be
permitted to speak for them.” (Wood, at p. 1145.)
Although the Board recognizes that physicians may assert their patients‟
privacy interests in certain cases, it argues that those cases are limited to contexts
where the physician is the custodian of the records or where his interests align
with his patients‟ interests. The Board argues that because Lewis is not the
custodian of the records in this case and his interests do not align with his
patients‟, he should not be permitted to assert his patients‟ rights.
We do not agree that Lewis‟s interests are at odds with his patients‟
interests. Because an individual‟s prescription records contain intimate details
about his or her medical conditions, the government‟s ability to access these
records may cause patients to hesitate to seek appropriate medical treatment.
(Whalen v. Roe (1977) 429 U.S. 589, 602 (Whalen) [“Unquestionably, some
individuals‟ concern for their own privacy may lead them to avoid or to postpone
needed medical attention.”]; Ferguson v. City of Charleston (2001) 532 U.S. 67,
78, fn. 14 [an intrusion on privacy “may have adverse consequences because it
may deter patients from receiving needed medical care”].) Because a physician
has an interest in patients seeking appropriate treatment and using appropriate
medication, the Board‟s actions are “inextricably bound up with the activity the
litigant wishes to pursue” in this case. (Singleton, supra, 428 U.S. at p. 114.)
Moreover, the patients‟ rights are “likely to be diluted or adversely affected”
unless Lewis is permitted to assert their rights on their behalf. (Griswold v.
8
Connecticut (1965) 381 U.S. 479, 481.) In this case, the patients are unable to
assert their own rights because they were never given notice that their records
were accessed. Without notice, there was no way for them to know of the
potential constitutional violation. “A physician has standing to assert his patient‟s
rights where they may not otherwise be established.” (People v. Barksdale (1972)
8 Cal. 3d 320, 333.)
The Board relies on Pating v. Board of Medical Quality Assurance (1982)
130 Cal. App. 3d 608, where the Court of Appeal held that the petitioner did not
have standing to object to the introduction of third-party medical records in part
because a majority of the patients whose records were subpoenaed appeared at the
administrative hearing and voluntarily consented to the introduction of their
medical records. (Id. at p. 621.) The Board makes a similar argument here,
contending that Lewis should not be permitted to assert his patients‟ privacy rights
because after the access of the CURES records, when five of the patients were
informed that the Board sought their complete medical records, three gave consent
and the other two did not object. We need not decide what effect, if any, the
subsequent consent of the three patients has on Lewis‟s standing because Lewis
would still be entitled to assert the rights of the nonconsenting patients. Finally,
the Board relies on Pating for the suggestion that “having allegedly victimized his
patients, [Lewis] should not be permitted standing to thus assert their privacy
rights for his own protection.” (Ibid.) Even assuming this rule applies in some
contexts, this line of reasoning is inapplicable where, as here, Lewis is not alleged
to have victimized all of the patients whose rights he seeks to assert.
B.
We now turn to the merits of Lewis‟s constitutional claim. In Hill, a case
involving a challenge to the student-athlete drug testing policies of the National
Collegiate Athletic Association (NCAA), we articulated a two-part inquiry for
9
determining whether the right to privacy under article I, section 1 has been
violated. (Hill, supra, 7 Cal.4th at p. 26.)
First, the complaining party must meet three “ „threshold elements‟ . . .
utilized to screen out claims that do not involve a significant intrusion on a privacy
interest protected by the state constitutional privacy provision.” (Loder v. City of
Glendale (1997) 14 Cal. 4th 846, 893 (Loder).) The party must demonstrate “(1) a
legally protected privacy interest; (2) a reasonable expectation of privacy in the
circumstances; and (3) conduct by defendant constituting a serious invasion of
privacy.” (Hill, supra, 7 Cal.4th at pp. 39–40.) This initial inquiry is necessary to
“permit courts to weed out claims that involve so insignificant or de minimis an
intrusion on a constitutionally protected privacy interest as not even to require an
explanation or justification by the defendant.” (Loder, at p. 893.)
Second, if a claimant satisfies the threshold inquiry, “[a] defendant may
prevail in a state constitutional privacy case by negating any of the three elements
just discussed or by pleading and proving, as an affirmative defense, that the
invasion of privacy is justified because it substantively furthers one or more
countervailing interests.” (Hill, supra, 7 Cal.4th at p. 40.) “The plaintiff, in turn,
may rebut a defendant‟s assertion of countervailing interests by showing there are
feasible and effective alternatives to defendant‟s conduct which have a lesser
impact on privacy interests.” (Ibid.)
The standard that a defendant‟s proffered countervailing interests must
satisfy varies based on the privacy interest asserted: “Where the case involves an
obvious invasion of an interest fundamental to personal autonomy, e.g., freedom
from involuntary sterilization or the freedom to pursue consensual familial
relationships, a „compelling interest‟ must be present to overcome the vital privacy
interest. If in contrast, the privacy interest is less central, or in bona fide dispute,
general balancing tests are employed.” (Hill, supra, 7 Cal.4th at p. 34.) “The
10
existence of a sufficient countervailing interest or an alternative course of conduct
present[s] threshold questions of law for the court. The relative strength of
countervailing interests and the feasibility of alternatives present mixed questions
of law and fact. . . . [I]n cases where material facts are undisputed, adjudication as
a matter of law may be appropriate.” (Id. at p. 40.)
1.
Lewis claims that the Board violated article I, section 1 of the California
Constitution by accessing his patients‟ CURES records. We reject this claim
because, even assuming the Board‟s actions constituted a serious intrusion on a
legally protected privacy interest, its review of these records was justified by the
state‟s dual interest in protecting the public from the unlawful use and diversion of
a particularly dangerous class of prescription drugs and protecting patients from
negligent or incompetent physicians.
The Court of Appeal assumed without deciding that if Lewis were able to
satisfy the three threshold elements, the Board would be required to establish a
compelling interest. In Hill, we “decline[d] to hold that every assertion of a
privacy interest under article I, section 1 must be overcome by a „compelling
interest.‟ ” (Hill, supra, 7 Cal.4th at pp. 34–35.) Instead, we limited the
application of the “compelling interest test” to those cases that implicate an
“obvious invasion of an interest fundamental to personal autonomy.” (Id. at p. 34;
see Hernandez v. Hillsides, Inc. (2009) 47 Cal. 4th 272, 288 (Hernandez) [“except
in the rare case in which a „fundamental‟ right of personal autonomy is involved[,]
the defendant need not present a „ “compelling” ‟ countervailing interest”].)
In all but one of our cases applying Hill, we have applied a general
balancing test without requiring the asserted countervailing interest to be
compelling. (See Loder, supra, 14 Cal.4th at p. 898 [applying a general balancing
test to an employer‟s suspicionless drug testing of a job applicant]; Pioneer
11
Electronics (USA), Inc. v. Superior Court (2007) 40 Cal. 4th 360, 373 (Pioneer
Electronics) [applying a general balancing test to plaintiff‟s request to obtain
defendant‟s customer lists]; International Federation of Professional and
Technical Engineers, Local 21, AFL-CIO v. Superior Court (2007) 42 Cal. 4th 319,
339 [the public‟s “strong” interest in public employees‟ salaries outweighed any
privacy invasion]; Hernandez, supra, 47 Cal.4th at p. 287 [because a fundamental
autonomy right was not implicated, the defendant did not need to present a
compelling countervailing interest].) The only case requiring a compelling
interest involved a challenge to a statute requiring a pregnant minor to obtain
parental consent or judicial authorization before having an abortion, an issue that
“unquestionably impinges upon „an interest fundamental to personal autonomy.‟ ”
(American Academy of Pediatrics v. Lungren (1997) 16 Cal. 4th 307, 340.)
The Board‟s actions in this case do not implicate a fundamental autonomy
right. It is true that the disclosure of information from the CURES database may
chill patients‟ willingness to pursue treatment. But it cannot “be said that any
individual has been deprived of the right to decide independently, with the advice
of his physician, to acquire and to use needed medication. Although the State no
doubt could prohibit entirely the use of particular [Schedule II, III, or IV] drugs, it
has not done so. This case is therefore unlike those in which the Court has held
that a total prohibition of certain conduct was an impermissible deprivation of
liberty.” (Whalen, supra, 429 U.S. at p. 603, fn. omitted.) The disclosure of
information from CURES may be one consideration affecting a patient‟s choice to
pursue treatment, but it does not significantly impair the patient‟s ultimate ability
to make that choice on his or her own. Because the Board‟s actions do not intrude
on a fundamental autonomy right, we apply a general balancing test to assess the
Board‟s actions in this case.
12
Under that test, the “[i]nvasion of a privacy interest is not a violation of the
state constitutional right to privacy if the invasion is justified by a competing
interest. Legitimate interests derive from the legally authorized and socially
beneficial activities of government and private entities. Their relative importance
is determined by their proximity to the central functions of a particular public or
private enterprise. Conduct alleged to be an invasion of privacy is to be evaluated
based on the extent to which it furthers legitimate and important competing
interests.” (Hill, supra, 7 Cal.4th at p. 38.)
The Board asserts two countervailing interests to justify any potential
invasion of privacy in this case: (1) protecting the public from unlawful use and
diversion of a particularly dangerous class of prescription drugs; and (2) protecting
patients from negligent or incompetent physicians. There is no question that the
state has a “vital interest in controlling the distribution of dangerous drugs”
(Whalen, supra, 429 U.S. at p. 598), and Lewis does not contest that access to the
CURES database furthers the state‟s interest in protecting patients and preventing
the abuse of prescription medication. Lewis instead argues that the Board should
be required to employ “less intrusive means” of monitoring controlled substance
abuse by limiting searches of the CURES database to those involving good cause,
as established by a warrant, subpoena, or similar legal mechanism.
The Board does not bear the burden of showing it adopted the least
intrusive means of achieving its legitimate objectives. In Hill, we said that “[l]ike
the „compelling interest‟ standard, the argument that such a „least restrictive
alternative‟ burden must invariably be imposed on defendants in privacy cases
derives from decisions that: (1) involve clear invasions of central, autonomy-
based privacy rights, particularly in the areas of free expression and association,
procreation, or government-provided benefits in areas of basic human need; or
(2) are directed against the invasive conduct of government agencies rather than
13
private, voluntary organizations.” (Hill, supra, 7 Cal.4th at p. 49.) Seizing on the
language directed at the “invasive conduct of government agencies” (ibid.), Lewis
argues that any time we consider the impact of the government‟s actions on a
privacy interest, the “least restrictive alternative” must be imposed. This
interpretation ignores the footnote associated with this passage in Hill
summarizing cases where the “least restrictive alternative” burden has been
applied; that footnote says “at the roots of the „least restrictive alternative‟ burden
lie cases of government infringement of fundamental freedoms of expression and
association.” (Id. at p. 49, fn. 16.) This case does not involve a government
infringement of any fundamental freedom of expression and association.
Although the Board does not bear the burden of showing it has adopted the
least intrusive means to monitor the flow of prescription drugs, evidence of less
intrusive alternatives is relevant in balancing the government‟s interests against
the privacy intrusion at issue. (Hill, supra, 7 Cal.4th at p. 40 [“The plaintiff . . .
may rebut a defendant‟s assertion of countervailing interests by showing there are
feasible and effective alternatives to defendant‟s conduct which have a lesser
impact on privacy interests.”].) In Hill, despite finding that the NCAA‟s drug
testing program was reasonably calculated to further its legitimate interests in
maintaining the integrity of athletic competition and the health and safety of
student athletes, we went on to consider the alternative methods proposed by the
plaintiffs. (Id. at p. 50.) Ultimately, we determined that “[b]ecause plaintiffs
failed to demonstrate with substantial evidence the presence of fully viable
alternatives to monitoring, they stopped short of proving their case.” (Id. at p. 51.)
But our analysis demonstrates that a showing of viable less intrusive alternatives
can carry weight in evaluating the reasonableness of a challenged policy and
balancing privacy against any countervailing interests.
14
Lewis asserts that a good cause requirement in this context is a feasible
alternative, citing as examples several cases involving Board access to patients‟
medical records. (See Gherardini, supra, 93 Cal.App.3d at p. 680; Wood, supra,
166 Cal.App.3d at pp. 1148–1150; Bearman v. Superior Court (2004) 117
Cal. App. 4th 463, 468–470.) But medical records contain far more sensitive
information than do prescription records. A patient‟s complete medical file may
include descriptions of symptoms, family history, diagnoses, test results, and other
intimate details concerning treatment. Moreover, a reasonable patient would know
or should know that the government monitors the sale and distribution of
controlled substances, and that prescription records are routinely reviewed by
pharmacists and insurance companies. The same cannot be said of a patient‟s
comprehensive medical record. Patients are also on notice that under the
Information Practices Act, personal information may be shared among government
agencies “in a manner that would link the information disclosed to the individual”
so long as “the transfer is necessary for the transferee agency to perform its
constitutional or statutory duties, and the use is compatible with a purpose for
which the information was collected . . . .” (Civ. Code, § 1798.24, subd. (e).)
Therefore, although patients retain a reasonable expectation of privacy in their
prescription records, that privacy interest is less robust than the privacy interest
associated with medical records, and the cases on which Lewis relies are
inapposite.
The Board argues that real-time access to CURES is essential to closely
monitoring the prescribing and dispensing of controlled substances because it
gives the Board the ability to “spot-check prescribers for compliance with both the
laws and standards of care governing controlled substance prescriptions,
potentially preventing the Board from detecting and addressing problems before
they result in patient harm.” The Board further argues that if it “were required to
15
provide notice to patients and develop good cause as understood by the Courts of
Appeal in the medical records context before obtaining records of controlled
substances prescriptions from the Department, it would delay the Board‟s ability
to identify and correct potentially dangerous practices.” We agree that a good
cause requirement would compromise the Board‟s ability to identify and address
potentially dangerous prescribing practices. Requiring the Board to present
evidence to a judicial officer establishing good cause as part of its preliminary
investigations could result in protracted legal battles that effectively derail those
investigations. Patients who objected to subpoenas to compel disclosure of their
medical records on the ground that the Board lacked good cause have stalled
investigations in the past. (See Chiarottino, supra, 225 Cal. App. 4th 623 [records
requested in February 2012; appeal resolved in April 2014]; Whitney, supra, 222
Cal. App. 4th 906 [records requested in January 2011; appeal resolved in January
2014].) Such delay is tolerated in that context because of the heightened privacy
interests implicated by government searches of medical records. For prescription
records, however, delays of that magnitude would impede the Board‟s ability to
swiftly identify and stop dangerous prescribing practices.
Thus, although Lewis‟s proposed alternative would reduce the impact on
patients‟ privacy interests, it is not an equally effective or feasible alternative to
the Board‟s current approach. It is possible there are ways to limit the privacy
intrusion on patients without hampering the Board‟s ability to investigate unsafe
medical practices. For instance, the Board could take steps to anonymize patients‟
prescription information prior to accessing the CURES database. But the parties
do not propose this alternative or address its feasibility, and we do not consider the
merits of such an approach here. Moreover, our rejection of an individualized
good cause requirement should not be understood to suggest that Board
investigators may access the CURES database for any reason. Such access must
16
be for the purpose of aiding “law enforcement and regulatory agencies in their
efforts to control the diversion and resultant abuse of [Schedule II-IV] controlled
substances” (§ 11165, subd. (a)) and pursuant to the Board‟s duty “to protect the
public against incompetent, impaired, or negligent physicians” (Arnett, supra, 14
Cal.4th at p. 7). The statutes governing the CURES database and the Board‟s
functions limit the reasons for which the Board may access the database.
The Board further argues that its review of the CURES data is not
unconstitutional because there are sufficient protocols in place to prevent public
disclosure. We have previously explained that “[p]rotective measures, safeguards
and other alternatives may minimize the privacy intrusion” and thus should be
considered when balancing a plaintiff‟s privacy interest against a defendant‟s
countervailing interests. (Pioneer Electronics, supra, 40 Cal.4th at p. 371.) “ „For
example, if intrusion is limited and confidential information is carefully shielded
from disclosure except to those who have a legitimate need to know, privacy
concerns are assuaged.‟ ” (Ibid., quoting Hill, supra, 7 Cal.4th at p. 38.)
Here, several provisions of law prohibit the wrongful public disclosure of
personal information obtained from CURES. CURES data may only be provided
to “appropriate state, local, and federal public agencies for disciplinary, civil, or
criminal purposes.” (§ 11165, subd. (c)(2)(A).) The information reported to
CURES is subject to “existing provisions of law to safeguard . . . privacy and
confidentiality” and “shall not be disclosed, sold, or transferred to any third party.”
(Ibid.) During the course of investigations, the Board is required to “keep in
confidence . . . the names of any patients whose records are reviewed and shall not
disclose or reveal those names, except as is necessary during the course of an
investigation, unless and until proceedings are instituted.” (Bus. & Prof. Code,
§ 2225, subd. (a).) Failure to abide by these limitations may trigger criminal and
civil liability: The Information Practices Act provides that “[e]xcept for
17
disclosures which are otherwise required or permitted by law, the intentional
disclosure of medical, psychiatric, or psychological information . . . is punishable
as a misdemeanor if the wrongful disclosure results in economic loss or personal
injury to the individual to whom the information pertains.” (Civ. Code,
§ 1798.57.) Civil Code section 1798.45 further authorizes civil actions for the
same unlawful conduct; in such an action, “the agency shall be liable to the
individual in an amount equal to the sum of . . . [a]ctual damages sustained by the
individual, including damages for mental suffering” and “[t]he costs of the action
together with reasonable attorney‟s fees.” (Civ. Code, § 1798.48.)
We note that adequate protections against public disclosure do not obviate
constitutional concerns as privacy interests are still implicated when the
government accesses personal information without disseminating it. That said, we
ultimately agree with the Board that the safeguards here limit the degree to which
patients‟ privacy is invaded when the Board examines their prescription records.
In view of the considerations above, we find that the balance tips in favor
of the Board‟s interests in protecting the public from unlawful use and diversion of
a particularly dangerous class of prescription drugs and protecting patients from
negligent or incompetent physicians. Because any potential invasion of privacy
caused by the Board‟s actions was justified by countervailing interests, we
conclude that the Board did not violate article I, section 1 of the California
Constitution when it obtained patient prescription records from CURES.
2.
In addition to challenging the Board‟s review of the CURES records, Lewis
asserts that the Board violated his patients‟ rights to privacy when, after searching
the CURES database, it obtained prescription records from CVS without good
cause, a warrant, or notice to his patients. Lewis has forfeited this claim.
18
Lewis‟s challenge at the administrative hearing, as well as his petition for a
writ of administrative mandate before the superior court, focused entirely on the
CURES report, with no mention of the subsequent records obtained from CVS. It
does appear, as Lewis asserts, that there was some confusion as to whether the
prescription records obtained from CVS were from the CURES database or from
CVS. Even after this confusion was clarified, however, Lewis did not assert an
additional objection to the CVS records until his reply brief before the Court of
Appeal. As a result, there are gaps in the record pertaining to these records and
neither the ALJ, the superior court, nor the Court of Appeal addressed this issue.
Finding this claim forfeited, we decline to reach the merits for the first time on
appeal. (Medical Bd. of California v. Superior Court (1991) 227 Cal. App. 3d
1458, 1462.)
IV.
Lewis also asserts that the Board‟s access of the CURES records violates
the Fourth Amendment to the United States Constitution. We agree with the
Board that Lewis has forfeited this claim on behalf of his patients by failing to
raise it at the administrative proceedings or before the superior court. Lewis‟s
fleeting references to “fundamental privacy protections guaranteed under state and
federal law” were insufficient to preserve the issue. His claims before the Board
and the trial court were supported entirely on the basis of the California
Constitution. Lewis‟s argument may be more convincing if he had presented
arguments under article I, section 13 of the California Constitution, the provision
that explicitly protects against unreasonable searches and seizures. However,
given that the thrust of his arguments before the Board and the trial court asserted
a general right to informational privacy, with no mention of search or seizure, at
most he can be said to have asserted a federal right to informational privacy under
the Fourteenth Amendment, a claim that he does not pursue before this court.
19
CONCLUSION
For the reasons above, we affirm the judgment of the Court of Appeal.
LIU, J.
WE CONCUR:
CANTIL-SAKAUYE, C. J.
WERDEGAR, J.
CHIN, J.
CORRIGAN, J.
CUÉLLAR, J.
KRUGER, J.
20
CONCURRING OPINION BY LIU, J.
In concluding that the government interests in protecting patients and the
public justify the Medical Board of California‟s access to the prescription drug
database here, our opinion today assumes without deciding that Dr. Alwin Carl
Lewis has met the threshold elements of an invasion of privacy claim. (Maj. opn.,
ante, at p. 11.) I believe each of those elements is satisfied in this case.
Lewis contends that the Medical Board of California (Board) violated his
patients‟ right to privacy under article I, section 1 of the California Constitution by
examining, without good cause, their prescription records maintained in the
Controlled Substance Utilization Review and Evaluation System (CURES)
database. A party asserting such a claim must demonstrate “(1) a legally protected
privacy interest; (2) a reasonable expectation of privacy in the circumstances; and
(3) conduct by defendant constituting a serious invasion of privacy.” (Hill v. Nat.
Collegiate Athletic Assn. (1994) 7 Cal. 4th 1, 39–40 (Hill).)
The Board concedes that the first element is satisfied here because patients
have a legally recognized privacy interest in their prescription records. The
records stored in CURES contain “sensitive and confidential information” (Hill,
supra, 7 Cal.4th at p. 35) that is protected by the right to privacy under the
California Constitution, and the sensitivity of this information is reflected in the
confidentiality provision of the CURES statute itself. (Health & Saf. Code,
§ 11165, subd. (c)(2); all undesignated statutory references are to this code.)
As to the second element (reasonable expectation of privacy), it is relevant
that “medical records contain far more sensitive information than do prescription
records” and that patients “know or should know that the government monitors the
sale and distribution of controlled substances, and that prescription records are
routinely reviewed by pharmacists and insurance companies.” (Maj. opn., ante, at
p. 15.) But these considerations do not mean that patients have no reasonable
expectation of privacy with regard to their prescription records. Many of the drugs
classified as Schedule II, Schedule III, and Schedule IV controlled substances are
approved only for the treatment of specific and often sensitive medical conditions
or symptoms. For example, testosterone, a Schedule III controlled substance, is
used to treat hypogonadism, a condition in which the male‟s testicles do not
produce enough testosterone. (§ 11056, subd. (f)(30); see Mayo Clinic, Patient
Care & Health Information [as of July 17, 2017]).
Alprazolam, a Schedule IV controlled substance (commonly found in anti-anxiety
drugs such as Xanax), is used to treat anxiety and panic disorders. (§ 11057,
subd. (d)(1); see Prescribers‟ Digital Reference (2017) alprazolam – drug
summary, [as of
July 17, 2017].) Patients retain a reasonable expectation of privacy in prescription
drug records that can reveal their medical conditions. (See Douglas v. Dobbs
(10th Cir. 2005) 419 F.3d 1097, 1102 [“we have no difficulty concluding that
protection of a right to privacy in a person‟s prescription drug records, which
contain intimate facts of a personal nature, is sufficiently similar to other areas
already protected within the ambit of privacy”]; Doe v. Southeastern Pa. Transp.
Auth. (3d Cir. 1995) 72 F.3d 1133, 1138 [“[M]edical science has improved and
specialized its medications. It is now possible from looking at an individual‟s
prescription records to determine that person‟s illnesses . . . .”].)
2
The fact that the government regulates controlled substances does not
eliminate patients‟ reasonable expectation of privacy. A pervasive regulatory
scheme has less significance when the area being regulated is particularly
sensitive. (Cf. Tucson Woman’s Clinic v. Eden (9th Cir. 2004) 379 F.3d 531, 550
[closely regulated industry exception to the warrant requirement does not apply to
abortion clinics, “where the expectation of privacy is heightened”].) Moreover, “it
plainly would defeat the voters‟ fundamental purpose in establishing a
constitutional right of privacy if a defendant could defeat a constitutional claim
simply by maintaining that statutory provisions or past practices that are
inconsistent with the constitutionally protected right eliminate any „reasonable
expectation of privacy‟ with regard to the constitutionally protected right.”
(American Academy of Pediatrics v. Lungren (1997) 16 Cal. 4th 307, 339; see
Delaware v. Prouse (1979) 440 U.S. 648, 662 [“An individual . . . does not lose all
reasonable expectation of privacy simply because [an activity is] subject to
government regulation.”].)
It is also relevant that patients do not choose to participate in the
prescription drug monitoring program. Instead, patients typically take prescription
drugs for nonvoluntary, legitimate medical purposes. (§ 11153 [“A prescription
for a controlled substance shall only be issued for a legitimate medical purpose by
an individual practitioner acting in the usual course of his or her professional
practice.”].) “[T]he presence or absence of opportunities to consent voluntarily to
activities impacting privacy interests obviously affects the expectations of the
participant.” (Hill, supra, 7 Cal.4th at p. 37.) In Hill, we emphasized that the
student athletes were choosing to participate in a voluntary extracurricular activity
and that “[a]s a result of its unique set of demands, athletic participation carries
with it social norms that effectively diminish the athlete‟s reasonable expectation
of personal privacy in his or her bodily condition, both internal and external.” (Id.
3
at p. 42.) Here, by contrast, “[t]he only way to avoid submission of prescription
information . . . is to forgo medical treatment or to leave the state[;] [t]his is not a
meaningful choice.” (Oregon Prescription Drug Monitoring Program v. U.S.
Drug Enforcement Admin. (D.Or. 2014) 998 F. Supp. 2d 957, 967, revd. on other
grounds (9th Cir. 2017) __ F.3d __.) Furthermore, unlike the athletes in Hill, the
patients were not given an opportunity to consent or refuse before their
information was shared with the Board. Given the mandatory nature of CURES
data collection, it is difficult to conclude that the monitoring scheme entirely
negates patients‟ expectation of privacy.
Finally, Lewis has demonstrated “a serious invasion of privacy.” (Hill,
supra, 7 Cal.4th at p. 40.) “ „[T]his element is intended simply to screen out
intrusions on privacy that are de minimis or insignificant.‟ ” (American Academy
of Pediatrics v. Lungren, supra, 16 Cal.4th at p. 339.) The Board argues that any
intrusion on patients‟ privacy is insignificant because there are sufficient protocols
to prevent public disclosure. Although such protective measures may limit the
extent of privacy invasion, they do not render an intrusion de minimis for purposes
of this threshold inquiry. (See maj. opn., ante, at p. 18 [“privacy interests are still
implicated when the government accesses personal information without
disseminating it”]; Hill, at p. 27, fn. 7 [“Particularly when professional or fiduciary
relationships premised on confidentiality are at issue (such as doctor and patient or
psychotherapist and client), the state constitutional right to privacy may be
invaded by a less-than-public dissemination of information.”].)
The electorate was concerned about more than public disclosure when it
passed the Privacy Initiative in 1972. The voters were concerned that their privacy
was violated whenever their personal information was used or accessed without
reason. (See White v. Davis (1975) 13 Cal. 3d 757, 775 [the initiative was intended
to curtail “the improper use of information properly obtained for a specific
4
purpose, for example, the use of it for another purpose or the disclosure of it to
some third party”]; Ballot Pamp., Proposed Stats. and Amends. to Cal. Const. with
arguments to voters, Gen. Elec. (Nov. 7, 1972) p. 27 [“Fundamental to our privacy
is the ability to control circulation of personal information. . . . The proliferation
of government and business records over which we have no control limits our
ability to control our personal lives. Often we do not know that these records even
exist and we are certainly unable to determine who has access to them.”].) This
concern is even more pressing today because advances in data science have
enabled sophisticated analyses of curated information as to a particular person.
Where, as here, one government agency discloses patients‟ sensitive medical
information to another, the privacy intrusion cannot be dismissed as trivial.
In sum, the disclosure of CURES data to the Board is not a de minimis
intrusion on patients‟ reasonable and legally protected privacy interests. But, as
today‟s opinion explains, the government interests behind the prescription drug
monitoring program are sufficiently weighty to justify the privacy invasion here.
LIU, J.
I CONCUR:
KRUGER, J.
5
See next page for addresses and telephone numbers for counsel who argued in Supreme Court.
Name of Opinion Lewis v. Superior Court
__________________________________________________________________________________
Unpublished Opinion
Original Appeal
Original Proceeding
Review Granted XXX 226 Cal. App. 4th 933
Rehearing Granted
__________________________________________________________________________________
Opinion No. S219811
Date Filed: July 17, 2017
__________________________________________________________________________________
Court: Superior
County: Los Angeles
Judge: Joanne B. O‟Donnell
__________________________________________________________________________________
Counsel:
Fenton Nelson, Fenton Law Group, Henry R. Fenton, Dennis E. Lee and Benjamin J. Fenton for Petitioner.
Peter Bibring, Jessica G. Price; Caldwell Leslie & Proctor, Benjamin B. Au and Julia J. Bredrup for The
American Civil Liberties Union of Sothern California, ACLU of Northern California and ACLU of San
Diego and Imperial Counties as Amici Curiae on behalf of Petitioner.
Lee Tien and Jamie L. Williams for Electronic Frontier Foundation as Amicus Curiae on behalf of
Petitioner.
Francisco J. Silva, Long X. Do and Lisa Matsubara for California Medical Association, American Medical
Association, California Psychiatric Association, California Dental Association and American Dental
Association as Amici Curiae on behalf of Petitioner.
No appearance for Respondent.
Kamala D. Harris and Xavier Becerra, Attorneys General, Edward C. DuMont, State Solicitor General,
Kathleen A. Kenealy, Chief Assistant Attorney General, Gloria L. Castro, Assistant Attorney General,
Janill L. Richards, Principal Deputy State Solicitor General, Aimee Feinberg, Deputy State Solicitor
General, Kathleen Vermazen Radez and Samuel P. Siegel, Associate Deputy State Solicitor General, E.A.
Jones III and Edward K. Kim, Deputy Attorneys General, for Real Party in Interest.
Robert C. Fellmeth, Julianne D‟Angelo Fellmeth and Bridget Fogarty Gramme for Center for Public
Interest Law as Amicus Curiae on behalf of Real Party in Interest.
Counsel who argued in Supreme Court (not intended for publication with opinion):
Henry R. Fenton
Fenton Law Group
1990 South Bundy Drive, Suite 777
Los Angeles, CA 90025
(310) 444-5244
Aimee Feinberg
Deputy State Solicitor General
1300 I Street
Sacramento, CA 95814
(916) 324-7562