Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 1. Chapter Definitions 11 CCR § 820
§ 820. Definitions.
(a) "Abuse" means any use of an Applicable Controlled Substance that is not authorized in its manner of use, purpose, quantity, or user.
(b) "Aggregated Data" means data that does not include PII and is presented in summary counts, mitigating privacy risks and attempts at re-identification.
(c) "Annual Renewal" means the annual process by which a User updates all applicable information contained within that User's CURES profile.
(d) "Applicable Controlled Substance" means a drug, substance, or immediate precursor that is listed in Health and Safety Code section 11055, 11056, or 11057. This definition also includes, as of January 1, 2021, a drug, substance, or immediate precursor that is listed in Health and Safety Code section 11058.
(e) "Applicant Type" means the type of account for which an applicant is applying for access to CURES, including only the following types: Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist.
(f) "Bona Fide Research" means research that is characterized by all of the following qualities:
(1) The identification, evaluation, or resolution of a problem in a research field.
(2) The intention to contribute to the knowledge of a research field.
(3) The utilization of scientific methods and research methodologies.
(4) The reasonable expectation that the final research product may support publication in a peer-reviewed journal, program evaluation and quality improvement, public health surveillance, or policy development.
(g) "Bona Fide Researcher" means a principal investigator, or a public health officer, who conducts Bona Fide Research and meets all of the following requirements:
(1) Has possession of a Master of Science degree, Master of Arts degree, other master's degree, or higher level degree in a field that conducts research. These fields include, but are not limited to, physical sciences, life sciences, social sciences, and medical sciences.
(2) Is research-affiliated with a research entity including, but not limited to, accredited universities, recognized research organizations, or public departments and agencies.
(3) Has relevant research experience at an accredited university or college, research entity, or public agency.
(h) "Category of Licensure" means the title of the license issued to an individual by that individual's Licensing Board or Licensing Agency.
(i) "Compliant Password" means a password that meets the password security standards as set forth by the application.
(j) "Connectivity Fee" means the mandatory, one-time fee paid by an entity operating a HIT System which covers the cost of connecting that HIT System to the Information Exchange Web Service. The Connectivity Fee amount is $1,500.
(k) "Controlled Substance" has the meaning set forth in Health and Safety Code section 11007, unless otherwise specified.
(l) "CURES" means the Controlled Substance Utilization Review and Evaluation System.
(m) "CURES PDMP" means the Department's program that administers CURES.
(n) "DEA" means the United States Drug Enforcement Administration.
(o) "DEA Number" means the DEA Registration Certificate number issued to an individual by the DEA.
(p) "DEA Registration Certificate" means the DEA certificate of registration issued to an individual granting that individual federal authority to handle Controlled Substances.
(q) "De-Identified Individual-Level Data" means individually disaggregated data that does not include any PII.
(r) "Delegate" means an individual to whom a Prescriber-User or Pharmacist-User has delegated authority to order Patient Activity Reports from CURES under Business and Professions Code section 209, subdivision (b).
(s) "Department" means the Department of Justice of the State of California.
(t) "Department Investigative Team" means two or more Law Enforcement Agencies, one of which is the Department, requesting access to CURES, or data from CURES, through the Department, to assist that Department Investigative Team's efforts to control the Diversion and Resultant Abuse of Applicable Controlled Substances.
(u) "Diversion" means any redirection of an Applicable Controlled Substance from a use that is authorized in its manner of use, purpose, quantity, and user, toward any use that is not authorized in its manner of use, purpose, quantity, or user.
(v) "Diversion and Resultant Abuse" means any redirection of an Applicable Controlled Substance from a use that is authorized in its manner of use, purpose, quantity, and user, toward any use that is not authorized in its manner of use, purpose, quantity, or user, and any use of an Applicable Controlled Substance that is not authorized in its manner of use, purpose, quantity, or user, that results, either directly or indirectly, from that redirection.
(w) "Health Care Practitioner" means a licensee authorized under Health and Safety Code section 11150 to prescribe, order, administer, furnish, or dispense Controlled Substances, excluding non-prescribing Pharmacists and non-prescribing Out-of-State Pharmacists.
(x) "Health Information Technology System" or "HIT System" has the meaning set forth in Health and Safety Code section 11165.1, subdivision (g)(4).
(y) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996 (Pub. L. No. 104-191, 110 Stat. 1936 (1996)).
(z) "HIPAA Regulations" means the regulations promulgated under HIPAA by the United States Department of Health and Human Services, including, but not limited to, 45 Code of Federal Regulations parts 160 and 164, as are currently in effect or as later amended.
(aa) "Identified Individual-Level Data" means individually disaggregated data that includes the PII of any patient to which that data relates.
(bb) "Information Exchange Web Service" means the method of system integration developed by the Department by which approved Prescriber-Users and Pharmacist-Users may use a qualified HIT System to request data from CURES.
(cc) "Institutional DEA Number" means a unique number issued by the DEA to a licensed, eligible institution that handles Controlled Substances.
(dd) "Interested Party" means a public or private entity, Bona Fide Researcher, or Team Member.
(ee) "Interstate Pharmacist," means an Out-of-State Pharmacist who is authorized to:
(1) Access the PDMP of a state other than California, and is in good standing with that PDMP.
(2) Request data from CURES from that Interstate Pharmacist's PDMP.
(ff) "Interstate Prescriber," means an Out-of-State Prescriber who is authorized to:
(1) Access the PDMP of a state other than California, and is in good standing with that PDMP.
(2) Request data from CURES from that Interstate Prescriber's PDMP.
(gg) "Law Enforcement Agency" means any agency of the United States, the State of California, or a public entity as defined in Government Code section 811.2, authorized to perform any of the following activities:
(1) Investigate or conduct an official inquiry into a potential violation of law, including an investigation or official inquiry into the manner, circumstances, or cause of death of a person, if the manner, circumstances, or cause of death might have involved a violation of law.
(2) Prosecute or otherwise conduct a criminal or civil proceeding arising from an alleged violation of law.
(3) Supervise criminal offenders post-sentencing.
(hh) "Law Enforcement Official" means a Law Enforcement Agency officer or employee who is designated by that Law Enforcement Agency to access CURES, or request data from CURES, on behalf of that Law Enforcement Agency.
(ii) "Law Enforcement-User" means a Law Enforcement Official who is registered for access to CURES.
(jj) "Licensing Agency" means the California Department of Consumer Affairs or a licensing agency outside of California.
(kk) "Licensing Board" means each of the boards and committees established within the California Department of Consumer Affairs and identified in Business and Professions Code section 208, subdivision (d).
(ll) "List of Patients" means a List of Patients generated by CURES for whom a Prescriber-User or Pharmacist-User is identified as the prescriber in CURES. A List of Patients includes the Prescriber DEA Number, Prescriber name, Prescriber address, and the patient last name, patient first name, patient date of birth, patient gender, and patient address, as reported to CURES PDMP.
(mm) "Out-of-State Licensing Board" means a board or committee established by a Licensing Agency other than the California Department of Consumer Affairs.
(nn) "Out-of-State Pharmacist" means any pharmacist licensed by a Licensing Agency in a state or states of the United States other than California, a territory or territories of the United States, or the Commonwealth of Puerto Rico, but not by a Licensing Board, and authorized under the laws of the Licensing Agency's jurisdiction to dispense Controlled Substances.
(oo) "Out-of-State Prescriber" means any prescriber licensed by a Licensing Agency in a state or states of the United States other than California, a territory or territories of the United States, or the Commonwealth of Puerto Rico, but not by a Licensing Board, and authorized under the laws of the Licensing Agency's jurisdiction to prescribe Controlled Substances.
(pp) "Patient Activity Report" means a report generated by CURES of the Controlled Substances history of a patient. The Patient Activity Report includes the patient last name, patient first name, patient middle initial, patient date of birth, patient gender, patient address, compact status, number of prescriptions, date filled, date sold, drug name, drug form, drug strength, quantity, days supply, species code, prescription number, refill number, number of authorized refills, payment method, prescriber name, prescriber DEA Number, pharmacy name, pharmacy number, and prescription form serial number.
(qq) "Patient Entity" means a unique patient profile created from dispensation records reported to CURES PDMP for each distinct combination of patient first name, patient last name, patient date of birth, and patient address, and with which any subsequently reported dispensations that match the same combination of patient information are linked. A single patient may be associated with multiple Patient Entities due to variations in reported patient first name, patient last name, patient date of birth, and patient address.
(rr) "Patient Picklist" means a list of Patient Entities returned to a User when that User submits the search criteria to initiate a Patient Activity Report.
(ss) "PDMP" means prescription drug monitoring program.
(tt) "Peer Review" means subjecting a researcher's scholarly work, research, or ideas to the scrutiny of other researchers in the same field of research for either of the following purposes:
(1) To ensure that the scholarly work meets the accepted standards of the researcher's discipline.
(2) To prevent the dissemination of research that is compromised by unwarranted claims, unacceptable interpretations, or personal views.
(uu) "Personal Identifying Information" or "PII" has the meaning set forth in Penal Code section 530.55, subdivision (b).
(vv) "Pharmacist" has the meaning set forth in Health and Safety Code section 11024.
(ww) "Pharmacy History Report" means a report generated by CURES of the Controlled Substances dispensation history of a pharmacy, as reported to CURES PDMP. The Pharmacy History Report includes the pharmacy name, pharmacy license number, date filled, date sold, patient last name, patient first name, patient date of birth, patient gender, drug name, drug form, drug strength, quantity, days supply, prescription number, refill number, prescriber name, and prescriber DEA Number.
(xx) "Pharmacist-User" means any Pharmacist or Out-of-State Pharmacist who is registered to access CURES.
(yy) "Prescriber" means any Health Care Practitioner licensed in California.
(zz) "Prescriber History Report" means a report generated by CURES of the Controlled Substances prescribing history of a prescriber, as reported to CURES PDMP. The Prescriber History Report includes the prescriber name, prescriber DEA Number, date filled, date sold, patient last name, patient first name, patient date of birth, patient gender, patient address, drug name, drug form, drug strength, quantity, days supply, pharmacy name, pharmacy number, prescription number, and refill number.
(aaa) "Prescriber-User" means any Prescriber or Out-of-State Prescriber who is registered to access CURES.
(bbb) "Prescription Theft or Loss Report" means the Web-form a Prescriber or Pharmacist is required to submit to the Department under Health and Safety Code section 11165.3.
(ccc) "Regulatory Agency" means the Department of Consumer Affairs, and the boards and committees identified in Business and Professions Code section 208, subdivision (d).
(ddd) "Regulatory Agency Official" means a Regulatory Agency officer or employee who is designated by that Regulatory Agency to access CURES, or request data from CURES, on behalf of that Regulatory Agency.
(eee) "Regulatory Agency-User" means a Regulatory Agency Official who is registered for access to CURES.
(fff) "Research Purposes" means analysis on data to conduct a systematic investigation, including research development, testing, or evaluation, which is designed to develop or contribute to generalizable knowledge or education.
(ggg) "Search Period" means the requested date range for which CURES is to be searched in relation to a Patient Activity Report, Prescriber History Report, Pharmacy History Report, or other report generated by CURES.
(hhh) "Security Question Answer" means an answer used to verify the identity of a User when the User resets the User's Compliant Password.
(iii) "State" means the State of California.
(jjj) "State License Number" means a licensee's professional license number assigned to that licensee by the applicable Licensing Agency.
(kkk) "Team Member" means any individual authorized by the Department's Research Center, upon approval of a Data Request Application, to access or analyze data obtained by a Bona Fide Researcher from CURES.
(lll) "Terms and Conditions of CURES" means all restrictions imposed by this chapter on the access and use of CURES, or data from CURES, with which a User must comply. Any violation of these Terms and Conditions of CURES, or any applicable State or federal law or regulation, may result in prosecution.
(mmm) "Ultimate User" has the meaning set forth in Health and Safety Code section 11030.
(nnn) "Under the Practitioner's Care," and "Under the Pharmacist's Care," as used in Health and Safety Code section 11165.1, mean Under the Care of.
(ooo) "Under the Care of" when used in this chapter to determine if a patient is Under the Care of a Prescriber-User, Pharmacist-User, Interstate Prescriber, or Interstate Pharmacist, means:
(1) With respect to a Prescriber-User or Interstate Prescriber, when any of the following conditions exist:
(A) The patient has had a professional medical consultation with the Prescriber-User or Interstate Prescriber and has an ongoing provider-patient relationship with that Prescriber-User or Interstate Prescriber.
(B) The patient has an appointment for a professional medical consultation with the Prescriber-User or Interstate Prescriber.
(C) The patient has not had a professional medical consultation with the Prescriber-User or Interstate Prescriber, but the Prescriber-User or Interstate Prescriber is part of the patient's "organized health care arrangement," as defined by 45 Code of Federal Regulations part 160.103 (10-1-19 Edition), incorporated by reference in this chapter, and the patient has a provider-patient relationship with that Prescriber-User or Interstate Prescriber.
(D) The patient presents to an emergency department for treatment and the Prescriber-User or Interstate Prescriber is involved in or oversees the intake or professional medical consultation of that patient within the emergency department.
(2) With respect to a Pharmacist-User or Interstate Pharmacist, when both of the following conditions exist:
(A) The patient, or an individual purporting to be a patient, has presented a prescription for a Controlled Substance, or a prescriber has ordered, or appears to have ordered, a prescription on behalf of that patient, to a pharmacy where the Pharmacist-User or Interstate Pharmacist is authorized to dispense Controlled Substances.
(B) The Pharmacist-User or Interstate Pharmacist is involved in or oversees the ordering, compounding, filling, dispensing, furnishing, or delivery of the Controlled Substance to that patient, or individual purporting to be a patient.
(ppp) "User" means any type of CURES registrant, including "Prescriber-User," "Pharmacist-User," "Delegate," "Regulatory Agency-User," and "Law Enforcement-User."
(qqq) "User Search" means a report generated by CURES that a Regulatory Agency-User may initiate to request the account information of a Prescriber-User or Pharmacist-User in CURES. The User Search includes the following information regarding the Prescriber-User or Pharmacist-User searched: User ID, Prescriber-User or Pharmacist-User first name, Prescriber-User or Pharmacist-User last name, State License Number, Licensing Board, Category of Licensure, and DEA Number.
(rrr) "Web-Based Application" means a Department-administered Web site or Web application that is made available for the purposes of accessing data in CURES or maintaining an account to access CURES. Web-Based Application does not include the Information Exchange Web Service or a HIT System.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11030, 11165, 11165.1, 11165.3, 11165.4 and 11165.6, Health and Safety Code; and Sections 208 and 209, Business and Professions Code.
HISTORY
1. New chapter 8.5 (articles 1-2, sections 820-828), article 1 (section 820) and section filed 5-14-2020; operative 7-1-2020 (Register 2020, No. 20).
2. Change without regulatory effect amending chapter heading and redesignating subsections (tt)(A)-(B) as subsections (tt)(1)-(2) filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2. Access and Use [Renumbered] 11 CCR § 821
§ 821. Prescribers and Out-of-State Prescribers. [Renumbered]
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11030, 11165, 11165.1, 11165.3, 11165.4, 11165.6 and 11190, Health and Safety Code; and Section 209, Business and Professions Code.
HISTORY
1. New article 2 (sections 821-828) and section filed 5-14-2020; operative 7-1-2020 (Register 2020, No. 20).
2. Change without regulatory effect renumbering article 2 (sections 821-828) to new articles 2.1-5 (sections 821.1-828.3) and renumbering former section 821 to new sections 821.1-821.7 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.1. Access and Use by Prescribers and Out-of-State Prescribers 11 CCR § 821.1
§ 821.1. Eligibility for Acess to CURES.
(a) A Prescriber who possesses a valid DEA Registration Certificate for a practice location in California must register for access to CURES.
(b) A Prescriber who possesses a valid DEA Registration Certificate for a practice location only in a state or states other than California may register for access to CURES if the Prescriber's Licensing Board expressly permits or requires that the Prescriber register for access to CURES.
(c) An Out-of-State Prescriber who possesses a valid DEA Registration Certificate for a practice location only in a state or states other than California may register for access to CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11030, 11165, 11165.1, 11165.3, 11165.4, 11165.6 and 11190, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former article 2 heading to new article 2.1 (sections 821.1-821.7) and renumbering former section 821, subsections (a)-(a)(3) to new section 821.1, including amendment of section heading and section, filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.1. Access and Use by Prescribers and Out-of-State Prescribers 11 CCR § 821.2
§ 821.2. Procedures to Register for Access to CURES.
(a) "Prescriber Registration Application," when used in this section, means the Web-form application developed by the Department, under Health and Safety Code section 11165.1, subdivision (a)(1)(A)(i), for a Prescriber or Out-of-State Prescriber to obtain approval to electronically access patient information from CURES.
(b) An applicant must electronically submit the Prescriber Registration Application, located on the CURES Web page of the Department's Web site.
(c) If the applicant is a Prescriber, to complete the application, the applicant must:
(1) Provide all of the following applicant information on the Prescriber Registration Application:
(A) Applicant Type.
(B) Name of Licensing Agency.
(C) Email address.
(D) First name.
(E) Last name.
1. The last name must match the information on the applicant's DEA Registration Certificate.
(F) Date of birth.
1. The date of birth must match the information on record with the applicant's Licensing Board.
(G) Phone number.
(H) Phone type.
(I) Social security number or individual taxpayer identification number.
1. The social security number or individual taxpayer identification number must match the information on record with the applicant's Licensing Board.
(J) Licensing Board.
(K) Category of Licensure.
1. The Category of Licensure must match the information on record with the applicant's Licensing Board.
(L) State License Number.
1. The State License Number must match the information on record with the applicant's Licensing Board.
(M) DEA Number.
1. The DEA Number must match the information on the applicant's DEA Registration Certificate.
2. If the applicant submits an Institutional DEA Number, the applicant must indicate that the DEA Number is an Institutional DEA Number.
(2) Select security questions and provide Security Question Answers.
(3) Agree to the Terms and Conditions of CURES.
(d) If the applicant is an Out-of-State Prescriber, to complete the application the applicant must:
(1) Provide all of the following applicant information on the Prescriber Registration Application:
(A) Applicant Type.
(B) Name of Licensing Agency.
(C) Email address.
(D) First name.
(E) Last name.
1. The last name must match the information on the applicant's DEA Registration Certificate.
(F) Date of birth.
(G) Phone number.
(H) Phone type.
(I) Licensing state.
(J) Out-of-State Licensing Board.
(K) Category of Licensure.
(L) State License Number.
(M) DEA Number.
1. The DEA Number must match the information on the applicant's DEA Registration Certificate.
2. If the applicant submits an Institutional DEA Number, the applicant must indicate that the DEA number is an Institutional DEA Number.
(2) Submit supporting documentation, which must include a photocopy of all of the following:
(A) The applicant's government-issued identification card or passport.
(B) The applicant's DEA Registration Certificate.
(C) The applicant's professional license issued by a Licensing Agency other than a Licensing Board.
(3) Submit a notarized acknowledgement verifying both of the following:
(A) The applicant has presented to a valid notary public all of the following supporting documentation:
1. The applicant's government-issued identification card or passport.
2. The applicant's DEA Registration Certificate.
3. The applicant's professional license issued by a Licensing Agency other than a Licensing Board.
(B) The applicant is the individual identified in the supporting documentation presented to the valid notary public.
(4) Select security questions and provide Security Question Answers.
(5) Agree to the Terms and Conditions of CURES.
(e) When an approved applicant accesses CURES for the first time, the approved applicant must:
(1) Answer the prompted security questions on the Web-Based Application.
(2) Provide a Compliant Password.
(3) Provide the approved applicant's street address and postal code.
(A) The street address must reflect the approved applicant's work address.
(B) The street address must not be a P.O. Box.
(4) If the approved applicant is licensed by the Medical Board of California or the Dental Board of California, the approved applicant must provide the approved applicant's specialty and specify whether the approved applicant is board-certified.
(5) Agree to the Terms and Conditions of CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11030, 11165, 11165.1, 11165.3, 11165.4, 11165.6 and 11190, Health and Safety Code; and Section 209, Business and Professions Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 821, subsections (b)-(b)(5)(E) to new section 821.2 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.1. Access and Use by Prescribers and Out-of-State Prescribers 11 CCR § 821.3
§ 821.3. Data Accessible to Prescriber-Users in CURES.
(a) Subject to the restrictions of section 821.4, a Prescriber-User may access patient information in CURES through both of the following:
(1) A Patient Activity Report.
(2) A List of Patients.
(b) A Prescriber-User may access patient information for a Search Period not to exceed 24 months from the date of the search.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11030, 11165, 11165.1, 11165.3, 11165.4, 11165.6 and 11190, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 821, subsections (c)-(c)(2) to new section 821.3 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.1. Access and Use by Prescribers and Out-of-State Prescribers 11 CCR § 821.4
§ 821.4. Restrictions on Accessing Patient Information in CURES.
(a) A Prescriber-User must only access patient information to:
(1) Treat a patient Under the Care of the Prescriber-User.
(A) If the patient is Under the Care of the Prescriber-User within the meaning of section 820, subdivision (ooo)(1)(B), but the patient does not have an ongoing provider-patient relationship with the Prescriber-User, the Prescriber-User must not access the patient's information in CURES earlier than 7 days before the appointment for a professional medical consultation with the Prescriber-User.
(2) Comply with the duty to consult CURES under Health and Safety Code section 11165.4.
(3) Obtain a List of Patients for whom the Prescriber-User is listed as the Prescriber or Out-of-State Prescriber.
(b) A Prescriber-User who is a veterinarian must only access patient information of the veterinarian's animal-patient. A Prescriber-User who is a veterinarian must not access patient information from CURES regarding the animal-patient's Ultimate User.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11030, 11165, 11165.1, 11165.3, 11165.4, 11165.6 and 11190, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 821, subsections (d)-(d)(2) to new section 821.4 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.1. Access and Use by Prescribers and Out-of-State Prescribers 11 CCR § 821.5
§ 821.5. Restrictions on Use or Disclosure of Patient Information Obtained from CURES.
(a) A Prescriber-User must not use, disclose, or transfer patient information obtained from CURES unless the use, disclosure, or transfer is consistent with all of the following:
(1) The use, disclosure, or transfer is for the same authorized purpose for which the patient information was originally requested.
(2) The use, disclosure, or transfer complies with all applicable federal and State privacy, confidentiality, and security laws and regulations, including, but not limited to:
(A) The Confidentiality of Medical Information Act (Part 2.6 (commencing with section 56) of Division 1 of the Civil Code).
(B) The HIPAA Regulations.
(C) Health and Safety Code section 11165, subdivision (c).
(b) A Prescriber-User must not sell any patient information obtained from CURES.
(c) Notwithstanding subdivision (a)(1), a Prescriber may disclose or transfer patient information obtained from CURES to the Prescriber's Licensing Board to document compliance with the law if the disclosure or transfer complies with subdivision (a)(2), and the patient information was obtained in accordance with the restrictions of section 821.4.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11030, 11165, 11165.1, 11165.3, 11165.4, 11165.6 and 11190, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 821, subsections (e)-(e)(3) to new section 821.5 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.1. Access and Use by Prescribers and Out-of-State Prescribers 11 CCR § 821.6
§ 821.6. Procedures for Use of CURES.
(a) Patient information is available in both of the following environments:
(1) The Web-Based Application.
(2) The Information Exchange Web Service.
(b) A Compliant Password may be changed in the Web-Based Application. A Prescriber-User must create a Compliant Password every 90 days.
(c) Procedure to Complete an Annual Renewal.
(1) An Annual Renewal may be completed in the Web-Based Application.
(2) A Prescriber-User must complete the Annual Renewal every 365 days.
(3) A Prescriber-User must update the following information on the Annual Renewal, if applicable:
(A) DEA Number.
(B) Phone number.
(C) Phone type.
(D) Street address.
1. The street address must reflect the Prescriber-User's work address.
2. The street address must not be a P.O. Box.
(E) Postal code.
(F) Email address.
(4) To submit the Annual Renewal, a Prescriber-User must agree to the Terms and Conditions of CURES.
(d) Procedure to Request a Patient Activity Report.
(1) A Patient Activity Report is available in the Web-Based Application or the Information Exchange Web Service.
(2) To request a Patient Activity Report in the Web-Based Application, a Prescriber-User must:
(A) Provide search criteria that includes, at a minimum, all of the following:
1. Patient first name or patient last name.
2. Patient date of birth.
3. Search Period.
(B) Agree to the Terms and Conditions of CURES.
(C) Select the applicable Patient Entity or Patient Entities from the Patient Picklist.
(3) Subject to the requirements of section 828.3 of this chapter, to request a Patient Activity Report in the Information Exchange Web Service, a Prescriber-User, or an authorized HIT System on behalf of a Prescriber-User, must:
(A) Provide search criteria that includes, at a minimum, all of the following:
1. Patient first name or patient last name.
2. Patient date of birth.
3. Search Period.
(B) Agree to the Terms and Conditions of CURES.
(e) Procedure to Request a List of Patients.
(1) A List of Patients is available in the Web-Based Application.
(2) To request a List of Patients, a Prescriber-User must:
(A) Select the Prescriber-User's DEA Number or DEA Numbers.
(B) Provide the Search Period.
(C) Agree to the Terms and Conditions of CURES.
(f) Procedure to Submit a Prescription Theft or Loss Report.
(1) A Prescription Theft or Loss Report is available in the Web-Based Application.
(2) Each Prescriber-User whose name is printed on a prescription form that is lost or stolen must submit a separate Prescription Theft or Loss Report.
(3) To submit a Prescription Theft or Loss Report, a Prescriber-User must:
(A) Provide all of the following information:
1. First name of the reporting Prescriber-User.
2. Last name of the reporting Prescriber-User.
3. Address of the reporting Prescriber-User.
4. Postal code of the reporting Prescriber-User.
5. Phone number of the reporting Prescriber-User.
6. DEA Number of the reporting Prescriber-User.
7. Date of theft or loss.
8. Principal business.
9. Type of theft or loss.
10. Name of county in which theft or loss occurred.
(B) Indicate whether the theft or loss was reported to a law enforcement agency in the applicable jurisdiction.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11030, 11165, 11165.1, 11165.3, 11165.4, 11165.6 and 11190, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 821, subsections (f)-(f)(6)(C)(ii) to new section 821.6 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.1. Access and Use by Prescribers and Out-of-State Prescribers 11 CCR § 821.7
§ 821.7. Delegate Use of CURES.
(a) Restrictions on Delegate Use of CURES.
(1) A Prescriber-User is responsible for the access and use of CURES of each of that Prescriber-User's Delegates.
(2) If a Delegate initiates a request to CURES on behalf of a Prescriber-User the request must conform to that Prescriber-User's restrictions on accessing patient information under section 821.4.
(b) Procedures to Register for Access to CURES.
(1) "Delegate Registration Application," when used in this section, means the electronic application developed by the Department for a Prescriber-User to designate an individual as a Delegate.
(2) A Prescriber-User must electronically submit the Delegate Registration Application on the Web-Based Application.
(3) A Prescriber-User must provide all of the following information on the Delegate Registration Application:
(A) Delegate first name.
(B Delegate last name.
(C) Delegate email address.
(4) To submit the Delegate Registration Application, a Prescriber-User must agree to the Terms and Conditions of CURES.
(5) When a Delegate accesses CURES for the first time, the Delegate must:
(A) Provide a Compliant Password.
(B) Provide security questions and Security Question Answers.
(C) Agree to the Terms and Conditions of CURES.
(c) Procedures for Use of CURES.
(1) A Delegate may access the Web-Based Application.
(2) A Delegate must create a Compliant Password every 90 days.
(3) Procedure to Complete an Annual Renewal.
(A) A Delegate must complete the Annual Renewal every 365 days.
(B) A Delegate must update the Delegate's email address on the Annual Renewal, if applicable.
(C) To submit the Annual Renewal, a Delegate must agree to the Terms and Conditions of CURES.
(4) Procedure to Initiate a Patient Activity Report.
(A) To initiate a Patient Activity Report, a Delegate must:
1. Provide search criteria that includes, at a minimum, all of the following:
a. Patient first name and patient last name.
b. Patient date of birth.
c. Search Period.
2. Select the Prescriber-User on whose behalf the Delegate is initiating the Patient Activity Report.
3. Agree to the Terms and Conditions of CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11030, 11165, 11165.1, 11165.3, 11165.4, 11165.6 and 11190, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 821, subsections (g)-(g)(3)(D)(i)c. to new section 821.7 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.1. Access and Use by Prescribers and Out-of-State Prescribers 11 CCR § 822
§ 822. Pharmacists and Out-of-State Pharmacists. [Renumbered]
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165, 11165.1 and 11165.3, Health and Safety Code; and Section 209, Business and Professions Code.
HISTORY
1. New section filed 5-14-2020; operative 7-1-2020 (Register 2020, No. 20).
2. Change without regulatory effect renumbering former section 822 to new sections 822.1-822.7 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.2. Access and Use by Pharmacists and Out-of-State Pharmacists 11 CCR § 822.1
§ 822.1. Eligibility for Access to CURES.
(a) A Pharmacist who possesses a valid California license must register for access to CURES.
(b) An Out-of-State Pharmacist who possesses a valid pharmacist license only in a state or states other than California may register for access to CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165, 11165.1 and 11165.3, Health and Safety Code.
HISTORY
1. Change without regulatory effect adopting new article 2.2 (sections 822.1-822.7) and renumbering former section 822, subsections (a)-(a)(2) to new section 822.1, including amendment of section heading and section, filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.2. Access and Use by Pharmacists and Out-of-State Pharmacists 11 CCR § 822.2
§ 822.2. Procedures to Register for Access to CURES.
(a) "Pharmacist Registration Application," when used in this section, means the Web-form application developed by the Department, under Health and Safety Code section 11165.1, subdivision (a)(1)(A)(ii), for a Pharmacist or Out-of-State Pharmacist to obtain approval to electronically access patient information from CURES.
(b) An applicant must electronically submit the Pharmacist Registration Application, located on the CURES Web page of the Department's Web site.
(c) If the applicant is a Pharmacist, to complete the application, the applicant must:
(1) Provide all of the following applicant information on the Pharmacist Registration Application:
(A) Applicant Type.
(B) Name of Licensing Agency.
(C) Email address.
(D) First name.
(E) Last name.
(F) Date of birth.
1. The date of birth must match the information on record with the California Board of Pharmacy.
(G) Phone number.
(H) Phone type.
(I) Social security number or individual taxpayer identification number.
1. The social security number or individual taxpayer identification number must match the information on record with the California Board of Pharmacy.
(J) State License Number.
1. The State License Number must match the information on record with the California Board of Pharmacy.
(2) Select security questions and provide Security Question Answers.
(3) Agree to the Terms and Conditions of CURES.
(d) If the applicant is an Out-of-State Pharmacist, to complete the application, the applicant must:
(1) Provide all of the following applicant information on the Pharmacist Registration Application:
(A) Applicant Type.
(B) Name of Licensing Agency.
(C) Email address.
(D) First name.
(E) Last name.
(F) Date of birth.
(G Phone number.
(H) Phone type.
(I) Licensing state.
(J) Out-of-State Licensing Board.
(K) Category of Licensure.
(L) State License Number.
(2) Submit supporting documentation, which must include a photocopy of all of the following:
(A) The applicant's government-issued identification card or passport.
(B) The applicant's professional license issued by a Licensing Agency other than a Licensing Board.
(3) Submit a notarized acknowledgement verifying both of the following:
(A) The applicant has presented to a valid notary public all of the following supporting documentation:
1. The applicant's government-issued identification card or passport.
2. The applicant's professional license issued by a Licensing Agency other than a Licensing Board.
(B) The applicant is the individual identified in the supporting documentation presented to the valid notary public.
(4) Select security questions and provide Security Question Answers.
(5) Agree to the Terms and Conditions of CURES.
(e) When an approved applicant accesses CURES for the first time, the approved applicant must:
(1) Answer the prompted security questions on the Web-Based Application.
(2) Provide a Compliant Password.
(3) Provide the approved applicant's street address and postal code.
(A) The street address must reflect the approved applicant's work address.
(B) The street address must not be a P.O. Box.
(4) Agree to the Terms and Conditions of CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165, 11165.1 and 11165.3, Health and Safety Code; and Section 209, Business and Professions Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 822, subsections (b)-(b)(5)(D) to new section 822.2 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.2. Access and Use by Pharmacists and Out-of-State Pharmacists 11 CCR § 822.3
§ 822.3. Data Accessible to Pharmacist-Users in CURES.
(a) Subject to the restrictions of section 822.4, a Pharmacist-User may access patient information in CURES through both of the following:
(1) A Patient Activity Report.
(2) A List of Patients, but only if the Pharmacist-User has a DEA Number associated with that Pharmacist-User's CURES account.
(b) A Pharmacist-User may access patient information for a Search Period not to exceed 24 months from the date of the search.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165, 11165.1 and 11165.3, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 822, subsections (c)-(c)(2) to new section 822.3 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.2. Access and Use by Pharmacists and Out-of-State Pharmacists 11 CCR § 822.4
§ 822.4. Restrictions on Accessing Patient Information in CURES.
A Pharmacist-User must only access patient information to:
(a) Treat a patient Under the Care of the Pharmacist-User.
(b) Obtain a List of Patients for whom the Pharmacist-User is listed as the prescribing Pharmacist or prescribing Out-of-State Pharmacist.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165, 11165.1 and 11165.3, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 822, subsections (d)-(d)(1)(B) to new section 822.4 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.2. Access and Use by Pharmacists and Out-of-State Pharmacists 11 CCR § 822.5
§ 822.5. Restrictions on Use or Disclosure of Patient Information Obtained from CURES.
(a) A Pharmacist-User must not use, disclose, or transfer patient information obtained from CURES unless the use, disclosure, or transfer is consistent with all of the following:
(1) The use, disclosure, or transfer is for the same authorized purpose for which the patient information was originally requested.
(2) The use, disclosure, or transfer complies with all applicable federal and State privacy, confidentiality, and security laws and regulations, including, but not limited to:
(A) The Confidentiality of Medical Information Act (Part 2.6 (commencing with section 56) of Division 1 of the Civil Code).
(B) The HIPAA Regulations.
(C) Health and Safety Code section 11165, subdivision (c).
(b) A Pharmacist-User must not sell any patient information obtained from CURES.
(c) Notwithstanding subdivision (a)(1), a Pharmacist may disclose or transfer patient information obtained from CURES to the California Board of Pharmacy to document compliance with the law if the disclosure or transfer complies with subdivision (a)(2) and the patient information was obtained in accordance with the restrictions of section 822.4.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165, 11165.1 and 11165.3, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 822, subsections (e)-(e)(3) to new section 822.5 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.2. Access and Use by Pharmacists and Out-of-State Pharmacists 11 CCR § 822.6
§ 822.6. Procedures for Use of CURES.
(a) Patient information is available in both of the following environments:
(1) The Web-Based Application.
(2) The Information Exchange Web Service.
(b) A Compliant Password may be changed in the Web-Based Application. A Pharmacist-User must create a Compliant Password every 90 days.
(c) Procedure to Complete an Annual Renewal.
(1) An Annual Renewal may be completed in the Web-Based Application.
(2) A Pharmacist-User must complete the Annual Renewal every 365 days.
(3) A Pharmacist-User must update the following information on the Annual Renewal, if applicable:
(A) Phone number.
(B) Phone type.
(C) Street address.
1. The street address must reflect the Pharmacist-User's work address.
2. The street address must not be a P.O. Box.
(D) Postal code.
(E) Email address.
(4) To submit the Annual Renewal, a Pharmacist-User must agree to the Terms and Conditions of CURES.
(d) Procedure to Request a Patient Activity Report.
(1) A Patient Activity Report is available in the Web-Based Application or the Information Exchange Web Service.
(2) To request a Patient Activity Report in the Web-Based Application, a Pharmacist-User must:
(A) Provide search criteria that includes, at a minimum, all of the following:
1. Patient first name or patient last name.
2. Patient date of birth.
3. Search Period.
(B) Agree to the Terms and Conditions of CURES.
(C) Select the applicable Patient Entity or Patient Entities from the Patient Picklist.
(3) Subject to the requirements of section 828.3 of this chapter, to request a Patient Activity Report in the Information Exchange Web Service, a Pharmacist-User, or an authorized HIT System on behalf of a Pharmacist-User, must:
(A) Provide search criteria that includes, at a minimum, all of the following:
1. Patient first name or patient last name.
2. Patient date of birth.
3. Search Period.
(B) Agree to the Terms and Conditions of CURES.
(e) Procedure to Request a List of Patients.
(1) A List of Patients is available in the Web-Based Application.
(2) To request a List of Patients, a Pharmacist-User must:
(A) Select the Pharmacist-User's DEA Number or DEA Numbers.
(B) Provide the Search Period.
(C) Agree to the Terms and Conditions of CURES.
(f) Procedure to Submit a Prescription Theft or Loss Report.
(1) A Prescription Theft or Loss Report is available in the Web-Based Application.
(2) Each Pharmacist-User whose name is printed on a prescription form that is lost or stolen must submit a separate Prescription Theft or Loss Report.
(3) To submit a Prescription Theft or Loss Report, a Pharmacist-User must:
(A) Provide all of the following information:
1. First name of the reporting Pharmacist-User.
2. Last name of the reporting Pharmacist-User.
3. Address of the reporting Pharmacist-User.
4. Postal code of the reporting Pharmacist-User.
5. Phone number of the reporting Pharmacist-User.
6. DEA Number of the reporting Pharmacist-User.
7. Date of theft or loss.
8. Principal business.
9. Type of theft or loss.
10. Name of county in which theft or loss occurred.
(B) Indicate whether the theft or loss was reported to a law enforcement agency in the applicable jurisdiction.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165, 11165.1 and 11165.3, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 822, subsections (f)-(f)(6)(C)(ii) to new section 822.6 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.2. Access and Use by Pharmacists and Out-of-State Pharmacists 11 CCR § 822.7
§ 822.7. Delegate Use of CURES.
(a) Restrictions on Delegate Use of CURES.
(1) A Pharmacist-User is responsible for the access and use of CURES of each of that Pharmacist-User's Delegates.
(2) If a Delegate initiates a request to CURES on behalf of a Pharmacist-User, the request must conform to that Pharmacist-User's restrictions on accessing patient information under section 822.4.
(b) Procedures to Register for Access to CURES.
(1) "Delegate Registration Application," when used in this section, means the electronic application developed by the Department for a Pharmacist-User to designate an individual as a Delegate.
(2) A Pharmacist-User must electronically submit the Delegate Registration Application on the Web-Based Application.
(3) A Pharmacist-User must provide all of the following information on the Delegate Registration Application:
(A) Delegate first name.
(B) Delegate last name.
(C) Delegate email address.
(4) To submit the Delegate Registration Application, a Pharmacist-User must agree to the Terms and Conditions of CURES.
(5) When a Delegate accesses CURES for the first time, the Delegate must:
(A) Provide a Compliant Password.
(B) Provide security questions and Security Question Answers.
(C) Agree to the Terms and Conditions of CURES.
(c) Procedures for Use of CURES.
(1) A Delegate may access the Web-Based Application.
(2) A Delegate must create a Compliant Password every 90 days.
(3) Procedure to Complete an Annual Renewal.
(A) A Delegate must complete the Annual Renewal every 365 days.
(B) A Delegate must update the Delegate's email address on the Annual Renewal, if applicable.
(C) To submit the Annual Renewal, a Delegate must agree to the Terms and Conditions of CURES.
(4) Procedure to Initiate a Patient Activity Report.
(A) To initiate a Patient Activity Report, a Delegate must:
1. Provide search criteria that includes, at a minimum, all of the following:
a. Patient first name or patient last name.
b. Patient date of birth.
c. Search Period.
2. Select the Pharmacist-User on whose behalf the Delegate is initiating the Patient Activity Report.
3. Agree to the Terms and Conditions of CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165, 11165.1 and 11165.3, Health and Safety Code; and Section 209, Business and Professions Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 822, subsections (g)-(g)(3)(D)(i)c. to new section 822.7 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.2. Access and Use by Pharmacists and Out-of-State Pharmacists 11 CCR § 823
§ 823. Interstate Prescribers and Interstate Pharmacists. [Renumbered]
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165 and 11165.4, Health and Safety Code.
HISTORY
1. New section filed 5-14-2020; operative 7-1-2020 (Register 2020, No. 20).
2. Change without regulatory effect renumbering former section 823 to new sections 823.1-823.5 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.3. Access and Use by Interstate Prescribers and Interstate Pharmacists 11 CCR § 823.1
§ 823.1. Eligibility for Access to Data from CURES.
(a) An Interstate Prescriber or Interstate Pharmacist is eligible to request data from CURES through that Interstate Prescriber's or Interstate Pharmacist's PDMP if all of the following requirements are met:
(1) The Interstate Prescriber's or Interstate Pharmacist's PDMP has entered into a memorandum of understanding with the Department for interstate sharing of data from CURES, and that memorandum of understanding is in effect at the time of the request.
(2) The authorized interstate data sharing hub through which the Interstate Prescriber's or Interstate Pharmacist's PDMP will request data from CURES has entered into a memorandum of understanding with the Department for interstate sharing of data from CURES, and that memorandum of understanding is in effect at the time of the request.
(3) The Interstate Prescriber or Interstate Pharmacist complies with all applicable federal and State privacy, confidentiality, and security laws and regulations, including, but not limited to:
(A) The Confidentiality of Medical Information Act (Part 2.6 (commencing with section 56) of Division 1 of the Civil Code).
(B) The HIPAA Regulations.
(C) Health and Safety Code section 11165, subdivision (c).
(4) The Interstate Prescriber's or Interstate Pharmacist's PDMP complies with all applicable federal and State privacy, confidentiality, and security laws and regulations.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165 and 11165.4, Health and Safety Code.
HISTORY
1. Change without regulatory effect adopting new article 2.3 (sections 823.1-823.5) and renumbering former section 823, subsections (a)-(a)(1)(D) to new section 823.1, including amendment of section heading and section, filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.3. Access and Use by Interstate Prescribers and Interstate Pharmacists 11 CCR § 823.2
§ 823.2. Data Accessible to Interstate Prescribers or Interstate Pharmacists in CURES.
(a) Subject to the restrictions of section 823.3, an Interstate Prescriber or Interstate Pharmacist may access patient information in CURES through a Patient Activity Report.
(b) An Interstate Prescriber or Interstate Pharmacist may access patient information for a Search Period not to exceed 24 months from the date of the search.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165 and 11165.4, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 823, subsections (b)-(b)(2) to new section 823.2 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.3. Access and Use by Interstate Prescribers and Interstate Pharmacists 11 CCR § 823.3
§ 823.3. Restrictions on Accessing Patient Information in CURES.
(a) An Interstate Prescriber or Interstate Pharmacist must only access patient information to treat a patient Under the Care of the Interstate Prescriber or Interstate Pharmacist.
(1) If the patient is Under the Care of the Interstate Prescriber within the meaning of section 820, subdivision (ooo)(1)(B), but the patient does not have an ongoing provider-patient relationship with the Interstate Prescriber, the Interstate Prescriber must not access the patient's information in CURES earlier than 7 days before the appointment for a professional medical consultation with the Interstate Prescriber.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165 and 11165.4, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 823, subsections (c)-(c)(1)(A) to new section 823.3 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.3. Access and Use by Interstate Prescribers and Interstate Pharmacists 11 CCR § 823.4
§ 823.4. Restrictions on Use or Disclosure of Patient Information Obtained from CURES.
(a) An Interstate Prescriber or Interstate Pharmacist must not use, disclose, or transfer patient information obtained from CURES unless the use, disclosure, or transfer is consistent with all of the following:
(1) The use, disclosure, or transfer is for the same authorized purpose for which the patient information was originally requested.
(2) The use, disclosure, or transfer complies with all applicable federal and State privacy, confidentiality, and security laws and regulations, including, but not limited to:
(A) The Confidentiality of Medical Information Act (Part 2.6 (commencing with section 56) of Division 1 of the Civil Code).
(B) The HIPAA Regulations.
(C) Health and Safety Code section 11165, subdivision (c).
(b) An Interstate Prescriber or Interstate Pharmacist must not sell any patient information obtained from CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165 and 11165.4, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 823, subsections (d)-(d)(2) to new section 823.4 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.3. Access and Use by Interstate Prescribers and Interstate Pharmacists 11 CCR § 823.5
§ 823.5. Procedures for Requesting Patient Information from CURES.
(a) A Patient Activity Report is available through the Interstate Prescriber's or Interstate Pharmacist's PDMP.
(b) To request a Patient Activity Report, an Interstate Prescriber or Interstate Pharmacist must provide search criteria that includes, at a minimum, all of the following:
(1) Patient first name or patient last name.
(2) Patient date of birth.
(3) Search Period.
(c) To request a Patient Activity Report, an Interstate Prescriber or Interstate Pharmacist must agree to the Terms and Conditions of CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165 and 11165.4, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 823, subsections (e)-(e)(1)(C) to new section 823.5 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.3. Access and Use by Interstate Prescribers and Interstate Pharmacists 11 CCR § 824
§ 824. Regulatory Agencies. [Renumbered]
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11153, 11153.5, 11165, 11165.4 and 11190, Health and Safety Code.
HISTORY
1. New section filed 5-14-2020; operative 7-1-2020 (Register 2020, No. 20).
2. Change without regulatory effect renumbering former section 824 to new sections 824.1-824.6 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.4. Access and Use by Regulatory Agency Officials 11 CCR § 824.1
§ 824.1. Eligibility to Access CURES or Obtain Data from CURES.
(a) A Regulatory Agency Official is eligible to access CURES or obtain data from CURES.
(b) In the event a Regulatory Agency Official is no longer employed by a Regulatory Agency, or is no longer authorized by the Regulatory Agency to access CURES, the Regulatory Agency must notify the Department. Upon receipt of the Regulatory Agency's notification, the Department must terminate the Regulatory Agency Official's access to CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11153, 11153.5, 11165, 11165.4 and 11190, Health and Safety Code.
HISTORY
1. Change without regulatory effect adopting new article 2.4 (sections 824.1-824.6) and renumbering former section 824, subsections (a)-(a)(2) to new section 824.1, including amendment of section heading and section, filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.4. Access and Use by Regulatory Agency Officials 11 CCR § 824.2
§ 824.2. Procedures to Register for Access to CURES.
(a) "Regulatory Agency Official Registration Application," when used in this section, means the Web-form application developed by the Department for a Regulatory Agency Official to obtain approval to electronically access data from CURES.
(b) An applicant must electronically submit the Regulatory Agency Official Registration Application.
(c) To complete the application, an applicant must:
(1) Contact CURES PDMP to receive an email containing a Web-link to the Regulatory Agency Official Registration Application.
(2) Provide all of the following applicant information on the Regulatory Agency Official Registration Application:
(A) Email address.
(B) First name.
(C) Last name.
(D) Job title.
(E) Date of birth.
(F) Regulatory Agency.
(G) Phone number.
(H) Phone type.
(3) Submit supporting documentation, which must include a photocopy of all of the following:
(A) The applicant's Regulatory Agency-issued identification card.
(B) A letter on the Regulatory Agency's official letterhead explaining the applicant's need for access to CURES and confirming the applicant's employment by that Regulatory Agency. This letter must be signed by the applicant's supervisor, or if required by the applicant's Regulatory Agency, the head of the applicant's Regulatory Agency.
(4) Select security questions and provide Security Question Answers.
(5) Agree to the Terms and Conditions of CURES.
(d) When an approved applicant accesses CURES for the first time, the approved applicant must:
(1) Answer the prompted security questions on the Web-Based Application.
(2) Provide a Compliant Password.
(3) Provide the approved applicant's street address and postal code.
(A) The street address must reflect the approved applicant's work address.
(B) The street address must not be a P.O. Box.
(4) Agree to the Terms and Conditions of CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11153, 11153.5, 11165, 11165.4 and 11190, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 824, subsections (b)-(b)(4)(D) to new section 824.2 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.4. Access and Use by Regulatory Agency Officials 11 CCR § 824.3
§ 824.3. Data Accessible to Regulatory Agency Officials.
(a) Subject to the restrictions of section 824.4, a Regulatory Agency Official may obtain all of the following:
(1) A Patient Activity Report.
(2) A Prescriber History Report.
(3) A Pharmacy History Report.
(4) Any other report generated by CURES available to Regulatory Agency Officials on the Web-Based Application.
(b) A Regulatory Agency Official may obtain data from CURES for as long as the data is retained in CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11153, 11153.5, 11165, 11165.4 and 11190, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 824, subsections (c)-(c)(2) to new section 824.3 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.4. Access and Use by Regulatory Agency Officials 11 CCR § 824.4
§ 824.4. Restrictions on Accessing CURES or Data from CURES.
(a) A Regulatory Agency Official must only access CURES, or obtain data from CURES, on behalf of a Regulatory Agency, to assist the efforts of that Regulatory Agency to control the Diversion and Resultant Abuse of Applicable Controlled Substances, for any of the following authorized purposes:
(1) To investigate or evaluate compliance by a licensee with any State or federal law or regulation related to the use, possession, sale, prescribing, ordering, administering, furnishing, or dispensing of any Applicable Controlled Substance, including compliance by a licensee with that licensee's obligation to consult CURES under Health and Safety Code section 11165.4.
(2) To investigate or evaluate compliance by a licensee with the applicable standard of practice related to the use, possession, sale, prescribing, ordering, administering, furnishing, or dispensing of any Applicable Controlled Substance.
(3) To investigate or evaluate compliance by a dispensing pharmacy, clinic, or other dispenser, with the obligation to report information to the Department under Health and Safety Code section 11165, subdivision (d).
(4) To investigate or evaluate compliance by a prescriber, as defined in Business and Profession Code section 4170, with the obligation to report information to the Department under Health and Safety Code section 11190, subdivision (c).
(5) To investigate or evaluate compliance by a licensee with the obligation to comply with Health and Safety Code sections 11153 and 11153.5, or any applicable professional standard of care.
(6) To investigate or evaluate compliance by a licensee with the terms of a disciplinary probation imposed by a Licensing Board.
(7) To use as evidence in a prosecution of a licensee in an administrative disciplinary proceeding.
(b) A Regulatory Agency Official must not access CURES, or obtain data from CURES, for the purpose of investigating criminal offenses or enforcing criminal law, except as specified in subdivision (c).
(c) A Regulatory Agency Official who requests access to CURES, or requests data from CURES, for the purpose of investigating criminal offenses or enforcing criminal law must request access to CURES, or request data from CURES, as a Law Enforcement Official and comply with all requirements of article 2.5 of this chapter.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11153, 11153.5, 11165, 11165.4 and 11190, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 824, subsections (d)-(d)(3) to new section 824.4 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.4. Access and Use by Regulatory Agency Officials 11 CCR § 824.5
§ 824.5. Restrictions on Use or Disclosure of Data Obtained from CURES.
(a) A Regulatory Agency-User must not use, disclose, or transfer data obtained from CURES unless the use, disclosure, or transfer is consistent with both of the following:
(1) Unless otherwise required by law, the use, disclosure, or transfer is for the same authorized purpose for which the information was originally requested.
(2) The use, disclosure, or transfer complies with all applicable federal and State privacy, confidentiality, and security laws and regulations, including, but not limited to, the California Uniform Controlled Substances Act, including Health and Safety Code section 11165.
(b) A Regulatory Agency-User must not sell any data obtained from CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11153, 11153.5, 11165, 11165.4 and 11190, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 824, subsections (e)-(e)(2) to new section 824.5 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.4. Access and Use by Regulatory Agency Officials 11 CCR § 824.6
§ 824.6. Procedures for Use of CURES.
(a) Subject to the restrictions of this section, a Regulatory Agency-User must only access the Web-Based Application.
(b) A Regulatory Agency-User must create a Compliant Password every 90 days.
(c) Procedure to Complete an Annual Renewal.
(1) A Regulatory Agency-User must complete the Annual Renewal every 365 days.
(2) A Regulatory Agency-User must update the following information on the Annual Renewal, if applicable:
(A) Job title.
(B) Phone number.
(C) Phone type.
(D) Supervisor first name.
(E) Supervisor last name.
(F) Supervisor phone number.
(G) Supervisor phone type.
(H) Street address.
1. The street address must reflect the Regulatory Agency-User's work address.
2. The street address must not be a P.O. Box.
(I) Postal code.
(J) Email address.
(3) To submit the Annual Renewal, a Regulatory Agency-User must agree to the Terms and Conditions of CURES.
(d) Procedure to Request a Patient Activity Report.
(1) To request a Patient Activity Report, a Regulatory Agency-User must:
(A) Provide search criteria that includes, at a minimum, both of the following:
1. Patient first name or patient last name.
2. Search Period.
(B) Agree to the Terms and Conditions of CURES.
(C) Select the applicable Patient Entity or Patient Entities from the Patient Picklist.
(e) Procedure to Request a Prescriber History Report.
(1) To request a Prescriber History Report, a Regulatory Agency-User must:
(A) Provide search criteria that includes, at a minimum, both of the following:
1. Prescriber first name and Prescriber last name, or Prescriber DEA Number.
2. Search Period.
(B) Agree to the Terms and Conditions of CURES.
(C) Select the applicable Prescriber from the picklist.
(f) Procedure to Request a Pharmacy History Report.
(1) To request a Pharmacy History Report, a Regulatory Agency-User must:
(A) Provide search criteria that includes, at a minimum, both of the following:
1. Pharmacy name or pharmacy license number.
2. Search Period.
(B) Agree to the Terms and Conditions of CURES.
(C) Select the applicable pharmacy from the picklist.
(g) Procedure to Initiate a User Search.
(1) To initiate a User Search, the Regulatory Agency-User must:
(A) Provide search criteria that includes, at a minimum, both of the following:
1. Prescriber State License Number.
2. Prescriber Licensing Board.
(B) Submit the search criteria.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11153, 11153.5, 11165, 11165.4 and 11190, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 824, subsections (f)-(f)(7)(A)(ii) to new section 824.6 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.4. Access and Use by Regulatory Agency Officials 11 CCR § 825
§ 825. Law Enforcement. [Renumbered]
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code.
HISTORY
1. New section filed 5-14-2020; operative 7-1-2020 (Register 2020, No. 20).
2. Change without regulatory effect renumbering former section 825 to new sections 825.1-825.6 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.5. Access and Use by Law Enforcement Officials 11 CCR § 825.1
§ 825.1. Eligibility to Access CURES or Obtain Data from CURES.
(a) A Law Enforcement Official is eligible to access CURES or obtain data from CURES.
(b) In the event a Law Enforcement Official is no longer employed by a Law Enforcement Agency, or is no longer authorized by the Law Enforcement Agency to access CURES, the Law Enforcement Agency must notify the Department. Upon receipt of the Law Enforcement Agency's notification, the Department must terminate the Law Enforcement Agency Official's access to CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code.
HISTORY
1. Change without regulatory effect adopting new article 2.5 (sections 825.1-825.6) and renumbering former section 825, subsections (a)-(a)(2) to new section 825.1, including amendment of section heading and section, filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.5. Access and Use by Law Enforcement Officials 11 CCR § 825.2
§ 825.2. Procedures to Register for Access to CURES.
(a) "Law Enforcement Official Registration Application," when used in this section, means the Web-form application developed by the Department for a Law Enforcement Official to obtain approval to electronically access data from CURES.
(b) An applicant must electronically submit the Law Enforcement Official Registration Application.
(c) To complete the application, an applicant must:
(1) Contact CURES PDMP to receive an email containing a Web-link to the Law Enforcement Official Registration Application.
(2) Provide all of the following applicant information on the Law Enforcement Official Registration Application:
(A) Email address.
(B) First name.
(C) Last name.
(D) Agency name.
(E) Badge number or identification number.
(F) Job title.
(G) Classification.
(H) Phone number.
(I) Phone type.
(J) Supervisor first name.
(K) Supervisor last name.
(L) Supervisor rank.
(M) Supervisor phone number.
(N) Supervisor phone type.
(3) Submit supporting documentation, which must include a photocopy of all of the following:
(A) The applicant's agency-issued identification card.
(B) A letter on the Law Enforcement Agency's official letterhead, signed by the applicant's supervisor, explaining the applicant's need for access to CURES and confirming the applicant's employment by that Law Enforcement Agency.
(4) Select security questions and provide Security Question Answers.
(5) Agree to the Terms and Conditions of CURES.
(d) When an approved applicant accesses CURES for the first time, the approved applicant must:
(1) Answer the prompted security questions on the Web-Based Application.
(2) Provide a Compliant Password.
(3) Provide the approved applicant's street address and postal code.
(A) The street address must reflect the approved applicant's work address.
(B) The street address must not be a P.O. Box.
(4) Agree to the Terms and Conditions of CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 825, subsections (b)-(b)(4)(D) to new section 825.2 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.5. Access and Use by Law Enforcement Officials 11 CCR § 825.3
§ 825.3. Data Accessible to a Law Enforcement Official.
(a) Subject to the restrictions of section 825.4, a Law Enforcement Official may obtain all of the following:
(1) A Patient Activity Report.
(2) A Prescriber History Report.
(3) A Pharmacy History Report.
(4) Any other report generated by CURES available to Law Enforcement Officials on the Web-Based Application.
(b) A Law Enforcement Official may obtain data from CURES for as long as the data is retained in CURES.
(c) Notwithstanding subdivision (a), a Law Enforcement Official acting in the capacity of a coroner or medical examiner, or a Law Enforcement Official directly assisting an individual acting in the capacity of a coroner or medical examiner, is prohibited from obtaining a Prescriber History Report or a Pharmacy History Report from CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 825, subsections (c)-(c)(3) to new section 825.3 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.5. Access and Use by Law Enforcement Officials 11 CCR § 825.4
§ 825.4. Restrictions on Accessing CURES or Data from CURES.
(a) A Law Enforcement Official must only access CURES, or request data from CURES, on behalf of a Law Enforcement Agency, to assist the efforts of that Law Enforcement Agency to control the Diversion and Resultant Abuse of Applicable Controlled Substances, in connection with an investigation or prosecution of a violation or possible violation of law related to the use, possession, sale, prescribing, ordering, administering, furnishing, or dispensing of any Applicable Controlled Substance.
(b) To obtain a Prescriber History Report or a Pharmacy History Report, a Law Enforcement Official must provide both of the following:
(1) Case number.
(2) Violation code or crime code.
(c) To obtain a Patient Activity Report, a Law Enforcement Official must provide all of the following:
(1) Case number.
(2) Violation code or crime code.
(A) If the Law Enforcement Official is acting in the capacity of a coroner or medical examiner, or the Law Enforcement Official is directly assisting an individual acting in the capacity of a coroner or medical examiner, and the subject of the search is deceased, the Law Enforcement Official is not required to provide a violation code or a crime code.
(3) Search warrant or court order.
(d) Notwithstanding subdivision (c) or any other regulation in this chapter, a Law Enforcement Official is not eligible for direct electronic access to a Patient Activity Report in connection with investigating or prosecuting a possible violation of civil law; however, a Law Enforcement Official may request a Patient Activity Report in connection with investigating or prosecuting a possible violation of civil law through written submission to CURES PDMP for manual processing.
(e) Notwithstanding subdivision (c)(3), a Law Enforcement Official is not required to provide a search warrant or a court order to obtain a Patient Activity Report under any of the following circumstances:
(1) The Law Enforcement Official provides CURES or CURES PDMP with a federal grand jury subpoena.
(2) The Law Enforcement Official provides CURES PDMP with a subpoena that meets all of the following requirements:
(A) The request is from a federal, State, or local prosecutor.
(B) The records requested are of the named defendant in the case.
(C) The request identifies the court in which the case is filed and the court case number.
(D) The records requested are to be delivered to the court.
(3) The Law Enforcement Official provides CURES PDMP with an administrative subpoena issued under 21 U.S.C. § 876 of the Controlled Substances Act.
(4) The Law Enforcement Official provides CURES PDMP with a federal civil subpoena.
(5) The Law Enforcement Official is an officer or employee of the Department's Bureau of Medi-Cal Fraud and Elder Abuse, or the Department of Health Care Services, and provides CURES or CURES PDMP with both of the following:
(A) A Medi-Cal beneficiary status report indicating that the individual whose information is to be searched was a Medi-Cal beneficiary, or an applicant to the Medi-Cal program, during the applicable Search Period.
(B) An affidavit produced on the Law Enforcement Agency's official letterhead that includes all of the following:
1. A statement to the effect that the Law Enforcement Official is conducting or assisting an investigation, prosecution, or civil or criminal proceeding, related to one or both of the following:
a. Administration of the Medi-Cal plan within the meaning of 42 CFR § 431.302(d).
b. Activities consistent with the duties and responsibilities of the Medicaid Fraud Control Unit as set forth in 42 CFR § 1007.11.
2. Medi-Cal beneficiary first name and Medi-Cal beneficiary last name.
3. Medi-Cal beneficiary date of birth.
4. Search Period.
5. Requesting Law Enforcement Official's signature and job title.
(6) The Law Enforcement Official provides CURES or CURES PDMP with a copy of an individual's death certificate or a memorandum produced on Law Enforcement Agency's official letterhead that includes all of the following:
(A) A statement attesting that the subject of the search is deceased.
(B) A statement attesting that the search is related to an open Law Enforcement Agency investigation or a corner or medical examiner case.
(C) Decedent first name and decedent last name.
(D) Decedent date of birth.
(E) Search Period.
(F) Requesting Law Enforcement Official's signature and job title.
(7) The Law Enforcement Official is an officer or employee of the Department and has written approval from the Attorney General to access CURES, or request data from CURES, on behalf of the Department, for limited purposes and use consistent with Section 13 of Article V of the Constitution, related to the Attorney General's investigative authority. In addition to the restrictions of section 825.5, access to CURES or data from CURES, and the use or disclosure of data obtained from CURES, by the Law Enforcement Officials of the Department may be subject to additional restrictions as determined by the Department.
(8) The Law Enforcement Official is an officer or employee of a Law Enforcement Agency that is a member of a Department Investigative Team. In addition to the restrictions of section 825.5, access to CURES or data from CURES, and the use or disclosure of data obtained from CURES, by Department Investigative Team members may be subject to additional restrictions as determined by the Department.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 825, subsections (d)-(d)(5)(H) to new section 825.4 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.5. Access and Use by Law Enforcement Officials 11 CCR § 825.5
§ 825.5. Restrictions on Use or Disclosure of Data Obtained from CURES.
(a) A Law Enforcement-User must not use, disclose, or transfer data obtained from CURES unless the use, disclosure, or transfer is consistent with both of the following:
(1) Unless otherwise required by law, the use, disclosure, or transfer is for the same authorized purpose for which the information was originally requested.
(2) The use, disclosure, or transfer complies with all applicable federal and State privacy, confidentiality, and security laws and regulations, including, but not limited to, the California Uniform Controlled Substances Act, including Health and Safety Code section 11165.
(b) A Law Enforcement-User must not sell any data obtained from CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 825, subsections (e)-(e)(2) to new section 825.5 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.5. Access and Use by Law Enforcement Officials 11 CCR § 825.6 Procedures for Use of CURES
§ 825.6 Procedures for Use of CURES.
(a) Subject to the restrictions of this section, a Law Enforcement-User must only access the Web-Based Application.
(b) A Law Enforcement-User must create a Compliant Password every 90 days.
(c) Procedure to Complete an Annual Renewal.
(1) A Law Enforcement-User must complete the Annual Renewal every 365 days.
(2) A Law Enforcement-User must update the following information on the Annual Renewal, if applicable:
(A) Job title.
(B) Badge number or identification number.
(C) Classification.
(D) Phone number.
(E) Phone type.
(F) Supervisor first name.
(G) Supervisor last name.
(H) Supervisor job title.
(I) Supervisor phone number.
(J) Supervisor phone type.
(K) Street address.
1. The street address must reflect the Law Enforcement-User's work address.
2. The street address must not be a P.O. Box.
(L) Postal code.
(M) Email address.
(3) To submit the Annual Renewal, a Law Enforcement-User must agree to the Terms and Conditions of CURES.
(d) Procedure to Request a Patient Activity Report.
(1) To request a Patient Activity Report, a Law Enforcement-User must:
(A) Provide a search authorization that includes all of the following:
1. Case number.
2. Violation code or crime code, unless otherwise specified in section 825.4, subdivision (c)(2)(A).
3. Search warrant, court order, or documentation of an approved exception specified in section 825.4, subdivision (e).
a. Unless otherwise approved in writing by the Department, a Law Enforcement-User is prohibited from submitting the following approved exceptions to authorize a search in the Web-Based Application; these approved exceptions must be submitted to CURES PDMP for manual processing:
i. A subpoena that meets the requirements of section 825.4, subdivision (e)(2) of this chapter.
ii. An administrative subpoena that meets the requirements of section 825.4, subdivision (e)(3) of this chapter.
(B) Indicate whether the search authorization is for a civil or criminal investigation.
(C) Certify and submit the search authorization.
(D) Provide search criteria that includes, at a minimum, all of the following:
1. Patient first name and patient last name.
2. Patient date of birth.
3. Search Period.
(E) Agree to the Terms and Conditions of CURES.
(F) Select the applicable Patient Entity or Patient Entities from the Patient Picklist.
(e) Procedure to Request a Prescriber History Report.
(1) To request a Prescriber History Report, a Law Enforcement-User must:
(A) Provide a search authorization that includes both of the following:
1. Case number.
2. Violation code or crime code.
(B) Indicate whether the search authorization is for a civil or criminal investigation.
(C) Certify and submit the search authorization.
(D) Provide search criteria that includes, at a minimum, both of the following:
1. Prescriber first name and Prescriber last name, or Prescriber DEA Number.
2. Search Period.
(E) Agree to Terms and Conditions of CURES.
(F) Select the applicable Prescriber from the picklist.
(f) Procedure to Request a Pharmacy History Report.
(1) To request a Pharmacy History Report, a Law Enforcement-User must:
(A) Provide a search authorization that includes both of the following:
1. Case number.
2. Violation code or crime code.
(B) Indicate whether the search authorization is for a civil or criminal investigation.
(C) Certify and submit the search authorization.
(D) Provide search criteria that includes, at a minimum, both of the following:
1. Pharmacy name or pharmacy license number.
2. Search Period.
(E) Agree to the Terms and Conditions of CURES.
(F) Select the applicable pharmacy from the picklist.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 825, subsections (f)-(f)(6)(A)(vi) to new section 825.6 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 2.5. Access and Use by Law Enforcement Officials 11 CCR § 826
§ 826. Research. [Renumbered]
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code; and Section 1798.24, Civil Code.
HISTORY
1. New section filed 5-14-2020; operative 7-1-2020 (Register 2020, No. 20).
2. Change without regulatory effect renumbering former section 826 to new sections 826.1-826.6 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 3. Research 11 CCR § 826.1
§ 826.1. Eligibility for Access to Data from CURES.
(a) A public or private entity is eligible to obtain data from CURES, subject to the limitations specified in section 826.2.
(b) A Bona Fide Researcher is eligible to obtain data from CURES.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code; and Section 1798.24, Civil Code.
HISTORY
1. Change without regulatory effect adopting new article 3 (sections 826.1-826.6) and renumbering former section 826, subsections (a)-(a)(2) to new section 826.1, including amendment of section heading and section, filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 3. Research 11 CCR § 826.2
§ 826.2. Data Accessible to Bona Fide Researchers or Public or Private Entities.
(a) Subject to the restrictions of this section, a public or private entity that is not a Bona Fide Researcher is limited to obtaining Aggregated Data from CURES.
(b) Subject to the restrictions of this section, a Bona Fide Researcher may obtain all of the following data from CURES:
(1) Aggregated Data.
(2) De-Identified Individual-Level Data.
(3) Identified Individual-Level Data.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code; and Section 1798.24, Civil Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 826, subsections (b)-(b)(2)(C) to new section 826.2 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 3. Research 11 CCR § 826.3
§ 826.3. Restrictions on Accessing Data from CURES.
A public or private entity, or a Bona Fide Researcher, must only obtain data from CURES for educational purposes, Peer Review purposes, statistical purposes, or Research Purposes.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code; and Section 1798.24, Civil Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 826, subsections (c)-(c)(1) to new section 826.3 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 3. Research 11 CCR § 826.4
§ 826.4. Restrictions on Use or Disclosure of Data Obtained from CURES.
(a) An Interested Party must only use data from CURES to support the educational purposes, Peer Review purposes, statistical purposes, or Research Purposes, as specified in the Written Request for Aggregated Data, defined in section 826.5, subdivision (a), or Data Request Application, defined in section 826.6, subdivision (a).
(b) For Identified Individual-Level Data or De-Identified Individual-Level Data, a Bona Fide Researcher must only obtain data from CURES during the access period defined in the Bona Fide Researcher's Data Request Application.
(c) To protect patient confidentiality and to confirm that data from CURES obtained in accordance with this section is used for the purposes for which it was requested, the Bona Fide Researcher must provide to the Department's Research Center, for review and comment, sufficiently in advance of any publication or dissemination, a complete draft of any report, evaluation, or other document, and the final publication. This requirement is not applicable if the Bona Fide Researcher only obtains Aggregated Data.
(d) An Interested Party must not disclose, transfer, or disseminate data from CURES, unless expressly authorized by this section or approved in writing by the Department's Research Center.
(e) A Bona Fide Researcher must not disclose or disseminate any data or documents identifying any individual, including, but not limited to, a patient, Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist, except to the Department's Research Center, absent the written consent of that identified individual, unless approved in writing by the Department's Research Center.
(f) A Bona Fide Researcher must aggregate Identified Individual-Level Data or De-Identified Individual-Level Data from CURES before it is published to ensure that it does not create a risk of identifying individuals.
(g) An Interested Party must not release, disclose, or disseminate data or documents from CURES in any form if there is a reasonable possibility that an individual, including, but not limited to, a patient, Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist, can be directly or indirectly identified from the information released, unless approved in writing by the Department's Research Center. Data from CURES is considered to have a reasonable possibility of indirectly identifying an individual, including, but not limited to, a patient, Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist, if it includes:
(1) Any of the following identifying information:
(A) Name.
(B) Date of birth.
(C) Race.
(D) Gender.
(E) Income.
(F) Ethnicity.
(G) Age.
(H) Health conditions.
(I) Use of a drug abuse treatment facility.
(J) Pregnancy.
(K) HIPAA identifiers including, but not limited to, any of the following:
1. Phone number.
2. Email address.
3. Social security number.
4. Driver's license number.
5. PII or any other personal information, if that information, either alone or in combination with other factors, including geographic area, creates a risk of indirectly identifying that individual, including, but not limited to, a patient, Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist.
6. Geographical units of fewer than 20,000 people.
(2) Rates, frequencies, other tabulations, or combined factors, which result in the reporting of data for fewer than 20 individuals.
(h) If the Department's Research Center determines that any publication, dissemination, disclosure, or release of data from CURES or analyses could compromise the identity of any individual, Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist, the Interested Party must not publish, disseminate, disclose, or release, that publication, dissemination, or disclosure containing any data from CURES.
(i) An Interested Party must not sell any data from CURES.
(j) An Interested Party must not disclose or transfer data from CURES in a legal proceeding or in response to a subpoena in the absence of a court order. An Interested Party must give immediate notice to the Department's Research Center of any subpoena or other legal proceeding in which the disclosure of data from CURES is requested.
(k) A public or private entity, or a Bona Fide Researcher, must notify the Department's Research Center when the project, as specified in the applicable Data Request Application or Written Request for Aggregated Data, has been completed. All restrictions imposed in this section regarding use or disclosure of data from CURES survive the completion of the project.
(l) A Team Member is limited to accessing or analyzing data obtained by a Bona Fide Researcher.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code; and Section 1798.24, Civil Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 826, subsections (d)-(d)(12) to new section 826.4 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 3. Research 11 CCR § 826.5
§ 826.5. Procedures for Requesting Aggregated Data from CURES.
(a) "Written Request for Aggregated Data," when used in this section, means the written request a public or private entity, or a Bona Fide Researcher, must submit to obtain approval to receive Aggregated Data from CURES.
(b) A public or private entity, or a Bona Fide Researcher, must electronically submit a complete Written Request for Aggregated Data to the Department's Research Center.
(c) To complete a Written Request for Aggregated Data, a public or private entity, or a Bona Fide Researcher, must provide all of the following information in the Written Request for Aggregated Data:
(1) Designation as a new request or a modified request.
(2) Date of request.
(3) Name, phone number, and email address of the public or private entity, or the Bona Fide Researcher.
(4) Address, city, state, and postal code of the public or private entity, or the Bona Fide Researcher.
(5) Name of the public agency or research body with which the public or private entity, or the Bona Fide Researcher, is affiliated.
(6) Project title.
(7) Project outline that describes all of the following:
(A) The purposes and objectives of the project or report.
(B) How the requested data will be used to support the educational purposes, Peer Review purposes, statistical purposes, or Research Purposes, of the project.
(C) The expected benefits of the project.
(D) The proposed project design and methodology, including, but not limited to, a detailed description of the requested Aggregated Data from CURES.
(E) If applicable, any information pertaining to other formal project approvals, including institutional review board approvals for the academic community.
(8) Signature of the public or private entity's authorized representative, or of the Bona Fide Researcher, and the date of signature of the public or private entity's authorized representative, or of the Bona Fide Researcher, acknowledging the restrictions on use or disclosure of data from CURES, as specified in section 826.4.
(d) If the Written Request for Aggregated Data is approved, the Department's Research Center will securely transfer the requested Aggregated Data to the public or private entity, or the Bona Fide Researcher.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code; and Section 1798.24, Civil Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 826, subsections (e)-(e)(4) to new section 826.5 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 3. Research 11 CCR § 826.6
§ 826.6. Procedures for Requesting Identified Individual-Level Data and De-Identified Individual-Level Data from CURES.
(a) "Data Request Application," when used in this section, means the application developed by the Department's Research Center for a Bona Fide Researcher to obtain approval to receive Identified Individual-Level Data or De-Identified Individual-Level Data from CURES.
(b) A Bona Fide Researcher must electronically submit a completed Data Request Application to the Department's Research Center.
(c) To complete the Data Request Application, a Bona Fide Researcher must provide all of the following information on the Data Request Application:
(1) Designation as a new request or a modified request.
(2) Date of request.
(3) Name, phone number, and email address of the Bona Fide Researcher.
(4) Address, city, state, and postal code of the Bona Fide Researcher.
(5) Name of the public agency or research body with which the Bona Fide Researcher is affiliated.
(6) Name, phone number, and email address of the public agency's or research body's information security officer or IT manager.
(7) Project title.
(8) Date of anticipated completion of the project or the report.
(9) List of information for each Team Member that includes all of the following:
(A) Name of Team Member.
(B) The physical location from which the Team Member will access individual-level data from CURES.
(C) Whether the Team Member is part of the data analysis team.
(D) Whether the Team Member is part of the IT team.
(10) Signature of the Bona Fide Researcher, and date of signature of the Bona Fide Researcher.
(11) Completed Data Request Application checklist that includes all of the following:
(A) Project outline that describes all of the following:
1. The purposes and objectives of the project or report.
2. How the requested data will be used to support the educational purposes, Peer Review purposes, statistical purposes, or Research Purposes, of the project.
3. The expected benefits of the project.
4. If applicable, the funding source of the project or report, including all of the following:
a. Whether the funding source is a public or private grant.
b. The grant period.
c. The grant expiration date.
5. Proposed project design and methodology, including, but not limited to:
a. Where the data analysis will be conducted.
b. A detailed description of the requested individual-level data from CURES.
6. Security measures the Bona Fide Researcher has in place to prevent the unauthorized access of hard copies or electronic files containing Identified Individual-Level Data or De-Identified Individual-Level Data from CURES, including, but not limited to:
a. Encryption methods.
b. Anti-virus software.
c. Network security.
d. Physical storage location of the data.
e. Risks or confidentiality issues related to the storage location.
f. Whether the data is stored on a device with an internet connection.
g. Any software protection on the device on which the data is stored.
h. Whether hard copies of the data will be stored.
i. If Identified Individual-Level Data is requested, how the Bona Fide Researcher will ensure the elimination of individual identifiers from subject records or publications when the project is completed.
7. Whether the Bona Fide Researcher is capable of transferring data over a secure file transfer protocol.
8. If applicable, any information pertaining to other formal project approvals, including institutional review board approvals for the academic community.
(B) Curriculum vitae of the Bona Fide Researcher.
(C) Signature of the Bona Fide Researcher, and the date of signature of the Bona Fide Researcher, acknowledging the restrictions on use or disclosure of data from CURES, as specified in section 826.4.
(D) Completed Data Request Application security checklist that includes all of the following:
1. The name of the public agency or research body.
2. The name, position, signature, and date of signature, of the public agency's or research body's information security officer or IT manager.
(E) Any relevant research materials, including, but not limited to:
1. Proposals.
2. Endorsements.
3. Questionnaires.
(F) Copy of the institutional review board approval and all documentation submitted as part of that review and approval process, including the application number and expiration date. This requirement is not applicable if the Bona Fide Researcher is a public health officer, acting in the capacity of a public health officer, and is requesting De-Identified Individual Level Data. This approval must demonstrate that the institutional review board is aware of, and has considered, relevant federal and State laws and regulations regarding the general use of human subjects, and specifically the use of human subjects who are incarcerated, minors, or otherwise vulnerable populations.
(G) If the Bona Fide Researcher is requesting Identified Individual-Level Data, the Bona Fide Researcher must provide the prior written voluntary consent of any individual for whom Identified Individual-Level Data is being requested on the Data Request Application, in accordance with the requirements of this section and Civil Code section 1798.24, subdivision (b). Identified Individual-Level Data may be disclosed under Civil Code section 1798.24, subdivision (b), only with the prior written voluntary consent of the individual to whom the data pertains. The individual's written consent must be retained for at least as long as the individual's Identified Individual-Level Data is retained by the Bona Fide Researcher. The Bona Fide Researcher must obtain an individual's written consent not more than 30 days before obtaining that individual's Identified Individual-Level Data from CURES, or within the time limit agreed to by the individual in the individual's written consent. A Bona Fide Researcher must not obtain an individual's Identified Individual-Level Data from CURES outside of that 30 days, or the time limit agreed to by the individual in the individual's written consent, unless the individual has provided a renewed written voluntary consent.
1. Each individual written consent must certify, in addition to any other requirements, all of the following:
a. That the consent is voluntary.
b. That the individual understands the individual's identity will never be revealed.
c. That the individual understands the individual may withdraw consent at any time.
d. The principle purpose or purposes for which the information is to be used.
e. The period of time, including start and end dates, during which the individual's Identified Individual-Level Data from CURES will be acquired.
f. The individual's right of access to records containing that individual's PII that was acquired, or is possessed, under the Data Request Application.
2. If any individual withdraws consent to obtain that individual's Identified Individual-Level Data from CURES, the Bona Fide Researcher must immediately notify the Department's Research Center of that withdrawal of consent. If consent is withdrawn, the Bona Fide Researcher may retain any of that individual's Identified Individual-Level Data that was already collected from CURES under any previous consent.
(H) Certification of human subjects protection training for the Bona Fide Researcher and all Team Members.
(d) If the Data Request Application is approved, the Bona Fide Researcher and all Team Members must complete and submit a notarized identification verification. After the notarized identification verification is received, the Department's Research Center will securely transfer the requested De-Identified Individual-Level Data or Identified Individual-Level Data to the Bona Fide Researcher.
(e) The Bona Fide Researcher must complete the Department's Research Center renewal process during the 90 days before the expiration date of the approved Data Request Application. The Department's Research Center will notify the Bona Fide Researcher to submit a project renewal before the expiration date of the approved Data Request Application. A project renewal must be submitted in writing, on the Bona Fide Researcher's official letterhead, to the Department's Research Center, and include all of the following information:
(1) Any personnel changes and updated contact information, including removal or addition of the Bona Fide Researcher or other Team Members.
(2) Any technology changes to the location or procedures around where the individual-level data from CURES is stored or accessed.
(3) Any environmental changes to the location or procedures around where the individual-level data from CURES is stored or accessed.
(4) The name and contact information of the public agency's or research body's information security officer or IT manager.
(5) If applicable, a copy of the institutional review board approval and all documentation submitted as part of that review and approval process, including the application number and expiration date.
(6) A certification of human subjects protection training for the Bona Fide Researcher and all Team Members.
(f) When the Bona Fide Researcher has concluded a research project or report, in accordance with the restrictions on use or disclosure of data from CURES, as specified in section 826.4, the Bona Fide Researcher must submit to the Department's Research Center, in writing, a signed and dated certificate of data destruction confirming all of the following:
(1) The project name and project number.
(2) The type of data to be destroyed.
(3) The name of the Bona Fide Researcher.
(4) All confidential information received from the Department's Research Center has been sanitized using one or more of the approved destruction methods listed in National Institute of Standards and Technology (NIST) Special Publication 800-88, Revision 1, Guidelines for Media Sanitation (December 2014)
(5) The date that all electronic files containing Identified Individual-Level Data or De-Identified Individual-Level Data from CURES were destroyed.
(6) The name of the witness or witnesses.
(7) The position of the witness or witnesses in the research team.
(8) Acknowledgement by the Bona Fide Researcher that failure to comply with the data destruction protocols required by this section may result in an audit of the project associated with the Identified Individual-Level Data or De-Identified Individual-Level Data from CURES.
(9) A description of the items disposed of or destroyed.
(10) An explanation of the method of destruction used.
(g) National Institute of Standards and Technology (NIST) Special Publication 800-88, Revision 1, Guidelines for Media Sanitation (December 2014) is incorporated by reference in this chapter.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code; and Section 1798.24, Civil Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 826, subsections (f)-(f)(7) to new section 826.6 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 3. Research 11 CCR § 827
§ 827. Individual Requestors. [Renumbered]
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 1798.24, Civil Code; and Section 11165, Health and Safety Code.
HISTORY
1. New section filed 5-14-2020; operative 7-1-2020 (Register 2020, No. 20).
2. Change without regulatory effect renumbering former section 827 to new sections 827.1-827.2 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 4. Information Practices Act Requests 11 CCR § 827.1
§ 827.1. Eligibility to Obtain Prescription History Information from CURES.
(a) An individual may obtain that individual's prescription history information retained in CURES from CURES PDMP.
(b) In accordance with subdivisions (b)(1) and (b)(2), an authorized personal representative, on behalf of an individual, may obtain that individual's prescription history information retained in CURES from CURES PDMP.
(1) If the individual to whom the information pertains is deceased, the requesting authorized personal representative must provide evidence to CURES PDMP that the requesting authorized personal representative is the court-appointed executor or authorized representative of the decedent or the decedent's estate.
(2) If the individual to whom the information pertains is a minor, an adult who has been placed under conservatorship, or an incapacitated individual who has been appointed a health care agent under Division 4 of the California Probate Code, the requesting authorized personal representative must provide evidence to CURES PDMP that the requesting authorized personal representative is the parental or court-appointed guardian of the minor, the court-appointed conservator, or an authorized health care agent.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 1798.24, Civil Code; and Section 11165, Health and Safety Code.
HISTORY
1. Change without regulatory effect adopting new article 4 (sections 827.1-827.2) and renumbering former section 827, subsections (a)-(a)(2)(B) to new section 827.1, including amendment of section heading and section, filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 4. Information Practices Act Requests 11 CCR § 827.2
§ 827.2. Procedures for Requesting Prescription History Information from CURES.
(a) An individual must complete and submit the CURES-101 Information Practices Act Individual Request Form (09/2019), incorporated by reference in this chapter, to receive that individual's prescription history information retained in CURES from CURES PDMP.
(b) An authorized personal representative must complete and submit the CURES-201 Information Practices Act Representative Request Form (09/2019), incorporated by reference in this chapter, to receive the prescription history information retained in CURES from CURES PDMP for the individual represented by that authorized personal representative.
(c) To receive audit history information, which identifies the Prescriber-Users or Pharmacist-Users who have accessed the individual's or represented individual's prescription history information retained in CURES, the individual or authorized personal representative must request the individual's or represented individual's audit history information, in writing, on the CURES-101 Information Practices Act Individual Request Form or CURES-201 Information Practices Act Representative Request Form, respectively.
(d) A hard copy of the completed CURES-101 Information Practices Act Individual Request Form or CURES-201 Information Practices Act Representative Request Form must be submitted to CURES PDMP by mail.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 1798.24, Civil Code; and Section 11165, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 827, subsections (b)-(b)(4) to new section 827.2 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 4. Information Practices Act Requests 11 CCR § 828
§ 828. Information Exchange Web Service. [Renumbered]
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165 and 11165.1, Health and Safety Code.
HISTORY
1. New section filed 5-14-2020; operative 7-1-2020 (Register 2020, No. 20).
2. Change without regulatory effect renumbering former section 828 to new sections 828.1-828.3 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 5. Information Exchange Web Service 11 CCR § 828.1
§ 828.1. Eligibility for Integration with the Information Exchange Web Service.
An entity operating a HIT System must be a "covered entity" or "business associate," as those terms are defined in the HIPAA Regulations, with respect to any data from CURES the HIT System may receive through the Information Exchange Web Service.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165 and 11165.1, Health and Safety Code.
HISTORY
1. Change without regulatory effect adopting new article 5 (sections 828.1-828.3) and renumbering former section 828, subsections (a)-(a)(1) to new section 828.1, including amendment of section heading and section, filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 5. Information Exchange Web Service 11 CCR § 828.2
§ 828.2. Procedures for Integration with the Information Exchange Web Service.
(a) "Integration Application Package," when used in this section, means the application package developed by the Department for an entity operating a HIT System to request system integration with CURES.
(b) An entity operating a HIT System must submit a hard-copy of a completed Integration Application Package to CURES PDMP by mail.
(c) An entity operating a HIT System must provide all of the following information in the Integration Application Package:
(1) A signed memorandum of understanding.
(2) A completed CURES Information Exchange Web Service Onboarding Questionnaire (December 2019), incorporated by reference in this chapter.
(3) A Connectivity Fee check made payable to the "California Department of Justice."
(d) An entity operating a HIT System must comply with the technical specifications identified in the CURES Information Exchange Web Service Overview (December 2019), incorporated by reference in this chapter.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165 and 11165.1, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 828, subsections (b)-(b)(4) to new section 828.2 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).
Title 11. Law
Division 1. Attorney General
Chapter 8.5. Controlled Substance Utilization Review and Evaluation System (Cures)
Article 5. Information Exchange Web Service 11 CCR § 828.3
§ 828.3. Requirements for HIT System Use of the Information Exchange Web Service.
(a) In accordance with Health and Safety Code section 11165.1, subdivision (a)(1)(E)(i), an entity that operates a HIT System is prohibited from using or disclosing data from CURES received through the Information Exchange Web Service for any purpose other than delivering the data from CURES to the authorized Prescriber-User or Pharmacist-User identified in subdivision (c)(3)(E), or performing data processing activities that may be necessary to enable the delivery, unless authorized by, and pursuant to, State and federal privacy and security laws and regulations.
(b) In accordance with Health and Safety Code section 11165.1, subdivision (a)(1)(E)(ii), and in the manner described in subdivision (c)(3)(E), a HIT System must authenticate the identity of the authorized Prescriber-User or Pharmacist-User initiating a request, or on whose behalf the HIT System is initiating a request, to the Information Exchange Web Service.
(c) In accordance with Health and Safety Code section 11165.1, subdivision (a)(1)(E)(ii), a HIT System, on behalf of an authorized Prescriber-User or Pharmacist-User, must submit all of the following information to the Information Exchange Web Service with each request for a Patient Activity Report:
(1) The date and time of the search.
(2) Patient first name and patient last name.
(3) Patient date of birth.
(4) Search Period.
(5) The identification of the authorized Prescriber-User or Pharmacist-User for whom the HIT System is submitting a request.
(A) To authenticate the identity of the authorized Prescriber-User or Pharmacist-User, a HIT System must submit all of the following information for each request:
1. The first name and last name of the authorized Prescriber-User or Pharmacist-User.
2. The DEA Number of the authorized Prescriber-User or the State License Number of the authorized Pharmacist-User.
(B) A HIT System must only identify one authorized Prescriber-User or Pharmacist-User for each request.
(d) If a HIT System uses predefined criteria to trigger an automated request to CURES on behalf of an authorized Prescriber-User or Pharmacist-User, the request must conform to that Prescriber-User's or Pharmacist-User's restrictions on accessing patient information under section 821.4 or section 822.4, respectively.
(e) In accordance with Health and Safety Code section 11165.1, subdivision (a)(1)(E)(iii), a HIT System must comply with applicable patient privacy and information security requirements of federal and State laws and regulations, including, but not limited to:
(1) The Confidentiality of Medical Information Act (Part 2.6 (commencing with section 56) of Division 1 of the Civil Code).
(2) The HIPAA Regulations.
(3) The California Uniform Controlled Substances Act, including Health and Safety Code sections 11165 and 11165.1.
(f) In accordance with Health and Safety Code section 11165.1, subdivision (a)(1)(E)(iv), an entity that operates a HIT System must maintain an active memorandum of understanding with the Department.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165 and 11165.1, Health and Safety Code.
HISTORY
1. Change without regulatory effect renumbering and amending former section 828, subsections (c)-(c)(6) to new section 828.3 filed 2-2-2021 pursuant to section 100, title 1, California Code of Regulations (Register 2021, No. 6).