SEE CONCURRING OPINION

Filed 7/17/17

IN THE SUPREME COURT OF CALIFORNIA

ALWIN CARL LEWIS, )

)

Petitioner, ) S219811

)

v. )

) Ct.App. 2/3 B252032

THE SUPERIOR COURT OF )

LOS ANGELES COUNTY, )

) Los Angeles County

Respondent; ) Super. Ct. No. BS 139289

)

MEDICAL BOARD OF CALIFORNIA, )

)

Real Party in Interest. )

____________________________________)

The Controlled Substance Utilization Review and Evaluation System 

(CURES) is California‟s prescription drug monitoring program. By statute, every 

prescription of a Schedule II, III, or IV controlled substance must be logged in 

CURES, along with the patient‟s name, address, telephone number, gender, date of 

birth, drug name, quantity, number of refills, and information about the 

prescribing physician and pharmacy. (Health & Saf. Code, § 11165, subd. (d); all 

undesignated statutory references are to this code.) The question in this case is 

whether the Medical Board of California (Board) violated patients‟ right to 

privacy under article I, section 1 of the California Constitution when it obtained 

data from CURES without a warrant or subpoena supported by good cause in the 

course of investigating the patients‟ physician, Dr. Alwin Carl Lewis. We hold 
2

that it did not because, even assuming that accessing prescription records without 

good cause constitutes a significant intrusion on a legally protected privacy 

interest, the Board‟s actions in this case were justified. 

I.

CURES was created in 1996 in an effort to move California‟s preexisting 

drug monitoring program online. (Sen. Com. on Crim. Proc., Analysis of Assem. 

Bill No. 3042 (1995–1996 Reg. Sess.) as amended Mar. 28, 1996.) CURES is

maintained by the California Department of Justice (DOJ) and is designed to 

“assist health care practitioners in their efforts to ensure appropriate prescribing, 

ordering, administering, furnishing, and dispensing of controlled substances,” and 

to help “law enforcement and regulatory agencies in their efforts to control the 

diversion and resultant abuse of [Schedule II-IV] controlled substances.” 

(§ 11165, subd. (a).) 

CURES requires any pharmacy or dispenser that prescribes or dispenses 

controlled substances listed on Schedules II, III, or IV to keep a record of the 

prescription and to report specific information to the DOJ as soon as reasonably 

possible, subject to certain exceptions. (§§ 11165, subd. (d), 11190.) This 

information includes the patient‟s full name, address, gender, date of birth, 

quantity of the drug dispensed, number of refills ordered, and date of the 

prescription. (§ 11165, subd. (d).) Data obtained from CURES can be provided to 

“appropriate state, local, and federal public agencies for disciplinary, civil, or 

criminal purposes and to other agencies or entities, as determined by the 

Department of Justice, for the purpose of educating practitioners and others in lieu 

of disciplinary, civil, or criminal actions.” (§ 11165, subd. (c)(2)(A).) At the time 

of these proceedings, the statute provided that “CURES shall operate under 

existing provisions of law to safeguard the privacy and confidentiality of patients.” 

(§ 11165, former subd. (c).) Section 11165, subdivision (c) now states: “(1) The 
3

operation of CURES shall comply with all applicable federal and state privacy and 

security laws and regulations. [¶] (2)(A) CURES shall operate under existing 

provisions of law to safeguard the privacy and confidentiality of patients. . . .” 

Data obtained from CURES “shall not be disclosed, sold, or transferred to any

third party.” (§ 11165, subd. (c)(2)(A).)

In 2009, the Attorney General launched the Prescription Drug Monitoring 

Program (PDMP) system, which allows preregistered users, including licensed 

health care prescribers, pharmacists, law enforcement, and regulatory boards, to 

obtain from CURES real-time patient history information concerning controlled 

substances. (Brown Unveils Real Time Statewide Prescription Drug Monitoring 

System (Sept. 15, 2009) <https://oag.ca.gov/news/press-releases/brown-unveilsreal-time-statewide-prescription-drug-monitoring-system> [as of July 17, 2017].) 

Before the PDMP system, users had to request information from CURES by fax, 

mail, or phone, and had to wait a few days to receive the information. (Sen. 

Health Com., Analysis of Sen. Bill No. 1071 (2009–2010 Reg. Sess.) as 

amended Apr. 28, 2010, p. 4.)

The Board “has been charged with the duty to protect the public against 

incompetent, impaired, or negligent physicians.” (Arnett v. Dal Cielo (1996) 14 

Cal.4th 4, 7 (Arnett).) It is responsible for enforcing disciplinary and criminal 

provisions of the Medical Practice Act, among other duties. (Bus. & Prof. Code,

§ 2004.) In particular, the Board may “investigat[e] complaints from the public, 

from other licensees, from health care facilities, or from the board that a physician 

and surgeon may be guilty of unprofessional conduct.” (Bus. & Prof. Code,

§ 2220, subd. (a).) The Board‟s investigators are peace officers. (Pen. Code, 

§ 830.3, subd. (a); Bus. & Prof. Code, §§ 159.5, subd. (b)(1), 160, subd. (a).) The 

investigators may interview and take statements from witnesses, and they may 

issue subpoenas “for the attendance of witnesses and the production of papers, 
4

books, accounts, documents . . . and testimony . . . pertinent or material to any 

inquiry [or] investigation.” (Gov. Code, § 11181, subd. (e); see also id. § 11182; 

Bus. & Prof. Code, § 101, subd. (b); Arnett, at p. 8.) The Board qualifies as one of 

the agencies authorized to access the CURES database. 

The Board investigates physicians based on complaints or on its own 

initiative. (Bus. & Prof. Code, § 2220, subd. (a).) If after an investigation the 

Board determines there is sufficient evidence to warrant a formal disciplinary 

action against a licensee, it refers the matter to the Attorney General. The action is 

then prosecuted by the Senior Assistant Attorney General of the Health Quality 

Enforcement Section, and the proceedings are conducted in accordance with the 

Administrative Procedure Act. (Arnett, supra, 14 Cal.4th at p. 9; see Gov. Code, 

§ 12529.)

II.

In November 2008, the Board initiated an investigation of Dr. Alwin Carl 

Lewis as a result of a patient‟s complaint in August 2008 alleging that Lewis 

recommended she lose weight by engaging in a “five-bite” diet. A participant in 

this diet does not eat breakfast, has five bites of food for lunch, and five bites of 

food for dinner. 

In the initial stages of the investigation, the Board investigator assigned to 

the case obtained a CURES prescriber activity report on Lewis. The report was 

205 pages long and contained the prescription information of hundreds of patients. 

Before obtaining the CURES report, the Board investigator did not obtain patient 

authorization or issue any subpoenas. After reviewing the report, the Board asked 

five of Lewis‟s patients for release of their full medical records. Three patients 

gave their consent, and the Board obtained the other two patients‟ records via 

administrative subpoenas. The investigator also requested and obtained a copy of 
5

Lewis‟s prescribing history from CVS Pharmacy, Inc. (CVS) for the prior three 

years. 

As a result of this preliminary investigation, the Board filed an accusation 

against Lewis related to the original patient who complained, as well as the five 

additional patients. The charges included unprofessional conduct, prescribing 

dangerous drugs without an appropriate examination, excessive prescribing, and 

failure to maintain adequate and accurate medical records. 

Prior to the administrative hearing, Lewis filed a motion to dismiss the 

allegations related to the five additional patients. Lewis argued that by obtaining 

the CURES reports without a warrant, subpoena, or good cause, the Board 

violated his patients‟ privacy rights. The administrative law judge (ALJ) denied 

Lewis‟s motion, stating that the government‟s interest in obtaining the reports in a 

highly regulated area outweighed the invasion of privacy. 

Following the eight-day administrative hearing, the ALJ concluded that 

Lewis engaged in unprofessional conduct, engaged in negligent acts, and failed to 

maintain adequate records. The ALJ recommended revoking Lewis‟s license but 

staying the revocation and placing Lewis on probation for three years. The Board 

adopted the ALJ‟s recommendation. 

Lewis next filed a writ of administrative mandamus in the Los Angeles 

County Superior Court seeking to set aside the Board‟s decision, arguing that the 

Medical Board violated “fundamental privacy protections guaranteed under state 

and federal law.” The superior court denied Lewis‟s petition, concluding that 

“[t]he public health and safety concern served by the monitoring and regulation of 

the prescription of controlled substances serves a compelling public interest that 

justifies disclosure of prescription records without notification or consent.” 

Lewis then filed a petition for writ of mandate in the Court of Appeal, again 

seeking to set aside the Board‟s disciplinary decision because the Board‟s decision 
6

violated his patients‟ right to privacy. The court interpreted his challenge to be 

one based on the right to privacy under article I, section 1 of the California 

Constitution, stating that “Lewis makes clear that he is asserting his patients‟ right 

to informational privacy in their controlled substances prescription records.” 

Applying the framework set forth in Hill v. National Collegiate Athletic 

Association (1994) 7 Cal.4th 1 (Hill), the Court of Appeal determined that Lewis 

did not satisfy the threshold elements required to establish that the Board‟s actions 

involved a significant intrusion on a privacy interest protected by the state 

Constitution‟s privacy provision. Specifically, the court held that although there is 

a legally protected privacy right in medical records, the “well-known and longestablished regulatory history significantly diminishes any reasonable expectation 

of privacy against the release of controlled substances prescription records to state, 

local, or federal agencies for purposes of criminal, civil, or disciplinary 

investigations,” and “the release of CURES data to the Board during an 

investigation of a licensee-physician is not a serious invasion of privacy because 

sufficient safeguards are in place.” 

The Court of Appeal went on to conclude that even if Lewis had satisfied 

the threshold elements to establish a right to privacy on behalf of his patients, the 

invasion of privacy was justified because it furthered two compelling government 

interests: “controlling the diversion and abuse of controlled substances” and 

“protect[ing] the public against incompetent, impaired, or negligent physicians.” 

“Balancing the state‟s substantial interest in preventing the abuse and diversion of 

controlled substances and protecting the public health against the minor intrusion 

upon a patient‟s informational privacy in his or her controlled substances 

prescription records stored in CURES,” the court concluded that “the Board‟s 

actions here in accessing and compiling data from CURES did not violate article I, 

section 1 of the California Constitution.” We granted review.
7

III.

Article I, section 1 of the California Constitution guarantees certain 

inalienable rights. “Among these are enjoying and defending life and liberty, 

acquiring, possessing, and protecting property, and pursuing and obtaining safety, 

happiness, and privacy.” (Cal. Const., art. I, § 1.) The electorate added this 

protection for “privacy” to the California Constitution by a ballot initiative (the 

Privacy Initiative) in 1972. The Privacy Initiative addressed the “accelerating 

encroachment on personal freedom and security caused by increased surveillance 

and data collection activity in contemporary society.” (White v. Davis (1975) 13 

Cal.3d 757, 774.) The principal “ „mischiefs‟ ” that the Privacy Initiative 

addressed were: “(1) „government snooping‟ and the secret gathering of personal 

information; (2) the overbroad collection and retention of unnecessary personal

information by government and business interests; (3) the improper use of 

information properly obtained for a specific purpose, for example, the use of it for 

another purpose or the disclosure of it to some third party; and (4) the lack of a 

reasonable check on the accuracy of existing records.” (Id. at p. 775.)

A.

We first address the Board‟s contention that Lewis lacks standing to assert 

his patients‟ privacy rights under article I, section 1 of the California Constitution.

Although constitutional rights are “generally personal” (People v. Hazelton

(1996) 14 Cal.4th 101, 109), the United States Supreme Court has departed from 

this rule when the third-party right asserted by the litigant is “inextricably bound 

up with the activity the litigant wishes to pursue” and when some “genuine 

obstacle” prevents the absent party from asserting his or her own interest. 

(Singleton v. Wulff (1976) 428 U.S. 106, 114, 116 (Singleton).) The Courts of 

Appeal have often permitted physicians to assert their patients‟ right to privacy 

under the California Constitution. (See Medical Bd. of California v. Chiarottino
8

(2014) 225 Cal.App.4th 623, 630–631, fn. 3 (Chiarottino); Whitney v. Montegut 

(2014) 222 Cal.App.4th 906, 918–921 (Whitney); Wood v. Superior Court (1985) 

166 Cal.App.3d 1138, 1143–1145 (Wood); Board of Medical Quality Assurance v. 

Gherardini (1979) 93 Cal.App.3d 669, 675 (Gherardini).) These cases stand for 

the principle that “[w]here the constitutionally protected privacy interests of absent 

patients are coincident with the interests of the doctor, the doctor must be 

permitted to speak for them.” (Wood, at p. 1145.) 

Although the Board recognizes that physicians may assert their patients‟ 

privacy interests in certain cases, it argues that those cases are limited to contexts 

where the physician is the custodian of the records or where his interests align 

with his patients‟ interests. The Board argues that because Lewis is not the 

custodian of the records in this case and his interests do not align with his

patients‟, he should not be permitted to assert his patients‟ rights. 

We do not agree that Lewis‟s interests are at odds with his patients‟ 

interests. Because an individual‟s prescription records contain intimate details 

about his or her medical conditions, the government‟s ability to access these 

records may cause patients to hesitate to seek appropriate medical treatment. 

(Whalen v. Roe (1977) 429 U.S. 589, 602 (Whalen) [“Unquestionably, some 

individuals‟ concern for their own privacy may lead them to avoid or to postpone 

needed medical attention.”]; Ferguson v. City of Charleston (2001) 532 U.S. 67, 

78, fn. 14 [an intrusion on privacy “may have adverse consequences because it 

may deter patients from receiving needed medical care”].) Because a physician 

has an interest in patients seeking appropriate treatment and using appropriate 

medication, the Board‟s actions are “inextricably bound up with the activity the 

litigant wishes to pursue” in this case. (Singleton, supra, 428 U.S. at p. 114.) 

Moreover, the patients‟ rights are “likely to be diluted or adversely affected” 

unless Lewis is permitted to assert their rights on their behalf. (Griswold v. 
9

Connecticut (1965) 381 U.S. 479, 481.) In this case, the patients are unable to 

assert their own rights because they were never given notice that their records 

were accessed. Without notice, there was no way for them to know of the 

potential constitutional violation. “A physician has standing to assert his patient‟s 

rights where they may not otherwise be established.” (People v. Barksdale (1972) 

8 Cal.3d 320, 333.)

The Board relies on Pating v. Board of Medical Quality Assurance (1982) 

130 Cal.App.3d 608, where the Court of Appeal held that the petitioner did not 

have standing to object to the introduction of third-party medical records in part 

because a majority of the patients whose records were subpoenaed appeared at the 

administrative hearing and voluntarily consented to the introduction of their 

medical records. (Id. at p. 621.) The Board makes a similar argument here, 

contending that Lewis should not be permitted to assert his patients‟ privacy rights 

because after the access of the CURES records, when five of the patients were 

informed that the Board sought their complete medical records, three gave consent 

and the other two did not object. We need not decide what effect, if any, the 

subsequent consent of the three patients has on Lewis‟s standing because Lewis 

would still be entitled to assert the rights of the nonconsenting patients. Finally, 

the Board relies on Pating for the suggestion that “having allegedly victimized his 

patients, [Lewis] should not be permitted standing to thus assert their privacy 

rights for his own protection.” (Ibid.) Even assuming this rule applies in some 

contexts, this line of reasoning is inapplicable where, as here, Lewis is not alleged 

to have victimized all of the patients whose rights he seeks to assert.

B.

We now turn to the merits of Lewis‟s constitutional claim. In Hill, a case 

involving a challenge to the student-athlete drug testing policies of the National 

Collegiate Athletic Association (NCAA), we articulated a two-part inquiry for 
10

determining whether the right to privacy under article I, section 1 has been 

violated. (Hill, supra, 7 Cal.4th at p. 26.)

First, the complaining party must meet three “ „threshold elements‟ . . . 

utilized to screen out claims that do not involve a significant intrusion on a privacy 

interest protected by the state constitutional privacy provision.” (Loder v. City of 

Glendale (1997) 14 Cal.4th 846, 893 (Loder).) The party must demonstrate “(1) a 

legally protected privacy interest; (2) a reasonable expectation of privacy in the 

circumstances; and (3) conduct by defendant constituting a serious invasion of 

privacy.” (Hill, supra, 7 Cal.4th at pp. 39–40.) This initial inquiry is necessary to 

“permit courts to weed out claims that involve so insignificant or de minimis an 

intrusion on a constitutionally protected privacy interest as not even to require an 

explanation or justification by the defendant.” (Loder, at p. 893.)

Second, if a claimant satisfies the threshold inquiry, “[a] defendant may 

prevail in a state constitutional privacy case by negating any of the three elements 

just discussed or by pleading and proving, as an affirmative defense, that the 

invasion of privacy is justified because it substantively furthers one or more 

countervailing interests.” (Hill, supra, 7 Cal.4th at p. 40.) “The plaintiff, in turn, 

may rebut a defendant‟s assertion of countervailing interests by showing there are 

feasible and effective alternatives to defendant‟s conduct which have a lesser 

impact on privacy interests.” (Ibid.)

The standard that a defendant‟s proffered countervailing interests must 

satisfy varies based on the privacy interest asserted: “Where the case involves an 

obvious invasion of an interest fundamental to personal autonomy, e.g., freedom 

from involuntary sterilization or the freedom to pursue consensual familial 

relationships, a „compelling interest‟ must be present to overcome the vital privacy 

interest. If in contrast, the privacy interest is less central, or in bona fide dispute, 

general balancing tests are employed.” (Hill, supra, 7 Cal.4th at p. 34.) “The 
11

existence of a sufficient countervailing interest or an alternative course of conduct 

present[s] threshold questions of law for the court. The relative strength of 

countervailing interests and the feasibility of alternatives present mixed questions 

of law and fact. . . . [I]n cases where material facts are undisputed, adjudication as 

a matter of law may be appropriate.” (Id. at p. 40.)

1. 

Lewis claims that the Board violated article I, section 1 of the California 

Constitution by accessing his patients‟ CURES records. We reject this claim 

because, even assuming the Board‟s actions constituted a serious intrusion on a 

legally protected privacy interest, its review of these records was justified by the 

state‟s dual interest in protecting the public from the unlawful use and diversion of 

a particularly dangerous class of prescription drugs and protecting patients from 

negligent or incompetent physicians.

The Court of Appeal assumed without deciding that if Lewis were able to 

satisfy the three threshold elements, the Board would be required to establish a 

compelling interest. In Hill, we “decline[d] to hold that every assertion of a 

privacy interest under article I, section 1 must be overcome by a „compelling 

interest.‟ ” (Hill, supra, 7 Cal.4th at pp. 34–35.) Instead, we limited the 

application of the “compelling interest test” to those cases that implicate an 

“obvious invasion of an interest fundamental to personal autonomy.” (Id. at p. 34; 

see Hernandez v. Hillsides, Inc. (2009) 47 Cal.4th 272, 288 (Hernandez) [“except 

in the rare case in which a „fundamental‟ right of personal autonomy is involved[,] 

the defendant need not present a „ “compelling” ‟ countervailing interest”].)

In all but one of our cases applying Hill, we have applied a general 

balancing test without requiring the asserted countervailing interest to be 

compelling. (See Loder, supra, 14 Cal.4th at p. 898 [applying a general balancing 

test to an employer‟s suspicionless drug testing of a job applicant]; Pioneer 
12

Electronics (USA), Inc. v. Superior Court (2007) 40 Cal.4th 360, 373 (Pioneer 

Electronics) [applying a general balancing test to plaintiff‟s request to obtain 

defendant‟s customer lists]; International Federation of Professional and 

Technical Engineers, Local 21, AFL-CIO v. Superior Court (2007) 42 Cal.4th 319, 

339 [the public‟s “strong” interest in public employees‟ salaries outweighed any 

privacy invasion]; Hernandez, supra, 47 Cal.4th at p. 287 [because a fundamental 

autonomy right was not implicated, the defendant did not need to present a 

compelling countervailing interest].) The only case requiring a compelling 

interest involved a challenge to a statute requiring a pregnant minor to obtain 

parental consent or judicial authorization before having an abortion, an issue that 

“unquestionably impinges upon „an interest fundamental to personal autonomy.‟ ” 

(American Academy of Pediatrics v. Lungren (1997) 16 Cal.4th 307, 340.)

The Board‟s actions in this case do not implicate a fundamental autonomy 

right. It is true that the disclosure of information from the CURES database may 

chill patients‟ willingness to pursue treatment. But it cannot “be said that any 

individual has been deprived of the right to decide independently, with the advice 

of his physician, to acquire and to use needed medication. Although the State no 

doubt could prohibit entirely the use of particular [Schedule II, III, or IV] drugs, it 

has not done so. This case is therefore unlike those in which the Court has held 

that a total prohibition of certain conduct was an impermissible deprivation of 

liberty.” (Whalen, supra, 429 U.S. at p. 603, fn. omitted.) The disclosure of 

information from CURES may be one consideration affecting a patient‟s choice to 

pursue treatment, but it does not significantly impair the patient‟s ultimate ability 

to make that choice on his or her own. Because the Board‟s actions do not intrude 

on a fundamental autonomy right, we apply a general balancing test to assess the 

Board‟s actions in this case.
13

Under that test, the “[i]nvasion of a privacy interest is not a violation of the 

state constitutional right to privacy if the invasion is justified by a competing 

interest. Legitimate interests derive from the legally authorized and socially 

beneficial activities of government and private entities. Their relative importance 

is determined by their proximity to the central functions of a particular public or 

private enterprise. Conduct alleged to be an invasion of privacy is to be evaluated 

based on the extent to which it furthers legitimate and important competing 

interests.” (Hill, supra, 7 Cal.4th at p. 38.) 

The Board asserts two countervailing interests to justify any potential

invasion of privacy in this case: (1) protecting the public from unlawful use and 

diversion of a particularly dangerous class of prescription drugs; and (2) protecting 

patients from negligent or incompetent physicians. There is no question that the 

state has a “vital interest in controlling the distribution of dangerous drugs” 

(Whalen, supra, 429 U.S. at p. 598), and Lewis does not contest that access to the 

CURES database furthers the state‟s interest in protecting patients and preventing 

the abuse of prescription medication. Lewis instead argues that the Board should 

be required to employ “less intrusive means” of monitoring controlled substance 

abuse by limiting searches of the CURES database to those involving good cause, 

as established by a warrant, subpoena, or similar legal mechanism. 

The Board does not bear the burden of showing it adopted the least 

intrusive means of achieving its legitimate objectives. In Hill, we said that “[l]ike 

the „compelling interest‟ standard, the argument that such a „least restrictive 

alternative‟ burden must invariably be imposed on defendants in privacy cases 

derives from decisions that: (1) involve clear invasions of central, autonomybased privacy rights, particularly in the areas of free expression and association, 

procreation, or government-provided benefits in areas of basic human need; or 

(2) are directed against the invasive conduct of government agencies rather than 
14

private, voluntary organizations.” (Hill, supra, 7 Cal.4th at p. 49.) Seizing on the 

language directed at the “invasive conduct of government agencies” (ibid.), Lewis 

argues that any time we consider the impact of the government‟s actions on a 

privacy interest, the “least restrictive alternative” must be imposed. This 

interpretation ignores the footnote associated with this passage in Hill

summarizing cases where the “least restrictive alternative” burden has been 

applied; that footnote says “at the roots of the „least restrictive alternative‟ burden 

lie cases of government infringement of fundamental freedoms of expression and 

association.” (Id. at p. 49, fn. 16.) This case does not involve a government 

infringement of any fundamental freedom of expression and association.

Although the Board does not bear the burden of showing it has adopted the 

least intrusive means to monitor the flow of prescription drugs, evidence of less 

intrusive alternatives is relevant in balancing the government‟s interests against 

the privacy intrusion at issue. (Hill, supra, 7 Cal.4th at p. 40 [“The plaintiff . . . 

may rebut a defendant‟s assertion of countervailing interests by showing there are 

feasible and effective alternatives to defendant‟s conduct which have a lesser 

impact on privacy interests.”].) In Hill, despite finding that the NCAA‟s drug 

testing program was reasonably calculated to further its legitimate interests in 

maintaining the integrity of athletic competition and the health and safety of 

student athletes, we went on to consider the alternative methods proposed by the 

plaintiffs. (Id. at p. 50.) Ultimately, we determined that “[b]ecause plaintiffs 

failed to demonstrate with substantial evidence the presence of fully viable 

alternatives to monitoring, they stopped short of proving their case.” (Id. at p. 51.) 

But our analysis demonstrates that a showing of viable less intrusive alternatives 

can carry weight in evaluating the reasonableness of a challenged policy and 

balancing privacy against any countervailing interests. 
15

Lewis asserts that a good cause requirement in this context is a feasible 

alternative, citing as examples several cases involving Board access to patients‟ 

medical records. (See Gherardini, supra, 93 Cal.App.3d at p. 680; Wood, supra, 

166 Cal.App.3d at pp. 1148–1150; Bearman v. Superior Court (2004) 117 

Cal.App.4th 463, 468–470.) But medical records contain far more sensitive 

information than do prescription records. A patient‟s complete medical file may 

include descriptions of symptoms, family history, diagnoses, test results, and other 

intimate details concerning treatment. Moreover, a reasonable patient would know 

or should know that the government monitors the sale and distribution of 

controlled substances, and that prescription records are routinely reviewed by 

pharmacists and insurance companies. The same cannot be said of a patient‟s 

comprehensive medical record. Patients are also on notice that under the

Information Practices Act, personal information may be shared among government 

agencies “in a manner that would link the information disclosed to the individual” 

so long as “the transfer is necessary for the transferee agency to perform its 

constitutional or statutory duties, and the use is compatible with a purpose for 

which the information was collected . . . .” (Civ. Code, § 1798.24, subd. (e).) 

Therefore, although patients retain a reasonable expectation of privacy in their 

prescription records, that privacy interest is less robust than the privacy interest 

associated with medical records, and the cases on which Lewis relies are

inapposite.

The Board argues that real-time access to CURES is essential to closely 

monitoring the prescribing and dispensing of controlled substances because it 

gives the Board the ability to “spot-check prescribers for compliance with both the 

laws and standards of care governing controlled substance prescriptions, 

potentially preventing the Board from detecting and addressing problems before 

they result in patient harm.” The Board further argues that if it “were required to 
16

provide notice to patients and develop good cause as understood by the Courts of 

Appeal in the medical records context before obtaining records of controlled 

substances prescriptions from the Department, it would delay the Board‟s ability 

to identify and correct potentially dangerous practices.” We agree that a good 

cause requirement would compromise the Board‟s ability to identify and address 

potentially dangerous prescribing practices. Requiring the Board to present 

evidence to a judicial officer establishing good cause as part of its preliminary 

investigations could result in protracted legal battles that effectively derail those 

investigations. Patients who objected to subpoenas to compel disclosure of their 

medical records on the ground that the Board lacked good cause have stalled 

investigations in the past. (See Chiarottino, supra, 225 Cal.App.4th 623 [records 

requested in February 2012; appeal resolved in April 2014]; Whitney, supra, 222 

Cal.App.4th 906 [records requested in January 2011; appeal resolved in January 

2014].) Such delay is tolerated in that context because of the heightened privacy 

interests implicated by government searches of medical records. For prescription

records, however, delays of that magnitude would impede the Board‟s ability to 

swiftly identify and stop dangerous prescribing practices.

Thus, although Lewis‟s proposed alternative would reduce the impact on 

patients‟ privacy interests, it is not an equally effective or feasible alternative to

the Board‟s current approach. It is possible there are ways to limit the privacy 

intrusion on patients without hampering the Board‟s ability to investigate unsafe 

medical practices. For instance, the Board could take steps to anonymize patients‟ 

prescription information prior to accessing the CURES database. But the parties 

do not propose this alternative or address its feasibility, and we do not consider the 

merits of such an approach here. Moreover, our rejection of an individualized 

good cause requirement should not be understood to suggest that Board 

investigators may access the CURES database for any reason. Such access must 
17

be for the purpose of aiding “law enforcement and regulatory agencies in their 

efforts to control the diversion and resultant abuse of [Schedule II-IV] controlled 

substances” (§ 11165, subd. (a)) and pursuant to the Board‟s duty “to protect the 

public against incompetent, impaired, or negligent physicians” (Arnett, supra, 14 

Cal.4th at p. 7). The statutes governing the CURES database and the Board‟s 

functions limit the reasons for which the Board may access the database. 

The Board further argues that its review of the CURES data is not 

unconstitutional because there are sufficient protocols in place to prevent public 

disclosure. We have previously explained that “[p]rotective measures, safeguards 

and other alternatives may minimize the privacy intrusion” and thus should be 

considered when balancing a plaintiff‟s privacy interest against a defendant‟s

countervailing interests. (Pioneer Electronics, supra, 40 Cal.4th at p. 371.) “ „For 

example, if intrusion is limited and confidential information is carefully shielded 

from disclosure except to those who have a legitimate need to know, privacy 

concerns are assuaged.‟ ” (Ibid., quoting Hill, supra, 7 Cal.4th at p. 38.) 

Here, several provisions of law prohibit the wrongful public disclosure of 

personal information obtained from CURES. CURES data may only be provided 

to “appropriate state, local, and federal public agencies for disciplinary, civil, or 

criminal purposes.” (§ 11165, subd. (c)(2)(A).) The information reported to 

CURES is subject to “existing provisions of law to safeguard . . . privacy and 

confidentiality” and “shall not be disclosed, sold, or transferred to any third party.”

(Ibid.) During the course of investigations, the Board is required to “keep in 

confidence . . . the names of any patients whose records are reviewed and shall not 

disclose or reveal those names, except as is necessary during the course of an 

investigation, unless and until proceedings are instituted.” (Bus. & Prof. Code, 

§ 2225, subd. (a).) Failure to abide by these limitations may trigger criminal and 

civil liability: The Information Practices Act provides that “[e]xcept for 
18

disclosures which are otherwise required or permitted by law, the intentional 

disclosure of medical, psychiatric, or psychological information . . . is punishable 

as a misdemeanor if the wrongful disclosure results in economic loss or personal 

injury to the individual to whom the information pertains.” (Civ. Code,

§ 1798.57.) Civil Code section 1798.45 further authorizes civil actions for the 

same unlawful conduct; in such an action, “the agency shall be liable to the 

individual in an amount equal to the sum of . . . [a]ctual damages sustained by the 

individual, including damages for mental suffering” and “[t]he costs of the action 

together with reasonable attorney‟s fees.” (Civ. Code, § 1798.48.) 

We note that adequate protections against public disclosure do not obviate 

constitutional concerns as privacy interests are still implicated when the 

government accesses personal information without disseminating it. That said, we 

ultimately agree with the Board that the safeguards here limit the degree to which 

patients‟ privacy is invaded when the Board examines their prescription records.

In view of the considerations above, we find that the balance tips in favor 

of the Board‟s interests in protecting the public from unlawful use and diversion of 

a particularly dangerous class of prescription drugs and protecting patients from 

negligent or incompetent physicians. Because any potential invasion of privacy 

caused by the Board‟s actions was justified by countervailing interests, we 

conclude that the Board did not violate article I, section 1 of the California 

Constitution when it obtained patient prescription records from CURES.

2.

In addition to challenging the Board‟s review of the CURES records, Lewis 

asserts that the Board violated his patients‟ rights to privacy when, after searching 

the CURES database, it obtained prescription records from CVS without good 

cause, a warrant, or notice to his patients. Lewis has forfeited this claim. 
19

Lewis‟s challenge at the administrative hearing, as well as his petition for a 

writ of administrative mandate before the superior court, focused entirely on the 

CURES report, with no mention of the subsequent records obtained from CVS. It 

does appear, as Lewis asserts, that there was some confusion as to whether the 

prescription records obtained from CVS were from the CURES database or from 

CVS. Even after this confusion was clarified, however, Lewis did not assert an 

additional objection to the CVS records until his reply brief before the Court of 

Appeal. As a result, there are gaps in the record pertaining to these records and 

neither the ALJ, the superior court, nor the Court of Appeal addressed this issue. 

Finding this claim forfeited, we decline to reach the merits for the first time on 

appeal. (Medical Bd. of California v. Superior Court (1991) 227 Cal.App.3d 

1458, 1462.)

IV.

Lewis also asserts that the Board‟s access of the CURES records violates 

the Fourth Amendment to the United States Constitution. We agree with the 

Board that Lewis has forfeited this claim on behalf of his patients by failing to 

raise it at the administrative proceedings or before the superior court. Lewis‟s 

fleeting references to “fundamental privacy protections guaranteed under state and 

federal law” were insufficient to preserve the issue. His claims before the Board 

and the trial court were supported entirely on the basis of the California 

Constitution. Lewis‟s argument may be more convincing if he had presented 

arguments under article I, section 13 of the California Constitution, the provision 

that explicitly protects against unreasonable searches and seizures. However, 

given that the thrust of his arguments before the Board and the trial court asserted 

a general right to informational privacy, with no mention of search or seizure, at 

most he can be said to have asserted a federal right to informational privacy under 

the Fourteenth Amendment, a claim that he does not pursue before this court. 
20

CONCLUSION

For the reasons above, we affirm the judgment of the Court of Appeal.

LIU, J.

WE CONCUR:

CANTIL-SAKAUYE, C. J.

WERDEGAR, J.

CHIN, J.

CORRIGAN, J.

CUÉLLAR, J.

KRUGER, J.
CONCURRING OPINION BY LIU, J.

In concluding that the government interests in protecting patients and the 

public justify the Medical Board of California‟s access to the prescription drug 

database here, our opinion today assumes without deciding that Dr. Alwin Carl 

Lewis has met the threshold elements of an invasion of privacy claim. (Maj. opn., 

ante, at p. 11.) I believe each of those elements is satisfied in this case.

Lewis contends that the Medical Board of California (Board) violated his 

patients‟ right to privacy under article I, section 1 of the California Constitution by 

examining, without good cause, their prescription records maintained in the 

Controlled Substance Utilization Review and Evaluation System (CURES) 

database. A party asserting such a claim must demonstrate “(1) a legally protected 

privacy interest; (2) a reasonable expectation of privacy in the circumstances; and 

(3) conduct by defendant constituting a serious invasion of privacy.” (Hill v. Nat. 

Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 39–40 (Hill).) 

The Board concedes that the first element is satisfied here because patients 

have a legally recognized privacy interest in their prescription records. The 

records stored in CURES contain “sensitive and confidential information” (Hill, 

supra, 7 Cal.4th at p. 35) that is protected by the right to privacy under the 

California Constitution, and the sensitivity of this information is reflected in the 

confidentiality provision of the CURES statute itself. (Health & Saf. Code, 

§ 11165, subd. (c)(2); all undesignated statutory references are to this code.)
2

As to the second element (reasonable expectation of privacy), it is relevant 

that “medical records contain far more sensitive information than do prescription 

records” and that patients “know or should know that the government monitors the 

sale and distribution of controlled substances, and that prescription records are 

routinely reviewed by pharmacists and insurance companies.” (Maj. opn., ante, at 

p. 15.) But these considerations do not mean that patients have no reasonable 

expectation of privacy with regard to their prescription records. Many of the drugs 

classified as Schedule II, Schedule III, and Schedule IV controlled substances are 

approved only for the treatment of specific and often sensitive medical conditions 

or symptoms. For example, testosterone, a Schedule III controlled substance, is 

used to treat hypogonadism, a condition in which the male‟s testicles do not 

produce enough testosterone. (§ 11056, subd. (f)(30); see Mayo Clinic, Patient 

Care & Health Information <http://www.mayoclinic.org/diseases-conditions/malehypogonadism/basics/definition/con-20014235> [as of July 17, 2017]). 

Alprazolam, a Schedule IV controlled substance (commonly found in anti-anxiety 

drugs such as Xanax), is used to treat anxiety and panic disorders. (§ 11057, 

subd. (d)(1); see Prescribers‟ Digital Reference (2017) alprazolam – drug 

summary, <http://www.pdr.net/drug-summary/Xanax-alprazolam-1873.31> [as of 

July 17, 2017].) Patients retain a reasonable expectation of privacy in prescription 

drug records that can reveal their medical conditions. (See Douglas v. Dobbs

(10th Cir. 2005) 419 F.3d 1097, 1102 [“we have no difficulty concluding that 

protection of a right to privacy in a person‟s prescription drug records, which 

contain intimate facts of a personal nature, is sufficiently similar to other areas 

already protected within the ambit of privacy”]; Doe v. Southeastern Pa. Transp. 

Auth. (3d Cir. 1995) 72 F.3d 1133, 1138 [“[M]edical science has improved and 

specialized its medications. It is now possible from looking at an individual‟s 

prescription records to determine that person‟s illnesses . . . .”].) 
3

The fact that the government regulates controlled substances does not 

eliminate patients‟ reasonable expectation of privacy. A pervasive regulatory 

scheme has less significance when the area being regulated is particularly 

sensitive. (Cf. Tucson Woman’s Clinic v. Eden (9th Cir. 2004) 379 F.3d 531, 550 

[closely regulated industry exception to the warrant requirement does not apply to 

abortion clinics, “where the expectation of privacy is heightened”].) Moreover, “it 

plainly would defeat the voters‟ fundamental purpose in establishing a 

constitutional right of privacy if a defendant could defeat a constitutional claim 

simply by maintaining that statutory provisions or past practices that are 

inconsistent with the constitutionally protected right eliminate any „reasonable 

expectation of privacy‟ with regard to the constitutionally protected right.” 

(American Academy of Pediatrics v. Lungren (1997) 16 Cal.4th 307, 339; see 

Delaware v. Prouse (1979) 440 U.S. 648, 662 [“An individual . . . does not lose all 

reasonable expectation of privacy simply because [an activity is] subject to 

government regulation.”].)

It is also relevant that patients do not choose to participate in the 

prescription drug monitoring program. Instead, patients typically take prescription 

drugs for nonvoluntary, legitimate medical purposes. (§ 11153 [“A prescription 

for a controlled substance shall only be issued for a legitimate medical purpose by 

an individual practitioner acting in the usual course of his or her professional 

practice.”].) “[T]he presence or absence of opportunities to consent voluntarily to 

activities impacting privacy interests obviously affects the expectations of the 

participant.” (Hill, supra, 7 Cal.4th at p. 37.) In Hill, we emphasized that the 

student athletes were choosing to participate in a voluntary extracurricular activity 

and that “[a]s a result of its unique set of demands, athletic participation carries 

with it social norms that effectively diminish the athlete‟s reasonable expectation 

of personal privacy in his or her bodily condition, both internal and external.” (Id.
4

at p. 42.) Here, by contrast, “[t]he only way to avoid submission of prescription 

information . . . is to forgo medical treatment or to leave the state[;] [t]his is not a 

meaningful choice.” (Oregon Prescription Drug Monitoring Program v. U.S. 

Drug Enforcement Admin. (D.Or. 2014) 998 F.Supp.2d 957, 967, revd. on other 

grounds (9th Cir. 2017) __ F.3d __.) Furthermore, unlike the athletes in Hill, the 

patients were not given an opportunity to consent or refuse before their 

information was shared with the Board. Given the mandatory nature of CURES 

data collection, it is difficult to conclude that the monitoring scheme entirely 

negates patients‟ expectation of privacy.

Finally, Lewis has demonstrated “a serious invasion of privacy.” (Hill, 

supra, 7 Cal.4th at p. 40.) “ „[T]his element is intended simply to screen out 

intrusions on privacy that are de minimis or insignificant.‟ ” (American Academy 

of Pediatrics v. Lungren, supra, 16 Cal.4th at p. 339.) The Board argues that any 

intrusion on patients‟ privacy is insignificant because there are sufficient protocols 

to prevent public disclosure. Although such protective measures may limit the 

extent of privacy invasion, they do not render an intrusion de minimis for purposes 

of this threshold inquiry. (See maj. opn., ante, at p. 18 [“privacy interests are still 

implicated when the government accesses personal information without 

disseminating it”]; Hill, at p. 27, fn. 7 [“Particularly when professional or fiduciary 

relationships premised on confidentiality are at issue (such as doctor and patient or 

psychotherapist and client), the state constitutional right to privacy may be 

invaded by a less-than-public dissemination of information.”].)

The electorate was concerned about more than public disclosure when it 

passed the Privacy Initiative in 1972. The voters were concerned that their privacy 

was violated whenever their personal information was used or accessed without 

reason. (See White v. Davis (1975) 13 Cal.3d 757, 775 [the initiative was intended 

to curtail “the improper use of information properly obtained for a specific 
5

purpose, for example, the use of it for another purpose or the disclosure of it to 

some third party”]; Ballot Pamp., Proposed Stats. and Amends. to Cal. Const. with 

arguments to voters, Gen. Elec. (Nov. 7, 1972) p. 27 [“Fundamental to our privacy 

is the ability to control circulation of personal information. . . . The proliferation 

of government and business records over which we have no control limits our 

ability to control our personal lives. Often we do not know that these records even 

exist and we are certainly unable to determine who has access to them.”].) This 

concern is even more pressing today because advances in data science have 

enabled sophisticated analyses of curated information as to a particular person. 

Where, as here, one government agency discloses patients‟ sensitive medical 

information to another, the privacy intrusion cannot be dismissed as trivial.

In sum, the disclosure of CURES data to the Board is not a de minimis 

intrusion on patients‟ reasonable and legally protected privacy interests. But, as 

today‟s opinion explains, the government interests behind the prescription drug 

monitoring program are sufficiently weighty to justify the privacy invasion here.

LIU, J.

I CONCUR:

KRUGER, J.
See next page for addresses and telephone numbers for counsel who argued in Supreme Court.

Name of Opinion Lewis v. Superior Court

__________________________________________________________________________________

Unpublished Opinion

Original Appeal

Original Proceeding

Review Granted XXX 226 Cal.App.4th 933

Rehearing Granted

__________________________________________________________________________________

Opinion No. S219811

Date Filed: July 17, 2017

__________________________________________________________________________________

Court: Superior

County: Los Angeles

Judge: Joanne B. O‟Donnell

__________________________________________________________________________________

Counsel:

Fenton Nelson, Fenton Law Group, Henry R. Fenton, Dennis E. Lee and Benjamin J. Fenton for Petitioner.

Peter Bibring, Jessica G. Price; Caldwell Leslie & Proctor, Benjamin B. Au and Julia J. Bredrup for The 

American Civil Liberties Union of Sothern California, ACLU of Northern California and ACLU of San 

Diego and Imperial Counties as Amici Curiae on behalf of Petitioner.

Lee Tien and Jamie L. Williams for Electronic Frontier Foundation as Amicus Curiae on behalf of 

Petitioner.

Francisco J. Silva, Long X. Do and Lisa Matsubara for California Medical Association, American Medical 

Association, California Psychiatric Association, California Dental Association and American Dental 

Association as Amici Curiae on behalf of Petitioner.

No appearance for Respondent.

Kamala D. Harris and Xavier Becerra, Attorneys General, Edward C. DuMont, State Solicitor General, 

Kathleen A. Kenealy, Chief Assistant Attorney General, Gloria L. Castro, Assistant Attorney General, 

Janill L. Richards, Principal Deputy State Solicitor General, Aimee Feinberg, Deputy State Solicitor 

General, Kathleen Vermazen Radez and Samuel P. Siegel, Associate Deputy State Solicitor General, E.A. 

Jones III and Edward K. Kim, Deputy Attorneys General, for Real Party in Interest.

Robert C. Fellmeth, Julianne D‟Angelo Fellmeth and Bridget Fogarty Gramme for Center for Public 

Interest Law as Amicus Curiae on behalf of Real Party in Interest.
Counsel who argued in Supreme Court (not intended for publication with opinion):

Henry R. Fenton

Fenton Law Group

1990 South Bundy Drive, Suite 777

Los Angeles, CA 90025

(310) 444-5244

Aimee Feinberg

Deputy State Solicitor General

1300 I Street

Sacramento, CA 95814

(916) 324-7562