SEE CONCURRING OPINION

Filed 7/17/17



## IN THE SUPREME COURT OF CALIFORNIA

ALWIN CARL LEWIS , ) ) Petitioner , ) S 21 9811 )
v. ) ) Ct.App. 2 /3 B252032 THE SUPERIOR COURT OF ) LOS ANGELES COUNTY , ) ) Los Angeles County Respondent; ) Super. Ct. No. BS 139289 ) MEDICAL BOARD OF CALIFORNIA , ) ) Real Party in Interest

. )

________________________________ ____ )

The Controlled Substance Utilization Review and Evaluation System (CURES) is California‟s prescription drug monitoring program. By statute, every prescription of a Schedule II, III, or IV controlled substance must be logged in CURES, along with the patient‟s name, address, telephone number, gender , date of birth, drug name, quantity, number of refills, and information about the prescribing physician and pharmacy. ( Health & Saf. Code , § 11165 , subd. ( d); all undesignated statutory references are to this c ode. ) The question in this case is whether the Medical Board of California (Board) violated patients‟ right to privacy under article I, section 1 of the California Constitution when it obtained
data f rom CURES without a warrant or subpoena supported by good cause in the

course o f investigating the patients‟ physician , Dr. Alwin Carl Lewis

. We hold2

that it did not because, even assuming that accessing prescription records without good cause constitutes a significant intrusion on a legally protected privacy interest, the Board‟s actions in this case were justified.
I. CURES was created in 1996 in an effort to move California‟s pre existing drug monitoring program online. ( Sen. Co m. on Crim. Proc., Analysis of Assem. Bill No. 3042 (1995

– 1996 Reg. Sess.) as amended Mar. 28, 1996 .) CURES is maintained by the California Department of Justice (DOJ ) and is designed to “assist health care practitioners in their efforts to ensure appropriate prescr ibing, ordering, administering, furnishing, and dispensing of controlled substances , ” and to help “law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of [Schedule II

- IV ] co ntrolled substances. ” (§ 11165 , subd. (a).) CURES requires any pharma cy or dispenser that prescribes or dispenses controlled substances listed on Schedules II, III, or IV to keep a record of the prescription and to report specific information to the DOJ as soon as reasonably possi ble, subject to certain exceptions. (§§ 11165, subd. (d) , 11190 .) This information includes the patient‟s full name, address, gender, date of birth, quantity of the drug dispensed, number of refills ordered, and date of the prescription. ( § 11165 , subd. (d).) Data obtained from CURES can be provided to “appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the Department of Justice, for the purpose of educa ting practitioners and others in lieu of disciplinary, civil, or criminal actions.” ( § 11165 , subd. (c)(2) (A) .) At the time
of these proceedings, the statute provided that “CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients.” ( § 1 1 165, former subd. (c).) S ection 11165, s ubdivision (c) now states: “ (1) The3

operation of CURES shall comply with all applicable federal and s tate privacy and security laws and regulations. [¶] (2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and c onfidentiality of patients.

. . . ”
D ata obtained from CURES “ shall not be disclosed, sold, or t ransferred to any third party.” ( § 11165, subd. (c)(2) (A) .) In 2009, the Attorney General launched the Prescription Drug Monitoring Program (PDMP) system , which allows preregistered users, including licensed health care prescribers, pharmacists, law enforcement, and regu latory boards , to obtain from CURES real

- time patient history information concerning controlled
substance s

. ( Brown Unveils Real Time Statewi de Pre scription Drug Monitoring System (Sept. 15, 2009) < https://oag.ca.gov/news/press

- releases/brown

- unveils

real

- time

- statewide

- prescription

- drug

- mo nitoring

- system> [ as of July 1 7 , 2017 ].)
Before the PDMP system, users had to request information from CURES by fax, mail, or phone, and had to wait a few da ys to receive the information. (Sen. Health Com., Analysis of Sen. Bill No. 1071 (2009

– 2010 Reg. Sess.) as amended Apr. 28, 2010, p. 4 .)
The Board “has been charged with the duty to protect the public against incompetent, impaired, or negligent physicians

. ” ( Arnett v. Dal Cielo (1996) 14 Cal.4th 4, 7 (

Arnett ).) It is responsible for enforcing disciplinary and criminal provisions of the Medical Practice Act, am ong other duties. ( Bus. & Prof. Code , § 2004.) In particular, t he Board may “investigat [e] complai nts from the public, from other licensees, from health care facilities, or from the board that a physician and surgeon may be guilty of unprofessional conduct. ” ( Bus. & Prof. Code , § 2220, subd. (a ) .) The Board‟s investigators are peace officers. (Pen. Code, § 830.3, subd. (a); Bus. & Prof. Code, §§ 159.5, subd. (b)(1), 160, subd. (a).) The investigators may interview and tak e statements from witnesses, and they may issue subpoenas “for the attendance of witnesses and the production of papers,4

books, accounts, documents . . . and testimony . . . pertinent or material to any inquiry [or] investigation. ” (Gov. Code, § 11181, subd. (e) ; see also id

. § 11182;
Bus. & Pr of . Code, § 101, subd. (b); Arnett , at p. 8.) The Board qualifies as one of the agencies authorized to access the CURES database. The Board investigate s physicians based on complaints or on its own initiative. ( Bus. & Prof. Code , § 2220, subd. (a) .) If after an investigation the Board determines there is sufficient evidence to warrant a formal disciplinary action against a licensee, it refers the m atter to the Attorney General. T he action is then prosecuted by the Senior Assistant Attorney General of the Health Quali t y Enforcement Section , and the proceedings are conducted in accordance with the
Administrative Procedure Act. ( Arnett , supra , 14 Cal.4th at p. 9; see Gov. Code, § 12529.)
II. In November 2008, t he Board initiated an investigation of Dr

. Alwin Carl
Lewis as a result of a patient‟s complaint in August 2008 alleging that Lewis
recommended she lose weight by engaging in a “five

- bite” diet. A participant in
this diet does not eat breakfast, has five bites of food for lunch , and five bites o f
food for dinner.
In the initial stages of the investigation, the Board investigator assigned to
the case obtained a CURES prescriber activity report on Lewis. The report was 205 pages long and contained the prescription information of hundreds of patients.
Before obtaining the CURES report, the Board investigator did not obtain patient
authorization or issue any subpoenas. After reviewing the report , the Board asked five of Lewis‟s patients for release of their full medical records. Three patien ts gave their consen t, and the Board obtained the other two patients‟ record s via administrative subpoenas. The investigator also requested and obtained a copy of5

Lewis‟s prescribing history from CVS P harmacy , Inc. (CVS) for the prior three
years. As a result of this preliminary investigation, the Board filed an accusation against Lewis r elated to the original patient who complained , as well as the five additional patients. The charges included unprofessional conduct, prescribing dangerous drugs wi thout an appropriate examination, excessive prescribing, and failure to maintain adequate and accurate medical records. Prior to the administrative hearing, Lewis filed a motion to dismiss the allegations related to the five additional patients. Lewis argued that by obtaining the CURES reports without a warrant, subpoena, or good cause, the Board violated his patients‟ privacy rights. The administrative law judge (ALJ) denied Lewis‟s motion , stating that the government‟s interest in obtaining the repor ts in a highly regulated area outweighed the invasion of privacy. Following the eight

- day administrative hearing, the ALJ concluded that Lewis engaged in unprofessional conduct, engaged in negligent acts , and failed to maintain adequate records. The AL J recommended revoking Lewi s‟s license but

st aying the revocation and placing Lewis on probation for three years. The Board adopted the ALJ‟s recommendation

. Lew is next filed a writ of administrative mandamus in the Los Angeles County Superior Court seeking to set aside the Board‟s decision , arguing that the Medical Board violated “fundamental privacy protections guaranteed under state and federal law.” The superior court denied Lew is‟s petition, concluding that “[t]he public health and safety concern served by the monitoring and regulation of the prescription of controlled substances serves a compelling public interest that justifies disclosure of prescription records without notifi cation or consent.” Lewis then filed a petition for writ of mandate in the Court of Appeal, again seeking to set aside the Board‟s disciplinary decision because the Board‟s decision6

violated his patients‟ right to privacy. The court interpreted his cha llenge to be
one based on the right to privacy under article I, section 1 of the California Constitution, stating that “Lewis makes clear that he is asserting his patients‟ right to informational privacy in their controlled substanc es prescription records. ” Applying the framework set forth in Hill v. National Collegiate Athletic
Association (1994) 7 Cal.4th 1 ( Hill ) , the C ourt of Appeal determined that Lewis
did not satisfy the threshold elements required to establish that the Board‟s actions
involve d a significant intrusion on a privacy interest prote cted by the state Constitution‟s privacy provision. Specifically , the court held that although there is a legally protected privacy right in medical records, the “well

- known and long

established regulato ry history significantly diminishes any reasonable expectation of privacy against the release of controlled substances prescription records to state, local, or federal agencies for purposes of criminal, civil, or disciplinary investigations,” and “the rele ase of CURES data to the Board during an investigation of a licensee

- physician is not a serious invasion of privacy because sufficient safeguards are in place.”
The C ourt of Appeal went on to conclude that even if Lewis had satisfied
the threshold elements to establish a right to privacy on behalf of his patients, the invasion of privacy was justified because it furthered two compelling government
interest s: “controlling the diversion and abuse of controlled substances” and “protect[ing] the public against incompetent, impaired, or negligent physicians.” “Balancing the state‟s substantial interest in preventing the abuse and diversion of controlled substances and protecting the public health against the minor intrusion upon a patient‟s informationa l privacy in his or her controlled substances prescription records stored in CURES, ” the court concluded that “ the Board‟s actions here in accessing and compiling data from CURES did not violate article I,
section 1 of the California Constitution.” We gra nted review

.7 II I

. Article I, section 1 of the California Constitution guarantees certain inalienable rights. “ Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy .” (Cal. Const., art . I, § 1.) The electorate added this protection for “privacy” to the California Constitu tion by a ballot initiative (the Privacy Initiative) in 1972

. The Privacy Initiative addressed the “accelerating encroachment on personal freedom and security caused by increased surveillance and data collection activity in contemporary society.” ( White v. Davis (1975) 13 Cal.3d 757, 774.) The principal “ „ mischiefs ‟ ” that the Privacy Initiative
addresse d were : “(1) „government snooping‟ and the secret gathering of personal information; (2) the overbroad collection and retention of unnecessary personal information by government and business interests; (3) the improper use of information properly obtained for a specific purpose, for example , the use of it for another purpose o r the disclosure of it to some third party; and (4) the lack of a
reasonable ch eck on the accuracy of existing records.” ( Id . at p. 775.)
A.
W e first address the Board‟s contention that Lewis lacks standing to assert his patients‟ privacy rights under article I, section 1 of the California Constitution. Although constitutional rights are “generally personal” ( People v. Hazelton (1996) 14 Cal.4th 101, 109), the United States Supreme Court has departed from
this rule when the third

- party right asserted by the litigant is “inextricably bound up with the activity the litigant wishes to pursue” and when some “genuine obstacle” prevents the absent party from asserting his or her own interest. ( Singleton v. Wulff (1976) 428 U.S. 106, 114, 116 ( Singleton ).) The Courts of Appeal have often permitted physicians to assert their patients‟ right to privacy under the California Constitution. ( See Medical Bd. of California v. Chiarottino8

(2014) 225 Cal.App.4th 623, 630

– 631 , fn. 3 ( Chiarottino ) ; Whitney v. Montegut (2014 ) 222 Cal.App.4th 906, 918

– 921 ( Whitney ) ; Wood v. Superior Court (1985)
16 6 Cal.App.3d 1138, 1143

– 1145 ( Wood ) ; Board of Medical Quality Assurance v.
Gherardini (1979) 93 Cal.App.3d 669, 675 ( Gherardini ).) These cases stand for the principle that “[w]here the constitutionally protected privacy interests of absent patients are co incident with the interests of the doctor, the doctor must be permitted to speak for them.” ( Wood , at p. 1145.) Although the Board recognizes that physicians may assert their patients‟ privacy interests in certain cases, it argues that those cases are limited to contexts where the physician is the custodian of the records or where his interests align
with his patients‟ interests. The Board argues that because Lewis is not the custodian of the records in this case and his interests do not align with his patients ‟ , he should not be permitted to a ssert his patients‟ rights.
We do not agree that Lewis‟s interests are at odds with his patients‟ interests. Because an individual‟s prescription records contain intimate details
abou t his or her medical cond itions , the government‟s ability to access these
record s may cause patients to hesitate to seek appropriate medical treatment. ( Whalen v. Roe (1977) 429 U.S. 589, 602 ( Whalen ) [“Unquestionably, some individuals‟ concern for their own privacy may lead them to avoid or to postpone needed medical attention.”]; Ferguson v. City of Charleston (2001) 532 U.S. 67, 78, fn. 14 [an intrusion on privacy “may have adverse consequences bec ause it may deter patients from receiving needed medical care”].) Because a physician has an interest in patients seeking appropriate treatment and using appropriate medication, the Board‟s actions are “inextricably bound up with the activity the litigant wishes to pursue” in this case. ( Singleton , supra , 428 U.S. at p. 114.) Moreover, the patients‟ rights are “likely to be diluted or adversely affected” unless Lewis is permitted to assert their rights on their behalf. ( Griswold v.9

Connecticut (1965) 38 1 U.S. 479, 481.) In this case, the patients are unable to assert their own rights because they were never given notice that their records were accessed. Without notice, there was no way for them to know of the potential constitutional violation. “A phy sician has standing to assert his patient‟s right s where they may not otherwise be established.” ( People v. Barksdale (1972) 8 Cal.3d 320, 333.)
The Board relies on Pating v. Board of Medical Quality Assurance (1982) 130 Cal.App.3d 608, where the Court o f Appeal held that the petitioner did not have standing to obje ct to the introduction of third

- party medical records in part because a majority of the patients whose records were subpoenaed appeared at the administrative hearing and voluntarily consented t o the introduction of their medical records. ( Id. at p. 621.) The Board makes a similar argument here, contending that Lewis should not be permitted to assert his patients‟ privacy rights
because after the access of the CURES records, when five of the pa tients were informed that the Board sought their complete medical records, three gave consent and the other two did not object. We need not decide what effect , if any, the subsequent consent of the three patients has on Lewis‟s standing because Lewis
woul d still be entitled to assert the rights of the non consenting patient s . Finally,
the Board relies on Pating for the suggestion that “having allegedly victimized his patients, [Lewis] should not be permitted standing to thus assert their privacy rights for his own protection.” ( Ibid .) Even assuming this rule applies in some contexts, this line of reasoning is inapplicable where, as here, Lewis is not alleged
to have victimized all of the patients whose rights he seeks to assert

. B

. We now turn to the merits of Lewis‟s constitutional claim. In Hill , a case involving a challenge to the student

- athlete drug testing policies of the National Collegiate Athletic Association (NCAA), we articulated a two

- part inquiry for10

determining whether the right to privacy under article I, section 1 has been violated. ( Hill , supra , 7 Cal.4th at p. 26.) First, the complaining party must meet three “ „threshold elements‟ . . . utilized to screen out claims that do not involve a significant intrusion on a privacy interest protected by the state constitutional privacy provision.” ( Loder v. City of
Glendale (1997) 14 Cal.4th 846, 893 ( Loder ).) The party must demonstrate “(1) a leg ally protected privacy interest; (2) a reasonable expectation of privacy in the
circum stances; and (3) conduct by defendant constituting a serious invasion of privacy.” ( Hill , supra , 7 Cal.4th at pp. 39

– 40.) This initial inquiry is necessary to “permit courts to weed out claims that involve so insignificant or de minimis an
intr usion on a constitutionally protected privacy interest as not even to require an explanation or justification by the defendant.” ( Loder , at p. 893.) Second, if a claimant satisfies the threshold inquiry , “[a] defendant may prevail in a state constitution al privacy case by negating any of the three elements just discussed or by pleading and proving, as an affirmative defense, that the invasion of privacy is justified because it substantively furthers one or more countervailing interests.” ( Hill , supra , 7 Cal.4th at p. 40.) “The plaintiff, in turn, may rebut a defendant‟s assertion of countervailing interests by showing there are feasible and effective alternatives to defendant‟s conduct which have a lesser impact on privacy interests.” ( Ibid .)
The stand ard that a defendan t ‟ s proffered countervailing interests must satisfy varies based on the privacy interest asserted: “Where the case involves an obvious invasion of an interest fundamental to personal autonomy, e.g., freedom from involuntary sterilizatio n or the freedom to pursue consensual familial relationship s , a „compelling interest‟ must be present to overcome the vital privacy interest. If in contrast, the privacy interest is less central, or in bona fide dispute, general balancing tests are employ ed.” ( Hill , supra , 7 Cal.4th at p. 34.) “The11

existence of a sufficient countervailing interest or an alternative course of conduct present [ s ] threshold questions of law for the court. The relative strength of countervailing interests and the feasibility of alternatives present mi xed questions
of law and fact.

. . . [I]n cases where material facts are undisputed, adjudication as
a matter of law may be appropriate.” ( Id. at p. 40.)
1.
Lewis claims that the Board violated article I, section 1 of the California
Constitution by accessing his patients‟ CURES records

. We reject this claim because, even assuming the Board‟s actions constitute d a se rious intrusion on a legally protected privacy interest, its review of these records was justified by the
state‟ s dual interest in protecting the public from the unlawful use and diversion of a particularly dangerou s class of prescription drugs and protect ing patients from negligent or incompetent physicians. The Court of Appeal assumed without deciding that if Lewis were able to satisfy the three threshold elements, the Board would be required to establish a compelling interest. In Hill , we “decline[d] t o hold that every assertion of a priva cy interest under article I, section 1 must be overcome by a „compelling interest.‟ ” ( Hill , supra , 7 Cal.4th at pp. 34

– 35.) Instead, we limited the application o f the “compelling interest test ” to those cases that i mplicate an “obvious invasion of an interest funda mental to personal autonomy .” ( Id . at p. 34;

see Hernandez v. Hillsides, Inc. (2009) 47 Cal.4th 272, 28 8 ( Hernandez ) [“except in the rare case in which a „fundamental‟ right of personal autonomy is involved[,] the defendant need not present a „ “ compelling ” ‟ countervailing interest”].) In all but one of our cases applying Hill , we have applied a general balancing test without requiring the asserted countervail ing interest to be compelling. (See Lo der , supra , 14 Cal.4th at p. 898 [applying a general balancing test to an employer‟s suspicionless drug testing of a job applicant] ; Pioneer12

Electronics (USA), Inc. v. Superior Court (2007) 40 Cal.4th 360, 373 ( Pioneer
Electronics ) [applying a general bala ncing test to plaintiff‟s request to obtain defendant‟s customer lists]; International Federation of Professional and Technical Engineers, Local 21, AFL

- CIO v. Superior Court (2007) 42 Cal.4th 319,
339 [the public‟s “strong” interest in public employees‟ s alaries outweighed any privacy invasion]; Hernandez , supra , 47 Cal.4th at p. 287 [because a fundamental autonomy right was not implicated, the defendant did not need to present a compelling countervailing interest].) The only case requiring a compelling
i nterest involved a challenge to a statute requiring a pregnant minor to obtain parental consent or judicial authorization before having an abortion, an issue that “unquestionably impinges upon „an interest fundame ntal to personal autonomy .‟ ” ( American Ac ademy of Pediatrics v. Lungren (1997) 16 Cal.4th 307, 340 .) The Board‟s actions in this case do not implicate a fundamental autonomy right. It is true that the disclosure of informati on from the CURES database may chill patients‟ willingness to pursue treatment. But it cannot “be said that any individual has been deprived of the right to decide independently, with the advice of his physician, to acquire and to use needed medication. Although the State no doubt could prohibit entirely the use of partic ular [Schedule II, III, or IV] drugs, it
has not done so. This case is therefore unlike those in which the Court has held that a total prohibition of certain conduct was an impermissible deprivation of liberty.” ( Whalen , supra , 429 U.S. at p. 603 , fn. om itted .) T he disclosure of information from CURES may be one consideration affecting a patient‟s choice to pursue treatment , but it does not significantly impair the patient‟s ultimate ability
to make that choice on his or her own

. Because the Board‟s act ions do not intrude on a fundamental autonomy right , we apply a general balancing test to assess the Board‟s actions in this case.13

Under that test, the “[i]nvasion of a privacy interest is not a violation of the state constitutional right to privacy if the invasion is justified by a competing interest. Legitimate interests derive from the legally authorized and socially beneficial activities of government and private entities. Their relative importance is determined by their proximity to the central funct ions of a particular public or private enterprise. Conduct alleged to be an invasion of privacy is to be evaluated based on the extent to which it furthers legitimate and important competing interests.” ( Hill , supra , 7 Cal.4th at p. 38.)
The Board asse rts two countervailing interests to justify any potential invasion of privacy in this case: (1) protecting the public from unlawful use and diversion of a particularly dangerous class of prescription drugs ; and (2) protecting patients from negligent or in competent physicians. There is no question that the state has a “vital interest in controlling the distribution of dangerous drugs” ( Whalen , supra , 429 U.S. at p. 598), and Lewis does not contest that access to the CURES database furthers the state‟s inte rest in protecting patients and preventing the abuse of prescription medication. Lewis instead argues that the Board should be required to employ “less intrusive means” of monitoring controlled substance abuse by limiting searches of the CURES database to those involving good cause, as established by a warrant, subpoena, or similar legal mechanism.
The Board does not bear the burden of showing it adopted the least intrusive means of achieving its legitimate objectives. In Hill , we said that “[l]ike
the „compelling interest‟ standard, the argument that such a „least restrictive alternative‟ burden must invariably be imposed on defendants in privacy cases derives from decisions that: (1) involve clear invasions of central, autonomy

based privacy rights, particularly in the areas of free expression and association, procreation, or government

- provided benefits in areas of basic human need; or (2) are directed against the invasive conduct of government agencies rather than14

private, voluntary organizations.” ( Hill , supra , 7 Cal.4th at p. 49.) Seizing on the language directed at the “invasive conduct of government agencies ” ( ibid .) , Lewis argues that any time we consider the impact of the government‟s actions on a privacy interest, the “least restrictive alte rnative” must be imposed. This interpretation ignores the footnote associated with this passage in Hill summarizing cases where the “least restrictive alterna tive” burden has been applied; t hat footnote says “at the roots of the „least restrictive alternative‟ burden
lie c ases of government infringement of fundamental freedoms of expression and
association. ” ( Id. at p. 49, fn. 16.) This case does not involve a government infringement of any fundamental freedom of expression and association.
A ltho ugh the Board does not bear the burden of showing it has adopted the
least intrusive means to monitor the flow of prescription drugs , evidence of less
intrusive alternatives is relevant in balancin g the government‟s interests against the privacy intrusion at issue. ( Hill , supra , 7 Cal.4th at p. 40 [“The plaintiff . . . may rebut a defendant‟s assertion of countervailing interests by showing there are
feasible and effective alte rnatives to defendant‟s conduct which have a lesser impact on privacy interests. ”].) In Hill , despite finding that the NCAA‟s drug testing program was reasonably calculated to further its legitimate interests in maintaining the integrity of athletic competition and the health and safety of student athletes, we went on to consider the alternative methods proposed by the plaintiffs. ( Id. at p. 50.) Ultimately, we determined that “[b]ecause plaintiffs failed to demonstrate with substantial evidence the presence of fully viable alternatives to monitoring, they stopped short of proving t heir case.” ( Id. at p. 51.) But our analysis demonstrates that a showing of viable less intrusive alternatives can carry weight in evaluating the reasonableness of a challenged policy and balancing privacy against any countervailing interests.15

Lewis as serts that a good cause requirement in this context is a feasible alternative, citing as examples several cases involving Board access to patients‟
medical records . (See Gherardini , supra , 93 Cal.App.3d at p. 680; Wood , supra , 166 Cal.App.3d at pp. 1148

– 1 150; Bearman v. Superior Court (2004 ) 117 Cal.App.4th 463, 468

– 470 .) B ut medical record s contain far more sensitive
information than do p rescription records. A patient‟s complete medi c al file may
include descriptions of symptoms, family history, diagnoses, test results, and other
intimate details concerning treatment

. Moreover, a reasonable patient would know
or should know that the government monitors the sale and distribution of controlled substances, and that pre scription records are routinely reviewed by pharmacists and insurance companies. The same cannot be said of a patient‟s comprehensive medical record. P atients are also on notice that under the
Information Practices Act , personal information m ay be shared among government agencies “in a manner that would link the information disclosed to the individual” so long as “ the transfer is necessary for the transferee agency to perform its constitutional or statutory duties, and the use is compatible wi th a purpose for
which the information was collected

. . . .” (Ci v. Code, § 1798.24, subd. (e).) Therefore, although patients retain a reasonable expectation of privacy in their prescription records, that privacy interest is less robust than the privacy interest
associated with medical records , and the cases on which Lewis relies are inapposite. The Board argues that real

- time access to CURES is essential to closely monitoring the prescribing and dispensing of controlled substances because it gives the B oard the ability to “spot

- check prescribers for compliance with both the laws and standards of care governing controlled substance prescriptions, potentially preventing the Board from detecting and addressing problems before they result in patient harm.” The Board further argues that if it “were required to16

provide notice to patients and develop good cause as understood by the Courts of Appeal in the medical records context before obtaining records of controlled substances prescriptions from the Department , it would delay the Board‟s ability to identify and correct potentially dangerous practices.” We agree that a good cause requirement would compromise the Board‟s ability to identify and address potentially dangerous prescribing practices. Requiring the Board to present
evidence to a judicial officer establishing good cause as part of its preliminary investigations could result in protracted legal battles that effectively derail those investigations. P atients who objected to subpoenas to compel disclosure of their
medical records on the ground that the Board lacked good cause have stalled investigations in the past . (See Chiarottino , supra , 225 Cal.App.4th 623 [records requested in February 2012 ; appeal resolved in April 2014]; Whitney , supra , 222 Cal.App.4th 906 [records requested in January 2011; appeal resolved in January 2014].) Such delay is tolerated in that context because of the heightened privacy interests impli cated by governm ent searches of medical records. F or prescription

reco rds, however, delay s of that magnitude would impede the Board‟s ability to swiftly identify and stop dangerous prescribing practices.
Thus , al though Lewis‟s proposed alternative would reduce the impact on patients‟ privacy interests, i t i s not a n equally effective or f easible alternative to the Board‟ s current approach. It is possible there are ways to limit the privacy intrusion on patients without hampering the Board‟s ability to investigate unsafe medical practices. F or instance, the Board cou ld take steps to anonymize patients‟ prescription information prior to accessing the CURES database. But t he parties
do not propose this alternative or address its feasibility , and we do not consider the merits of such an approach here. Moreover, our rej ection of an individualized good cause requirement should not be understood to suggest that Board investigators may access the CURES database for any reason. Such access must17

be for the purpose of aiding “law enforcement and regulatory agencies in their

e fforts to control the diversion and resultant abuse of [Schedu le II

- IV ] controlled substances” (§ 11165, subd. (a )) and pursuant to the Board‟s duty “ to protect the public against incompetent, im paired, or negligent physicians” ( Arnett , supra , 14 Cal.4th at p. 7). The statute s governing the CURES database and the Board‟s
functions limit the reasons for which the Board may access the database. The Board further argues that its review of the CURES data is not
unconstitutional because there a re sufficient protocols in place to prevent public disclosure. We have previously explained that “[p] rotective measures, safeguards and other alternatives may minimize the privacy intrusion” and thus should be
considered when balancing a plaintiff‟s priva cy interest against a defendant‟s countervailing interests. ( Pioneer Electronics , supra , 40 Cal.4th at p. 371 .) “ „ For example, if intrusion is limited and confidential information is carefully shielded from disclosure except to those who have a legitima te need to know, privacy concerns are assuaged. ‟ ” ( Ibid ., quoting Hill , supra , 7 Cal.4th at p. 38.) Here, several provisions of law prohibit the wrongful public disclosure of personal information obtained from CURES. CURES data may only be provided
to “ appropriate state, local, and federal public agencies for disciplinary , civil, or criminal purposes. ” ( § 11165, subd. (c)(2) (A) .) The information reported to CURES is subject to “ existing provisions of law to safeguard

. . . privacy and
confidentiali ty ” and “ shall not be disclosed, sold, or transferred to any third party .” ( Ibid .) During the course of investigations, the Board is required to “ keep in
confidence

. . . the names of any patients whose records are reviewed and shall no t disclose or reve al those names, except as is necessary during the course of an investigation, unless and until proceedings are instit uted.” (Bus. & Prof. Code, § 2225, subd. (a) .) Failure to abide by these limitations may trigge r criminal and
civil liability : The Infor mation Practices Act provides that “[e]xcept for18

disclosures which are otherwise required or permitted by law, the intentional disclosure of medical, psychiatri c, or psychological information

. . . is punishable as a misdemeanor if the wrongful disclosure results in economic loss or personal injury to the individual to whom the information pertains .” (Civ. Code , § 1798.57 .) Civil Code section 1798.45 further authorizes civil actions for the
same unlawful conduct; in such an action, “the agency shall be liable to the individual in an amount equal to the sum of .

. . [a]ctual damages sustained by the individual, including dama ges for mental suffering” and “[ t]he costs of the action together with reasonable attorney‟s fees.” (Civ. Code , § 1798.48.)
We n ote that a dequate protections against public disclosure do not obviate

c onstitutional concerns as privacy interests are still implicated when the government accesses personal information without disseminating it. That said, we ultimately agree with the Bo ard that the safeguards here limit the degre e to which patients‟ privacy is invaded when the Board examines their prescription records

. In view of the considerations above, we find that the balance tips in favor
of the Board‟s interests in protecting the public from unlawful use and diversion of a particularly dangerous class of prescription drugs and protecting patients from negligent or incompetent physicians

. Because any potential invasion of priva cy caused by the Board‟s actions wa s justified by count ervailing interests, we
conclude that the Board did not violate article I, section 1 of the California
Constitution when it obtained patient prescription records from CURES.
2. In addition to challenging the Board‟s review of the CURES records, Lewis asserts that the Board violated his patients‟ rights to privacy when, after searching the CURES database, it obtained prescription records from CVS without good cause, a warrant, or notice to his patients. Lewis has forfeited this claim.19

Lewis‟s challenge at the administrative hearing, as well as his petition for a writ of administrative mandate before the superior court, focused entirely on the CURES report, with no mention of the subsequent records obtained from CVS. It does appear, as Lewis as serts, that there was some confusion as to whether the prescription records obtained from CVS w ere from the CURES database or from
CVS. E ven after this confusion was clarified, however, Lewis did not assert an additional objection to the CVS records until his reply brief before the Court of Appeal. As a result, there are gaps in the record pertaining to these records and
neither the AL J, the superior court, nor the Court of A ppeal addressed this issue.
F ind ing this claim forfeited, we decline to reach th e merits for the first time on appeal. ( Medical Bd. of California v. Superior Court (1991) 227 Cal.App.3d 1458, 1462.)
IV

. Lewis also asserts that the Board‟s access of the CURES records violates
the Fourth Amendment to th e United States Constitution. W e agree with the
Board that Lewis has forfeited this claim on behalf of his patients by failing to
raise it at the administrative proceedings or before the superior court. Lewis‟s fleeting references to “fundamental privacy protections guarant eed under st ate and
federal law ” were insufficient to preserve the issue. His claims before the Board and the trial court were supported enti rely on the basis of the California
C onstitution. Lewis‟s argument may be more convincing if he had presented arguments under a rticle I , section 13 of the California Constitution, the provision that explicitly protects against unreasonable searches and seizures. However, given that the thrust of his arguments before the Board and the trial court as serted a general right to informational privacy, with no mention of search or seizure, at most he can be said to have asserted a federal right to info rmational privacy under
the Fourteenth Amendment , a claim that he does not pursue before this court.20 CONC LUSION For the reasons above, we affirm t he judgment of the Court of Appeal

. L IU , J.

W E C ONCUR :
C ANTIL - S AKAUYE , C. J. W ERDEGAR , J. C HIN , J. C ORRIGAN , J. C UÉLLAR , J. K RUGER , J.CONCURRING OPINION B Y LIU, J.

In concluding that the government interests in protecting patients and the public justify the Medical Board of California‟s access to the prescription drug database here, our opinion today assumes without deciding that Dr. Alwin Carl
Lewis has met the threshold elements of an invasion of privacy claim. (Maj. opn.,

ante , at p. 11.) I believe each of those elements is satisfied in this case. Lewis contends that the Medical Board of California (Board) violated his patients‟ right to privacy under article I, section 1 of the California Constitution by examining, without good cause, their prescription records maintained in the Controlled Substance Utilization Review and Evaluation System (CURES)
database. A party asserting such a claim must demonstrate “(1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstanc es; and (3) conduct by defendant constituting a serious invasion of privacy.” ( Hill v. Nat. Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 39

– 40 ( Hill ).) The Board concedes that the first element is satisfied here because patients have a legally recogni zed privacy interest in their prescription records. The records stored in CURES contain “sensitive and confidential information” ( Hill , supra , 7 Cal.4th at p. 35) that is protected by the right to privacy under the California Constitution, and the sensiti vity of this information is reflected in the confidentiality provision of the CURES statute itself. (Health & Saf. Code, § 11165, subd. (c)(2); all undesignated statutory references are to this code .)2

As to the second element (reasonable expectation of pr ivacy), it is relevant
that “medical records contain far more sensitive information than do prescription records” and that patients “ know or should know that the government monitors the sale and distribution of controlled substances, and that prescription records are routinely reviewed by pharmacists and insurance companies.” (Maj. opn., ante , at
p. 15.) But these considerations do not mean that patients have no reasonable expectation of privacy with regard to their prescription records. Many of the drug s classified as Schedule II, Schedule III, and Schedule IV controlled substances are approved only for the treatment of specific and often sensitive medical conditions or symptoms. For example, testosterone, a Schedule III controlled substance, is
used to treat hypogonadism, a condition in which the male‟s testicles do not produce enough testosterone. (§ 11056, subd. (f)(30); see Mayo Clinic, Patient Care & Health Information <http://www.mayoclinic.org/diseases

- conditions/male

hypogonadism/

basics/ defini tion/con

- 20014235> [ as of July 17, 2017 ]). Alprazolam, a Schedule IV controlled substance (commonly found in anti

- anxiety drugs such as Xanax), is used to treat anxiety and panic disorders. (§ 11057,
subd. (d)(1); see Prescribers‟ Digital Reference (2017 ) alprazolam

– drug summary, <http://www.pdr.net/drug

- summary/Xanax

- alprazolam

- 1873.31> [ as of July 17, 2017 ].) Patients retain a reasonable expectation of privacy in prescription drug records that can reveal their medical conditions. (See Douglas v. Dob bs (10th Cir. 2005) 419 F.3d 1097 , 1102 [“we have no difficulty concluding that protection of a right to privacy in a person‟s prescription drug records, which contain intimate facts of a personal nature, is sufficiently similar to other areas already prot ected within the ambit of privacy”]; Doe v. Southeastern Pa. Transp.
Auth. (3d Cir. 1995) 72 F.3d 1133, 1138 [“[M]edical science has improved and specialized its medications. It is now possible from looking at an individual‟s prescription records to deter mine that person‟s illnesses . . . .”].)3

The fact that the government regulates controlled substances does not eliminate patients‟ reasonable expectation of privacy. A pervasive regulatory scheme has less significance when the area being regulated is p articularly sensitive. (Cf. Tucson Woman’s Clinic v. Eden (9th Cir. 2004) 379 F.3d 531, 550 [closely regulated industry exception to the warrant requirement does not apply to abortion clinics, “where the expectation of privacy is heightened ”].) Moreover, “it plainly would defeat the voters‟ fundamental purpose in establishing a
constitutional right of privacy if a defendant could defeat a constitutional claim simply by maintaining that statutory provisions or past practices that are
inconsistent with the constitutionally protected right eliminate any „reasonable expectation of privacy‟ with regard to the constitutionally protected right.” ( American Academy of Pediatrics v. Lungren (1997) 16 Cal.4th 307, 339; see
Delaware v. Prouse (1979) 440 U.S. 648, 662 [“An individual . . . does not lose all reasonable expectation of privacy simply because [an activity is] subject to government regulation.”].) It is also relevant that patients do not choose to participate in the prescription drug monitoring program. In stead, patients typically take prescription drugs for nonvoluntary, legitimate medical purposes. ( § 11153 [“A prescription for a controlled substance shall only be issued for a legitimate medical purpose by an individual practitioner acting in the usual c ourse of his or her professional practice.”].) “[T]he presence or absence of opportunities to consent voluntarily to activities impacting privacy interests obviously affects the expectations of the participant.” ( Hill , supra , 7 Cal.4th at p. 37.) In Hil l , we emphasized that the student athletes were choosing to participate in a voluntary extracurricular activity and that “[a]s a result of its unique set of demands, athletic participation carries with it social norms that effectively diminish the athlete‟ s reasonable expectation of personal privacy in his or her bodily condition, both internal and external.” ( Id.4

at p. 42.) Here, by contrast, “[t]he only way to avoid submission of prescription
information .

. . is to forgo medical treatment or to leave t he state[;] [t]his is not a meaningful choice.” ( Oregon Prescription Drug Monitoring Program v. U.S. Drug Enforcement Admin. (D.Or. 2014) 998 F.Supp.2d 957, 967, revd. on other grounds (9th Cir. 2017) __ F.3d __.) Furthermore, unlike the athletes in Hill , the patients were not given an opportunity to consent or refuse before their information was shared with the Board. Given the mandatory nature of CURES data collection, it is difficult to conclude that the monitoring scheme entirely negates patients‟ ex pectation of privacy. Finally, Lewis has demonstrated “a serious invasion of privacy.” ( Hill , supra , 7 Cal.4th at p. 40.) “ „[T]his element is intended simply to screen out intrusions on privacy that are de minimis or insignificant.‟ ” ( American Academ y of Pediatrics v. Lungren , supra , 16 Cal.4th at p. 339.) The Board argues that any intrusion on patients‟ privacy is insignificant because there are sufficient protocols to prevent public disclosure. Although such protective measures may limit the

exten t of privacy invasion, they do not render an intrusion de minimis for purposes of this threshold inquiry. (See maj. opn., ante , at p. 18 [“privacy interests are still implicated when the government accesses personal information without disseminating it”]; Hill , at p. 27, fn. 7 [“Particularly when professional or fiduciary relationships premised on confidentiality are at issue (such as doctor and patient or psychotherapist and client), the state constitutional right to privacy may be invaded by a less

- than

- public dissemination of information.”].) The electorate was concerned about more than public disclosure when it passed the Privacy Initiative in 1972. The voters were concerned that their privacy was violated whenever their personal information was used or accessed without reason. (See White v. Davis (1975) 13 Cal.3d 757, 775 [the initiative was intended to curtail “the improper use of information properly obtained for a specific5

purpose, for example, the use of it for another purpose or the disclosure o f it to some third party”]; Ballot Pamp., Proposed Stats. and Amends. to Cal. Const. with arguments to voters, Gen. Elec. (Nov. 7, 1972) p. 27 [“Fundamental to our privacy is the ability to control circulation of personal information.

. . . The proliferat ion of government and business records over which we have no control limits our ability to control our personal lives. Often we do not know that these records even exist and we are certainly unable to determine who has access to them.”].) This
concern is even more pressing today because advances in data science have enabled sophisticated analyses of curated information as to a particular person. Where, as here, one government agency discloses patients‟ sensitive medical information to another, the privac y intrusion cannot be dismissed as trivial. In sum, the disclosure of CURES data to the Board is not a de minimis intrusion on patients‟ reasonable and legally protected privacy interests. But, as today‟s opinion explains, the government interests behind the prescription drug monitoring program are sufficiently weighty to justify the privacy invasion here.

L IU , J.
I C ONCUR : K RUGER , J.See next page for addresses and telephone numbers for counsel who argued in Supreme Court.

Name of Opinion Lewis v. Super ior Court

__________________________________________________________________________________ Unpublished Opinion Original Appeal Original Proceeding Review Granted XXX 226 Cal.App.4th 933 Rehearing Granted

__________________________________________________________________________________ Opinion No. S219811 Date Filed: July 17, 2017

__________________________________________________________________________________ Court: Superior County: Los Angeles Judge: Joanne B. O‟Donnell

__________________________________________________________________________________ Counsel: Fenton Nelson, Fenton Law Group, Henry R. Fenton, Dennis E. Lee and Benjamin J. Fenton for Petitioner. Peter Bibring, Jessica G. Price; Cal dwell Leslie & Proctor, Benjamin B. Au and Julia J. Bredrup for The American Civil Liberties Union of Sothern California, ACLU of Northern California and ACLU of San Diego and Imperial Counties as Amici Curiae on behalf of Petitioner.

Lee Tien and Jamie L . Williams for Electronic Frontier Foundation as Amicus Curiae on behalf of Petitioner. Francisco J. Silva, Long X. Do and Lisa Matsubara for California Medical Association, American Medical Association, California Psychiatric Association, California Dental Association and American Dental Association as Amici Curiae on behalf of Petitioner. No appearance for Respondent. Kamala D. Harris and Xavier Becerra, Attorneys General, Edward C. DuMont, State Solic itor General, Kathleen A. Kenealy, Chief Assistant Attorney General, Gloria L. Castro, Assistant Attorney General, Janill L. Richards, Principal Deputy State Solicitor General, Aimee Feinberg, Deputy State Solicitor General, Kathleen Vermazen Radez and Sam uel P. Siegel, Associate Deputy State Solicitor General, E.A. Jones III and Edward K. Kim, Deputy Attorneys General, for Real Party in Interest. Robert C. Fellmeth, Julianne D‟Angelo Fellmeth and Bridget Fogarty Gramme for Center for Public Interest Law a s Amicus Curiae on behalf of Real Party in Interest.Counsel who argued in Supreme Court (not intended for publication with opinion):

Henry R. Fenton Fenton Law Group 1990 South Bundy Drive, Suite 777 Los Angeles, CA 90025 (310) 444

- 5244

Aimee Fei nberg Deputy State Solicitor General 1300 I Street Sacramento, CA 95814 (916) 324

- 7562