An act to amend Sections 11165 and 11165.1 of, and to add Section 11165.4 to, the Health and Safety Code, relating to controlled substances.

The people of the State of California do enact as follows:


SECTION 1.
Section 11165 of the Health and Safety Code is amended to read:
11165.
(a) To assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances, law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of Schedule II, Schedule III, and Schedule IV controlled substances, and for statistical analysis, education, and research, the Department of Justice shall, contingent upon the availability of adequate funds in the CURES Fund, maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of, and Internet access to information regarding, the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe, order, administer, furnish, or dispense these controlled substances.
(b) The Department of Justice may seek and use grant funds to pay the costs incurred by the operation and maintenance of CURES. The department shall annually report to the Legislature and make available to the public the amount and source of funds it receives for support of CURES.
(c) (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.
(2) (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the Department of Justice, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the Department of Justice, for educational, peer review, statistical, or research purposes, provided that patient information, including any information that may identify the patient, is not compromised. Further, data disclosed to any individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to any third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The Department of Justice shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.
(B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.
(3) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patient’s CURES patient activity report as long as no additional CURES data is provided and keep a copy of the report in the patient’s medical record in compliance with subdivision (d) of Section 11165.1.
(d) For each prescription for a Schedule II, Schedule III, or Schedule IV controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, and 1308.14, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the Department of Justice as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed, in a format specified by the Department of Justice:
(1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender, and date of birth of the ultimate user.
(2) The prescriber’s category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of any prescriber using the federal controlled substance registration number of a government-exempt facility.
(3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.
(4) National Drug Code (NDC) number of the controlled substance dispensed.
(5) Quantity of the controlled substance dispensed.
(6) International Statistical Classification of Diseases, 9th revision (ICD-9) or 10th revision (ICD-10) Code, if available.
(7) Number of refills ordered.
(8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.
(9) Date of origin of the prescription.
(10) Date of dispensing of the prescription.
(e) The Department of Justice may invite stakeholders to assist, advise, and make recommendations on the establishment of rules and regulations necessary to ensure the proper administration and enforcement of the CURES database. All prescriber and dispenser invitees shall be licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, in active practice in California, and a regular user of CURES.
(f) The Department of Justice shall, prior to upgrading CURES, consult with prescribers licensed by one of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, one or more of the boards or committees identified in subdivision (d) of Section 208 of the Business and Professions Code, and any other stakeholder identified by the department, for the purpose of identifying desirable capabilities and upgrades to the CURES Prescription Drug Monitoring Program (PDMP).
(g) The Department of Justice may establish a process to educate authorized subscribers of the CURES PDMP on how to access and use the CURES PDMP.
SEC. 2.
Section 11165.1 of the Health and Safety Code is amended to read:
11165.1.
(a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, or Schedule IV controlled substances pursuant to Section 11150 shall, before July 1, 2016, or upon receipt of a federal Drug Enforcement Administration (DEA) registration, whichever occurs later, submit an application developed by the Department of Justice to obtain approval to access information online regarding the controlled substance history of a patient that is stored on the Internet and maintained within the Department of Justice, and, upon approval, the department shall release to that practitioner the electronic history of controlled substances dispensed to an individual under his or her care based on data contained in the CURES Prescription Drug Monitoring Program (PDMP).
(ii) A pharmacist shall, before July 1, 2016, or upon licensure, whichever occurs later, submit an application developed by the Department of Justice to obtain approval to access information online regarding the controlled substance history of a patient that is stored on the Internet and maintained within the Department of Justice, and, upon approval, the department shall release to that pharmacist the electronic history of controlled substances dispensed to an individual under his or her care based on data contained in the CURES PDMP.
(B) An application may be denied, or a subscriber may be suspended, for reasons which include, but are not limited to, the following:
(i) Materially falsifying an application for a subscriber.
(ii) Failure to maintain effective controls for access to the patient activity report.
(iii) Suspended or revoked federal DEA registration.
(iv) Any subscriber who is arrested for a violation of law governing controlled substances or any other law for which the possession or use of a controlled substance is an element of the crime.
(v) Any subscriber accessing information for any other reason than caring for his or her patients.
(C) Any authorized subscriber shall notify the Department of Justice within 30 days of any changes to the subscriber account.
(2) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, or Schedule IV controlled substances pursuant to Section 11150 or a pharmacist shall be deemed to have complied with paragraph (1) if the licensed health care practitioner or pharmacist has been approved to access the CURES database through the process developed pursuant to subdivision (a) of Section 209 of the Business and Professions Code.
(b) Any request for, or release of, a controlled substance history pursuant to this section shall be made in accordance with guidelines developed by the Department of Justice.
(c) In order to prevent the inappropriate, improper, or illegal use of Schedule II, Schedule III, or Schedule IV controlled substances, the Department of Justice may initiate the referral of the history of controlled substances dispensed to an individual based on data contained in CURES to licensed health care practitioners, pharmacists, or both, providing care or services to the individual.
(d) The history of controlled substances dispensed to an individual based on data contained in CURES that is received by a practitioner or pharmacist from the Department of Justice pursuant to this section is medical information subject to the provisions of the Confidentiality of Medical Information Act contained in Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code.
(e) Information concerning a patient’s controlled substance history provided to a prescriber or pharmacist pursuant to this section shall include prescriptions for controlled substances listed in Sections 1308.12, 1308.13, and 1308.14 of Title 21 of the Code of Federal Regulations.
(f) A health care practitioner, pharmacist, and any person acting on behalf of a health care practitioner or pharmacist, when acting with reasonable care and in good faith, is not subject to civil or administrative liability arising from any false, incomplete, inaccurate, or misattributed information submitted to, reported by, or relied upon in the CURES database or for any resulting failure of the CURES database to accurately or timely report that information.
SEC. 3.
Section 11165.4 is added to the Health and Safety Code, to read:
11165.4.
(a) (1) (A) (i) A health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance shall consult the CURES database to review a patient’s controlled substance history before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every four months thereafter if the substance remains part of the treatment of the patient.
(ii) If a health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance is not required, pursuant to an exemption described in subdivision (c), to consult the CURES database the first time he or she prescribes, orders, administers, or furnishes a controlled substance to a patient, he or she shall consult the CURES database to review the patient’s controlled substance history before subsequently prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient and at least once every four months thereafter if the substance remains part of the treatment of the patient.
(B) For purposes of this paragraph, “first time” means the initial occurrence in which a health care practitioner, in his or her role as a health care practitioner, intends to prescribe, order, administer, or furnish a Schedule II, Schedule III, or Schedule IV controlled substance to a patient and has not previously prescribed a controlled substance to the patient.
(2) A health care practitioner shall obtain a patient’s controlled substance history from the CURES database no earlier than 24 hours, or the previous business day, before he or she prescribes, orders, administers, or furnishes a Schedule II, Schedule III, or Schedule IV controlled substance to the patient.
(b) The duty to consult the CURES database, as described in subdivision (a), does not apply to veterinarians or pharmacists.
(c) The duty to consult the CURES database, as described in subdivision (a), does not apply to a health care practitioner in any of the following circumstances:
(1) If a health care practitioner prescribes, orders, or furnishes a controlled substance to be administered to a patient while the patient is admitted to any of the following facilities or during an emergency transfer between any of the following facilities for use while on facility premises:
(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.
(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.
(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.
(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.
(2) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance in the emergency department of a general acute care hospital and the quantity of the controlled substance does not exceed a nonrefillable seven-day supply of the controlled substance to be used in accordance with the directions for use.
(3) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient as part of the patient’s treatment for a surgical procedure and the quantity of the controlled substance does not exceed a nonrefillable five-day supply of the controlled substance to be used in accordance with the directions for use, in any of the following facilities:
(A) A licensed clinic, as described in Chapter 1 (commencing with Section 1200) of Division 2.
(B) An outpatient setting, as described in Chapter 1.3 (commencing with Section 1248) of Division 2.
(C) A health facility, as described in Chapter 2 (commencing with Section 1250) of Division 2.
(D) A county medical facility, as described in Chapter 2.5 (commencing with Section 1440) of Division 2.
(E) A place of practice, as defined in Section 1658 of the Business and Professions Code.
(4) If a health care practitioner prescribes, orders, administers, or furnishes a controlled substance to a patient currently receiving hospice care, as defined in Section 1339.40.
(5) (A) If all of the following circumstances are satisfied:
(i) It is not reasonably possible for a health care practitioner to access the information in the CURES database in a timely manner.
(ii) Another health care practitioner or designee authorized to access the CURES database is not reasonably available.
(iii) The quantity of controlled substance prescribed, ordered, administered, or furnished does not exceed a nonrefillable five-day supply of the controlled substance to be used in accordance with the directions for use and no refill of the controlled substance is allowed.
(B) A health care practitioner who does not consult the CURES database under subparagraph (A) shall document the reason he or she did not consult the database in the patient’s medical record.
(6) If the CURES database is not operational, as determined by the department, or when it cannot be accessed by a health care practitioner because of a temporary technological or electrical failure. A health care practitioner shall, without undue delay, seek to correct any cause of the temporary technological or electrical failure that is reasonably within his or her control.
(7) If the CURES database cannot be accessed because of technological limitations that are not reasonably within the control of a health care practitioner.
(8) If consultation of the CURES database would, as determined by the health care practitioner, result in a patient’s inability to obtain a prescription in a timely manner and thereby adversely impact the patient’s medical condition, provided that the quantity of the controlled substance does not exceed a nonrefillable five-day supply if the controlled substance were used in accordance with the directions for use.
(d) (1) A health care practitioner who fails to consult the CURES database, as described in subdivision (a), shall be referred to the appropriate state professional licensing board solely for administrative sanctions, as deemed appropriate by that board.
(2) This section does not create a private cause of action against a health care practitioner. This section does not limit a health care practitioner’s liability for the negligent failure to diagnose or treat a patient.
(e) This section is not operative until six months after the Department of Justice certifies that the CURES database is ready for statewide use and that the department has adequate staff, which, at a minimum, shall be consistent with the appropriation authorized in Schedule (6) of Item 0820-001-0001 of the Budget Act of 2016 (Chapter 23 of the Statutes of 2016), user support, and education. The department shall notify the Secretary of State and the office of the Legislative Counsel of the date of that certification.
(f) All applicable state and federal privacy laws govern the duties required by this section.
(g) The provisions of this section are severable. If any provision of this section or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.

Summary: Existing law classifies certain controlled substances into designated schedules. Existing law requires the Department of Justice to maintain the Controlled Substance Utilization Review and Evaluation System (CURES) for the electronic monitoring of the prescribing and dispensing of Schedule II, Schedule III, and Schedule IV controlled substances by all practitioners authorized to prescribe, administer, furnish, or dispense these controlled substances. Existing law requires dispensing pharmacies and clinics to report specified information for each prescription of a Schedule II, Schedule III, or Schedule IV controlled substance to the department.
This bill would require a health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance to consult the CURES database to review a patient’s controlled substance history no earlier than 24 hours, or the previous business day, before prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient for the first time and at least once every 4 months thereafter if the substance remains part of the treatment of the patient. The bill would exempt a veterinarian and a pharmacist from this requirement. The bill would also exempt a health care practitioner from this requirement under specified circumstances, including, among others, if prescribing, ordering, administering, or furnishing a controlled substance to a patient receiving hospice care, to a patient admitted to a specified facility for use while on facility premises, or to a patient as part of a treatment for a surgical procedure in a specified facility if the quantity of the controlled substance does not exceed a nonrefillable 5-day supply of the controlled substance that is to be used in accordance with the directions for use. The bill would require, if a health care practitioner authorized to prescribe, order, administer, or furnish a controlled substance is not required to consult the CURES database the first time he or she prescribes, orders, administers, or furnishes a controlled substance to a patient pursuant to one of those exemptions, the health care practitioner to consult the CURES database before subsequently prescribing a Schedule II, Schedule III, or Schedule IV controlled substance to the patient and at least once every 4 months thereafter if the substance remains part of the treatment of the patient.
This bill would provide that a health care practitioner who fails to consult the CURES database is required to be referred to the appropriate state professional licensing board solely for administrative sanctions, as deemed appropriate by that board. The bill would make the above-mentioned provisions operative 6 months after the Department of Justice certifies that the CURES database is ready for statewide use and that the department has adequate staff, user support, and education, as specified.
This bill would also exempt a health care practitioner, pharmacist, and any person acting on behalf of a health care practitioner or pharmacist, when acting with reasonable care and in good faith, from civil or administrative liability arising from any false, incomplete, inaccurate, or misattributed information submitted to, reported by, or relied upon in the CURES database or for any resulting failure of the CURES database to accurately or timely report that information.
Existing law requires the operation of the CURES database to comply with all applicable federal and state privacy and security laws and regulations. Existing law authorizes the disclosure of data obtained from the CURES database to agencies and entities only for specified purposes and requires the Department of Justice to establish policies, procedures, and regulations regarding the use, access, disclosure, and security of the information within the CURES database.
This bill would authorize a health care practitioner to provide a patient with a copy of the patient’s CURES patient activity report if no additional CURES data is provided. The bill would also prohibit a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances from obtaining data from the CURES database.