California Code of Regulations › Title 11 - Law › Division 1 - Attorney General › Chapter 8.5 - Controlled Substance Utilization Review and Evaluation System (Cures) › Article 3 - Research › Section 828.4 - Restrictions on Use or Disclosure of Data Obtained from CURES

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) An
				  Interested Party must only use data from CURES to support the educational purposes,
				  Peer Review purposes, statistical purposes, or Research Purposes, as specified in
				  the Written Request for Aggregated Data, defined in section
				  828.5, subdivision (a), or Data Request
				  Application, defined in section
				  828.6, subdivision (a).
(b) For Identified Individual-Level Data or
				  De-Identified Individual-Level Data, a Bona Fide Researcher must only obtain data
				  from CURES during the access period defined in the Bona Fide Researcher's Data
				  Request Application.
(c) To protect
				  patient confidentiality and to confirm that data from CURES obtained in accordance
				  with this section is used for the purposes for which it was requested, the Bona Fide
				  Researcher must provide to the Department's Research Services, for review and
				  comment, sufficiently in advance of any publication or dissemination, a complete
				  draft of any report, evaluation, or other document, and the final publication. This
				  requirement is not applicable if the Bona Fide Researcher only obtains Aggregated
				  Data.
(d) An Interested Party must not
				  disclose, transfer, or disseminate data from CURES, unless expressly authorized by
				  this section or approved in writing by the Department's Research Services.
(e) A Bona Fide Researcher must not disclose or
				  disseminate any data or documents identifying any individual, including, but not
				  limited to, a patient, Prescriber, Out-of-State Prescriber, Pharmacist, or
				  Out-of-State Pharmacist, except to the Department's Research Services, absent the
				  written consent of that identified individual, unless approved in writing by the
				  Department's Research Services.
(f) A
				  Bona Fide Researcher must aggregate Identified Individual-Level Data or
				  De-Identified Individual-Level Data from CURES before it is published to ensure that
				  it does not create a risk of identifying individuals.
(g) An Interested Party must not release,
				  disclose, or disseminate data or documents from CURES in any form if there is a
				  reasonable possibility that an individual, including, but not limited to, a patient,
				  Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist, can be
				  directly or indirectly identified from the information released, unless approved in
				  writing by the Department's Research Services. Data from CURES is considered to have
				  a reasonable possibility of indirectly identifying an individual, including, but not
				  limited to, a patient, Prescriber, Out-of-State Prescriber, Pharmacist, or
				  Out-of-State Pharmacist, if it includes:
(1) Any of
				  the following identifying information:
(A)
				  Name.
(B) Date of birth.
(C) Race.
(D) Gender.
(E) Income.
(F) Ethnicity.
(G) Age.
(H) Health conditions.
(I) Use of a drug abuse treatment
				  facility.
(J) Pregnancy.
(K) HIPAA identifiers under 45 Code of Federal
				  Regulations part 164.514, subdivision (b)(2)(i), (10-1-20 Edition), incorporated by
				  reference in this chapter, including, but not limited to, any of the following:
1. Phone number.
2. Email address.
3. Social security number.
4. Driver's license number.
5. PII or any other personal information, if that
				  information, either alone or in combination with other factors, including geographic
				  area, creates a risk of indirectly identifying that individual, including, but not
				  limited to, a patient, Prescriber, Out-of-State Prescriber, Pharmacist, or
				  Out-of-State Pharmacist.
6. Geographical
				  units of fewer than 20,000 people.