California Code of Regulations › Title 11 - Law › Division 1 - Attorney General › Chapter 8.5 - Controlled Substance Utilization Review and Evaluation System (Cures) › Article 5 - Information Exchange Web Service › Section 830.3 - Requirements for HIT System Use of the Information Exchange Web Service

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) In accordance with Health and Safety Code
				  section
				  11165.1,
				  subdivision (a)(1)(E)(i), an entity that operates a HIT System is prohibited from
				  using or disclosing data from CURES received through the Information Exchange Web
				  Service for any purpose other than delivering the data from CURES to the authorized
				  Prescriber-User, Non-DEA Practitioner-User, or Pharmacist-User identified in section
				  830.3, subdivision (c)(5), or
				  performing data processing activities that may be necessary to enable the delivery,
				  unless authorized by, and pursuant to, State and federal privacy and security laws
				  and regulations.
(b) In accordance with
				  Health and Safety Code section
				  11165.1,
				  subdivision (a)(1)(E)(ii), and in the manner described in section
				  830.3, subdivision (c)(5), a HIT System
				  must authenticate the identity of the authorized Prescriber-User, Non-DEA
				  Practitioner-User, or Pharmacist-User initiating a request, or on whose behalf the
				  HIT System is initiating a request, to the Information Exchange Web
				  Service.
(c) In accordance with Health
				  and Safety Code section
				  11165.1,
				  subdivision (a)(1)(E)(ii), a HIT System, on behalf of an authorized Prescriber-User,
				  Non-DEA Practitioner-User, or Pharmacist-User, must submit all of the following
				  information to the Information Exchange Web Service with each request for a Patient
				  Activity Report:
(1) The date and time of the
				  search.
(2) Patient first name and
				  patient last name.
(3) Patient date of
				  birth.
(4) Search Period.
(5) The identification of the authorized
				  Prescriber-User, Non-DEA Practitioner-User, or Pharmacist-User for whom the HIT
				  System is submitting a request. A HIT System must only identify one authorized
				  Prescriber-User, Non-DEA Practitioner-User, or Pharmacist-User for each request. The
				  Prescriber-User, Non-DEA Practitioner-User, or Pharmacist-User whose identity is
				  submitted must be the intended recipient of the data.
(A) To authenticate the identity of the authorized
				  Prescriber-User, a HIT System must submit the Prescriber-User's first name,
				  Prescriber-User's last name, Prescriber-User's State License Number, and
				  Prescriber-User's national provider identifier number.
(B) To authenticate the identity of the authorized
				  Non-DEA Practitioner-User, a HIT System must submit the Non-DEA Practitioner-User's
				  first name, Non-DEA Practitioner-User's last name, Non-DEA Practitioner-User's State
				  License Number, and Non-DEA Practitioner-User's national provider identifier
				  number.
(C) To authenticate the identity
				  of the authorized Pharmacist-User, a HIT System must submit the Pharmacist-User's
				  first name, Pharmacist-User's last name, Pharmacist-User's State License Number, and
				  Pharmacist-User's pharmacy business name.