65 Cal.App.5th 621
Cal. Ct. App.2021Background
- The People sued opioid manufacturers (including Johnson & Johnson) alleging deceptive marketing caused a public-health crisis; the operative complaint sought injunctive relief, civil penalties, and nuisance remedies.
- Johnson & Johnson served subpoenas on Los Angeles and Alameda Counties seeking patient-level opioid prescription and substance-use treatment records (ORCHID, LACPRS, and Medi-Cal data), covering millions of encounters.
- The superior court ordered the counties to produce identified patient data to a private vendor (Rawlings) to deidentify and cross‑reference the datasets; only deidentified data would be provided to parties thereafter.
- Counties objected based on state constitutional informational privacy, federal substance-use confidentiality rules, and the risks of reidentification and data breaches; Johnson & Johnson relied on a protective order and asserted relevance for causation and apportionment defenses.
- Applying the Hill privacy framework and relying on this court’s Board of Registered Nursing decision, the Court of Appeal held the counties met the Hill threshold and Johnson & Johnson failed to identify countervailing interests sufficient to overcome the serious privacy invasion; the court granted writs, vacated the production order, and directed denial of the motions to compel.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether counties may assert third-party patients' state constitutional privacy rights | Counties can assert patients' rights because their interests align and third parties cannot practically protect themselves | Defendants disputed forfeiture but did not meaningfully contest standing | Counties may assert the patients’ privacy rights; standing permitted |
| Whether production of identified prescription and substance-use treatment records to a vendor for deidentification is a "serious invasion" under Hill | The nature (sensitive medical and substance-use records), massive scope (millions of encounters), and risks (reidentification, chilling treatment) make it a serious invasion | Protective order and post-production deidentification sufficiently protect privacy | The order met Hill’s threshold: it threatened a serious invasion of privacy |
| Whether defendants demonstrated countervailing interests that justify disclosure | Counties: defendants offered only vague relevance and failed to show necessity or lack of less-intrusive alternatives | Defendants: data needed for causation, apportionment, and cross-referencing with other datasets; protective measures suffice | Defendants failed to show their asserted needs outweighed privacy interests; discovery unjustified |
| Reviewability and standard of review for the discovery order | Writ review is appropriate because disclosure would cause irreparable privacy harm; constitutional question reviewed de novo | Discovery rulings normally reviewed for abuse of discretion | Writ relief appropriate; constitutional application of Hill reviewed de novo; writ granted and order vacated |
Key Cases Cited
- Hill v. National Collegiate Athletic Assn., 7 Cal.4th 1 (1994) (art. I, § 1 privacy balancing framework and threshold elements)
- Lewis v. Superior Court, 3 Cal.5th 561 (2017) (third‑party assertion of patients’ privacy and limits on government access to prescription records)
- Williams v. Superior Court, 3 Cal.5th 531 (2017) (applying Hill to discovery disputes involving privacy)
- Board of Registered Nursing v. Superior Court, 59 Cal.App.5th 1011 (2021) (refusing broad production of CURES prescription data to vendor for deidentification)
- Calcor Space Facility, Inc. v. Superior Court, 53 Cal.App.4th 216 (1997) (nonparty discovery requires specific factual justification)
- County of Los Angeles v. Los Angeles County Employee Relations Com., 56 Cal.4th 905 (2013) (serious-invasion test under Hill: nature, scope, and impact)
- Grafilo v. Wolfsohn, 33 Cal.App.5th 1024 (2019) (informational privacy is the constitutional amendment’s central concern)
- Sander v. Superior Court, 26 Cal.App.5th 651 (2018) (issues and protocols for deidentification and reidentification risks)
- Snibbe v. Superior Court, 224 Cal.App.4th 184 (2014) (distinguishing required disclosure of redacted records from disclosure of identified records)
- Catholic Mutual Relief Society v. Superior Court, 42 Cal.4th 358 (2007) (permissible scope of nonparty discovery is narrower than party discovery)