ALWIN CARL LEWIS, Petitioner, v. THE SUPERIOR COURT OF LOS ANGELES COUNTY, Respondent; MEDICAL BOARD OF CALIFORNIA, Real Party in Interest.
S219811
IN THE SUPREME COURT OF CALIFORNIA
Filed 7/17/17
Ct.App. 2/3 B252032; Los Angeles County Super. Ct. No. BS 139289; Judge: Joanne B. O‘Donnell
CURES was created in 1996 in an effort to move California‘s preexisting drug monitoring program online. (Sen. Com. on Crim. Proc., Analysis of Assem. Bill No. 3042 (1995–1996 Reg. Sess.) as amended Mar. 28, 1996.) CURES is maintained by the California Department of Justice (DOJ) and is designed to “assist health care practitioners in their efforts to ensure appropriate prescribing, ordering, administering, furnishing, and dispensing of controlled substances,” and to help “law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of [Schedule II-IV] controlled substances.” (
CURES requires any pharmacy or dispenser that prescribes or dispenses controlled substances listed on Schedules II, III, or IV to keep a record of the prescription and to report specific information to the DOJ as soon as reasonably possible, subject to certain exceptions. (
In 2009, the Attorney General launched the Prescription Drug Monitoring Program (PDMP) system, which allows preregistered users, including licensed health care prescribers, pharmacists, law enforcement, and regulatory boards, to obtain from CURES real-time patient history information concerning controlled substances. (Brown Unveils Real Time Statewide Prescription Drug Monitoring System (Sept. 15, 2009) <https://oag.ca.gov/news/press-releases/brown-unveils-real-time-statewide-prescription-drug-monitoring-system> [as of July 17, 2017].) Before the PDMP system, users had to request information from CURES by fax, mail, or phone, and had to wait a few days to receive the information. (Sen. Health Com., Analysis of Sen. Bill No. 1071 (2009–2010 Reg. Sess.) as amended Apr. 28, 2010, p. 4.)
The Board investigates physicians based on complaints or on its own initiative. (
II.
In November 2008, the Board initiated an investigation of Dr. Alwin Carl Lewis as a result of a patient‘s complaint in August 2008 alleging that Lewis recommended she lose weight by engaging in a “five-bite” diet. A participant in this diet does not eat breakfast, has five bites of food for lunch, and five bites of food for dinner.
In the initial stages of the investigation, the Board investigator assigned to the case obtained a CURES prescriber activity report on Lewis. The report was 205 pages long and contained the prescription information of hundreds of patients. Before obtaining the CURES report, the Board investigator did not obtain patient authorization or issue any subpoenas. After reviewing the report, the Board asked five of Lewis‘s patients for release of their full medical records. Three patients gave their consent, and the Board obtained the other two patients’ records via administrative subpoenas. The investigator also requested and obtained a copy of Lewis‘s prescribing history from CVS Pharmacy, Inc. (CVS) for the prior three years.
Prior to the administrative hearing, Lewis filed a motion to dismiss the allegations related to the five additional patients. Lewis argued that by obtaining the CURES reports without a warrant, subpoena, or good cause, the Board violated his patients’ privacy rights. The administrative law judge (ALJ) denied Lewis‘s motion, stating that the government‘s interest in obtaining the reports in a highly regulated area outweighed the invasion of privacy.
Following the eight-day administrative hearing, the ALJ concluded that Lewis engaged in unprofessional conduct, engaged in negligent acts, and failed to maintain adequate records. The ALJ recommended revoking Lewis‘s license but staying the revocation and placing Lewis on probation for three years. The Board adopted the ALJ‘s recommendation.
Lewis next filed a writ of administrative mandamus in the Los Angeles County Superior Court seeking to set aside the Board‘s decision, arguing that the Medical Board violated “fundamental privacy protections guaranteed under state and federal law.” The superior court denied Lewis‘s petition, concluding that “[t]he public health and safety concern served by the monitoring and regulation of the prescription of controlled substances serves a compelling public interest that justifies disclosure of prescription records without notification or consent.”
Lewis then filed a petition for writ of mandate in the Court of Appeal, again seeking to set aside the Board‘s disciplinary decision because the Board‘s decision violated his patients’ right to privacy. The court interpreted his challenge to be one based on the right to privacy under
Applying the framework set forth in Hill v. National Collegiate Athletic Association (1994) 7 Cal.4th 1 (Hill), the Court of Appeal determined that Lewis did not satisfy the threshold elements required to establish that the Board‘s actions involved a significant intrusion on a privacy interest protected by the state Constitution‘s privacy provision. Specifically, the court held that although there is a legally protected privacy right in medical records, the “well-known and long-established regulatory
The Court of Appeal went on to conclude that even if Lewis had satisfied the threshold elements to establish a right to privacy on behalf of his patients, the invasion of privacy was justified because it furthered two compelling government interests: “controlling the diversion and abuse of controlled substances” and “protect[ing] the public against incompetent, impaired, or negligent physicians.” “Balancing the state‘s substantial interest in preventing the abuse and diversion of controlled substances and protecting the public health against the minor intrusion upon a patient‘s informational privacy in his or her controlled substances prescription records stored in CURES,” the court concluded that “the Board‘s actions here in accessing and compiling data from CURES did not violate article I, section 1 of the California Constitution.” We granted review.
III.
A.
We first address the Board‘s contention that Lewis lacks standing to assert his patients’ privacy rights under
Although the Board recognizes that physicians may assert their patients’ privacy interests in certain cases, it argues that those cases are limited to contexts where the physician is the custodian of the records or where his interests align with his patients’ interests. The Board argues that because Lewis is not the custodian of the records in this case and his interests do not align with his patients‘, he should not be permitted to assert his patients’ rights.
We do not agree that Lewis‘s interests are at odds with his patients’ interests. Because an individual‘s prescription records contain intimate details about his or her medical conditions, the government‘s ability to access these records may cause patients to hesitate to seek appropriate medical treatment. (Whalen v. Roe (1977) 429 U.S. 589, 602 (Whalen) [“Unquestionably, some individuals’ concern for their own privacy may lead them to avoid or to postpone needed medical attention.“]; Ferguson v. City of Charleston (2001) 532 U.S. 67, 78, fn. 14 [an intrusion on privacy “may have adverse consequences because it may deter patients from receiving needed medical care“].) Because a physician has an interest in patients seeking appropriate treatment and using appropriate medication, the Board‘s actions are “inextricably bound up with the activity the litigant wishes to pursue” in this case. (Singleton, supra, 428 U.S. at p. 114.) Moreover, the patients’ rights are “likely to be diluted or adversely affected” unless Lewis is permitted to assert their rights on their behalf. (Griswold v. Connecticut (1965) 381 U.S. 479, 481.) In this case, the patients are unable to assert their own rights because they were never given notice that their records were accessed.
The Board relies on Pating v. Board of Medical Quality Assurance (1982) 130 Cal.App.3d 608, where the Court of Appeal held that the petitioner did not have standing to object to the introduction of third-party medical records in part because a majority of the patients whose records were subpoenaed appeared at the administrative hearing and voluntarily consented to the introduction of their medical records. (Id. at p. 621.) The Board makes a similar argument here, contending that Lewis should not be permitted to assert his patients’ privacy rights because after the access of the CURES records, when five of the patients were informed that the Board sought their complete medical records, three gave consent and the other two did not object. We need not decide what effect, if any, the subsequent consent of the three patients has on Lewis‘s standing because Lewis would still be entitled to assert the rights of the nonconsenting patients. Finally, the Board relies on Pating for the suggestion that “having allegedly victimized his patients, [Lewis] should not be permitted standing to thus assert their privacy rights for his own protection.” (Ibid.) Even assuming this rule applies in some contexts, this line of reasoning is inapplicable where, as here, Lewis is not alleged to have victimized all of the patients whose rights he seeks to assert.
B.
We now turn to the merits of Lewis‘s constitutional claim. In Hill, a case involving a challenge to the student-athlete drug testing policies of the National Collegiate Athletic Association (NCAA), we articulated a two-part inquiry for determining whether the right to privacy under article I, section 1 has been violated. (Hill, supra, 7 Cal.4th at p. 26.)
First, the complaining party must meet three ” ‘threshold elements’ . . . utilized to screen out claims that do not involve a significant intrusion on a privacy interest protected by the state constitutional privacy provision.” (Loder v. City of Glendale (1997) 14 Cal.4th 846, 893 (Loder).) The party must demonstrate “(1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of privacy.” (Hill, supra, 7 Cal.4th at pp. 39–40.) This initial inquiry is necessary to “permit courts to weed out claims that involve so insignificant or de minimis an intrusion on a constitutionally protected privacy interest as not even to require an explanation or justification by the defendant.” (Loder, at p. 893.)
The standard that a defendant‘s proffered countervailing interests must satisfy varies based on the privacy interest asserted: “Where the case involves an obvious invasion of an interest fundamental to personal autonomy, e.g., freedom from involuntary sterilization or the freedom to pursue consensual familial relationships, a ‘compelling interest’ must be present to overcome the vital privacy interest. If in contrast, the privacy interest is less central, or in bona fide dispute, general balancing tests are employed.” (Hill, supra, 7 Cal.4th at p. 34.) “The existence of a sufficient countervailing interest or an alternative course of conduct present[s] threshold questions of law for the court. The relative strength of countervailing interests and the feasibility of alternatives present mixed questions of law and fact. . . . [I]n cases where material facts are undisputed, adjudication as a matter of law may be appropriate.” (Id. at p. 40.)
1.
Lewis claims that the Board violated article I, section 1 of the California Constitution by accessing his patients’ CURES records. We reject this claim because, even assuming the Board‘s actions constituted a serious intrusion on a legally protected privacy interest, its review of these records was justified by the state‘s dual interest in protecting the public from the unlawful use and diversion of a particularly dangerous class of prescription drugs and protecting patients from negligent or incompetent physicians.
The Court of Appeal assumed without deciding that if Lewis were able to satisfy the three threshold elements, the Board would be required to establish a compelling interest. In Hill, we “decline[d] to hold that every assertion of a privacy interest under article I, section 1 must be overcome by a ‘compelling interest.’ ” (Hill, supra, 7 Cal.4th at pp. 34–35Id. at p. 34; see Hernandez v. Hillsides, Inc. (2009) 47 Cal.4th 272, 288 (Hernandez) [“except in the rare case in which a ‘fundamental’ right of personal autonomy is involved[,] the defendant need not present a ‘compelling’ countervailing interest“].)
The Board‘s actions in this case do not implicate a fundamental autonomy right. It is true that the disclosure of information from the CURES database may chill patients’ willingness to pursue treatment. But it cannot “be said that any individual has been deprived of the right to decide independently, with the advice of his physician, to acquire and to use needed medication. Although the State no doubt could prohibit entirely the use of particular [Schedule II, III, or IV] drugs, it has not done so. This case is therefore unlike those in which the Court has held that a total prohibition of certain conduct was an impermissible deprivation of liberty.” (Whalen, supra, 429 U.S. at p. 603, fn. omitted.) The disclosure of information from CURES may be one consideration affecting a patient‘s choice to pursue treatment, but it does not significantly impair the patient‘s ultimate ability to make that choice on his or her own. Because the Board‘s actions do not intrude on a fundamental autonomy right, we apply a general balancing test to assess the Board‘s actions in this case.
Under that test, the “[i]nvasion of a privacy interest is not a violation of the state constitutional right to privacy if the invasion is justified by a competing interest. Legitimate interests derive from the legally authorized and socially beneficial activities of government and private entities. Their relative importance is determined by their proximity to the central functions of a particular public or private enterprise. Conduct alleged to be an invasion of privacy is to be evaluated based on the extent to which it furthers legitimate and important competing interests.” (Hill, supra, 7 Cal.4th at p. 38.)
The Board does not bear the burden of showing it adopted the least intrusive means of achieving its legitimate objectives. In Hill, we said that “[l]ike the ‘compelling interest’ standard, the argument that such a ‘least restrictive alternative’ burden must invariably be imposed on defendants in privacy cases derives from decisions that: (1) involve clear invasions of central, autonomy-based privacy rights, particularly in the areas of free expression and association, procreation, or government-provided benefits in areas of basic human need; or (2) are directed against the invasive conduct of government agencies rather than private, voluntary organizations.” (Hill, supra, 7 Cal.4th at p. 49.) Seizing on the language directed at the “invasive conduct of government agencies” (ibid.), Lewis argues that any time we consider the impact of the government‘s actions on a privacy interest, the “least restrictive alternative” must be imposed. This interpretation ignores the footnote associated with this passage in Hill summarizing cases where the “least restrictive alternative” burden has been applied; that footnote says “at the roots of the ‘least restrictive alternative’ burden lie cases of government infringement of fundamental freedoms of expression and association.” (Id. at p. 49, fn. 16.) This case does not involve a government infringement of any fundamental freedom of expression and association.
Although the Board does not bear the burden of showing it has adopted the least intrusive means to monitor the flow of prescription drugs, evidence of less intrusive alternatives is relevant in balancing the government‘s interests against the privacy intrusion at issue. (Hill, supra, 7 Cal.4th at p. 40 [“The plaintiff . . . may rebut a defendant‘s assertion of countervailing interests by showing there are feasible and effective alternatives to defendant‘s conduct which have a lesser impact on privacy interests.“].) In Hill, despite finding that the NCAA‘s drug testing program was reasonably calculated to further its legitimate interests in maintaining the integrity of athletic competition and the health and safety of student athletes, we went on to consider the alternative methods proposed by the plaintiffs. (Id. at p. 50.) Ultimately, we determined that “[b]ecause plaintiffs failed to demonstrate
Lewis asserts that a good cause requirement in this context is a feasible alternative, citing as examples several cases involving Board access to patients’ medical records. (See Gherardini, supra, 93 Cal.App.3d at p. 680; Wood, supra, 166 Cal.App.3d at pp. 1148–1150; Bearman v. Superior Court (2004) 117 Cal.App.4th 463, 468–470.) But medical records contain far more sensitive information than do prescription records. A patient‘s complete medical file may include descriptions of symptoms, family history, diagnoses, test results, and other intimate details concerning treatment. Moreover, a reasonable patient would know or should know that the government monitors the sale and distribution of controlled substances, and that prescription records are routinely reviewed by pharmacists and insurance companies. The same cannot be said of a patient‘s comprehensive medical record. Patients are also on notice that under the Information Practices Act, personal information may be shared among government agencies “in a manner that would link the information disclosed to the individual” so long as “the transfer is necessary for the transferee agency to perform its constitutional or statutory duties, and the use is compatible with a purpose for which the information was collected . . . .” (
The Board argues that real-time access to CURES is essential to closely monitoring the prescribing and dispensing of controlled substances because it gives the Board the ability to “spot-check prescribers for compliance with both the laws and standards of care governing controlled substance prescriptions, potentially preventing the Board from detecting and addressing problems before they result in patient harm.” The Board further argues that if it “were required to provide notice to patients and develop good cause as understood by the Courts of Appeal in the medical records context before obtaining records of controlled substances prescriptions from the Department, it would delay the Board‘s ability to identify and correct potentially dangerous practices.” We agree that a good cause requirement would compromise the Board‘s ability to identify and address potentially dangerous prescribing practices. Requiring the Board to present evidence to a judicial officer establishing good cause as part of its preliminary investigations could result in protracted legal battles that effectively derail those investigations. Patients who objected to subpoenas to compel disclosure of their medical records on
Thus, although Lewis‘s proposed alternative would reduce the impact on patients’ privacy interests, it is not an equally effective or feasible alternative to the Board‘s current approach. It is possible there are ways to limit the privacy intrusion on patients without hampering the Board‘s ability to investigate unsafe medical practices. For instance, the Board could take steps to anonymize patients’ prescription information prior to accessing the CURES database. But the parties do not propose this alternative or address its feasibility, and we do not consider the merits of such an approach here. Moreover, our rejection of an individualized good cause requirement should not be understood to suggest that Board investigators may access the CURES database for any reason. Such access must be for the purpose of aiding “law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of [Schedule II-IV] controlled substances” (
The Board further argues that its review of the CURES data is not unconstitutional because there are sufficient protocols in place to prevent public disclosure. We have previously explained that “[p]rotective measures, safeguards and other alternatives may minimize the privacy intrusion” and thus should be considered when balancing a plaintiff‘s privacy interest against a defendant‘s countervailing interests. (Pioneer Electronics, supra, 40 Cal.4th at p. 371.) ” ‘For example, if intrusion is limited and confidential information is carefully shielded from disclosure except to those who have a legitimate need to know, privacy concerns are assuaged.’ ” (Ibid., quoting Hill, supra, 7 Cal.4th at p. 38.)
Here, several provisions of law prohibit the wrongful public disclosure of personal information obtained from CURES. CURES data may only be provided to “appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes.” (
We note that adequate protections against public disclosure do not obviate constitutional concerns as privacy interests are still implicated when the government accesses personal information without disseminating it. That said, we ultimately agree with the Board that the safeguards here limit the degree to which patients’ privacy is invaded when the Board examines their prescription records.
In view of the considerations above, we find that the balance tips in favor of the Board‘s interests in protecting the public from unlawful use and diversion of a particularly dangerous class of prescription drugs and protecting patients from negligent or incompetent physicians. Because any potential invasion of privacy caused by the Board‘s actions was justified by countervailing interests, we conclude that the Board did not violate article I, section 1 of the California Constitution when it obtained patient prescription records from CURES.
2.
In addition to challenging the Board‘s review of the CURES records, Lewis asserts that the Board violated his patients’ rights to privacy when, after searching the CURES database, it obtained prescription records from CVS without good cause, a warrant, or notice to his patients. Lewis has forfeited this claim.
Lewis‘s challenge at the administrative hearing, as well as his petition for a writ of administrative mandate before the superior court, focused entirely on
IV.
Lewis also asserts that the Board‘s access of the CURES records violates the Fourth Amendment to the United States Constitution. We agree with the Board that Lewis has forfeited this claim on behalf of his patients by failing to raise it at the administrative proceedings or before the superior court. Lewis‘s fleeting references to “fundamental privacy protections guaranteed under state and federal law” were insufficient to preserve the issue. His claims before the Board and the trial court were supported entirely on the basis of the California Constitution. Lewis‘s argument may be more convincing if he had presented arguments under
CONCLUSION
For the reasons above, we affirm the judgment of the Court of Appeal.
LIU, J.
WE CONCUR:
CANTIL-SAKAUYE, C. J.
WERDEGAR, J.
CHIN, J.
CORRIGAN, J.
CUÉLLAR, J.
KRUGER, J.
CONCURRING OPINION BY LIU, J.
In concluding that the government interests in protecting patients and the public justify the Medical Board of California‘s access to the prescription drug database here, our opinion today assumes without deciding that Dr. Alwin Carl Lewis has met the threshold elements of an
Lewis contends that the Medical Board of California (Board) violated his patients’ right to privacy under article I, section 1 of the California Constitution by examining, without good cause, their prescription records maintained in the Controlled Substance Utilization Review and Evaluation System (CURES) database. A party asserting such a claim must demonstrate “(1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of privacy.” (Hill v. Nat. Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 39–40 (Hill).)
The Board concedes that the first element is satisfied here because patients have a legally recognized privacy interest in their prescription records. The records stored in CURES contain “sensitive and confidential information” (Hill, supra, 7 Cal.4th at p. 35) that is protected by the right to privacy under the California Constitution, and the sensitivity of this information is reflected in the confidentiality provision of the CURES statute itself. (
As to the second element (reasonable expectation of privacy), it is relevant that “medical records contain far more sensitive information than do prescription records” and that patients “know or should know that the government monitors the sale and distribution of controlled substances, and that prescription records are routinely reviewed by pharmacists and insurance companies.” (Maj. opn., ante, at p. 15.) But these considerations do not mean that patients have no reasonable expectation of privacy with regard to their prescription records. Many of the drugs classified as Schedule II, Schedule III, and Schedule IV controlled substances are approved only for the treatment of specific and often sensitive medical conditions or symptoms. For example, testosterone, a Schedule III controlled substance, is used to treat hypogonadism, a condition in which the male‘s testicles do not produce enough testosterone. (
The fact that the government regulates controlled substances does not eliminate patients’ reasonable expectation of privacy. A pervasive regulatory scheme has less significance when the area being regulated is particularly sensitive. (Cf. Tucson Woman‘s Clinic v. Eden (9th Cir. 2004) 379 F.3d 531, 550 [closely regulated industry exception to the warrant requirement does not apply to abortion clinics, “where the expectation of privacy is heightened“].) Moreover, “it plainly would defeat the voters’ fundamental purpose in establishing a constitutional right of privacy if a defendant could defeat a constitutional claim simply by maintaining that statutory provisions or past practices that are inconsistent with the constitutionally protected right eliminate any ‘reasonable expectation of privacy’ with regard to the constitutionally protected right.” (American Academy of Pediatrics v. Lungren (1997) 16 Cal.4th 307, 339; see Delaware v. Prouse (1979) 440 U.S. 648, 662 [“An individual . . . does not lose all reasonable expectation of privacy simply because [an activity is] subject to government regulation.“].)
It is also relevant that patients do not choose to participate in the prescription drug monitoring program. Instead, patients typically take prescription drugs for nonvoluntary, legitimate medical purposes. (
Finally, Lewis has demonstrated “a serious invasion of privacy.” (Hill, supra, 7 Cal.4th at p. 40.) ” ‘[T]his element is intended simply to screen out intrusions on privacy that are de minimis or insignificant.’ ” (American Academy of Pediatrics v. Lungren, supra, 16 Cal.4th at p. 339.) The Board argues that any intrusion on patients’ privacy is insignificant because there are sufficient protocols to prevent public disclosure. Although such protective measures may limit the extent of privacy invasion, they do not render an intrusion de minimis for purposes of this threshold inquiry. (See maj. opn., ante, at p. 18 [“privacy interests are still implicated when the government accesses personal information without disseminating it“]; Hill, at p. 27, fn. 7 [“Particularly when professional or fiduciary relationships premised on confidentiality are at issue (such as doctor and patient or psychotherapist and client), the state constitutional right to privacy may be invaded by a less-than-public dissemination of information.“].)
The electorate was concerned about more than public disclosure when it passed the Privacy Initiative in 1972. The voters were concerned that their privacy was violated whenever their personal information was used or accessed without reason. (See White v. Davis (1975) 13 Cal.3d 757, 775 [the initiative was intended to curtail “the improper use of information properly obtained for a specific purpose, for example, the use of it for another purpose or the disclosure of it to some third party“]; Ballot Pamp., Proposed Stats. and Amends. to Cal. Const. with arguments to voters, Gen. Elec. (Nov. 7, 1972) p. 27 [“Fundamental to our privacy is the ability to control circulation of personal information. . . . The proliferation of government and business records over which we have no control limits our ability to control our personal lives. Often we do not know that these records even exist and we are certainly unable to determine who has access to them.“].) This concern is even more pressing today because advances in data science have enabled sophisticated analyses of curated information as to a particular person. Where, as here, one government agency discloses patients’ sensitive medical information to another, the privacy intrusion cannot be dismissed as trivial.
In sum, the disclosure of CURES data to the Board is not a de minimis intrusion on patients’ reasonable and legally protected privacy interests. But,
LIU, J.
I CONCUR:
KRUGER, J.