(c)

1. (1) The operation of CURES shall comply with all applicable federal and state privacy and security laws and regulations.

2. (2)

   1. (A) CURES shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients. Data obtained from CURES shall only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or criminal purposes and to other agencies or entities, as determined by the department, for the purpose of educating practitioners and others in lieu of disciplinary, civil, or criminal actions. Data may be provided to public or private entities, as approved by the department, for educational, peer review, statistical, or research purposes, if patient information, including information that may identify the patient, is not compromised. The University of California shall be provided access to identifiable data for research purposes if the requirements of subdivision (t) of Section 1798.24 of the Civil Code are satisfied. Further, data disclosed to an individual or agency as described in this subdivision shall not be disclosed, sold, or transferred to a third party, unless authorized by, or pursuant to, state and federal privacy and security laws and regulations. The department shall establish policies, procedures, and regulations regarding the use, access, evaluation, management, implementation, operation, storage, disclosure, and security of the information within CURES, consistent with this subdivision.
   2. (B) Notwithstanding subparagraph (A), a regulatory board whose licensees do not prescribe, order, administer, furnish, or dispense controlled substances shall not be provided data obtained from CURES.

   3. (C)

      1. (i) Notwithstanding subparagraph (A) or any other law, a state or local agency or employee, appointee, officer, contractor, or official or any other person acting on behalf of a public agency shall not knowingly provide any CURES data or knowingly expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil, criminal, or disciplinary liability based on another state’s laws for the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.
      2. (ii) This section does not prohibit the investigation of any activity that is punishable as a crime under the laws of this state so long as CURES data related to any legally protected health care activity, as defined in Section 1798.300 of the Civil Code, is not knowingly shared with any individual or entity from another state.
      3. (iii) This section does not prohibit compliance with an audit or investigation of activity that is unlawful under the laws of this state or federal law, or with an audit, review, or investigation conducted for purposes of licensure, registration, accreditation, or certification under the laws of this state or federal law or pursuant to an accrediting organization recognized by the State Department of Public Health or the federal Centers for Medicare and Medicaid Services.

3. (3) The department may adopt regulations regarding the access and use of the information within CURES. The department shall consult with all stakeholders identified by the department during the rulemaking process. The regulations shall, at a minimum, address all of the following in a manner consistent with this chapter:

   1. (A) The process for approving, denying, and disapproving individuals or entities seeking access to information in CURES.
   2. (B) The purposes for which a health care practitioner may access information in CURES.
   3. (C) The conditions under which a warrant, subpoena, or court order is required for a law enforcement agency to obtain information from CURES as part of a criminal investigation.
   4. (D) The process by which information in CURES may be provided for educational, peer review, statistical, or research purposes.
4. (4) In accordance with federal and state privacy laws and regulations, a health care practitioner may provide a patient with a copy of the patient’s CURES patient activity report as long as no additional CURES data are provided and the health care practitioner keeps a copy of the report in the patient’s medical record in compliance with subdivision (d) of Section 11165.1.

(d) Except as provided in subdivision (k), for each prescription for a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, specifically Sections 1308.12, 1308.13, 1308.14, and 1308.15, respectively, of Title 21 of the Code of Federal Regulations, the dispensing pharmacy, clinic, or other dispenser shall report the following information to the department or contracted prescription data processing vendor as soon as reasonably possible, but not more than one working day after the date a controlled substance is released to the patient or patient’s representative, in a format specified by the department:

1. (1) Full name, address, and, if available, telephone number of the ultimate user or research subject, or contact information as determined by the Secretary of the United States Department of Health and Human Services, and the gender and date of birth of the ultimate user.
2. (2) The prescriber’s category of licensure, license number, national provider identifier (NPI) number, if applicable, the federal controlled substance registration number, and the state medical license number of a prescriber using the federal controlled substance registration number of a government-exempt facility.
3. (3) Pharmacy prescription number, license number, NPI number, and federal controlled substance registration number.
4. (4) National Drug Code (NDC) number of the controlled substance dispensed.
5. (5) Quantity of the controlled substance dispensed.
6. (6) The International Statistical Classification of Diseases (ICD) Code contained in the most current ICD revision, or any revision deemed sufficient by the State Board of Pharmacy, if available.
7. (7) Number of refills ordered.
8. (8) Whether the drug was dispensed as a refill of a prescription or as a first-time request.
9. (9) Prescribing date of the prescription.
10. (10) Date of dispensing of the prescription.
11. (11) The serial number for the corresponding prescription form, if applicable.

(h)

1. (1) The department may enter into an agreement with an entity operating an interstate data sharing hub, or an agency operating a prescription drug monitoring program in another state, for purposes of interstate data sharing of prescription drug monitoring program information. An out-of-state authorized user who obtains CURES data through the interstate data sharing hub shall not provide any CURES data in furtherance of any investigation or proceeding seeking to impose civil, criminal, or disciplinary liability based on another state’s laws for the provision or receipt of legally protected health care activity, as defined in Section 1798.300 of the Civil Code.
2. (2) Data obtained from CURES may be provided to authorized users of another state’s prescription drug monitoring program, as determined by the department pursuant to subdivision (c), if the entity operating the interstate data sharing hub, and the prescription drug monitoring program of that state, as applicable, have entered into an agreement with the department for interstate data sharing of prescription drug monitoring program information.
3. (3) An agreement entered into by the department for purposes of interstate data sharing of prescription drug monitoring program information shall ensure that all access to data obtained from CURES and the handling of data contained within CURES comply with California law, including regulations, and meet the same patient privacy, audit, and data security standards employed and required for direct access to CURES.
4. (4) For purposes of interstate data sharing of CURES information pursuant to this subdivision, an authorized user of another state’s prescription drug monitoring program shall not be required to register with CURES, if the authorized user is registered and in good standing with that state’s prescription drug monitoring program.
5. (5) The department shall not enter into an agreement pursuant to this subdivision until the department has issued final regulations regarding the access and use of the information within CURES as required by paragraph (3) of subdivision (c).
6. (6) Notwithstanding subdivision (c), the department shall not provide CURES data to out-of-state law enforcement absent a warrant, subpoena, or court order, issued pursuant to Section 2029.300 or 2029.350 of the Code of Civil Procedure, or Section 1326 of the Penal Code.

(k)

1. (1) Notwithstanding subdivision (d), a prescription for or the dispensing of testosterone or mifepristone shall not be reported to the department, CURES, or a contracted prescription data processing vendor.
2. (2) On or before January 1, 2027, the department shall remove existing records of a prescription described in this subdivision created or maintained prior to January 1, 2026.

(l)

1. (1) Any person who accesses the CURES database and who is not authorized by law to do so is guilty of a misdemeanor.
2. (2) Any person authorized by law to access the CURES database and who knowingly furnishes the information from the CURES database to a person who is not authorized by law to receive that information is guilty of a misdemeanor.
3. (3) This subdivision does not apply to a provider of health care as defined in Section 56.06 of the Civil Code that is subject to applicable state and federal medical privacy laws.