(a)

1. (1)

   1. (A)

      1. (i) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 shall, upon receipt of a federal Drug Enforcement Administration (DEA) registration, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the practitioner or their delegate the electronic history of controlled substances dispensed to an individual under the practitioner’s care based on data contained in the CURES Prescription Drug Monitoring Program (PDMP).
      2. (ii) A pharmacist shall, upon licensure, submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of a patient that is maintained by the department. Upon approval, the department shall release to the pharmacist or their delegate the electronic history of controlled substances dispensed to an individual under the pharmacist’s care based on data contained in the CURES PDMP.
      3. (iii) A licensed physician and surgeon who does not hold a DEA registration may submit an application developed by the department to obtain approval to electronically access information regarding the controlled substance history of the patient that is maintained by the department. Upon approval, the department shall release to the physician and surgeon or their delegate the electronic history of controlled substances dispensed to a patient under their care based on data contained in the CURES PDMP.
      4. (iv) The department shall implement its duties described in clauses (i), (ii), and (iii) upon completion of any technological changes to the CURES database necessary to support clauses (i), (ii), and (iii), or by October 1, 2022, whichever is sooner.

   2. (B) The department may deny an application or suspend a subscriber, for reasons that include, but are not limited to, the following:

      1. (i) Materially falsifying an application to access information contained in the CURES database.
      2. (ii) Failing to maintain effective controls for access to the patient activity report.
      3. (iii) Having their federal DEA registration suspended or revoked.
      4. (iv) Violating a law governing controlled substances or another law for which the possession or use of a controlled substance is an element of the crime.
      5. (v) Accessing information for a reason other than to diagnose or treat a patient, or to document compliance with the law.
   3. (C) An authorized subscriber shall notify the department within 30 days of a change to the subscriber account.
   4. (D) An approved health care practitioner, pharmacist, or a person acting on behalf of a health care practitioner or pharmacist pursuant to subdivision (b) of Section 209 of the Business and Professions Code may use the department’s online portal or a health information technology system that meets the criteria required in subparagraph (E) to access information in the CURES database pursuant to this section. A subscriber who uses a health information technology system that meets the criteria required in subparagraph (E) to access the CURES database may submit automated queries to the CURES database that are triggered by predetermined criteria.

   5. (E) An approved health care practitioner or pharmacist may submit queries to the CURES database through a health information technology system if the entity that operates the health information technology system certifies all of the following:

      1. (i) The entity will not use or disclose data received from the CURES database for a purpose other than delivering the data to an approved health care practitioner or pharmacist or performing data processing activities that may be necessary to enable the delivery unless authorized by, and pursuant to, state and federal privacy and security laws and regulations.

      2. (ii) The health information technology system will authenticate the identity of an authorized health care practitioner or pharmacist initiating queries to the CURES database and, at the time of the query to the CURES database, the health information technology system submits the following data regarding the query to CURES:

         1. (I) The date of the query.
         2. (II) The time of the query.
         3. (III) The first and last name of the patient queried.
         4. (IV) The date of birth of the patient queried.
         5. (V) The identification of the CURES user for whom the system is making the query.
      3. (iii) The health information technology system meets applicable patient privacy and information security requirements of state and federal law.
      4. (iv) The entity has entered into a memorandum of understanding with the department that solely addresses the technical specifications of the health information technology system to ensure the security of the data in the CURES database and the secure transfer of data from the CURES database. The technical specifications shall be universal for all health information technology systems that establish a method of system integration to retrieve information from the CURES database. The memorandum of understanding shall not govern, or in any way impact or restrict, the use of data received from the CURES database or impose any additional burdens on covered entities in compliance with the regulations promulgated pursuant to the federal Health Insurance Portability and Accountability Act of 1996 found in Parts 160 and 164 of Title 45 of the Code of Federal Regulations.
   6. (F) No later than October 1, 2018, the department shall develop a programming interface or other method of system integration to allow health information technology systems that meet the requirements in subparagraph (E) to retrieve information in the CURES database on behalf of an authorized health care practitioner or pharmacist.
   7. (G) The department shall not access patient-identifiable information in an entity’s health information technology system.
   8. (H) An entity that operates a health information technology system that is requesting to establish an integration with the CURES database shall pay a reasonable fee to cover the cost of establishing and maintaining integration with the CURES database.
   9. (I) The department may prohibit integration or terminate a health information technology system’s ability to retrieve information in the CURES database if the health information technology system fails to meet the requirements of subparagraph (E), or the entity operating the health information technology system does not fulfill its obligation under subparagraph (H).
2. (2) A health care practitioner authorized to prescribe, order, administer, furnish, or dispense Schedule II, Schedule III, Schedule IV, or Schedule V controlled substances pursuant to Section 11150 or a pharmacist shall be deemed to have complied with paragraph (1) if the licensed health care practitioner or pharmacist has been approved to access the CURES database through the process developed pursuant to subdivision (a) of Section 209 of the Business and Professions Code.

(g) For purposes of this section, the following terms have the following meanings:

1. (1) “Automated basis” means using predefined criteria to trigger an automated query to the CURES database, which can be attributed to a specific health care practitioner or pharmacist.
2. (2) “Department” means the Department of Justice.
3. (3) “Entity” means an organization that operates, or provides or makes available, a health information technology system to a health care practitioner or pharmacist.
4. (4) “Health information technology system” means an information processing application using hardware and software for the storage, retrieval, sharing of or use of patient data for communication, decisionmaking, coordination of care, or the quality, safety, or efficiency of the practice of medicine or delivery of health care services, including, but not limited to, electronic medical record applications, health information exchange systems, or other interoperable clinical or health care information system.