Cal. Code Regs. Tit. 11, § 828.4 - Restrictions on Use or Disclosure of Data Obtained from CURES
(a) An
Interested Party must only use data from CURES to support the educational purposes,
Peer Review purposes, statistical purposes, or Research Purposes , as specified in
the Written Request for Aggregated Data , defined in section
828.5, subdivision (a), or Data Request
Application, defined in section
828.6, subdivision (a).
(b) For Identified Individual-Level Data or
De-Identified Individual-Level Data , a Bona Fide Researcher must only obtain data
from CURES during the access period defined in the Bona Fide Researcher 's Data
Request Application.
(c) To protect
patient confidentiality and to confirm that data from CURES obtained in accordance
with this section is used for the purposes for which it was requested, the Bona Fide
Researcher must provide to the Department 's Research Services, for review and
comment, sufficiently in advance of any publication or dissemination, a complete
draft of any report , evaluation, or other document, and the final publication. This
requirement is not applicable if the Bona Fide Researcher only obtains Aggregated
Data .
(d) An Interested Party must not
disclose, transfer, or disseminate data from CURES , unless expressly authorized by
this section or approved in writing by the Department 's Research Services.
(e) A Bona Fide Researcher must not disclose or
disseminate any data or documents identifying any individual, including, but not
limited to, a patient, Prescriber , Out-of-State Prescriber , Pharmacist , or
Out-of-State Pharmacist , except to the Department 's Research Services, absent the
written consent of that identified individual, unless approved in writing by the
Department 's Research Services.
(f) A
Bona Fide Researcher must aggregate Identified Individual-Level Data or
De-Identified Individual-Level Data from CURES before it is published to ensure that
it does not create a risk of identifying individuals.
(g) An Interested Party must not release,
disclose, or disseminate data or documents from CURES in any form if there is a
reasonable possibility that an individual, including, but not limited to, a patient,
Prescriber , Out-of-State Prescriber , Pharmacist , or Out-of-State Pharmacist , can be
directly or indirectly identified from the information released, unless approved in
writing by the Department 's Research Services. Data from CURES is considered to have
a reasonable possibility of indirectly identifying an individual, including, but not
limited to, a patient, Prescriber , Out-of-State Prescriber , Pharmacist , or
Out-of-State Pharmacist , if it includes:
(1) Any of
the following identifying information:
(A)
Name.
(B) Date of birth.
(C) Race.
(D) Gender.
(E) Income.
(F) Ethnicity.
(G) Age.
(H) Health conditions.
(I) Use of a drug abuse treatment
facility.
(J) Pregnancy.
(K) HIPAA identifiers under 45 Code of Federal
Regulations part 164.514, subdivision (b)(2)(i), (10-1-20 Edition), incorporated by
reference in this chapter, including, but not limited to, any of the following:
1. Phone number.
2. Email address.
3. Social security number.
4. Driver's license number.
5. PII or any other personal information, if that
information, either alone or in combination with other factors, including geographic
area, creates a risk of indirectly identifying that individual, including, but not
limited to, a patient, Prescriber , Out-of-State Prescriber , Pharmacist , or
Out-of-State Pharmacist .
6. Geographical
units of fewer than 20,000 people.
(2) Rates, frequencies, other tabulations, or
combined factors, including geographic information other than state and county-level
information, and social stratification information, including gender, race, and
economics, which result in the reporting of data for fewer than 10
individuals.
(h) If the
Department 's Research Services determines that any publication, dissemination,
disclosure, or release of data from CURES or analyses could compromise the identity
of any individual, Prescriber , Out-of-State Prescriber , Pharmacist , or Out-of-State
Pharmacist , the Interested Party must not publish, disseminate, disclose, or
release, that publication, dissemination, or disclosure containing any data from
CURES .
(i) An Interested Party must not
re-identify or attempt to re-identify De-Identified Individual-Level Data or
Aggregated Data from CURES .
(j) An
Interested Party must not sell any data from CURES .
(k) An Interested Party must not disclose or
transfer data from CURES in a legal proceeding or in response to a subpoena in the
absence of a court order. An Interested Party must give immediate notice to the
Department 's Research Services of any subpoena or other legal proceeding in which
the disclosure of data from CURES is requested.
(l) A public or private entity, or a Bona Fide
Researcher , must notify the Department 's Research Services when the project, as
specified in the applicable Data Request Application or Written Request for
Aggregated Data , has been completed. All restrictions imposed in this section
regarding use or disclosure of data from CURES survive the completion of the
project.
(m) A Team Member is limited to
accessing or analyzing data obtained by a Bona Fide Researcher .
Notes
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code; and Section 1798.24, Civil Code.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code; and Section 1798.24, Civil Code.
2. Change without regulatory effect amending subsections (c)-(e), (g), (h) and (k)-(l) filed 5-29-2024 pursuant to section 100, title 1, California Code of Regulations (Register 2024, No. 22).
State regulations are updated quarterly; we currently have two versions available. Below is a comparison between our most recent version and the prior quarterly release. More comparison features will be added as we have more versions to compare.
(a) An Interested Party must only use data from CURES to support the educational purposes, Peer Review purposes, statistical purposes, or Research Purposes, as specified in the Written Request for Aggregated Data, defined in section 828.5, subdivision (a), or Data Request Application, defined in section 828.6, subdivision (a).
(b) For Identified Individual-Level Data or De-Identified Individual-Level Data, a Bona Fide Researcher must only obtain data from CURES during the access period defined in the Bona Fide Researcher's Data Request Application.
(c) To protect patient confidentiality and to confirm that data from CURES obtained in accordance with this section is used for the purposes for which it was requested, the Bona Fide Researcher must provide to the Department's Research Services, for review and comment, sufficiently in advance of any publication or dissemination, a complete draft of any report, evaluation, or other document, and the final publication. This requirement is not applicable if the Bona Fide Researcher only obtains Aggregated Data.
(d) An Interested Party must not disclose, transfer, or disseminate data from CURES, unless expressly authorized by this section or approved in writing by the Department's Research Services.
(e) A Bona Fide Researcher must not disclose or disseminate any data or documents identifying any individual, including, but not limited to, a patient, Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist, except to the Department's Research Services, absent the written consent of that identified individual, unless approved in writing by the Department's Research Services.
(f) A Bona Fide Researcher must aggregate Identified Individual-Level Data or De-Identified Individual-Level Data from CURES before it is published to ensure that it does not create a risk of identifying individuals.
(g) An Interested Party must not release, disclose, or disseminate data or documents from CURES in any form if there is a reasonable possibility that an individual, including, but not limited to, a patient, Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist, can be directly or indirectly identified from the information released, unless approved in writing by the Department's Research Services. Data from CURES is considered to have a reasonable possibility of indirectly identifying an individual, including, but not limited to, a patient, Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist, if it includes:
(1) Any of the following identifying information:
(A) Name.
(B) Date of birth.
(C) Race.
(D) Gender.
(E) Income.
(F) Ethnicity.
(G) Age.
(H) Health conditions.
(I) Use of a drug abuse treatment facility.
(J) Pregnancy.
(K) HIPAA identifiers under 45 Code of Federal Regulations part 164.514, subdivision (b)(2)(i), (10-1-20 Edition), incorporated by reference in this chapter, including, but not limited to, any of the following:
1. Phone number.
2. Email address.
3. Social security number.
4. Driver's license number.
5. PII or any other personal information, if that information, either alone or in combination with other factors, including geographic area, creates a risk of indirectly identifying that individual, including, but not limited to, a patient, Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist.
6. Geographical units of fewer than 20,000 people.
(2) Rates, frequencies, other tabulations, or combined factors, including geographic information other than state and county-level information, and social stratification information, including gender, race, and economics, which result in the reporting of data for fewer than 10 individuals.
(h) If the Department's Research Services determines that any publication, dissemination, disclosure, or release of data from CURES or analyses could compromise the identity of any individual, Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist, the Interested Party must not publish, disseminate, disclose, or release, that publication, dissemination, or disclosure containing any data from CURES.
(i) An Interested Party must not re-identify or attempt to re-identify De-Identified Individual-Level Data or Aggregated Data from CURES.
(j) An Interested Party must not sell any data from CURES.
(k) An Interested Party must not disclose or transfer data from CURES in a legal proceeding or in response to a subpoena in the absence of a court order. An Interested Party must give immediate notice to the Department's Research Services of any subpoena or other legal proceeding in which the disclosure of data from CURES is requested.
(l) A public or private entity, or a Bona Fide Researcher, must notify the Department's Research Services when the project, as specified in the applicable Data Request Application or Written Request for Aggregated Data, has been completed. All restrictions imposed in this section regarding use or disclosure of data from CURES survive the completion of the project.
(m) A Team Member is limited to accessing or analyzing data obtained by a Bona Fide Researcher.
Notes
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code; and Section 1798.24, Civil Code.
Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code; and Section 1798.24, Civil Code.
2. Change without regulatory effect amending subsections (c)-(e), (g), (h) and (k)-(l) filed 5-29-2024 pursuant to section 100, title 1, California Code of Regulations (Register 2024, No. 22).