Cal. Code Regs. Tit. 11, § 828.4 - Restrictions on Use or Disclosure of Data Obtained from CURES

(a) An Interested Party must only use data from CURES to support the educational purposes, Peer Review purposes, statistical purposes, or Research Purposes, as specified in the Written Request for Aggregated Data, defined in section 828.5, subdivision (a), or Data Request Application, defined in section 828.6, subdivision (a).

(b) For Identified Individual-Level Data or De-Identified Individual-Level Data, a Bona Fide Researcher must only obtain data from CURES during the access period defined in the Bona Fide Researcher's Data Request Application.

(c) To protect patient confidentiality and to confirm that data from CURES obtained in accordance with this section is used for the purposes for which it was requested, the Bona Fide Researcher must provide to the Department's Research Center, for review and comment, sufficiently in advance of any publication or dissemination, a complete draft of any report, evaluation, or other document, and the final publication. This requirement is not applicable if the Bona Fide Researcher only obtains Aggregated Data.

(d) An Interested Party must not disclose, transfer, or disseminate data from CURES, unless expressly authorized by this section or approved in writing by the Department's Research Center.

(e) A Bona Fide Researcher must not disclose or disseminate any data or documents identifying any individual, including, but not limited to, a patient, Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist, except to the Department's Research Center, absent the written consent of that identified individual, unless approved in writing by the Department's Research Center.

(f) A Bona Fide Researcher must aggregate Identified Individual-Level Data or De-Identified Individual-Level Data from CURES before it is published to ensure that it does not create a risk of identifying individuals.

(g) An Interested Party must not release, disclose, or disseminate data or documents from CURES in any form if there is a reasonable possibility that an individual, including, but not limited to, a patient, Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist, can be directly or indirectly identified from the information released, unless approved in writing by the Department's Research Center. Data from CURES is considered to have a reasonable possibility of indirectly identifying an individual, including, but not limited to, a patient, Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist, if it includes:

(1) Any of the following identifying information:

(A) Name.

(B) Date of birth.

(C) Race.

(D) Gender.

(E) Income.

(F) Ethnicity.

(G) Age.

(H) Health conditions.

(I) Use of a drug abuse treatment facility.

(J) Pregnancy.

(K) HIPAA identifiers under 45 Code of Federal Regulations part 164.514, subdivision (b)(2)(i), (10-1-20 Edition), incorporated by reference in this chapter, including, but not limited to, any of the following:

1. Phone number.

2. Email address.

3. Social security number.

4. Driver's license number.

5. PII or any other personal information, if that information, either alone or in combination with other factors, including geographic area, creates a risk of indirectly identifying that individual, including, but not limited to, a patient, Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist.

6. Geographical units of fewer than 20,000 people.

(2) Rates, frequencies, other tabulations, or combined factors, including geographic information other than state and county-level information, and social stratification information, including gender, race, and economics, which result in the reporting of data for fewer than 10 individuals.

(h) If the Department's Research Center determines that any publication, dissemination, disclosure, or release of data from CURES or analyses could compromise the identity of any individual, Prescriber, Out-of-State Prescriber, Pharmacist, or Out-of-State Pharmacist, the Interested Party must not publish, disseminate, disclose, or release, that publication, dissemination, or disclosure containing any data from CURES.

(i) An Interested Party must not re-identify or attempt to re-identify De-Identified Individual-Level Data or Aggregated Data from CURES.

(j) An Interested Party must not sell any data from CURES.

(k) An Interested Party must not disclose or transfer data from CURES in a legal proceeding or in response to a subpoena in the absence of a court order. An Interested Party must give immediate notice to the Department's Research Center of any subpoena or other legal proceeding in which the disclosure of data from CURES is requested.

(l) A public or private entity, or a Bona Fide Researcher, must notify the Department's Research Center when the project, as specified in the applicable Data Request Application or Written Request for Aggregated Data, has been completed. All restrictions imposed in this section regarding use or disclosure of data from CURES survive the completion of the project.

(m) A Team Member is limited to accessing or analyzing data obtained by a Bona Fide Researcher.

Notes

Cal. Code Regs. Tit. 11, § 828.4

Note: Authority cited: Section 11165, Health and Safety Code. Reference: Section 11165, Health and Safety Code; and Section 1798.24, Civil Code.

1. Renumbering and amendment of former section 826.4 to new section 828.4 filed 8-15-2022; operative 8/15/2022 pursuant to Government Code section 11343.4(b)(3) (Register 2022, No. 33).