Cal. Code Regs. Tit. 11, § 830.3 - Requirements for HIT System Use of the Information Exchange Web Service

(a) In accordance with Health and Safety Code section 11165.1, subdivision (a)(1)(E)(i), an entity that operates a HIT System is prohibited from using or disclosing data from CURES received through the Information Exchange Web Service for any purpose other than delivering the data from CURES to the authorized Prescriber-User, Non-DEA Practitioner-User, or Pharmacist-User identified in section 830.3, subdivision (c)(5), or performing data processing activities that may be necessary to enable the delivery, unless authorized by, and pursuant to, State and federal privacy and security laws and regulations.

(b) In accordance with Health and Safety Code section 11165.1, subdivision (a)(1)(E)(ii), and in the manner described in section 830.3, subdivision (c)(5), a HIT System must authenticate the identity of the authorized Prescriber-User, Non-DEA Practitioner-User, or Pharmacist-User initiating a request, or on whose behalf the HIT System is initiating a request, to the Information Exchange Web Service.

(c) In accordance with Health and Safety Code section 11165.1, subdivision (a)(1)(E)(ii), a HIT System, on behalf of an authorized Prescriber-User, Non-DEA Practitioner-User, or Pharmacist-User, must submit all of the following information to the Information Exchange Web Service with each request for a Patient Activity Report:

(1) The date and time of the search.

(2) Patient first name and patient last name.

(3) Patient date of birth.

(4) Search Period.

(5) The identification of the authorized Prescriber-User, Non-DEA Practitioner-User, or Pharmacist-User for whom the HIT System is submitting a request. A HIT System must only identify one authorized Prescriber-User, Non-DEA Practitioner-User, or Pharmacist-User for each request. The Prescriber-User, Non-DEA Practitioner-User, or Pharmacist-User whose identity is submitted must be the intended recipient of the data.

(A) To authenticate the identity of the authorized Prescriber-User, a HIT System must submit the Prescriber-User's first name, Prescriber-User's last name, Prescriber-User's State License Number, and Prescriber-User's national provider identifier number.

(B) To authenticate the identity of the authorized Non-DEA Practitioner-User, a HIT System must submit the Non-DEA Practitioner-User's first name, Non-DEA Practitioner-User's last name, Non-DEA Practitioner-User's State License Number, and Non-DEA Practitioner-User's national provider identifier number.

(C) To authenticate the identity of the authorized Pharmacist-User, a HIT System must submit the Pharmacist-User's first name, Pharmacist-User's last name, Pharmacist-User's State License Number, and Pharmacist-User's pharmacy business name.

(d) If a HIT System uses predefined criteria to trigger an automated request to CURES on behalf of an authorized Prescriber-User, Non-DEA Practitioner-User, or Pharmacist-User, the request must conform to that Prescriber-User's, Non-DEA Practitioner-User's, or Pharmacist-User's restrictions on accessing data in CURES under section 821.4, section 822.4, or section 823.4, respectively.

(e) In accordance with Health and Safety Code section 11165.1, subdivision (a)(1)(E)(iii), a HIT System must comply with applicable patient privacy and information security requirements of federal and State laws and regulations, including, but not limited to:

(1) The Confidentiality of Medical Information Act (Part 2.6 (commencing with section 56) of Division 1 of the Civil Code).

(2) The HIPAA Regulations.

(3) The California Uniform Controlled Substances Act, including Health and Safety Code sections 11165 and 11165.1.

(f) In accordance with Health and Safety Code section 11165.1, subdivision (a)(1)(E)(iv), an entity that operates a HIT System must maintain an active memorandum of understanding with the Department.

Notes

Cal. Code Regs. Tit. 11, § 830.3

1. Renumbering of former section 828.3 to section 830.3 filed 8-15-2022; operative 8-15-2022 pursuant to Government Code section 11343.4(b)(3) (Register 2022, No. 33).

Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11165 and 11165.1, Health and Safety Code.

1. Renumbering of former section 828.3 to section 830.3 filed 8-15-2022; operative 8/15/2022 pursuant to Government Code section 11343.4(b)(3) (Register 2022, No. 33).