Medical Bd. of Calif. v. Chiarottino

225 Cal. App. 4th 623, 170 Cal. Rptr. 3d 540, 2014 WL 1427466, 2014 Cal. App. LEXIS 333

• Court: California Court of Appeal
• Decided: April 15, 2014
• Docket: A138420
• Status: Published

Opinion

Opinion

DONDERO, J.

Defendant Michael Chiarottino, a physician licensed to practice in California, appeals from the trial court’s order to comply with investigative subpoenas issued by plaintiff Medical Board of California (Board). The Board issued the subpoenas in connection with an investigation into defendant’s prescribing activities as they pertain to controlled substances. On appeal, defendant contends the court erred in rejecting his argument that the Board violated his patients’ right to privacy by accessing a computerized database of controlled substance prescription records prior to issuing the subpoenas. We affirm.

FACTUAL BACKGROUND AND PROCEDURAL HISTORY

In August 2011, the Board obtained information that defendant was possibly prescribing excessive medications to patients in violation of the Medical Practice Act. (Bus. & Prof. Code, § 2000 et seq.) A Board investigator obtained a Controlled Substance Utilization Review and Evaluation System (CURES) 1 report of defendant’s prescribing history between August 22, 2009, and February 22, 2012. The investigator also obtained CURES reports of the prescription histories for five of defendant’s patients over a 12-month period between 2011 and 2012 and the corresponding pharmacy records for these same patients.

The Board’s medical expert, Rick Chavez, M.D., conducted an independent review of the CURES reports and the patients’ pharmacy records. He identified significant concerns and irregularities in defendant’s prescribing of controlled substances to these patients, including prescribing large quantities of highly addictive and dangerous narcotics, prescribing highly unusual combinations of drugs, prescribing buprenorphine (a drug used to resolve opiate addiction) to patients who were concurrently receiving opioids from several other physicians, prescribing at irregular time intervals, and prescribing highly addictive drugs for lengthy periods of time. Chavez concluded defendant’s conduct was alarming and difficult to justify.

On February 7, 2012, the Board’s investigator sent letters to the five patients requesting authorization for the release of their medical records with respect to the treatment they received from defendant. Defendant was subsequently served with subpoenas directing him to produce the patients’ medical records. After the patients were notified of the subpoenas, they informed the investigator that they objected. Defendant’s counsel indicated to the investigator that defendant would not produce the requested information because the patients had objected to the release of their medical records.

On December 26, 2012, the Board filed a petition for an order compelling compliance with the investigative subpoenas. (Gov. Code, § 11180 et seq.) 2 In its supporting papers, it argued that the five patients’ medical records were needed to properly assess whether the narcotics and controlled substances defendant had prescribed were or were not warranted, and whether he was in compliance with standards of care and practice. The Board asserted these records were necessary to allow it to “fulfill its monitoring responsibilities of public protection as mandated by California law.” It claimed the subpoenas were “reasonably tailored to seek only the records that are necessary and material to the Board’s investigation.”

On January 2, 2013, the trial court issued an order to show cause regarding the Board’s petition.

On January 31, 2013, defendant filed his opposition to the Board’s petition. He claimed his refusal was based on protecting the privacy rights of his patients, as well as their rights not to be subjected to unwarranted search and seizure.

On April 18, 2013, the trial court granted the Board’s petition to compel defendant’s compliance with the subpoenas. The court found the Board had set forth sufficient facts to support a finding of good cause. The court limited the disclosure to records that “are relevant and material to the pending investigation,” by setting forth certain substantive and time-based limitations. This appeal followed.

DISCUSSION

I. Standard of Review

The standard of review generally applicable to review of a trial court’s order involving discovery matters or other matters where the trial court has discretionary power is abuse of discretion. (See Britts v. Superior Court (2006) 145 Cal.App.4th 1112, 1123 [52 Cal.Rptr.3d 185].) An abuse of discretion is found where a court exceeds the bounds of reason in light of the circumstances under consideration. (Loomis v. Loomis (1960) 181 Cal.App.2d 345, 348 [5 Cal.Rptr. 550].) Unless there has been a clear miscarriage of justice, a reviewing court will not substitute its opinion for that of the trial court so as to avoid divesting the trial court of its discretionary power. (Id. at p. 349.)

Issues of law are reviewed de novo. (Szold v. Medical Bd. of California (2005) 127 Cal.App.4th 591, 596 [25 Cal.Rptr.3d 665].) Construction of a statute is a question of law and, as such, is subject to de novo review. (Ibid.)

II. Contentions on Appeal

As noted above, the trial court found the Board had established good cause to support the issuance of the subpoenas. Defendant’s sole basis for challenging the trial court’s good cause finding is his claim that the CURES reports themselves were obtained in violation of his patients’ rights to privacy under article I, section 1, of the California Constitution. More specifically, he contends their rights were violated when the Board was given “unfettered and extensive access to two-and-a-half years’ worth of all of his patients’ CURES prescription information.” As will be demonstrated, the Board’s actions were entirely authorized under Health and Safety Code section 11165 (the CURES statute). Thus, defendant is implicitly attacking the constitutionality of the- statute itself. The weight of authority supports the Board’s position that the statute, and its actions taken pursuant thereto, pass constitutional muster.

IH. The CURES Statute

The prescribing and dispensing of controlled substances in California are strictly regulated and are monitored by the Department of Justice (DOJ). (See Health & Saf. Code, § 11150 et seq.) The CURES statute provides for the reporting of prescription records to the DOJ, and specifically authorizes the DOJ to disclose such records to state enforcement and regulatory agencies. (Health & Saf. Code, § 11165, subd. (c).) The DOJ maintains a database for the electronic monitoring of, and Internet access to, information regarding the prescribing and dispensing of schedule II, schedule III, and schedule IV controlled substances by all practitioners authorized to prescribe or dispense these controlled substances. The primary purpose of the CURES statute is to “assist . . . law enforcement and regulatory agencies in their efforts to control the diversion and resultant abuse of . . . controlled substances.” (Health & Saf. Code, § 11165, subd. (a).) It is undisputed that the Board qualifies for authorization under the CURES statute to access and review prescription records for controlled substances that pharmacists and other dispensing providers are required to report.

The CURES statute does not require the Board to obtain either patient consent or judicial approval prior to accessing CURES data. The statute does, however, contain its own confidentiality requirements. Specifically, it provides that the database system “shall operate under existing provisions of law to safeguard the privacy and confidentiality of patients.” (Health & Saf. Code, § 11165, subd. (c).) The statute further prohibits the disclosure, sale, or transfer of patient data to any third party. (Ibid.)

IV. The Medical Board of California

In Arnett v. Dal Cielo (1996) 14 Cal.4th 4 [56 Cal.Rptr.2d 706, 923 P.2d 1] (Arnett), our Supreme Court provided a useful overview of the Board’s role in protecting the health and safety of the public. As the court observed, California has long regulated the practice of medicine as an exercise of the state’s police power. (Id. at p. 7.) “A key instrument of that regulation has been the statewide agency authorized to license and discipline medical practitioners . . . ,” now known as the Medical Board of California. (Ibid:, see Bus. & Prof. Code, § 101, subd. (b).) “A primary power exercised by the Board in carrying out its enforcement responsibilities is the power to investigate-, the statute broadly vests the Board with the power of ‘Investigating complaints from the public, from other licensees, from health care facilities, or from a division of the board that a physician and surgeon may be guilty of unprofessional conduct.’ [Citation.]” (Arnett, supra, at pp. 7-8.)

“The Board’s investigators have the status of peace officers [citation], and possess a wide range of investigative powers. In addition to interviewing and taking statements from witnesses, the Board’s investigators are authorized to exercise delegated powers [citation] to ‘Inspect books and records’ and to ‘Issue subpoenas for the attendance of witnesses and the production of papers, books, accounts, documents and testimony in any inquiry [or] investigation ... in any part of the state.’ [Citation.]” (Arnett, supra, 14 Cal.4th at p. 8.) Further, because the Board is authorized “to issue a subpoena ‘in any inquiry [or] investigation’ [citation], the Board may do so for purely investigative purposes; it is not necessary that a formal accusation be on file or a formal adjudicative hearing be pending. [Citation.]” (Ibid.) The Court in Arnett further observed “ ‘the power to make administrative inquiry is not derived from a judicial function but is more analogous to the power of a grand jury, which does not depend on a case or controversy to get evidence but can investigate “merely on suspicion that the law is being violated, or even just because it wants assurance that it is not.” ’ [Citation.]” (Ibid.)

The Board is specifically charged with enforcement of the Medical Practice Act, and many of the act’s provisions focus particularly on the use and misuse of prescription drugs, as illustrated by the following statutes: Business and Professions Code sections 2238 (violation of state or federal statute regulating dangerous drugs and controlled substances), 2241 and 2241.5 (furnishing prescription drugs to an addict), and 2242 (furnishing prescription drugs without an appropriate prior examination and medical indication).

In the present case, defendant does not challenge the Board’s investigative powers directly. Instead, he repeatedly asserts the Board violated his patients’ privacy rights when it obtained “unfettered access” to the CURES data, data the Board subsequently relied on to justify the issuance of the five subpoenas. 3

V. The Board’s Actions Taken Pursuant to the CURES Statute Did Not Violate Patients’ Privacy Rights

A. The State Constitutional Right to Privacy

“In 1972, Californians, by initiative, added an explicit right to privacy in the state’s Constitution: ‘All people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy.’ (Cal. Const., art. I, § 1, italics added.)” (County of Los Angeles v. Los Angeles County Employee Relations Com. (2013) 56 Cal.4th 905, 926 [157 Cal.Rptr.3d 481, 301 P.3d 1102] (County of Los Angeles).)

In Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1 [26 Cal.Rptr.2d 834, 865 P.2d 633] (Hill), our Supreme Court “established a framework for analyzing constitutional invasion of privacy claims. An actionable claim requires three essential elements: (1) the claimant must possess a legally protected privacy interest [citation]; (2) the claimant’s expectation of privacy must be objectively reasonable[ 4 ] [citation]; and (3) the invasion of privacy complained of must be serious in both its nature and scope [citation]. If the claimant establishes all three required elements, the strength of that privacy interest is balanced against countervailing interests. [Citation.] In general, the court should not proceed to balancing unless a satisfactory threshold showing is made. A defendant is entitled to prevail if it negates any of the three required elements. [Citations.] A defendant can also prevail at the balancing stage. An otherwise actionable invasion of privacy may be legally justified if it substantively furthers one or more legitimate competing interests. [Citation.] Conversely, the invasion may be unjustified if the claimant can point to ‘feasible and effective alternatives’ with ‘a lesser impact on privacy interests.’ [Citation.]” (County of Los Angeles, supra, 56 Cal.4th at p. 926.)

It is established that patients do have a right to privacy in their medical information under our state Constitution. 5 (See, e.g., Gross v. Recabaren (1988) 206 Cal.App.3d 771, 782-783 [253 Cal.Rptr. 820] [substantial privacy concerns are raised whenever there is an intrusion into a patient’s confidential relationship with a physician]; Ruiz v. Podolsky (2010) 50 Cal.4th 838, 851 [114 Cal.Rptr.3d 263, 237 P.3d 584] [the same with respect to disclosure of confidential medical information regarding the condition a patient seeks to treat].) This right would appear to extend to prescription records. 6 However, it is also well settled that an individual’s constitutional right to privacy is not absolute. (Hill, supra, 7 Cal.4th at p. 37.)

Even assuming defendant has satisfied the three-prong prima facie elements under Hill, we conclude any invasion of his patients’ privacy rights with respect to the Board’s review of information obtained from the CURES database is justified by a compelling competing interest: “Invasion of a privacy interest .is not a violation of the state constitutional right to privacy if the invasion is justified by a competing interest. Legitimate interests derive from the legally authorized and socially beneficial activities of government and private entities. Their relative importance is determined by their proximity to the central functions of a particular public or private enterprise. Conduct alleged to be an invasion of privacy is to be evaluated based on the extent to which it furthers legitimate and important competing interests.” (Hill, supra, 7 Cal.4th at p. 38.) Here, the balance favors disclosure.

B. Defendant Does Not Challenge the CURES Statute on Its Face

As the Board correctly notes, to the extent defendant is contending on appeal that the CURES statute is facially unconstitutional, he did not raise this argument in the proceeding below; thus, this argument may be deemed waived. (Ochoa v. Pacific Gas & Electric Co. (1998) 61 Cal.App.4th 1480, 1488, fn. 3 [72 Cal.Rptr.2d 232] [“arguments not asserted below are waived and will not be considered for the first time on appeal”].) We also observe he has not cited to any legal authority to support an argument that the CURES statute is facially unconstitutional. Accordingly, we deem the argument waived and abandoned. 7 (Ibid.)

C. The Board Did Not Violate Defendants Patients’ Right to Privacy

Defendant concedes that the CURES statute “appears to authorize the [Board] to obtain CURES data in its investigation of doctors for potential disciplinary purposes, as in the instant case.” Our research has not disclosed a California case directly addressing an invasion of privacy claim with respect to activities undertaken pursuant to the CURES statute. However, a recent case lends support for the proposition that the Board’s conduct can be justified by a compelling governmental interest. In 420 Caregivers, LLC v. City of Los Angeles (2012) 219 Cal.App.4th 1316 [163 Cal.Rptr.3d 17] (420 Caregivers), the Court of Appeal reversed an order granting a preliminary injunction against the enforcement of an ordinance regulating the number and geographic distribution of medical marijuana collectives and requiring their registration. Among its conclusions, the appellate court found the collectives did not have a reasonable expectation of privacy in the limited information sought by the ordinance. (Id. at p. 1350.) Alternatively, it found any invasion of a reasonable expectation of privacy to be justified by a legitimate and competing state interest. (Id. at p. 1349.) Because the collectives did not demonstrate a likelihood of prevailing on the merits at trial, the appellate panel concluded the trial court had erred in granting the request for a preliminary injunction. (Id. at p. 1350.)

In arriving at its holding, the appellate court observed “statutes already allow the disclosure of patient contact information by traditional health care providers upon demand. . . . Insofar as schedules II, HI, and IV controlled substances (drugs which may be legally prescribed) are concerned, pharmacies are already required weekly to provide the state Department of Justice with the names, addresses, and phone numbers of prescribed users. [Citation.] This information, in turn, may be given to state, local, or federal agencies for purposes of criminal or disciplinary investigations. [Citation.]” (420 Caregivers, supra, 219 Cal.App.4th at p. 1350, italics added & omitted.) The reviewing court concluded: “In short, even where the privacy rights of individual collective members are concerned, the information sought is extremely limited and nonintimate in nature and the information—plus more—is typically already subject to disclosure in the context of more traditional health care treatments and providers. . . . [W]e see no reason to give medical marijuana users greater privacy rights than patients utilizing more traditional health care providers and more traditional prescription drugs. Indeed, given the continued illegal nature of marijuana under most circumstances, even more substantial invasions of privacy would likely be justified under the current state of the law. Whether analyzed as an unreasonable expectation of privacy or a reasonably justified invasion of a reasonable expectation of privacy, we find no violation of the Collectives’ members’ individual privacy rights.” (Ibid., italics added.)

In rejecting defendant’s unreasonable search and seizure claim, the trial court in the present case specifically rejected his right-to-privacy arguments, concluding that, under the circumstances of this case, neither defendant nor his patients have a reasonable expectation of privacy in the records maintained in the CURES database. Several other jurisdictions have addressed this issue more directly and have found that a state law enforcement official’s access to controlled substance prescription records does not violate the patient’s right of privacy under federal law or under applicable local privacy statutes. We find those opinions to be persuasive.

Significantly, in Whalen v. Roe (1977) 429 U.S. 589 [51 L.Ed.2d 64, 97 S.Ct. 869] (Whalen), the United States Supreme Court addressed a statute similar to the CURES statute. In Whalen, a group of patients and physicians, among others, challenged the constitutionality of a New York statutory scheme requiring physicians to forward records of prescriptions for schedule II drugs, which contained detailed patient information, to a centralized database maintained by that state’s department of health. (Id. at pp. 593-595.) Although, like the CURES statute at issue here, public disclosure of the identity of the patient was prohibited under New York law, certain state regulatory employees and personnel responsible for investigating violations of that state’s controlled substance statutes were afforded access to that information. (Id. at pp. 594-595.) After finding that the statute furthered the state’s “vital interest in controlling the distribution of dangerous drugs,” the court concluded that the challenged statutory scheme, by mandating the disclosure of the prescription information to representatives of the state having responsibility for the health and welfare of the community, did not create an impermissible invasion of privacy. (Id. at pp. 603-604.) As more-recent cases demonstrate, other jurisdictions are in accord.

In State of Nebraska v. Wiedeman (2013) 286 Neb. 193 [835 N.W.2d 698], a criminal defendant argued that state law enforcement officers violated her due process privacy rights through their warrantless investigatory access to her prescription records. As in the present case, she did not challenge the statute that authorized the access. (Id., 835 N.W.2d at p. 707.) The state’s high court found Whalen to be dispositive of her privacy arguments under the federal Constitution. (835 N.W.2d at pp. 707-708.) The Nebraska court observed “there is a long history of governmental scrutiny in the area of narcotics and other controlled substances. All states highly regulate prescription narcotics, and many state statutes specifically allow for law enforcement investigatory access to those records without a warrant. This well-known and long-established regulatory history significantly diminishes any societal expectation of privacy against governmental investigation of narcotics prescriptions.” (Id. at p. 711, fn. omitted.) The court concluded the defendant had no legitimate expectation that governmental inquiries would not occur with respect to a pharmacy’s prescription records. (Id. at p. 712.)

In State of Connecticut v. Russo, supra, 790 A.2d 1132 (Russo), the Supreme Court of Connecticut held a patient’s privacy rights were not violated under a state statute that allowed government officials with the duty to enforce state and federal controlled substance statutes to inspect prescription records. (Id. at p. 1146.) The local police department was investigating a defendant accused of multiple counts of forgery and obtaining controlled substances by forging a prescription. Pursuant to the challenged statute, an authorized law enforcement agent had obtained, with the pharmacists’ consent, records of the defendant’s prescriptions for controlled substances. The court, largely relying on Whalen, found the defendant’s privacy rights had not been violated. (Id. at p. 1155.)

The court in Russo noted that the Connecticut statutory scheme was indistinguishable from the statutes at issue in Whalen. (Russo, supra, 790 A.2d at pp. 1150-1151.) Specifically, both schemes safeguarded the privacy interest of the affected patients by restricting access to those records to a limited class of persons, and by prohibiting the dissemination of such information to the general public. (Ibid.) The court further observed that nothing in the court records in either case suggested that the law enforcement officials involved had failed to abide by the nondisclosure provisions, or that they would likely flout those provisions in the future. (Id. at p. 1151.)

In State of Vermont v. Welch (1992) 160 Vt. 70 [624 A.2d 1105], the Supreme Court of Vermont held that a criminal defendant had a privacy interest in her pharmaceutical records, based on a reasonable expectation that those records would not be arbitrarily disclosed. (Id., 624 A.2d at p. 1109.) The court concluded, however, that the “ ‘pervasively regulated industry’ ” exception to the warrant requirement allowed for the warrantless inspection of her records in furtherance of the enforcement of statutes pertaining to closely regulated businesses such as pharmacies. (Id. at pp. 1110-1111.) The court specifically noted the state interest in the regulation of dangerous drugs (id. at p. 1111), and concluded the warrantless inspection of pharmacy records undertaken in compliance with statutory procedures was reasonable (id. at p. 1112).

Finally, in Stone v. City of Stow (1992) 64 Ohio St.3d 156 [593 N.E.2d 294], a contingent of doctors, patients, and a pharmacist sued several municipalities contending that Ohio statutes providing for the inspection of pharmacy prescription records without a warrant violated the right of privacy and the prohibition against unreasonable searches and seizures found in the United States and Ohio Constitutions. (593 N.E.2d at p. 297.) The court found Whalen dispositive of the privacy issue, declining to apply a balancing test that would weigh the need for access to prescription records against the deprivation of privacy caused by the regulatory provisions. The court noted that, on the state of the record before it, there was no basis for speculating that any unauthorized disclosure of the prescription records would occur. (593 N.E.2d at p. 299.)

In the present case, defendant argues that the Board violated the privacy rights of all of his patients by, essentially, conducting a fishing expedition into records of his prescribing activities as reflected in the CURES database. However, there is no evidence that the Board acted outside the scope of its investigative mandate. For example, defendant does not contend the Board used its authority to investigate the records of individuals who were not his patients, or that the Board improperly disclosed any CURES information to third parties. Nor does he contend that the Board had any improper motive in deciding to investigate his own prescribing activities. Thus, it is undisputed that the Board acted within the scope of its authority and in compliance with all relevant statutory law.

Further, the cases defendant relies on are inapposite in that they concern subpoena requests for medical records made by the Board in the absence of good cause. For example, in Bearman v. Superior Court (2004) 117 Cal.App.4th 463 [11 Cal.Rptr.3d 644], the appellate court held that the Board “must demonstrate through competent evidence that the particular records it seeks are relevant and material to its inquiry sufficient for a trial court to independently make a finding of good cause to order the materials disclosed.” (Id. at p. 469.) The appellate court concluded the Board had failed to set forth facts suggesting that the prescribing physician had engaged in any unethical conduct with respect to his prescribing medical marijuana to a patient. Further, the court found the request was overbroad. (Id. at pp. 471-472.) Here, defendant does not challenge the adequacy of the Board’s good cause showing to the trial court. Instead, he challenges the legitimacy of the Board’s conduct in compiling the factual justification that enabled the court to make an independent assessment of good cause.

For purposes of our decision here, we assume patients have a reasonable expectation that their prescription records will not be disclosed to persons who are not actively involved in their care. Balancing society’s substantial interest in reducing the illegitimate use of dangerously addictive prescription drugs against the relatively minor intrusion upon a patient’s reasonable expectations of privacy when he or she is given a prescription by a treating physician, we conclude that, as applied to such patients, the Board’s actions here in accessing and compiling data from the CURES database did not violate article I, section 1 of the state Constitution. This is particularly so in light of the fact that the Board is prohibited by law from disclosing this data to third parties. Further, even a reasonable expectation of privacy is somewhat diminished as it is widely known that such investigative actions are possible with respect to controlled substances. In this setting, we conclude that the limited incremental intrusion upon a patient’s privacy is justified by the state’s countervailing interest in preventing the abuse of controlled substances. Accordingly, we hold the trial court correctly found there was good cause to enforce the subpoenas of the five patients’ medical records.

DISPOSITION

The order is affirmed.

Margulies, Acting P. J., and Banke, J., concurred.

1 The Controlled Substance Utilization Review and Evaluation System was established pursuant to Health and Safety Code section 11165. This section was made operative on January 1, 2005.

2 Trial courts are authorized to enforce investigative subpoenas that are “regularly issued.” (Gov. Code, § 11188.) “The term ‘regularly issued’ means in accordance with the provisions of sections 11180, 11181, 11182, 11184 and 11185 of the Government Code providing for the matters which may be investigated, the acts authorized in connection with investigations, and the service of process.” (Fielder v. Berkeley Properties Co. (1972) 23 Cal.App.3d 30, 39 [99 Cal.Rptr. 791].)

3 A physician has the right to assert the privacy interests of his patients who have not consented to the disclosure of their medical records. (Wood v. Superior Court (1985) 166 Cal.App.3d 1138, 1145 [212 Cal.Rptr. 811].)

4 “A ‘reasonable’ expectation of privacy is an objective entitlement founded on broadly based and widely accepted community norms.” (Hill, supra, 7 Cal.4th at p. 37.) The reasonableness of a privacy expectation depends on the surrounding context. The Supreme Court has “stressed that ‘customs, practices, and physical settings surrounding particular activities may create or inhibit reasonable expectations of privacy.’ [Citation.]” (County of Los Angeles, supra, 56 Cal.4th at p. 927.)

5 “Legally recognized privacy interests include ‘interests in precluding the dissemination or misuse of sensitive and confidential information,’ which Hill described under the umbrella term ‘ “informational privacy." ’ [Citation.]” (County of Los Angeles, supra, 56 Cal.4th at p. 927.)

6 The Connecticut Supreme Court has noted that a person may reasonably expect his or her prescription records or information contained therein will not be disseminated publicly “[b]ecause prescription records may contain information of a private nature regarding a person’s physical or mental health.” (State of Connecticut v. Russo (2002) 259 Conn. 436, 460 [790 A.2d 1132].)

7 Amicus curiae the California Medical Association (CMA) asserts the CURES statute fails to comply with privacy statutes requiring heightened protection of highly sensitive medical information. Specifically, the CMA asserts that access to the prescription information contained in the CURES database can lead to the disclosure of information as to an individual’s HIV status, treatment for drug and alcohol abuse, or participation in outpatient psychotherapy. The CMA finds fault with the provision in the statute that allows the DOJ to unilaterally determine whether “to share private prescription information with any third party as determined by the DOJ.” Notably, the CMA does not argue that the DOJ abused its discretion in sharing CURES database information concerning defendant’s patients with the Board. The CMA further asserts that while CURES “can serve a needed purpose to help control drug diversion in the state and assist physicians in making informed prescribing decisions,’.’ the privacy protections of the system “are outdated and unregulated.” In light of the fact that defendant has not raised a direct challenge the CURES statute, such concerns are more properly addressed to the Legislature.