California CURES Query Log Privacy Laws: What Independent Pharmacies Need to Know

CURES Registration Requirements

Who must register and when

All California-licensed pharmacists must register for CURES access upon issuance of their pharmacist license. Registration is tied to licensure status and is not contingent on whether you personally dispense controlled substances. Prescribers with DEA registration must also register; pharmacies should ensure their pharmacists and any authorized prescriber-owners are enrolled to maintain operational continuity. ([oag.ca.gov](https://oag.ca.gov/cures/faqs?utm_source=openai))

The CURES regulations and application framework expressly include a Pharmacist Registration Application and empower the Department of Justice (DOJ) to deny or suspend access for causes such as materially falsifying an application or failing to maintain effective access controls. This makes early, accurate registration—and sound access governance—essential. ([oag.ca.gov](https://oag.ca.gov/system/files/media/CURES%20-%20Text%20of%20Adopted%20Regulations.pdf?utm_source=openai))

CURES fee regulation

Expect a dedicated CURES fee at license renewal. As of March 2025, Board of Pharmacy renewals include a $30 CURES fee, and statute authorizes the assessment on pharmacists and other licensees, with exemptions for retired or inactive status. Budget for this recurring cost as part of your compliance program. ([pharmacy.ca.gov](https://www.pharmacy.ca.gov/about/fee_schedule.shtml?utm_source=openai))

CURES Data Reporting Obligations

What to report and when

Dispensing pharmacies must report every Schedule II–V controlled substance dispensation to CURES no later than one working day after the medication is released to the patient. Direct‑dispensing prescribers have different timelines (weekly reporting), so clarify roles if your site includes prescriber dispensing. This timely Schedule II–V reporting obligation applies statewide and underpins prescription data protection and diversion prevention. ([oag.ca.gov](https://www.oag.ca.gov/cures?utm_source=openai))

How to report: file format and vendor

All dispensers submit data electronically through Bamboo Health’s PMP Clearinghouse. As of August 1, 2024, California requires the ASAP 4.2B format; non‑conforming files are rejected. Confirm your pharmacy software outputs ASAP 4.2B and that transmissions reconcile daily. ([mbc.ca.gov](https://mbc.ca.gov/Resources/Medical-Resources/CURES/default.aspx?utm_source=openai))

Key carve‑outs affecting reporting

Effective January 1, 2026, AB 82 prohibits reporting prescriptions for, or the dispensing of, testosterone or mifepristone to CURES or DOJ’s contracted vendor. The law also directs removal of historical records of those drugs by deadlines set in the statute. Adjust your reporting logic accordingly and audit archives for compliance. ([oag.ca.gov](https://oag.ca.gov/cures?utm_source=openai))

If technology limitations or disasters interrupt reporting, deadlines may be extended until normal operations resume; document disruptions and resume submissions promptly. ([law.justia.com](https://law.justia.com/codes/california/code-hsc/division-10/chapter-4/article-1/section-11165/?utm_source=openai))

Restrictions on Data Use

Use CURES solely for care and compliance

California CURES Query Log Privacy Laws require that you access CURES only for authorized purposes: treating a patient under your care or documenting compliance with the law. Patient activity reports you receive are “medical information” subject to the California Confidentiality of Medical Information Act (CMIA) and HIPAA; build policies that reflect HIPAA compliance and CMIA standards. ([oag.ca.gov](https://oag.ca.gov/cures/regulations?utm_source=openai))

Query log privacy and security requirements

When you integrate CURES with a health information technology system, the system must authenticate the user and transmit specific query metadata (date, time, patient first/last name, date of birth, and the identity of the CURES user on whose behalf the query is made). These query logs support auditability and controlled substances database security while reinforcing prescription data protection. ([pharmacy.ca.gov](https://www.pharmacy.ca.gov/laws_regs/lawbook.pdf?preview=true&site_id=816))

DOJ may deny or suspend access for inadequate controls, so enforce least‑privilege access, monitor query activity, and keep credentials current. ([pharmacy.ca.gov](https://www.pharmacy.ca.gov/laws_regs/lawbook.pdf?preview=true&site_id=816))

Prohibited Data Disclosure

No sale or marketing use

CURES data may not be sold. Pharmacist‑Users and Delegate‑Users are expressly barred from selling any patient information obtained from CURES. Any use or transfer must also comply with CMIA and HIPAA. ([oag.ca.gov](https://www.oag.ca.gov/system/files/media/CURES%20-%20Text%20of%20Adopted%20Regulations.pdf))

Limited, purpose‑bound sharing

Disclosure is narrowly permitted to another treating prescriber or pharmacist for a patient under their care, or to your licensing board to document compliance—always for the same authorized purpose and under privacy safeguards. DOJ may provide de‑identified, aggregated data for research, peer review, or education without compromising patient identity; pharmacies themselves must not release identifiable data for these purposes. ([oag.ca.gov](https://www.oag.ca.gov/system/files/media/CURES%20-%20Text%20of%20Adopted%20Regulations.pdf))

E-Prescribing of Controlled Substances

State mandate and exceptions

California requires most prescriptions to be issued electronically under Business and Professions Code section 688. For controlled substances, E‑Prescribing of Controlled Substances (EPCS) must meet DEA 21 CFR Part 1311 requirements. If a technological or electrical failure prevents EPCS, prescribers must document the reason in the medical record within 72 hours. Statutory exemptions apply (for example, declared disasters, ≤100 prescriptions per year, or circumstances where timely access would be adversely affected), but they are limited and subject to documentation and, in some cases, annual exemption registration. ([mbc.ca.gov](https://www.mbc.ca.gov/Resources/Medical-Resources/e-prescriptions.aspx/1000))

CURES Access for Delegates

Delegate access authorization

Delegates may query CURES on behalf of an Authorizing User (e.g., a pharmacist) only with an active, written Delegate Agreement. The agreement term may not exceed 12 months, and the Authorizing User is responsible for all delegate access and compliance. Each query must identify the Authorizing User, and the patient must be under that user’s care. ([oag.ca.gov](https://www.oag.ca.gov/system/files/media/CURES%20-%20Text%20of%20Adopted%20Regulations.pdf))

Audits, renewals, and credentials

Authorizing Users can generate Delegate Audit Reports and must keep associations current; delegates complete annual renewals and maintain compliant passwords, with periodic changes required. These controls help ensure HIPAA compliance and uphold CMIA protections within CURES workflows. ([oag.ca.gov](https://www.oag.ca.gov/system/files/media/CURES%20-%20Text%20of%20Adopted%20Regulations.pdf))

Recent CURES Regulatory Updates

ASAP 4.2B submission standard

Beginning August 1, 2024, dispensers must submit CURES data in ASAP 4.2B via Bamboo Health’s PMP Clearinghouse. Confirm your vendor’s certification and run test submissions to avoid rejections. ([oag.ca.gov](https://oag.ca.gov/system/files/media/new-file-format-for-reporting-to-cures.pdf?utm_source=openai))

AB 82 privacy changes

As of January 1, 2026, do not report testosterone or mifepristone to CURES; DOJ is also removing prior records per statutory timelines. Update SOPs, software rules, and staff training to reflect this privacy‑protective change. ([oag.ca.gov](https://oag.ca.gov/cures?utm_source=openai))

Interstate data sharing and system safeguards

Any interstate PDMP data‑sharing agreement must meet California’s privacy, audit, and data security standards. DOJ also cannot access patient‑identifiable information within your EHR during CURES integrations; access is limited to what is required for secure data transfer. ([law.justia.com](https://law.justia.com/codes/california/code-hsc/division-10/chapter-4/article-1/section-11165/?utm_source=openai))

Program funding and fee updates

CURES operations are funded in part through licensee assessments. Pharmacist renewals currently include a $30 CURES fee, and statute directs the Department of Consumer Affairs to contract with DOJ to operate and maintain CURES for specified boards. Track Board notices for future fee adjustments. ([pharmacy.ca.gov](https://www.pharmacy.ca.gov/about/fee_schedule.shtml?utm_source=openai))

FAQs.

What are the CURES registration requirements for pharmacists?

Pharmacists must register for CURES upon issuance of their California pharmacist license. Maintain accurate account details, effective access controls, and timely updates to avoid suspension or denial of access. ([oag.ca.gov](https://oag.ca.gov/cures/faqs?utm_source=openai))

How must CURES data be protected under privacy laws?

Patient activity reports are medical information governed by the Confidentiality of Medical Information Act and HIPAA. Use CURES only for treatment of a patient under your care or to document legal compliance, protect query logs, and ensure your systems authenticate users and transmit required query metadata securely. ([law.justia.com](https://law.justia.com/codes/california/2024/code-hsc/division-10/chapter-4/article-1/section-11165-1/?utm_source=openai))

Can pharmacies disclose or sell CURES data?

No. Selling CURES data is prohibited. Limited disclosures are allowed—to another treating prescriber or pharmacist for the same patient, or to your licensing board to document compliance—subject to CMIA and HIPAA. De‑identified, aggregated releases for research or education occur through DOJ, not by pharmacies. ([oag.ca.gov](https://www.oag.ca.gov/system/files/media/CURES%20-%20Text%20of%20Adopted%20Regulations.pdf))

What recent changes affect CURES reporting obligations?

Two major updates: the ASAP 4.2B reporting format became mandatory on August 1, 2024, and, effective January 1, 2026, AB 82 removed testosterone and mifepristone from CURES reporting (with prior records scheduled for removal). Verify your software and SOPs reflect both changes. ([oag.ca.gov](https://oag.ca.gov/system/files/media/new-file-format-for-reporting-to-cures.pdf?utm_source=openai))

In summary, independent pharmacies should ensure timely Schedule II–V reporting, maintain airtight HIPAA and CMIA safeguards around CURES query logs, strictly limit data use and disclosure, keep EPCS processes compliant, govern delegate access with written agreements and audits, and stay ahead of evolving state requirements like ASAP 4.2B and AB 82.