County of Los Angeles v. Superior Ct. ( 2021 )

Filed 6/15/21
CERTIFIED FOR PUBLICATION
COURT OF APPEAL, FOURTH APPELLATE DISTRICT
DIVISION ONE
STATE OF CALIFORNIA
COUNTY OF LOS ANGELES, D077794
Petitioner, (Super. Ct. No. 30-2014-00725287-
CU-BT-CXC)
v.
THE SUPERIOR COURT OF
ORANGE COUNTY,
Respondent;
JOHNSON & JOHNSON et al.,
Real Parties in Interest.
COUNTY OF ALAMEDA, D077795
Petitioner, (Super. Ct. No. 30-2014-00725287-
CU-BT-CXC)
v.
THE SUPERIOR COURT OF
ORANGE COUNTY,
Respondent;
JOHNSON & JOHNSON et al.,
Real Parties in Interest.
CONSOLIDATED ORIGINAL PROCEEDINGS in mandate.
Peter J. Wilson, Judge. Petitions granted.
Mary C. Wickham and Rodrigo A. Castro-Silva, County Counsel,
Robert E. Ragland, Scott Kuhn, Andrea Ross, Tracy Hughes, Deputies
County Counsel; Bradley Bernstein Sands and Erin B. Bernstein for
Petitioner County of Los Angeles.
Donna R. Ziegler, County Counsel, Kathleen A. Pacheco, Raymond J.
Leung, Deputies County Counsel, for Petitioner County of Alameda.
O’Melveny & Myers, Michael G. Yoder, Amy J. Laurendeau, Charles C.
Lifland, Sabrina H. Strong, Amy R. Lucas, Jonathan P. Schneller for Real
Parties in Interest Johnson & Johnson et al.
I.
INTRODUCTION
In the lawsuit underlying these consolidated writ proceedings, the
People of the State of California, by and through the Santa Clara County
Counsel, the Orange County District Attorney, the Los Angeles County
Counsel, and the Oakland City Attorney, filed an action against defendants—
various pharmaceutical companies involved in the manufacture, marketing,
distribution, and sale of prescription opioid medications. (People v. Purdue
Pharma (Super Ct. Orange County, 2014, No. 30-2014-00725287-CU-BT-
CXC) (“Underlying Action”).)
In the operative sixth amended complaint, the People allege that the
defendants made false and misleading statements as part of a deceptive
marketing scheme designed to minimize the risks of opioid medications and
inflate their benefits. This scheme, the People allege, caused a public health
crisis in California by dramatically increasing the number of opioid
2
prescriptions, the use and abuse of opioids, and opioid-related deaths. The
operative complaint contains causes of action for violations of the False
Advertising Law (Bus. & Prof. Code, § 17500 et seq.), the Unfair Competition
Law (Bus & Prof. Code, § 17200 et seq.), and the public nuisance statutes
(Civ. Code, §§ 3479, 3480) and seeks declaratory and injunctive relief, as well
as civil penalties.
In Board of Registered Nursing v. Superior Court (2021) 59 Cal.App.5th
1011 (Board of Registered Nursing), this court recently considered the
propriety of several discovery orders in the Underlying Action that compelled
four nonparty state agencies to produce to defendants various categories of
documents related to opioids.1 (Id. at p. 1021.) Of relevance to these writ
proceedings, the Board of Registered Nursing court considered the legality of
a superior court order requiring the production of prescription records
contained in the state’s Controlled Substance Utilization Review and
Evaluation System (CURES) database. (Id. at p. 1022.) The order required
the Department of Justice to produce CURES prescription records for
individually identified patients to an outside vendor. The vendor would then
replace patient names with unique identifiers, cross-reference the records
with other datasets in the vendor’s possession, and provide the linked
deidentified datasets to the defendants. (Id. at p. 1045.)2
1 The Board of Registered Nursing court noted that the discovery was
sought on behalf of all defendants in the Underlying Case and that all
defendants appeared as real parties in the writ proceedings in this court.
(Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1024, fn. 2.)
2 The court’s order compelling production required either “(1) the
production of patient identifying data to defendants’ vendor or (2) the
production of data with patient identifying data replaced with a unique
identifier supplied by defendants’ vendor that would allow the vendor to
3
In a writ proceeding challenging the propriety of the order, after
observing that the production of identified patient data to an outside vendor
for deidentification “would . . . implicate the privacy rights of the patients”
(Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1045), the Board of
Registered Nursing court concluded that defendants “ha[d] not justified such
a sweeping production of personal and private medical data” under the law
governing nonparty discovery. (Id. at p. 1038, citing Calcor Space Facility,
Inc. v. Superior Court (1997) 53 Cal.App.4th 216, 223 (Calcor).) Accordingly,
the Board of Registered Nursing court held that the superior court abused its
discretion in ordering production of the CURES records.
The present writ proceedings pertain to another discovery dispute in
the Underlying Action. The dispute arose after several of the defendants in
the Underlying Action (“Johnson & Johnson defendants”),3 served subpoenas
on two nonparty counties, petitioners County of Los Angeles and County of
Alameda, seeking records of patients in various county programs, including
individual prescription data and individual patient records related to
substance abuse treatment.
In its petition, the County of Los Angeles describes the documents at
issue as including “detailed data for over one million dispensed medications,
along with pharmacy and prescriber identifiers, as well as over 1.7 million
associated encounters, including diagnoses, procedures, medical service,
treating provider and attending (billing) provider” (italics omitted) and
cross-reference CURES data with other data in its possession (e.g., insurance
claim data).” (Board of Registered Nursing, supra, 59 Cal.App.5th at
p. 1045.)
3 The Johnson & Johnson defendants are real parties Johnson &
Johnson, Janssen Pharmaceuticals, Inc., and Ortho-McNeil-Janssen
Pharmaceuticals, Inc.
4
“records for 5,867 individuals and over 65,000 associated encounters,
including diagnoses, procedures, and other clinical information,” pertaining
to “patients diagnosed with or treated for opioid use disorder, opioid
addiction, or overdose at LA County facilities.” In its petition, the County of
Alameda describes the documents as including “patient-level data related to
substance use treatment, pharmacy records, encounter data, and other
sensitive information.”4
After petitioners and the Johnson & Johnson defendants engaged in
various informal and formal means to attempt to resolve the dispute, the
superior court issued a discovery order granting the Johnson & Johnson
defendants’ motions to compel production of the records. As with the CURES
data at issue in Board of Registered Nursing, the court’s order directed
petitioners to provide the records on a personally “identified” basis to a
vendor that would “de-identify [the] data and make it cross-referenceable
against other de-identified data processed by [the vendor] in this case.” The
4 Similarly, in their informal response in this court, the Johnson &
Johnson defendants summarized the records at issue as follows:
“The specific records at issue here are: (1) opioid
prescription records and healthcare services records for
patients with opioid-related diagnoses from the Los Angeles
County Department of Health’s Online Real-time
Centralized Health Information Database (‘ORCHID’),
which tracks healthcare services provided by publicly
funded healthcare centers in Los Angeles County [citation];
(2) patient-level data from the Los Angeles County
Participant Reporting System (‘LACPRS’), a repository of
data used to measure substance abuse treatment and/or
recovery outcomes measures [citation]; and (3) Medi-Cal
data involving opioids for all patients treated by Alameda
County, including prescription data, claims data, or
encounter data [citation].”
5
court’s order specifies that “[o]nly fully de-identified data will be provided by
[the vendor] to defendants (or any other party in this case).”
Each petitioner filed a petition for writ of mandate in this court,
seeking vacatur of the superior court’s order compelling production of the
documents. The petitioners claim that the discovery order implicates the
state constitutional privacy rights of the individuals whose records the
superior court ordered produced, among other arguments. We consolidated
the petitions and issued an order to show cause.
In determining whether a discovery order would violate state
constitutional privacy rights, we apply the framework established in Hill v.
National Collegiate Athletic Assn. (1994) 7 Cal.4th 1 (Hill). (See Williams v.
Superior Court (2017) 3 Cal.5th 531, 552, 556 (Williams) [stating that Hill
applies to a discovery dispute that “requires a court to reconcile asserted
privacy interests with competing claims for access”].) In applying the Hill
test, “[t]he party asserting a privacy right must establish a legally protected
privacy interest, an objectively reasonable expectation of privacy in the given
circumstances, and a threatened intrusion that is serious.” (Williams, supra,
at p. 552, citing Hill, supra, at pp. 35–37.) “The party seeking information
may raise in response whatever legitimate and important countervailing
interests [the] disclosure serves,” and “[a] court must then balance these
competing considerations.” (Williams, supra, at p. 552, citing Hill, supra, at
pp. 37–40.)
As we explain in part III, post, we conclude that petitioners have
established that the superior court’s order threatens a serious intrusion into
the privacy interests of the patients whose records are at issue. In
considering whether the Johnson & Johnson defendants have “demonstrated,
under the heightened standard applicable to constitutional rights of privacy,
6
a practical necessity for discovery [of the records],” (John B. v. Superior Court
(2006) 38 Cal.4th 1177, 1201), we observe that the Johnson & Johnson
defendants seek to obtain opioid prescription data similar to the CURES data
at issue in Board of Registered Nursing, as well as substance abuse treatment
records, which threatens to cause an even more substantial invasion of
privacy rights. Yet, the Johnson & Johnson defendants fail to provide a
justification for the discovery of such records that differs in any material way
from that which this court found insufficient in Board of Registered Nursing
to justify discovery under the broad Calcor standard applicable to nonparty
discovery requests generally. (See Board of Registered Nursing, supra,
59 Cal.App.5th at p. 1039 [“ ‘Although the scope of civil discovery is broad, it
is not limitless,’ ” quoting Calcor, supra, 53 Cal.App.4th at p. 223].)
Therefore, and for reasons we explain more fully in part III, post, we conclude
that the Johnson & Johnson defendants have failed to demonstrate that their
interests in obtaining “such a vast production of medical information” (Board
of Registered Nursing, supra, at p. 1046) outweigh the significant privacy
interests that the nonparty petitioners have identified. (See Williams, supra,
3 Cal.5th at p. 556 [where “a discovery request seeks information implicating
the constitutional right of privacy,” the party seeking discovery must make a
showing of need greater than that needed for discovery requests generally].)
Accordingly, we grant petitioners’ writ petitions and direct the superior
court to vacate its order compelling production of the requested documents
and to enter a new order denying Johnson & Johnson defendants’ motions to
compel.5
5 The petitioners also contend that the superior court’s order should be
vacated because it orders disclosure of substance use disorder patient
records, in violation of federal law (42 C.F.R § 2 et seq.) and because the
superior court lacked authority to order the public entities to enter into a
7
II.
FACTUAL AND PROCEDURAL BACKGROUND
A. The operative complaint
In June 2018, the People filed the operative complaint against
defendants. According to the operative complaint, the defendants engaged in
wide ranging illegal misconduct designed to promote the use of opioids. The
People alleged that defendants targeted susceptible prescribers and
vulnerable patient populations with false and misleading statements about
opioids. Specifically, according to the People, the defendants falsely
downplayed, and failed to disclose, the known risks of long-term opioid use.
Defendants also “[g]rossly [o]verstated” the benefits of chronic opioid therapy.
The operative complaint alleges that defendants carried on this “marketing
scheme” through varied means, including the use of direct marketing of
branded opioids and the use of “seemingly independent third parties.” The
People further allege that defendants’ efforts led to a huge increase in the
number of opioid prescriptions and the use of such drugs, which has resulted
in a public health crisis that includes high rates of opioid abuse and addiction
and ancillary social costs.
The operative complaint relies on such allegations to state causes of
action for false advertising (Bus & Prof. Code, § 17500), unfair competition
(Bus & Prof. Code, § 17200), and public nuisance. (Civ. Code, §§ 3479, 3480.)
The People seek civil penalties for each act of false advertising and
unfair competition and an order requiring defendants to abate the public
nuisance. In addition, the People seek declaratory and injunctive relief.
contract with an intermediary for the purpose of deidentifying the
documents. In light of our granting the petitions for the reasons stated in the
text, we need not, and do not, address these additional arguments for
vacatur.
8
B. The underlying discovery dispute
In December 2018, the Johnson & Johnson defendants6 served
business record subpoenas on two agencies of the County of Los Angeles
seeking claims data for opioid prescriptions, healthcare services, and
substance-abuse treatment. The subpoenas sought broad categories of
information including:
“All Documents and Communications concerning or
relating to any assessment of actual or potential harm to
specific Patients or other specific individuals as a result of
any Subject Opioid or any Defendant’s Marketing,
Educational Activities, or statements about any Subject
Opioid.”
“Participant-level Claims Data showing the full Medicaid or
other Program Claims history for prescriptions and other
health care services submitted to Medicaid or any other
Program, whether reimbursed or not, for all Patients who
received a prescription for any Subject Opioid.”
The Johnson & Johnson defendants served similar subpoenas on
various County of Alameda agencies.
The County of Los Angeles identified two sets of responsive data:
(1) opioid prescription and medical encounter data from publicly funded
healthcare centers tracked by the County of Los Angeles Department of
Health Services’ Online Real-time Centralized Health Information Database
(“ORCHID”); and (2) patient-level claims data measuring substance-abuse
6 Although the December 6, 2018 subpoena contained in the exhibits to
the County of Los Angeles’s writ petition appears to have been served by
defendants other than the Johnson & Johnson defendants, the Johnson &
Johnson defendants admit in their return “that they served [County of Los
Angeles] with a subpoena on December 6, 2018.” Accordingly, we refer to the
discovery sought in this case from the County of Los Angeles as having been
sought by the Johnson & Johnson defendants.
9
treatment recovery outcomes tracked by the Los Angeles County Participant
Reporting System (“LACPRS”). The County of Alameda identified data for
patients that the county treats through its implementation of the Medi-Cal
program “including prescription data, claims data, [and] encounter data.”
After engaging in various informal discovery efforts, the Johnson &
Johnson defendants filed motions to compel the petitioners to provide the
requested data on an identified basis7 to an outside vendor, Rawlings &
Associations (Rawlings). Rawlings would in turn “de-identify” the data by
assigning unique identifiers to each record that would make the data “cross-
walkable,” with other data processed by Rawlings. The deidentified, but
cross-walkable, records would then be shared with the Johnson & Johnson
defendants.
Petitioners opposed the motions on several grounds, including that
privacy protections bar the production of identifiable patient data to a third
party. The Johnson & Johnson defendants argued in turn that a March 2019
Stipulated Qualified Protective Order for Protected Health Information
(Protective Order) previously entered in the case would sufficiently protect
any privacy interests.
C. The discovery referee’s reports and recommendations
After the parties submitted briefing and a discovery referee held
several hearings on the discovery issues presented in these writ proceedings
as well as numerous other discovery disputes, the discovery referee issued
two reports and recommendations to grant the Johnson & Johnson
defendants’ motions to compel. As to the County of Los Angeles, with respect
to the ORCHID data, the referee agreed that the Protective Order “in
7 By “on an identified basis,” we mean “containing personal information
sufficient to identify an individual person.”
10
practice, requires that the County produce its data to Rawlings so that
Rawlings can de-identify the data and make it cross-walkable.”8 With
respect to the LACPRS data, the referee rejected the County of Los Angeles’s
privacy arguments based on federal regulations governing substance abuse
treatment records, reasoning that “the focus must be on whether the
requesting party receives the data in de-identified form, not a third-party
vendor.” With respect to the County of Alameda, the referee issued a report
determining that “[County of] Alameda fails to provide a sufficient basis to
object to the production of the requested information where, as here, the
information will be produced pursuant to a stringent . . . Protective Order.”
D. Petitioners’ objections to the discovery referee’s report and
recommendations
Petitioners each filed objections to the discovery referee’s report and
recommendations. Among other arguments, the County of Los Angeles
argued that “[t]here is no basis, legal or factual, to order the reproduction of
identified patient data,” and that “[t]he Protective Order does not
contemplate, let alone require, that any entity must contract with and
produce identified heath data to a third-party vendor, and such a
requirement would violate the Protective Order as well as numerous privacy
law protections.” Specifically, the County of Los Angeles contended that “to
produce identifiable protected health information to any party or third party
would violate . . . the constitutional rights of third parties,” among other
laws.
8 The County of Los Angeles had previously produced the ORCHID data
in a deidentified format and the referee noted that the county argued that it
should not be compelled to “re-produce its ORCHID data in a manner which
would allow the datasets to be cross-referenced with other datasets.”
11
In its objection, the County of Alameda raised numerous arguments,
including those rooted in the privacy rights of the patients whose medical
data would be impacted by the production. Specifically, the County of
Alameda referred to the “privacy objections over having to produce
completely unredacted patient health information, including substance use
disorder information, to Rawlings,” that it had raised before the discovery
referee. For example, the County of Alameda referred to a supplemental
brief that it had filed opposing the Johnson & Johnson defendants’ motion to
compel that stated the following:
“[The Johnson & Johnson] Defendants have made NO
showing of why patient level data for the entirety of
Alameda County. . . are relevant. And they certainly do not
present any viable argument that the privacy interests of
these individuals are outweighed by what is, in essence, a
fishing expedition that casts a wide net for information
from a non-party.”
E. The Johnson & Johnson defendants’ responses
The Johnson & Johnson defendants filed responses to the petitioners’
objections. With respect to the County of Los Angeles’s objections, the
Johnson & Johnson defendants noted that the County had “mention[ed]—
again, without explanation—‘the constitutional rights of third parties.’ ” The
Johnson & Johnson defendants argued that the superior court had ruled,
with respect to previous discovery issues in the case, that deidentification
and the Protective Order would suffice to protect constitutional privacy rights
and that “ ‘[t]he limited invasion being permitted here is justified due to the
relevance of the discovery to Plaintiffs[’] claims.’ ” The Johnson & Johnson
defendants argued that the court should reach the same conclusion with
respect to the County of Los Angeles’s production.
12
In their opposition to the County of Alameda’s objections, the Johnson
& Johnson defendants argued that the Protective Order and “precautions
taken by the parties and third parties operating under it ensure that privacy
laws will be fully complied with while providing the parties access to claims
data critical to testing Plaintiff[s’] theory of the case.”
F. The superior court’s order granting the Johnson & Johnson defendants’
motions to compel
After a hearing, the superior court entered an order on July 6, 2020
granting the Johnson & Johnson defendants’ motions to compel. The court
ordered the County of Los Angeles “to provide to Rawlings the identified data
for the County’s previous ORCHID production to defendants, so that
Rawlings can de-identify all such data and make it cross-referenceable
against other de-identified data processed by Rawlings in this case.” The
court also ordered the County of Los Angeles to produce the LACPRS data to
Rawlings for deidentification. The court specified that “[o]nly fully de-
identified data will be provided by Rawlings to defendants (or any other party
in this case).” The court also ordered the County of Alameda to provide the
“Medi-Cal claims and prescription data,” specified in the discovery referee’s
report and recommendations on the same terms as the court specified for the
County of Los Angeles’s production.
The superior court also directed the Johnson & Johnson defendants to
modify the Protective Order to make Rawlings subject to the Protective
Order; to ensure that Rawlings expressly consented to such modification and
agreed to act in compliance with various provisions of federal law; and to
provide that all information produced by a nonparty would be subject to the
Protective Order.
13
G. Writ proceedings in this court
In August 2020, petitioners filed petitions for writ of mandate9 seeking
reversal of the superior court’s July 6 order, together with requests that this
court take judicial notice of the state agencies’ petitions for writ of mandate
in Board of Registered Nursing.
After soliciting and receiving informal responses from the Johnson &
Johnson defendants with respect to each petition, this court summarily
denied the petitions.
The Supreme Court granted petitioners’ petitions for review and
transferred the matters to this court with directions to vacate our orders
denying the petitions for writ of mandate and to issue orders directing
respondent superior court to show cause why the relief sought in the petitions
should not be granted. We acted in accordance with the Supreme Court’s
directions and consolidating the proceedings.
The Johnson & Johnson defendants filed a return by way of
answer/demurrer and a request that we take judicial notice of: (1) the June
8, 2018 operative sixth amended complaint in the Underlying Action; (2) the
Protective Order as revised pursuant to the July 6 order, and (3) the
February 26, 2020 hearing transcript of the discovery proceedings that led to
the writ proceedings in this court in Board of Registered Nursing.
9 The day after filing their initial petitions, petitioners each filed
amended petitions. For ease of reference, we refer to the amended petitions
as the petitions at issue in these proceedings. Although the writ petitions
were initially filed in Court of Appeal, Fourth District, Division Three, the
administrative presiding justice transferred the petitions to this division
pursuant to California Rules of Court, rule 10.1000(b)(1)(A).
14
Petitioners thereafter filed a reply, and both parties, pursuant to our
request, filed supplemental letter briefs concerning Board of Registered
Nursing.10
III.
DISCUSSION
Petitioners claim that the superior court’s July 6 discovery order
threatens to intrude on the state constitutional privacy rights (Cal. Const.,
art. I, § 1) of the patients whose medical information would be affected by the
order.11
10 We grant petitioners’ August 11, 2020 unopposed requests that we take
judicial notice of the state agencies’ petitions for writ of mandate in the
Board of Registered Nursing proceedings in this court. (See Evid. Code,
§§ 452, subd. (c) [permitting the taking of judicial notice of the “[o]fficial acts
of the legislative, executive, and judicial departments of the United States
and of any state of the United States”], 455, subd. (a), 459, subd. (c)
[specifying the manner by which a reviewing court may take judicial notice of
a “matter was not theretofore judicially noticed in the action”].)
We also grant the Johnson & Johnson defendants’ unopposed December
16, 2020 request that we take judicial notice of: (1) the June 8, 2018
operative sixth amended complaint in the Underlying Action; (2) the August
17, 2020 revised Protective Order, and (3) the February 26, 2020 hearing
transcript of the discovery proceedings that led to the writ proceedings in this
court in Board of Registered Nursing. (See Evid. Code, §§ 452, subd. (c), 455,
subd. (a), 459, subd. (c) [specifying the manner by which reviewing courts
may take judicial notice of judicial records].)
11 Although petitioners filed separate writ petitions in this court, they
joined in each other’s petitions and filed a consolidated reply. In addition,
petitioners’ state constitutional privacy claims are not materially distinct.
Thus, we address the state constitutional privacy claims raised in the writ
petitions jointly as a single claim.
15
A. Preliminary matters
Before considering the merits of petitioners’ claim, we address three
preliminary matters presented by their writ petitions.
First, although not specifically addressed in the briefing in these writ
proceedings, it is well established that, under appropriate circumstances, a
litigant “may assert the privacy rights of third parties.” (Tien v. Superior
Court (2006) 139 Cal.App.4th 528, 539.) One such circumstance is where the
litigant’s interests align with those of the third party and the third party’s
“rights are ‘likely to be diluted or adversely affected’ unless [the litigant] is
permitted to assert their rights on their behalf.” (Lewis v. Superior Court
(2017) 3 Cal.5th 561, 570 (Lewis) [concluding that physician had standing to
assert privacy rights of patients whose prescription records had been
accessed by state board].) For the same reasons that the Lewis court
concluded that a doctor could assert his patients’ privacy interests in their
prescription records, we conclude that the petitioners’ may assert the privacy
interests of the patients whose medical information they possess. (See ibid.[doctor could assert privacy rights of patients because: (1) patients might
“hesitate to seek appropriate medical treatment,” if records were disclosed
and doctor shared patients’ interest in seeking appropriate medical treatment
and; (2) patients were “unable to assert their own rights because they were
never given notice that their records were accessed”].)
Second, although discovery orders are ordinarily not reviewable on an
interlocutory basis (City of Petaluma v. Superior Court (2016)
248 Cal.App.4th 1023, 1031), writ review is appropriate “[w]here, as here, an
order will effectively . . . infringe on privacy rights.” (Los Angeles Gay &
Lesbian Center v. Superior Court (2011) 194 Cal.App.4th 288, 300
(Los Angeles Gay & Lesbian Center).) In such an instance, “review on appeal
16
is deemed inadequate because reversal on appeal will not cure the disclosure
of protected information.” (Ibid.) Accordingly, because petitioners lack an
“adequate remedy at law” to vindicate the third-party privacy rights at stake
in their petitions and those third parties “will suffer an irreparable injury”
(ibid.) if a writ is not granted, we conclude that writ review is appropriate.
Finally, although petitioners did not discuss Hill or present a developed
state constitutional argument in the superior court, for the following reasons,
we exercise our discretion to reach the merits of their state constitutional
claim, notwithstanding any possible forfeiture. (See People v. Williams
(1998) 17 Cal.4th 148, 161 [“An appellate court is generally not prohibited
from reaching a question that has not been preserved for review by a party”].)
To begin with, the privacy rights at stake are those of the petitioners’
patients, and we are therefore disinclined to conclude that petitioners’ briefing
in the superior court precludes our consideration of these rights. (See Boler
v. Superior Court (1987) 201 Cal.App.3d 467, 472, fn. 1.) In Boler, the court
considered whether the defendant had forfeited his right to object on privacy
grounds to deposition questions pertaining to the defendant’s prior sexual
history with certain nonparties. The Boler court rejected this argument,
reasoning in part:
“[T]he privacy protection extends to the unknown,
unnamed female partners of Boler who have neither
executed a waiver nor are even necessarily aware their
privacy interests are endangered by the deposition
question. Indeed, where third-party privacy interests are
involved, the target of discovery has an affirmative duty to
notify the third parties of the discovery request and give
them an opportunity to appear and object. [Citations.] An
inflexible waiver rule would defeat the exercise of this duty
and infringe upon the constitutional privacy rights of
citizens not participating in this lawsuit. [¶] Given the
fundamentality of the sexual privacy issue and the
17
interests of nonparties not present to object and the fact
that the trial court reached the merits, we decline to rule
that Boler has waived his sexual privacy objections.” (Ibid.)
In addition, although petitioners did not develop a state constitutional
privacy argument in the superior court, in their oppositions to the discovery
referee’s recommendations and reports, the County of Los Angeles specifically
mentioned “the constitutional rights of third parties” and the County of
Alameda reiterated its privacy objections to having to produce unredacted
patient health information. In addition, in its briefing before the discovery
referee, the County of Alameda argued that the Johnson & Johnson
defendants had failed to demonstrate that the “privacy interests of [patients]
are outweighed by what is, in essence, a fishing expedition.” Further,
petitioners alerted the superior court to the third-party privacy interests at
stake by extensively arguing that the requested discovery sought materials
protected by federal privacy regulations governing substance abuse
treatment records.
Moreover, the Johnson & Johnson defendants do not present any
forfeiture argument in this court,12 nor do they argue that there are disputed
facts relevant to a Hill analysis. (Williams, supra, 3 Cal.5th at p. 554, fn. 7
[“Because there are no disputed material facts, we may conduct a Hill
analysis for the first time on appeal”].) Indeed, in their return, the Johnson
& Johnson defendants argue that the superior court considered the state
constitutional privacy interests of third parties, contending that the
12 In their consolidated answer to petitioners’ petitions for review of our
initial summary denials of their writ petitions in the Supreme Court, the
Johnson & Johnson defendants did argue that petitioners “never raised Hill
or constitutional privacy rights below.” (Boldface & some italics omitted.)
18
“Superior Court performed its balancing obligation under Hill.” Under these
circumstances, we conclude that it is appropriate to consider petitioners’ state
constitutional privacy claim on the merits.13
B. Standard of review
Ordinarily, “[w]e review the trial court's grant or denial of a motion to
compel discovery for an abuse of discretion. [Citation.] . . . A circumspect
approach to appellate review of discovery orders ensures an appropriate
degree of trial court latitude in the exercise of that discretion.” (Williams,
supra, 3 Cal.5th at p. 540.) However, the Williams court cautioned that such
deference comes with a significant “caveat[ ].” (Ibid.)14 “ ‘ “[T]he scope of
discretion always resides in the particular law being applied, i.e., in the ‘legal
principles governing the subject of [the] action . . . .’ Action that transgresses
the confines of the applicable principles of law is outside the scope of
13 Notwithstanding our consideration of the merits of petitioners’ state
constitutional privacy claim under Hill, we find petitioners’ argument that
“the [superior] court erred in neglecting to apply the Hill test,” (first italics
added) and petitioners’ chiding of the Johnson & Johnson defendants’
“attempts to apply the Hill factors post hoc,” (second italics added) to be
misleading because petitioners failed to cite Hill or present an argument
based on the Hill framework in the superior court.
14 The Williams court also referred to a second “caveat[ ]” namely “the
prodiscovery policies of the statutory scheme.” (Williams, supra, 3 Cal.5th at
p. 540.) Without disregarding the statutory “preference for discovery” (ibid.),
we observe that the discovery at issue in this writ proceeding is sought from
nonparty petitioners, while in Williams, the discovery was sought from the
defendant. (See id. at p. 538.) As this court observed in Board of Registered
Nursing, the Supreme Court has cautioned that “[t]he permissible scope of
discovery in general is not as broad with respect to nonparties as it is with
respect to parties.” (Catholic Mutual Relief Society v. Superior Court (2007)
42 Cal.4th 358, 366, fn. 6 (Catholic Mutual Relief Society); see Board of
Registered Nursing, supra, 59 Cal.App.5th at p. 1039, citing Catholic Mutual
Relief Society, supra, at p. 366, fn. 6.)
19
discretion and we call such action an ‘abuse’ of discretion.” ’ [Citation.] An
order that implicitly or explicitly rests on an erroneous reading of the law
necessarily is an abuse of discretion. [Citation.]” (Ibid.)
The Williams court also noted that the application of Hill to requested
discovery constitutes one such principle of law that may be applied by a
reviewing court “as a matter of law,” where there are no disputed material
facts. (Williams, supra, 3 Cal.5th at p. 554, fn. 7.) Thus, because a
determination of whether the superior court’s discovery order implicates
constitutional privacy rights under Hill rests upon undisputed facts (see pt.
III.A, ante), we review this question of constitutional law de novo. (See, e.g.,
Alfaro v. Superior Court (2020) 58 Cal.App.5th 371, 384 [“Although in general
discovery rulings are reviewed for abuse of discretion, where, as here, ‘ “ ‘the
propriety of a discovery order turns on . . . a question of law,’ we ‘determine
the issue de novo’ ” ’ ”]; City of Los Angeles v. Superior Court (2017)
9 Cal.App.5th 272, 282 [when “ ‘the propriety of a discovery order turns on . .
. a question of law,’ we ‘determine the issue de novo’ ”].)
C. Governing law
1. Relevant principles of the law governing discovery from nonparties
In Board of Registered Nursing, supra, this court recently provided an
overview of the law governing discovery from nonparties:
“ ‘Although the scope of civil discovery is broad, it is not
limitless.’ (Calcor[, supra,] 53 Cal.App.4th [at p.] 223 . . . .)
In general, ‘any party may obtain discovery regarding any
matter, not privileged, that is relevant to the subject
matter involved in the pending action or to the
determination of any motion made in that action, if the
matter either is itself admissible in evidence or appears
reasonably calculated to lead to the discovery of admissible
evidence.’ (Code Civ. Proc., § 2017.010.) To meet this
standard, a party seeking to compel production of records
from a nonparty must articulate specific facts justifying the
20
discovery sought; it may not rely on mere generalities.
(Calcor, at p. 224.) In assessing the party’s proffered
justification, courts must keep in mind the more limited
scope of discovery available from nonparties. (See Catholic
Mutual Relief Society[, supra, at p. 366, fn. 6.])” (Board of
Registered Nursing, supra, 59 Cal.App.5th at p. 1039.)
“Even if information is otherwise discoverable, it may be protected by a
constitutional . . . privilege . . . [including] . . . the right to privacy . . . .”
(Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1039; Williams,
supra, 3 Cal.5th at p. 554 [stating that a trial court’s order denying a request
for discovery may be “affirmed on privacy grounds if . . . such concerns
supported denial of discovery”]; see Weil & Brown, Cal. Practice Guide: Civil
Procedure Before Trial (The Rutter Group 2020) ¶ 8:293 [“Even highly
relevant, nonprivileged information may be shielded from discovery if its
disclosure would impair a person’s ‘inalienable right of privacy’ provided by
Calif. Const. Art. 1, § 1”].)
2. The right to privacy under the California Constitution
a. The state constitutional amendment adding a right of privacy
“In November 1972, the voters of California specifically amended
article I, section 1 of our state Constitution to include among the various
‘inalienable’ rights of ‘all people’ the right of ‘privacy.’ ” (White v. Davis
(1975) 13 Cal.3d 757, 773.)15 Among the “principal ‘mischiefs’ ” that the
constitutional amendment addressed was “the improper use of information
properly obtained for a specific purpose, for example, the use of it for another
purpose or the disclosure of it to some third party . . . .” (Id. at p. 775; see
15 “All people are by nature free and independent and have inalienable
rights. Among these are enjoying and defending life and liberty, acquiring,
possessing, and protecting property, and pursuing and obtaining safety,
happiness, and privacy.” (Cal. Const., art I, § 1, italics added.)
21
Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1039 [“Protection of
informational privacy is the provision’s central concern”]; see also Grafilo v.
Wolfsohn (2019) 33 Cal.App.5th 1024, 1033–1034 (Grafilo) [“[t]he provision’s
‘central concern’ is the ‘[p]rotection of informational privacy’ [citation]; that
is, the interest ‘in precluding the dissemination or misuse of sensitive and
confidential information’ ”].)
b. The Hill framework
In Hill, the California Supreme Court “articulated a two-part inquiry
for determining whether the right to privacy under article I, section 1 has
been violated.” (Lewis, supra, 3 Cal.5th at p. 571, citing Hill, supra, 7 Cal.4th
at p. 26.) “First, the complaining party must meet three ‘ “threshold
elements” . . . utilized to screen out claims that do not involve a significant
intrusion on a privacy interest protected by the state constitutional privacy
provision.’ [Citation.] The party must demonstrate ‘(1) a legally protected
privacy interest; (2) a reasonable expectation of privacy in the circumstances;
and (3) conduct by defendant constituting a serious invasion of privacy.’
[Citation.] This initial inquiry is necessary to ‘permit courts to weed out
claims that involve so insignificant or de minimis an intrusion on a
constitutionally protected privacy interest as not even to require an
explanation or justification by the defendant.’ [Citation.]” (Lewis, supra, at
p. 571.)
Second, if a claimant satisfies the threshold inquiry, “ ‘[a] defendant
may prevail in a state constitutional privacy case by negating any of the
three elements just discussed or by pleading and proving, as an affirmative
defense, that the invasion of privacy is justified because it substantively
22
furthers one or more countervailing interests.’ [Citation.]” (Lewis, supra,
3 Cal.5th at p. 572, citing Hill, supra, 7 Cal.4th at p. 40.)16
As alluded to in our discussion of the applicable standard of review (see
pt. III.B, ante), “The Hill test, conceived in the context of a pleaded cause of
action for invasion of privacy, has been applied more broadly, including to
circumstances where litigation requires a court to reconcile asserted privacy
interests with competing claims for access to third party contact
information.” (Williams, supra, 3 Cal.5th at p. 552.) A reviewing court “may
conduct a Hill analysis for the first time,” in a case in which “there are no
disputed material facts.” (Id. at p. 554, fn. 7.)
D. Application
We apply the Hill framework in considering whether the superior
court’s order implicates state constitutional privacy rights (Cal. Const., art. I,
§ 1) of the patients whose medical information would be affected by the order.
1. Petitioners have established the threshold elements of a Hill claim
We first consider whether petitioners have carried their threshold
burden of demonstrating that the superior court’s discovery order threatens a
serious invasion of privacy.
16 If a defendant makes such a showing, “ ‘[t]he [claimant], in turn, may
rebut a defendant’s assertion of countervailing interests by showing there are
feasible and effective alternatives to defendant’s conduct which have a lesser
impact on privacy interests.’ [Citation.]” (Lewis, supra, 3 Cal.5th at p. 572,
citing Hill, supra, 7 Cal.4th at p. 40.) We need not discuss the rebuttal prong
further in this case, because, for the reasons discussed in part III.D, post, we
conclude that the Johnson & Johnson defendants have not identified
countervailing interests that outweigh the serious invasion of privacy
interests at issue in this case.
23
a. Legally protected privacy interest
In considering the first of the three factors comprising the threshold
inquiry, it is clear that patients “have a bona fide interest in the
confidentiality of their [medical] information.” (Williams, supra, 3 Cal.5th at
p. 554.) “[P]atients have a right to privacy with respect to information
contained in . . . medical records. Indeed, that right is well[-]settled.”
(Grafilo, supra, 33 Cal.App.5th at p. 1034, citing numerous cases].) It is a
right that is protected by case law as well as state and federal statutes and
regulations. (See, e.g., Civ. Code, § 56 et seq. [“This part may be cited as the
Confidentiality of Medical Information Act”]; 42 U.S.C. § 1320d et seq. Health
Insurance Portability and Accountability Act (HIPAA) of 1996 [providing that
health care providers generally may not disclose medical information without
a patient’s authorization or court order]; Citizens for Health v. Leavitt,
428 F.3d 167, 172 (3d Cir. 2005) [describing administrative privacy
regulations promulgated pursuant to HIPAA].)
“Medical patients’ privacy interest, our Supreme Court has observed,
derives from their expectation of privacy in their physician’s files, which ‘may
include descriptions of symptoms, family history, diagnoses, test results, and
other intimate details concerning treatment.’ ” (Grafilo, supra,
33 Cal.App.5th at p. 1034, citing Lewis, supra, 3 Cal.5th at p. 575.) “ ‘[T]he
matters disclosed to the physician arise in most sensitive areas often difficult
to reveal even to the doctor. Their unauthorized disclosure can provoke more
than just simple humiliation in a fragile personality. . . . The individual’s
right to privacy encompasses not only the state of his mind, but also his
viscera, detailed complaints of physical ills, and their emotional overtones.
The state of a person’s gastro-intestinal tract is as much entitled to privacy
from unauthorized public or bureaucratic snooping as is that person’s bank
24
account, the contents of his library or his membership in the NAACP.’ ”
(Grafilo, supra, at p. 1034, quoting Board of Medical Quality Assurance v.
Gherardini (1979) 93 Cal.App.3d 669, 679.) As one court explained in
discussing the “examination of medical records within the purview of the
privacy amendment”:
“The information that may be recorded in a doctor’s files is
broad[-]ranging. The chronology of ailments and treatment
is potentially sensitive. Patients may disclose highly
personal details of lifestyle and information concerning
sources of stress and anxiety. These are matters of great
sensitivity going to the core of the concerns for the privacy
of information about an individual. The intrusion upon
personal privacy when a state agency examines such
records is substantial.” (Wood v. Superior Court (1985)
166 Cal.App.3d 1138, 1147 (Wood).)
Medical records pertaining to substance abuse treatment, such as those
at issue in this case, are an example of such “highly personal details” (Wood,
supra, 166 Cal.App.3d at p. 1147) that are entitled to even greater privacy
protections under both state and federal law. (See Health & Saf.,
§ 11845.5;17 42 U.S.C. § 290dd-2; 42 C.F.R. § 2.1 et seq.) One court
17 Health & Safety Code section 11845.5 provides:
“(a) The identity and records of the identity, diagnosis,
prognosis, or treatment of any patient, which identity and
records are maintained in connection with the performance
of any alcohol and other drug abuse treatment or
prevention effort or function conducted, regulated, or
directly or indirectly assisted by the department shall,
except as provided in subdivision (c), be confidential and be
disclosed only for the purposes and under the
circumstances expressly authorized under subdivision (b).
“(b) The content of any records referred to in subdivision (a)
may be disclosed in accordance with the prior written
consent of the client with respect to whom the record is
25
maintained, but only to the extent, under the
circumstances, and for the purposes as clearly stated in the
release of information signed by the client.
“(c) Whether or not the client, with respect to whom any
given record referred to in subdivision (a) is maintained,
gives his or her written consent, the content of the record
may be disclosed as follows:
“(1) In communications between qualified professional
persons employed by the treatment or prevention program
in the provision of service.
“(2) To qualified medical persons not employed by the
treatment program to the extent necessary to meet a bona
fide medical emergency.
“(3) To qualified personnel for the purpose of conducting
scientific research, management audits, financial and
compliance audits, or program evaluation, but the
personnel may not identify, directly or indirectly, any
individual client in any report of the research, audit, or
evaluation, or otherwise disclose patient identities in any
manner. For purposes of this paragraph, the term
‘qualified personnel’ means persons whose training and
experience are appropriate to the nature and level of work
in which they are engaged, and who, when working as part
of an organization, are performing that work with adequate
administrative safeguards against unauthorized
disclosures.
“(4) If the recipient of services is a minor, ward, or
conservatee, and his or her parent, guardian, or
conservator designates, in writing, persons to whom his or
her identity in records or information may be disclosed,
except that nothing in this section shall be construed to
compel a physician and surgeon, psychologist, social
worker, nurse, attorney, or other professional person to
reveal information that has been given to him or her in
confidence by members of the client’s family.
“(5) If authorized by a court of competent jurisdiction
granted after application showing probable cause therefor,
26
summarized federal law pertaining to substance abuse treatment records as
follows:
“ ‘Federal law restricts the disclosure of information
obtained “in connection with the performance of any
program or activity relating to substance abuse education,
prevention, training, treatment, rehabilitation or research”
conducted by the United States or with federal money.’
[Citations.] The purpose of such restrictions is ‘to protect
“the patient, the physician-patient relationship, and the
treatment programs.” ’ [Citations.] ‘It is not only the
privacy rights of individual patients that are at stake here,
but also the continued effectiveness and viability of
important substance abuse treatment programs.’
[Citations]; see also Whyte v. Connecticut Mut. Life Ins.
Co., 818 F.2d 1005, 1010 (1st Cir. 1987) (‘[A]bsolute
confidentiality is an indispensable prerequisite to
successful [substance abuse] research . . . [and]
treatment.’). ‘Without guarantees of confidentiality, many
individuals with [substance abuse] problems would be
reluctant to participate fully in [substance abuse]
programs.’ [Citations.]” (United States ex rel. Gelfand v.
Special Care Hosp. Mgmt. Corp. (E.D.N.Y., June 10, 2010,
No. CV 02-6079 (LDW) (ETB) 2010 U.S.Dist. Lexis 57456,
*8–*9.)
With respect to the subset of records that may be said to constitute
“prescription records,”18 patients “retain a reasonable expectation of privacy”
in such records. (Lewis, supra, 3 Cal.5th at p. 575.) While we acknowledge
that patients’ privacy interest in prescription records is “less robust than the
as provided in subdivision (c) of Section 1524 of the Penal
Code.”
18 Such records include the data on “dispensed medications, along with
pharmacy and prescriber identifiers,” referred to in the County of Los
Angeles’s writ petition, and the “pharmacy records,” referred to in the County
of Alameda’s writ petition. (See generally pts. I, II.B, ante.)
27
privacy interest associated with medical records” (ibid.; see also ibid.
[“medical records contain far more sensitive information than do prescription
records”]), patients nevertheless maintain a significant privacy interest in
such records, particularly those for opioids, given the stigma associated with
substance abuse disorders.
b. Reasonable expectation of privacy
We also think it clear that patients have “a reasonable expectation of
privacy under the [particular] circumstances.” (Hill, supra, 7 Cal.4th at
p. 50.) To begin with, patients could reasonably rely on the statutory and
case law described in part III.D.1.a, ante, in expecting that their medical
information would not be used to facilitate the construction of a database for
litigation purposes.19
Further, the patients whose records are being sought have not taken
any litigation position that could possibly constitute a waiver of their privacy
rights. (See Britt v. Superior Court (1978) 20 Cal.3d 844, 864 [“while
[plaintiffs] may not withhold information which relates to any physical or
mental condition which they have put in issue by bringing this lawsuit, they
are entitled to retain the confidentiality of all unrelated medical . . .
treatment they may have undergone in the past” (fn. omitted)].) Nor have
such patients performed some other act that might indicate a willingness to
have their records disclosed. (Compare with Pioneer Electronics (USA), Inc.
v. Superior Court (2007) (Pioneer Electronics (USA), Inc.) 40 Cal.4th 360, 363,
372 [in consumer class action against the seller of allegedly defective
products in which plaintiff sought personal identifying information of
19 With respect to the substance abuse treatment records at issue in this
case, patients could have additionally reasonably relied on federally
mandated notices stating that, “federal law and regulations protect the
confidentiality of substance use disorder patient records.” (42 C.F.R. § 2.22.)
28
customers who had filed complaints with seller, concluding that complainants
had a reduced expectation of privacy because “complainants might
reasonably expect, and even hope, that their names and addresses would be
given to any such class action plaintiff”].)
In particular, the patients whose records were ordered disclosed are not
seeking to have their interests furthered by facilitating the payment of
insurance payments to their providers. Thus, we are unpersuaded by the
Johnson & Johnson defendants’ argument that such patients’ privacy rights
would not be invaded by the ordered production because the Confidentiality
of Medical Information Act permits patients’ medical information to be
“disclosed to a person or entity that provides billing, claims management,
medical data processing, or other administrative services for providers of
health care or health care service plans . . . .” (Civ. Code, § 56.10(c)(3).)
Nor can it be said that the patients’ reasonable expectation of privacy
was reduced because the Johnson & Johnson defendants are seeking to use
the requested discovery to further patients’ interests generally. (Compare
with Williams, supra, 3 Cal.5th at p. 554 [in considering whether plaintiff
employee was entitled to disclosure of contact information of defendant
employer’s other employees, stating “we doubt . . . fellow employees would
expect that information to be withheld from a plaintiff seeking to prove labor
law violations committed against them and to recover civil penalties on their
behalf,” citing numerous cases].)
Finally, we are not aware of, and the Johnson & Johnson defendants
have not cited, any historical practice, social norm, cultural practice or
physical setting that would reduce such patients’ expectations of privacy in
the present context. (See County of Los Angeles v. Los Angeles County
Employee Relations Com. (2013) 56 Cal.4th 905, 927 (County of Los Angeles)
29
[“ ‘customs, practices, and physical settings surrounding particular activities
may create or inhibit reasonable expectations of privacy’ ”]; compare with
Lewis, supra, 3 Cal.5th at pp. 568–569 [noting Court of Appeal’s conclusion
that release of CURES prescription data to Medical Board for investigative
purposes was supported by the fact that “ ‘well-known and long-established
regulatory history significantly diminishes any reasonable expectation of
privacy against the release of controlled substances prescription records to
state, local, or federal agencies for purposes of criminal, civil, or disciplinary
investigations’ ”].)
c. Serious invasion of privacy
In determining whether petitioners have established “ ‘a serious
invasion of privacy’ ” (Lewis, supra, 3 Cal.5th at p. 571), we must ask whether
the ordered disclosure is “ ‘sufficiently serious in [its] nature, scope, and
actual or potential impact to constitute an egregious breach of the social
norms underlying the privacy right.’ ” (County of Los Angeles, supra,
56 Cal.4th at p. 929, quoting Hill, supra, 7 Cal.4th at p. 37; see also County of
Los Angeles, supra, at p. 929 [“The disclosure contemplated in this case was
more than trivial. It rose to the level of a “ ‘serious’ ” invasion of privacy
under Hill”].)20
As discussed in part I, ante, as with the CURES prescription record
data at issue in Board of Registered Nursing, the court’s order directed
petitioners to provide the records on a personally identified basis to Rawlings
so that Rawlings could deidentify the data and make it cross-referenceable
against other deidentified data in the case. In Board of Registered Nursing,
20 The County of Los Angeles court considered whether the County, as an
employer, was required to provide a union with the home addresses and
telephone numbers of all represented employees, including those who had not
joined the union. (County of Los Angeles, supra, 56 Cal.4th at p. 912.)
30
this court stated that such disclosure “implicate[s] the privacy rights of the
patients.” (Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1045.)
For the reasons that follow, we reach a similar conclusion with respect to the
prescription records and substance abuse treatment records at issue in these
writ proceedings.
In considering the first of the Hill factors—the nature of the
disclosure—as discussed above, the order pertains, in part, to medical
records, “which may contain ‘matters of great sensitivity going to the core of
the concerns for the privacy of information about an individual.’ ” (Grafilo v.
Soorani (2019) 41 Cal.App.5th 497, 507.) Further, the nature of the medical
records at issue in this case—treatment records for a stigmatized condition—
only heightens the need for “robust protection.” (Ibid. [“The privacy interest
in psychiatric records is particularly strong and, in some respects, entitled to
more robust protection than other types of medical records”]; cf. Los Angeles
Gay & Lesbian Center, supra, 194 Cal.App.4th at p. 308 [“unnamed plaintiffs
have a reasonable expectation in the privacy of their medical records at the
Center given the extremely sensitive nature of the information contained in
them (sexually transmitted disease, possible HIV status, and sexual
orientation)”]; compare with Pioneer Electronics (USA), Inc., supra,
40 Cal.4th at p. 372 [“the proposed disclosure was not ‘particularly sensitive,’
as it involved disclosing neither one’s personal medical history [n]or current
medical condition”].) Moreover, patients were not notified of the ordered
disclosure, and while petitioners have asserted the rights of such patients, no
provision was made for a representative or multiple representatives of the
31
patients21 to participate in the discovery proceedings in the superior court.
(See Valley Bank of Nevada v. Superior Court (1975) 15 Cal.3d 652, 657 [“The
protection of [nonparty’s privacy right] should not be left entirely to the
election of third persons who may have their own personal reasons for
permitting or resisting disclosure of confidential information received from
others”].) Further, it is also almost certain that many such patients would
have strongly objected to the superior court’s disclosure order and would have
desired to participate in the proceedings to protect against disclosure. (Cf.
Sander v. Superior Court (2018) 26 Cal.App.5th 651, 655–657 (Sander) [in
case involving whether State Bar was required to disclose “individually
unidentifiable records,” (id. at p. 655, italics added) pertaining to bar
applicants’ “race or ethnicity, law school, transfer status, year of law school
graduation, law school and undergraduate GPA, LSAT scores, and
performance on the bar examination,” (ibid.) “more than a dozen individuals,”
and “two nonprofit professional associations of African American lawyers,”
intervened on the side of the State Bar, in order “ ‘to protect privacy and
reputational interests that are at the heart of the litigation between
Petitioners and the State Bar,’ ” (id. at pp. 656–657)].)
In sum, the nature of the disclosure—the production of patients’ opioid
prescription treatment history and/or substance abuse treatment records,
without notice to the patients—is consistent with a serious invasion of
privacy interests.
The scope of the disclosure ordered is also extremely broad, whether
considered as applied to an individual patient or with respect to the number
21 It is not difficult to imagine that there may be many different privacy
interests that patients might wish to assert, given the number of patient
records implicated by the superior court’s order.
32
of records implicated by the order. As to individual patients, the documents
to be produced include “encounter data” containing “diagnoses, procedures,
and other clinical information.” (See pt. I, ante.) As to the number of patient
records implicated by the order, the superior court ordered petitioners to
disclose all of the relevant patient records. (Compare with Snibbe v. Superior
Court (2014) 224 Cal.App.4th 184, 188–189 (Snibbe) [real party sought to
“discover all postoperative orders signed by petitioner between June 2010
and June 2011 and by [petitioner’s assistant] between June 2009 and June
2011,” but trial court “limited the scope of discovery to 160 postoperative
orders including provisions for the administration of opioids”].) As a result,
the number of patient records implicated by the court’s order is staggering.
For example, the County of Los Angeles states in their petition that the
records include “over 1.7 million associated encounters.” (Italics altered.)
The Johnson & Johnson defendants do not dispute this number or argue that
the order does not require—like the production at issue in Board of
Registered Nursing—a “vast production of medical information from the
nonparties here.” (Board of Registered Nursing, supra, 59 Cal.App.5th at
p. 1011.) Thus, the scope of the disclosure at issue also supports the
conclusion that the superior court’s order threatens a serious invasion of
privacy interests.
With respect to the “actual or potential impact,” (Hill, supra, 7 Cal.4th
at p. 37, italics added) of the ordered production on privacy rights, we
acknowledge that the trial court’s discovery order does not contemplate
public disclosure of the records, or even identified disclosure to the Johnson &
Johnson defendants. However, as the Supreme Court cautioned in a case
involving the disclosure of prescription records, constitutional privacy
concerns are not eliminated by the existence of protections against public
33
disclosure. (See Lewis, supra, 3 Cal.5th at p. 577 [“adequate protections
against public disclosure do not obviate constitutional concerns as privacy
interests are still implicated when the government accesses personal
information without disseminating it”]; accord Board of Registered Nursing,
supra, 59 Cal.App.5th at p. 1045 [“production of patient identifying
information” to defendants’ vendor for deidentification “would . . . implicate
the privacy rights of the patients” (citing Lewis)].)
Indeed, under the circumstances of this case, for the following reasons,
we conclude that the “actual or potential,” (Hill, supra, 7 Cal.4th at p. 37)
impact on patient privacy rights is substantial. With respect to “actual”
impact (ibid.), as petitioners remind us throughout their briefing, the
superior court’s order requires the production of fully identified data to
Rawlings. Thus, it cannot be disputed that the superior court’s order will
have some actual impact on patients’ privacy rights in that the court ordered
the production of their highly sensitive medical records and prescription data
on a fully personally identified basis to an outside entity without the notice or
consent of the patients.
This fact distinguishes this case from Snibbe, supra, 224 Cal.App.4th
190 and the case law on which Snibbe relied. In Snibbe, a patient died after
receiving pain medication after surgery. (Id. at p. 187.) The deceased
patient’s family members sued the petitioner surgeon for wrongful death.
(Ibid.) The family members sought to discover postoperative orders involving
other patients of the surgeon in an attempt to show that the surgeon had a
practice of permitting his physician’s assistant “ ‘to rely on boilerplate drug
orders for the administration of opioid pain medication.’ ” (Id. at p. 190.) The
family members’ “requests allowed for the redaction of patients’ names and
personal identifying information.” (Id. at p. 188.) After the surgeon objected
34
to the discovery on various grounds, the trial court granted the family
members’ motion to compel in part, limiting, as mentioned above, the scope of
discovery to 160 postoperative orders including provisions for the
administration of opioids. (Id. at p. 189.) The surgeon petitioned for a writ of
mandate to compel the trial court to vacate the discovery order for various
reasons, including that the order violated his patients’ privacy rights. (Id. at
p. 187.)
The Snibbe court recognized the privacy rights at stake,
notwithstanding the redacted nature of the records:
“As it stands, the discovery order is too broad. Based on
[the family members’] limited showing and the trial court’s
finding of relevance only as to the opioid provisions of
postoperative orders, allowing discovery of the orders in
their entirety is unreasonable. It is all the more so because
production of entire orders may raise legitimate concerns
about the scope of intrusion into patient privacy
rights . . . . ” (Snibbe, supra, 224 Cal.App.4th at p. 190.)
However, the Snibbe court concluded that patients lacked a privacy
interest in the “pain management provisions of otherwise redacted
postoperative orders.” (Snibbe, supra, 224 Cal.App.4th at pp. 191; see id. at
pp. 194–195.) The Snibbe court reasoned in part:
“[P]atients’ privacy rights are not infringed if ‘neither
disclosure of the patients’ identities nor disclosure of
identifying medical information was requested.’ (Board of
Medical Quality Assurance v. Hazel Hawkins Memorial
Hospital (1982) 135 Cal.App.3d 561, 565 [request for
unnamed charts of four patients did not infringe on
patients’ privacy rights] [(Board of Medical Quality
Assurance)]; see Kizer v. Sulnick (1988) 202 Cal.App.3d
431, 439 [(Kizer)] [privacy rights require no more than
deletion of named medical records in health study or ‘if
feasible, the deletion of information which individually
identifies the participants’].) The limited production of
35
redacted postoperative orders cannot be said to infringe on
patients’ privacy rights any more than the production of
unnamed patients’ charts.” (Id. at pp. 194–195.)22
The productions mandated by the courts in Snibbe and Board of
Medical Quality Assurance pertained to records that did not contain
personally identifying information. (See Snibbe, supra, 224 Cal.App.4th at
p. 191; Board of Medical Quality Assurance, supra, 135 Cal.App.3d at p. 566.)
In Kizer, supra, 202 Cal.App.3d at pp. 438–442, the court stated that “ ‘the
record does not disclose whether the study[23] refers to individually
22 Neither petitioners nor the Johnson & Johnson defendants cited
Snibbe, Board of Medical Quality Assurance, or Kizer in their briefing.
Further, while the Johnson & Johnson defendants assert in their
supplemental letter brief that there is a line of “unbroken case law[,] holding
that production of anonymized data for purposes of litigation does not violate
the right to privacy,” (italics added) they do not cite to any such cases in their
supplemental letter brief.
In their return, the Johnson & Johnson defendants cite Padron v.
Watchtower Bible & Tract Society of New York, Inc. (2017) 16 Cal.App.5th
1246, in which this court concluded that the third-party privacy rights at
issue in that case were adequately protected by the production of documents
in which “personal identifying information” was redacted (id. at p. 1270) and
Poway Unified School Dist. v. Superior Court (1998) 62 Cal.App.4th 1496 in
which this court concluded that “privacy concerns” (id. at p. 1506) related to
the disclosure of a minor’s tort claim form to a newspaper could be
“address[ed],” by “redacting released materials.” (Ibid.) We disagree that
these few fact-specific cases stand for the broad proposition that individuals
never maintain a privacy interest in anonymized data under California law.
(See fn. 25, post, and accompanying text.) However, as discussed in the text,
even assuming that patients do not maintain a privacy interest in
anonymized medical data, the discovery order at issue in these proceedings
mandates the production of identified data to Rawlings, and thus is not
governed by Snibbe or cases mandating the production of anonymized data.
23 Kizer involved a government agency’s request to obtain a “medical
study of the health effects on persons living near [a waste] facility,” which
36
identifiable medical records,’ ” but “[i]f such records are part of the study, the
right to privacy would justify, at most, either the deletion of any named
medical records upon the remainder of the health study being produced or, if
feasible, the deletion of information which individually identifies the
participants.”24 In contrast, in this case, the superior court’s order expressly
mandates that petitioners “provide to Rawlings the identified data.” More
generally, Snibbe, Board of Medical Quality Assurance, and Kizer do not
address whether the production of vast amounts of personally identifiable
medical data to a third-party vendor for deidentification purposes implicates
the privacy rights of the patients whose records are to be produced.
We assume, without deciding, that the Snibbe court and the cases on
which it relied were correct in concluding that patients have no privacy
interest in data that does not contain personally identifiable information.
(See also Sander v. State Bar of California (2013) 58 Cal.4th 300, 311 [stating
“If the applicant cannot be identified, disclosure of information does not
had been commissioned by a law firm representing plaintiffs in a civil action
against the facility. (Kizer, supra, 202 Cal.App.3d at p. 435.)
24 Kizer, supra, 202 Cal.App.3d at p. 439 was decided before Hill and thus
did not apply the Hill framework. However, to the extent that Kizer may be
read as stating that the study should be produced with personally identifiable
medical records to the extent that it was infeasible to delete such
information, we understand the case as being premised on the conclusion
that the invasion of privacy implicated by such disclosure would be
outweighed by the need for a government agency to “investigate . . . possible
health hazards posed by [a] waste facility.” (Kizer, supra, at p. 441.) The
Kizer court did not state that the production of identified medical records
would not constitute a serious invasion of privacy rights.
37
impair his or her privacy interests”].)25 We also observe that the Snibbe line
of cases, as well as Sander v. State Bar of California, supra, 58 Cal.4th 300,
were all decided before Lewis, and thus, those courts did not consider the
Lewis court’s observation that privacy concerns are not necessarily
eliminated with “adequate protections against public disclosure.” (Lewis,
supra, 3 Cal.5th at p. 577; see also id. at p. 581 (conc. opn. of Liu, J.) [“The
electorate was concerned about more than public disclosure when it passed
the privacy initiative in 1972, which amended the Constitution. The voters
were concerned that their privacy was violated whenever their personal
information was used or accessed without reason”].)
Irrespective of whether patients maintain privacy rights in their
deidentified data, the superior court’s order mandates the production of
“identified data” to Rawlings. (Italics added.) As to that data, the patients
whose records are at issue clearly maintain privacy rights. (See pt. III.D.1,
ante.) Moreover, petitioners’ briefing identifies at least three “potential
impact[s]” (Hill, supra, 7 Cal.4th at p. 37) related to such rights that are of
25 Whether an individual may have a privacy interest in information
pertaining to that individual even where that data is not linked to the
individual is an important legal question on which commentators have
expressed diverse views, given the many contexts in which the issue arises.
(Compare, e.g., Dunkel, Medical Privacy Rights in Anonymous Data:
Discussion of Rights in the United Kingdom and the United States in Light of
the Source Informatics Cases (2001) 23 Loyola L.A. Internat. & Comparative
L.Rev. 41, 41 [“a patient’s right to privacy is violated when personal medical
information is revealed to an unauthorized third party . . . this should hold
true even if such information is rendered anonymous by the removal of all
data relating to the patient’s identity” (fn. omitted)] with Charkow, The
Control over the De-Identification of Data (2003) 21 Cardozo Arts & Ent. L.J.
195, 197 [“the informational privacy interest for a data subject should extend
only to the use and sharing of personally identifiable information with
unauthorized persons” (fn. omitted)].)
38
significance. First, there is the potential for a data breach, whether
inadvertent or malicious, that might reveal identified patient data.26 Even
assuming that this risk is small, given the extremely sensitive nature of the
data at issue in this case, it is a risk that must be considered in determining
whether petitioners have demonstrated a “potential impact” on privacy
rights. (Ibid.)
Second, petitioners argue that “mass disclosure to an out-of-state data
miner would surely discourage meaningful treatment and impair trust
between [p]etitioners and their current, former, and future patients.” We
agree that there is, at a minimum, a potential that some persons might be
discouraged from seeking or continuing with treatment if they were to
become aware of the discovery order in this case, given the highly sensitive
nature of the data.27
Finally, and as emphasized by petitioners in reply,28 there maintains
the potential of “re-identification,” or the possibility that someone could “ ‘use
reasonable effort to match the person’s identity to details in the released
dataset sufficient to know enough information about the person to identify
him or her as a specific person.’ ” (Sander, supra, 26 Cal.App.5th at p. 658
26 The County of Los Angeles argued in its writ petition, “And if the
database that Defendants create is ordered to be produced in other cases,
unforeseen breaches are not out of the question.”
27 That potential was lessened by the protections fashioned by the
superior court to attempt to prevent public disclosure of identifiable patient
data.
28 The County of Los Angeles did reference this issue in its writ petition,
arguing, “One potential misuse of the database that Defendants seek to
create is the real possibility that it will include enough data points to allow
re-identification of the patients that Rawlings has purported to anonymize.”
39
[quoting a data privacy expert].) While the superior court’s discovery order
mandates that Rawlings “de-identify” the data, the possibility that
deidentified data may be reidentified when such data is made cross-
referenceable with other data sets is well documented. (See, e.g., id. at p. 659
[summarizing expert testimony to the effect that “[d]ata analytic companies
that deal in data compilations and derivations to link disparate datasets are
also becoming increasingly able to re-identify data historically regarded as
anonymous”]; Brasher, Addressing the Failure of Anonymization: Guidance
from the European Union’s General Data Protection Regulation (2018) 2018
Colum. Bus. L.Rev. 209, 211 [“In practice . . . anonymization fails to
permanently obstruct the identities of data subjects due to the potential for
deanonymization—the linking of anonymized data to ‘auxiliary’ information
to re-identify data subjects”]; Ohm, Broken Promises of Privacy: Responding
to the Surprising Failure of Anonymization (2010) 57 UCLA L.Rev. 1701,
1742 [stating that “we must abandon the pervasively held idea that we can
protect privacy by simply removing personally identifiable information,” as a
“discredited approach”].)
As one commentator noted in discussing the “well-documented failures
of anonymization”:
“Historically, the way to share private information without
betraying privacy was through anonymization, stripping
away all identifiers that could potentially uniquely identify
an individual or group of individuals. Anonymization,
however, proved to be anything but a ‘silver bullet.’ ”
(Bellovin et. al., Privacy and Synthetic Datasets (2019)
22 Stan. Tech. L.Rev. 3–4 (Bellovin).)
Bellovin argues that various high-profile reidentification incidents
suggest that it is often possible with “even novice computer aptitude to ‘join’
40
auxiliary information with a series of ‘perturbed’[29] data points and unveil
the very data that anonymization was designed to protect.” (Bellovin, supra,
at 4.)
Commentators have suggested various “[r]isk [f]actors,” to consider in
assessing the risk of reidentification, including the “[v]olume of [d]ata,”
because “large data sets have a high degree of unicity, which makes it easier
to launch reidentification attacks.” (Rubinstein & Hartzog, Anonymization
and Risk (2016) 91 Wash. L. Rev. 703, 741.) The Johnson & Johnson
defendants both acknowledge that Rawlings has “previously anonymized over
a dozen other databases containing tens of millions of records from
government agencies, private insurers, and the People in this case,” and seek
to make petitioners’ own massive datasets cross-referenceable with these
“multiple datasets.” Another risk factor for reidentification is the
“[s]ensitivity of the [d]ata,” because “[s]ome information, like health . . .
information, is more sensitive and thus more likely to be targeted by
attackers,” (ibid.). As discussed throughout this opinion, the disclosure
ordered in this case involves extremely sensitive medical and substance
abuse treatment information.
Finally, and critically, while the discovery order directs Rawlings to
“de-identify” the data, it contains no protocols or requirements as to how such
deidentification must be carried out. (Compare with Sander, supra,
26 Cal.App.5th at p. 658 [noting that “[a] primary issue [at trial] was whether
the four different protocols proposed by Petitioners to de-identify or
‘anonymize’ the data were sufficient to prevent matching a record in the
29 “ ‘Perturbed’ here refers to the traditional, remove-name-and-zip-code
styled sanitization techniques which often fail to exclude information which
may be linked together to reidentify individuals.” (Id. at p. 4, fn. 9.)
41
supposedly anonymous data to either an individual or a small group of
individuals”]; see also id. at pp. 659–663 [describing four different complex
deidentification protocols and noting “[p]rotocols 2 and 4 employ variations of
a concept known as ‘k-anonymity,’ ” in which “ ‘[t]he proper size of k (i.e. how
much anonymity to provide) is a policy question depending on the sensitivity
of the data and how ambiguous an identification is considered
permissible’ ”].) Given the massive size of the ordered production, the
multiple datasets, and the high sensitivity of the materials to be produced,
the risks associated with an order to provide identified data to a third-party
vendor with vague directions to “de-identify” such data, without any
specification as to how such deidentification must occur, presents a clear
potential threat to patient privacy.
d. Petitioners met their threshold burden to establish a serious
invasion of privacy interests
In sum, given the nature, scope and the actual and potential impact on
patient privacy, we conclude that petitioners have carried their threshold
burden of demonstrating that the superior court’s discovery order threatens a
serious invasion of privacy.
2. The Johnson & Johnson defendants have not identified interests in
favor of disclosure that outweigh the serious invasion of privacy that
such disclosure would entail
We next must consider whether the Johnson & Johnson defendants
have identified interests in favor of disclosure that outweigh the serious
invasion of privacy described in part III.D.1, ante. (See Williams, supra,3 Cal.5th at p. 557 [describing the shifting burdens in applying the Hill
framework]; Tom v. City and County of San Francisco (2004) 120 Cal.App.4th
674, 686 [“Because we conclude that respondents carried their burden of
demonstrating a serious invasion of their reasonable privacy interests, the
42
burden shifted to the City to show ‘that the invasion of privacy is justified
because it substantively furthers one or more countervailing interests’ ”].) In
conducting such inquiry, we may consider “the interest of the requesting
party, fairness to litigants in conducting the litigation, and the consequences
of granting or restricting access to the information.” (Los Angeles Gay &
Lesbian Center, supra, 194 Cal.App.4th at p. 307, citing Hill, supra, 7 Cal.4th
at p. 37.)
In considering the interests of the requesting party, we observe that the
Board of Registered Nursing court noted that defendants contended that the
CURES prescription data sought in that case was “relevant and
discoverable,” because it would demonstrate “whether defendants’ drugs were
associated with opioid abuse and overdoses,” and “whether patients were
engaged in illicit activities or whether they obtained prescriptions from
unauthorized prescribers.” (Board of Registered Nursing, supra,
59 Cal.App.5th at pp. 1045–1046.) The Board of Registered Nursing court
concluded that such interests were insufficient to justify the discovery of the
CURES prescription records —even when considering the broad scope of
discovery allowed from nonparties generally. (Id. at p. 1046, citing Calcor,
supra, 53 Cal.App.4th at p. 224.)
In this case, the Johnson & Johnson defendants seek to obtain opioid
prescription data similar to the CURES data at issue in Board of Registered
Nursing as well as substance abuse treatment records that threaten an even
more substantial invasion of privacy rights (see Lewis, supra, 3 Cal.5th at
p. 575, see also ibid. [“medical records contain far more sensitive information
than do prescription records”]).30 And, like the defendants in Board of
30 In their supplemental letter brief concerning Board of Registered
Nursing, the Johnson & Johnson defendants do not argue that the
43
Registered Nursing, the Johnson & Johnson defendants argue that such data
is necessary to determine “any ‘causal chain’ (or lack thereof) between
Defendants’ conduct and any alleged “adverse consequences” as alleged by
the People.” More specifically, as in Board of Registered Nursing, the
Johnson & Johnson defendants maintain that the discovery is relevant to
their contention “that any increase in opioid misuse, abuse, and overdose was
a function of illegal prescribing and dispensing, widespread criminal
diversion, and illicit drug trafficking.” Indeed, in the section of their return
arguing that the superior court’s order comports with Hill, the only legal
argument as to the relevance of the petitioners’ prescription and substance
treatment data that the Johnson & Johnson defendants advance is the
superior court’s relevance finding as to the discoverability of the state
agency’s CURES data that this court reversed in Board of Registered
Nursing.31
Given that the Board of Registered Nursing court concluded that such
interests were insufficient to justify disclosure under the broad Calcor
discovery standard (Board of Registered Nursing, supra, 59 Cal.App.5th
1011), we think it necessarily follows that such interests are not sufficient to
justify disclosure in light of the serious potential invasion of privacy rights
that exists in this case. This conclusion is strengthened by the Johnson &
Johnson defendants’ failure to provide any discussion of the elements of
prescription data differs from the CURES data at issue in Board of Registered
Nursing, nor do they dispute that the discovery of substance abuse treatment
records poses even greater privacy concerns.
31 While the Johnson & Johnson defendants provide additional details as
to these arguments in their supplemental letter brief, the underlying theory
of discoverability, which the Board of Registered Nursing court rejected,
remains the same.
44
plaintiffs’ causes of action or any case law bearing on such causes of action to
attempt to demonstrate a theory of discoverability of the sensitive medical
information at issue in these writ proceedings. Simply put, the Johnson &
Johnson defendants fail to provide any “cogent legal argument” (Board of
Registered Nursing, supra, 59 Cal.App.5th at p. 1041) as to how the discovery
that they seek would be admissible or lead to the discovery of admissible
evidence.
This omission is particularly striking given that, in their reply,
petitioners noted that the Johnson & Johnson defendants failed to provide
any argument as to how the requested discovery “could be used to defend
against causes of action that do not require a link between an individual
harm and their particular product,” (italics omitted) and the Board of
Registered Nursing court rejected the superior court’s finding of relevance on
which the Johnson & Johnson defendants relied in their return.32 Yet, as
with their return, the Johnson & Johnson defendants’ supplemental brief
32 Instead, and straining credulity, the Johnson & Johnson defendants
argue in their supplemental brief that the Board of Registered Nursing
opinion has “no bearing” on our consideration of the writ petitions in this
case, because, according to the Johnson & Johnson defendants, “the decision
in Board of Registered Nursing turned chiefly on relevance and burden
concerns that are not at issue in this case . . . .”
“[R]elevance and burden concerns,” are clearly factors that not only
may, but must be considered in determining whether a defendant has
demonstrated that “the interest of the requesting party, fairness to litigants
in conducing the litigation, and the consequences of granting or restricting
access to the information” outweigh the privacy interests at stake in a case.
(Los Angeles Gay & Lesbian Center, supra, 194 Cal.App.4th at p. 307.)
Indeed, the Johnson & Johnson defendants argued in their return that they
had carried their Hill burden by quoting the superior court’s determination
that the discovery of CURES data was “relevant” in the proceedings that led
to Board of Registered Nursing.
45
concerning Board of Registered Nursing fails to provide any discussion of the
causes of action against which they are defending, a fact that supports the
conclusion that the Johnson & Johnson defendants have failed to identify
countervailing interests supporting the discovery order that outweigh the
privacy interests at stake.33 In short, much like the general references to
“ ‘measur[ing] trends and test[ing] causal relationships’ ” (Board of Registered
Nursing, supra, 59 Cal.App.5th at p. 1046) that the Board of Registered
Nursing court concluded was insufficient to justify the discovery at issue in
that case, we conclude that the Johnson & Johnson defendants’ vague
arguments that the data sought from petitioners goes “to the heart of the
People’s causation theories,” and “apportionment in the event the Superior
Court finds liability,” are “insufficient to justify such a vast production of
medical information from the nonparties” (ibid.), particularly in light of the
serious competing privacy interests at stake.
The Johnson & Johnson defendants also have not made any persuasive
argument that fairness to the litigants in conducing the litigation outweighs
the privacy interests at stake. (Los Angeles Gay & Lesbian Center, supra,
194 Cal.App.4th at p. 307.) To begin with, the Johnson & Johnson
defendants do not argue that they bear the burden of proof with respect to
either causation or damages, the two general areas for which the Johnson &
33 In their supplemental brief, the Johnson & Johnson defendants argue
that “[i]f this Court is inclined to consider relevance or burden arguments
raised for the first time in Petitioners’ Reply, [the Johnson & Johnson
defendants] request leave to expand the record to include additional evidence
supporting these newly raised theories, which they would have done in
connection with their Return had the relevance arguments been raised at any
time below or in the Petitions.” We do not consider “relevance or burden
arguments” outside the context of petitioners’ Hill argument, which was
clearly and distinctly raised in their writ petitions. Accordingly, we decline
the Johnson & Johnson defendants’ request to “expand the record.”
46
Johnson defendants have argued that the requested discovery is relevant.
Further, the Johnson & Johnson defendants do not make any argument that
plaintiffs have sought to discover the prescription records and substance
abuse treatment records at issue in these writ proceedings. Thus, the
Johnson & Johnson defendants have not shown that they are being deprived
of any discovery on which plaintiffs may rely in proving their case, nor have
they demonstrated that any other fairness concerns mandate disclosure.
The Johnson & Johnson defendants also have not demonstrated that
the consequences of granting or restricting access to the information support
disclosure. (Los Angeles Gay & Lesbian Center, supra, 194 Cal.App.4th at
p. 307.) To begin with, while the Johnson & Johnson defendants vaguely
refer to the need to cross-reference “multiple datasets,” they provide but one
example of such cross-referencing in their return.34 (Italics added.) Given
the highly sensitive nature of the data requested, a far more detailed showing
is required as to the precise nature of the datasets to which the discovery in
this case would be linked and exactly how such data would be cross-
referenced.
Relatedly, the Johnson & Johnson defendants do not discuss in any
detail the other discovery that has been produced in this case in attempting
to explain their need for the specific discovery at issue in these writ
proceedings. The Board of Registered Nursing court noted the lack of any
such showing in that case:
“[Defendants fail to] persuasively explain why such a large
amount of personal and private data, on millions of
Californians, is necessary in light of the extensive
34 The one example provided is the Johnson & Johnson defendants’
statement that “[p]etitioners’ claims data can be cross-referenced with
already provided statewide mortality data to illustrate whether, and the
extent to which, any harms befell County-specific and California patients.”
47
information already available to them. For example,
defendants admit they have ‘insurance claims data and
hospital claims data’ from the plaintiff jurisdictions and
other private entities, as well as comprehensive mortality
data from the California Department of Health. The
department already releases data on opioid-related deaths,
emergency room visits, hospitalizations, and county-level
prescriptions. The [Department of Justice] releases
aggregate statistics from the CURES database across
numerous dimensions.” (Board of Registered Nursing,
supra, 59 Cal.App.5th at p. 1046.)
Similarly, in these writ proceedings, the Johnson & Johnson
defendants acknowledge having access to multiple datasets in preparing their
defense and fail to demonstrate why the discovery they seek from petitioners
is critical in defending against plaintiffs’ claims.
3. After applying the Hill framework, we conclude that the superior
court erred in granting the Johnson & Johnson defendants’ motions
to compel
Petitioners have established a legally protected privacy interest, an
objectively reasonable expectation of privacy in the given circumstances, and
a threatened intrusion that is serious. The Johnson & Johnson defendants
have not established countervailing interests that outweigh this serious
potential invasion of privacy rights. Accordingly, we conclude that the
superior court erred in granting the Johnson & Johnson defendants’ motions
to compel.
IV.
DISPOSITION
The Johnson & Johnson defendants’ demurrer to the petitions is
overruled. The petitions are granted. Let a peremptory writ of mandate
issue directing the superior court to vacate its order compelling production of
documents from petitioners County of Los Angeles and County of Alameda
48
and enter a new order denying the Johnson & Johnson defendants’ motions
to compel. Petitioners shall recover their costs in this original proceeding.
(Cal. Rules of Court, rule 8.493(a)(2).)
AARON, J.
WE CONCUR:
BENKE, Acting P. J.
IRION, J.
49