California’s Controlled Substance Utilization Review and Evaluation System, known as the CURES database, is a statewide prescription drug monitoring program run by the California Department of Justice. It records every Schedule II through Schedule V controlled substance dispensed in the state and gives licensed prescribers and pharmacists a way to see a patient’s controlled substance history before writing or filling the next prescription. Patients can request their own records too.
What CURES Tracks
CURES collects dispensing data across four federal scheduling categories: Schedule II, Schedule III, Schedule IV, and Schedule V.1California Legislative Information. California Code HSC 11165 That covers a wide range of medications. Schedule II includes high-potency drugs like oxycodone, fentanyl, and stimulants used for attention deficit disorders. Schedule III and IV substances include codeine combination products, anabolic steroids, and benzodiazepines such as alprazolam. Schedule V covers lower-risk preparations, including certain cough suppressants containing small amounts of codeine.
California’s inclusion of Schedule V is broader than what many other states monitor. Gabapentin, which California reclassified as a Schedule V controlled substance, generates CURES reporting obligations as well.
Every time a pharmacy, clinic, or other dispenser releases one of these medications, the transaction must be reported electronically to the Department of Justice within one working day. Veterinarians have seven days.1California Legislative Information. California Code HSC 11165 The report identifies the patient by full legal name, date of birth, and residential address, along with the drug, quantity, days’ supply, dispensing pharmacy, and prescribing physician’s DEA number.
Testosterone and Mifepristone Are No Longer Tracked
Assembly Bill 82, signed into law on October 13, 2025, carved out an exemption for two drugs. As of January 1, 2026, pharmacies and other dispensers must not report prescriptions for testosterone or mifepristone to CURES. The Department of Justice must also remove any existing testosterone or mifepristone records from the database by January 1, 2027.2California Department of Justice – Office of the Attorney General. AB 82 Update on Reporting of Testosterone and Mifepristone
What Prescribers Are Required to Do
Every healthcare practitioner authorized to handle Schedule II through V controlled substances must register for CURES access once they receive their federal DEA registration. Pharmacists register upon licensure. Physicians without a DEA registration may still apply voluntarily to view the controlled substance history of patients under their care.3California Legislative Information. California Code HSC 11165.1
Registration is only the start. State law also dictates when a registered provider must actually check the database before prescribing:4Medical Board of California. Mandatory Use – CURES
- Before prescribing a controlled substance to a patient for the first time.
- Within 24 hours, or the previous business day, before writing each subsequent prescription for a controlled substance.
- At least once every six months while the controlled substance remains part of the patient’s ongoing treatment.
When the Check Is Not Required
The law recognizes situations where stopping to query the database is impractical. A provider does not need to consult CURES:4Medical Board of California. Mandatory Use – CURES
- While a patient is admitted to a licensed clinic, outpatient setting, health facility, or county medical facility, or during an emergency transfer.
- When prescribing in a hospital emergency department, as long as the supply does not exceed a non-refillable seven-day course.
- When prescribing as part of a surgical procedure at a licensed facility, limited to a non-refillable five-day supply.
- When the patient is receiving hospice care.
- When the system is down or no one with CURES access is reasonably available. In that case the provider may prescribe up to a non-refillable five-day supply, but must document the reason in the medical record.
What Happens if a Provider Skips the Check
A provider who fails to consult CURES when required is referred to their professional licensing board for administrative sanctions, with the specific discipline left to the board’s discretion. The statute does not create a private right of action for patients, though it also does not shield a provider from ordinary malpractice liability for negligent prescribing.5California Legislative Information. California Code HSC 11165.4
Who Else Can See CURES Records
Access extends beyond the doctor and pharmacist in front of you. State professional licensing boards can pull a practitioner’s prescribing data when investigating whether that licensee is prescribing inappropriately. Law enforcement agencies can request specific records relevant to an active criminal investigation. The Department of Justice can also proactively flag a patient’s history back to that patient’s healthcare providers when the data suggests a pattern of inappropriate use.6State of California Department of Justice – Office of the Attorney General. California Health and Safety Code 11165.1
Prescribers and pharmacists can designate delegates to run queries on their behalf. The authorizing provider stays responsible for whatever the delegate does in the system, and the delegate must follow the same access restrictions, meaning the patient being searched must be under the authorizing provider’s care.7Cornell Law Institute. California Code of Regulations Title 11 Section 824.6
California also shares CURES data with other states’ prescription drug monitoring programs. An out-of-state user can request California data through their own state’s program if that program has a memorandum of understanding with the California Department of Justice.8Cornell Law Institute. California Code of Regulations Title 11 Section 825.1 The design is meant to catch patients who cross state lines to obtain prescriptions from multiple providers.
Privacy, Penalties, and Fixing Bad Records
CURES data is confidential health information. Anyone who accesses or discloses patient information from the database without authorization faces criminal penalties under California law, with unauthorized disclosure classified as a misdemeanor carrying up to one year in county jail alongside civil penalties. These protections sit on top of federal HIPAA requirements. Subscribers must notify the department within 30 days of any change to their CURES account, and the department monitors for access patterns that suggest misuse.3California Legislative Information. California Code HSC 11165.1
If you review your history and find errors, federal law gives you a right to request an amendment. Under HIPAA, a covered entity such as a pharmacy must act on your amendment request within 60 days, with a single 30-day extension permitted if the entity explains the delay in writing.9eCFR. 45 CFR 164.526
If the amendment is granted, the entity must update the record and make reasonable efforts to notify anyone who received the original information and might rely on it. If it is denied, you must receive a written explanation, instructions for filing a disagreement statement, and information on how to complain to the entity or to the Secretary of Health and Human Services.9eCFR. 45 CFR 164.526
How to Request Your Own Prescription History
You have the right to see what CURES has on file about you. The request goes on Form BCIA 8735, the Request for CURES Individual Prescription History Report, available on the California Department of Justice website. The form asks for your full legal name, Social Security Number, and the date range you want covered.
Attach a clear photocopy of a valid government-issued photo ID, such as a California driver’s license or passport. The form must be signed in front of a notary public. California Government Code Section 8211 caps the notary fee at $15 per signature, and that cost is paid to the notary, separate from any DOJ processing.10California Legislative Information. California Government Code 8211
Mail the notarized form and ID copy to the Department of Justice for manual verification. Processing typically takes several weeks depending on volume, and the report comes back by mail to the address on the application. Reviewing your own history is worth doing periodically if you have been treated by multiple providers or pharmacies, because records occasionally get matched to the wrong patient.