Filed 7/18/25 Garfield Beach CVS v. Board of Pharmacy etc. CA4/1

NOT TO BE PUBLISHED IN OFFICIAL REPORTS

California Rules of Court, rule 8.1115(a), prohibits courts and parties from citing or relying on opinions not certified for publication or ordered published, except as specified by rule 8.1115(b). This opinion has not been certified for publication or ordered published for purposes of rule 8.1115.

COURT OF APPEAL, FOURTH APPELLATE DISTRICT

DIVISION ONE

STATE OF CALIFORNIA

GARFIELD BEACH CVS, LLC, D083962

Plaintiff and Appellant,

v. (Super. Ct. No. 37-2023- 00006013-CU-WM-CTL)

BOARD OF PHARMACY,

DEPARTMENT OF CONSUMER

AFFAIRS,

Defendant and Respondent.

APPEAL from a judgment of the Superior Court of San Diego County, Carolyn M. Caietti, Judge. Affirmed. Much Shelist and Ryan N. Burns, for Plaintiff and Appellant. Rob Bonta, Attorney General, Carl W. Sonne, Assistant Attorney General, Gregory J. Salute and Nicole R. Trama, Deputy Attorneys General, for Defendant and Respondent. In 2020, the Board of Pharmacy, Department of Consumer Affairs cited Garfield Beach CVS, LLC for failure to maintain prescription records at CVS pharmacy number 5837 (Buena Park CVS) in a secure manner preserving patient confidentiality in violation of title 16 of the California Code of Regulations sections 1714, subdivision (d) and 1707, subdivision (g)(2), as well as Civil Code section 56.101. After the Board affirmed the citation, CVS petitioned for a writ of administrative mandate to compel the Board to set aside its decision and order. The court denied the petition. On appeal, CVS raises three arguments. First, CVS argues substantial evidence was not presented that an alarmed but unlocked door inadequately secures prescription records and protects their confidentiality. We determine, however, that the record contains substantial evidence, including reasonable inferences drawn from the record evidence, to support that finding. Second, CVS contends the Board was collaterally estopped from affirming the citation given its prior dismissal of a similar citation against CVS pharmacy number 6755 (Long Beach CVS). Yet because (1) the citations arose out of different transactions and (2) the Long Beach CVS prescription records were stored behind a locked door, whereas the doors to the storage area of the Buena Park CVS were alarmed but unlocked, we conclude the issues are not identical, so collateral estoppel does not apply. Finally, CVS claims the Board abused its discretion in interpreting the relevant regulations and statute to require that access to prescription records be restricted to pharmacy employees. But the record, which shows the Board was concerned about non-employees’ access to the records as well, does not support CVS’s argument. Accordingly, we affirm the court’s dismissal of the petition.

2 I. A. The Buena Park CVS has a “typical” layout, in which the front of the store carries general merchandise and groceries while a pharmacy at the back of the store fills and dispenses medications. A storage room sits at the back of the Buena Park CVS. The only way to enter the storage room is through a set of double doors. To enter the storage room without setting off an alarm, a person needs to input a code onto a keypad next to the door. The keypad has no locking mechanism, so it does not physically prevent anyone from opening the doors. A single code is shared by all employees of the store, and the district leader—who oversees 14 CVS pharmacies, including Buena Park—was uncertain how often, if at all, the code was changed, even after employee terminations. The Buena Park CVS keeps prescription records in the upstairs portion of the storage room. The records are kept in closed cardboard boxes, at least some of which are labeled as containing “Confidential Hardcopy Pharmacy Records.” Some boxes are taped shut. At the administrative hearing, the district leader agreed “there are security cameras at the entry to the storage room or in the storage room.” (Italics added.) She later explained there is one security camera inside the storage room, but not in the upstairs portion where pharmacy records are kept. CVS’s policy is that vendors or delivery persons must be accompanied by a CVS employee to enter the storage room. Additionally, it is CVS’s policy to keep documents containing confidential information in a locked file cabinet or desk drawer. The district leader acknowledged the prescription records were not maintained according to policy.

3 B. In October 2019, Board inspector Sejal Desai inspected the Buena Park CVS in response to a complaint. As part of her inspection, Desai inspected the prescription records kept in the storage room and found the way they were stored “problematic.” That same day, Desai issued a notice of citation for a violation of section 1714(d) of title 16 of the California Code of Regulations “[a]s it relates to” section 1707(g)(2) and Civil Code section 56.101, noting “the prescription records were store[d] upstairs in the stock room with other store merchandise and records” and “not in a secured manner.” In November 2020, the Board issued a citation and fine alleging CVS violated the above provisions because it “did not have effective control against theft and diversion of records for drugs/devices” and the “prescription records were not secure to maintain patient confidentiality” at the Buena Park CVS. CVS was to pay a fine of $2,500. CVS contested the citation and requested an office conference. In February 2021, following the office conference, the Board affirmed the citation and fine. An administrative hearing was scheduled for October 2022. At the administrative hearing, the Attorney General focused on non- pharmacy employees’ access to the prescription records. Desai, however, testified the storage room was “accessible” to CVS customers “because you can walk in and the alarm would still go off, but it is accessible because it’s not locked.” She also testified she was not aware of any material differences between the physical security measures employed by the Buena Park CVS and the Long Beach CVS in storing their records. There was no evidence any unauthorized person ever accessed or stole the prescription records from the Buena Park CVS.

4 C. During the administrative hearing, CVS argued collateral estoppel barred the Board’s claims given its prior decision to dismiss a citation issued in similar circumstances to the Long Beach CVS. In December 2019, Desai inspected the Long Beach CVS. The Long Beach CVS stored prescription records in the upstairs portion of a storage room that also held regular store merchandise. The boxes were labeled “‘Confidential Hardcopy Pharmacy Records,’” but some boxes were broken and papers were visible inside. The storage room was accessible through “a door with a keypad that required a code to be entered to unlock.” There was “a camera in the receiving area where the keypad on the door permits access from the store,” as well as “a camera that covers the top of the stairs.” The Board issued a citation and fine alleging violations of the same regulations and statute as the Buena Park CVS. Following an administrative hearing, the Board dismissed the citation. It found the Long Beach CVS’s security measures “sufficient” because, among other measures, “access to the storage room was limited by means of a keypad whose combination was given to CVS employees only” and “the bottom of the stairs and the top of the stairs leading to the storage room were monitored by security cameras.” D. In November 2022, an administrative law judge issued a proposed decision affirming the Buena Park CVS’s citation. In December, the Board adopted the proposed decision as its decision. In February 2023, CVS filed a petition for writ of administrative mandate in which it sought to compel the Board to set aside its decision. As here, CVS contended (1) the Board abused its discretion in concluding

5 collateral estoppel did not bar its claim, (2) no evidence established that the keypad alarm was insufficient to safeguard the security or confidentiality of the prescription records, and (3) CVS did not violate the asserted regulations and statutes in allowing front-of-store employees access to the storage room containing the records. The court denied the writ. It concluded collateral estoppel did not bar the Board’s claim because “a critical difference between the two cases” was that the storage room access door at the Long Beach CVS was “locked” while the door at the Buena Park CVS was “always unlocked and only had a code to enter on a keypad to prevent an alarm from sounding” that “did not prevent anyone from entering the storage room.” The court also found substantial evidence supported the Board’s decision. It concluded evidence of actual unauthorized access to the records was not required because “the Board was not required to wait for patient harm before taking action.” The record further established that “non- pharmacy employees and members of the public” could enter the “unlocked storage area,” which was “substantial evidence of CVS not preserving the confidentiality of patient records.” The court entered judgment accordingly.

II.

“Our standard of review of a judgment denying a petition for writ of administrative mandate is the same as that of the trial court when it reviews the determination of the administrative board.” (Blazevich v. State Bd. of Control (1987) 191 Cal.App.3d 1121, 1125.) Here, the trial court reviewed the Board’s decision for abuse of discretion and substantial evidence. Code of Civil Procedure section 1094.5(a) lets courts “inquir[e] into the validity of any final administrative order or decision made as the result of a

6 proceeding in which by law a hearing is required to be given, evidence is required to be taken, and discretion in the determination of facts is vested in the inferior tribunal, corporation, board, or officer.” We review the administrative decision to determine if it was “without, or in excess of, jurisdiction; whether there was a fair trial; and whether there was any prejudicial abuse of discretion.” (§ 1094.5(b).) An abuse of discretion occurs “if the respondent has not proceeded in the manner required by law, the order or decision is not supported by the findings, or the findings are not supported by the evidence.” (Ibid.) We “resolv[e] all evidentiary conflicts and draw[ ] all legitimate and reasonable inferences in favor of the court’s decision.” (Cassidy v. California Bd. of Accountancy (2013) 220 Cal.App.4th 620, 627.) A. CVS claims there was “no evidence, never mind substantial evidence,” to support a conclusion that the Buena Park CVS’s keypad alarm system was less secure and less preserving of confidentiality than the Long Beach CVS’s keypad lock system. We conclude otherwise. Our review for substantial evidence “begins and ends with the determination as to whether, on the entire record, there is substantial evidence, contradicted or uncontradicted, which will support the determination, and when two or more inferences can reasonably be deduced from the facts, a reviewing court is without power to substitute its deductions for those of the trial court.” (Bowers v. Bernards (1984) 150 Cal.App.3d 870, 873-874.) “Substantial evidence is evidence of ponderable legal significance, reasonable in nature, credible, and of solid value.” (Ermoian v. Desert Hospital (2007) 152 Cal.App.4th 475, 501.)

7 Here, as the Board states, “[i]t is undisputed that the [Buena Park CVS’s] patient records were stored in an unlocked storage area.” Nor were the records monitored by security cameras. Meanwhile, the Long Beach CVS stored its records in a locked storage area with security cameras covering both the bottom and the top of the stairs leading to the records. As the Board argues, a reasonable inference from the evidence is “that a locked door is more secure than an unlocked door.” We agree such an inference is permissible and constitutes substantial evidence. (See Moran v. Foster Wheeler Energy Corp. (2016) 246 Cal.App.4th 500, 518.) Desai’s testimony that she was aware of no material differences between the physical security measures employed by the two CVS locations does not compel a contrary result because other evidence belies her statement. Nor does the lack of any testimony about an alarm being inadequate, as that fact could be permissibly inferred from the evidence before the court. B. CVS also claims the Board was collaterally estopped from “relitigating” the alleged violation against the Buena Park CVS given the dismissal of the citation against the Long Beach CVS. We disagree. “Collateral estoppel precludes relitigation of issues argued and decided in prior proceedings” if (1) the relevant issue is “identical to that decided in a former proceeding,” (2) the issue was “actually litigated” and “necessarily decided,” (3) “the decision in the former proceeding” is “final and on the merits,” and (4) “the party against whom preclusion is sought” is “the same as, or in privity with, the party to the former proceeding.” (Lucido v. Superior Court (1990) 51 Cal.3d 335, 341.) Here, only the first requirement is contested.

8 “The ‘identical issue’ requirement addresses whether ‘identical factual allegations’ are at stake in the two proceedings, not whether the ultimate issues or dispositions are the same.” (Lucido, 51 Cal.3d at p. 342.) Thus, “‘where the subsequent action involves parallel facts, but a different historical transaction, the application of the law to the facts is not subject to collateral estoppel.’” (Chern v. Bank of America (1976) 15 Cal.3d 866, 871.) “The party asserting collateral estoppel bears the burden of establishing” the issues are identical. (Lucido, at p. 341.) We review collateral estoppel determinations de novo. (Murphy v. Murphy (2008) 164 Cal.App.4th 376, 399.) Given these principles, we agree with the Board that CVS failed to satisfy its burden of establishing the issues in the Buena Park and Long Beach CVS matters are identical. Here, the citations arose from different inspections of different CVS locations at different times; accordingly, they arose out of different transactions. (Chern, 15 Cal.3d at p. 871.) Even were that not so, as the Board aptly points out, the facts are not identical given the Long Beach CVS’s prescriptions records were kept behind a locked door while the Buena Park CVS’s records were kept behind an alarmed but unlocked door. Accordingly, neither the Board nor the court erred in finding this “critical difference” made collateral estoppel inapplicable here. CVS claims the issue raised in this case was whether, “for records to be secure and confidential, access must be limited to pharmacists and technicians.” While the Board primarily argued during the hearing that access by other CVS employees was problematic, the citation was not so limited. Instead, it broadly alleged the Buena Park CVS “did not have effective control against theft and diversion of records for drugs/devices” and because “[t]he prescription records were not secure to maintain patient

9 confidentiality.” The administrative law judge similarly defined the relevant issue as “whether [CVS] complied with the requirements as set forth in” the asserted regulations and statute. Because the issue and allegations were not limited to the access of non-pharmacy CVS employees, neither the administrative law judge nor the court erred in concluding the potential for access by members of the public was also problematic. To the extent CVS asserted for the first time at oral argument that the shift in focus from non- pharmacy CVS employees to members of the public violated its right to due process, the claim is forfeited. (People v. Carrasco (2014) 59 Cal.4th 924, 990 [“‘Obvious reasons of fairness militate against consideration of an issue raised initially’ at oral argument.”].) C. Finally, CVS claims it did not violate the asserted regulations or statute “by storing records in a warehouse accessible to CVS employees other than pharmacists and pharmacy technicians” because “those provisions simply do not impose the restrictions” the Board asserts. On this record, however, we conclude the administrative law judge and trial court did not err in upholding at least one of the violations determined by the Board. “‘The standard for judicial review of agency interpretation of law is the independent judgment of the court, giving deference to the determination of the agency appropriate to the circumstances of the agency action.’” (Yamaha Corp. of America v. State Bd. of Equalization (1998) 19 Cal.4th 1, 8.) “A court is more likely to defer to an agency’s interpretation of its own regulation than to its interpretation of a statute.” (Id. at p. 12.) Section 1707(g) requires, when pharmacy prescription records are stored “in a storage area at the same address or adjoining the licensed premises” rather than within the pharmacy itself, “[t]he storage area” to be

10 “maintained so that the records are secure and so that the confidentiality of any patient-related information is maintained.” As explained above, it is reasonable to conclude an unlocked storage room with no security cameras trained on its entrance or the access point to patients’ confidential prescription records is not “secure” and fails to maintain the confidentiality of patients’ information. As CVS argues, the regulation cannot reasonably be read to require that access be limited to pharmacists or pharmacy technicians, but the Board’s citation and the administrative law judge’s decision that CVS violated the regulation do not rely on such an interpretation. Thus, is does not matter if the Board advanced such an argument at the hearing. Nor did the administrative law judge conclude, as CVS claims, a locked door is required. Instead, the administrative law judge reasonably concluded something more than an alarm on an unlocked door was required to preserve patient confidentiality. Because we determine the administrative law judge and trial court properly concluded at least one regulation the Board alleged CVS violated was, in fact, violated, we need not reach CVS’s arguments as to the remaining regulation or statute, including its contention that section 56.101(a) requires “an actual breach of confidentiality.” CVS did not raise a similar argument as to section 1707(g), and we agree with the trial court that the Board is not required to wait to enforce its regulations until harm has already occurred.

11

III.

We affirm and award the Board of Pharmacy, Department of Consumer Affairs its costs on appeal.

CASTILLO, J.

WE CONCUR:

DO, Acting P. J.

KELETY, J.

12