Opinion

Rossum (Rossum) took toxic materials from her employer, the County of San Diego (County), and used them to murder her husband, Greg de Villers (de Villers). The trial court ruled County could be liable in wrongful death damages for de Villers’s death. The jury awarded damages against County. We reverse.

I

FACTUAL BACKGROUND

A. The Relationship Between Rossum and de Villers

Rossum became addicted to methamphetamine during high school. She continued to use methamphetamine periodically during college. In December 1994, while in college, Rossum left school without telling her parents, and went to San Diego to hide a relapse into methamphetamine use. At that time, she met de Villers, they became lovers, and Rossum moved into de Villers’s apartment.

De Villers helped Rossum quit using methamphetamine, and in the fall of 1995 she reenrolled in college, majoring in chemistry. She avoided drug use and graduated with honors in May 2000. Rossum married de Villers in June 1999.

B. Rossum’s Employment at the Office of the Medical Examiner

In 1997, while still in college, Rossum was employed as a student worker at County’s office of the medical examiner (OME). At that time, she had not used drugs for approximately two years. In 1997, OME had no policy requiring applicants to pass a drug or alcohol test, and Rossum’s employment application did not inquire about prior drug or alcohol use or criminal history.

In March 2000, OME promoted Rossum from a student worker to a permanent position as a Toxicologist I. A toxicologist analyzes body fluids for the purpose of determining whether drugs are present. At the time OME promoted Rossum, OME was unaware of her earlier drug history or juvenile record. OME did not conduct a drug test or a background check on Rossum, although County’s policy at that time required all OME applicants to pass a drug and alcohol test and the job description for toxicologist specified the applicant was required to undergo a law enforcement background investigation. Janet Enright, the administrative services manager for OME, thought Rossum should have been drug tested but was told by County’s human resources department that Rossum was not required to be tested because she already worked at OME. Although Rossum signed a waiver agreeing to be tested, OME never arranged for the tests. However, there was no evidence suggesting Rossum had relapsed into drug use at the time she applied for and received the promotion, and neither her physical appearance nor her job performance suggested she had resumed using methamphetamine. Instead, the evidence suggested she did not resume her drug use until late September 2000.

Enright also thought all employees were required to undergo a background check, and asked Mr. Ambom (OME’s operations administrator) whether Rossum should undergo a background check. Ambom told Enright it would be unnecessary. Although Ambom decided in June 2000 to have the sheriff’s department conduct background checks on all employees hired in 2000, and Enright secured a waiver from Rossum permitting a background check, Ambom elected not to conduct a background check on Rossum. However, after de Villers was murdered, Ambom conducted a background check on Rossum and it disclosed no offenses.

C. The Robertson/Rossum Affair

Michael Robertson (Robertson) began working at OME in the spring of 2000. Robertson was Rossum’s supervisor. By May 2000 coworkers suspected he and Rossum were involved in an affair and complained to Enright, who relayed the complaints to Ambom. However, when Ambom questioned some coworkers, they denied seeing the two hugging or kissing. Ambom also asked Robertson (on two occasions) whether he was involved with Rossum, and Robertson denied it. Ambom did not ask Rossum about the rumors or examine the e-mails between Rossum and Robertson.

By October 2000, Rossum had relapsed into methamphetamine use. Robertson became aware of her renewed usage but, contrary to County’s policy requiring supervisors to report any workplace drag use, did not report Rossum’s renewed usage of drags.

D. de Villers’s Death

On Thursday November 2, 2000, de Villers confronted Rossum. He told her he suspected she was using drugs and having an affair with Robertson, and demanded she quit her job at OME. He threatened to reveal her drug use and her affair with Robertson to OME if she refused to quit her job. However, when Rossum and de Villers visited with her parents the following night, the parents did not notice anything to suggest Rossum had relapsed into drug use.

On Monday, November 6, at 9:22 p.m., Rossum called 911 and told the operator de Villers had not been feeling well and that he had suddenly stopped breathing. Paramedics arrived minutes later and found de Villers’s body on the floor next to his bed. Fresh-looking red rose petals were strewn around his body. The paramedics transported de Villers to the hospital, where he was pronounced dead at 10:19 p.m. {People v. Rossum (June 13, 2005, D041343) [nonpub. opn.].)

E. The Investigation

San Diego County Medical Examiner, Dr. Brian Blackboume, performed an autopsy on de Villers’s body the day after his death. He concluded de Villers had been dead for at “least an hour or so” by the time paramedics arrived, and that de Villers had been “stuporous or semi-conscious or comatose” for a minimum of six to 12 hours prior to his death. Blackboume also found needle marks on de Villers’s body. {People v. Rossum, supra, D041343.) However, neither the autopsy nor the initial toxicology tests showed the cause of his death.

Based on subsequent toxicology results of de Villers’s body fluids, Blackboume determined de Villers had died of acute fentanyl intoxication. The toxicology results also showed de Villers had oxycodone and clonazepam in his system at the time of his death.

Shortly thereafter, an audit was conducted at OME for the purpose of determining whether any fentanyl was missing from its supply. Fifteen fentanyl patches impounded in three different cases and the contents of a vial of the fentanyl standard were missing from OME. Rossum had been involved in all three cases in question and had logged in the fentanyl standard. Robertson also had authorized access to all drugs stored at OME. Robertson and Rossum, who both knew OME did not routinely test for fentanyl, had traveled together in October 2000 to attend a conference of forensic toxicologists at which they received a copy of a journal that included a paper discussing 25 deaths caused by fentanyl.

In December 2000 and January 2001, OME toxicologist Lowe conducted two further evidentiary audits to determine whether any methamphetamine or other drugs were missing from OME. The audits found impounded methamphetamine was missing from various envelopes, and various drug standards (including those for methamphetamine and cocaine) were missing. These three audits were the first audits of impounded drugs conducted in Lowe’s 32 years at OME. In July 2001, OME directed another toxicologist to conduct an audit of all of OME’s evidence drugs. This audit found that some clonazepam and oxycodone were missing. In addition to the fentanyl, low levels of these latter two drugs were found in de Villers’s system.

At the trial in the case, plaintiffs introduced the testimony of several experts. One expert testified OME’s hiring and supervision practices were inadequate because drugs are constantly present in the work environment. A second expert testified there were several deficiencies in the controls used by OME to prevent drug thefts by its employees. A third expert testified to the effects of methamphetamine on its users and testified that Rossum’s constant access to the drug coupled with the stress of hiding her affair with Robertson nearly guaranteed she would relapse into substance abuse.

E The Criminal Proceedings

Rossum was charged with the first degree murder of de Villers and, as a special circumstance, the information alleged she committed the murder by administering poison. The jury convicted her of the crime and found the special circumstance true. (People v. Rossum, supra, D041343.) She is currently serving a prison sentence of life without possibility of parole.

n

PROCEDURAL BACKGROUND

Plaintiffs filed this wrongful death action against Rossum and County seeking damages for de Villers’s death. Plaintiffs’ claim against County alleged two theories of liability: (1) County was liable for de Villers’s death because it had negligently hired and supervised Rossum and this negligence was a proximate cause of de Villers’s death; and (2) County breached its mandatory duty to guard against the theft of drugs from OME and the breach of that duty was a proximate cause of de Villers’s death. After County’s pretrial challenges to plaintiffs’ theories were rejected, the matter was tried to a jury, which found in favor of plaintiffs on both theories. County’s motion for judgment notwithstanding the verdict was denied, and judgment was entered in favor of plaintiffs. This timely appeal by County followed.

HI

ISSUES ON APPEAL

A. Overview

When a party is injured by a tortfeasor and seeks to affix liability on the tortfeasor’s employer, the injured party ordinarily must demonstrate either (1) the employer violated a duty of care it owed to the injured party and this negligence was a proximate cause of the resulting injury (the direct liability theory), or (2) the tortfeasor-employee was liable for committing the tortious conduct that caused the injury while acting within the course and scope of his or her employment (the vicarious liability theory). (See generally 3 Witkin, Summary of Cal. Law (10th ed. 2005) Agency and Employment, §§ 167-168, pp. 211-213.) When the employer is a governmental agency, the statutory framework permits the injured party to pursue the vicarious liability theory in accordance with these general common law principles. (Gov. Code, § 815.2.) However, the statutory framework requires, as a condition to the injured party’s recovery on a direct liability theory against a governmental agency, that the injured party identify a “specific statute declaring [the entity] to be liable, or at least creating some specific duty of care” by the agency in favor of the injured party. (Eastbum v. Regional Fire Protection Authority (2003) 31 Cal.4th 1175, 1183 [ 7 Cal.Rptr.3d 552 , 80 P.3d 656 ] CEastbum); accord, Searcy v. Hemet Unified School Dist. (1986) 177 Cal.App.3d 792, 802 [ 223 Cal.Rptr. 206 ].)

B. Issues on Appeal

In this case, plaintiffs asserted County was liable under both vicarious and direct liability theories. Although conceding County could not be held vicariously liable for Rossum’s direct conduct because she was not acting within the course and scope of her employment when she killed de Villers, plaintiffs nevertheless appear to assert County may be held either directly or vicariously liable for de Villers’s death because the negligence of County’s managers in hiring and supervising Rossum were proximate causes of the murder. Plaintiffs alternatively contend that, even if a direct liability claim is limited to cases in which a legislative enactment has created a specific duty of care by the agency in favor of the injured party, the provisions of 21 Code of Federal Regulations part 1301.71(a) (2007) imposed a mandatory duty on County to take effective steps to safeguard against the theft and abuse of drugs in its possession, and County’s violation of that mandatory duty supports the judgment for plaintiffs.

IV

THE NEGLIGENT HIRING/SUPERVISION CLAIM

Plaintiffs first argue County may be held liable, either vicariously or directly, for negligently hiring and supervising Rossum.

A. The Vicarious Liability Theory

Plaintiffs assert various County employees, acting within the course and scope of their employment, negligently (1) failed to discover Rossum’s prior drug history or juvenile criminal record when it hired her or terminate her when another County department learned of her prior history, (2) failed to prevent or uncover the theft of drugs from OME by its staff, (3) failed to discover her affair with Robertson, and (4) permitted Rossum to learn of the lethality of fentanyl. Plaintiffs contend these acts and omissions were substantial factors leading to de Villers’s murder, and therefore County is vicariously liable for de Villers’s murder.

When assessing a claim for vicarious liability against a governmental employer based on the acts or omissions of its employee, a court must examine whether the employee who acted or failed to act would have been personally liable for the injury. (§ 815.2, subd. (a); Eastbum, supra, 31 Cal.4th at p. 1180 .) We are convinced Rossum’s coworkers would not have been liable for de Villers’s death because they had no duty to prevent Rossum from murdering de Villers, and therefore plaintiffs’ claim of vicarious liability against County is not viable.

As a general rule, citizens do not have a duty to prevent criminal attacks by third parties. (Margaret W. v. Kelley R. (2006) 139 Cal.App.4th 141, 150 [ 42 Cal.Rptr.3d 519 ].) Although an exception might exist when the citizen bears some special protective relationship to the victim and has actual knowledge of the assaultive propensities of the criminal actor, a citizen “cannot be liable under a negligent supervision theory . . . based solely on constructive knowledge or information they should have known.” (Id. at p. 153, fn. omitted.)

Here, there was no evidence supporting a conclusion any County employee had undertaken a special protective relationship toward de Villers. Moreover, the evidence appears undisputed that no one—including de Villers or other family members—had actual knowledge that Rossum posed a threat to de Villers. Plaintiffs contend it is unnecessary to prove County employees were actually aware of Rossum’s malignant heart, arguing all that “is required to be foreseeable is the general character of the event or harm ...[,] not its precise nature or manner of occurrence.” (Bigbee v. Pacific Tel. & Tel. Co. (1983) 34 Cal.3d 49, 57-58 [ 192 Cal.Rptr. 857 , 665 P.2d 947 ].) From this predicate, plaintiffs assert it was foreseeable County’s failure to secure its drug supply could lead to death or injury.

However, Bigbee did not involve a criminal act, and our Supreme Court’s more recent and pertinent analysis is contained in Wiener v. Southcoast Childcare Centers, Inc. (2004) 32 Cal.4th 1138 [ 12 Cal.Rptr.3d 615 , 88 P.3d 517 ]. In Wiener , the victims were seriously injured (and two children were killed) when a man purposefully rammed his car through a chain link fence into the defendant’s schoolyard. The driver was convicted of first degree murder. The complaint alleged the fence was inadequate to protect children playing near a busy roadway. There had been no prior criminal intrusions, although a mail truck had accidentally gone through the fence some years earlier and there had been other traffic accidents near the property. (Id. at pp. 1143-1144.) The Court of Appeal reversed a grant of summary judgment in favor of the defendants on the theory that a motorist crashing through the fence was sufficiently foreseeable to require the defendants to build a stronger fence, which could have prevented the injuries. (Id. at p. 1145.) The Supreme Court reversed, recognizing that although a landlord has a duty to protect children from foreseeable perils, the focus needed to be on the foreseeability of the particular criminal act itself, not the general nature of the harm that resulted. (Id. at p. 1148.) Wiener went on to explain that “[Cjases analyze third party criminal acts differently from ordinary negligence, and require us to apply a heightened sense of foreseeability before we can hold a defendant liable for the criminal acts of third parties. [Citation.] There are two reasons for this: first, it is difficult if not impossible in today’s society to predict when a criminal might strike. Also, if a criminal decides on a particular goal or victim, it is extremely difficult to remove his every means for achieving that goal.” (Id. at pp. 1149-1150.) Wiener concluded that, because the driver’s criminal conduct was impossible to anticipate and because the defendants had never been the target of violence in the past, the “defendants owed no duty to [the victims] because Abrams’s brutal criminal act was unforeseeable.” (Id. at p. 1150.)

Plaintiffs cite no relevant California authority suggesting that persons who do not occupy a special protective relationship to the victim (or the class to which the victim belonged), and who lack actual knowledge of the perpetrator’s propensity to engage in criminal conduct, nevertheless owe a duty to anticipate and protect against the criminal conduct of a perpetrator. The law is to the contrary. (Margaret W. v. Kelley R., supra, 139 Cal.App.4th at p. 156 ; cf. Mendoza v. City of Los Angeles (1998) 66 Cal.App.4th 1333, 1341 [ 78 Cal.Rptr.2d 525 ].) Under plaintiffs’ theory, a coworker who suspects a fellow employee (or even a person who suspects a friend) might be involved in an extramarital affair and have a substance abuse problem would be potentially liable for failing to anticipate and prevent criminal assaults by the perpetrator. Under established authority, we conclude Rossum’s coworkers did not owe that duty to de Villers and, therefore, County cannot be held vicariously liable for the coworkers’ failure to prevent the murder because the coworkers would not be personally liable.

Plaintiffs appear to suggest that because the jury found Robertson was acting “within the course and scope of his employment with respect to the manner in which he supervised” Rossum, County can be held vicariously liable for de Villers’s death. Noticeably absent from this argument is any discussion of why Robertson would be liable for de Villers’s death. If Robertson was merely negligent in failing to anticipate and prevent Rossum’s crime, Wiener would insulate him from liability. However, if Robertson’s liability arose because he was a coconspirator or aider and abettor, then the jury’s finding that he was acting in the scope of his employment would lack evidentiary support. Thus, the finding Robertson was acting in the scope of his employment in his “supervision” of Rossum, in addition to being so broad as to lack meaningful content, does not aid plaintiffs’ claim against County for vicarious liability based on the acts of its employees.

B. The Direct Liability Theory

Plaintiffs argue that, even if County employees would not be liable for failing to anticipate and prevent Rossum’s criminal act, a governmental entity may be held directly liable for negligently hiring and supervising its employees. However, in both Zelig v. County of Los Angeles (2002) 27 Cal.4th 1112 [ 119 Cal.Rptr.2d 709 , 45 P.3d 1171 ] and Eastburn, supra, 31 Cal.4th 1175 , our Supreme Court carefully reiterated the distinction between the direct liability of a public entity—which must be founded on a specific statute either declaring the entity to be liable or creating a specific duty of care apart from the general tort principles embodied in Civil Code section 1714—and the vicarious liability of a public entity for torts committed by its employees within the course and scope of their employment with the agency.

In Zelig, the governmental entity was sued for failing to protect against a criminal assault on public property in which the perpetrator killed a person. Zelig explained that: “[T]he public entities’ potential liability for the death of plaintiffs’ mother arises under the California Tort Claims Act. . . and has two sources: (1) the public entities’ liability based on their own conduct and legal obligations, and (2) the public entities’ liability, based on respondeat superior principles, for the misconduct of their employees that occurred in the scope of their employment. The Tort Claims Act draws a clear distinction between the liability of a public entity based on its own conduct, and the liability arising from the conduct of a public employee. Although the Act provides that a public employee generally is liable for an injury caused by his or her act or omission ‘to the same extent as a private person’ (Gov. Code, § 820, subd. (a)) and that, when the act or omission of the public employee occurs in the scope of employment the public entity will be vicariously liable for the injury (Gov. Code, § 815.2), the Act contains no provision similarly providing that a public entity generally is liable for its own conduct or omission to the same extent as a private person or entity. Rather, the Act provides that a public entity is not liable for an injury ‘[e]xcept as otherwise provided by statute . . . .’ (Gov. Code, § 815.) Certain statutes do provide expressly for public entity liability in circumstances that are somewhat parallel to the potential liability of private individuals and entities but, as past cases have explained, ‘ “[T]he intent of the [Tort Claims Act] is not to expand the rights of plaintiffs in suits against governmental entities, but to confine potential governmental liability to rigidly delineated circumstances ....”’ (Brown v. Poway Unified School Dist. (1993) 4 Cal.4th 820, 829 [ 15 Cal.Rptr.2d 679 , 843 P.2d 624 ].)” (Zelig v. County of Los Angeles, supra, 27 Cal.4th at pp. 1127-1128.)

Zelig proceeded to examine each of the two theories of potential liability. Zelig first concluded the complaint did not state a claim for vicarious liability because the complaint did not “allege that a public employee engaged in conduct within the scope of employment that would render the employee liable to plaintiffs for their mother’s death, and thus there is no basis for imposing vicarious liability upon the public entities.” (Zelig v. County of Los Angeles, supra, 27 Cal.4th at p. 1131 .) The court then examined each of the claimed statutory bases for imposing direct liability on the entity and concluded the complaint did not state a claim for direct liability based on those statutes. (Id. at pp. 1131-1147.)

In Eastbum , the court reiterated the importance of distinguishing between vicarious liability and direct liability, noting that the latter requires identification of a “specific statute declaring [the entity] to be liable, or at least creating some specific duty of care [by the agency in favor of the injured party], and not on the general tort provisions of Civil Code section 1714.” (Eastburn, supra, 31 Cal.4th at p. 1183 .) Accordingly, we examine whether plaintiffs’ claim for direct liability against County may be premised on their assertion that County’s negligent hiring and supervision of Rossum violated a statute declaring a governmental entity will be liable for negligence in its hiring and supervision practices or imposing a specific duty of care by the agency in favor of the injured party.

We find no relevant case law approving a claim for direct liability based on a public entity’s allegedly negligent hiring and supervision practices. Instead, the court in Munoz v. City of Union City (2004) 120 Cal.App.4th 1077 [ 16 Cal.Rptr.3d 521 ] concluded no statutory basis for such a claim existed. In Munoz , an officer shot and killed a victim and the officer and his governmental employer were sued. The jury apportioned 50 percent fault to the officer, 45 percent fault to the city, and 5 percent to the victim. The Munoz court, applying the framework articulated in Eastbum , concluded the city could be vicariously liable for the 50 percent portion attributed to its officer-employee, but that Eastbum barred liability for the 45 percent portion of fault attributed to the city based on its alleged negligence in hiring, training and supervising its officers. (Munoz, at pp. 1110-1115.) Here, as in Munoz , there is no statutory basis for declaring a governmental entity liable for negligence in its hiring and supervision practices and, accordingly, plaintiffs’ claim against County based on that theory is barred by Eastbum and Zelig.

Plaintiffs do not on appeal identify any statutory basis supporting a direct claim against a governmental entity for injuries allegedly caused by the entity’s generic negligence in hiring and supervising its employees. Instead, they rely on a series of cases that purportedly authorized a direct claim against the entity for negligence. However, we are unconvinced those cases support a direct claim for negligent hiring and supervision.

The two Supreme Court cases relied on by plaintiffs—John R. v. Oakland Unified School Dist. (1989) 48 Cal.3d 438 [ 256 Cal.Rptr. 766 , 769 P.2d 948 ] (John R. ) and Grudt v. City of Los Angeles (1970) 2 Cal.3d 575 [ 86 Cal.Rptr. 465 , 468 P.2d 825 ]—do not support their position. In Grudt , the court addressed the narrow issue of whether a timely filed complaint alleging respondeat superior liability against the public entity for a shooting death by an officer could be amended, even though the statute of limitations had run, to add a claim asserting the entity was itself negligent in retaining officers it knew to be dangerous. The court concluded this new claim was not time-barred because it sought recovery on the same set of facts. (Grudt, at pp. 583-585.) However, a determination that a claim is not time-barred falls short of a holding the claim is otherwise viable.

Plaintiffs’ reliance on John R. is even less convincing. In John R., the court’s holding was limited to two narrow issues: (1) was the claim timely filed, and (2) may a school district be held vicariously liable for a sexual assault by a teacher during an after-school program. Although the lead opinion in John R. contained dicta at various points suggesting that its holding—declining to permit vicarious liability—would not bar a claim for direct liability for the school’s negligence in supervising the activity (see John R., supra, 48 Cal.3d at pp. 441, 451, fn. 10), the language is both dicta and is contained in an opinion that did not command a majority of the court. We conclude dicta contained in an opinion that did not gamer a majority of the court is an insufficient basis to ignore the requirement, as outlined in the subsequent majority holdings in Zelig and Eastbum , that a statutory basis for a direct claim against a governmental entity must be identified.

Plaintiffs also cite a series of appellate court cases to support their contention that a direct claim for negligence may be maintained against a governmental entity for injuries allegedly caused by the entity’s negligent hiring and supervising of its employees. These cases do not persuade us that the analysis required by Eastbum and Zelig is preempted by a claim for direct liability under a negligent hiring/supervision theory. For example, in both Virginia G. v. ABC Unified School Dist. (1993) 15 Cal.App.4th 1848 [ 19 Cal.Rptr.2d 671 ] and Doe 1 v. City of Murrieta (2002) 102 Cal.App.4th 899 [ 126 Cal.Rptr.2d 213 ], the courts evaluated the entity’s liability for molestation of students by their teacher. The Virginia G. court, after correctly recognizing that public entity liability must arise from a statutory basis (Virginia G. v. ABC Unified School Dist., supra, 15 Cal.App.4th at p. 1853 ), nevertheless peremptorily concluded the entity could be directly liable for negligent supervision (without identifying the statutory basis for such liability) by relying without analysis on the John R. dicta. (Virginia G., at p. 1855.) We conclude Virginia G.’s reliance on the John R. dicta was erroneous and should not be perpetuated.

In Doe 1 , the court again made no effort to identify a statutory basis for the direct claim against the public entity. Instead, Doe 1 concluded the entity could be liable for negligent supervision by finding a duty of care under two theories. First, it employed a traditional duty analysis, relying in part on Ma v. City and County of San Francisco (2002) 95 Cal.App.4th 488 [ 115 Cal.Rptr.2d 544 ] and application of the Rowland factors (Doe 1 v. City of Murrieta, supra, 102 Cal.App.4th at pp. 913-916 & fns. 41, 44), from which it concluded the entity owed a duty of care to the victim. Second, relying on Virginia G., it concluded the entity had a “special relationship” with the victim from which a direct duty of care would be imposed. (Doe 1, supra, 102 Cal.App.4th at pp. 917-918.) The latter rationale, we have already concluded, is a derelict on the waters of the law that we decline to follow. Moreover, Doe Fs first rationale appears to have been eviscerated by Eastburn’s discussion of Ma and Rowland. Eastburn noted that, after the Ma court concluded no statutory duty had been identified, Ma “nonetheless held that a public agency and its dispatchers owe the public a mandatory duty of care arising from the common law duty to act with reasonable care that is embodied in Civil Code section 1714. We disagree.” (Eastburn, supra, 31 Cal.4th at p. 1182 , italics added.) Eastburn then discussed why it disapproved of Ma, explaining: “[T]he Ma court . . . [w]ithout acknowledging the provisions of Government Code section 815, requiring a statutory basis for direct public entity liability, . . . ‘employed] a traditional common law duty analysis,’ [to hold] that the city owed its citizens the general duty of ordinary care embodied in Civil Code section 1714. (Ma, supra, 95 Cal.App.4th at p. 502 .) Using traditional tort analysis (i.e., balancing the factors enumerated in [Rowland], including the foreseeability and certainty of harm, the close connection with and moral blame of the defendant’s conduct, the policy of preventing future harm, etc.), the Ma court concluded that ‘all the individual Rowland factors favor duty overwhelmingly. ’ (Ma, supra, 95 Cal.App.4th at p. 511 .) HO ... HO We think that Ma erred in concluding that Civil Code section 1714, and the common law principles it codified, were alone sufficient bases for imposing direct tort liability on a public entity. As previously noted, ‘[a] public entity is not liable for an injury,’ ‘[e]xcept as otherwise provided by statute.’ (Gov. Code, § 815.) In other words, direct tort liability of public entities must be based on a specific statute declaring them to be liable, or at least creating some specific duty of care, and not on the general tort provisions of Civil Code section 1714. Otherwise, the general rule of immunity for public entities would be largely eroded by the routine application of general tort principles.” (Eastburn, at pp. 1182-1183.)

As we interpret Eastburn, the fundamental basis underlying the first rationale relied on by Doe 1 has been eviscerated by Eastburn’s discussion of Ma and Rowland. We conclude Doe 1 was impliedly disapproved in Eastburn and should not be followed.

The remaining cases relied on by plaintiffs are equally inapplicable. We conclude that a direct claim against a governmental entity asserting negligent hiring and supervision, when not grounded in the breach of a statutorily imposed duty owed by the entity to the injured party, may not be maintained.

V

THE MANDATORY DUTY CLAIM

Plaintiffs contend that, even if their claim against County requires a legislative enactment creating a specific duty of care by the agency in favor of the injured party, the provisions of 21 Code of Federal Regulations part 1301.71 (2007) imposed a mandatory duty on County to take effective steps to safeguard against the theft and abuse of drugs in its possession, and County’s violation of that mandatory duty supports the judgment here.

A. Legal Framework

Section 815.6 provides: “Where a public entity is under a mandatory duty imposed by an enactment that is designed to protect against the risk of a particular kind of injury, the public entity is liable for an injury of that kind proximately caused by its failure to discharge the duty unless the public entity establishes that it exercised reasonable diligence to discharge the duty.”

Section 815.6 has three discrete requirements, two of which are dispositive here. First, “the enactment at issue be obligatory, rather than merely discretionary or permissive, in its directions to the public entity; it must require, rather than merely authorize or permit, that a particular action be taken or not taken. [Citation.] It is not enough, moreover, that the public entity or officer have been under an obligation to perform a function if the function itself involves the exercise of discretion. [Citation.]” (Haggis v. City of Los Angeles (2000) 22 Cal.4th 490, 498 [ 93 Cal.Rptr.2d 327 , 993 P.2d 983 ].)

The second “but equally important [requirement is] that the mandatory duty be ‘designed’ to protect against the particular kind of injury the plaintiff suffered. The plaintiff must show the injury is ‘ “one of the consequences which the [enacting body] sought to prevent through imposing the alleged mandatory duty.” ’ (Hoff v. Vacaville Unified School Dist. (1998) 19 Cal.4th 925, 939 [ 80 Cal.Rptr.2d 811 , 968 P.2d 522 ], fn. omitted.) Our inquiry in this regard goes to the legislative purpose of imposing the duty. That the enactment ‘confers some benefit’ on the class to which plaintiff belongs is not enough; if the benefit is ‘incidental’ to the enactment’s protective purpose, the enactment cannot serve as a predicate for liability under section 815.6.” (Haggis v. City of Los Angeles, supra, 22 Cal.4th at p. 499 .)

Whether the enactment creates a mandatory duty designed to protect against the particular injury is subject to de novo review because it involves a question of statutory interpretation for the courts. (Haggis v. City of Los Angeles, supra, 22 Cal.4th at p. 499 .) We are convinced the federal regulations did not impose a mandatory duty actionable within the meaning of section 815.6 because they do not command specific acts designed to prevent an employee from using embezzled drugs to commit premeditated first degree murder.

B. The Evidence

OME is an analytical laboratory that performs chemical analysis for civil and law enforcement purposes, including analyzing drugs removed from death scenes and to determine cause of death. To acquire drug standards and store controlled substances, OME must qualify as a registrant licensed by the federal Drug Enforcement Administration (DEA). The DEA imposes regulatory requirements on licensees who hold controlled substances, although the nature of the regulations vary depending on the nature of the licensee’s activity. (See 21 C.F.R. § 1301.71 et seq. (2007).) Among the requirements imposed on all registrants is that a registrant “shall provide effective controls and procedures to guard against theft and diversion of controlled substances.” ( 21 C.F.R. § 1301.71 (a).)

At the time of de Villers’s murder, OME stored the drug standards in a locked room within the locked toxicology laboratory. Plaintiffs do not cite any evidence this double set of locked doors failed substantially to comply with the physical security requirements applicable to OME.

At the time of de Villers’s murder, materials impounded by investigators were taken to OME. The materials were placed in envelopes, which were then deposited into a locked “evidence box” previously inspected and approved by DEA investigators. However, when the evidence box was full to overflowing, investigators would place the excess envelopes adjacent to the evidence box. Persons with authorized access to OME’s offices had access to the envelopes that were not inside the locked evidence box.

The envelopes were periodically collected, moved into the toxicology laboratory and placed in the “balance room.” A toxicologist would periodically sort through the collection to remove envelopes marked “destroy, no hold”; these would be placed into a cardboard box to be later taken to the sheriff’s office for destruction. The remainder of the envelopes were eventually sorted and placed into locked storage cabinets in the toxicology laboratory. After the envelopes had been moved from the evidence box area into the toxicology laboratory, only the toxicologists or others with keys to the laboratory had access to the materials in the balance room or the locked storage cabinets.

Plaintiffs’ expert, Mr. Mudri, testified certain aspects of OME’s security arrangements violated the mandatory obligations the Code of Federal Regulations imposed on OME. First, he testified only one or two persons should have keys that would allow access to the drug standards and the other locked areas where seized drugs were stored but, instead, the keys were accessible to all of the toxicologists after they were inside the toxicology laboratory. He stated the “key control systems and/or combination lock control systems” ( 21 C.F.R. § 1301.71 (b)(8) (2007)) were inadequate. Second, he noted there was no system for recording or monitoring when an OME employee had possession of a drug envelope or drug standard. He concluded the “supervision over employees having access to . . . storage areas” ( 21 C.F.R. § 1301.71 (b)(ll)) was also inadequate.

C. The Required Action Was Not a Mandatory Duty Within the Meaning of Section 815.6

The provisions of 21 Code of Federal Regulations part 1301.71(a) (2007) require a registrant to provide “effective” controls to “guard against” theft of controlled substances, but does not impose a mandatory obligation to guarantee no materials will ever be stolen. The regulation does not mandate that any particular method or procedure be adopted to guard against theft; to the contrary, it expressly recognizes that “[substantial compliance” with the physical and other security requirements imposed on registrants may be “deemed sufficient” to satisfy the registrant’s obligations. ( 21 C.F.R. § 1301.71 (b).) Indeed, plaintiffs’ expert conceded that neither of the measures he specified as complying with the regulations (e.g., limiting keys to two people and having a witnessed monitoring when any toxicologist accessed a drug standard or an evidence envelope) were mandated by the enactment, and he agreed the guidelines are “general guidelines” that afford discretion on how to design and implement safeguards against theft.

We conclude the Code of Federal Regulations does not impose the type of mandatory obligation contemplated by section 815.6. Although the regulations set goals to which the registrant must aspire, it grants latitude on how best to achieve those goals and does not describe discrete acts that must be performed. Under the analysis of Creason v. Department of Health Services (1998) 18 Cal.4th 623 [ 76 Cal.Rptr.2d 489 , 957 P.2d 1323 ] (Creason), the enactment here did not impose the type of mandatory duty actionable under section 815.6. In Creason , the legislation obliged the state department of health services to formulate testing standards for hypothyroidism that would be “ ‘ “accurate, provide maximum information, and . . . produce results that are subject to minimum misinterpretation.” ’ ” {Creason, at p. 629.) It was alleged the standards developed by the agency failed to satisfy those obligations, and the injuries suffered as a result of that failure were actionable under section 815.6. {Creason, at pp. 627-629.) The Supreme Court concluded that, although the enactment contained mandatory language describing the goals to be pursued, it “left the selection of necessary and appropriate testing and reporting standards to the sound discretion of the Director, guided by certain ‘principles’ that the Director should consider in drafting those standards.” {Id. at pp. 631-632.) Because the guiding principles were “general and broad and . . . subject to considerable interpretation,” the court concluded the statutory scheme contemplated discretionary decisions by the agency on how best to achieve the stated goals, and the alleged negligent exercise of that discretion would not support a claim for breach of a mandatory duty. (Id. at pp. 634-635.) As subsequently confirmed by Haggis , the enactment “must require . . . that a particular action be taken or not taken. [Citation.] It is not enough, moreover, that the public entity or officer have been under an obligation to perform a function if the function itself involves the exercise of discretion.” (Haggis v. City of Los Angeles, supra, 22 Cal.4th at p. 498 , 2d & 3d italics added.)

In determining whether a mandatory duty actionable under section 815.6 had been imposed, the Legislature’s use of mandatory language (while necessary) is not the dispositive criteria. Instead, the courts have focused on the particular action required by the statute, and have found the enactment created a mandatory duty under section 815.6 only where the statutorily commanded act did not lend itself to a normative or qualitative debate over whether it was adequately fulfilled. Thus, actionable mandatory duties have been found where a county failed to release an arrestee after dismissal of charges as required by Penal Code section 1384 (Sullivan v. County of Los Angeles (1974) 12 Cal.3d 710 [ 117 Cal.Rptr. 241 , 527 P.2d 865 ]), or where the agency failed to register a dismissal of charges as required by Penal Code section 1384 (Bradford v. State of California (1973) 36 Cal.App.3d 16 [ 111 Cal.Rptr. 852 ]), or where the entity failed to release the arrestee under the duty to release on bail prescribed by Penal Code section 1295 {Shakespeare v. City of Pasadena (1964) 230 Cal.App.2d 375 [ 40 Cal.Rptr. 863 ]). In each of these cases, the required action was clear and discrete and required no evaluation of whether it had in fact occurred.

In contrast, when the statutorily prescribed act involves debatable issues over whether the steps taken by the entity adequately fulfilled its obligation, we believe the act necessarily embodies discretionary determinations by the agency regarding how best to fulfill the mandate, and this discretion removes the duty from the type of activity that supports a claim under section 815.6. “Like the court in Haggis , we also read Creason as endorsing the view that, for purposes of establishing damages liability under section 815.6, if the predicate enactment confers the exercise of discretion on government officials, the use of ‘shall’ and like words will not alone support liability under the California Tort Claims Act.” (Sutherland v. City of Fort Bragg, supra, 86 Cal.App.4th 13, 20 .) Thus, in Creason , the requirement that the agency develop testing procedures that would be “accurate [and] provide maximum information” did not impose a mandatory duty within the meaning of section 815.6 because the manner of its discharge necessarily involved discretionary determinations on how to best implement the legislative mandate. Similarly, in County of Los Angeles v. Superior Court (2002) 102 Cal.App.4th 627 [ 125 Cal.Rptr.2d 637 ], the mandate that a social services agency place a dependent child with relatives was held not to create a mandatory duty actionable under section 815.6 because the discretionary determinations on how best to fulfill the duty necessarily involved debatable issues of whether the mandate had been adequately fulfilled, which obviated the application of section 815.6. (County of Los Angeles, at p. 640.)

Here, the mandated act—to “guard against” theft with “effective controls and procedures”—does not involve a discrete act over which there can be no debate, but instead involves actions that admit to a qualitative debate over whether OME’s actions were sufficient to fulfill its obligation. Indeed, the Code of Federal Regulations itself contemplates that “[substantial compliance with the standards . . . may be deemed sufficient by the Administrator” to satisfy the mandate ( 21 C.F.R. § 1301.71 (b) (2007)), which confirms that the qualitative judgments on the adequacy of the steps taken to fulfill the mandate have been vested in administrative agencies. We do not believe that 21 Code of Federal Regulations part 1301.71 imposes a duty that is mandatory for purposes of establishing damages liability under section 815.6, because the predicate enactment confers on government officials the discretion to evaluate and decide how best to implement the required security.

D. The Enactment Was Not Designed to Protect Against the Particular Injury

The second essential element of section 815.6—that the mandatory duty was designed to protect against the particular kind of injury the plaintiff suffered—is also absent here. Plaintiffs have not produced any relevant legislative history demonstrating that the particular injury suffered—the danger that stolen drugs would be used to commit premeditated murder—is “ ‘one of the consequences which the [enacting body] sought to prevent through imposing the alleged mandatory duty.’ ” (Hoff v. Vacaville Unified School Dist., supra, 19 Cal.4th at p. 939 , fn. omitted.) Instead, plaintiffs argue it is sufficient that Congress has declared the “illegal . . . possession and improper use of controlled substances have a substantial and detrimental effect on the health and general welfare of the American people” ( 21 U.S.C. § 801 ) to show that antitheft measures were designed to prevent the particular injury—the deleterious effect on de Villers’s health from a murderous spouse—suffered here. However, this attenuated connection is not sufficient, because the fact the enactment “ ‘confers some benefit’ on the class to which plaintiff belongs is not enough; if the benefit is ‘incidental’ to the enactment’s protective purpose, the enactment cannot serve as a predicate for liability under section 815.6.” (Haggis v. City of Los Angeles, supra, 22 Cal.4th at p. 499 .)

The courts have repeatedly rejected the contention that a plaintiff’s ability to articulate some causal nexus between the broad protective purposes of the mandatory duty and the specific injury suffered is sufficient to show the particular injury suffered was within the intended ambit of the duty. For example, in Nunn v. State of California (1984) 35 Cal.3d 616 [ 200 Cal.Rptr. 440 , 677 P.2d 846 ], an unarmed security guard was killed while on duty, and it was argued that if the state had satisfied its duty to promptly promulgate regulations allowing for firearm training for security guards, the victim would have been able to carry a weapon and to have defended himself against the attacker. (Id. at p. 620.) The Nunn court, rejecting the claim, explained that even if a mandatory duty promulgated by the regulations existed, “section 815.6 requires that the statute imposing such a mandatory duty be ‘designed to protect against the risk of [the] particular kind of injury’ which occurred. [Citations.] The Legislature clearly enacted [the statute concerning firearm training] for the purpose of protecting the public from the danger of incompetent armed private security guards. Since the Legislature conditioned the use of firearms on the guards’ completion of a firearms instruction course, it might be argued that the legislative scheme reflects the Legislature’s recognition of the guards’ interest in protecting themselves on the job. While we agree that the statute confers some benefit on the guards, such benefit is incidental. Accordingly, the statutory purpose is not to protect plaintiff from this type of injury. The primary purpose—protecting the public—remains.” (Id. at pp. 625-626, italics added.) Similarly, the primary purpose of the antitheft provisions of the Code of Federal Regulations appears to be to prevent drug users from obtaining and ingesting illegal substances. Although this legislative purpose may collaterally confer some benefit on the families, friends, coworkers and the broader society—by diminishing the number of persons whose drug addiction might eventually lead them to commit antisocial acts—we believe that benefit is remote from and incidental to the primary protective purpose of the statute.

Other courts have similarly declined to find a particular injury suffered was within the intended ambit of the duty merely because there was some causal connection between the alleged violation of the duty and the specific injury. For example, in Fleming v. State of California (1995) 34 Cal.App.4th 1378 [ 41 Cal.Rptr.2d 63 ], a parolee left the state in violation of the terms of his parole and subsequently murdered a victim. It was alleged the state violated the mandatory duty imposed by Penal Code section 3059, which provided that a parolee who left the state “ ‘shall be held as an escaped prisoner and arrested as such’ ” {Fleming, at p. 1383), and that the failure to arrest the parolee was a proximate cause of the subsequent murder. {Fleming, at pp. 1382-1384.) The court concluded, in part, that the claim under section 815.6 failed because the statute “was not intended to protect the public against the risk of criminal attack by a parolee who leaves the state without permission.” ( 34 Cal.App.4th at p. 1384 .) Here, the primary purpose of the enactment appears to be to prevent theft of drugs, not to protect the public against the risk of criminal attack by a drug thief.

Plaintiffs cite neither pertinent legislative history nor analogous case law suggesting that a measure designed to deter drug theft encompasses, as “ ‘one of the consequences which the [enacting body] sought to prevent through imposing the alleged mandatory duty’ ” (Hoff v. Vacaville Unified School Dist., supra, 19 Cal.4th at p. 939 ), the prevention of premeditated murder by drug thieves. We conclude plaintiffs’ claim under section 815.6 fails for the additional reason that the enactment was not designed to protect against the particular injury for which plaintiffs seek recovery.

VI

OTHER CLAIMS

Because we conclude there is no cause of action against County in this case for negligent hiring and supervision under either a vicarious or direct liability theory, and no cause of action for failure to perform a mandatory duty within the meaning of section 815.6, it is unnecessary to address the alternative claim of County that the murder of de Villers by Rossum was not foreseeable for purposes of establishing either a duty on County or causation resulting from any breach of duty.

DISPOSITION

The judgment is reversed and the matter is remanded to the trial court with directions to grant the County’s motion for judgment notwithstanding the verdict. The County is entitled to costs on appeal.

McIntyre, J., and Irion, J., concurred.

Respondents’ petition for review by the Supreme Court was denied January 16, 2008, S158544.

Rossum had a juvenile record on charges of being under the influence and in possession of controlled substances. Detectives investigating de Villers’s death found a prescription in Rossum’s name, with a late September 2000 date on it, obtained from a Mexican physician and apparently filled in Mexico. The prescription was for a drug that metabolized as methamphetamine. Ambom decided the toxicology tests to be performed on de Villers’s body fluids should be performed by an agency other than OME to avoid any potential conflict of interest. This was the first time Ambom had used an outside agency to conduct toxicology tests. When Ambom told Robertson he had decided to have the tests performed outside OME, Robertson expressed shock. OME performs toxicological analyses to determine whether drugs may have contributed to a death and, to facilitate the analysis, OME maintains an inventory of drug “standards,” which are vials of pure drugs that may be used to chemically compare with drugs impounded at death scenes. Plaintiffs’ complaint also sought damages against Robertson, but the claims against Robertson were voluntarily dismissed before trial. All statutory references are to the Government Code unless otherwise specified. Plaintiffs also argue that several cases have permitted a plaintiff to pursue a negligent hiring and supervision claim against a governmental entity as a claim for direct rather than vicarious liability. We discuss those cases at part IV.B., post. Plaintiffs acknowledge there was no special relationship between de Villers and County. Plaintiffs rely on Lugtu v. California Highway Patrol (2001) 26 Cal.4th 703 [ 110 Cal.Rptr.2d 528 , 28 P.3d 249 ] and Ladd v. County of San Mateo (1996) 12 Cal.4th 913 [ 50 Cal.Rptr.2d 309 , 911 P.2d 496 ]. Lugtu did not involve a party’s duty to prevent a criminal attack and is irrelevant to this case. Ladd discussed, in dicta, the possible liability of a public entity to injured members of the public when the entity negligently permits a prisoner to escape, but rejected liability on the facts of that case. Moreover, injuries caused by an escaping prisoner involve a defendant entity that has undertaken a protective relationship—to safeguard the public against the precise danger posed to safety by escaping criminals—and the entity has actual knowledge of the potential for criminal conduct in connection with the escape, neither of which applies to Rossum’s coworkers here. In Mary M. v. City of Los Angeles (1991) 54 Cal.3d 202 [ 285 Cal.Rptr. 99 , 814 P.2d 1341 ], our Supreme Court subsequently recognized that the lead opinion in John R., in which the dicta relied on by plaintiffs is contained, was “an opinion signed by only two justices of this court. (There were four separate opinions.) Even the other three justices who agreed there should be no vicarious liability declined to sign the portion of the lead opinion dealing with that issue. Instead, they chose to make clear that they concurred only ‘in the majority’s holding’ of no vicarious liability. [Quoting the cone, and dis. opn. of Eagleson, J. from John R., supra, 48 Cal.3d at p. 455 .] Except to its precise holding of no liability, the lead opinion stated a minority view and provides no authority for any proposition in a subsequent case. [Citations.] This is hornbook law. ‘No opinion has any value as a precedent on points as to which there is no agreement of a majority of the court.’ [Quoting 9 Witkin, Cal. Procedure (3d ed. 1985) Appeal, § 808, p. 788.]” (Mary M., at p. 233 (cone. opn. of Baxter, J.).) Although respondents cite Mary M. v. City of Los Angeles, supra, 54 Cal.3d 202 , for the proposition that an entity may be held liable for the negligent hiring and supervision practices of its managers, the holding in Mary M. was that an entity may be held vicariously liable for the acts of an employee within the course and scope of his or her employment. (Id. at p. 221.) It did not evaluate alleged negligence in the hiring or supervision of that employee. In Virginia G., a junior high school student was molested by a teacher while at school (Virginia G. v. ABC Unified School Dist., supra, 15 Cal.App.4th at p. 1851 ), and in Doe 1 , the students were participants in an “explorer” program operated by the police department and were molested by their mentor during that program (Doe 1 v. City of Murrieta, supra, 102 Cal.App.4th at pp. 903-905). Rowland v. Christian (1968) 69 Cal.2d 108, 112-113 [ 70 Cal.Rptr. 97 , 443 P.2d 561 ]. For example, although Mendoza v. City of Los Angeles, supra, 66 Cal.App.4th 1333 , contains generic references to an entity’s alleged liability for negligent hiring and supervision {id. at pp. 1339-1340), the court ultimately concluded it would not impose on the employer a duty to prevent its employee from murdering a family member (id. at p. 1341). The third requirement is that the entity’s failure to fulfill that duty was a proximate cause of the injury. (Sutherland v. City of Fort Bragg (2000) 86 Cal.App.4th 13, 23 [ 102 Cal.Rptr.2d 736 ].) We do not consider that element here because we conclude the first two elements are absent in this case. The regulation provides that, to determine whether a registrant has provided “effective controls,” the DEA’s administrator “shall use the security requirements set forth in §§ 1301.72-1301.76 as standards for the physical security controls and operating procedures necessary to prevent diversion.” ( 21 C.F.R. § 1301.71 (a) (2007).) Parts 1301.72 and 1301.73 address the standards for physical security controls to be employed by nonpractitioners. Part 1301.74 addresses “other security controls” to be employed by nonpractitioners. Part 1301.75 addresses physical security controls to be employed by practitioners, and these latter controls apparently apply to nonpractitioners “authorized to conduct research or chemical analysis under another registration.” ( 21 C.F.R. § 1301.75 (c) (2007).) Finally, part 1301.76 addresses “other security controls” for practitioners, but does not similarly extend such controls to nonpractitioners authorized to conduct chemical analysis under another registration. OME did not maintain a “witnessed” inventory of materials deposited by investigators. . Mudri initially testified he had three reasons for concluding OME’s procedures violated 21 Code of Federal Regulations part 1301.71. However, the third criterion he cited was subdivision (b)(14), which refers to the “adequacy of the . . . system for monitoring the receipt . . . and disposition of controlled substances in its operations.” ( 21 C.F.R. § 1301.71 (b)(14).) When describing how this provision was violated, Mudri acknowledged it “falls along the lines with the other two, [the] monitoring activities [and] access to only a minimum number of employees.” It appears that Mudri believed that controlling access to the keys and monitoring when employees accessed the drugs held in OME offices were required to comply with the three cited subdivisions. The subdivisions cited by Mudri as the foundation for his opinion that County violated its mandated obligations are contained in 21 Code of Federal Regulations part 1301.71(b) (2007). That subdivision explicitly grants to the administrator the power to determine whether the security provided by the registrant adequately meets the regulatory demands. Thus, discretionary determinations as to the adequacy of security are made in the first instance by OME and in the second instance by the DEA. For example, in Department of Corporations v. Superior Court (2007) 153 Cal.App.4th 916 [ 63 Cal.Rptr.3d 624 ], this court recently concluded that a statute, although employing mandatory language, did not impose a mandatory duty actionable under section 815.6 because the mandated action arose only after (and was predicated on) the discretionary application of the agency’s judgment and expertise. Other courts have found mandatory duties under similar enactments, including (1) the obligation of an entity to issue a building permit only on proof the applicant has workers’ compensation insurance (Morris v. County of Marin (1977) 18 Cal.3d 901 [ 136 Cal.Rptr. 251 , 559 P.2d 606 ]), (2) the obligation of the DMV (Department of Motor Vehicles) to deny a license to a person it had determined could not safely operate a motor vehicle (Trewin v. State of California (1984) 150 Cal.App.3d 975 [ 198 Cal.Rptr. 263 ]), and (3) the obligation of the PUC (Public Utilities Commission) to revoke the operating authority of a bus company that did not maintain liability insurance (Elson v. Public Utilities Commission (1975) 51 Cal.App.3d 577 [ 124 Cal.Rptr. 305 ]).