I.

INTRODUCTION

In the lawsuit underlying these consolidated writ proceedings, the People of the State of California, by and through the Santa Clara County Counsel, the Orange County District Attorney, the Los Angeles County Counsel, and the Oakland City Attorney, filed an action against defendants— various pharmaceutical companies involved in the manufacture, marketing, distribution, and sale of prescription opioid medications. (People v. Purdue Pharma (Super Ct. Orange County, 2014, No. 30-2014-00725287-CU-BT- CXC) (“Underlying Action”).) In the operative sixth amended complaint, the People allege that the defendants made false and misleading statements as part of a deceptive marketing scheme designed to minimize the risks of opioid medications and inflate their benefits. This scheme, the People allege, caused a public health crisis in California by dramatically increasing the number of opioid

2 prescriptions, the use and abuse of opioids, and opioid-related deaths. The operative complaint contains causes of action for violations of the False Advertising Law (Bus. & Prof. Code, § 17500 et seq.), the Unfair Competition Law (Bus & Prof. Code, § 17200 et seq.), and the public nuisance statutes (Civ. Code, §§ 3479, 3480) and seeks declaratory and injunctive relief, as well as civil penalties. In Board of Registered Nursing v. Superior Court (2021) 59 Cal.App.5th 1011 (Board of Registered Nursing), this court recently considered the propriety of several discovery orders in the Underlying Action that compelled four nonparty state agencies to produce to defendants various categories of

documents related to opioids.1 (Id. at p. 1021.) Of relevance to these writ proceedings, the Board of Registered Nursing court considered the legality of a superior court order requiring the production of prescription records contained in the state’s Controlled Substance Utilization Review and Evaluation System (CURES) database. (Id. at p. 1022.) The order required the Department of Justice to produce CURES prescription records for individually identified patients to an outside vendor. The vendor would then replace patient names with unique identifiers, cross-reference the records with other datasets in the vendor’s possession, and provide the linked

deidentified datasets to the defendants. (Id. at p. 1045.)2

1 The Board of Registered Nursing court noted that the discovery was sought on behalf of all defendants in the Underlying Case and that all defendants appeared as real parties in the writ proceedings in this court. (Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1024, fn. 2.)

2 The court’s order compelling production required either “(1) the production of patient identifying data to defendants’ vendor or (2) the production of data with patient identifying data replaced with a unique identifier supplied by defendants’ vendor that would allow the vendor to 3 In a writ proceeding challenging the propriety of the order, after observing that the production of identified patient data to an outside vendor for deidentification “would . . . implicate the privacy rights of the patients” (Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1045), the Board of Registered Nursing court concluded that defendants “ha[d] not justified such a sweeping production of personal and private medical data” under the law governing nonparty discovery. (Id. at p. 1038, citing Calcor Space Facility, Inc. v. Superior Court (1997) 53 Cal.App.4th 216, 223 (Calcor).) Accordingly, the Board of Registered Nursing court held that the superior court abused its discretion in ordering production of the CURES records. The present writ proceedings pertain to another discovery dispute in the Underlying Action. The dispute arose after several of the defendants in

the Underlying Action (“Johnson & Johnson defendants”),3 served subpoenas on two nonparty counties, petitioners County of Los Angeles and County of Alameda, seeking records of patients in various county programs, including individual prescription data and individual patient records related to substance abuse treatment. In its petition, the County of Los Angeles describes the documents at issue as including “detailed data for over one million dispensed medications, along with pharmacy and prescriber identifiers, as well as over 1.7 million associated encounters, including diagnoses, procedures, medical service, treating provider and attending (billing) provider” (italics omitted) and

cross-reference CURES data with other data in its possession (e.g., insurance claim data).” (Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1045.)

3 The Johnson & Johnson defendants are real parties Johnson & Johnson, Janssen Pharmaceuticals, Inc., and Ortho-McNeil-Janssen Pharmaceuticals, Inc. 4 “records for 5,867 individuals and over 65,000 associated encounters, including diagnoses, procedures, and other clinical information,” pertaining to “patients diagnosed with or treated for opioid use disorder, opioid addiction, or overdose at LA County facilities.” In its petition, the County of Alameda describes the documents as including “patient-level data related to substance use treatment, pharmacy records, encounter data, and other sensitive information.”4 After petitioners and the Johnson & Johnson defendants engaged in various informal and formal means to attempt to resolve the dispute, the superior court issued a discovery order granting the Johnson & Johnson defendants’ motions to compel production of the records. As with the CURES data at issue in Board of Registered Nursing, the court’s order directed petitioners to provide the records on a personally “identified” basis to a vendor that would “de-identify [the] data and make it cross-referenceable against other de-identified data processed by [the vendor] in this case.” The

4 Similarly, in their informal response in this court, the Johnson & Johnson defendants summarized the records at issue as follows: “The specific records at issue here are: (1) opioid prescription records and healthcare services records for patients with opioid-related diagnoses from the Los Angeles County Department of Health’s Online Real-time Centralized Health Information Database (‘ORCHID’), which tracks healthcare services provided by publicly funded healthcare centers in Los Angeles County [citation]; (2) patient-level data from the Los Angeles County Participant Reporting System (‘LACPRS’), a repository of data used to measure substance abuse treatment and/or recovery outcomes measures [citation]; and (3) Medi-Cal data involving opioids for all patients treated by Alameda County, including prescription data, claims data, or encounter data [citation].” 5 court’s order specifies that “[o]nly fully de-identified data will be provided by [the vendor] to defendants (or any other party in this case).” Each petitioner filed a petition for writ of mandate in this court, seeking vacatur of the superior court’s order compelling production of the documents. The petitioners claim that the discovery order implicates the state constitutional privacy rights of the individuals whose records the superior court ordered produced, among other arguments. We consolidated the petitions and issued an order to show cause. In determining whether a discovery order would violate state constitutional privacy rights, we apply the framework established in Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1 (Hill). (See Williams v. Superior Court (2017) 3 Cal.5th 531, 552, 556 (Williams) [stating that Hill applies to a discovery dispute that “requires a court to reconcile asserted privacy interests with competing claims for access”].) In applying the Hill test, “[t]he party asserting a privacy right must establish a legally protected privacy interest, an objectively reasonable expectation of privacy in the given circumstances, and a threatened intrusion that is serious.” (Williams, supra, at p. 552, citing Hill, supra, at pp. 35–37.) “The party seeking information may raise in response whatever legitimate and important countervailing interests [the] disclosure serves,” and “[a] court must then balance these competing considerations.” (Williams, supra, at p. 552, citing Hill, supra, at pp. 37–40.) As we explain in part III, post, we conclude that petitioners have established that the superior court’s order threatens a serious intrusion into the privacy interests of the patients whose records are at issue. In considering whether the Johnson & Johnson defendants have “demonstrated, under the heightened standard applicable to constitutional rights of privacy,

6 a practical necessity for discovery [of the records],” (John B. v. Superior Court (2006) 38 Cal.4th 1177, 1201), we observe that the Johnson & Johnson defendants seek to obtain opioid prescription data similar to the CURES data at issue in Board of Registered Nursing, as well as substance abuse treatment records, which threatens to cause an even more substantial invasion of privacy rights. Yet, the Johnson & Johnson defendants fail to provide a justification for the discovery of such records that differs in any material way from that which this court found insufficient in Board of Registered Nursing to justify discovery under the broad Calcor standard applicable to nonparty discovery requests generally. (See Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1039 [“ ‘Although the scope of civil discovery is broad, it is not limitless,’ ” quoting Calcor, supra, 53 Cal.App.4th at p. 223].) Therefore, and for reasons we explain more fully in part III, post, we conclude that the Johnson & Johnson defendants have failed to demonstrate that their interests in obtaining “such a vast production of medical information” (Board of Registered Nursing, supra, at p. 1046) outweigh the significant privacy interests that the nonparty petitioners have identified. (See Williams, supra, 3 Cal.5th at p. 556 [where “a discovery request seeks information implicating the constitutional right of privacy,” the party seeking discovery must make a showing of need greater than that needed for discovery requests generally].) Accordingly, we grant petitioners’ writ petitions and direct the superior court to vacate its order compelling production of the requested documents and to enter a new order denying Johnson & Johnson defendants’ motions to

compel.5

5 The petitioners also contend that the superior court’s order should be vacated because it orders disclosure of substance use disorder patient records, in violation of federal law (42 C.F.R § 2 et seq.) and because the superior court lacked authority to order the public entities to enter into a 7

II.

FACTUAL AND PROCEDURAL BACKGROUND

A. The operative complaint In June 2018, the People filed the operative complaint against defendants. According to the operative complaint, the defendants engaged in wide ranging illegal misconduct designed to promote the use of opioids. The People alleged that defendants targeted susceptible prescribers and vulnerable patient populations with false and misleading statements about opioids. Specifically, according to the People, the defendants falsely downplayed, and failed to disclose, the known risks of long-term opioid use. Defendants also “[g]rossly [o]verstated” the benefits of chronic opioid therapy. The operative complaint alleges that defendants carried on this “marketing scheme” through varied means, including the use of direct marketing of branded opioids and the use of “seemingly independent third parties.” The People further allege that defendants’ efforts led to a huge increase in the number of opioid prescriptions and the use of such drugs, which has resulted in a public health crisis that includes high rates of opioid abuse and addiction and ancillary social costs. The operative complaint relies on such allegations to state causes of action for false advertising (Bus & Prof. Code, § 17500), unfair competition (Bus & Prof. Code, § 17200), and public nuisance. (Civ. Code, §§ 3479, 3480.) The People seek civil penalties for each act of false advertising and unfair competition and an order requiring defendants to abate the public nuisance. In addition, the People seek declaratory and injunctive relief.

contract with an intermediary for the purpose of deidentifying the documents. In light of our granting the petitions for the reasons stated in the text, we need not, and do not, address these additional arguments for vacatur. 8 B. The underlying discovery dispute

In December 2018, the Johnson & Johnson defendants6 served business record subpoenas on two agencies of the County of Los Angeles seeking claims data for opioid prescriptions, healthcare services, and substance-abuse treatment. The subpoenas sought broad categories of information including: “All Documents and Communications concerning or relating to any assessment of actual or potential harm to specific Patients or other specific individuals as a result of any Subject Opioid or any Defendant’s Marketing, Educational Activities, or statements about any Subject Opioid.”

“Participant-level Claims Data showing the full Medicaid or other Program Claims history for prescriptions and other health care services submitted to Medicaid or any other Program, whether reimbursed or not, for all Patients who received a prescription for any Subject Opioid.”

The Johnson & Johnson defendants served similar subpoenas on various County of Alameda agencies. The County of Los Angeles identified two sets of responsive data: (1) opioid prescription and medical encounter data from publicly funded healthcare centers tracked by the County of Los Angeles Department of Health Services’ Online Real-time Centralized Health Information Database (“ORCHID”); and (2) patient-level claims data measuring substance-abuse

6 Although the December 6, 2018 subpoena contained in the exhibits to the County of Los Angeles’s writ petition appears to have been served by defendants other than the Johnson & Johnson defendants, the Johnson & Johnson defendants admit in their return “that they served [County of Los Angeles] with a subpoena on December 6, 2018.” Accordingly, we refer to the discovery sought in this case from the County of Los Angeles as having been sought by the Johnson & Johnson defendants. 9 treatment recovery outcomes tracked by the Los Angeles County Participant Reporting System (“LACPRS”). The County of Alameda identified data for patients that the county treats through its implementation of the Medi-Cal program “including prescription data, claims data, [and] encounter data.” After engaging in various informal discovery efforts, the Johnson & Johnson defendants filed motions to compel the petitioners to provide the

requested data on an identified basis7 to an outside vendor, Rawlings & Associations (Rawlings). Rawlings would in turn “de-identify” the data by assigning unique identifiers to each record that would make the data “cross- walkable,” with other data processed by Rawlings. The deidentified, but cross-walkable, records would then be shared with the Johnson & Johnson defendants. Petitioners opposed the motions on several grounds, including that privacy protections bar the production of identifiable patient data to a third party. The Johnson & Johnson defendants argued in turn that a March 2019 Stipulated Qualified Protective Order for Protected Health Information (Protective Order) previously entered in the case would sufficiently protect any privacy interests. C. The discovery referee’s reports and recommendations After the parties submitted briefing and a discovery referee held several hearings on the discovery issues presented in these writ proceedings as well as numerous other discovery disputes, the discovery referee issued two reports and recommendations to grant the Johnson & Johnson defendants’ motions to compel. As to the County of Los Angeles, with respect to the ORCHID data, the referee agreed that the Protective Order “in

7 By “on an identified basis,” we mean “containing personal information sufficient to identify an individual person.” 10 practice, requires that the County produce its data to Rawlings so that Rawlings can de-identify the data and make it cross-walkable.”8 With respect to the LACPRS data, the referee rejected the County of Los Angeles’s privacy arguments based on federal regulations governing substance abuse treatment records, reasoning that “the focus must be on whether the requesting party receives the data in de-identified form, not a third-party vendor.” With respect to the County of Alameda, the referee issued a report determining that “[County of] Alameda fails to provide a sufficient basis to object to the production of the requested information where, as here, the information will be produced pursuant to a stringent . . . Protective Order.” D. Petitioners’ objections to the discovery referee’s report and recommendations

Petitioners each filed objections to the discovery referee’s report and recommendations. Among other arguments, the County of Los Angeles argued that “[t]here is no basis, legal or factual, to order the reproduction of identified patient data,” and that “[t]he Protective Order does not contemplate, let alone require, that any entity must contract with and produce identified heath data to a third-party vendor, and such a requirement would violate the Protective Order as well as numerous privacy law protections.” Specifically, the County of Los Angeles contended that “to produce identifiable protected health information to any party or third party would violate . . . the constitutional rights of third parties,” among other laws.

8 The County of Los Angeles had previously produced the ORCHID data in a deidentified format and the referee noted that the county argued that it should not be compelled to “re-produce its ORCHID data in a manner which would allow the datasets to be cross-referenced with other datasets.” 11 In its objection, the County of Alameda raised numerous arguments, including those rooted in the privacy rights of the patients whose medical data would be impacted by the production. Specifically, the County of Alameda referred to the “privacy objections over having to produce completely unredacted patient health information, including substance use disorder information, to Rawlings,” that it had raised before the discovery referee. For example, the County of Alameda referred to a supplemental brief that it had filed opposing the Johnson & Johnson defendants’ motion to compel that stated the following: “[The Johnson & Johnson] Defendants have made NO showing of why patient level data for the entirety of Alameda County. . . are relevant. And they certainly do not present any viable argument that the privacy interests of these individuals are outweighed by what is, in essence, a fishing expedition that casts a wide net for information from a non-party.”

E. The Johnson & Johnson defendants’ responses The Johnson & Johnson defendants filed responses to the petitioners’ objections. With respect to the County of Los Angeles’s objections, the Johnson & Johnson defendants noted that the County had “mention[ed]— again, without explanation—‘the constitutional rights of third parties.’ ” The Johnson & Johnson defendants argued that the superior court had ruled, with respect to previous discovery issues in the case, that deidentification and the Protective Order would suffice to protect constitutional privacy rights and that “ ‘[t]he limited invasion being permitted here is justified due to the relevance of the discovery to Plaintiffs[’] claims.’ ” The Johnson & Johnson defendants argued that the court should reach the same conclusion with respect to the County of Los Angeles’s production.

12 In their opposition to the County of Alameda’s objections, the Johnson & Johnson defendants argued that the Protective Order and “precautions taken by the parties and third parties operating under it ensure that privacy laws will be fully complied with while providing the parties access to claims data critical to testing Plaintiff[s’] theory of the case.” F. The superior court’s order granting the Johnson & Johnson defendants’ motions to compel

After a hearing, the superior court entered an order on July 6, 2020 granting the Johnson & Johnson defendants’ motions to compel. The court ordered the County of Los Angeles “to provide to Rawlings the identified data for the County’s previous ORCHID production to defendants, so that Rawlings can de-identify all such data and make it cross-referenceable against other de-identified data processed by Rawlings in this case.” The court also ordered the County of Los Angeles to produce the LACPRS data to Rawlings for deidentification. The court specified that “[o]nly fully de- identified data will be provided by Rawlings to defendants (or any other party in this case).” The court also ordered the County of Alameda to provide the “Medi-Cal claims and prescription data,” specified in the discovery referee’s report and recommendations on the same terms as the court specified for the County of Los Angeles’s production. The superior court also directed the Johnson & Johnson defendants to modify the Protective Order to make Rawlings subject to the Protective Order; to ensure that Rawlings expressly consented to such modification and agreed to act in compliance with various provisions of federal law; and to provide that all information produced by a nonparty would be subject to the Protective Order.

13 G. Writ proceedings in this court In August 2020, petitioners filed petitions for writ of mandate9 seeking reversal of the superior court’s July 6 order, together with requests that this court take judicial notice of the state agencies’ petitions for writ of mandate in Board of Registered Nursing. After soliciting and receiving informal responses from the Johnson & Johnson defendants with respect to each petition, this court summarily denied the petitions. The Supreme Court granted petitioners’ petitions for review and transferred the matters to this court with directions to vacate our orders denying the petitions for writ of mandate and to issue orders directing respondent superior court to show cause why the relief sought in the petitions should not be granted. We acted in accordance with the Supreme Court’s directions and consolidating the proceedings. The Johnson & Johnson defendants filed a return by way of answer/demurrer and a request that we take judicial notice of: (1) the June 8, 2018 operative sixth amended complaint in the Underlying Action; (2) the Protective Order as revised pursuant to the July 6 order, and (3) the February 26, 2020 hearing transcript of the discovery proceedings that led to the writ proceedings in this court in Board of Registered Nursing.

9 The day after filing their initial petitions, petitioners each filed amended petitions. For ease of reference, we refer to the amended petitions as the petitions at issue in these proceedings. Although the writ petitions were initially filed in Court of Appeal, Fourth District, Division Three, the administrative presiding justice transferred the petitions to this division pursuant to California Rules of Court, rule 10.1000(b)(1)(A). 14 Petitioners thereafter filed a reply, and both parties, pursuant to our request, filed supplemental letter briefs concerning Board of Registered

Nursing.10

III.

DISCUSSION

Petitioners claim that the superior court’s July 6 discovery order threatens to intrude on the state constitutional privacy rights (Cal. Const., art. I, § 1) of the patients whose medical information would be affected by the

order.11

10 We grant petitioners’ August 11, 2020 unopposed requests that we take judicial notice of the state agencies’ petitions for writ of mandate in the Board of Registered Nursing proceedings in this court. (See Evid. Code, §§ 452, subd. (c) [permitting the taking of judicial notice of the “[o]fficial acts of the legislative, executive, and judicial departments of the United States and of any state of the United States”], 455, subd. (a), 459, subd. (c) [specifying the manner by which a reviewing court may take judicial notice of a “matter was not theretofore judicially noticed in the action”].) We also grant the Johnson & Johnson defendants’ unopposed December 16, 2020 request that we take judicial notice of: (1) the June 8, 2018 operative sixth amended complaint in the Underlying Action; (2) the August 17, 2020 revised Protective Order, and (3) the February 26, 2020 hearing transcript of the discovery proceedings that led to the writ proceedings in this court in Board of Registered Nursing. (See Evid. Code, §§ 452, subd. (c), 455, subd. (a), 459, subd. (c) [specifying the manner by which reviewing courts may take judicial notice of judicial records].)

11 Although petitioners filed separate writ petitions in this court, they joined in each other’s petitions and filed a consolidated reply. In addition, petitioners’ state constitutional privacy claims are not materially distinct. Thus, we address the state constitutional privacy claims raised in the writ petitions jointly as a single claim. 15 A. Preliminary matters Before considering the merits of petitioners’ claim, we address three preliminary matters presented by their writ petitions. First, although not specifically addressed in the briefing in these writ proceedings, it is well established that, under appropriate circumstances, a litigant “may assert the privacy rights of third parties.” (Tien v. Superior Court (2006) 139 Cal.App.4th 528, 539.) One such circumstance is where the litigant’s interests align with those of the third party and the third party’s “rights are ‘likely to be diluted or adversely affected’ unless [the litigant] is permitted to assert their rights on their behalf.” (Lewis v. Superior Court (2017) 3 Cal.5th 561, 570 (Lewis) [concluding that physician had standing to assert privacy rights of patients whose prescription records had been accessed by state board].) For the same reasons that the Lewis court concluded that a doctor could assert his patients’ privacy interests in their prescription records, we conclude that the petitioners’ may assert the privacy interests of the patients whose medical information they possess. (See ibid. [doctor could assert privacy rights of patients because: (1) patients might “hesitate to seek appropriate medical treatment,” if records were disclosed and doctor shared patients’ interest in seeking appropriate medical treatment and; (2) patients were “unable to assert their own rights because they were never given notice that their records were accessed”].) Second, although discovery orders are ordinarily not reviewable on an interlocutory basis (City of Petaluma v. Superior Court (2016) 248 Cal.App.4th 1023, 1031), writ review is appropriate “[w]here, as here, an order will effectively . . . infringe on privacy rights.” (Los Angeles Gay & Lesbian Center v. Superior Court (2011) 194 Cal.App.4th 288, 300 (Los Angeles Gay & Lesbian Center).) In such an instance, “review on appeal

16 is deemed inadequate because reversal on appeal will not cure the disclosure of protected information.” (Ibid.) Accordingly, because petitioners lack an “adequate remedy at law” to vindicate the third-party privacy rights at stake in their petitions and those third parties “will suffer an irreparable injury” (ibid.) if a writ is not granted, we conclude that writ review is appropriate. Finally, although petitioners did not discuss Hill or present a developed state constitutional argument in the superior court, for the following reasons, we exercise our discretion to reach the merits of their state constitutional claim, notwithstanding any possible forfeiture. (See People v. Williams (1998) 17 Cal.4th 148, 161 [“An appellate court is generally not prohibited from reaching a question that has not been preserved for review by a party”].) To begin with, the privacy rights at stake are those of the petitioners’ patients, and we are therefore disinclined to conclude that petitioners’ briefing in the superior court precludes our consideration of these rights. (See Boler v. Superior Court (1987) 201 Cal.App.3d 467, 472, fn. 1.) In Boler, the court considered whether the defendant had forfeited his right to object on privacy grounds to deposition questions pertaining to the defendant’s prior sexual history with certain nonparties. The Boler court rejected this argument, reasoning in part: “[T]he privacy protection extends to the unknown, unnamed female partners of Boler who have neither executed a waiver nor are even necessarily aware their privacy interests are endangered by the deposition question. Indeed, where third-party privacy interests are involved, the target of discovery has an affirmative duty to notify the third parties of the discovery request and give them an opportunity to appear and object. [Citations.] An inflexible waiver rule would defeat the exercise of this duty and infringe upon the constitutional privacy rights of citizens not participating in this lawsuit. [¶] Given the fundamentality of the sexual privacy issue and the

17 interests of nonparties not present to object and the fact that the trial court reached the merits, we decline to rule that Boler has waived his sexual privacy objections.” (Ibid.)

In addition, although petitioners did not develop a state constitutional privacy argument in the superior court, in their oppositions to the discovery referee’s recommendations and reports, the County of Los Angeles specifically mentioned “the constitutional rights of third parties” and the County of Alameda reiterated its privacy objections to having to produce unredacted patient health information. In addition, in its briefing before the discovery referee, the County of Alameda argued that the Johnson & Johnson defendants had failed to demonstrate that the “privacy interests of [patients] are outweighed by what is, in essence, a fishing expedition.” Further, petitioners alerted the superior court to the third-party privacy interests at stake by extensively arguing that the requested discovery sought materials protected by federal privacy regulations governing substance abuse treatment records. Moreover, the Johnson & Johnson defendants do not present any forfeiture argument in this court,12 nor do they argue that there are disputed facts relevant to a Hill analysis. (Williams, supra, 3 Cal.5th at p. 554, fn. 7 [“Because there are no disputed material facts, we may conduct a Hill analysis for the first time on appeal”].) Indeed, in their return, the Johnson & Johnson defendants argue that the superior court considered the state constitutional privacy interests of third parties, contending that the

12 In their consolidated answer to petitioners’ petitions for review of our initial summary denials of their writ petitions in the Supreme Court, the Johnson & Johnson defendants did argue that petitioners “never raised Hill or constitutional privacy rights below.” (Boldface & some italics omitted.)

18 “Superior Court performed its balancing obligation under Hill.” Under these circumstances, we conclude that it is appropriate to consider petitioners’ state

constitutional privacy claim on the merits.13 B. Standard of review Ordinarily, “[w]e review the trial court's grant or denial of a motion to compel discovery for an abuse of discretion. [Citation.] . . . A circumspect approach to appellate review of discovery orders ensures an appropriate degree of trial court latitude in the exercise of that discretion.” (Williams, supra, 3 Cal.5th at p. 540.) However, the Williams court cautioned that such

deference comes with a significant “caveat[ ].” (Ibid.)14 “ ‘ “[T]he scope of discretion always resides in the particular law being applied, i.e., in the ‘legal principles governing the subject of [the] action . . . .’ Action that transgresses the confines of the applicable principles of law is outside the scope of

13 Notwithstanding our consideration of the merits of petitioners’ state constitutional privacy claim under Hill, we find petitioners’ argument that “the [superior] court erred in neglecting to apply the Hill test,” (first italics added) and petitioners’ chiding of the Johnson & Johnson defendants’ “attempts to apply the Hill factors post hoc,” (second italics added) to be misleading because petitioners failed to cite Hill or present an argument based on the Hill framework in the superior court.

14 The Williams court also referred to a second “caveat[ ]” namely “the prodiscovery policies of the statutory scheme.” (Williams, supra, 3 Cal.5th at p. 540.) Without disregarding the statutory “preference for discovery” (ibid.), we observe that the discovery at issue in this writ proceeding is sought from nonparty petitioners, while in Williams, the discovery was sought from the defendant. (See id. at p. 538.) As this court observed in Board of Registered Nursing, the Supreme Court has cautioned that “[t]he permissible scope of discovery in general is not as broad with respect to nonparties as it is with respect to parties.” (Catholic Mutual Relief Society v. Superior Court (2007) 42 Cal.4th 358, 366, fn. 6 (Catholic Mutual Relief Society); see Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1039, citing Catholic Mutual Relief Society, supra, at p. 366, fn. 6.) 19 discretion and we call such action an ‘abuse’ of discretion.” ’ [Citation.] An order that implicitly or explicitly rests on an erroneous reading of the law necessarily is an abuse of discretion. [Citation.]” (Ibid.) The Williams court also noted that the application of Hill to requested discovery constitutes one such principle of law that may be applied by a reviewing court “as a matter of law,” where there are no disputed material facts. (Williams, supra, 3 Cal.5th at p. 554, fn. 7.) Thus, because a determination of whether the superior court’s discovery order implicates constitutional privacy rights under Hill rests upon undisputed facts (see pt. III.A, ante), we review this question of constitutional law de novo. (See, e.g., Alfaro v. Superior Court (2020) 58 Cal.App.5th 371, 384 [“Although in general discovery rulings are reviewed for abuse of discretion, where, as here, ‘ “ ‘the propriety of a discovery order turns on . . . a question of law,’ we ‘determine the issue de novo’ ” ’ ”]; City of Los Angeles v. Superior Court (2017) 9 Cal.App.5th 272, 282 [when “ ‘the propriety of a discovery order turns on . . . a question of law,’ we ‘determine the issue de novo’ ”].) C. Governing law 1. Relevant principles of the law governing discovery from nonparties In Board of Registered Nursing, supra, this court recently provided an overview of the law governing discovery from nonparties: “ ‘Although the scope of civil discovery is broad, it is not limitless.’ (Calcor[, supra,] 53 Cal.App.4th [at p.] 223 . . . .) In general, ‘any party may obtain discovery regarding any matter, not privileged, that is relevant to the subject matter involved in the pending action or to the determination of any motion made in that action, if the matter either is itself admissible in evidence or appears reasonably calculated to lead to the discovery of admissible evidence.’ (Code Civ. Proc., § 2017.010.) To meet this standard, a party seeking to compel production of records from a nonparty must articulate specific facts justifying the

20 discovery sought; it may not rely on mere generalities. (Calcor, at p. 224.) In assessing the party’s proffered justification, courts must keep in mind the more limited scope of discovery available from nonparties. (See Catholic Mutual Relief Society[, supra, at p. 366, fn. 6.])” (Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1039.)

“Even if information is otherwise discoverable, it may be protected by a constitutional . . . privilege . . . [including] . . . the right to privacy . . . .” (Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1039; Williams, supra, 3 Cal.5th at p. 554 [stating that a trial court’s order denying a request for discovery may be “affirmed on privacy grounds if . . . such concerns supported denial of discovery”]; see Weil & Brown, Cal. Practice Guide: Civil Procedure Before Trial (The Rutter Group 2020) ¶ 8:293 [“Even highly relevant, nonprivileged information may be shielded from discovery if its disclosure would impair a person’s ‘inalienable right of privacy’ provided by Calif. Const. Art. 1, § 1”].) 2. The right to privacy under the California Constitution a. The state constitutional amendment adding a right of privacy “In November 1972, the voters of California specifically amended article I, section 1 of our state Constitution to include among the various ‘inalienable’ rights of ‘all people’ the right of ‘privacy.’ ” (White v. Davis (1975) 13 Cal.3d 757, 773.)15 Among the “principal ‘mischiefs’ ” that the constitutional amendment addressed was “the improper use of information properly obtained for a specific purpose, for example, the use of it for another purpose or the disclosure of it to some third party . . . .” (Id. at p. 775; see

15 “All people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy.” (Cal. Const., art I, § 1, italics added.) 21 Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1039 [“Protection of informational privacy is the provision’s central concern”]; see also Grafilo v. Wolfsohn (2019) 33 Cal.App.5th 1024, 1033–1034 (Grafilo) [“[t]he provision’s ‘central concern’ is the ‘[p]rotection of informational privacy’ [citation]; that is, the interest ‘in precluding the dissemination or misuse of sensitive and confidential information’ ”].) b. The Hill framework In Hill, the California Supreme Court “articulated a two-part inquiry for determining whether the right to privacy under article I, section 1 has been violated.” (Lewis, supra, 3 Cal.5th at p. 571, citing Hill, supra, 7 Cal.4th at p. 26.) “First, the complaining party must meet three ‘ “threshold elements” . . . utilized to screen out claims that do not involve a significant intrusion on a privacy interest protected by the state constitutional privacy provision.’ [Citation.] The party must demonstrate ‘(1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of privacy.’ [Citation.] This initial inquiry is necessary to ‘permit courts to weed out claims that involve so insignificant or de minimis an intrusion on a constitutionally protected privacy interest as not even to require an explanation or justification by the defendant.’ [Citation.]” (Lewis, supra, at p. 571.) Second, if a claimant satisfies the threshold inquiry, “ ‘[a] defendant may prevail in a state constitutional privacy case by negating any of the three elements just discussed or by pleading and proving, as an affirmative defense, that the invasion of privacy is justified because it substantively

22 furthers one or more countervailing interests.’ [Citation.]” (Lewis, supra, 3 Cal.5th at p. 572, citing Hill, supra, 7 Cal.4th at p. 40.)16 As alluded to in our discussion of the applicable standard of review (see pt. III.B, ante), “The Hill test, conceived in the context of a pleaded cause of action for invasion of privacy, has been applied more broadly, including to circumstances where litigation requires a court to reconcile asserted privacy interests with competing claims for access to third party contact information.” (Williams, supra, 3 Cal.5th at p. 552.) A reviewing court “may conduct a Hill analysis for the first time,” in a case in which “there are no disputed material facts.” (Id. at p. 554, fn. 7.) D. Application We apply the Hill framework in considering whether the superior court’s order implicates state constitutional privacy rights (Cal. Const., art. I, § 1) of the patients whose medical information would be affected by the order. 1. Petitioners have established the threshold elements of a Hill claim We first consider whether petitioners have carried their threshold burden of demonstrating that the superior court’s discovery order threatens a serious invasion of privacy.

16 If a defendant makes such a showing, “ ‘[t]he [claimant], in turn, may rebut a defendant’s assertion of countervailing interests by showing there are feasible and effective alternatives to defendant’s conduct which have a lesser impact on privacy interests.’ [Citation.]” (Lewis, supra, 3 Cal.5th at p. 572, citing Hill, supra, 7 Cal.4th at p. 40.) We need not discuss the rebuttal prong further in this case, because, for the reasons discussed in part III.D, post, we conclude that the Johnson & Johnson defendants have not identified countervailing interests that outweigh the serious invasion of privacy interests at issue in this case. 23 a. Legally protected privacy interest In considering the first of the three factors comprising the threshold inquiry, it is clear that patients “have a bona fide interest in the confidentiality of their [medical] information.” (Williams, supra, 3 Cal.5th at p. 554.) “[P]atients have a right to privacy with respect to information contained in . . . medical records. Indeed, that right is well[-]settled.” (Grafilo, supra, 33 Cal.App.5th at p. 1034, citing numerous cases].) It is a right that is protected by case law as well as state and federal statutes and regulations. (See, e.g., Civ. Code, § 56 et seq. [“This part may be cited as the Confidentiality of Medical Information Act”]; 42 U.S.C. § 1320d et seq. Health Insurance Portability and Accountability Act (HIPAA) of 1996 [providing that health care providers generally may not disclose medical information without a patient’s authorization or court order]; Citizens for Health v. Leavitt, 428 F.3d 167, 172 (3d Cir. 2005) [describing administrative privacy regulations promulgated pursuant to HIPAA].) “Medical patients’ privacy interest, our Supreme Court has observed, derives from their expectation of privacy in their physician’s files, which ‘may include descriptions of symptoms, family history, diagnoses, test results, and other intimate details concerning treatment.’ ” (Grafilo, supra, 33 Cal.App.5th at p. 1034, citing Lewis, supra, 3 Cal.5th at p. 575.) “ ‘[T]he matters disclosed to the physician arise in most sensitive areas often difficult to reveal even to the doctor. Their unauthorized disclosure can provoke more than just simple humiliation in a fragile personality. . . . The individual’s right to privacy encompasses not only the state of his mind, but also his viscera, detailed complaints of physical ills, and their emotional overtones. The state of a person’s gastro-intestinal tract is as much entitled to privacy from unauthorized public or bureaucratic snooping as is that person’s bank

24 account, the contents of his library or his membership in the NAACP.’ ” (Grafilo, supra, at p. 1034, quoting Board of Medical Quality Assurance v. Gherardini (1979) 93 Cal.App.3d 669, 679.) As one court explained in discussing the “examination of medical records within the purview of the privacy amendment”: “The information that may be recorded in a doctor’s files is broad[-]ranging. The chronology of ailments and treatment is potentially sensitive. Patients may disclose highly personal details of lifestyle and information concerning sources of stress and anxiety. These are matters of great sensitivity going to the core of the concerns for the privacy of information about an individual. The intrusion upon personal privacy when a state agency examines such records is substantial.” (Wood v. Superior Court (1985) 166 Cal.App.3d 1138, 1147 (Wood).)

Medical records pertaining to substance abuse treatment, such as those at issue in this case, are an example of such “highly personal details” (Wood, supra, 166 Cal.App.3d at p. 1147) that are entitled to even greater privacy protections under both state and federal law. (See Health & Saf., § 11845.5;17 42 U.S.C. § 290dd-2; 42 C.F.R. § 2.1 et seq.) One court

17 Health & Safety Code section 11845.5 provides: “(a) The identity and records of the identity, diagnosis, prognosis, or treatment of any patient, which identity and records are maintained in connection with the performance of any alcohol and other drug abuse treatment or prevention effort or function conducted, regulated, or directly or indirectly assisted by the department shall, except as provided in subdivision (c), be confidential and be disclosed only for the purposes and under the circumstances expressly authorized under subdivision (b). “(b) The content of any records referred to in subdivision (a) may be disclosed in accordance with the prior written consent of the client with respect to whom the record is 25 maintained, but only to the extent, under the circumstances, and for the purposes as clearly stated in the release of information signed by the client. “(c) Whether or not the client, with respect to whom any given record referred to in subdivision (a) is maintained, gives his or her written consent, the content of the record may be disclosed as follows: “(1) In communications between qualified professional persons employed by the treatment or prevention program in the provision of service. “(2) To qualified medical persons not employed by the treatment program to the extent necessary to meet a bona fide medical emergency. “(3) To qualified personnel for the purpose of conducting scientific research, management audits, financial and compliance audits, or program evaluation, but the personnel may not identify, directly or indirectly, any individual client in any report of the research, audit, or evaluation, or otherwise disclose patient identities in any manner. For purposes of this paragraph, the term ‘qualified personnel’ means persons whose training and experience are appropriate to the nature and level of work in which they are engaged, and who, when working as part of an organization, are performing that work with adequate administrative safeguards against unauthorized disclosures. “(4) If the recipient of services is a minor, ward, or conservatee, and his or her parent, guardian, or conservator designates, in writing, persons to whom his or her identity in records or information may be disclosed, except that nothing in this section shall be construed to compel a physician and surgeon, psychologist, social worker, nurse, attorney, or other professional person to reveal information that has been given to him or her in confidence by members of the client’s family. “(5) If authorized by a court of competent jurisdiction granted after application showing probable cause therefor, 26 summarized federal law pertaining to substance abuse treatment records as follows: “ ‘Federal law restricts the disclosure of information obtained “in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation or research” conducted by the United States or with federal money.’ [Citations.] The purpose of such restrictions is ‘to protect “the patient, the physician-patient relationship, and the treatment programs.” ’ [Citations.] ‘It is not only the privacy rights of individual patients that are at stake here, but also the continued effectiveness and viability of important substance abuse treatment programs.’ [Citations]; see also Whyte v. Connecticut Mut. Life Ins. Co., 818 F.2d 1005, 1010 (1st Cir. 1987) (‘[A]bsolute confidentiality is an indispensable prerequisite to successful [substance abuse] research . . . [and] treatment.’). ‘Without guarantees of confidentiality, many individuals with [substance abuse] problems would be reluctant to participate fully in [substance abuse] programs.’ [Citations.]” (United States ex rel. Gelfand v. Special Care Hosp. Mgmt. Corp. (E.D.N.Y., June 10, 2010, No. CV 02-6079 (LDW) (ETB) 2010 U.S.Dist. Lexis 57456, *8–*9.)

With respect to the subset of records that may be said to constitute

“prescription records,”18 patients “retain a reasonable expectation of privacy” in such records. (Lewis, supra, 3 Cal.5th at p. 575.) While we acknowledge that patients’ privacy interest in prescription records is “less robust than the

as provided in subdivision (c) of Section 1524 of the Penal Code.”

18 Such records include the data on “dispensed medications, along with pharmacy and prescriber identifiers,” referred to in the County of Los Angeles’s writ petition, and the “pharmacy records,” referred to in the County of Alameda’s writ petition. (See generally pts. I, II.B, ante.) 27 privacy interest associated with medical records” (ibid.; see also ibid. [“medical records contain far more sensitive information than do prescription records”]), patients nevertheless maintain a significant privacy interest in such records, particularly those for opioids, given the stigma associated with substance abuse disorders. b. Reasonable expectation of privacy We also think it clear that patients have “a reasonable expectation of privacy under the [particular] circumstances.” (Hill, supra, 7 Cal.4th at p. 50.) To begin with, patients could reasonably rely on the statutory and case law described in part III.D.1.a, ante, in expecting that their medical information would not be used to facilitate the construction of a database for

litigation purposes.19 Further, the patients whose records are being sought have not taken any litigation position that could possibly constitute a waiver of their privacy rights. (See Britt v. Superior Court (1978) 20 Cal.3d 844, 864 [“while [plaintiffs] may not withhold information which relates to any physical or mental condition which they have put in issue by bringing this lawsuit, they are entitled to retain the confidentiality of all unrelated medical . . . treatment they may have undergone in the past” (fn. omitted)].) Nor have such patients performed some other act that might indicate a willingness to have their records disclosed. (Compare with Pioneer Electronics (USA), Inc. v. Superior Court (2007) (Pioneer Electronics (USA), Inc.) 40 Cal.4th 360, 363, 372 [in consumer class action against the seller of allegedly defective products in which plaintiff sought personal identifying information of

19 With respect to the substance abuse treatment records at issue in this case, patients could have additionally reasonably relied on federally mandated notices stating that, “federal law and regulations protect the confidentiality of substance use disorder patient records.” (42 C.F.R. § 2.22.) 28 customers who had filed complaints with seller, concluding that complainants had a reduced expectation of privacy because “complainants might reasonably expect, and even hope, that their names and addresses would be given to any such class action plaintiff”].) In particular, the patients whose records were ordered disclosed are not seeking to have their interests furthered by facilitating the payment of insurance payments to their providers. Thus, we are unpersuaded by the Johnson & Johnson defendants’ argument that such patients’ privacy rights would not be invaded by the ordered production because the Confidentiality of Medical Information Act permits patients’ medical information to be “disclosed to a person or entity that provides billing, claims management, medical data processing, or other administrative services for providers of health care or health care service plans . . . .” (Civ. Code, § 56.10(c)(3).) Nor can it be said that the patients’ reasonable expectation of privacy was reduced because the Johnson & Johnson defendants are seeking to use the requested discovery to further patients’ interests generally. (Compare with Williams, supra, 3 Cal.5th at p. 554 [in considering whether plaintiff employee was entitled to disclosure of contact information of defendant employer’s other employees, stating “we doubt . . . fellow employees would expect that information to be withheld from a plaintiff seeking to prove labor law violations committed against them and to recover civil penalties on their behalf,” citing numerous cases].) Finally, we are not aware of, and the Johnson & Johnson defendants have not cited, any historical practice, social norm, cultural practice or physical setting that would reduce such patients’ expectations of privacy in the present context. (See County of Los Angeles v. Los Angeles County Employee Relations Com. (2013) 56 Cal.4th 905, 927 (County of Los Angeles)

29 [“ ‘customs, practices, and physical settings surrounding particular activities may create or inhibit reasonable expectations of privacy’ ”]; compare with Lewis, supra, 3 Cal.5th at pp. 568–569 [noting Court of Appeal’s conclusion that release of CURES prescription data to Medical Board for investigative purposes was supported by the fact that “ ‘well-known and long-established regulatory history significantly diminishes any reasonable expectation of privacy against the release of controlled substances prescription records to state, local, or federal agencies for purposes of criminal, civil, or disciplinary investigations’ ”].) c. Serious invasion of privacy In determining whether petitioners have established “ ‘a serious invasion of privacy’ ” (Lewis, supra, 3 Cal.5th at p. 571), we must ask whether the ordered disclosure is “ ‘sufficiently serious in [its] nature, scope, and actual or potential impact to constitute an egregious breach of the social norms underlying the privacy right.’ ” (County of Los Angeles, supra, 56 Cal.4th at p. 929, quoting Hill, supra, 7 Cal.4th at p. 37; see also County of Los Angeles, supra, at p. 929 [“The disclosure contemplated in this case was more than trivial. It rose to the level of a “ ‘serious’ ” invasion of privacy

under Hill”].)20 As discussed in part I, ante, as with the CURES prescription record data at issue in Board of Registered Nursing, the court’s order directed petitioners to provide the records on a personally identified basis to Rawlings so that Rawlings could deidentify the data and make it cross-referenceable against other deidentified data in the case. In Board of Registered Nursing,

20 The County of Los Angeles court considered whether the County, as an employer, was required to provide a union with the home addresses and telephone numbers of all represented employees, including those who had not joined the union. (County of Los Angeles, supra, 56 Cal.4th at p. 912.) 30 this court stated that such disclosure “implicate[s] the privacy rights of the patients.” (Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1045.) For the reasons that follow, we reach a similar conclusion with respect to the prescription records and substance abuse treatment records at issue in these writ proceedings. In considering the first of the Hill factors—the nature of the disclosure—as discussed above, the order pertains, in part, to medical records, “which may contain ‘matters of great sensitivity going to the core of the concerns for the privacy of information about an individual.’ ” (Grafilo v. Soorani (2019) 41 Cal.App.5th 497, 507.) Further, the nature of the medical records at issue in this case—treatment records for a stigmatized condition— only heightens the need for “robust protection.” (Ibid. [“The privacy interest in psychiatric records is particularly strong and, in some respects, entitled to more robust protection than other types of medical records”]; cf. Los Angeles Gay & Lesbian Center, supra, 194 Cal.App.4th at p. 308 [“unnamed plaintiffs have a reasonable expectation in the privacy of their medical records at the Center given the extremely sensitive nature of the information contained in them (sexually transmitted disease, possible HIV status, and sexual orientation)”]; compare with Pioneer Electronics (USA), Inc., supra, 40 Cal.4th at p. 372 [“the proposed disclosure was not ‘particularly sensitive,’ as it involved disclosing neither one’s personal medical history [n]or current medical condition”].) Moreover, patients were not notified of the ordered disclosure, and while petitioners have asserted the rights of such patients, no provision was made for a representative or multiple representatives of the

31 patients21 to participate in the discovery proceedings in the superior court. (See Valley Bank of Nevada v. Superior Court (1975) 15 Cal.3d 652, 657 [“The protection of [nonparty’s privacy right] should not be left entirely to the election of third persons who may have their own personal reasons for permitting or resisting disclosure of confidential information received from others”].) Further, it is also almost certain that many such patients would have strongly objected to the superior court’s disclosure order and would have desired to participate in the proceedings to protect against disclosure. (Cf. Sander v. Superior Court (2018) 26 Cal.App.5th 651, 655–657 (Sander) [in case involving whether State Bar was required to disclose “individually unidentifiable records,” (id. at p. 655, italics added) pertaining to bar applicants’ “race or ethnicity, law school, transfer status, year of law school graduation, law school and undergraduate GPA, LSAT scores, and performance on the bar examination,” (ibid.) “more than a dozen individuals,” and “two nonprofit professional associations of African American lawyers,” intervened on the side of the State Bar, in order “ ‘to protect privacy and reputational interests that are at the heart of the litigation between Petitioners and the State Bar,’ ” (id. at pp. 656–657)].) In sum, the nature of the disclosure—the production of patients’ opioid prescription treatment history and/or substance abuse treatment records, without notice to the patients—is consistent with a serious invasion of privacy interests. The scope of the disclosure ordered is also extremely broad, whether considered as applied to an individual patient or with respect to the number

21 It is not difficult to imagine that there may be many different privacy interests that patients might wish to assert, given the number of patient records implicated by the superior court’s order. 32 of records implicated by the order. As to individual patients, the documents to be produced include “encounter data” containing “diagnoses, procedures, and other clinical information.” (See pt. I, ante.) As to the number of patient records implicated by the order, the superior court ordered petitioners to disclose all of the relevant patient records. (Compare with Snibbe v. Superior Court (2014) 224 Cal.App.4th 184, 188–189 (Snibbe) [real party sought to “discover all postoperative orders signed by petitioner between June 2010 and June 2011 and by [petitioner’s assistant] between June 2009 and June 2011,” but trial court “limited the scope of discovery to 160 postoperative orders including provisions for the administration of opioids”].) As a result, the number of patient records implicated by the court’s order is staggering. For example, the County of Los Angeles states in their petition that the records include “over 1.7 million associated encounters.” (Italics altered.) The Johnson & Johnson defendants do not dispute this number or argue that the order does not require—like the production at issue in Board of Registered Nursing—a “vast production of medical information from the nonparties here.” (Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1011.) Thus, the scope of the disclosure at issue also supports the conclusion that the superior court’s order threatens a serious invasion of privacy interests. With respect to the “actual or potential impact,” (Hill, supra, 7 Cal.4th at p. 37, italics added) of the ordered production on privacy rights, we acknowledge that the trial court’s discovery order does not contemplate public disclosure of the records, or even identified disclosure to the Johnson & Johnson defendants. However, as the Supreme Court cautioned in a case involving the disclosure of prescription records, constitutional privacy concerns are not eliminated by the existence of protections against public

33 disclosure. (See Lewis, supra, 3 Cal.5th at p. 577 [“adequate protections against public disclosure do not obviate constitutional concerns as privacy interests are still implicated when the government accesses personal information without disseminating it”]; accord Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1045 [“production of patient identifying information” to defendants’ vendor for deidentification “would . . . implicate the privacy rights of the patients” (citing Lewis)].) Indeed, under the circumstances of this case, for the following reasons, we conclude that the “actual or potential,” (Hill, supra, 7 Cal.4th at p. 37) impact on patient privacy rights is substantial. With respect to “actual” impact (ibid.), as petitioners remind us throughout their briefing, the superior court’s order requires the production of fully identified data to Rawlings. Thus, it cannot be disputed that the superior court’s order will have some actual impact on patients’ privacy rights in that the court ordered the production of their highly sensitive medical records and prescription data on a fully personally identified basis to an outside entity without the notice or consent of the patients. This fact distinguishes this case from Snibbe, supra, 224 Cal.App.4th 190 and the case law on which Snibbe relied. In Snibbe, a patient died after receiving pain medication after surgery. (Id. at p. 187.) The deceased patient’s family members sued the petitioner surgeon for wrongful death. (Ibid.) The family members sought to discover postoperative orders involving other patients of the surgeon in an attempt to show that the surgeon had a practice of permitting his physician’s assistant “ ‘to rely on boilerplate drug orders for the administration of opioid pain medication.’ ” (Id. at p. 190.) The family members’ “requests allowed for the redaction of patients’ names and personal identifying information.” (Id. at p. 188.) After the surgeon objected

34 to the discovery on various grounds, the trial court granted the family members’ motion to compel in part, limiting, as mentioned above, the scope of discovery to 160 postoperative orders including provisions for the administration of opioids. (Id. at p. 189.) The surgeon petitioned for a writ of mandate to compel the trial court to vacate the discovery order for various reasons, including that the order violated his patients’ privacy rights. (Id. at p. 187.) The Snibbe court recognized the privacy rights at stake, notwithstanding the redacted nature of the records: “As it stands, the discovery order is too broad. Based on [the family members’] limited showing and the trial court’s finding of relevance only as to the opioid provisions of postoperative orders, allowing discovery of the orders in their entirety is unreasonable. It is all the more so because production of entire orders may raise legitimate concerns about the scope of intrusion into patient privacy rights . . . . ” (Snibbe, supra, 224 Cal.App.4th at p. 190.)

However, the Snibbe court concluded that patients lacked a privacy interest in the “pain management provisions of otherwise redacted postoperative orders.” (Snibbe, supra, 224 Cal.App.4th at pp. 191; see id. at pp. 194–195.) The Snibbe court reasoned in part: “[P]atients’ privacy rights are not infringed if ‘neither disclosure of the patients’ identities nor disclosure of identifying medical information was requested.’ (Board of Medical Quality Assurance v. Hazel Hawkins Memorial Hospital (1982) 135 Cal.App.3d 561, 565 [request for unnamed charts of four patients did not infringe on patients’ privacy rights] [(Board of Medical Quality Assurance)]; see Kizer v. Sulnick (1988) 202 Cal.App.3d 431, 439 [(Kizer)] [privacy rights require no more than deletion of named medical records in health study or ‘if feasible, the deletion of information which individually identifies the participants’].) The limited production of

35 redacted postoperative orders cannot be said to infringe on patients’ privacy rights any more than the production of unnamed patients’ charts.” (Id. at pp. 194–195.)22

The productions mandated by the courts in Snibbe and Board of Medical Quality Assurance pertained to records that did not contain personally identifying information. (See Snibbe, supra, 224 Cal.App.4th at p. 191; Board of Medical Quality Assurance, supra, 135 Cal.App.3d at p. 566.) In Kizer, supra, 202 Cal.App.3d at pp. 438–442, the court stated that “ ‘the record does not disclose whether the study[23] refers to individually

22 Neither petitioners nor the Johnson & Johnson defendants cited Snibbe, Board of Medical Quality Assurance, or Kizer in their briefing. Further, while the Johnson & Johnson defendants assert in their supplemental letter brief that there is a line of “unbroken case law[,] holding that production of anonymized data for purposes of litigation does not violate the right to privacy,” (italics added) they do not cite to any such cases in their supplemental letter brief. In their return, the Johnson & Johnson defendants cite Padron v. Watchtower Bible & Tract Society of New York, Inc. (2017) 16 Cal.App.5th 1246, in which this court concluded that the third-party privacy rights at issue in that case were adequately protected by the production of documents in which “personal identifying information” was redacted (id. at p. 1270) and Poway Unified School Dist. v. Superior Court (1998) 62 Cal.App.4th 1496 in which this court concluded that “privacy concerns” (id. at p. 1506) related to the disclosure of a minor’s tort claim form to a newspaper could be “address[ed],” by “redacting released materials.” (Ibid.) We disagree that these few fact-specific cases stand for the broad proposition that individuals never maintain a privacy interest in anonymized data under California law. (See fn. 25, post, and accompanying text.) However, as discussed in the text, even assuming that patients do not maintain a privacy interest in anonymized medical data, the discovery order at issue in these proceedings mandates the production of identified data to Rawlings, and thus is not governed by Snibbe or cases mandating the production of anonymized data.

23 Kizer involved a government agency’s request to obtain a “medical study of the health effects on persons living near [a waste] facility,” which 36 identifiable medical records,’ ” but “[i]f such records are part of the study, the right to privacy would justify, at most, either the deletion of any named medical records upon the remainder of the health study being produced or, if feasible, the deletion of information which individually identifies the

participants.”24 In contrast, in this case, the superior court’s order expressly mandates that petitioners “provide to Rawlings the identified data.” More generally, Snibbe, Board of Medical Quality Assurance, and Kizer do not address whether the production of vast amounts of personally identifiable medical data to a third-party vendor for deidentification purposes implicates the privacy rights of the patients whose records are to be produced. We assume, without deciding, that the Snibbe court and the cases on which it relied were correct in concluding that patients have no privacy interest in data that does not contain personally identifiable information. (See also Sander v. State Bar of California (2013) 58 Cal.4th 300, 311 [stating “If the applicant cannot be identified, disclosure of information does not

had been commissioned by a law firm representing plaintiffs in a civil action against the facility. (Kizer, supra, 202 Cal.App.3d at p. 435.)

24 Kizer, supra, 202 Cal.App.3d at p. 439 was decided before Hill and thus did not apply the Hill framework. However, to the extent that Kizer may be read as stating that the study should be produced with personally identifiable medical records to the extent that it was infeasible to delete such information, we understand the case as being premised on the conclusion that the invasion of privacy implicated by such disclosure would be outweighed by the need for a government agency to “investigate . . . possible health hazards posed by [a] waste facility.” (Kizer, supra, at p. 441.) The Kizer court did not state that the production of identified medical records would not constitute a serious invasion of privacy rights.

37 impair his or her privacy interests”].)25 We also observe that the Snibbe line of cases, as well as Sander v. State Bar of California, supra, 58 Cal.4th 300, were all decided before Lewis, and thus, those courts did not consider the Lewis court’s observation that privacy concerns are not necessarily eliminated with “adequate protections against public disclosure.” (Lewis, supra, 3 Cal.5th at p. 577; see also id. at p. 581 (conc. opn. of Liu, J.) [“The electorate was concerned about more than public disclosure when it passed the privacy initiative in 1972, which amended the Constitution. The voters were concerned that their privacy was violated whenever their personal information was used or accessed without reason”].) Irrespective of whether patients maintain privacy rights in their deidentified data, the superior court’s order mandates the production of “identified data” to Rawlings. (Italics added.) As to that data, the patients whose records are at issue clearly maintain privacy rights. (See pt. III.D.1, ante.) Moreover, petitioners’ briefing identifies at least three “potential impact[s]” (Hill, supra, 7 Cal.4th at p. 37) related to such rights that are of

25 Whether an individual may have a privacy interest in information pertaining to that individual even where that data is not linked to the individual is an important legal question on which commentators have expressed diverse views, given the many contexts in which the issue arises. (Compare, e.g., Dunkel, Medical Privacy Rights in Anonymous Data: Discussion of Rights in the United Kingdom and the United States in Light of the Source Informatics Cases (2001) 23 Loyola L.A. Internat. & Comparative L.Rev. 41, 41 [“a patient’s right to privacy is violated when personal medical information is revealed to an unauthorized third party . . . this should hold true even if such information is rendered anonymous by the removal of all data relating to the patient’s identity” (fn. omitted)] with Charkow, The Control over the De-Identification of Data (2003) 21 Cardozo Arts & Ent. L.J. 195, 197 [“the informational privacy interest for a data subject should extend only to the use and sharing of personally identifiable information with unauthorized persons” (fn. omitted)].)

38 significance. First, there is the potential for a data breach, whether inadvertent or malicious, that might reveal identified patient data.26 Even assuming that this risk is small, given the extremely sensitive nature of the data at issue in this case, it is a risk that must be considered in determining whether petitioners have demonstrated a “potential impact” on privacy rights. (Ibid.) Second, petitioners argue that “mass disclosure to an out-of-state data miner would surely discourage meaningful treatment and impair trust between [p]etitioners and their current, former, and future patients.” We agree that there is, at a minimum, a potential that some persons might be discouraged from seeking or continuing with treatment if they were to become aware of the discovery order in this case, given the highly sensitive

nature of the data.27 Finally, and as emphasized by petitioners in reply,28 there maintains the potential of “re-identification,” or the possibility that someone could “ ‘use reasonable effort to match the person’s identity to details in the released dataset sufficient to know enough information about the person to identify him or her as a specific person.’ ” (Sander, supra, 26 Cal.App.5th at p. 658

26 The County of Los Angeles argued in its writ petition, “And if the database that Defendants create is ordered to be produced in other cases, unforeseen breaches are not out of the question.”

27 That potential was lessened by the protections fashioned by the superior court to attempt to prevent public disclosure of identifiable patient data.

28 The County of Los Angeles did reference this issue in its writ petition, arguing, “One potential misuse of the database that Defendants seek to create is the real possibility that it will include enough data points to allow re-identification of the patients that Rawlings has purported to anonymize.” 39 [quoting a data privacy expert].) While the superior court’s discovery order mandates that Rawlings “de-identify” the data, the possibility that deidentified data may be reidentified when such data is made cross- referenceable with other data sets is well documented. (See, e.g., id. at p. 659 [summarizing expert testimony to the effect that “[d]ata analytic companies that deal in data compilations and derivations to link disparate datasets are also becoming increasingly able to re-identify data historically regarded as anonymous”]; Brasher, Addressing the Failure of Anonymization: Guidance from the European Union’s General Data Protection Regulation (2018) 2018 Colum. Bus. L.Rev. 209, 211 [“In practice . . . anonymization fails to permanently obstruct the identities of data subjects due to the potential for deanonymization—the linking of anonymized data to ‘auxiliary’ information to re-identify data subjects”]; Ohm, Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization (2010) 57 UCLA L.Rev. 1701, 1742 [stating that “we must abandon the pervasively held idea that we can protect privacy by simply removing personally identifiable information,” as a “discredited approach”].) As one commentator noted in discussing the “well-documented failures of anonymization”: “Historically, the way to share private information without betraying privacy was through anonymization, stripping away all identifiers that could potentially uniquely identify an individual or group of individuals. Anonymization, however, proved to be anything but a ‘silver bullet.’ ” (Bellovin et. al., Privacy and Synthetic Datasets (2019) 22 Stan. Tech. L.Rev. 3–4 (Bellovin).)

Bellovin argues that various high-profile reidentification incidents suggest that it is often possible with “even novice computer aptitude to ‘join’

40 auxiliary information with a series of ‘perturbed’[29] data points and unveil the very data that anonymization was designed to protect.” (Bellovin, supra, at 4.) Commentators have suggested various “[r]isk [f]actors,” to consider in assessing the risk of reidentification, including the “[v]olume of [d]ata,” because “large data sets have a high degree of unicity, which makes it easier to launch reidentification attacks.” (Rubinstein & Hartzog, Anonymization and Risk (2016) 91 Wash. L. Rev. 703, 741.) The Johnson & Johnson defendants both acknowledge that Rawlings has “previously anonymized over a dozen other databases containing tens of millions of records from government agencies, private insurers, and the People in this case,” and seek to make petitioners’ own massive datasets cross-referenceable with these “multiple datasets.” Another risk factor for reidentification is the “[s]ensitivity of the [d]ata,” because “[s]ome information, like health . . . information, is more sensitive and thus more likely to be targeted by attackers,” (ibid.). As discussed throughout this opinion, the disclosure ordered in this case involves extremely sensitive medical and substance abuse treatment information. Finally, and critically, while the discovery order directs Rawlings to “de-identify” the data, it contains no protocols or requirements as to how such deidentification must be carried out. (Compare with Sander, supra, 26 Cal.App.5th at p. 658 [noting that “[a] primary issue [at trial] was whether the four different protocols proposed by Petitioners to de-identify or ‘anonymize’ the data were sufficient to prevent matching a record in the

29 “ ‘Perturbed’ here refers to the traditional, remove-name-and-zip-code styled sanitization techniques which often fail to exclude information which may be linked together to reidentify individuals.” (Id. at p. 4, fn. 9.) 41 supposedly anonymous data to either an individual or a small group of individuals”]; see also id. at pp. 659–663 [describing four different complex deidentification protocols and noting “[p]rotocols 2 and 4 employ variations of a concept known as ‘k-anonymity,’ ” in which “ ‘[t]he proper size of k (i.e. how much anonymity to provide) is a policy question depending on the sensitivity of the data and how ambiguous an identification is considered permissible’ ”].) Given the massive size of the ordered production, the multiple datasets, and the high sensitivity of the materials to be produced, the risks associated with an order to provide identified data to a third-party vendor with vague directions to “de-identify” such data, without any specification as to how such deidentification must occur, presents a clear potential threat to patient privacy. d. Petitioners met their threshold burden to establish a serious invasion of privacy interests

In sum, given the nature, scope and the actual and potential impact on patient privacy, we conclude that petitioners have carried their threshold burden of demonstrating that the superior court’s discovery order threatens a serious invasion of privacy. 2. The Johnson & Johnson defendants have not identified interests in favor of disclosure that outweigh the serious invasion of privacy that such disclosure would entail

We next must consider whether the Johnson & Johnson defendants have identified interests in favor of disclosure that outweigh the serious invasion of privacy described in part III.D.1, ante. (See Williams, supra, 3 Cal.5th at p. 557 [describing the shifting burdens in applying the Hill framework]; Tom v. City and County of San Francisco (2004) 120 Cal.App.4th 674, 686 [“Because we conclude that respondents carried their burden of demonstrating a serious invasion of their reasonable privacy interests, the

42 burden shifted to the City to show ‘that the invasion of privacy is justified because it substantively furthers one or more countervailing interests’ ”].) In conducting such inquiry, we may consider “the interest of the requesting party, fairness to litigants in conducting the litigation, and the consequences of granting or restricting access to the information.” (Los Angeles Gay & Lesbian Center, supra, 194 Cal.App.4th at p. 307, citing Hill, supra, 7 Cal.4th at p. 37.) In considering the interests of the requesting party, we observe that the Board of Registered Nursing court noted that defendants contended that the CURES prescription data sought in that case was “relevant and discoverable,” because it would demonstrate “whether defendants’ drugs were associated with opioid abuse and overdoses,” and “whether patients were engaged in illicit activities or whether they obtained prescriptions from unauthorized prescribers.” (Board of Registered Nursing, supra, 59 Cal.App.5th at pp. 1045–1046.) The Board of Registered Nursing court concluded that such interests were insufficient to justify the discovery of the CURES prescription records —even when considering the broad scope of discovery allowed from nonparties generally. (Id. at p. 1046, citing Calcor, supra, 53 Cal.App.4th at p. 224.) In this case, the Johnson & Johnson defendants seek to obtain opioid prescription data similar to the CURES data at issue in Board of Registered Nursing as well as substance abuse treatment records that threaten an even more substantial invasion of privacy rights (see Lewis, supra, 3 Cal.5th at p. 575, see also ibid. [“medical records contain far more sensitive information than do prescription records”]).30 And, like the defendants in Board of

30 In their supplemental letter brief concerning Board of Registered Nursing, the Johnson & Johnson defendants do not argue that the 43 Registered Nursing, the Johnson & Johnson defendants argue that such data is necessary to determine “any ‘causal chain’ (or lack thereof) between Defendants’ conduct and any alleged “adverse consequences” as alleged by the People.” More specifically, as in Board of Registered Nursing, the Johnson & Johnson defendants maintain that the discovery is relevant to their contention “that any increase in opioid misuse, abuse, and overdose was a function of illegal prescribing and dispensing, widespread criminal diversion, and illicit drug trafficking.” Indeed, in the section of their return arguing that the superior court’s order comports with Hill, the only legal argument as to the relevance of the petitioners’ prescription and substance treatment data that the Johnson & Johnson defendants advance is the superior court’s relevance finding as to the discoverability of the state agency’s CURES data that this court reversed in Board of Registered

Nursing.31 Given that the Board of Registered Nursing court concluded that such interests were insufficient to justify disclosure under the broad Calcor discovery standard (Board of Registered Nursing, supra, 59 Cal.App.5th 1011), we think it necessarily follows that such interests are not sufficient to justify disclosure in light of the serious potential invasion of privacy rights that exists in this case. This conclusion is strengthened by the Johnson & Johnson defendants’ failure to provide any discussion of the elements of

prescription data differs from the CURES data at issue in Board of Registered Nursing, nor do they dispute that the discovery of substance abuse treatment records poses even greater privacy concerns.

31 While the Johnson & Johnson defendants provide additional details as to these arguments in their supplemental letter brief, the underlying theory of discoverability, which the Board of Registered Nursing court rejected, remains the same. 44 plaintiffs’ causes of action or any case law bearing on such causes of action to attempt to demonstrate a theory of discoverability of the sensitive medical information at issue in these writ proceedings. Simply put, the Johnson & Johnson defendants fail to provide any “cogent legal argument” (Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1041) as to how the discovery that they seek would be admissible or lead to the discovery of admissible evidence. This omission is particularly striking given that, in their reply, petitioners noted that the Johnson & Johnson defendants failed to provide any argument as to how the requested discovery “could be used to defend against causes of action that do not require a link between an individual harm and their particular product,” (italics omitted) and the Board of Registered Nursing court rejected the superior court’s finding of relevance on

which the Johnson & Johnson defendants relied in their return.32 Yet, as with their return, the Johnson & Johnson defendants’ supplemental brief

32 Instead, and straining credulity, the Johnson & Johnson defendants argue in their supplemental brief that the Board of Registered Nursing opinion has “no bearing” on our consideration of the writ petitions in this case, because, according to the Johnson & Johnson defendants, “the decision in Board of Registered Nursing turned chiefly on relevance and burden concerns that are not at issue in this case . . . .” “[R]elevance and burden concerns,” are clearly factors that not only may, but must be considered in determining whether a defendant has demonstrated that “the interest of the requesting party, fairness to litigants in conducing the litigation, and the consequences of granting or restricting access to the information” outweigh the privacy interests at stake in a case. (Los Angeles Gay & Lesbian Center, supra, 194 Cal.App.4th at p. 307.) Indeed, the Johnson & Johnson defendants argued in their return that they had carried their Hill burden by quoting the superior court’s determination that the discovery of CURES data was “relevant” in the proceedings that led to Board of Registered Nursing.

45 concerning Board of Registered Nursing fails to provide any discussion of the causes of action against which they are defending, a fact that supports the conclusion that the Johnson & Johnson defendants have failed to identify countervailing interests supporting the discovery order that outweigh the privacy interests at stake.33 In short, much like the general references to “ ‘measur[ing] trends and test[ing] causal relationships’ ” (Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1046) that the Board of Registered Nursing court concluded was insufficient to justify the discovery at issue in that case, we conclude that the Johnson & Johnson defendants’ vague arguments that the data sought from petitioners goes “to the heart of the People’s causation theories,” and “apportionment in the event the Superior Court finds liability,” are “insufficient to justify such a vast production of medical information from the nonparties” (ibid.), particularly in light of the serious competing privacy interests at stake. The Johnson & Johnson defendants also have not made any persuasive argument that fairness to the litigants in conducing the litigation outweighs the privacy interests at stake. (Los Angeles Gay & Lesbian Center, supra, 194 Cal.App.4th at p. 307.) To begin with, the Johnson & Johnson defendants do not argue that they bear the burden of proof with respect to either causation or damages, the two general areas for which the Johnson &

33 In their supplemental brief, the Johnson & Johnson defendants argue that “[i]f this Court is inclined to consider relevance or burden arguments raised for the first time in Petitioners’ Reply, [the Johnson & Johnson defendants] request leave to expand the record to include additional evidence supporting these newly raised theories, which they would have done in connection with their Return had the relevance arguments been raised at any time below or in the Petitions.” We do not consider “relevance or burden arguments” outside the context of petitioners’ Hill argument, which was clearly and distinctly raised in their writ petitions. Accordingly, we decline the Johnson & Johnson defendants’ request to “expand the record.” 46 Johnson defendants have argued that the requested discovery is relevant. Further, the Johnson & Johnson defendants do not make any argument that plaintiffs have sought to discover the prescription records and substance abuse treatment records at issue in these writ proceedings. Thus, the Johnson & Johnson defendants have not shown that they are being deprived of any discovery on which plaintiffs may rely in proving their case, nor have they demonstrated that any other fairness concerns mandate disclosure. The Johnson & Johnson defendants also have not demonstrated that the consequences of granting or restricting access to the information support disclosure. (Los Angeles Gay & Lesbian Center, supra, 194 Cal.App.4th at p. 307.) To begin with, while the Johnson & Johnson defendants vaguely refer to the need to cross-reference “multiple datasets,” they provide but one example of such cross-referencing in their return.34 (Italics added.) Given the highly sensitive nature of the data requested, a far more detailed showing is required as to the precise nature of the datasets to which the discovery in this case would be linked and exactly how such data would be cross- referenced. Relatedly, the Johnson & Johnson defendants do not discuss in any detail the other discovery that has been produced in this case in attempting to explain their need for the specific discovery at issue in these writ proceedings. The Board of Registered Nursing court noted the lack of any such showing in that case: “[Defendants fail to] persuasively explain why such a large amount of personal and private data, on millions of Californians, is necessary in light of the extensive

34 The one example provided is the Johnson & Johnson defendants’ statement that “[p]etitioners’ claims data can be cross-referenced with already provided statewide mortality data to illustrate whether, and the extent to which, any harms befell County-specific and California patients.” 47 information already available to them. For example, defendants admit they have ‘insurance claims data and hospital claims data’ from the plaintiff jurisdictions and other private entities, as well as comprehensive mortality data from the California Department of Health. The department already releases data on opioid-related deaths, emergency room visits, hospitalizations, and county-level prescriptions. The [Department of Justice] releases aggregate statistics from the CURES database across numerous dimensions.” (Board of Registered Nursing, supra, 59 Cal.App.5th at p. 1046.)

Similarly, in these writ proceedings, the Johnson & Johnson defendants acknowledge having access to multiple datasets in preparing their defense and fail to demonstrate why the discovery they seek from petitioners is critical in defending against plaintiffs’ claims. 3. After applying the Hill framework, we conclude that the superior court erred in granting the Johnson & Johnson defendants’ motions to compel

Petitioners have established a legally protected privacy interest, an objectively reasonable expectation of privacy in the given circumstances, and a threatened intrusion that is serious. The Johnson & Johnson defendants have not established countervailing interests that outweigh this serious potential invasion of privacy rights. Accordingly, we conclude that the superior court erred in granting the Johnson & Johnson defendants’ motions to compel.

IV.

DISPOSITION

The Johnson & Johnson defendants’ demurrer to the petitions is overruled. The petitions are granted. Let a peremptory writ of mandate issue directing the superior court to vacate its order compelling production of documents from petitioners County of Los Angeles and County of Alameda

48 and enter a new order denying the Johnson & Johnson defendants’ motions to compel. Petitioners shall recover their costs in this original proceeding. (Cal. Rules of Court, rule 8.493(a)(2).)

AARON, J.

WE CONCUR:

BENKE, Acting P. J.

IRION, J.

49