The CURES database in California, formally the Controlled Substance Utilization Review and Evaluation System, is a statewide prescription drug monitoring program run by the California Department of Justice that records every Schedule II through Schedule V controlled substance dispensed in the state. Pharmacists, physicians, licensing boards, and law enforcement can look into it under specific rules, and you can request a copy of your own record.
What CURES Tracks
CURES collects dispensing data on controlled substances across four federal scheduling categories: Schedule II, Schedule III, Schedule IV, and Schedule V.1California Legislative Information. California Code HSC 11165 That covers a wide range of medications. Schedule II includes high-potency drugs like oxycodone, fentanyl, and stimulants used for attention deficit disorders. Schedule III and IV include medications like codeine combination products, anabolic steroids, and benzodiazepines such as alprazolam. Schedule V covers lower-risk preparations like certain cough suppressants containing small amounts of codeine.
California’s inclusion of Schedule V is broader than many state monitoring programs. Gabapentin, which the state reclassified as a Schedule V controlled substance, also generates a CURES entry each time it is dispensed.
Testosterone and Mifepristone No Longer Reported
Assembly Bill 82, signed into law on October 13, 2025, created an exemption that took effect January 1, 2026. Pharmacies and dispensers must no longer report prescriptions for testosterone or mifepristone to CURES, and the Department of Justice must remove any existing testosterone or mifepristone records already in the database by January 1, 2027.2California Department of Justice – Office of the Attorney General. AB 82 Update on Reporting of Testosterone and Mifepristone If a pharmacy accidentally submits one of these prescriptions after the effective date, the DOJ will attempt to intercept it, but compliance remains the dispenser’s responsibility.
What Information Is in Your Record
Every time a pharmacy, clinic, or other dispenser releases a monitored controlled substance to a patient, it must electronically send a detailed record to the Department of Justice no later than one working day after the medication is handed over.1California Legislative Information. California Code HSC 11165
Each entry includes your full legal name, date of birth, and residential address so the system can match records to the right person. The National Drug Code identifies the specific product and manufacturer. Other fields record the quantity dispensed, dosage strength, days’ supply, the pharmacy’s information, the dispensing practitioner’s identification, and the prescribing physician’s DEA registration number.3California Department of Justice – Office of the Attorney General. Controlled Substance Utilization Review and Evaluation System Technological failures, power outages, and natural or manmade disasters extend the one-day reporting deadline until normal operations resume.1California Legislative Information. California Code HSC 11165
Who Can See Your CURES Record
Access is limited by statute to specific groups with a legitimate reason to look.4California Legislative Information. California Code HSC 11165.1
Prescribers and pharmacists caring for you can pull your record to review your controlled substance history before writing or filling a prescription. State professional licensing boards can review a practitioner’s prescribing data when investigating whether a licensee is prescribing inappropriately or failing to meet standard care requirements. Law enforcement agencies can request specific records when the information is relevant to an active criminal investigation. The Department of Justice may also refer a patient’s controlled substance history to that patient’s healthcare providers when its own data suggests a pattern of inappropriate use.5State of California Department of Justice – Office of the Attorney General. California Health and Safety Code 11165.1
Prescribers and pharmacists do not have to run every query themselves. They may designate delegates to search the database on their behalf under an active delegation agreement, and the authorizing provider remains responsible for everything the delegate does. The patient whose record is being searched must still be under that provider’s care.6Cornell Law Institute. California Code of Regulations Title 11 Section 824.6
California shares CURES data with monitoring programs in other states through interstate data sharing hubs. An out-of-state user can request California prescription data through their own state’s program, provided that program has signed a memorandum of understanding with the California Department of Justice.7Cornell Law Institute. California Code of Regulations Title 11 Section 825.1
When Your Provider Is Required to Check It
If a pharmacist or physician pulls up your record, it is usually because state law requires them to. Registered providers must consult CURES before prescribing a controlled substance to a patient for the first time, within 24 hours or the previous business day before writing any later prescription, and at least once every six months while a controlled substance remains part of ongoing treatment.8Medical Board of California. Mandatory Use – CURES
The law also recognizes situations where stopping to check the database is impractical. A provider does not need to consult CURES while you are admitted to a licensed clinic, outpatient setting, health facility, or county medical facility, or during an emergency transfer. The requirement also does not apply when prescribing in a hospital emergency department if the supply does not exceed a non-refillable seven-day course, when prescribing as part of a surgical procedure at a licensed facility for a non-refillable five-day supply, or when you are receiving hospice care. If the system is down or no one with access is reasonably available, a provider may prescribe up to a non-refillable five-day supply and must document the reason in your medical record.8Medical Board of California. Mandatory Use – CURES
A provider who skips the required check faces referral to their professional licensing board for administrative sanctions. The statute does not create a private right for patients to sue over a missed check, though it does not shield a provider from ordinary malpractice liability for negligent prescribing.9California Legislative Information. California Code HSC 11165.4
Privacy Protections and Penalties for Misuse
CURES data is confidential health information. Anyone who accesses or discloses a patient’s information from the database without authorization faces criminal penalties under California law. Unauthorized disclosure is a misdemeanor that can carry up to one year in county jail along with civil penalties. These protections sit alongside federal HIPAA requirements that govern patient data more broadly.
Subscribers must notify the Department of Justice within 30 days of any change to their account, and the department monitors for access patterns that suggest misuse.4California Legislative Information. California Code HSC 11165.1 The DOJ may deny or suspend a provider’s access for reasons including falsifying the application, failing to maintain effective access controls, having a DEA registration suspended, or using patient information for any purpose other than diagnosis, treatment, or documenting legal compliance.
How to Request Your Own Prescription History
You have the right to see what CURES has on file about you. The request goes in on Form BCIA 8735, the Request for CURES Individual Prescription History Report, available on the California Department of Justice website. The form asks for your full legal name, Social Security Number, and the date range you want covered.
Attach a clear photocopy of a valid government-issued photo ID, such as a California driver’s license or passport. Sign the form in front of a notary public. California’s Government Code Section 8211 caps the notary fee at $15 per signature, paid directly to the notary and separate from any DOJ processing fees.10California Legislative Information. California Government Code 8211
Mail the completed form and ID copy to the Department of Justice for manual verification. Processing typically takes several weeks depending on application volume. The DOJ sends the report by mail to the address on your application, and it will contain every monitored substance dispensed to you during the dates you requested. Pulling your own report periodically is worth doing if you have been treated by multiple providers or pharmacies, since matching errors do happen.
Correcting an Error in Your Record
If you spot an error, federal law gives you the right to request an amendment. Under HIPAA, a covered entity such as a pharmacy must act on your amendment request within 60 days. The entity can extend the deadline once by up to 30 days, but must explain the delay to you in writing.11eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
If the pharmacy grants the amendment, it must update the record and make reasonable efforts to notify anyone who received the original information and might still rely on it. If the request is denied, you must get a written explanation of the reason, instructions for filing a statement of disagreement, and information on how to complain to the entity or to the Secretary of Health and Human Services.11eCFR. 45 CFR 164.526 – Amendment of Protected Health Information