State of California Department of Justice
Rob Bonta
Attorney General
Attorney General
Assembly Bill (AB) 82 (Ward, Chapter 679, Statutes of 2025), signed into law on October 13, 2025, directly impacts dispensers who report specified medications to the Controlled Substance Utilization Review and Evaluation System (CURES), maintained by the California Department of Justice (DOJ). The dispensing of testosterone or mifepristone shall not be reported to DOJ, CURES, or its contracted prescription data processing vendor. For more information, please review the CURES AB 82 Bulletin.
CURES (Controlled Substance Utilization Review and Evaluation System) is a database of Schedule II, Schedule III, Schedule IV and Schedule V controlled substance prescriptions dispensed in California serving the public health, regulatory oversight agencies, and law enforcement. CURES is committed to the reduction of prescription drug abuse and diversion without affecting legitimate medical practice or patient care.
The operation of CURES complies with all applicable federal and state privacy and security laws and regulations. The controlled substances dispensation history of an individual that is received by a practitioner or pharmacist from CURES is subject to the Confidentiality of Medical Information Act and the Health Insurance Portability and Accountability Act of 1996 (HIPAA), including the HIPAA regulations in 45 Code of Federal Regulations parts 160 and 164.
Access to CURES is strictly limited. Licensed health care practitioners and licensed pharmacists may access information in CURES only for patients under their care. Regulatory agency officials and law enforcement officials may access information in CURES only to assist the efforts of their agencies to control the diversion and resultant abuse of controlled substances.
California law (Health and Safety Code Section 11165.1) requires all California licensed health care practitioners authorized to prescribe Schedule II, Schedule III, Schedule IV and Schedule V controlled substances to register for access to CURES upon issuance of a Drug Enforcement Administration Controlled Substance Registration Certificate. California licensed pharmacists must register for access to CURES upon issuance of a Board of Pharmacy Pharmacist License.
Prescriber and Pharmacist registration to access CURES is simple and fully automated. Prescribers and Pharmacists can register by accessing the CURES User Registration.
Section 11165.4 of the Health and Safety Code, sets forth the requirements for mandatory consultation of CURES. Please refer to your respective state licensing board for additional information regarding the CURES consultation requirement.
Step-by-step instructional videos for the Patient Activity Report (PAR) and Password Reset processes can be found on the Training and Publications page.
The optimized CURES includes expanded Delegate functionality, which allows Delegates to directly access data in CURES.
The Department of Justice (DOJ) has created a Quick Reference Guide that details how to establish and activate a Delegate in the optimized CURES, along with questions and answers. For detailed information view the Quick Reference Guide.
DOJ has also created two sample Delegate Agreements. The first sample Delegate Agreement demonstrates an agreement between one Authorizing User and one Delegate. The second sample Delegate Agreement demonstrates an agreement between one Authorizing User and multiple Delegates.
Detailed information concerning Delegate eligibility and Delegate Agreement requirements are described in DOJ’s October 14, 2022, bulletin entitled, New Features and Requirements for Expanded Delegate Access.
California dispensers are required to report dispensations to the Department of Justice (DOJ) or DOJ’s contracted prescription data processing vendor not more than one working day after the date a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance, as defined in the controlled substances schedules in federal law and regulations, is released to the patient, if reporting under California Health and Safety Code (HSC) section 11165(d). Additionally, California HSC section 11165(i) states veterinarians shall report dispensation information as soon as reasonably possible, but not more than seven days after the date a controlled substance is dispensed.
Furthermore, prescribers dispensing controlled substances Schedule II, Schedule III, and Schedule IV, as defined in California Health & Safety Code section 11007, pursuant to California Business and Professions Code section 4170 shall report to DOJ the information required by California HSC 11190(c) on a weekly basis.
All reporting must be made through the PMP Clearinghouse. If you do not currently have an account with PMP Clearinghouse, you can register using the Create an Account link provided at: PMP Clearinghouse.
The Data Submission Guide for Dispensers (ASAP version 4.2B) can be found on your PMP Clearinghouse account. The following article provides more information on how to locate the Dispenser Guide: Where are Dispenser Guides Located?
Questions regarding the Data Submission Guide for Dispensers may be directed to Bamboo by phone at (855) 502-0999 or by submitting a ticket online through the below link: PMP Clearinghouse Zendesk
Currently, the only accepted format for data submission is ASAP version 4.2B. Data submissions that do not conform to the requirements of ASAP version 4.2B will be rejected by Bamboo Health. Detailed information about the reporting changes between ASAP versions 4.1 and 4.2B is available here: Description of ASAP version 4.2B Changes. A list of Frequently Asked Questions (FAQs) is available here: ASAP version 4.2B FAQs.
For information on how to submit controlled substance prescription data or data corrections, pharmacies and direct dispensers may contact Bamboo Health at (855) 502-0999 or visit the Bamboo Health PMP Clearinghouse Support Center website at: PMP Clearinghouse Zendesk.
In accordance with California Health & Safety Code section 11165(c)(2)(A) the California Department of Justice (CA DOJ) may provide CURES data to public or private entities, as approved by the CA DOJ, for educational, peer review, statistical, or research purposes, provided that the patient information, including any information that may identify the patient, is not compromised.
To request CURES data for any of the above listed purposes, or for additional information about the data request process, you can go to the Research Center “Data Request Process” website at https://oag.ca.gov/research-center/request-process.
California law requires that any written prescription for a Schedule II, Schedule III, Schedule IV, and Schedule V controlled substance be issued on a tamper-resistant prescription form ordered from a state-approved security printer. To order tamper-resistant prescription forms, please refer to the Approved List of Security Prescription Printers for vendors authorized by the California Department of Justice and the vendor’s contact information.
Reports of lost or stolen prescription forms or pads should be reported to local law enforcement and must be reported to CURES. Prescribers can electronically report their lost or stolen prescription forms or pads online when logged into their CURES account and should include the law enforcement agency report number when submitting a report of lost or stolen prescription forms to CURES.
For questions concerning how to report lost or stolen prescription pads or forms, please contact the Security Prescription Printer Program at SecurityPrinter@doj.ca.gov.