Current through Register No. 13, March 27, 2025
(a) An ATC shall implement security measures
to deter and prevent unauthorized entrance into areas containing cannabis or
CIP and to prevent diversion, loss, and theft of cannabis or CIP at the ATC or
during transport of cannabis or CIP.
(b) Security measures to protect the
registered premises, registered qualifying patients, designated caregivers, and
agents of the ATC shall include but are not limited to the following:
(1) The ATC shall limit access to the
registered premises as described in (c) and (g) below;
(2) The ATC shall establish limited access
areas accessible only to specifically authorized personnel, and only the number
of employees or ATC agents essential for efficient operation;
(3) The ATC shall dispose of all cannabis
waste including unused portions of the plant, contaminated cannabis product,
and excess cannabis in accordance with
He-C
402.22;
(4) The ATC shall store all finished cannabis
in a secure, locked safe, vault, or storage unit in such a manner as to prevent
diversion, theft, and loss;
(5) The
ATC shall keep all safes, vaults, storage units, and any other equipment or
areas used for the production, cultivation, harvesting, processing, or storage
of cannabis and CIP securely locked and protected from entry, except for the
actual time required to remove or replace cannabis;
(6) The ATC shall keep all locks and security
equipment in good working order;
(7) Keys, and other access devices, as
applicable, shall not be left in the locks, or stored or placed in a location
accessible to persons other than specifically authorized personnel;
(8) The ATC shall prohibit accessibility of
security measures, such as combination numbers, passwords, or electronic or
biometric security systems, to persons other than specifically authorized
personnel;
(9) The outside
perimeter of the ATC shall be sufficiently lit to facilitate
surveillance;
(10) The ATC shall
ensure that trees, bushes, and other foliage outside of the registered premises
do not allow for a person or persons to conceal themselves from
sight;
(11) The ATC shall develop
emergency policies and procedures for securing all product following any
instance of diversion, theft, o r loss of cannabis or CIP, and conduct an
assessment to determine whether additional safeguards are necessary;
and
(12) The ATC shall develop
additional safeguards as directed by the department for registered premises or
areas of operations that present security concerns.
(c) An ATC shall not permit any person to
enter the ATC unless:
(1) Such person is an
ATC employee, is on duty, and is visibly displaying his or her badge;
(2) Such person is an ATC volunteer, is on
duty, and is visibly displaying his or her badge;
(3) Such person is an ATC agent, not
including those in (1) and (2) above, such as a board member or corporate
officer, who is logged in, escorted, and is displaying a visitor badge, in
accordance with (e) (3) and (f) below;
(4) Such person is a qualifying patient or
designated caregiver possessing a registry identification card issued by the
department pursuant to He-C 401 and whose access shall be limited to the
dispensing are a of the ATC;
(5)
Such person is accompanying a qualifying patient while in the dispensing area
of the ATC, and who:
a. Shall not be required
to be a qualifying patient or a designated caregiver;
c. Shall be required to comply with (e) (3)
below, except that the person does not need an individual escort, and (f)
below;
d. Shall be subject to the
ATC's policy on such visitors, including a policy that may prohibit or
otherwise limit such visitors from accessing the ATC; and
e. Shall be the only visitor accompanying the
qualifying patient at any one time;
(6) Such person is an outside vendor or
contractor whose responsibilities require access to the ATC and then only to
the specific areas necessary and for only as long as necessary to perform the
person's job duties. For the purposes of this rule, an outside vendor or
contractor means an individual who requires temporary access to the registered
premises for a specific purpose, such as to perform construction or
maintenance, to conduct system repairs or inspection, or to perform employee
training;
(7) Such person is
authorized by law, rule, or in writing by the commissioner to be in the
registered premises;
(8) Such
person(s) are emergency responders in the course of responding to an emergency
and the ATC documents the names, times, and dates of each responder at the time
of the incident or as soon as is practicable after the emergency, as required
by the incident report in
He-C 402.10(n)
; or
(9) Such person is a prospective ATC employee
or volunteer and the reason for entry to the ATC is for interviewing
purposes.
(d) The
requirements of (c) above shall not be construed to prohibit access to
authorized law enforcement personnel or local officials acting within their
lawful jurisdiction. For the purpose of this rule, "jurisdiction" means general
authority and is not limited to only geographic area.
(e) The ATC shall document:
(1) The dates and times that all agents are
either in the registered premises or offsite transporting cannabis or
CIP;
(2) The registry
identification numbers, dates, and times that all registered qualifying
patients and designated caregivers are in the registered premises for either
education or purchase of cannabis or CIP;
(3) Access to the registered premises by
persons authorized by (c) (2), (3) and (5) -(9), or (d) above, including the
name, signature, date, time in and out, purpose of the visit, to include
sufficient information to demonstrate compliance with (c) or (d) above, and the
name of the employee providing escort;
(4) The signature and employee escort
requirements in (3) above shall not apply for emergency responders in the event
of a reportable incident; and
(5)
The employee escort requirement in (3) above shall not apply for visitors
described in (c) (5) above.
(f) For all authorized persons who do not
have either a registry identification card issued by the department or an
employee or volunteer identification badge issued by the ATC, except for
emergency responders in the event of a reportable incident, the ATC shall:
(1) Issue a temporary visitor's badge that
shall be worn for the duration of the visit to the ATC and returned prior to
exit; and
(2) Provide an ATC
employee who shall escort the authorized person(s) at all times while they are
in the limited access areas of the registered premises, except that this shall
not apply to visitors described in (c) (5) above.
(g) The limited access areas described in (b)
(2) above shall be identified by the posting of a sign that shall be a minimum
of 12" X 12" and which states: "Do Not Enter - Limited Access Area - Access
Limited to Authorized Personnel Only" in lettering no smaller than one inch in
height.
(h) An ATC shall have a
security system designed to prevent and detect diversion, theft, or loss of
cannabis an d unauthorized intrusion, which shall, at a minimum, include:
(1) A perimeter alarm on all entry points and
perimeter windows;
(2) A failure
notification system that provides an audible, text, or visual notification of
any failure in the surveillance system which alerts designated employees of the
ATC within 5 minutes after the failure, either by telephone, email, or text
message;
(3) A duress alarm, panic
alarm, and holdup alarm connected to local public safety or law enforcement
authorities or to an alarm monitoring company;
(4) Video cameras in all areas that may
contain cannabis, at all points of entry and exit, on the entrance to the video
surveillance room, and in any parking lot, which shall be appropriate for the
normal lighting conditions of the area under surveillance. The cameras shall be
directed at all safes, vaults, sales areas, and areas where cannabis is
cultivated, harvested, processed, prepared, stored, handled, or dispensed.
Cameras shall be angled so as to allow for the capture of clear and certain
identification of any person entering or exiting the ATC or area;
(5) 24-hour recordings from all video cameras
that are available for immediate viewing by the department upon request and
that are retained for at least 90 calendar days. Recordings shall not be
destroyed or altered, and shall be retained as long as necessary if the ATC is
made aware of a pending criminal, civil, or administrative investigation, or
legal proceeding for which the recording might contain relevant
information;
(6) The ability to
immediately produce a clear, color, still photo either live or from a
recording;
(7) A date and time
stamp embedded on all recordings which shall be synchronized, set correctly,
and shall not obscure the picture;
(8) A video recording that allows for the
exporting of still images in an industry standard image format, including .jpg,
.bmp, and .gif. Exported video shall have the ability to be archived in a
proprietary format that ensures authentication of the video and guarantees that
no alteration of the recorded image has taken place. Exported video shall also
have the ability to be saved in an industry standard file format that can be
played on a standard computer operating system. All recordings shall be erased
or destroyed prior to disposal; and
(9) The functionality that the security
system shall remain operational during a power outage.
(i) In addition to the requirements listed in
(h) above, each registered premises shall have a backup alarm system that shall
detect unauthorized entry during times when the registered premises are closed
and that shall be provided by a company which shall not be the same company
providing the primary security system.
(j) All security system equipment and
recordings shall be maintained in a secure location so as to prevent theft,
loss, destruction, and alterations, access to which shall be limited to persons
that are essential to security operations, including security system
personnel.
(k) A current list of
authorized employees and service personnel that have access to the surveillance
room shall be available to the department upon request.
(l) All video surveillance records, including
recordings of point-of-sale areas, shall be confidential, except that the ATC
may provide such records and recordings, with notice to the department, to
state or local law enforcement agency(s) acting within their lawful
jurisdiction and if requested in connection with a law enforcement
investigation or proceeding, or pursuant to a court order, or to the
department.
(m) All policies,
procedures, practices, plans, and physical layout pertaining to security, and
the address of a second site for cultivation and processing if separate from
the dispensing location, shall be confidential except that they shall be
provided to the department upon request and as otherwise allowed by He-C
402.
(n) All security equipment
shall be in good working order and shall be inspected and tested at regular
intervals, of at least every 30 calendar days.
(o) Documentation of the inspection and
testing in (n) above shall be maintained by the ATC.
(p) At all points of ingress and egress, the
ATC shall ensure the use of commercial-grade, non-residential door
locks.
(q) ATCs shall develop
written security protocols which they shall share with local police
department(s) having jurisdiction at the address(es) of the registered
premises. The ATC shall document the efforts made to engage local police
departments.
