Current through all regulations passed and filed through December 16, 2024
(A) All licensed dispensaries shall maintain
security policies and procedures that include, but are not limited to:
(1) A security plan with protocols for
patient, caregiver, and employee safety and management and security of medical
marijuana and currency;
(2)
Restricted access to the areas in the dispensary that contain medical marijuana
to authorized employees;
(3)
Identification of authorized employees through means including current employee
identification card in the employee's immediate possession whenever the
employee is present at the dispensary;
(4) Controlled access and prevention of
loitering both inside and outside of the facility;
(5) Conducting electronic
monitoring;
(6) Use of a panic
button; and
(7) Prepares for,
protects against, and addresses how to handle any crisis that affects the
security or operation of a dispensary in the event of strike, fire, flood or
other natural disaster, or other situations of local, state or national
emergency.
(B) All
licensed dispensaries shall implement security measures to protect the
premises, patients, caregivers and employees, including the following measures:
(1) The dispensary department shall be
accessible to patients and caregivers, dispensary employees, service
professionals conducting business with the dispensary and who are escorted and
supervised by a dispensary employee, and other persons authorized by Chapter
3796. of the Revised Code and this division. To prevent unauthorized access to
the dispensary department, establish a locked door or barrier between the
facility's entrance and the dispensary department.
(2) Post a sign at all entry ways into any
area of the dispensary containing medical marijuana, including a room with an
approved vault, which sign shall be a minimum of twelve inches in height and
twelve inches in width and shall state: "Do Not Enter - Restricted Access Area
- Access Restricted to Authorized Employees Only." In lettering no smaller than
one-half inch in height.
(3)
Maintenance of a supply of medical marijuana that is not more than the quantity
required for normal, efficient operation;
(4) Prevent individuals from remaining on the
premises if they are not engaging in authorized activities under Chapter 3796.
of the Revised Code or this division;
(5) Develop a policy that addresses the
maximum capacity and patient flow in the waiting rooms, dispensary department,
and patient care areas;
(6) Dispose
of medical marijuana in accordance with this division;
(7) During hours of operation, store all
medical marijuana in established restricted access areas accessible only to
authorized employees. The minimum number of dispensary employees necessary for
efficient operations shall be in the restricted access area;
(8) Keep all safes, vaults and any other
equipment or medical marijuana storage areas securely locked and protected from
unauthorized entry. The vault shall have dual authentication or biometric
access with a unique code for each employee. A safe exclusively used for
storage of currency, with separate access controls, shall be maintained in the
product vault;
(9) Keep a daily log
of dispensary employees with access to the safe or vault and knowledge of the
access code or combination, and records of all employee access to any
restricted access areas;
(10) Keep
all locks and security equipment in good working order. All security equipment
must be inspected and tested at regular intervals, not to exceed thirty
calendar days from the previous inspection and test to ensure the systems
remain functional. A dispensary must maintain a log documenting such
inspections and tests;
(11)
Prohibit keys, if applicable, from being left in locks or stored or placed in a
location accessible to persons other than specifically authorized
personnel;
(12) Prohibit
accessibility of security measures, including combination numbers, passwords or
electronic or biometric security systems to persons other than persons
specifically authorized in accordance with this division;
(13) Ensure that trees, bushes and other
foliage outside of the dispensary do not allow for a person to conceal
themselves from sight;
(14) Develop
emergency policies and procedures for securing all product and currency
following any instance of diversion, theft or loss of medical marijuana, and
conduct an assessment to determine whether additional safeguards are
necessary;
(15) Employ dedicated
on-site security personnel during all operational hours who shall only perform
tasks related to security operations and have foundational training specific to
security; and
(16) Develop
sufficient additional safeguards in response to any special security concerns,
or as required by the state board of pharmacy.
(C) The state board of pharmacy may request
or approve alternate security provisions that it determines are an adequate
substitute for a security measure specified in this rule. Any additional
protections may be considered by the state board of pharmacy in evaluating
overall security measures.
(D) When
physical security controls become inadequate because of such items as a
significant increase in the quantity of medical marijuana, the physical
controls shall be expanded and extended accordingly.
(E) All licensed dispensaries shall have a
security system that is operational at all times and that uses commercial grade
equipment to prevent and detect diversion, theft, or loss of medical marijuana,
including:
(3) Video cameras in all areas, unless
prohibited by law, including all points of entry and exit from the dispensary,
the dispensary department, and restricted access areas which shall be
appropriate for the normal lighting conditions of the area under surveillance,
so as to allow for the capture of clear and certain identification of any
person located in the surveillance area. Such surveillance shall be sufficient
to distinctly view the entire area under surveillance;
(4) A video camera or cameras recording at
each point of sale location allowing for the identification of the dispensary
employee dispensing the medical marijuana and any patient or caregiver
purchasing the medical marijuana. The camera or cameras shall capture the sale,
the individuals and the computer monitors used for the sale;
(5) A minimum of one height strip camera at
any public entrance or exit to the dispensary;
(6) In accordance with rule
3796:6-3-04 of the
Administrative Code, a minimum of constant streaming from all video cameras
during hours when a dispensary is closed;
(7) Recording from all video cameras during
hours of operation, which the dispensary shall make available for immediate
viewing by the state board of pharmacy or the board's authorized representative
upon request and shall be retained for at least six months.
(a) Unaltered copies of such recordings shall
be made available upon request;
(b)
If a dispensary knows or should know of a pending criminal, civil, or
administrative investigation or legal proceeding for which a recording may
contain relevant information, the registered organization shall retain an
unaltered copy of the recording until the investigation or proceeding is closed
or the entity conducting the investigation or proceeding notifies the
dispensary that it is not necessary to retain the recording.
(8) A duress alarm, which for
purposes of this rule means a silent security alarm system signal generated by
the entry of a designated code into an arming station to signal that the alarm
user is being forced to turn off the system;
(9) A panic alarm, which for purposes of this
section, means an audible security alarm system signal generated by the manual
activation of a device intended to signal a life threatening event or emergency
requiring a law enforcement response;
(10) A holdup alarm, which for purposes of
this section, means a silent alarm signal generated by the manual activation of
a device intended to signal a robbery in progress;
(11) An automatic voice dialer, which for
purposes of this section means any electrical, electronic, mechanical, or other
device capable of being programmed to send a prerecorded voice message, when
activated, over a telephone line, radio or other communication system, to a law
enforcement, public safety or emergency services agency requesting
dispatch;
(12) A failure
notification system that provides an audible, text or visual notification of
any failure in the surveillance system. The failure notification system shall
provide an alert to the dispensary within five minutes of the failure, either
by telephone, email, or text message;
(13) The ability to immediately produce a
clear color still photo that is a minimum of ninety-six hundred dpi from any
camera image, either live or recorded. All cameras shall be capable of
capturing at least thirty frames per second;
(14) A date and time stamp embedded on all
recordings. The date and time shall be synchronized and set correctly and shall
not significantly obscure the picture;
(15) The ability to remain operational during
a power outage and ensure that all access doors are not solely controlled by an
electronic access panel to ensure that locks are not released during a power
outage; and
(16) All video
surveillance equipment shall allow for the exporting of still images in an
industry standard image format, including .jpg, .bmp, and .gif. Exported video
shall have the ability to be archived in a proprietary format that ensures
authentication of the video and guarantees that no alteration of the recorded
image has taken place. Exported video shall also have the ability to be in an
industry standard file format that can be played on a standard computer
operating system. All recordings shall be erased or destroyed prior to
disposal.
(F) A
surveillance system at a dispensary shall have electronic monitoring capacity
including:
(1) Monitors that are each at least
nineteen inches or greater;
(2) A
video printer capable of immediately producing a clear still photo from any
video image; and
(3) A failure
notification system that provides an audible and visual notification of any
failure in the electronic monitoring system.
(G) All surveillance systems at a dispensary
shall comply with the requirements herein and shall provide secure access and
secure override access for the system to the state board of pharmacy in a
manner suitable to the board. At any time and without notice, the dispensary
surveillance system, and its component parts, shall be subject to testing by
the state board of pharmacy. Each surveillance camera must be programed with a
defined home position that remains consistent when a surveillance system is
restarted. The defined home position feature must remain enabled at all times
and allow for automatic return to the home position.
(H) If dispensary premises present special
security issues, such as an extremely large stock of medical marijuana, exposed
handling or unusual vulnerability to diversion, theft or loss, the state board
of pharmacy may require additional safeguards, including, but not limited to, a
supervised watchman service.
(I) If
diversion, theft or loss of medical marijuana has occurred from a dispensary,
the state board of pharmacy shall review and approve the improvements in the
appropriate storage and security requirements for all medical marijuana in such
dispensary and may require additional safeguards to ensure security of the
medical marijuana.
(J) Preventive
maintenance must be performed on a dispensary's surveillance system at least
annually by a vendor approved by the state board of pharmacy.