16-11-086  

  • WSR 16-11-086
    PERMANENT RULES
    DEPARTMENT OF HEALTH
    [Filed May 17, 2016, 12:05 p.m., effective June 17, 2016]
    Effective Date of Rule: Thirty-one days after filing.
    Purpose: New chapter 246-71 WAC, Medical marijuana authorization data base, the rules implement a medical marijuana authorization data base and establish a process for patients and designated providers authorized to use medical marijuana to obtain recognition cards. The cards allow for possession of larger amounts of marijuana products, sales tax exemption, and arrest protection. The rules also outline how authorized users may access data in the data base.
    Statutory Authority for Adoption: RCW 69.51A.230.
    Adopted under notice filed as WSR 16-05-061 on February 12, 2016.
    Changes Other than Editing from Proposed to Adopted Version: WAC 246-71-040 (1)(d) was revised in order to not restrict the types of laminators a marijuana retail establishment may use to create recognition cards.
    A final cost-benefit analysis is available by contacting Susan Reynolds, P.O. Box 47852, Olympia, WA 98504-7852, phone (360) 236-2820, fax (360) 236-4626, e-mail susan.reynolds@doh.wa.gov.
    Number of Sections Adopted in Order to Comply with Federal Statute: New 0, Amended 0, Repealed 0; Federal Rules or Standards: New 0, Amended 0, Repealed 0; or Recently Enacted State Statutes: New 16, Amended 0, Repealed 0.
    Number of Sections Adopted at Request of a Nongovernmental Entity: New 0, Amended 0, Repealed 0.
    Number of Sections Adopted on the Agency's Own Initiative: New 0, Amended 0, Repealed 0.
    Number of Sections Adopted in Order to Clarify, Streamline, or Reform Agency Procedures: New 0, Amended 0, Repealed 0.
    Number of Sections Adopted Using Negotiated Rule Making: New 0, Amended 0, Repealed 0; Pilot Rule Making: New 0, Amended 0, Repealed 0; or Other Alternative Rule Making: New 16, Amended 0, Repealed 0.
    Date Adopted: May 17, 2016.
    John Wiesman, DrPH, MPH
    Secretary
    Chapter  246-71  WAC
    MEDICAL MARIJUANA AUTHORIZATION DATA BASE
    NEW SECTION
    WAC 246-71-010 Definitions.
    The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.
    (1) "Authorization" means a form developed by the department that is completed and signed by a qualifying patient's health care professional and printed on tamper-resistant paper approved by the Washington pharmacy quality assurance commission.
    (2) "Consultant" means a person who holds a valid medical marijuana consultant certificate issued by the secretary under chapter 246-72 WAC and who is employed by a retail outlet with a medical marijuana endorsement.
    (3) "Credential for access" or "credentials" means information, electronic device, or certificate provided by the department or the department's designee to a data requestor to electronically access the data base. The authentication may include, but is not limited to, a user name, password, or an identification electronic device or certificate.
    (4) "Data base" means the medical marijuana authorization data base established under RCW 69.51A.230.
    (5) "Department" means the Washington state department of health.
    (6) "Designated provider" has the same meaning as RCW 69.51A.010(4).
    (7) "Dispenser" means a person authorized to dispense controlled substances other than marijuana under chapter 69.50 RCW.
    (8) "Health care practitioner" or "authorizing health care practitioner," for purposes of this chapter only, means a physician licensed under chapter 18.71 RCW, a physician assistant licensed under chapter 18.71A RCW, an osteopathic physician licensed under chapter 18.57 RCW, an osteopathic physician's assistant licensed under chapter 18.57A RCW, a naturopath licensed under chapter 18.36A RCW, or an advanced registered nurse practitioner licensed under chapter 18.79 RCW.
    (9) "Official" means an official of a local, state, tribal, or federal law enforcement or prosecutorial agency.
    (10) "Prescriber" means a person authorized to prescribe or dispense controlled substances other than marijuana under chapter 69.50 RCW.
    (11) "Qualifying patient" or "patient" has the same meaning as RCW 69.51A.010(19).
    (12) "Recognition card" means a card issued to qualifying patients and designated providers by a marijuana retailer with a medical marijuana endorsement that has entered them into the medical marijuana authorization data base.
    (13) "Retail outlet with a medical marijuana endorsement" or "endorsed outlet" means a location licensed by the WSLCB under RCW 69.50.325 for the retail sale of usable marijuana and marijuana-infused products to the public, and under RCW 69.50.375 to qualifying patients and designated providers for medical use.
    (14) "Valid photographic identification" means:
    (a) A driver's license or instruction permit issued by any state of the United States or province of Canada. If the patient's driver's license has expired, the patient must also show a valid temporary driver's license with the expired card.
    (b) A state identification card issued by any state of the United States or province of Canada.
    (c) An official passport issued by any nation.
    (d) A United States armed forces identification card issued to active duty, reserve, and retired personnel and the personnel's dependents.
    (e) A merchant marine identification card issued by the United States Coast Guard.
    (f) An enrollment card issued by the governing authority of a federally recognized Indian tribe located in Washington, if the enrollment card incorporates security features comparable to those implemented by the department of licensing for Washington drivers' licenses.
    A recognition card, whether current or expired, does not qualify as valid photographic identification.
    (15) "Vendor" means the third-party administrator with whom the department has contracted to operate the data base.
    (16) "WSCLB" means the Washington state liquor and cannabis board.
    NEW SECTION
    WAC 246-71-020 Adding qualifying patients and designated providers to the data base.
    A qualifying patient or designated provider may take their authorization to an endorsed outlet to be entered into the data base.
    (1) Only a consultant employed by an endorsed outlet is allowed to enter a qualifying patient's or designated provider's information into the data base.
    (2) Consultants must register with the department to receive credentials to access the data base. The process for registration will be established by the department.
    (3) The department shall verify the consultant's identity and certificate status before providing credentials to access the data base.
    (4) The consultant shall access the data base using the credentials issued by the department or the department's designee. If the credentials are lost or missing, or the security of the credentials is compromised, the consultant shall notify the department by telephone and in writing within one business day.
    (5) The consultant shall ensure that the authorization form provided is valid, complete, unaltered, and meets all requirements specified in RCW 69.51A.030 and complies with the instructions on the form. If any requirement is not met, or the form is altered or incomplete, the person cannot be entered into the data base.
    (6) The consultant shall verify the identity of every patient age eighteen and older and every designated provider by inspecting the patient's or designated provider's valid photographic identification. Except for patients under the age of eighteen, a person cannot be entered into the data base without valid photographic identification.
    (7) In the event of an inexact match of names on the identification and the authorization, the consultant shall ensure that the patient or designated provider named on the authorization form is the same person presenting the authorization for entry into the data base.
    (8) The consultant shall check the data base to ensure that a designated provider is not currently associated with a different patient in the data base before associating the designated provider with a new patient in the data base. If a designated provider is still associated with a different patient, the consultant cannot enter the designated provider into the data base as associated with the new patient.
    (9) The consultant shall enter the following information into the data base for each patient and designated provider (unless specified below):
    (a) The type of valid photographic identification verified and the unique number from the identification;
    (b) Full legal name, as it appears on the valid photographic identification, including first name, middle initial, last name, and generational suffixes, if any;
    (c) Date of birth;
    (d) Actual address if different from the address on the identification;
    (e) Gender;
    (f) Name of the authorizing health care practitioner;
    (g) Authorizing health care practitioner's full license number;
    (h) Business address of the authorizing health care practitioner;
    (i) Telephone number of the authorizing health care practitioner, as listed on the authorization form;
    (j) The patient's qualifying condition(s);
    (k) For the designated provider only, the patient the designated provider is authorized to assist;
    (l) The date the authorization was issued;
    (m) The date the authorization expires; and
    (n) The number of plants the patient is allowed to grow. If the authorizing health care practitioner does not indicate a specific number, the presumptive number is six plants. The health care practitioner cannot authorize more than fifteen plants. An authorization for more than fifteen plants is invalid.
    (10) All requests for, uses of, and disclosures of information from the data base by authorized persons must be consistent with chapter 69.51A RCW and this chapter.
    NEW SECTION
    WAC 246-71-030 Renewing qualifying patients and designated providers in the data base.
    (1) Recognition cards expire on the expiration date indicated on the patient's or designated provider's authorization. To be valid, an authorization must expire no later than:
    (a) Twelve months after the date it was issued for patients age eighteen and over;
    (b) Twelve months after the date it was issued for designated providers; or
    (c) Six months after the date it was issued for patients under the age of eighteen.
    (2) To renew a recognition card a patient or designated provider must receive a new authorization following reexamination of the patient by a health care practitioner. The qualifying patient or designated provider may take their new authorization to an endorsed outlet to be entered into the data base.
    (3) The procedures in WAC 246-71-020 must be used to enter the patient's or designated provider's new authorization into the data base.
    (4) The consultant shall ensure that the information required by WAC 246-71-020(9) is updated and accurate at the time of renewal.
    NEW SECTION
    WAC 246-71-040 Requirements for recognition cards.
    (1) An endorsed outlet must have the following equipment readily available and maintained in good working order:
    (a) A computer with internet access and capability of running a supported version of a common web browser;
    (b) A digital camera with at least 10 megapixel resolution;
    (c) A standard color printer able to print at least 300 dots per inch;
    (d) A laminator; and
    (e) A solid white backdrop to use as the background for each picture.
    (2) When issuing a recognition card to a qualifying patient or designated provider, an endorsed outlet must comply with the following requirements:
    (a) Only a consultant employed by the endorsed outlet is allowed to print and create a card;
    (b) The consultant shall take a picture of the face of the patient or designated provider at the same time they are entered into the data base following the process specified by the department;
    (c) The consultant shall create, print and laminate the card, and issue it to the patient or designated provider following the process specified by the department; and
    (d) The consultant shall return the authorization to the patient or designated provider. The endorsed outlet shall not retain a copy of the authorization.
    (3) The data base vendor shall ensure recognition cards contain the following:
    (a) A randomly generated and unique identification number;
    (b) The name of the patient or designated provider;
    (c) For designated providers, the unique identification number of the patient they are assisting;
    (d) A photograph of the patient or designated provider;
    (e) The amounts of marijuana concentrates, usable marijuana, or marijuana-infused products the patient or designated provider is authorized to purchase or obtain at an endorsed outlet;
    (f) The number of plants the patient or designated provider is authorized to grow;
    (g) The effective date and expiration date of the card;
    (h) The name of the health care professional who issued the authorization; and
    (i) Additional security features required by the department to ensure the validity of the card.
    NEW SECTION
    WAC 246-71-050 Data base access by marijuana retailers with medical endorsements.
    Employees of an endorsed outlet may access the data base to confirm the validity of a recognition card presented by a patient or designated provider.
    (1) An employee of an endorsed outlet must register with the department to receive credentials for access. The registration process shall be established by the department.
    (2) The department shall verify the employee's identity and employment status before providing credentials to access the data base.
    (3) The employee shall access the data base using the credentials issued by the department or the department's designee. If the credentials issued are lost or missing, or the security of the credentials is compromised, the employee shall notify the department by telephone and in writing within one business day.
    (4) An endorsed outlet owner or manager shall inform the department and the data base vendor in writing immediately upon the termination of employment of an employee with access.
    (5) All requests for, uses of, and disclosures of information from the data base by authorized persons must be consistent with chapter 69.51A RCW and this chapter.
    NEW SECTION
    WAC 246-71-060 Data base access by qualifying patients or designated providers.
    Qualifying patients and designated providers may request and receive their own authorization information from the data base or information about any person or entity that has queried their name or information.
    (1) A patient or designated provider may submit a request using a process and format established by the department for requesting and receiving information from the data base.
    (2) The department shall require proof of identity including, but not limited to, valid photographic identification prior to releasing any information to a patient or designated provider.
    (3) The information will be delivered using a process and format established by the department.
    NEW SECTION
    WAC 246-71-070 Data base access by prescribers and dispensers.
    Prescribers and dispensers may access patient information in the data base for the purpose of providing medical or pharmaceutical care for their patients.
    (1) Prescribers and dispensers who want access to the data base shall register with the department in order to receive credentials for access. The registration process shall be established by the department.
    (2) The department shall verify the prescriber's or dispenser's identity and health care practitioner license(s) before providing credentials to access the data base.
    (3) Prescribers and dispensers shall access the data base using the credentials issued by the department or the department's designee. If the credentials issued are lost or missing, or the security of the credentials is compromised, the prescriber or dispenser shall notify the department by telephone and in writing within one business day.
    (4) Prescribers and dispensers registered to access the data base must inform the department and the data base vendor immediately in writing when they no longer have the authority to prescribe or dispense controlled substances.
    (5) All requests for, uses of, and disclosures of information from the data base by authorized persons must be consistent with chapter 69.51A RCW and this chapter.
    NEW SECTION
    WAC 246-71-080 Data base access by local, state, tribal, and federal law enforcement and prosecutorial officials.
    Officials who are engaged in a bona fide specific investigation of suspected marijuana-related activity that may be illegal under Washington state law may access the data base to confirm the validity of the recognition card of a patient or designated provider.
    (1) Officials who want access to the data base shall register with the department in order to receive credentials for access. The registration process shall be established by the department.
    (2) The department or the department's designee shall verify the official's identity and position before providing credentials to access the data base.
    (3) Officials shall access the data base using the credentials issued by the department or the department's designee. If the credentials issued are lost or missing, or the security of the credentials is compromised, the official shall notify the department or its designee by telephone and in writing within one business day.
    (4) Officials with an active data base account must inform the department and the data base vendor in writing immediately when they no longer hold a position as a law enforcement or prosecutorial official.
    (5) All requests for, uses of, and disclosures of information from the data base by authorized persons must be consistent with chapter 69.51A RCW and this chapter.
    NEW SECTION
    WAC 246-71-090 Data base access by the department of revenue.
    The Washington department of revenue may access information in the data base to verify tax exemptions under chapters 82.08 and 82.12 RCW. The process and format for request and receiving the information shall be established by the department and the data base vendor in coordination with the Washington department of revenue.
    NEW SECTION
    WAC 246-71-100 Confidentiality.
    (1) Under RCW 42.56.625, records in the data base containing names and other personally identifiable information of qualifying patients and designated providers are exempt from public disclosure, inspection, or copying.
    (2) The vendor must retain data base records for at least five calendar years to permit the WSLCB and Washington department of revenue to verify eligibility for tax exemptions.
    NEW SECTION
    WAC 246-71-110 Penalties and sanctions.
    (1) Pursuant to RCW 69.51A.240, unlawful access to the data base is a class C felony.
    (2) If the department or vendor determines a person or entity has intentionally, knowingly, or negligently accessed, used or disclosed data base information in violation of chapter 69.51A RCW or this chapter, the department may take action including, but not limited to:
    (a) Terminating access to the data base;
    (b) Filing a complaint with appropriate health profession disciplining authority; or
    (c) Reporting the violation to the appropriate government agency, including WSLCB or law enforcement.
    NEW SECTION
    WAC 246-71-120 Process to obtain a replacement recognition card.
    A patient or designated provider may request a replacement recognition card at an endorsed outlet if the original recognition card is lost or stolen.
    (1) The replacement recognition card will expire on the same date as the original recognition card unless the patient is reexamined by a health care practitioner and a new authorization is provided.
    (2) Only consultants shall issue a replacement recognition card to the patient or designated provider. The consultant shall issue the replacement recognition card in compliance with the procedure in WAC 246-71-030.
    (3) Information regarding the issuance of a replacement recognition card must be entered into the data base as determined by the department prior to the card being printed and given to the patient or designated provider.
    NEW SECTION
    WAC 246-71-130 Removal of a qualifying patient or designated provider from the data base.
    (1) The vendor must automatically deactivate patient and designated provider records in the data base upon expiration of a recognition card.
    (2) Patients and designated providers may request to be removed from the data base before the expiration of their recognition card using the process established by the department.
    (3) The authorizing health care practitioner may request removal of a patient or designated provider from the data base if the patient no longer qualifies for the medical use of marijuana. This request must be made using the process established by the department.
    NEW SECTION
    WAC 246-71-140 Revocation of a designated provider.
    (1) Patients may revoke their designation of a specific designated provider. The revocation must be in writing using a form developed by the department. The patient must send the revocation to the vendor and give a copy to the designated provider. The vendor must verify the form's authenticity prior to revoking the designated provider and deactivating the designated provider's recognition card.
    (2) A patient may designate a new designated provider after revoking a prior designated provider. The new designated provider must receive an authorization form from the patient's authorizing health care practitioner. The new designated provider may then go to a retail outlet to be entered into the data base and receive a recognition card.
    (3) A person may stop serving as a designated provider by providing a letter to the patient. If the person is currently in the data base as a designated provider for the patient, the person shall also submit a form established by the department to the vendor. The vendor shall verify the form's authenticity prior to revoking the designated provider in the data base and deactivating the designated provider's recognition card.
    NEW SECTION
    WAC 246-71-150 Release of aggregate information from the data base.
    (1) The department may provide aggregate information from the data base, with all personally identifiable information redacted, for the purpose of statistical analysis and oversight of agency performance and actions.
    (2) To obtain information from the program a person or public or private entity must submit a request on a form established by the department.
    (3) All requests for, uses of, and disclosures of information from the authorization data base must be consistent with chapter 69.51A RCW and this chapter.
    NEW SECTION
    WAC 246-71-990 Recognition card fees.
    (1) Endorsed outlets must collect a one dollar fee for each initial, replacement, and renewal recognition card. The fee shall be collected by the endorsed outlet from the patient or designated provider when the card is issued.
    (2) Endorsed outlets must periodically remit fees collected using the process established by the department.
    (3) Failure by an endorsed outlet to promptly remit fee revenue when due will result in notice to the WSLCB and any other action necessary to ensure compliance.

Document Information

Effective Date:
6/17/2016