935 CMR, § 501.110

Current through Register 1533, October 25, 2024

Section 501.110 - Security Requirements for Medical Marijuana Treatment Centers

(1)General Requirements. An MTC shall implement sufficient security measures to deter and prevent unauthorized entrance into areas containing Marijuana, theft of Marijuana and ensure the safety of MTC employees, Qualifying Patients and the general public. Security measures to protect the Premises, Registered Qualifying Patients, Personal Caregivers, and MTC agents of the MTC shall include, but are not limited to, the following:

(a) Positively identifying and allowing only Registered Qualifying Patients, Personal Caregivers, MTC agents, Marijuana Courier agents, as applicable, and, subject to the requirements of 935 CMR 501.110(4)(e), outside vendors, contractors, and Visitors, access to the MTC;

(b) Preventing individuals from remaining on the Premises of the MTC if they are not engaging in activity expressly or by necessary implication permitted by M.G.L. c. 94I, and 935 CMR 501.000;

(c) Disposing of Marijuana in accordance with 935 CMR 501.105(12), in excess of the quantity required for normal, efficient operation as established within 935 CMR 501.105;

(d) Securing all entrances to the MTC to prevent unauthorized access;

(e) Establishing Limited Access Areas which, after receipt of a final License, shall be accessible only to specifically authorized personnel limited to include only the minimum number of employees essential for efficient operation;

(f) Storing all finished Marijuana in a secure, locked safe or vault and in such a manner as to prevent diversion, theft, and loss;

(g) Keeping all safes, vaults, and any other equipment or areas used for the production, cultivation, harvesting, Processing, or storage, including prior to disposal, of Marijuana and MIPs securely locked and protected from entry, except for the actual time required to remove or replace Marijuana;

(h) Keeping all locks and security equipment in good working order;

(i) Prohibiting keys, if any, from being left in the locks, or stored or placed in a location accessible to persons other than specifically authorized personnel;

(j) Prohibit accessibility of security measures, such as combination numbers, passwords, or electronic or biometric security systems, to persons other than specifically authorized personnel;

(k) Ensure that the outside perimeter of the MTC is sufficiently lit to facilitate surveillance;

(l) Ensuring that all Marijuana Products are kept out of plain sight and are not visible from a public place, outside of the MTC, without the use of binoculars, optical aids or aircraft;

(m) Develop emergency policies and procedures for securing all product following any instance of diversion, theft, or loss of Marijuana, and conduct an assessment to determine whether additional safeguards are necessary;

(n) Develop sufficient additional safeguards as required by the Commission for MTCs that present special security concerns;

(o) At MTCs where transactions are conducted in cash, establishing procedures for safe cash handling and cash transportation to financial institutions to prevent theft, loss and associated risks to the safety of employees, customers and the general public;

(p) Sharing the MTC's floor plan or layout of the facility with Law Enforcement Authorities in a manner and scope as required by the municipality and identifying when the use of flammable or combustible solvents, chemicals or other materials are in use at the MTC;

(q) Sharing the MTC's security plan and procedures with Law Enforcement Authorities, in the municipality where the MTC is located and periodically updating Law Enforcement Authorities if the plans or procedures are modified in a material way; and

(r) Inside the MTC, all Marijuana shall be kept in a Limited Access Area inaccessible to any persons other than MTC agents, except for displays allowable under 935 CMR 501.105(4)(a 4. Inside the MTC, all Marijuana shall be stored in a locked, access-controlled space in a Limited Access Area during nonbusiness hours.

(2)Alternative Security Provisions.

(a) Notwithstanding the requirements specified in 935 CMR 501.110(1) and (5) through (7), if an MTC has provided other, specific safeguards that may be regarded as an adequate substitute for those requirements, such measures may be taken into account by the Commission in evaluating the overall required security measures. For purposes of cash handling and cash transportation, only alternative safeguards that comply with the requirements of 935 CMR 501.110(7)(b) shall be considered to be adequate substitutes.

(b) The applicant or Licensee shall submit a request for an alternative security provision to the Commission on a form as determined and made available by the Commission. Upon receipt of the form, the Commission shall submit the request to the chief law enforcement officer in the municipality where the MTC is located or will be located. The Commission shall request that the chief law enforcement officer review the request and alternative security provision requested and, within 30 days;

1. Certify the sufficiency of the requested alternate security provision; or

2. Provide the Commission with a statement of reasons why the alternative security provision is not sufficient in the opinion of the chief law enforcement officer.

(c) The Commission shall take the chief law enforcement officer's opinion under consideration in determining whether to grant the alternative security provision, provided that it may not be determinative. If no response is received from the chief law enforcement officer or a delegee within 30 days of submitting the request to the chief law enforcement officer, the Commission shall proceed with a determination.

(3)Buffer Zone. An MTC Entrance may not be closer than 500 feet from the nearest School Entrance, unless a city or town adopts an ordinance or bylaw that reduces the distance requirement.

(a) The buffer zone distance of 500 feet shall be measured in a straight line from the geometric center of the MTC Entrance to the geometric center of the nearest School Entrance unless there is an Impassable Barrier within those 500 feet; in these cases, the buffer zone distance shall be measured along the center of the shortest publicly-accessible pedestrian travel path from the geometric center of the MTC Entrance to the geometric center of the nearest School Entrance.

(b) The buffer zone distance of 500 feet may be reduced if a city or town adopts an ordinance or bylaw that reduces the distance requirement.

(4)Limited Access Areas.

(a) All Limited Access Areas shall be identified by the posting of a sign that shall be a minimum of 12" x 12" and which states: "Do Not Enter - Limited Access - Area Access Limited to Authorized Personnel Only" in lettering no smaller than one inch in height.

(b) All Limited Access Areas shall be clearly described by the filing of a diagram of the licensed Premises, in the form and manner determined by the Commission, reflecting walls, partitions, counters, and all areas of entry and exit, including loading areas. Said diagram shall also show all Propagation, Vegetation, Flowering, Processing, production, storage, disposal, and retail sales areas.

(c) At all times following receipt of a final License, access to Limited Access Areas shall be limited to persons that are essential to operations in these areas and specifically permitted by the MTC, representatives of the Commission acting in accordance with their authority under the adult use, medical use and CMO laws; Commission Delegee(s); and local law enforcement authorities, fire safety personnel and emergency medical services acting within their lawful jurisdiction and official capacity.

(d) An MTC agent shall visibly display an identification badge issued by the MTC or the Commission at all times while at the MTC or transporting Marijuana.

(e) Following receipt of a final License, all outside vendors, contractors, and Visitors shall obtain a Visitor Identification Badge prior to entering a Limited Access Area, and shall be escorted at all times by an MTC agent authorized to enter the Limited Access Area. The Visitor Identification Badge shall be visibly displayed at all times while the Visitor is in any Limited Access Area. All Visitors shall be logged in and out, and that log shall be available for inspection by the Commission at all times. All Visitor Identification Badges shall be returned to the MTC upon exit.

(5)Security and Alarm Systems.

(a) An MTC shall have an adequate security system to prevent and detect diversion, theft, or loss of Marijuana or unauthorized intrusion, utilizing commercial grade equipment, which shall, at a minimum, include:

1. A perimeter alarm on all entry and exit points and perimeter windows;

2. A failure notification system that provides an audible, text, or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to designated employees of the MTC within five minutes after the failure, either by telephone, email, or text message;

3. A Duress Alarm, Panic Alarm, or Holdup Alarm connected to local public safety or law enforcement authorities;

4. Video cameras in all areas that may contain Marijuana, vaults or safes for the purpose of securing cash, at all points of entry and exit, and in any parking lot, which shall be appropriate for the normal lighting conditions of the area under surveillance. The cameras shall be directed at all safes, vaults, sales areas, and areas where Marijuana is cultivated, harvested, Processed, prepared, stored, handled, Transferred or dispensed, or where cash is kept and Processed. Cameras shall be angled to allow for the capture of clear and certain identification of any individual entering or exiting the MTC or area;

5. 24-hour recordings from all video cameras that are available for immediate viewing by the Commission upon request and that are retained for at least 90 calendar days. Recordings may not be destroyed or altered, and shall be retained as long as necessary if the MTC is aware of a pending criminal, civil, or administrative investigation, or legal proceeding for which the recording may contain relevant information;

6. The ability to immediately produce a clear, color, still image (live or recorded);

7. A date and time stamp embedded on all recordings. The date and time shall be synchronized and set correctly and may not significantly obscure the picture;

8. The ability to remain operational during a power outage for a minimum of four hours and, if it appears likely that the outage will last for more than four hours, the MTC takes sufficient steps to ensure security on the premises in consultation with the Commission; and

9. A video recording that allows for the exporting of still images in an industry standard image format, including.jpg,.bmp, and.gif. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall be able to be saved in an industry standard file format that can be played on a standard computer operating system. All recordings shall be erased or destroyed prior to disposal.

(b) All security system equipment and recordings shall be maintained in a secure location to prevent theft, loss, destruction, and alterations.

(c) In addition to the requirements listed in 935 CMR 501.110(5), the MTC shall have a back-up alarm system, with all capabilities of the primary system, provided by a company supplying commercial grade equipment, which may not be the same company supplying the primary security system, or shall demonstrate to the Commission's satisfaction alternate safeguards to ensure continuous operation of a security system.

(d) Access to surveillance areas shall be limited to persons that are essential to surveillance operations, law enforcement authorities acting within their lawful jurisdiction, fire safety personnel, security system service personnel, representatives of the Commission as authorized by M.G.L. c. 94I, and 935 CMR 501.000, and Commission Delegee(s).

(e) A current list of authorized employees and service personnel that have access to the surveillance room shall be available to the Commission upon request. If on-site, surveillance rooms shall remain locked and may not be used for any other function.

(f) All security equipment shall be in good working order and shall be inspected and tested at regular intervals, not to exceed 30 calendar days from the previous inspection and test.

(g) Trees, bushes and other foliage outside of the MTC shall be maintained so as to prevent a person or persons from concealing themselves from sight.

(6)Security and Alarm Requirements for MTCs Operating Outdoors.

(a) An MTC that is an operating outdoors shall implement adequate security measures to ensure that outdoor areas are not readily accessible to unauthorized individuals and to prevent and detect diversion, theft or loss of Marijuana which shall, at a minimum, include:

1. A perimeter security fence designed to prevent unauthorized entry to the cultivation facility with signs notifying observers that it is a Limited Access Area;

2. Commercial-grade, nonresidential locks;

3. A security alarm system that shall:

a. Be continuously monitored, whether electronically, by a monitoring company or other means determined to be adequate by the Commission; and

b. Provide an alert to designated employees of the MTC within five minutes after a notification of an alarm or a system failure, either by telephone, email or text message.

4. Video cameras at all points of entry and exit and in any parking lot which shall be appropriate for the normal lighting conditions of the area under surveillance. The cameras shall be directed at all safes, vaults, sales areas, and areas where Marijuana is cultivated, harvested, Processed, prepared, stored, handled, Transferred or dispensed and for the purpose of securing cash. Cameras shall be angled so as to allow for the capture of clear and certain identification of any person entering or exiting the MTC or area;

5. Recordings from all video cameras which shall be enabled to record 24 hours each day and be available for immediate viewing by the Commission on request for at least the preceding 90 calendar days or the duration of a request to preserve the recordings for a specified period of time made by the Commission, whichever is longer. Video cameras may use motion detection sensors to begin recording, so long as the motion detection sensor system provides an alert to designated employees of the MTC in a manner established in the MTC's written security procedures and approved by the Commission or a Commission Delegee. If an MTC receives notice that the motion detection sensor is not working correctly, it shall take prompt action to make corrections and document those actions. Recordings may not be destroyed or altered, and shall be retained as long as necessary if the MTC is aware of a pending criminal, civil or administrative investigation or legal proceeding for which the recording may contain relevant information;

6. The ability to immediately produce a clear, color still image whether live or recorded;

7. A date and time stamp embedded in all recordings, which shall be synchronized and set correctly at all times and may not significantly obscure the picture;

9. A video recording that allows for the exporting of still images in an industry standard image format, including.jpg,.bmp and.gif. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that may be played on a standard computer operating system. All recordings shall be erased or destroyed prior to disposal.

(b) All security system equipment and recordings shall be maintained in a secure location so as to prevent theft, loss, destruction and alterations.

(d) Access to surveillance areas shall be limited to persons that are essential to surveillance operations, law enforcement authorities acting within their lawful jurisdiction, fire safety personnel, security system service personnel and the Commission. A current list of authorized employees and service personnel that have access to the surveillance room shall be available to the Commission on request. If the surveillance room is on-site of the MTC, it shall remain locked and may not be used for any other function.

(e) All security equipment shall be in good working order and shall be inspected and tested at regular intervals, not to exceed 30 calendar days from the previous inspection and test.

(f) Security plans and procedures shared with law enforcement authorities pursuant to 935 CMR 501.110(1)(q) shall include:

1. A description of the location and operation of the security system, including the location of the central control on the Premises;

2. A schematic of security zones;

3. The name of the security alarm company and monitoring company, if any;

4. A floor plan or layout of the facility in a manner and scope as required by the municipality; and

5. A safety plan for the manufacture and production of Marijuana Products as required pursuant to 935 CMR 501.101(1)(c).

(7)Cash Handling and Transportation Requirements.

(a) An MTC with a contract to deposit funds with a financial institution that conducts any transaction in cash shall establish and implement adequate security measures and procedures for safe cash handling and cash transportation to financial institutions or Massachusetts Department of Revenue (DOR) facilities to prevent theft and loss, and to mitigate associated risks to the safety of employees, customers and the general public. Adequate security measures shall include:

1. An on-site secure locked safe or vault maintained in an area separate from retail sales areas used exclusively for the purpose of securing cash;

2. Video cameras directed to provide images of areas where cash is kept, handled and packaged for transport to financial institutions or DOR facilities, provided that the cameras may be motion-sensor activated cameras and provided, further, that all cameras be able to produce a clear, still image whether live or recorded;

3. A written process for securing cash and ensuring transfers of deposits to the MTC's financial institutions and DOR facilities on an incremental basis consistent with the requirements for deposit by the financial institution or DOR facilities;

4. Use of an armored transport provider that is licensed pursuant to M.G.L. c. 147, § 25 (watch, guard or patrol agency) and has been approved by the financial institution or DOR facility.

(b) Notwithstanding the requirement of 935 CMR 501.110(7)(a)4., an MTC may request an alternative security provision under 935 CMR 501.110(2) for purposes of cash transportation to financial institutions and DOR facilities. Any approved alternative security provision shall be included in the security plan shared with law enforcement in the municipality in which the MTC is licensed and periodically updated as required under 935 CMR 501.110(1)(q). To be determined to provide a sufficient alternative, any such alternative safeguard shall include, but may not be limited to:

1. Requiring the use of a locked bag for the transportation of cash from an MTC to a financial institution or DOR facility;

2. Requiring any transportation of cash be conducted in an unmarked vehicle;

3. Requiring two registered MTC Agents employed by the Licensee to be present in the vehicle at all times during transportation of deposits;

4. Requiring real-time GPS tracking of the vehicle at all times when transporting cash;

5. Requiring access to two-way communications between the transportation vehicle and the MTC;

6. Prohibiting the transportation of Marijuana or Marijuana Products at the same time that cash is being transported for deposit to a financial institution or DOR facility; and

7. Approval of the alternative safeguard by the financial institution or DOR facility.

(c) All written safety and security measures developed under this section shall be treated as security planning documents, the public disclosure of which would jeopardize public safety.

(8)Security Requirements for MTC Home Delivery Operations.

(a) An MTC authorized to perform home delivery (MTC) or a Marijuana Courier performing deliveries to Patients and Caregivers on behalf of an MTC, shall implement adequate security measures to ensure that each vehicle used for transportation of Marijuana and Marijuana Products are not readily accessible to unauthorized individuals and to prevent and detect diversion, theft or loss of Marijuana. Security measures shall, at a minimum, include for each operational delivery vehicle:

1. A vehicle security system that includes an exterior alarm;

2. A secure, locked storage compartment that is a part of the vehicle and not easily removable for the purpose of transporting the Marijuana or Marijuana Products.

3. A secure, locked storage compartment that is secured to the vehicle and not easily removable for the purpose of transporting and securing cash used as payment for deliveries of Marijuana or Marijuana Products.

4. A means of secure communication between each vehicle and the MTC's or Marijuana Courier's dispatching location which shall be capable of being monitored at all times that a vehicle is performing a delivery route. Means of communication shall include:

a. Two-way digital or analog radio (UHF or VHF);

b. Cellular phone; or

c. Satellite phone.

5. A global positioning system (GPS) monitoring device that is:

a. Not a mobile device and that is attached to the vehicle at all times that the vehicle contains Marijuana or Marijuana Products; and

b. Monitored by the MTC or Marijuana Courier at a fixed location during the transportation of Marijuana or Marijuana Products for the purpose of home delivery with location checks occurring at least every 30 minutes. The MTC or Marijuana Courier may delegate monitoring of the GPS to the Third-party Technology Platform Provider with which the MTC or Marijuana Courier has a contract, provided that the MTC Licensee or Marijuana Courier shall be responsible for ensuring that monitoring occurs as required 935 CMR 501.110(8) and the contract is made available for inspection and on request, submitted to the Commission.

6. A video system that includes one or more video cameras in the storage area of the vehicle and one or more video cameras in the driver area of the vehicle and which shall remain operational at all times during the entire transportation process and which shall have:

a. The ability to produce a clear color still photo whether live or recorded; and

b. A date and time stamp embedded in all recordings which shall be synchronized and set correctly at all times and may not significantly obscure the picture.

7. All security equipment on vehicles shall be in good working order and shall be inspected and tested at regular intervals, no to exceed 30 calendar days from the previous inspection and test.

(b) An MTC transporting Marijuana and Marijuana Products for home delivery shall ensure that all vehicles used for deliveries are staffed with a minimum of two MTC Agents. At least one MTC Agent shall remain with the vehicle at all times that the vehicle contains Marijuana or Marijuana Products.

(c) The Commission may establish required training programs for MTC and Marijuana Courier Agents that shall be completed within a reasonable period of time and at the expense of the MTC or Marijuana Courier. Trainings shall include, but may not be limited to, the requirements of 935 CMR 501.105(2)(b)7.:

(d) An MTC agent shall document and report any unusual discrepancy in inventory to the Commission and local law enforcement within 24 hours of the discovery of such a discrepancy.

(e) An MTC shall report to the Commission and local law enforcement any vehicle accidents, diversions, losses, or other reportable incidents that occur during transport immediately and, under no circumstances, more than 24 hours of becoming aware of any accidents, diversions, losses, or other reportable incidents and shall otherwise comply with the incident reporting requirements set forth under 935 CMR 501.110(9).

(f) The following individuals shall have access to MTC operations and vehicles, including video recordings:

1. Representatives of the Commission in the course of responsibilities authorized by 935 CMR 501.000;

2. Representatives of other state agencies of the Commonwealth of Massachusetts acting within their jurisdiction; and

3. Law Enforcement Authorities and emergency medical services in the course of responding to an emergency.

(g)935 CMR 501.000 may not be construed to prohibit access to authorized law enforcement personnel or local public health, inspectional services, or other permit-granting agents acting within their lawful jurisdiction.

(h) All vehicles used by the MTC for home delivery are subject to inspection and approval by the Commission prior being put into use. It shall be the MTCs responsibility to make the Commission aware of its intent to introduce a new vehicle into operation and ensure an inspection of the vehicle prior to commencing operation.

(i) Firearms are strictly prohibited from MTC vehicles and from MTC agents performing home deliveries.

(9)Incident Reporting

(a) An MTC shall immediately notify appropriate Law Enforcement Authorities and the Commission any breach of security or other reportable incident defined herein immediately and, in no instance, more than 24 hours following discovery of the breach or incident. Notification shall occur, but not be limited to, during the following occasions:

1. Discovery of inventory discrepancies;

2. Diversion, theft, or loss of any Marijuana Product;

3. Any criminal action involving the MTC or an MTC Agent or occurring on or in the MTC Premises;

4. Any suspicious act involving the sale, cultivation, distribution, Processing, or production of Marijuana by any person;

5. Unauthorized destruction of Marijuana;

6. Any loss or unauthorized alteration of records related to Marijuana, Registered Qualifying Patients, Personal Caregivers, or MTC Agents;

7. An alarm activation or other event that requires response by public safety personnel including, but not limited to, local law enforcement, municipal fire departments, public works or municipal sanitation departments, and municipal inspectional services department, or security personnel privately engaged by the MTC;

8. The failure of any security alarm system due to a loss of electrical power or mechanical malfunction that is expected to last longer than eight hours;

9. A significant motor vehicle crash that occurs while transporting or delivering Finished Marijuana Products and would require the filing of a Motor Vehicle Crash Operator Report pursuant to M.G.L. c. 90 § 26; provided however that a motor vehicle crash that renders the Licensee's vehicle inoperable shall be reported immediately to state and local law enforcement so that Marijuana or Marijuana Products may be adequately secured; or

10. Any other breach of security.

(b) An MTC shall, within ten calendar days, provide notice to the Commission of any incident described in 935 CMR 501.110(9)(a), by submitting an incident report in the form and manner determined by the Commission which details the circumstances of the event, any corrective actions taken, and confirmation that the appropriate Law Enforcement Authorities were notified.

(c) All documentation related to an incident that is reportable pursuant to 935 CMR 501.110(9)(a) shall be maintained by an MTC for no less than one year or the duration of an open investigation, whichever is longer, and made available to the Commission and to Law Enforcement Authorities acting within their lawful jurisdiction upon request.

(10)Security Audits. An MTC shall, on an annual basis, obtain at its own expense a security system audit by a vendor approved by the Commission. A report of such audit shall be submitted, in a form and manner determined by the Commission, no later than 30 calendar days after the audit is conducted. If the audit identifies concerns related to the MTC's security system, the MTC shall also submit a plan to mitigate those concerns within ten business days of submitting the audit.