Rule 351-6-.03 - Security(1) The dispensing licensee is responsible for the security of all products on the premises, including providing adequate safeguards against theft or diversion of product in final packaged form.(2) The dispensing licensee shall have a comprehensive security system to prevent and detect diversion, theft, or loss of product in final packaged form utilizing commercial grade equipment, which shall, at a minimum, include: (a) An alarm system that provides: 5. Sensors at all possible points of entry into the dispensary, to include all doors, windows, roof hatches, and skylights.(b) A surveillance system that includes:2. Video cameras in all areas that may contain product in final packaged form and at all points of entry and exit, appropriate for the conditions of the area under surveillance; (i) The dispensing licensee shall direct video cameras at:(I) All safes and vaults;(II) The retail point of dispensing;(III) All other areas where product in final packaged form is being stored or handled;(IV) All restricted access areas;(V) The entrance to the video surveillance room;(VI) The loading dock or area, if applicable;(VII) All parking lots or parking areas; and(VIII) All entry and exit points, which shall be angled so as to allow for the capture of clear and certain identification of all persons entering or exiting the dispensary.(ii) Video cameras shall operate twenty-four (24) hours a day, seven (7) days a week, recording interior and exterior; (I) The dispensing licensee shall make all recordings available to the Commission or its employees upon request. (II) The dispensing licensee shall retain all recordings for a minimum of forty-five (45) days.(III) Editing or altering the recordings at any point is strictly prohibited and doing so shall result in penalties, up to and including revocation.(IV) The physical media or storage device on which surveillance recordings are stored shall be secured in a manner to protect the recording from decay, tampering, or theft.(iii) All video cameras shall:(I) Have a minimum digital resolution of 2560 x 1440 pixels or pixel equivalent for analog;(II) Record continuously twenty-four (24) hours per day, or on a motion-sensor system, at a minimum of fifteen (15) frames per second;(III) Have the ability to produce a still photo that is clear, unobstructed, and in color from either live or from a recording;(IV) Have an embedded date-and-time stamp on all recordings that shall be synchronized and not obscure the picture; and(V) Continue to operate during a power outage.3. Surveillance recording and monitoring equipment shall be housed in a designated, locked, and secured room or other enclosure with restricted access.(c) Exterior lighting sufficient to deter nuisance activity and facilitate surveillance; and(d) A failure notification system that provides an audible, text, or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to the dispensing licensee within five (5) minutes of the failure, either by telephone, electronic mail, or text message.(3) The dispensing licensee shall notify the Commission and its employees, within twenty-four (24) hours, of any security system failure.(a) The dispensing licensee shall keep a log of any security system failure.(b) The security system failure log shall be maintained on the premises for a period of at least three (3) years.(c) The security system failure log shall be provided to the Commission or its employees upon request.(4) A dispensing licensee shall keep all security equipment in good-working order and shall test the function of all such equipment at least quarterly. (a) The dispensing licensee shall keep a log of all security systems tests completed, which shall include:1. Date security systems test was completed;2. Name(s) of the individual(s) who completed the testing;3. Details regarding tests completed; and4. Any issues found during the testing.(b) The security system testing log shall be maintained on the premises for a period of at least three (3) years.(c) The security system testing log shall be provided to the Commission or its employees upon request.(5) A dispensing licensee shall ensure that product in final packaged form is stored in a restricted access area separated by tight, floor-to-ceiling-high walls.(6) At any time the dispensary is not open for dispensing, a dispensing licensee shall ensure that: (a) The dispensary is securely locked with commercial-grade, non-residential door locks;(b) All product in final packaged form is locked in a secure storage area;(c) The dispensary is equipped with an active alarm system, which shall be activated when the dispensing licensee employees are not at the dispensary; and(d) Only employees of the dispensing licensee and other authorized individuals are allowed access into restricted access areas of the dispensary. For the purposes of this section, authorized individuals include individuals employed by the dispensing licensee as well as any outside contractors or other individuals conducting business that requires access to the restricted access areas.(7) A dispensing licensee shall ensure the use of secure electronic access and non-residential door locks with the ability to remain operational during a power outage at all restricted access entry and exit points.(8) While inside the dispensary, all dispensing licensee employees shall wear a form of identification that clearly identifies them as such to the public.(9) Employee identification shall contain: (a) The name of the employee;(c) The date of issuance;(d) The expiration date, which shall not exceed the expiration date of the dispensing license;(e) The name of the dispensing licensee;(f) The license number of the dispensing license;(g) An alphanumeric identification number that is unique to the employee;(h) A photographic image of the employee; and(i) Security measures to prevent unauthorized duplication of the identification.(10) Upon termination of an employee, a dispensing licensee shall:(a) Immediately disable the employee's access to any restricted access areas of the dispensing license facility;(b) Immediately disable the employee's access to the Commission-approved tracking system and all other security access systems; and(c) Obtain and destroy the terminated employee's identification within twenty-four (24) hours of termination of employment.(11) A dispensing licensee shall have at least two (2) employees physically present at the dispensary during all hours that the dispensary is open to patients and caregivers.(12) A dispensing licensee shall maintain a daily log of employees for at least three (3) years.(13) Any non-employee, prior to entering a restricted access area, shall obtain a visitor identification badge from management employees of the dispensing licensee. (a) Visitors shall visibly display the badge while in the restricted access area.(b) A dispensing licensee employee shall escort and monitor visitors at all times.(c) A visitor shall return the visitor identification badge to a dispensing licensee's employee upon exiting the dispensary.1. The dispensary shall maintain a current and accurate inventory of all visitor identification badges.2. Any loss of a visitor identification badge shall be documented separately and maintained with the visitor log.(d) The dispensing licensee shall log all visitors in and out, and shall maintain a log that includes the date, time, and purpose of the visit. 1. The log shall retain a photocopy of the government-issued photo identification for each visitor.2. The log shall include the name and identification number of the employee escorting the visitor. 3. The visitor log shall be maintained for at least three (3) years.4. The log shall be made available to the Commission or its employees upon request.(e) Nothing shall prohibit the Commission or its employees, or local, state, or federal law enforcement from entering restricted access areas.(f) All restricted access areas shall have a sign posted on or near the door indicating that access to the area is restricted to employees only.(14) A dispensing licensee shall keep a surveillance equipment maintenance activity log at the dispensary to record all service activity including the identity of any individual performing the service, the service date and time, and the reason for service to the surveillance system.(a) The security equipment maintenance activity log shall be made available to the Commission or its employees upon request.(b) The security equipment maintenance activity log shall be maintained for at least three (3) years.(15) A dispensing licensee shall maintain documentation in an auditable form for a period of at least three (3) years for: (a) Any alarm activation or other event which requires response by public safety employees; and(b) Any unauthorized breach of security.(16) A dispensing licensee shall notify the Commission and its employees as well as the appropriate law enforcement authorities within twenty-four (24) hours after discovering any of the following:(a) Discrepancies identified during inventory reconciliation;(b) Diversion, theft, loss, or any criminal activity pertaining to the operation of the dispensing licensee;(c) Diversion, theft, loss, or any criminal activity by any agent or employee of the dispensing licensee pertaining to the operation of the dispensing licensee;(d) The loss or unauthorized alteration of records related to products, patients, caregivers, or employees or agent of the dispensing licensee; and(e) Any other breach of security.Ga. Comp. R. & Regs. R. 351-6-.03
O.C.G.A. §§ 16-12-203, 16-12-206.
Original Rule entitled "Security" adopted. F. Mar. 16, 2023; eff. Apr. 5, 2023.