Iowa Admin. Code r. 641-154.21

Current through Register Vol. 47, No. 6, September 18, 2024

Rule 641-154.21 - Manufacturer and dispensary security requirements

(1)Restricted access. A manufacturer or dispensary shall limit entrance to all restricted areas by completing all of the following:

a. Mark restricted access areas with signs that state: "Do Not Enter-Restricted Access Areas Access Limited to Authorized Personnel Only".

b. Use a controlled access system that:

(1) Limits access to authorized individuals;

(2) Maintains a log of individuals with approved access, including dates of approvals and revocations;

(3) Tracks times of personnel entry to and exit from the facility;

(4) Stores data for retrieval for a minimum of one year; and

(5) Limits access to authorized individuals in the event of a power failure.

c. If the controlled access system cannot electronically record visitors, visitors to restricted access areas sign manifests with name, date, and times of entry and exit. These manifests shall be kept and stored for a minimum of one year.

d. Visitors wear badges that are visible at all times and identify them as visitors.

e. If requested by the department, submit stored controlled access system data to the department within five business days.

(2)Perimeter intrusion detection system.

a.Computer-controlled video surveillance system. A manufacturer or dispensary shall operate and maintain a computer-controlled, closed-circuit television surveillance system on its premises that operates 24 hours per day, seven days per week, and visually records:

(1) All phases of medical cannabidiol production, if applicable;

(2) All areas that might contain plant material, medical cannabidiol, or both;

(3) All points of entry and exit;

(4) The entrance to the video surveillance control room; and

(5) Parking areas, which shall have appropriate lighting for the normal conditions of the area under surveillance.

b.Camera specifications. Cameras shall:

(1) Capture clear and certain identification of any person entering or exiting a manufacturer or dispensary or its parking areas;

(2) Produce a clear, color still photograph live or from a recording;

(3) Have an embedded date-and-time stamp that is synchronized to the recording and does not obscure the picture; and

(4) Continue to operate during a power outage.

c.Video recording specifications. Video recording equipment shall:

(1) Export still images in an industry standard image format, such as .jpg, .bmp, or .gif;

(2) Archive exported video in a format that ensures authentication and guarantees that the recorded image has not been altered; and

(3) Save exported video in an industry standard file format that can be played on a standard computer operating system.

d.Location. A dispensary shall maintain all security system equipment and recordings in a secure location to prevent theft, loss, destruction, corruption, and alterations.

e.Retention. A manufacturer or dispensary shall ensure that recordings from all video cameras are:

(1) Available for viewing by the department upon request;

(2) Retained for at least 60 days; and

(3) Maintained free of alteration or corruption.

f.Required signage. A manufacturer or dispensary shall post a sign in capital letters in a conspicuous location at every entrance to the manufacturing facility or dispensary that reads, "THESE PREMISES ARE UNDER CONSTANT VIDEO SURVEILLANCE."

(3)Security alarm system requirements.

a. A manufacturer or dispensary shall use a professionally monitored security alarm system that provides intrusion and fire detection of all the following:

(1) Dispensary entrances and exits;

(2) Facility entrances and exits;

(3) Rooms with exterior windows;

(4) Rooms with exterior walls;

(5) Roof hatches;

(6) Skylights; and

(7) Storage rooms.

b. A manufacturer or dispensary's security alarm system and all devices shall continue to operate during a power outage.

c. A manufacturer or dispensary shall provide documentation of the annual inspection and device testing, by a qualified alarm vendor, to the department upon request.

(4)Personnel identification system. A manufacturer or dispensary shall use a personnel identification system that controls and monitors individual employee access to restricted access areas.

a. An employee identification card shall contain:

(1) The name of the employee;

(2) The date of issuance and expiration;

(3) An alphanumeric identification number that is unique to the employee; and

(4) A photographic image of the employee.

b. A manufacturer or dispensary's employee shall keep the identification card visible at all times when the employee is in a manufacturing facility, a dispensary, or a vehicle transporting medical cannabidiol.

c. Upon termination or resignation of an employee, a manufacturer or dispensary shall immediately:

(1) Revoke the employee's access to the manufacturing facility or dispensary; and

(2) Destroy the employee's identification card, if possible.

Iowa Admin. Code r. 641-154.21

Adopted by IAB January 31, 2018/Volume XL, Number 16, effective 3/7/2018

Amended by IAB June 6, 2018/Volume XL, Number 25, effective 7/11/2018

Amended by IAB June 5, 2019/Volume XLI, Number 25, effective 7/10/2019

Adopted by IAB July 10, 2024/Volume XLVII, Number 1, effective 8/14/2024