Iowa Admin. Code r. 641-154.42

Current through Regsiter Vol. 46, No. 26, June 12, 2024

Rule 641-154.42 - Security requirements

The department may request assistance from the department of public safety in ensuring dispensaries meet the security requirements in this rule.

(1)Restricted access. A dispensary shall have a controlled access system to limit entrance to all restricted access areas of the dispensary facility. Visitors to restricted access areas shall sign manifests with name, date, and times of entry and exit, if the controlled access system cannot electronically record visitors. Visitors shall wear badges that are visible at all times and identify them as visitors.

a. The controlled access system shall do all of the following:

(1) Limit access to authorized individuals;

(2) Maintain a log of individuals with approved access, including dates of approvals and revocations;

(3) Track times of personnel entry to and exit from restricted access areas;

(4) Store data for retrieval for a minimum of one year; and

(5) Limit access to authorized individuals in the event of a power failure.

b. A dispensary shall promptly, but no later than five business days after receipt of request, submit stored controlled access system data to the department.

c. Separate written manifests of visitors to restricted access areas shall be kept and stored for a minimum of one year if the controlled access system does not include electronic records of visitors to the restricted access areas.

d. Restricted access areas shall be identified with signs that state: "Do Not Enter - Restricted Access Area - Access Limited to Authorized Personnel Only."

(2)Perimeter intrusion detection system.

a.Computer-controlled video surveillance system. A dispensary shall operate and maintain in good working order a computer-controlled, closed-circuit television surveillance system on its premises that operates 24 hours per day, seven days a week, and visually records:

(1) All areas that might contain medical cannabidiol, including all safes, vaults, and storage areas;

(2) All points of entry and exit;

(3) The entrance to the video surveillance control room; and

(4) Parking areas, which shall have appropriate lighting for the normal conditions of the area under surveillance.

b.Camera specifications. Cameras shall:

(1) Capture clear and certain identification of any person entering or exiting a dispensary or its parking areas to the extent identification is technologically feasible with generally accepted commercial security cameras;

(2) Have the ability to produce a clear, color still photograph live or from a recording;

(3) Have on all recordings an embedded date-and-time stamp that is synchronized to the recording and does not obscure the picture; and

(4) Continue to operate during a power outage.

c.Video recording specifications.

(1) A video recording shall export still images in an industry standard image format, such as jpg, .bmp, or .gif

(2) Exported video shall be archived in a format that ensures authentication and guarantees that the recorded image has not been altered.

(3) Exported video shall also be saved in an industry standard file format that can be played on a standard computer operating system.

(4) All recordings shall be erased or destroyed at the end of the retention period and prior to disposal of any storage medium.

d.Additional requirements. A dispensary shall maintain all security system equipment and recordings in a secure location to prevent theft, loss, destruction, corruption, and alterations.

e.Retention. A dispensary shall ensure that recordings from all video cameras are:

(1) Available for viewing by the department upon request;

(2) Retained for at least 60 days;

(3) Maintained free of alteration or corruption; and

(4) Retained longer, as needed, if a dispensary is given actual notice of a pending criminal, civil, or administrative investigation, or other legal proceeding for which the recording may contain relevant information.

f.Required signage. A dispensary shall post a sign in capital letters in a conspicuous location at every entrance to the dispensary that reads, "THESE PREMISES ARE UNDER CONSTANT VIDEO SURVEILLANCE."

(3)Security alarm system requirements.

a. A dispensary shall install and maintain a professionally monitored security alarm system that provides intrusion and fire detection of all:

(1) Dispensary entrances and exits;

(2) Rooms with exterior windows;

(3) Rooms with exterior walls;

(4) Roof hatches;

(5) Skylights; and

(6) Storage rooms.

b. For the purposes of this subrule, a security alarm system means a device or series of devices that summons law enforcement personnel during, or as a result of, an alarm condition. Devices may include:

(1) Hardwired systems and systems interconnected with a radio frequency method such as cellular or private radio signals that emit or transmit a remote or local audio, visual, or electronic signal;

(2) Motion detectors;

(3) Pressure switches;

(4) A duress alarm;

(5) A panic alarm;

(6) A holdup alarm;

(7) An automatic voice dialer; and

(8) A failure notification system that provides an audio, text, or visual notification of any failure in the surveillance system.

c. A dispensary's security alarm system and all devices shall continue to operate during a power outage.

d. A dispensary's security alarm system shall be inspected and all devices tested annually by a qualified alarm vendor. A dispensary shall provide documentation of the annual inspection and device testing to the department upon request.

(4)Personnel identification system. A dispensary shall use a personnel identification system that controls and monitors individual employee access to restricted access areas within the dispensary and that meets the requirements of this subrule and subrule 154.42(1).

a. Requirement for employee identification card. An employee identification card shall contain:

(1) The name of the employee;

(2) The date of issuance and expiration;

(3) An alphanumeric identification number that is unique to the employee; and

(4) A photographic image of the employee.

b. A dispensary's employees shall keep the identification card visible at all times when the employee is in a dispensary or a vehicle transporting medical cannabidiol.

c. Upon termination or resignation of an employee, a dispensary shall immediately:

(1) Revoke the employee's access to restricted access areas of the dispensary; and

(2) Obtain and destroy the employee's identification card, if possible.

Iowa Admin. Code r. 641-154.42

Adopted by IAB January 31, 2018/Volume XL, Number 16, effective 3/7/2018