Mo. Code Regs. tit. 19 § 100-1.090

Current through Register Vol. 49, No. 20, October 15, 2024

Section 19 CSR 100-1.090 - Facility Security

PURPOSE: The Department of Health and Senior Services has the authority to establish security requirements for any premises licensed or certified under Article XIV, Sections 1 and 2 of the Missouri Constitution. This section provides the security requirements of all licensed or certified medical and marijuana facilities.

(1) All medical and marijuana facility licensees shall ensure the security of marijuana product and the facility, including any offsite warehouses, by taking security measures and maintaining security equipment as follows:

(A) Devices or a series of devices to detect unauthorized intrusion, which may include a signal system interconnected with a radio frequency method, such as cellular or private radio signals, or other mechanical or electronic devices;

(B) Except in the case of outdoor cultivation, exterior lighting to facilitate surveillance, which shall cover the exterior of all buildings and the perimeter of the facility; and

(C) Electronic video monitoring, which shall include video cameras with a recording resolution of at least 1920 x 1080p, or the equivalent, capable of recording videos at a rate of at least fifteen (15) frames per second, that operate in such a way as to provide continuous monitoring and allow identification of people and activities in all lighting levels, and that are capable of being accessed remotely at all times by the department or a law enforcement agency in real time.

1. The use of motion detection as a method of continuous monitoring is not permitted where marijuana product is or will be present.

2. Remote access shall be accomplished through https access or another department-approved format.

3. Video cameras must provide coverage of-

A. All facility building entry and exit points, including windows;

B. All areas of the facility and facility premises where marijuana is or will be present;

C. Each point-of-sale location;

D. All vaults or safes where marijuana product is stored;

E. Any area on facility premises, including offsite warehouses and transport vehicles, where a seed-to-sale system or the state-wide track and trace system are accessed;

F. The entire perimeter of the facility, including at least twenty feet (20') of space around the perimeter of an outdoor grow area; and

G. All marijuana product, from at least two (2) angles, where it is grown, cultivated, manufactured, sampled for testing, tested, stored, weighed, packaged, processed for sale, sold/distributed, rendered unusable, disposed, or loaded for transport.

4. All activities subject to video camera monitoring shall occur only in areas of the facility that are covered by the required video monitoring.

5. Licensees shall ensure that each video camera used pursuant to this section-

A. Includes a date and time generator which accurately displays the date and time of recorded events on the recording in a manner that does not significantly obstruct the recorded view;

B. Is installed in a manner that prevents the video camera from being readily obstructed, tampered with, or disabled; and

C. Is cabled and does not solely operate via wifi.

6. Video recording equipment must also include at least one (1) call-up monitor that is at least nineteen inches (19").

7. Facilities must have a printer capable of immediately producing a clear, color, still photo from any video camera image.

8. Licensees shall store recordings from the video cameras for at least sixty (60) days in a secure location or through a service or network that allows for providing copies of the recordings, in a department approved format, upon request and at the expense of the licensee.

A. The licensee shall provide the department with proof of a working storage mechanism upon request of the department and at the expense of the licensee.

B. If the licensee changes its recording storage mechanism, the licensee must provide the department with notification of such change and proof that the new storage mechanism is capable of storing all recordings for at least sixty (60) days within ten (10) days of said change.

C. Video storage must be encrypted.

9. Facilities shall have a failure notification system that provides an audible and visual notification of any failure in the electronic video monitoring system; and

10. Facilities shall have sufficient battery backup for video cameras and recording equipment to support at least sixty (60) minutes of recording in the event of a power outage.

(D) Controlled entry to limited access areas, which shall be controlled by electronic card access systems, biometric identification systems, or other equivalent means, except that, in addition to these means, all external access doors shall be equipped with a locking mechanism that may be used in case of power failure. Access information shall be recorded, and all records of entry shall be maintained for at least one (1) year;

(E) A method of immediate, automatic notification to alert local law enforcement agencies of an unauthorized breach of security at the facility;

(F) Manual, silent alarms affixed at each point-of-sale, reception area, vault, warehouse, and electronic monitoring station with capability of alerting local law enforcement agencies immediately of an unauthorized breach of security at the facility;

(G) Security film or shatter-proof glass on glass doors and storefronts;

(H) If windows are in a limited access area, the windows cannot be opened and must be designed to prevent intrusion or the window is otherwise inaccessible from the outside; and

(I) Vaults must be secured in a manner that prevents access to unauthorized individuals through both physical and electronic security measures.

(2) Facility licensees shall establish and follow policies and procedures-

(A) For restricting access to the areas of the facility that contain marijuana product to only facility agents who are employees, contractors, owners having access to a medical or marijuana facility, and volunteers of the facility. Individuals without an agent identification card may be present when necessary for legitimate business purposes, if they sign in and sign out of a visitor log and are escorted at all times by facility agents in a ratio of no less than one (1) facility agent per five (5) visitors;

(B) For identifying persons authorized to be in the areas of the facility that contain marijuana product;

(C) For identifying facility agents responsible for inventory control activities;

(D) For monitoring the security for the facility;

(E) For the use of the automatic or electronic notification and manual, silent alarms to alert local law enforcement agencies of an unauthorized breach of security at the facility, including designation of on-call facility personnel to respond to, and to be available to law enforcement personnel responding to any alarms; and

(F) For keeping local law enforcement and the department updated on whether the facility employs armed security personnel and how those personnel can be identified on sight.

(3) Medical and marijuana facility licensees with outdoor or greenhouse cultivation spaces, or cultivation or manufacturing facilities with multiple buildings in which cultivation or manufacturing are conducted, shall construct an exterior barrier around the perimeter of the facility that consists of a fence-

(A) Constructed of nine (9) gauge metal or stronger chain link;

(B) That is at least eight (8) feet in height from the ground to the top of the fence;

(C) Topped with razor wire or similar security wire along the entire length of the fence;

(D) Screened such that an outdoor cultivation area is not easily viewed from outside the fence; and

(E) That includes a secured gate that complies with the same security standards as the fence, as well as a method for controlling access through the gate.

(4) For any planned security outage, the licensee shall notify the department at least twenty-four (24) hours prior to the planned outage and provide a plan for facility and product security during the outage. For a planned security outage occurring in fewer than twenty-four (24) hours, the licensee shall notify the department as soon as a security issue requiring an outage is discovered.

(5) Licensees shall notify the department within twenty-four (24) hours after a security system malfunction is discovered and shall make a reasonable effort to repair a malfunction of any security equipment within seventy-two (72) hours after the malfunction is discovered.

(A) A malfunction occurs when any piece of security equipment fails to work as designed or intended, for more than sixty (60) seconds, either through defect, power outage, security breach, internet outage, compromise, or other reason.

(B) If the electronic video monitoring used pursuant to this section malfunctions, the licensee shall immediately provide alternative video camera coverage or use other security measures until video camera coverage can be restored, such as assigning additional supervisory or security personnel, to provide for the security of the facility. If the licensee uses other security measures, the licensee must immediately notify the department.

(C) Each licensee shall maintain a log that documents each malfunction and repair of the security equipment of the facility. The log must state the date, time, and nature of each malfunction; the efforts taken to repair the malfunction and the date of each effort; the reason for any delay in repairing the malfunction; the date the malfunction is repaired and; if applicable, any alternative security measures that were taken. The log must list, by date and time, all communications with the department concerning each malfunction and corrective action. The facility shall maintain the log for at least one (1) year after the date of last entry in the log.

(6) Each licensee shall employ a security manager who shall be responsible for-

(A) Conducting a semi-annual audit of all security measures.

1. The semi-annual audit shall be an evaluation of the security of the facility, including warehouses, equipment, procedures, and training, as well as the facility's compliance with this rule.

2. Audits shall take place at least five (5) months apart.

3. Security audit records shall be kept for at least five (5) years;

(B) Training employees on security measures, emergency response, and theft prevention and response within one (1) week of hiring and on an annual basis;

(C) Evaluating the credentials of any contractors or other individuals who intend to provide services to the facility before the contractor or individual is hired by or enters into a contract with the licensee; and

(D) Evaluating the credentials of any third party who intends to provide security to the facility before the third party is hired by or enters into a contract with the facility.

(7) Each licensee shall ensure that the security manager of the facility, any facility agents who provide security for the facility, and the employees of any third party who provides security to the facility have completed the following training:

(A) Training in theft prevention or a related subject;

(B) Training in emergency response or a related subject;

(C) Training in the appropriate use of force or a related subject that covers when the use of force is and is not necessary;

(D) Training in the protection of a crime scene or a related subject;

(E) Training in the control of access to protected areas of a facility or a related subject;

(F) Not fewer than eight (8) hours of training at the facility in providing security services; and

(G) Not fewer than eight (8) hours of classroom training in providing security services.

19 CSR 100-1.090

Adopted by Missouri Register March 1, 2023/Volume 48, Number 5, effective 2/3/2023

Amended by Missouri Register June 15, 2023/Volume 48, Number 12, effective 7/31/2023