N.H. Code Admin. R. He-C 402.24

Current through Register No. 16, April 18, 2024

Section He-C 402.24 - Security Requirements

(a) An ATC shall implement security measures to deter and prevent unauthorized entrance into areas containing cannabis or CIP and to prevent diversion, loss, and theft of cannabis or CIP at the ATC or during transport of cannabis or CIP.

(b) Security measures to protect the registered premises, registered qualifying patients, designated caregivers, and agents of the ATC shall include but are not limited to the following:

(1) The ATC shall limit access to the registered premises as described in (c) and (g) below;

(2) The ATC shall establish limited access areas accessible only to specifically authorized personnel, and only the number of employees or ATC agents essential for efficient operation;

(3) The ATC shall dispose of all cannabis waste including unused portions of the plant, contaminated cannabis product, and excess cannabis in accordance with He-C 402.22;

(4) The ATC shall store all finished cannabis in a secure, locked safe, vault, or storage unit in such a manner as to prevent diversion, theft, and loss;

(5) The ATC shall keep all safes, vaults, storage units, and any other equipment or areas used for the production, cultivation, harvesting, processing, or storage of cannabis and CIP securely locked and protected from entry, except for the actual time required to remove or replace cannabis;

(6) The ATC shall keep all locks and security equipment in good working order;

(7) Keys, and other access devices, as applicable, shall not be left in the locks, or stored or placed in a location accessible to persons other than specifically authorized personnel;

(8) The ATC shall prohibit accessibility of security measures, such as combination numbers, passwords, or electronic or biometric security systems, to persons other than specifically authorized personnel;

(9) The outside perimeter of the ATC shall be sufficiently lit to facilitate surveillance;

(10) The ATC shall ensure that trees, bushes, and other foliage outside of the registered premises do not allow for a person or persons to conceal themselves from sight;

(11) The ATC shall develop emergency policies and procedures for securing all product following any instance of diversion, theft, o r loss of cannabis or CIP, and conduct an assessment to determine whether additional safeguards are necessary; and

(12) The ATC shall develop additional safeguards as directed by the department for registered premises or areas of operations that present security concerns.

(c) An ATC shall not permit any person to enter the ATC unless:

(1) Such person is an ATC employee, is on duty, and is visibly displaying his or her badge;

(2) Such person is an ATC volunteer, is on duty, and is visibly displaying his or her badge;

(3) Such person is an ATC agent, not including those in (1) and (2) above, such as a board member or corporate officer, who is logged in, escorted, and is displaying a visitor badge, in accordance with (e) (3) and (f) below;

(4) Such person is a qualifying patient or designated caregiver possessing a registry identification card issued by the department pursuant to He-C 401 and whose access shall be limited to the dispensing are a of the ATC;

(5) Such person is accompanying a qualifying patient while in the dispensing area of the ATC, and who:

a. Shall not be required to be a qualifying patient or a designated caregiver;

b. Shall not be a minor;

c. Shall be required to comply with (e) (3) below, except that the person does not need an individual escort, and (f) below;

d. Shall be subject to the ATC's policy on such visitors, including a policy that may prohibit or otherwise limit such visitors from accessing the ATC; and

e. Shall be the only visitor accompanying the qualifying patient at any one time;

(6) Such person is an outside vendor or contractor whose responsibilities require access to the ATC and then only to the specific areas necessary and for only as long as necessary to perform the person's job duties. For the purposes of this rule, an outside vendor or contractor means an individual who requires temporary access to the registered premises for a specific purpose, such as to perform construction or maintenance, to conduct system repairs or inspection, or to perform employee training;

(7) Such person is authorized by law, rule, or in writing by the commissioner to be in the registered premises;

(8) Such person(s) are emergency responders in the course of responding to an emergency and the ATC documents the names, times, and dates of each responder at the time of the incident or as soon as is practicable after the emergency, as required by the incident report in He-C 402.10(n) ; or

(9) Such person is a prospective ATC employee or volunteer and the reason for entry to the ATC is for interviewing purposes.

(d) The requirements of (c) above shall not be construed to prohibit access to authorized law enforcement personnel or local officials acting within their lawful jurisdiction. For the purpose of this rule, "jurisdiction" means general authority and is not limited to only geographic area.

(e) The ATC shall document:

(1) The dates and times that all agents are either in the registered premises or offsite transporting cannabis or CIP;

(2) The registry identification numbers, dates, and times that all registered qualifying patients and designated caregivers are in the registered premises for either education or purchase of cannabis or CIP;

(3) Access to the registered premises by persons authorized by (c) (2), (3) and (5) -(9), or (d) above, including the name, signature, date, time in and out, purpose of the visit, to include sufficient information to demonstrate compliance with (c) or (d) above, and the name of the employee providing escort;

(4) The signature and employee escort requirements in (3) above shall not apply for emergency responders in the event of a reportable incident; and

(5) The employee escort requirement in (3) above shall not apply for visitors described in (c) (5) above.

(f) For all authorized persons who do not have either a registry identification card issued by the department or an employee or volunteer identification badge issued by the ATC, except for emergency responders in the event of a reportable incident, the ATC shall:

(1) Issue a temporary visitor's badge that shall be worn for the duration of the visit to the ATC and returned prior to exit; and

(2) Provide an ATC employee who shall escort the authorized person(s) at all times while they are in the limited access areas of the registered premises, except that this shall not apply to visitors described in (c) (5) above.

(g) The limited access areas described in (b) (2) above shall be identified by the posting of a sign that shall be a minimum of 12" X 12" and which states: "Do Not Enter - Limited Access Area - Access Limited to Authorized Personnel Only" in lettering no smaller than one inch in height.

(h) An ATC shall have a security system designed to prevent and detect diversion, theft, or loss of cannabis an d unauthorized intrusion, which shall, at a minimum, include:

(1) A perimeter alarm on all entry points and perimeter windows;

(2) A failure notification system that provides an audible, text, or visual notification of any failure in the surveillance system which alerts designated employees of the ATC within 5 minutes after the failure, either by telephone, email, or text message;

(3) A duress alarm, panic alarm, and holdup alarm connected to local public safety or law enforcement authorities or to an alarm monitoring company;

(4) Video cameras in all areas that may contain cannabis, at all points of entry and exit, on the entrance to the video surveillance room, and in any parking lot, which shall be appropriate for the normal lighting conditions of the area under surveillance. The cameras shall be directed at all safes, vaults, sales areas, and areas where cannabis is cultivated, harvested, processed, prepared, stored, handled, or dispensed. Cameras shall be angled so as to allow for the capture of clear and certain identification of any person entering or exiting the ATC or area;

(5) 24-hour recordings from all video cameras that are available for immediate viewing by the department upon request and that are retained for at least 90 calendar days. Recordings shall not be destroyed or altered, and shall be retained as long as necessary if the ATC is made aware of a pending criminal, civil, or administrative investigation, or legal proceeding for which the recording might contain relevant information;

(6) The ability to immediately produce a clear, color, still photo either live or from a recording;

(7) A date and time stamp embedded on all recordings which shall be synchronized, set correctly, and shall not obscure the picture;

(8) A video recording that allows for the exporting of still images in an industry standard image format, including .jpg, .bmp, and .gif. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. All recordings shall be erased or destroyed prior to disposal; and

(9) The functionality that the security system shall remain operational during a power outage.

(i) In addition to the requirements listed in (h) above, each registered premises shall have a backup alarm system that shall detect unauthorized entry during times when the registered premises are closed and that shall be provided by a company which shall not be the same company providing the primary security system.

(j) All security system equipment and recordings shall be maintained in a secure location so as to prevent theft, loss, destruction, and alterations, access to which shall be limited to persons that are essential to security operations, including security system personnel.

(k) A current list of authorized employees and service personnel that have access to the surveillance room shall be available to the department upon request.

(l) All video surveillance records, including recordings of point-of-sale areas, shall be confidential, except that the ATC may provide such records and recordings, with notice to the department, to state or local law enforcement agency(s) acting within their lawful jurisdiction and if requested in connection with a law enforcement investigation or proceeding, or pursuant to a court order, or to the department.

(m) All policies, procedures, practices, plans, and physical layout pertaining to security, and the address of a second site for cultivation and processing if separate from the dispensing location, shall be confidential except that they shall be provided to the department upon request and as otherwise allowed by He-C 402.

(n) All security equipment shall be in good working order and shall be inspected and tested at regular intervals, of at least every 30 calendar days.

(o) Documentation of the inspection and testing in (n) above shall be maintained by the ATC.

(p) At all points of ingress and egress, the ATC shall ensure the use of commercial-grade, non-residential door locks.

(q) ATCs shall develop written security protocols which they shall share with local police department(s) having jurisdiction at the address(es) of the registered premises. The ATC shall document the efforts made to engage local police departments.

N.H. Code Admin. R. He-C 402.24

Adopted byVolume XXXIV Number 50, Filed December 11, 2014, Proposed by #10731, Effective 11/25/2014.

Amended by Volume XXXVIII Number 45, Filed November 8, 2018, Proposed by #12653, Effective 11/1/2018, Expires 11/1/2028.