N.Y. Comp. Codes R. & Regs. tit. 9 § 113.14

Current through Register Vol. 46, No. 36, September 4, 2024

Section 113.14 - Security Requirements for Manufacturing and Dispensing Sites

(a) All facilities operated by a registered organization, including any manufacturing facility and dispensing site, shall have a security system to prevent and detect diversion, theft or loss of cannabis and/or medical cannabis products, utilizing commercial grade equipment, which shall, at a minimum, include:

(1) a perimeter alarm that communicates with an internal designee and a third-party commercial central monitoring station when intrusion is detected;

(2) video cameras in all areas that may contain cannabis or medical cannabis products, all surveillance areas or rooms and at all points of entry and exit, which shall be appropriate for the normal lighting conditions of the area under surveillance. The manufacturing facility or dispensing site shall direct cameras at all areas where cannabis or medical cannabis product is being handled, stored or disposed. At entry and exit points, the manufacturing facility or dispensing site shall angle cameras to allow for the capture of clear and certain identification of any person entering or exiting the facility;

(3) continuous recordings during hours of operation and at any time that cannabis or medical cannabis product, in any form is handled, and motion activated recordings at all other times, from all video cameras, which the manufacturing facility or dispensing site shall make available via remote access or login credentials for immediate viewing by the Office or the Office's authorized representative upon request and shall be retained for at least sixty (60) days. The registered organization shall provide the Office with an unaltered copy of such recording upon request. If a registered organization is aware of a pending criminal, civil or administrative investigation or legal proceeding for which a recording may contain relevant information, the registered organization shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the registered organization that it is not necessary to retain the recording, but in no event for less than sixty (60) days;

(4) failure notification system that provides an audible text or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to the registered organization's designated representative(s) within five (5) minutes of the failure, either by telephone, e-mail, or text message;

(5) the ability to immediately produce a clear color still photo from any camera image (live or recorded);

(6) a date and time stamp embedded on all recordings. The date and time shall be synchronized and set correctly and shall not significantly obscure the picture; and

(7) the ability for the security alarms and video surveillance system to remain operational during a power outage for a minimum of eight (8) hours.

(b) A registered organization shall limit access to any surveillance areas and keep all on-site surveillance rooms locked. A registered organization shall make available to the Office or the Office's authorized representative, upon request, a current list of authorized employees who have access to any surveillance room.

(c) A registered organization shall keep illuminated the outside perimeter of any manufacturing facility and dispensing site that is operated under the registered organization's registration.

(d) All video recordings shall allow for the exporting of still images in an industry standard image format (including .jpeg, .bmp, and .gif). Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. A registered organization, after receiving approval of the Office, shall erase all recordings prior to disposal or sale of the facility.

(e) A registered organization shall keep all security equipment in full operating order and shall test such equipment no less than semi-annually at each manufacturing facility and dispensing site that is operated under the registered organization's registration. Records of security tests must be maintained for five (5) years and made available to the Office upon request.

(f) The manufacturing facility of the registered organization must be securely locked and protected from unauthorized entry at all times.

(g) All cannabis and medical cannabis products must be stored in a secure area or location within the registered organization manufacturing or dispensing site accessible to the minimum number of employees essential for efficient operation, to prevent diversion, theft or loss.

(h) All medical cannabis must be stored in such a manner as to protect against physical, chemical and microbial contamination and deterioration.

(i) All approved safes, vaults or any other approved equipment or areas used for the manufacturing or storage of cannabis and medical cannabis products must be securely locked or protected from entry, except for the actual time required to remove or replace cannabis or medical cannabis products.

(j) Keys shall not be left in the locks or stored or placed in a location accessible to individuals who are not authorized access to cannabis or manufactured medical cannabis products.

(k) Security measures, such as combination numbers, passwords or biometric security systems, shall not be accessible to individuals other than those specifically authorized to access cannabis or manufactured medical cannabis products.

(l) A registered organization shall ensure the safe and secure transport of any medical cannabis, including the safety of those transporting medical cannabis, and shall:

(1) prior to transporting any medical cannabis, shipping manifest data must be provided to the Office in a manner determined by the Office;

(2) maintain all shipping manifests and make them available to the Office for inspection upon request, for a period of five (5) years;

(3) transport all medical cannabis products in a secure manner that will not compromise the integrity of the products for the duration of the transport;

(4) transport all medical cannabis products directly to the destination(s) and the employee(s) shall not make any unnecessary stops in between;

(5) ensure that all medical cannabis product delivery times are randomized;

(6) ensure transport team members have the ability to communicate with employees at the registered organization at all times that the vehicle contains medical cannabis products; and

(7) ensure transport team members possess a copy of the shipping manifest at all times when transporting or delivering medical cannabis products and shall produce it to the Office, the Office's authorized representative or law enforcement official upon request.

N.Y. Comp. Codes R. & Regs. Tit. 9 § 113.14

Adopted New York State Register February 22, 2023/Volume XLV, Issue 08, eff. 2/22/2023