Section 3796:6-3-16 - Monitoring, surveillance, and security requirements(A) All licensed dispensaries shall maintain security policies and procedures that include, but are not limited to: (1) A security plan with protocols for patient, caregiver, and employee safety and management and security of medical marijuana and currency;(2) Restricted access to the areas in the dispensary that contain medical marijuana to authorized employees;(3) Identification of authorized employees through means including current employee identification card in the employee's immediate possession whenever the employee is present at the dispensary;(4) Controlled access and prevention of loitering both inside and outside of the facility;(5) Conducting electronic monitoring;(6) Use of a panic button; and(7) Prepares for, protects against, and addresses how to handle any crisis that affects the security or operation of a dispensary in the event of strike, fire, flood or other natural disaster, or other situations of local, state or national emergency.(B) All licensed dispensaries shall implement security measures to protect the premises, patients, caregivers and employees, including the following measures: (1) The dispensary department shall be accessible to patients and caregivers, dispensary employees, service professionals conducting business with the dispensary and who are escorted and supervised by a dispensary employee, and other persons authorized by Chapter 3796. of the Revised Code and this division. To prevent unauthorized access to the dispensary department, establish a locked door or barrier between the facility's entrance and the dispensary department.(2) Post a sign at all entry ways into any area of the dispensary containing medical marijuana, including a room with an approved vault, which sign shall be a minimum of twelve inches in height and twelve inches in width and shall state: "Do Not Enter - Restricted Access Area - Access Restricted to Authorized Employees Only." In lettering no smaller than one-half inch in height.(3) Maintenance of a supply of medical marijuana that is not more than the quantity required for normal, efficient operation;(4) Prevent individuals from remaining on the premises if they are not engaging in authorized activities under Chapter 3796. of the Revised Code or this division;(5) Develop a policy that addresses the maximum capacity and patient flow in the waiting rooms, dispensary department, and patient care areas;(6) Dispose of medical marijuana in accordance with this division;(7) During hours of operation, store all medical marijuana in established restricted access areas accessible only to authorized employees. The minimum number of dispensary employees necessary for efficient operations shall be in the restricted access area;(8) Keep all safes, vaults and any other equipment or medical marijuana storage areas securely locked and protected from unauthorized entry. The vault shall have dual authentication or biometric access with a unique code for each employee. A safe exclusively used for storage of currency, with separate access controls, shall be maintained in the product vault;(9) Keep a daily log of dispensary employees with access to the safe or vault and knowledge of the access code or combination, and records of all employee access to any restricted access areas;(10) Keep all locks and security equipment in good working order. All security equipment must be inspected and tested at regular intervals, not to exceed thirty calendar days from the previous inspection and test to ensure the systems remain functional. A dispensary must maintain a log documenting such inspections and tests;(11) Prohibit keys, if applicable, from being left in locks or stored or placed in a location accessible to persons other than specifically authorized personnel;(12) Prohibit accessibility of security measures, including combination numbers, passwords or electronic or biometric security systems to persons other than persons specifically authorized in accordance with this division;(13) Ensure that trees, bushes and other foliage outside of the dispensary do not allow for a person to conceal themselves from sight;(14) Develop emergency policies and procedures for securing all product and currency following any instance of diversion, theft or loss of medical marijuana, and conduct an assessment to determine whether additional safeguards are necessary;(15) Employ dedicated on-site security personnel during all operational hours who shall only perform tasks related to security operations and have foundational training specific to security; and(16) Develop sufficient additional safeguards in response to any special security concerns, or as required by the state board of pharmacy.(C) The state board of pharmacy may request or approve alternate security provisions that it determines are an adequate substitute for a security measure specified in this rule. Any additional protections may be considered by the state board of pharmacy in evaluating overall security measures.(D) When physical security controls become inadequate because of such items as a significant increase in the quantity of medical marijuana, the physical controls shall be expanded and extended accordingly.(E) All licensed dispensaries shall have a security system that is operational at all times and that uses commercial grade equipment to prevent and detect diversion, theft, or loss of medical marijuana, including:(3) Video cameras in all areas, unless prohibited by law, including all points of entry and exit from the dispensary, the dispensary department, and restricted access areas which shall be appropriate for the normal lighting conditions of the area under surveillance, so as to allow for the capture of clear and certain identification of any person located in the surveillance area. Such surveillance shall be sufficient to distinctly view the entire area under surveillance;(4) A video camera or cameras recording at each point of sale location allowing for the identification of the dispensary employee dispensing the medical marijuana and any patient or caregiver purchasing the medical marijuana. The camera or cameras shall capture the sale, the individuals and the computer monitors used for the sale;(5) A minimum of one height strip camera at any public entrance or exit to the dispensary;(6) In accordance with rule 3796:6-3-04 of the Administrative Code, a minimum of constant streaming from all video cameras during hours when a dispensary is closed;(7) Recording from all video cameras during hours of operation, which the dispensary shall make available for immediate viewing by the state board of pharmacy or the board's authorized representative upon request and shall be retained for at least six months. (a) Unaltered copies of such recordings shall be made available upon request;(b) If a dispensary knows or should know of a pending criminal, civil, or administrative investigation or legal proceeding for which a recording may contain relevant information, the registered organization shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the dispensary that it is not necessary to retain the recording.(8) A duress alarm, which for purposes of this rule means a silent security alarm system signal generated by the entry of a designated code into an arming station to signal that the alarm user is being forced to turn off the system;(9) A panic alarm, which for purposes of this section, means an audible security alarm system signal generated by the manual activation of a device intended to signal a life threatening event or emergency requiring a law enforcement response;(10) A holdup alarm, which for purposes of this section, means a silent alarm signal generated by the manual activation of a device intended to signal a robbery in progress;(11) An automatic voice dialer, which for purposes of this section means any electrical, electronic, mechanical, or other device capable of being programmed to send a prerecorded voice message, when activated, over a telephone line, radio or other communication system, to a law enforcement, public safety or emergency services agency requesting dispatch;(12) A failure notification system that provides an audible, text or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to the dispensary within five minutes of the failure, either by telephone, email, or text message;(13) The ability to immediately produce a clear color still photo that is a minimum of ninety-six hundred dpi from any camera image, either live or recorded. All cameras shall be capable of capturing at least thirty frames per second;(14) A date and time stamp embedded on all recordings. The date and time shall be synchronized and set correctly and shall not significantly obscure the picture;(15) The ability to remain operational during a power outage and ensure that all access doors are not solely controlled by an electronic access panel to ensure that locks are not released during a power outage; and(16) All video surveillance equipment shall allow for the exporting of still images in an industry standard image format, including .jpg, .bmp, and .gif. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be in an industry standard file format that can be played on a standard computer operating system. All recordings shall be erased or destroyed prior to disposal.(F) A surveillance system at a dispensary shall have electronic monitoring capacity including:(1) Monitors that are each at least nineteen inches or greater;(2) A video printer capable of immediately producing a clear still photo from any video image; and(3) A failure notification system that provides an audible and visual notification of any failure in the electronic monitoring system.(G) All surveillance systems at a dispensary shall comply with the requirements herein and shall provide secure access and secure override access for the system to the state board of pharmacy in a manner suitable to the board. At any time and without notice, the dispensary surveillance system, and its component parts, shall be subject to testing by the state board of pharmacy. Each surveillance camera must be programed with a defined home position that remains consistent when a surveillance system is restarted. The defined home position feature must remain enabled at all times and allow for automatic return to the home position.(H) If dispensary premises present special security issues, such as an extremely large stock of medical marijuana, exposed handling or unusual vulnerability to diversion, theft or loss, the state board of pharmacy may require additional safeguards, including, but not limited to, a supervised watchman service.(I) If diversion, theft or loss of medical marijuana has occurred from a dispensary, the state board of pharmacy shall review and approve the improvements in the appropriate storage and security requirements for all medical marijuana in such dispensary and may require additional safeguards to ensure security of the medical marijuana.(J) Preventive maintenance must be performed on a dispensary's surveillance system at least annually by a vendor approved by the state board of pharmacy.Ohio Admin. Code 3796:6-3-16
Effective: 10/31/2024
Five Year Review (FYR) Dates: 8/5/2024
Promulgated Under: 119.03
Statutory Authority: 3796.04
Rule Amplifies: 3796.04
Prior Effective Dates: 09/08/2017, 07/11/2022