Current through Vol. 42, No. 3, October 15, 2024
Section 442:10-11-1 - [Effective 9/14/2025] Standards and requirements to achieve process validation(a)Purpose. The Authority is authorized to establish process validation requirements. Process validation shall be voluntary, and no licensee shall be required to validate their process.(b)Definitions. The following words and terms, when used in this Subchapter, shall have the following meaning, unless the context clearly indicates otherwise: (1)"Certified Process Validation Testing Laboratory" means a testing laboratory certified by the Authority to conduct testing and research on samples of medical marijuana and medical marijuana products for medical marijuana businesses pursuing or operating under process validation.(2)"Process change" means any alteration or modification to a process that previously underwent process validation and has the potential to affect the quality, safety, or integrity of a final product. This includes, but is not limited to, changes in raw material sources or suppliers, alterations in equipment type, scale, or location, modifications in process parameters, methods, or procedures, implementation of new technologies or techniques, changes in the facility or environment where the process occurs, or alterations in the sequence, duration, or conditions of process steps.(3)"Process validated" means a licensed medical marijuana business operating in accordance with this Subchapter.(4)"Process validation" means the documented data and objective evidence that a particular process, when operated according to standard operating procedures, will consistently produce medical marijuana and medical marijuana products that meet predetermined quality attributes and specifications and are adequate for an intended use.(5)"Process Validation Report" means a document that provides a detailed account of the approach, intentions, and activities to be conducted during a validation activity and the results and findings from a validation activity.(6)"Process validation self-assessment" means a systematic evaluation tool provided by the Authority, designed to allow medical marijuana businesses to assess and quantify their adherence to the requirements in this Subchapter.(7)"Process verification" means the continual and documented monitoring, evaluation, and/or assessment of whether or not a particular process complies with these Rules and a medical marijuana licensee's standard operating procedures.(8)"Standard operating procedures" or "SOPs" means written procedures produced by a medical marijuana licensee that provides detailed instructions on how to perform activities to ensure consistency, quality, and safety of medical marijuana and medical marijuana products and demonstrates compliance with Oklahoma law and these Rules.(c)General requirements. Licensees seeking to achieve process validation and licensees maintaining process validation must meet the ongoing requirements listed below. (1)Applicable laws apply. Licensees must comply with all requirements of Oklahoma law and these Rules in addition to any additional requirements to operate under process validation.(2)Seed to sale tracking system. All licensees must track their marijuana and marijuana product inventory with the Authority's designated seed-to-sale system. This requirement for compliance with the seed-to-sale system shall be mandatory for licensees seeking to achieve process validation whether or not compliance with a seed-to-sale system is mandatory for all licensees.(3)Initial requirements to achieve process validation. Licensees seeking to achieve process validation must submit every harvest batch or production batch for testing to a Certified Process Validation Testing Laboratory and must successfully pass all required testing with no failures over a three (3) month period.(4)Ongoing requirements to maintain process validation. Licensees maintaining process validation must continue to submit every harvest batch or production batch for testing to a Certified Process Validation Testing Laboratory and must successfully pass all required testing with no failures. Any testing failures under process validation will require the licensee to revalidate the process. Licensees shall immediately notify the Authority in the manner and form prescribed by the Authority on its website and shall submit a copy of the COA to the Authority within two (2) business days. Further, the licensee must perform and document a corrective action and preventative action (CAPA) investigation to determine the root cause of the failure. The report shall be made available to the Authority upon request.(5)Process validated laboratory. Licensees seeking to achieve process validation and licensees maintaining process validation must use and report results from a laboratory that is certified as a Certified Process Validation Testing Laboratory.(6)Required programs and standard operating procedures. Licensees must utilize a Quality Management System (QMS) based on consensus standards generated by entities such as ASTM International or the International Organization for Standardization (ISO) relevant to this process validation program. Licensees seeking to achieve process validation and licensees maintaining process validation shall implement, document, and adhere to the following programs as part of the licensee's standard operating procedures: (A) Implement and maintain a Quality Management System (QMS) documented in a quality manual that outlines the medical marijuana licensee's commitment to quality and serves as a reference guide for all quality-related activities focused on ensuring consistency in medical marijuana and medical marijuana product quality. (i) A formal quality policy statement expressing the organizational commitment to quality;(ii) Specific, measurable quality objectives aligned with the quality policy, aiming to ensure continuous improvement in product quality and operational efficiency;(iii) A clear depiction of the organizational hierarchy, detailing roles and responsibilities related to quality management and process validation;(iv) Procedures for an annual management review meeting to assess the effectiveness of the quality management system, discuss any non-conformities, and set directions for future improvements; and(v) Mechanisms for identifying opportunities for improvements, implementing changes, and monitoring their effectiveness.(B) Employee training program, including, but not limited to: (i) A structured program that ensures all employees are adequately trained on their specific roles, quality principles, hygiene and sanitation practices, and any other relevant topics;(ii) Initial and annual ongoing training requirements for all employees that at a minimum, include training on specific job responsibilities, emergency response and safety protocols, all the programs described in these Rules, and any other training required by these Rules;(iii) Procedures for evaluating training to gauge the effectiveness of the training, including, but not limited to, training quizzes and shadowing by trained employees; and(iv) Documentation of all training sessions, including attendees, trainers, topics covered, and date of training.(C) Recordkeeping, record retention, and document control program including, but not limited to: (i) A master list of documents related to process validation, including, but not limited to, document titles, version numbers, and dates of revision for all documents;(ii) Procedures for accurately maintaining all records and documents related to product quality and compliance with these Rules, ensuring they are easily retrievable, and protected from unauthorized alterations;(iii) Procedures for approving documents;(iv) Defined retention periods for record retention for each type of record, indicating compliance with Oklahoma law and these Rules;(v) Protocols and naming conventions for naming documents to ensure consistency and ease of identification; and(vi) Procedures for document revisions and tracking document versions, ensuring that only the latest and approved version is in use.(D) Disease and foreign material control program, including, but not limited to:(i) Detailed policies on personal hygiene, including but not limited to, handwashing, grooming, and attire for employees and visitors;(ii) Procedures for the use of personal protective equipment for employees and visitors;(iii) Protocols for employees to report illnesses, ensuring they are relieved from duties that might risk contamination; and(iv) Implemented measures to prevent contamination from foreign materials, including, but not limited to, regular inspections, use of sieves/filters, and metal detectors.(E) Equipment program, including, but not limited to:(i) A master list of equipment;(ii) A defined system for equipment identification;(iii) Equipment calibration protocols, including frequency of calibrations;(iv) Equipment installation protocols, including documented procedures and appropriate records for verifying the equipment against the manufacturer's specifications including, but not limited to, model, capacity, checking for the presence and completeness of all equipment components and accessories, ensuring the equipment is installed in an appropriate environment including, but not limited to, clean and temperature-controlled, confirming that all necessary utility connections including, but not limited to, electrical and water are available and correctly set up, reviewing and storing equipment manuals, schematics, and installation instructions, and documenting any deviations or issues identified during installation and their resolutions;(v) Operational check protocols, including procedures and appropriate records for verifying that all safety features and alarms are functional, testing the equipment under different settings to ensure it operates within the defined limits, confirming that the equipment can achieve and maintain required operational parameters including, but not limited to, temperature and pressure, documenting the equipment's response to potential failures or interruptions including, but not limited to, power outage, and recording any deviations or inconsistencies in operation and their resolutions;(vi) Performance verification protocols, including procedures and appropriate records for running the equipment using actual or simulated materials to mimic real production scenarios, monitor and document key output parameters to ensure they meet the required specifications including, but not limited to, weight, conducting repeated runs to verify the consistency of the equipment's performance over time, and documenting any deviations in performance and their resolutions;(vii) Equipment preventive maintenance and repair protocols with a preventive maintenance schedule; and(viii) Documentation of all equipment-related activities.(F) Sanitation program, including but not limited to:(i) The cleaning and sanitation procedures for all equipment, tools, and facilities to ensure that all areas are free from potential contaminants and operate under hygienic conditions;(ii) A defined frequency for cleaning and sanitation tasks;(iii) A list of approved cleaning agents and sanitizers; and(iv) Protocols for cleaning verification and validation.(G) Environmental monitoring program that describes a system to regularly monitor and document environmental conditions to ensure conditions remain appropriate and consistent, including, but not limited to:(i) Procedures for regular monitoring of environmental conditions such as temperature, humidity, and potential contaminants, including frequency of monitoring;(ii) Use of calibrated instruments for monitoring, with defined frequency for calibration;(iii) Defined environmental monitoring alert limits and environmental monitoring action limits to indicate there may be something going wrong within the environment that are based on trend analysis, risk assessment, standards, and/or regulatory requirements in these Rules. For the purposes of this section, "environmental monitoring action limit" means a predetermined threshold that signifies a process has deviated from its accepted operating range and corrective action(s) must be taken and documented to restore the process to its normal state. For the purposes of this section, "environmental monitoring alert limit" means a predetermined threshold that serves as an early indication of a drift from normal environmental conditions, which, when exceeded, results in increased attention;(iv) Procedures for corrective actions when alert or action limits are exceeded; and(v) Documentation and trending of environmental monitoring data.(H) Supplier qualification program, including, but not limited to:(i) Procedures for initial assessment and approval of suppliers, including, but not limited to, audits, sample testing, and regular reviews of supplier performance, to meet the medical marijuana business's quality specifications and comply with these Rules;(ii) Defined criteria and frequency for evaluating suppliers' quality systems and historical performance; and(iii) Documentation of supplier performance and any corrective actions taken when supplier issues arise.(I) Raw materials, ingredients, and final product qualification program, including, but not limited to: (i) Protocols for inspecting and testing raw materials and ingredients upon receipt, as well as the final product before transfer;(ii) Defined quality attributes and specifications for raw materials, ingredients, and final products;(iii) Procedures for quarantine, approval, or rejection of raw materials, ingredients, and final products; and(iv) Documentation of all inspections, tests, and decisions.(J) Corrective and preventive action (CAPA) program that provides a systematic approach to investigate, address, and prevent issues related to product quality or safety, including, but not limited to:(i) Procedures to identify, document, and address quality or safety issues;(ii) Description of root cause analysis techniques that may be used to determine underlying causes of issues;(iii) Defined procedures for implementing corrective actions and verifying their effectiveness to ensure that corrective actions prevent recurrence; and(iv) Documentation and trending of all CAPA activities.(K) Batch records program, including, but not limited to: (i) Procedures for each stage of production or processing;(ii) Traceability records for raw materials and ingredients used in each batch;(iii) Procedures for reviewing and approving batch records; and(iv) Procedures for archiving and retrieving batch records.(L) Packaging and labeling program, including, but not limited to:(i) Detailed step-by-step procedures for packaging and labeling and verifying packaging and labeling to ensure that final products are packaged under sanitary conditions and the labels provide accurate, compliant information that adheres to these Rules; and(ii) Procedures for label control, including but not limited to storage, issuance, and reconciliation.(M) Waste program, including, but not limited to: (i) Defined categories of waste, including but not limited to waste disposal requirements of Oklahoma law and these Rules;(ii) Protocols for segregating, storing, and disposing of waste, minimizing contamination risks, and ensuring compliance with these Rules;(iii) Procedures for treating or decontaminating waste, if applicable; and(iv) Documentation of all waste disposal including but not limited to documents from licensed medical marijuana waste disposal facilities, disposal logs required under OAC 442:10-5-10, and authorized industrial waste disposal entities.(N) Storage program, including, but not limited to:(i) Protocols for ensuring compliance with these Rules and the proper storage of raw materials, chemicals, ingredients, in-process products, final products, and retained samples. This shall include temperature and humidity controls, where appropriate, approaches to protect stored materials and products from contaminants, and approaches to minimize safety hazards;(ii) Protocols for stock rotation, such as First In, First Out (FIFO) and First Expired, First Out (FEFO); and(iii) Measures to protect stored items from contamination, pests, and theft.(O) Transport and shipping program, including, but not limited to:(i) Procedures to ensure products are transported under conditions that maintain their quality, safety, and compliance with these Rules. This shall include considerations for temperature control, protection from contamination, and secure packaging;(ii) Use of validated shipping containers or systems; and(iii) Documentation of transport and shipping, including any deviations or issues.(7)Process Validation Report. Licensees shall annually submit to the Authority a detailed Process Validation Report outlining the approach, intentions, and activities conducted during process validation and any results and findings. The Process Validation Report shall include, but is not limited to, the following: (A) Introduction, including, but not limited to, the purpose of the process validation, a brief description of the processes being validated, and the scope of the process validation;(B) Process validation team, including the list of employees involved in the process validation and their roles and responsibilities;(C) Equipment, including, but not limited to, a list of equipment and instruments used and calibration and maintenance records for equipment;(D) Process descriptions, including, but not limited to, detailed step-by-step description of each process that is required to produce final products. This includes, but is not limited to, all the processes within the programs described in this subchapter;(E) Protocol, including, but not limited to, pre-defined criteria and methods for conducting process validation, sampling plans, including sample size, sampling points, and frequency, and acceptance criteria for each validation activity, prescribed by these Rules and the medical marijuana business's standard operating procedures;(F) Results, including, but not limited to, detailed results from each validation activity, data, graphs, charts, and/or other relevant evidence, comparison of results against acceptance criteria;(G) Deviations and corrective actions, including, but not limited to, a list of deviations, nonconformances, or anomalies observed during validation activities, root cause analysis for each deviation, corrective actions taken, and their outcomes;(H) Risk assessment, including, but not limited to, a list of identified sources of potential risks from equipment, chemicals, work processes, human behaviors, or other sources, an evaluation of the likelihood each risk will lead to harm and the severity of the impact if the risk could lead to harm, a list of implemented measures to eliminate or reduce the risk, and procedures for how these measures will be monitored, recorded, and reviewed for continuous improvement;(I) Quality attributes and specifications, including, but not limited to, references to where the medical marijuana business's quality attributes and specifications are listed in their standard operating procedures and examples of actual results from approved raw materials, ingredients, and final products compared with specifications. Specifications serve as the criteria that describe the acceptable limits for the quality attributes. For the purposes of this section, "quality attributes" means the desired physical, chemical, biological, or microbiological properties or characteristics medical marijuana and medical marijuana products should have to ensure quality. For the purposes of this section, "specification" means any requirement with which a process, ingredient, medical marijuana, or medical marijuana product must conform, including but not limited to, the requirements set forth in these Rules and those written in a medical marijuana licensee's standard operating procedures;(J) Process verification, including, but not limited to, procedures for how the medical marijuana business will conduct process verification activities along with their frequency, monitoring parameters, and acceptance criteria;(K) Conclusion, including, but not limited to, a summary of the process validation results, a statement on whether the processes were successfully validated, and plans for any improvements or changes, if applicable;(L) Attachments, including, but not limited to, raw data, calibration certificates, equipment manuals, testing results, and other relevant documents that supply information and evidence of process validation; and(M) Approval and sign-off, including signatures of the validation team and management with dates confirming the accuracy and completeness of the report.(8)Process validation self-assessment or third-party good manufacturing practices certification. Licensees must submit annually to the Authority at least one of the following: (A) A process validation self-assessment, provided by the Authority, to determine the licensee's compliance with process validation requirements. For successful completion of the process validation self-assessment, licensees must achieve a score indicating eighty percent (80%) adherence or higher, in addition to adhering to the other requirements in this subchapter. The process validation self-assessment shall be submitted with any new or renewal process validation applications and must detail any corrective and preventive action taken or planned and any areas of non-compliance, if identified(B) A Good Manufacturing Practices certification document from a certification body that is ISO 17021-1:2015 or ISO 17065:2012 accredited, recognized by the International Accreditation Forum (IAF), and approved by the Authority. The certification document shall be submitted with the audit report, the medical marijuana licensee's responses to deficiencies, and associated corrective and preventive action documentation, if applicable.(d)Application.(1)Application fee. The nonrefundable, annual registration fee of Five Thousand Dollars ($5,000.00) per licensee is in addition to any other fees due by the licensee.(2)Submission. Applications for a licensee to achieve process validation shall be on the Authority prescribed form and shall include the following information about the licensee: (A) Name of the establishment;(B) Physical address of the establishment, including the county in which any licensed premises will be located;(C) GPS coordinates of the establishment;(D) Phone number and email of the establishment; and(E) Hours of operation for any licensed premises.(3)Supporting documentation. Each application for process validation shall be accompanied by the following documentation:(A) Accreditation documentation, including documentation of enrollment in analyte specific proficiency testing results, showing applicants meet requirements stated in these Rules;(B) Standard operating procedures, policies, protocol or procedures for receipt, handling, and disposition of samples of usable marijuana, as well as documented proof of required programs and standard operating procedures required by this subchapter;(C) Documented compliance with required programs and standard operating procedures pursuant to OAC 10-11-1(c)(6);(D) Process Validation report;(E) Process validation self-assessment or third-party good manufacturing practices certification;(F) If applicable, reference standards, sample analysis procedures, and documentation demonstrating that the analytical methods used by the laboratory are appropriate for their intended purpose;(G) Policies for data recording, review, storage, and reporting and record retention requirements; and(H) Any further documentation or information the Authority determines is necessary to ensure the applicant is qualified under Oklahoma law and these Rules.(4)Incomplete application. Failure to submit a complete application with all required information and documentation shall result in a rejection of the application. The Authority shall notify the applicant via email through the electronic application account of the reasons for the rejection.(e)Record retention requirements. Licensees must establish document retention policies and shall keep all records and documents related to their process validation ready and accessible at the address listed on their marijuana business license for inspection or audit by the Authority.(1) Records shall be maintained by the licensee for as long as the licensee is continuing to operate under that validated process.(2) Licensees shall retain all such documents and records for at least four (4) years after the licensee has stopped using the validated process or after the licensee has made a significant process change to a validated process. Any significant process change to the validated processes of a licensee is subject to the same document retention requirements and shall be retained for as long as the significant process change is part of an ongoing validated process, and for at least four (4) years after the licensee has stopped using the validated process or after the licensee has made a subsequent significant process change to the validated process.(3) Records shall be maintained of all inspection, maintenance, testing, and calibrating operations. These records shall include the date of the operation, the person who performed it, the written procedure used, and any deviations from the written procedure. All deviations must be reviewed and approved in writing by the medical laboratory director.(f)Biannual inspections.(1) Submission of an application to operate under process validation constitutes permission for entry to and inspection of any licensed premises and any vehicles on the licensed premises used for the transportation of medical marijuana and medical marijuana products during hours of operation and other reasonable times. Refusal to permit or impeding such entry or inspection shall constitute grounds for administrative penalties, which may include but are not limited to fines as set forth in Appendix C and the nonrenewal, suspension, and/or revocation of a license.(2) Licensees shall be subject to biannual inspections by the Authority that include random testing of products being produced under process validation. The Authority shall obtain the random sample during the biannual inspections and take samples to the quality assurance laboratory. The Authority shall have access to all products being produced or grown under process validation.(3) The Authority may review any and all records of a licensee and may require and conduct interviews with such persons or entities and persons affiliated with such entities, for the purpose of determining compliance with Authority Rules and applicable laws. Failure to make documents or other requested information available to the Authority and/or refusal to appear or cooperate with an interview shall constitute grounds for administrative penalties, which may include, but are not limited to, fines as set forth in Appendix C and the denial, nonrenewal, suspension, and/or revocation of a license. All records shall be kept on-site and readily available.(g)Certified Process Validation Testing Laboratory. A testing laboratory may apply to be certified as a Certified Process Validation Testing Laboratory to conduct testing for licensees pursuing or operating under process validation. (1) Accreditation. Testing laboratories seeking to be a Certified Process Validation Testing Laboratory must be accredited by or have made application for accreditation to ANSI/ASQ National Accreditation Board, American Association for Laboratory Accreditation (A2LA), Perry Johnson Laboratory Accreditation (PJLA), or any other accrediting entity using the ISO/IEC Standard 17025. Accreditation or application for accreditation must be from one of these entities in both chemistry and biology or cannabis.(2) Laboratories seeking to become a certified Process Validation Testing Laboratory must, in addition to all other requirements to achieve and maintain process validation required under this subchapter, Oklahoma law and these Rules: (A) Conform to ASTM International Standard D8244-21a: Standard Guide for Analytical Laboratory Operations Supporting the Cannabis/Hemp Industry and demonstrate conformance by submitting at least one of the following:(i) A Certified Process Validation Testing Laboratory self-assessment, provided by the Authority, to determine the licensee's percentage of compliance with ASTM International Standard D8244-21a. For successful completion of the self-assessment, a testing laboratory must achieve a score indicating eighty percent (80%) adherence or higher, in addition to adhering to the other requirements in Oklahoma law and these rules. The self-assessment shall be submitted with associated documentation detailing any corrective and preventive action taken or planned, if areas of non-compliance are identified.(ii) A certification document demonstrating conformance to ASTM International Standard D8244-21a from a certification body that is ISO 17021-1:2015 accredited and approved by the Authority. The certification document shall be submitted with the audit report, the testing laboratory's responses to deficiencies, and associated corrective and preventive action documentation, if applicable.(B) Follow ASTM International's D8282-19: Standard Practice for Laboratory Test Method Validation and Method Development to validate test methods that will be used to test samples of final products produced under process validation.(C) At a minimum, pass five (5) consecutive blind proficiency tests administered by the quality assurance laboratory without a failure over the course of six (6) months.(h)Revocation of process validation certification. The Authority may revoke the certification of licensees to operate under process validation or revoke the certification of a testing laboratory that is seeking to operate or operating as a Certified Process Validation Testing Laboratory.(i)Surrender of process validation certification. A licensee operating under process validation may voluntarily surrender their authority to operate under process validation to the Authority at any time. If a licensee voluntarily surrenders their certification to operate under process validation, the licensee shall: (A) Submit on a form prescribed by the Authority a report to the Authority including the reason for surrendering their certification to operate under process validation; the effective date of surrendering their certification to operate under process validation; and where all records required under this subsection will be retained;(B) Submit proof of the licensee's identity through submission of documentation identified in OAC 442:10-1-7 (relating to Proof of Identity); and(C) Comply with all appliable requirements of Oklahoma law and these Rules as it relates to medical marijuana businesses not seeking or operating under process validation.(j)Penalties. A licensee's failure to timely comply with the provisions of this subsection and/or provide required information and documentation to the Authority may result in revocation, suspension, and monetary penalties, in addition to any other penalties established by Oklahoma law and these Rules.(1) Punishment for violations of process validation that, at a minimum, would prohibit a licensee from operating under process validation for five (5) years and the assessment of a fine not to exceed Fifty Thousand Dollars ($50,000.00). Any such fine levied against a licensee found to have violated the laws or rules of process validation shall be remitted to the Department of Mental Health and Substance Abuse Services,(2) If an adulterated product that was produced under process validation fails testing and the batch or lot has been sold to a dispensary, (A) A first violation shall be the assessment of a fine not to exceed Ten Thousand Dollars ($10,000.00) and a public recall of the product. The licensee shall further be required to revalidate the process.(B) A second violation within two (2) years of a previous violation shall be the assessment of a fine not to exceed Seventy-five Thousand Dollars ($75,000.00) and a public recall of the product. The licensee shall further be prohibited from utilizing process validation for a minimum of five (5) years.(C) A third violation within two (2) years of a previous violation shall be the assessment of a fine of Two Hundred Fifty Thousand Dollars ($250,000.00) and a public recall of the product. The licensee shall further be prohibited from utilizing process validation,(3) Any willful violation of process validation shall result in:(A) A first willful violation of process validation shall result in the assessment of a fine of Two Hundred Fifty Thousand Dollars ($250,000.00) and a license revocation hearing.(B) A second willful violation of process validation shall result in the assessment of a fine of One Million Dollars ($1,000,000.00) and a hearing to permanently revoke the license.(4) Punishment for violations by a Certified Process Validation Testing Laboratory that has been found to have been falsifying data, providing misinformation, or any unethical practices related to process validation at a minimum shall prohibit a licensee from operating under process validation for up to twenty-five (25) years and the assessment of a fine not to exceed One Million Dollars ($1,000,000.00). Any such fine levied against a licensee shall be remitted to the Authority for deposit into the Oklahoma Medical Marijuana Authority Revolving Fund. In addition to this fine, in response to a finding of a willful violation of process validation by the Authority, the Authority shall also be authorized to collect, levy, or impose any other fee, fine, penalty, or action as allowed by law.Okla. Admin. Code § 442:10-11-1
Adopted by Oklahoma Register, Volume 42, Issue 1, September 16, 2024, eff. 8/16/2024, exp. 9/14/2025 (Emergency)