3 Va. Admin. Code § 10-40-140

Current through Register Vol. 40, No. 22, June 17, 2024

Section 3VAC10-40-140 - Security requirements

A. A pharmaceutical processor shall initially cultivate only the number of cannabis plants necessary to produce cannabis products for the number of patients anticipated within the first nine months of operation. Thereafter, the processor shall not maintain cannabis product in excess of the quantity required for normal, efficient operation.

B. At no time shall a cannabis dispensing facility maintain cannabis products in excess of the quantity required for normal, efficient operation.

C. A medical cannabis facility shall properly secure cannabis plants, seeds, parts of plants, extracts, and cannabis products. To secure these items a medical cannabis facility shall:

1. Maintain all cannabis plants, seeds, parts of plants, extracts, and cannabis products in a secure area or location accessible only by the minimum number of authorized employees essential for efficient operation;

2. Store all cut parts of cannabis plants, extracts, or cannabis products in an approved safe or approved vault within the medical cannabis facility and not sell cannabis products when the regulated cannabis facility is closed;

3. Keep all approved safes, approved vaults, or any other approved equipment or areas used for the production, cultivation, harvesting, processing, manufacturing, or storage of cannabis products securely locked or protected from entry, except for the actual time required to remove or replace the cannabis, seeds, parts of plants, extracts, or cannabis products;

4. Keep all locks and security equipment in good working order;

5. Restrict access to keys or codes to all safes, approved vaults, or other approved equipment or areas in the dispensing area to pharmacists practicing at the pharmaceutical processor or cannabis dispensing facility;

6. Restrict access to keys or codes to all safes, approved vaults, or other approved equipment or areas in the cultivation and production areas to the responsible party and to those authorized by the responsible party. The responsible party shall authorize access to pharmacists practicing in the processor or persons supervising cultivation-related or production-related activities at the processor; and

7. Not allow keys to be left in the locks or otherwise accessible to persons not authorized by the PIC or responsible party.

D. The PIC or responsible party may designate employees, other than a pharmacist or person supervising cultivation-related or production-related activities at the processor, to have the ability to unlock a secured area to gain entrance to perform required job duties, but only during hours of operation of the processor or dispensing facility. At no time shall these employees have access to the security system.

E. The regulated cannabis facility shall have an adequate security system to prevent and detect diversion, theft, or loss of cannabis seeds, plants, extracts, or cannabis products. A failure notification system and a back-up alarm system with an ability to remain operational during a power outage shall be installed in each pharmaceutical processor or cannabis dispensing facility. The installation and the operation of the system shall meet accepted alarm industry standards, subject to the following conditions:

1. The system shall include a sound, microwave, photoelectric, ultrasonic, or other generally accepted and suitable device;

2. The system shall be monitored in accordance with accepted industry standards, be maintained in operating order, have an auxiliary source of power, and be capable of sending an alarm signal to the monitoring entity when breached if the communication line is not operational;

3. The system shall fully protect the entire processor or facility and shall be capable of detecting any failure in the system when activated;

4. The system shall include a duress alarm, a panic alarm, and an automatic voice dialer;

5. Access to the alarm system for the dispensing area of the pharmaceutical processor or cannabis dispensing facility shall be restricted to the pharmacists working at the pharmaceutical processor or cannabis dispensing facility, and the system shall be activated whenever the pharmaceutical processor or cannabis dispensing facility is closed for business; and

6. Access to the alarm system in a cannabis cultivation facility or areas of a pharmaceutical processor that are designated for cultivation and production shall be restricted to the responsible party and to those authorized by the responsible party who shall be the pharmacists practicing at the pharmaceutical processor or person supervising cultivation-related or production-related activities.

F. A medical cannabis facility shall keep the outside perimeter of the premises well lit.

G. A medical cannabis facility shall have video cameras in all areas that may contain cannabis plants, seeds, parts of plants, extracts, or cannabis products and at all points of entry and exit, which shall be appropriate for the normal lighting conditions of the area under surveillance.

1. The medical cannabis facility shall direct cameras at all approved safes, approved vaults, dispensing areas, or cannabis products sales areas, and any other area where cannabis plants, seeds, extracts, or cannabis products are being produced, harvested, manufactured, stored, or handled. At entry and exit points, the medical cannabis facility shall angle cameras so as to allow for the capture of clear and certain identification of any person entering or exiting the facility;

2. The video system shall have:

a. A failure notification system that provides an audible, text, or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to the medical cannabis facility within five minutes of the failure, either by telephone, email, or text message;

b. The ability to immediately produce a clear color still photo that is a minimum of 9600 dpi from any camera image, live or recorded;

c. A date and time stamp embedded on all recordings. The date and time shall be synchronized and set correctly and shall not significantly obscure the picture; and

d. The ability to remain operational during a power outage;

3. All video recordings shall allow for the exporting of still images in an industry standard image format. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. A medical cannabis facility shall erase all recordings prior to disposal or sale of the facility; and

4. The medical cannabis facility shall make 24-hour recordings from all video cameras available for immediate viewing by the board or the board's agent upon request and shall retain the recordings for at least 30 days. If a medical cannabis facility is aware of a pending criminal, civil, or administrative investigation or legal proceeding for which a recording may contain relevant information, the medical cannabis facility shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the medical cannabis facility PIC or responsible party that it is not necessary to retain the recording.

H. The medical cannabis facility shall maintain all security system equipment and recordings in a secure location so as to prevent theft, loss, destruction, or alterations. All security equipment shall be maintained in good working order and shall be tested at least every six months. The pharmaceutical processor or cannabis dispensing facility shall keep all onsite surveillance rooms locked and shall not use such rooms for any other function.

I. A medical cannabis facility shall limit access to surveillance areas to persons who are essential to surveillance operations, law-enforcement agencies, security system service employees, the board or the board's agent, and others when approved by the board. A medical cannabis facility shall make available a current list of authorized employees and security system service employees who have access to the surveillance room of the processor or facility.

J. If diversion, theft, or loss of cannabis plants, seeds, parts of plants, extracts, or cannabis products has occurred from a medical cannabis facility, the board may require additional safeguards to ensure the security of the products.

3 Va. Admin. Code § 10-40-140

Derived from Virginia Register Volume 40, Issue 11, eff. 1/1/2024.

Statutory Authority: §§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.