Utah Admin. Code R66-5-7 - Security Standards

(1) A medical cannabis pharmacy shall comply with security standards established in Section 4-41a-1101 and this rule.

(2) A medical cannabis pharmacy shall have security equipment sufficient to deter and prevent unauthorized entrance into a limited access area of the medical cannabis pharmacy that includes equipment required in this section.

(3) A medical cannabis pharmacy shall have a system to detect unauthorized intrusion, which may include a signal system interconnected with a radio frequency method, such as cellular or private radio signals, or another mechanical or electronic device.

(4) A medical cannabis pharmacy shall be equipped with a secure lock on any entrance to the medical cannabis pharmacy.

(5) A medical cannabis pharmacy shall have electronic monitoring including:

(a) at least one 19-inch or greater call-up monitor;

(b) a printer, capable of immediately producing a clear still photo from any video camera image;

(c) a video camera with a recording resolution of at least 640 x 470, or the equivalent, that provides coverage of entrances to and exits from limited access areas, entrances to and exits from the building, and is capable of identifying any activity occurring in or adjacent to the building:

(d) a video camera that records continuously, 24 hours a day, 7 days a week or be motion activated;

(e) a video camera at each point-of-sale and product destruction or disposal location that will allow for the identification of a medical cannabis cardholder, visitor, or pharmacy employee;

(f) a method for storing video recordings from the video camera for at least 45 calendar days:

(i) a surveillance system storage device used for locally stored footage shall be secured in the facility in a lock box, cabinet, closet, or secured in another manner, to protect from employee tampering or criminal theft; and

(ii) access to footage stored on a remote server shall be restricted to protect from employee tampering;

(g) a failure notification system that provides an audible and visual notification of failure in the electronic monitoring system;

(h) sufficient battery backup for a video camera and recording equipment to support of recording in the event of a power outage;

(i) a date and time stamp embedded on video camera recordings that is set correctly; and

(j) a panic alarm in the interior of the facility that is a silent security alarm system signal generated by the manual activation of a device intended to signal a robbery in progress.

(6) Security measures implemented by a medical cannabis pharmacy to deter and prevent unauthorized entrance in areas containing products or theft of products and to ensure the safety of employees and cardholders, shall include measures to:

(a) store medical cannabis products and medical cannabis devices in a secure locked limited access area in a manner as to prevent diversion, theft, and loss;

(b) keep safes, vaults, and any other equipment or areas used for storage, including before disposal of the product, securely locked and protected during times other than the time required to remove or replace medical cannabis a product or medical cannabis devices;

(c) keep locks and security equipment in good working order and test that equipment is functioning properly at least two times per calendar year;

(d) prohibit keys from being left in locks, stored, or placed in a location accessible to any person other than specifically authorized personnel;

(e) prohibit accessibility of security measures such as combination numbers, passwords, or electronic, or biometric security systems, to any person other than specifically authorized personnel;

(f) ensure that the outside perimeter of the building is sufficiently lit to facilitate surveillance;

(g) ensure that medical cannabis products and medical cannabis devices are kept out of plain sight and are not visible from a public place;

(h) secure each product following any instance of diversion, theft, or loss of product, and conduct an assessment to determine whether additional safeguards are necessary;

(i) ensure safe cash handling and cash transportation to prevent theft, loss, and associated risk to the safety of employees, customers, and the general public at any medical cannabis pharmacy where a cash transaction is conducted; and

(j) prevent an individual from remaining on the premise of the medical cannabis pharmacy if they are not engaging in activity permitted by Title 26B, Chapter 4, Part 2, Cannabinoid Research and Medical Cannabis or Title 4, Chapter 41a, Medical Cannabis Production Establishments and Pharmacies.

(7) A medical cannabis pharmacy may display, in a securely locked case, a sample of each product offered:

(a) the display case shall be transparent; and

(b) an authorized PMP or pharmacy agent may remove an example of medical cannabis or a medical cannabis device from the case and provide it to a cardholder for inspection, provided:

(i) the patient does not consume or otherwise use the sample;

(ii) the processor label from the original product container or an image showing the processor label is affixed to the sample's container with the unique identifying number that links the medical cannabis product to the ICS; and

(iii) the medical cannabis product is destroyed in compliance with applicable laws and the pharmacy's standard operating procedures.

(8) Inside the medical cannabis pharmacy, medical cannabis product and medical cannabis devices, shall be stored in a limited access area during non-business hours.

(9)

(a) While inside the medical cannabis pharmacy, each employee shall wear an identification tag or similar form of identification, to clearly identify them to the public.

(b) The tag shall list the employees' position at the medical cannabis pharmacy as a PMP or pharmacy agent.

(c) A medical cannabis PMP shall carry their Pharmacy Medical Provider registration card at all times when:

(i) they are on the premises of a medical cannabis pharmacy; and

(ii) they are transporting cannabis in a medicinal dosage form, a cannabis product in a medicinal dosage form, or a medical cannabis device between a cannabis production establishment and a medical cannabis pharmacy.

(10) A medical cannabis pharmacy shall include the following areas:

(a) public waiting area;

(b) cardholder-only area; and

(c) limited access area.

(11) A medical cannabis pharmacy shall allow only a medical cannabis cardholder, PMP, pharmacy agent, authorized vendor, contactor, or visitor, to have access to the cardholder area of the medical cannabis pharmacy.

(12)

(a) An outside vendor, contractor, or a visitor shall obtain a visitor identification badge before entering the cardholder-only, or limited access area of a medical cannabis pharmacy.

(b) The badge shall be worn at all times when on the premise of the medical cannabis pharmacy.

(c) Each visitor shall be escorted at all times by an employee authorized to enter the medical cannabis pharmacy.

(d) Each visitor shall log in and out and that log shall be available for inspection by the department.

(e) Each visitor shall return their badge to the medical cannabis pharmacy upon exit.

(13) A medical cannabis pharmacy shall keep and maintain a log showing:

(a) the full name of each visitor entering the facility;

(b) the badge number issued;

(c) the date and time of arrival;

(d) the date and time of departure; and

(e) the purpose of the visit.

(14) The visitor log shall be maintained by the medical cannabis pharmacy for a minimum of one year.

(15) The medical cannabis pharmacy shall make visitor log available to the department upon request.

(16)

(a) A medical cannabis pharmacy shall keep product that is inside the medical cannabis pharmacy in a limited access area, inaccessible to any person other than a PMP, pharmacy agent, state employee, or an individual authorized by the medical cannabis pharmacy's PIC.

(b) The limited access area under Subsection (13)(a) shall:

(i) be identified by the posting of a sign that is a minimum of 12" x 12;" and

(ii) states: "Limited Access Area," in lettering no smaller than one inch in height.

(17) If a cabinet or drawer is used as a limited access area, it is not required to have a "Limited Access Area" sign on it.

(18) Only a PMP or a pharmacy agent shall have access to the medical cannabis pharmacy when the medical cannabis pharmacy is closed to the public.

(19)

(a) The medical cannabis pharmacy, or parent company, shall maintain a record of not less than five years of the initials or identification codes that identify each PMP or pharmacy agent by name.

(b) The initial or identification code under Subsection (16)(a):

(i) shall be unique, to ensure that each PMP or pharmacy agent can be identified; and

(ii) may not be used for two or more PMPs or pharmacy agents.

Notes

Utah Admin. Code R66-5-7

Adopted by Utah State Bulletin Number 2024-10, effective 5/13/2024 Amended by Utah State Bulletin Number 2024-15, effective 7/25/2024