TITLE 3. ALCOHOLIC BEVERAGE AND CANNABIS CONTROL

VIRGINIA CANNABIS CONTROL AUTHORITY

Final Regulation

Title of Regulation: 3VAC10-40. Regulated Operations (adding 3VAC10-40-10 through 3VAC10-40-220).

Statutory Authority: §§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.

Effective Date: January 1, 2024.

Agency Contact: Jake Shuford, Legislative and Regulatory Manager, Virginia Cannabis Control Authority, 333 East Franklin Street, Richmond, VA 23219, telephone (804) 873-9038, or email jake.shuford@cca.virginia.gov.

Background: Chapters 740 and 773 of the 2023 Acts of Assembly transferred regulatory authority for the Medical Cannabis Program from the Board of Pharmacy to the independent agency, the Cannabis Control Authority.

Summary:

Pursuant to Chapters 740 and 773, this action establishes Regulated Operations (3VAC10-40), for the Medical Cannabis Program, which includes requirements for (i) wholesale distribution of cannabis products, bulk cannabis oil, botanical cannabis, and usable cannabis; (ii) personnel and security for medical cannabis facilities; (iii) medical cannabis advertising; and (iv) recordkeeping and storage.

Chapter 40

Regulated Operations

Part I

General Provisions

3VAC10-40-10. Definitions.

In addition to words and terms defined in § 4.1-600 of the Code of Virginia, the following words and terms when used in this chapter shall have the following meanings, unless the context clearly indicates otherwise:

"Batch" means a quantity of (i) cannabis oil from a production lot or (ii) harvested botanical cannabis product that is identified by a batch number or other unique identifier.

"Board" means the Board of Directors of the Cannabis Control Authority.

"Cannabis cultivation facility" means a location at which the board has authorized a pharmaceutical processor to cultivate cannabis plants pursuant to § 4.1-1602 of the Code of Virginia and the requirements of 3VAC10-30-160.

"Cannabis product advertising" means the act of providing consideration for the publication, dissemination, solicitation, or circulation of visual, oral, or written communication through any means to directly induce any person to patronize a particular pharmaceutical processor or cannabis dispensing facility or to purchase particular approved cannabis products. Advertising includes marketing.

"Certification" means a written statement, consistent with requirements of § 4.1-1601 of the Code of Virginia, issued by a practitioner for the use of cannabis products for treatment of or to alleviate the symptoms of any diagnosed condition or disease determined by the practitioner to benefit from such use.

"Medical cannabis facility" means a pharmaceutical processor, cannabis dispensing facility, or cannabis cultivation facility.

"On duty" means that a pharmacist, the responsible party, or a person who is qualified to provide supervision in accordance with 3VAC10-30-90 is on the premises at the address of the permitted pharmaceutical processor and is available as needed.

"Perpetual inventory" means an ongoing system for recording quantities of cannabis products received, dispensed, or otherwise distributed by a cannabis dispensing facility.

"PIC" means the pharmacist-in-charge whose name is on the pharmaceutical processor or cannabis dispensing facility application for a permit that has been issued and who shall have oversight of the processor's dispensing area or cannabis dispensing facility.

"Production" or "produce" means the manufacture, planting, preparation, cultivation, growing, harvesting, propagation, conversion, or processing of marijuana for the creation of usable cannabis, botanical cannabis, or a cannabis product derived thereof, (i) directly or indirectly by extraction from substances of natural origin, (ii) independently by means of chemical synthesis, or (iii) by a combination of extraction and chemical synthesis. "Production" or "produce" includes any packaging or repackaging of the substance or labeling or relabeling of its container.

"Qualifying patient" means a Virginia resident who has received from a practitioner, as defined in § 4.1-1600 of the Code of Virginia, a written certification for the use of cannabis products for treatment of or to alleviate the symptoms of any diagnosed condition or disease.

"Registration" means an identification card or other document issued by the board that identifies a person as a qualifying patient, parent, legal guardian, or registered agent that has voluntarily registered with the board.

"Responsible party" means the person designated on the pharmaceutical processor application who shall have oversight of the cultivation and production areas of the pharmaceutical processor.

3VAC10-40-20. General provisions.

A. A pharmaceutical processor or cannabis dispensing facility shall only sell cannabis products in a child-resistant, secure, and light-resistant container. Upon a written request from the patient, parent, legal guardian, or registered agent, the product may be dispensed in a non-child-resistant container so long as all labeling is maintained with the product.

B. Only a pharmacist may dispense cannabis products to patients or parents or legal guardians of patients who are minors or vulnerable adults, or to a registered agent. A pharmacy technician who meets the requirements of 3VAC10-30-90 C may assist, under the direct supervision of a pharmacist, in the dispensing and selling of cannabis products.

C. The PIC, pharmacist, responsible party, or person who is qualified to provide supervision in accordance with 3VAC10-30-90 on duty shall restrict access to the pharmaceutical processor or cannabis dispensing facility to:

1. A person whose responsibilities necessitate access to the pharmaceutical processor or cannabis dispensing facility and then for only as long as necessary to perform the person's job duties; or

2. A person who is a patient, parent, legal guardian, registered agent, or a companion of the patient, in which case such person shall not be permitted behind the service counter or in other areas where cannabis plants, extracts, or cannabis products are stored.

D. A pharmacist, pharmacy technician, or an employee of the pharmaceutical processor or cannabis dispensing facility who has routine access to confidential patient data and who has signed a patient data confidentiality agreement with the processor or dispensing facility may determine eligibility for access to the processor or facility by verifying through a verification source recognized by the board that the registration of the patient, parent, legal guardian, or registered agent is current.

E. All pharmacists and pharmacy technicians shall at all times while at the pharmaceutical processor or cannabis dispensing facility have their current license or registration available for inspection by the board or the board's agent.

F. While inside the pharmaceutical processor or cannabis dispensing facility, all employees shall wear name tags or similar forms of identification that clearly identify them, including their position at the pharmaceutical processor or cannabis dispensing facility.

G. A pharmaceutical processor or cannabis dispensing facility shall be open for patients, parents, legal guardians, or registered agents to purchase cannabis products for a minimum of 35 hours a week, except as otherwise authorized by the board.

H. A pharmaceutical processor or cannabis dispensing facility that closes the dispensing area during its normal hours of operation shall implement procedures to notify patients, parents, legal guardians, and registered agents of when the pharmaceutical processor or cannabis dispensing facility will resume normal hours of operation. Such procedures may include telephone system messages and conspicuously posted signs. If the cultivation, production, or dispensing area of the pharmaceutical processor or if a cannabis dispensing facility is or will be closed during its normal hours of operation for longer than two business days, the pharmaceutical processor or cannabis dispensing facility shall immediately notify the board.

I. A pharmacist shall counsel patients, parents, legal guardians, and registered agents, if applicable, regarding the use of cannabis products. Such counseling shall include information related to safe techniques for proper use and storage of cannabis products and for disposal of the products in a manner that renders them nonrecoverable.

J. The medical cannabis facility shall establish, implement, and adhere to a written alcohol-free, drug-free, and smoke-free workplace policy that shall be available to the board or the board's agent upon request.

3VAC10-40-30. Facility prohibitions.

A. No pharmaceutical processor shall:

1. Cultivate cannabis plants or produce or dispense cannabis products in any place except the approved facility at the address of record on the application for the pharmaceutical processor permit;

2. Sell, deliver, transport, or distribute cannabis, including cannabis products, to any other facility except for wholesale distribution pursuant to 3VAC10-40-50;

3. Produce or manufacture cannabis products for use outside of Virginia; or

4. Provide cannabis products samples.

B. No cannabis dispensing facility shall:

1. Dispense cannabis products in any place except the approved facility at the address of record on the application for the cannabis dispensing facility permit;

2. Sell, deliver, transport, or distribute cannabis products to any other facility, except for wholesale distribution pursuant to 3VAC10-40-50; or

3. Provide cannabis product samples.

C. No cannabis cultivation facility shall:

1. Sell, deliver, transport, or distribute cannabis to any other facility, except for the pharmaceutical processor that established the cannabis cultivation facility;

2. Produce, manufacture, or dispense cannabis products; or

3. Provide cannabis samples.

D. When a pharmacist is not on the premises and directly supervising the activity within the dispensing area of the pharmaceutical processor or a cannabis dispensing facility:

1. The dispensing area shall not be open or in operation;

2. No person shall be in the dispensing area unless all cannabis products are contained in a vault or other similar container to which only the pharmacist has access controls; and

3. The dispensing area shall be closed and properly secured.

E. Employee access to secured areas designated for cultivation and production, as authorized by the responsible party pursuant to § 4.1-1602 of the Code of Virginia, is permissible when a pharmacist is not on the premises.

F. No pharmaceutical processor or cannabis dispensing facility shall sell anything other than cannabis products except for devices for administration of dispensed products or hemp-based CBD products.

G. Except as provided in subsections H and I of this section, no person other than a medical cannabis facility employee, a patient, parent, legal guardian, registered agent, or a companion of a patient shall be allowed on the premises of a processor or facility.

H. Laboratory staff may enter a pharmaceutical processor or cannabis cultivation facility for the sole purpose of identifying and collecting cannabis or cannabis products samples to conduct laboratory tests.

I. A medical cannabis facility may submit a written request for entry by other persons to the board or the board's authorized representative.

J. An employee of a business that is contracted by a pharmaceutical processor may be allowed on the premises of the processor to perform the employee's duties (e.g. security, cleaning, electrical, plumbing) without requesting board authorization. The pharmaceutical processor should apply the requirements for visitor access found in subsection K of this section to the contracted employee.

K. All persons who the board or the board’s representative has authorized in writing to enter the medical cannabis facility shall obtain a visitor identification badge from a medical cannabis facility employee prior to entering the processor or facility.

1. An employee shall escort and monitor an authorized visitor at all times the visitor is in the medical cannabis facility.

2. The visitor identification badge shall remain visible at all times the visitor is in the medical cannabis facility and the visitor shall return the visitor identification badge to an employee upon exiting the medical cannabis facility.

3. All visitors shall log in and out. The medical cannabis facility shall maintain the visitor log that shall include the date, time, and purpose of the visit and be available to the board.

4. If an emergency requires the presence of a visitor and makes it impractical for the medical cannabis facility to obtain prior authorization from the board, the medical cannabis facility shall provide written notice to the board as soon as practicable after the onset of the emergency. Such notice shall include the name and company affiliation of the visitor, the purpose of the visit, and the date and time of the visit. A medical cannabis facility shall monitor the visitor and maintain a log of such visit as required by this subsection.

L. No cannabis products shall be sold, dispensed, or distributed via a delivery service or any other manner outside of a pharmaceutical processor or cannabis dispensing facility; however, a parent, legal guardian, or registered agent or an agent of the processor or cannabis dispensing facility may deliver cannabis products to the patient or in accordance with 3VAC10-50-80 A.

M. Notwithstanding the requirements of subsection G of this section, an agent of the board or local law enforcement or other federal, state, or local government officials may enter any area of a medical cannabis facility if necessary to perform such individual's governmental duties.

3VAC10-40-40. Reserved.

Part II

Cannabis Production, Distribution, and Inventory

3VAC10-40-50. Wholesale distribution of cannabis products, bulk cannabis oil, botanical cannabis, and usable cannabis.

A. Cannabis oil, cannabis products, botanical cannabis, and usable cannabis from a batch that have passed the tests required in 3VAC10-60-20 G and H and are packaged and labeled for sale with an appropriate expiration date in accordance with 3VAC10-60-20 may be wholesale distributed between pharmaceutical processors, between a pharmaceutical processor and a cannabis dispensing facility, and between cannabis dispensing facilities.

B. Bulk cannabis oil, botanical cannabis, and usable cannabis that have not been packaged for sale and have not passed the tests required in 3VAC10-60-20 G and H and do not bear an appropriate expiration date may be wholesale distributed between pharmaceutical processors. Prior to distribution, the bulk cannabis oil, botanical cannabis and usable cannabis shall be labeled in compliance with 3VAC10-70-30.

C. A pharmaceutical processor or cannabis dispensing facility engaged in wholesale distribution of cannabis products shall create a record of the transaction that shows (i) the date of distribution; (ii) the names and addresses of the processor or cannabis dispensing facility distributing the product and the processor or cannabis dispensing facility receiving the product; (iii) the kind and quantity of product being distributed; and (iv) the batch and lot identifying information to include harvest date, testing date, processing or manufacturing date, and expiration date. The record of the transaction shall be maintained by the distributing pharmaceutical processor or cannabis dispensing facility with its records of distribution, and a copy of the record shall be provided to and maintained by the processor or facility receiving the product in its records of receipt. Such records shall be maintained by each processor or facility for three years in compliance with 3VAC10-40-200.

D. A pharmaceutical processor engaged in wholesale distribution of bulk cannabis oil, botanical cannabis, and usable cannabis shall create a record of the transaction.

1. The record of the transaction shall show (i) the date of distribution; (ii) the names and addresses of the processor distributing the bulk cannabis oil, botanical cannabis, and usable cannabis and the processor receiving the bulk cannabis oil, botanical cannabis, and usable cannabis; (iii) the quantity or weight of the cannabis oil, botanical cannabis, or usable cannabis in each container; (iv) the quantity of each type of container being distributed; (v) the identification of the contents of each container, including a brief description of the type or form of cannabis oil, botanical cannabis, or usable cannabis and the strain name, as appropriate; (vi) the lot or batch number or unique identifier so as to facilitate any warnings or recalls the board or pharmaceutical processor deem appropriate; and (vii) the dates of harvest and packaging.

2. The record of the transaction shall be maintained by the distributing pharmaceutical processor with its records of distribution, and a copy of the record shall be provided to and maintained by the processor receiving the product in its records of receipt.

3. Such records shall be maintained by each processor for three years in compliance with 3VAC10-40-200.

E. A pharmaceutical processor or cannabis dispensing facility engaged in the wholesale distribution of cannabis products shall provide the receiving processor or cannabis dispensing facility with a copy of the lab results for the distributed product or electronic access to the information that can be shared upon request to patients, parents, legal guardians, registered agents, practitioners who have certified qualifying patients, or an agent of the board.

F. A pharmaceutical processor or cannabis dispensing facility engaged in the wholesale distribution of cannabis products and pharmaceutical processors engaged in the wholesale distribution of bulk cannabis oil, botanical cannabis, and usable cannabis shall store and handle the items and maintain policies and procedures that include a process for executing or responding to mandatory and voluntary recalls in a manner that complies with 3VAC10-40-210.

G. If a pharmaceutical processor or cannabis dispensing facility participating in wholesale distribution uses an electronic system for the storage and retrieval of records related to distribution, the pharmaceutical processor shall use a system that is compliant with 3VAC10-40-200.

3VAC10-40-60. Inventory requirements.

A. Each medical cannabis facility prior to commencing business shall:

1. Conduct an initial comprehensive inventory of all cannabis plants, including the seeds, parts of plants, extracts, and cannabis products, at the facility. If a facility commences business with no cannabis or cannabis products on hand, the pharmacist or responsible party shall record this fact as the initial inventory.

2. Establish ongoing inventory controls and procedures for the conduct of inventory reviews and comprehensive inventories of all cannabis plants, including the seeds, parts of plants, extracts, and cannabis products, that shall enable the facility to detect any diversion, theft, or loss in a timely manner.

B. For all inventories conducted by a medical cannabis facility:

1. The responsible party shall ensure all required inventories are performed in the cultivation and production areas, and the PIC shall ensure all required inventories are performed in the dispensing area.

2. The inventory shall be conducted by a pharmacist, pharmacy technician, responsible party, or person authorized by the responsible party who provides supervision of cultivation or production-related activities.

3. The inventories shall include, at a minimum, the date of the inventory, a summary of the inventory findings, and the name, signature, and title of the person who conducted the inventory.

C. Upon commencing business, each pharmaceutical processor shall conduct a weekly inventory of all cannabis plants, including the seeds, parts of plants, and cannabis products in stock, that shall comply with the requirements of subsection B of this section.

D. Upon commencing business, each cannabis dispensing facility shall maintain a perpetual inventory of all cannabis products received and dispensed that accurately indicates the physical count of each cannabis product on hand at the time of performing the inventory. The perpetual inventory shall include a reconciliation of each cannabis product at least monthly with a written explanation for any difference between the physical count and the theoretical count.

E. Upon commencing business, each cannabis cultivation facility shall conduct a weekly inventory of all cannabis plants, including the seeds and parts of plants, in stock that shall comply with the requirements of subsection B of this section.

F. The record of all cannabis products sold, dispensed, or otherwise disposed of shall show the date of sale or disposition; the name of the pharmaceutical processor or cannabis dispensing facility; the name and address of the patient, parent, legal guardian, or registered agent to whom the cannabis product was sold; the kind and quantity of cannabis product sold or disposed of; and the method of disposal.

G. A complete and accurate record of all cannabis plants, including the seeds, parts of plants, and cannabis products on hand, shall be prepared annually on the anniversary of the initial inventory or such other date that the PIC or responsible party may choose, so long as it is not more than one year following the prior year's inventory.

H. All inventories, procedures, and other documents required by this section shall be maintained on the premises and made available to the board or its agent.

I. Inventory records shall be maintained for three years from the date the inventory was taken.

J. Whenever a person authorized to enforce state or federal law for the purpose of investigation or as evidence removes any sample or record, such person shall tender a receipt in lieu thereof and the receipt shall be kept for a period of at least three years.

3VAC10-40-70. Reserved.

3VAC10-40-80. Reserved.

3VAC10-40-90. Reserved.

Part III

Personnel and Security

3VAC10-40-100. Employee training.

A. All employees of a medical cannabis facility shall complete training prior to the employee commencing work at the medical cannabis facility. At a minimum, the training shall be in the following areas:

1. The proper use of security measures and controls that have been adopted for the prevention of diversion, theft, or loss of cannabis, to include the seeds, any parts or extracts of the cannabis plants, and cannabis products;

2. Procedures and instructions for responding to an emergency;

3. Professional conduct, ethics, and state and federal statutes and regulations regarding patient confidentiality; and

4. Developments in the field of the medical use of cannabis products.

B. The PIC and the responsible party shall ensure the continued competency of all employees, in the respective areas for which they have oversight, through continuing in-service training that is provided at least annually, is designed to supplement initial training, and includes any guidance specified by the board.

C. The PIC and the responsible party shall be responsible for maintaining a written record documenting the initial and continuing training of all their respective employees that shall contain:

1. The name of the person receiving the training;

2. The dates of the training;

3. A general description of the topics covered;

4. The name of the person supervising the training; and

5. The signatures of the person receiving the training and the PIC or the responsible party.

D. When a change of PIC or responsible party for the medical cannabis facility occurs, the new PIC or responsible party shall review the training record and sign it, indicating that the new PIC or responsible party understands its contents.

E. A medical cannabis facility shall maintain the record documenting the employee training and make it available in accordance with regulations.

3VAC10-40-110. Pharmacy technicians; ratio; supervision and responsibility.

A. The ratio of pharmacy technicians to pharmacists on duty in the areas of a pharmaceutical processor designated for production or dispensing or in a cannabis dispensing facility shall not exceed six pharmacy technicians to one pharmacist.

B. The pharmacist providing direct supervision of pharmacy technicians may be held responsible for the pharmacy technicians' actions. Any violations relating to the dispensing of cannabis products resulting from the actions of a pharmacy technician shall constitute grounds for action against the license of the pharmacist and the registration of the pharmacy technician. As used in this subsection, "direct supervision" means a supervising pharmacist who:

1. Is on duty where the pharmacy technician is performing routine production of cannabis products or dispensing functions; and

2. Conducts in-process and final checks on the pharmacy technician's performance.

C. Pharmacy technicians shall not:

1. Counsel a patient, a patient's parent, legal guardian, or registered agent regarding (i) cannabis products or other drugs either before or after cannabis products have been dispensed or (ii) any medical information contained in a patient medication record;

2. Consult with the practitioner who certified the patient, or the practitioner's agent, regarding a patient or any medical information pertaining to the patient's cannabis product or any other drug the patient may be taking;

3. Interpret the patient's clinical data or provide medical advice;

4. Determine whether a different formulation of cannabis product should be substituted for the cannabis product or formulation recommended by the practitioner or requested by the patient or parent or legal guardian; or

5. Communicate with a practitioner who certified a patient or the practitioner's agent to obtain a clarification on a qualifying patient's written certification or instructions.

3VAC10-40-120. Responsibilities of the responsible party.

A. A person may only serve as the responsible party for one pharmaceutical processor or cannabis cultivation facility at any one time. The responsible party shall be employed full time in a managerial position at the location of the pharmaceutical processor or cannabis cultivation facility and shall be actively engaged in daily operations of the processor during normal hours of operation.

B. The responsible party shall be aware of and knowledgeable about all policies and procedures pertaining to the operations of the pharmaceutical processor or cannabis cultivation facility.

C. The responsible party shall ensure compliance with all security measures to protect the cannabis within the cultivation and production areas from diversion at all times and ensure that cultivation and production is performed in a safe and compliant manner and free of adulteration and misbranding.

D. The responsible party shall be responsible for ensuring that:

1. All employees practicing in the cultivation and production areas are properly trained;

2. All record retention requirements are met;

3. All requirements are met for the physical security of the cannabis, to include the seeds, any parts or extracts of the cannabis plants, and the cannabis products within the cultivation and production area; and

4. Any other required filings or notifications regarding the cultivation and production areas are made on behalf of the processor as set forth in this chapter.

E. When the responsible party ceases practice at a pharmaceutical processor or cannabis cultivation facility or no longer wishes to be designated as the responsible party, the responsible party shall immediately return the pharmaceutical processor permit to the board indicating the effective date on which the responsible party ceased to be the responsible party.

F. The outgoing responsible party shall have the opportunity to take a complete and accurate inventory of all cannabis, to include plants, extracts, or cannabis products on hand in the cultivation and production areas, on the date he ceases to be the responsible party unless the owner submits written notice to the board showing good cause as to why this opportunity should not be allowed.

G. A responsible party who is absent from practice for more than 30 consecutive days shall be deemed to no longer be the responsible party. If the responsible party knows of an upcoming absence of longer than 30 days, the responsible party shall be responsible for notifying the board and returning the permit. For unanticipated absences by the responsible party that exceed 15 days with no known return date within the next 15 days, the permit holder shall immediately notify the board and shall obtain a new responsible party.

H. An application for a permit designating the new responsible party shall be filed with the required fee within 14 days of the original date of resignation or termination of the responsible party in a manner provided by the board. It shall be unlawful for a pharmaceutical processor to operate without a new permit past the 14-day deadline unless the board receives a request for an extension prior to the deadline. The chair of the board, or the chair's designee, may grant an extension for up to an additional 14 days for good cause shown.

3VAC10-40-130. Responsibilities of the PIC.

A. The PIC of a pharmaceutical processor shall not serve as PIC of any other medical cannabis facility at any one time. A processor shall employ the PIC at the pharmaceutical processor for at least 35 hours per week, except as otherwise authorized by the board. A person may serve simultaneously as the PIC for no more than two cannabis dispensing facilities located within the same health service area at any one time.

B. The PIC or the pharmacist on duty shall control all aspects of the practice in the dispensing area of the pharmaceutical processor or in a cannabis dispensing facility. Any decision overriding such control of the PIC or other pharmacist on duty may be grounds for disciplinary action against the pharmaceutical processor or cannabis dispensing facility permit.

C. The PIC of a pharmaceutical processor or cannabis dispensing facility shall be responsible for ensuring that:

1. Pharmacy technicians are registered and properly trained;

2. All record retention requirements pertaining to the dispensing area met;

3. All requirements for the physical security of the cannabis products are met;

4. The pharmaceutical processor or cannabis dispensing facility has appropriate pharmaceutical reference materials to ensure that cannabis products can be properly dispensed;

5. The following items are conspicuously posted in the pharmaceutical processor or cannabis dispensing facility in a location and in a manner so as to be clearly and readily identifiable to patients, parents, legal guardians, or registered agents:

a. Pharmaceutical processor permit or cannabis dispensing facility permit;

b. Licenses for all pharmacists practicing at the pharmaceutical processor or cannabis dispensing facility; and

c. The price of all cannabis products offered by the pharmaceutical processor or cannabis dispensing facility; and

6. Any other required filings or notifications are made on behalf of the dispensing area of the pharmaceutical processor or the dispensing facility as set forth in this chapter.

D. When the PIC ceases practice at a pharmaceutical processor or cannabis dispensing facility or no longer wishes to be designated as PIC, the PIC shall immediately return the permit to the board indicating the effective date on which the PIC ceased to be the PIC.

E. An outgoing PIC shall have the opportunity to take a complete and accurate inventory of all cannabis products on hand in the dispensing area of the pharmaceutical processor or the dispensing facility on the date the PIC ceases to be the PIC, unless the owner submits written notice to the board showing good cause as to why this opportunity should not be allowed.

F. A PIC who is absent from practice for more than 30 consecutive days shall be deemed to no longer be the PIC. If the PIC knows of an upcoming absence of longer than 30 days, the PIC shall be responsible for notifying the board and returning the permit. For unanticipated absences by the PIC that exceed 15 days with no known return date within the next 15 days, the permit holder shall immediately notify the board and shall obtain a new PIC.

G. An application for a permit designating the new PIC shall be filed with the required fee within 14 days of the original date of resignation or termination of the PIC on a form provided by the board. It shall be unlawful for a pharmaceutical processor or cannabis dispensing facility to operate without a new permit past the 14-day deadline unless the board receives a request for an extension prior to the deadline. The executive director for the board may grant an extension for up to an additional 14 days for good cause shown.

3VAC10-40-140. Security requirements.

A. A pharmaceutical processor shall initially cultivate only the number of cannabis plants necessary to produce cannabis products for the number of patients anticipated within the first nine months of operation. Thereafter, the processor shall not maintain cannabis product in excess of the quantity required for normal, efficient operation.

B. At no time shall a cannabis dispensing facility maintain cannabis products in excess of the quantity required for normal, efficient operation.

C. A medical cannabis facility shall properly secure cannabis plants, seeds, parts of plants, extracts, and cannabis products. To secure these items a medical cannabis facility shall:

1. Maintain all cannabis plants, seeds, parts of plants, extracts, and cannabis products in a secure area or location accessible only by the minimum number of authorized employees essential for efficient operation;

2. Store all cut parts of cannabis plants, extracts, or cannabis products in an approved safe or approved vault within the medical cannabis facility and not sell cannabis products when the regulated cannabis facility is closed;

3. Keep all approved safes, approved vaults, or any other approved equipment or areas used for the production, cultivation, harvesting, processing, manufacturing, or storage of cannabis products securely locked or protected from entry, except for the actual time required to remove or replace the cannabis, seeds, parts of plants, extracts, or cannabis products;

4. Keep all locks and security equipment in good working order;

5. Restrict access to keys or codes to all safes, approved vaults, or other approved equipment or areas in the dispensing area to pharmacists practicing at the pharmaceutical processor or cannabis dispensing facility;

6. Restrict access to keys or codes to all safes, approved vaults, or other approved equipment or areas in the cultivation and production areas to the responsible party and to those authorized by the responsible party. The responsible party shall authorize access to pharmacists practicing in the processor or persons supervising cultivation-related or production-related activities at the processor; and

7. Not allow keys to be left in the locks or otherwise accessible to persons not authorized by the PIC or responsible party.

D. The PIC or responsible party may designate employees, other than a pharmacist or person supervising cultivation-related or production-related activities at the processor, to have the ability to unlock a secured area to gain entrance to perform required job duties, but only during hours of operation of the processor or dispensing facility. At no time shall these employees have access to the security system.

E. The regulated cannabis facility shall have an adequate security system to prevent and detect diversion, theft, or loss of cannabis seeds, plants, extracts, or cannabis products. A failure notification system and a back-up alarm system with an ability to remain operational during a power outage shall be installed in each pharmaceutical processor or cannabis dispensing facility. The installation and the operation of the system shall meet accepted alarm industry standards, subject to the following conditions:

1. The system shall include a sound, microwave, photoelectric, ultrasonic, or other generally accepted and suitable device;

2. The system shall be monitored in accordance with accepted industry standards, be maintained in operating order, have an auxiliary source of power, and be capable of sending an alarm signal to the monitoring entity when breached if the communication line is not operational;

3. The system shall fully protect the entire processor or facility and shall be capable of detecting any failure in the system when activated;

4. The system shall include a duress alarm, a panic alarm, and an automatic voice dialer;

5. Access to the alarm system for the dispensing area of the pharmaceutical processor or cannabis dispensing facility shall be restricted to the pharmacists working at the pharmaceutical processor or cannabis dispensing facility, and the system shall be activated whenever the pharmaceutical processor or cannabis dispensing facility is closed for business; and

6. Access to the alarm system in a cannabis cultivation facility or areas of a pharmaceutical processor that are designated for cultivation and production shall be restricted to the responsible party and to those authorized by the responsible party who shall be the pharmacists practicing at the pharmaceutical processor or person supervising cultivation-related or production-related activities.

F. A medical cannabis facility shall keep the outside perimeter of the premises well lit.

G. A medical cannabis facility shall have video cameras in all areas that may contain cannabis plants, seeds, parts of plants, extracts, or cannabis products and at all points of entry and exit, which shall be appropriate for the normal lighting conditions of the area under surveillance.

1. The medical cannabis facility shall direct cameras at all approved safes, approved vaults, dispensing areas, or cannabis products sales areas, and any other area where cannabis plants, seeds, extracts, or cannabis products are being produced, harvested, manufactured, stored, or handled. At entry and exit points, the medical cannabis facility shall angle cameras so as to allow for the capture of clear and certain identification of any person entering or exiting the facility;

2. The video system shall have:

a. A failure notification system that provides an audible, text, or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to the medical cannabis facility within five minutes of the failure, either by telephone, email, or text message;

b. The ability to immediately produce a clear color still photo that is a minimum of 9600 dpi from any camera image, live or recorded;

c. A date and time stamp embedded on all recordings. The date and time shall be synchronized and set correctly and shall not significantly obscure the picture; and

d. The ability to remain operational during a power outage;

3. All video recordings shall allow for the exporting of still images in an industry standard image format. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. A medical cannabis facility shall erase all recordings prior to disposal or sale of the facility; and

4. The medical cannabis facility shall make 24-hour recordings from all video cameras available for immediate viewing by the board or the board's agent upon request and shall retain the recordings for at least 30 days. If a medical cannabis facility is aware of a pending criminal, civil, or administrative investigation or legal proceeding for which a recording may contain relevant information, the medical cannabis facility shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the medical cannabis facility PIC or responsible party that it is not necessary to retain the recording.

H. The medical cannabis facility shall maintain all security system equipment and recordings in a secure location so as to prevent theft, loss, destruction, or alterations. All security equipment shall be maintained in good working order and shall be tested at least every six months. The pharmaceutical processor or cannabis dispensing facility shall keep all onsite surveillance rooms locked and shall not use such rooms for any other function.

I. A medical cannabis facility shall limit access to surveillance areas to persons who are essential to surveillance operations, law-enforcement agencies, security system service employees, the board or the board's agent, and others when approved by the board. A medical cannabis facility shall make available a current list of authorized employees and security system service employees who have access to the surveillance room of the processor or facility.

J. If diversion, theft, or loss of cannabis plants, seeds, parts of plants, extracts, or cannabis products has occurred from a medical cannabis facility, the board may require additional safeguards to ensure the security of the products.

3VAC10-40-150. Reportable events.

A. Upon becoming aware of (i) diversion, theft, loss, or discrepancies identified during inventory; (ii) unauthorized destruction of any cannabis products; or (iii) any loss or unauthorized alteration of records related to cannabis products or qualifying patients, a pharmacist, responsible party, or medical cannabis facility shall immediately notify appropriate law-enforcement authorities and the board.

B. A pharmacist, responsible party, or medical cannabis facility shall provide the notice required by subsection A of this section to the board by way of a signed statement that details the circumstances of the event, including an accurate inventory of the quantity and registered cannabis product names of cannabis product diverted, stolen, lost, destroyed, or damaged and confirmation that the local law-enforcement authorities were notified. A pharmacist, responsible party, or medical cannabis facility shall make such notice no later than 24 hours after discovery of the event.

C. A pharmacist, responsible party, or medical cannabis facility shall notify the board no later than the next business day, followed by written notification no later than 10 business days, of any of the following:

1. An alarm activation or other event that requires a response by public safety personnel;

2. A breach of security;

3. The failure of the security alarm system due to a loss of electrical support or mechanical malfunction that is expected to last longer than eight hours; and

4. Corrective measures taken, if any.

D. A pharmacist, responsible party, pharmaceutical processor, or cannabis dispensing facility shall immediately notify the board of an employee convicted of a felony.

Part IV

Advertising

3VAC10-40-160. General provisions.

A medical cannabis facility may engage in marketing activities related to products, the medical cannabis program, the pharmaceutical processor company, and related communications, except those marketing activities that:

1. Include false or misleading statements;

2. Promote excessive consumption;

3. Depict a person younger than 21 years of age consuming cannabis;

4. Include any image designed or likely to appeal to minors, specifically including cartoons, toys, animals, children, or any other likeness to images, character, or phrases that are popularly used to advertise to children;

5. Depict products or product packaging or labeling that bears reasonable resemblance to any product legally available for consumption as a candy or that promotes cannabis consumption; or

6. Contain any seal, flag, crest, coat of arms, or other insignia that is likely to mislead patients or the general public to believe that the cannabis product has been endorsed, made, or used by the Commonwealth of Virginia or any of its representatives except where specifically authorized.

3VAC10-40-170. Prohibited practices.

A. A medical cannabis facility shall not advertise (i) through any means unless at least 85% of the audience is reasonably expected to be 18 years of age or older, as determined by reliable, up-to-date audience composition data or (ii) on television or the radio at any time outside of regular school hours for elementary and secondary schools.

B. Advertising shall not:

1. Display cannabis products or images of products where the advertisement is visible to members of the public from any street, sidewalk, park, or other public place; and

2. Include coupons, giveaways of free cannabis products, or distribution of merchandise that displays anything other than the facility name and contact information.

C. No outdoor cannabis product advertising shall be placed within 1,000 feet of (i) a school or daycare; (ii) a public or private playground or similar recreational or child-centered facility; or (iii) a substance use disorder treatment facility.

D. Signs placed on the property of a medical cannabis facility shall not:

1. Display imagery of cannabis or the use of cannabis or utilize long luminous gas-discharge tubes that contain rarefied neon or other gases;

2. Draw undue attention to the facility but may be designed to assist patients, parents, legal guardians, and registered agents to find the medical cannabis facility; or

3. Be illuminated during nonbusiness hours.

E. A medical cannabis facility shall not advertise at any sporting event or use any billboard advertisements.

F. No cannabis product advertising shall be on or in a public transit vehicle, public transit shelter, bus stop, taxi stand, transportation waiting area, train station, airport, or any similar transit-related location.

3VAC10-40-180. Permitted practices.

A. A medical cannabis facility may list its business in public telephone books, business directories, search engines, or other places where it is reasonable for a business to maintain an informational presence of its existence and a description of the nature of the business. A medical cannabis facility shall not engage in the use of pop-up digital advertisements.

B. A medical cannabis facility may display the following information on its website or social media site:

1. Name and location of the medical cannabis facility;

2. Contact information for the medical cannabis facility;

3. Hours and days the pharmaceutical processor or cannabis dispensing facility is open for dispensing cannabis products;

4. Laboratory results;

5. Product information and pricing;

6. Directions to the medical cannabis facility; and

7. Educational materials regarding the use of cannabis products that are supported by substantial, current clinical evidence or data.

C. Medical cannabis facilities may provide communication and engagement for educational purposes with health care practitioners, patients, parents, legal guardians, registered agents, and the general public, including the dissemination of information permitted by 3VAC10-40-160 and educational materials.

3VAC10-40-190. Advertising requirements.

A. Advertising must accurately and legibly identify the medical cannabis facility responsible for its content and include a statement that cannabis products are for use by patients only. Any advertisement for cannabis products that is related to the benefits, safety, or efficacy, including therapeutic or medical claims, shall:

1. Be supported by substantial, current clinical evidence or data; and

2. Include information on side effects or risks associated with the use of cannabis.

B. Any website or social media site owned, managed, or operated by a medical cannabis facility shall employ a neutral age-screening mechanism that verifies that the user is at least 18 years of age, including by using an age-gate, age-screen, or age verification mechanism.

C. All outdoor signage must comply with local or state requirements.

Part V

Records, Storage, and Administration

3VAC10-40-200. Recordkeeping requirements.

A. If a medical cannabis facility uses an electronic system for the storage and retrieval of patient information or other records related to cultivating, producing, and dispensing cannabis products, as applicable, the pharmaceutical processor or cannabis dispensing facility shall use a system that:

1. Guarantees the confidentiality of the information contained in the system;

2. Is capable of safeguarding against erasures and unauthorized changes in data after the information has been entered and verified by the pharmacist or responsible party; and

3. Is capable of being reconstructed in the event of a computer malfunction or accident resulting in the destruction of the data bank.

B. All records relating to inventory, laboratory results, and dispensing shall be maintained for a period of three years and shall be made available to the board upon request.

3VAC10-40-210. Storage and handling requirements.

A. A medical cannabis facility shall:

1. Have storage areas that provide adequate lighting, ventilation, sanitation, space, equipment, and security conditions for the cultivation of cannabis and the production and dispensing of cannabis products;

2. Have storage areas with temperature and humidity maintained in the following ranges:

Room or Phase	Temperature	Humidity
Mother room	65 - 85° F	50% - 75%
Nursery phase	65 - 85° F	50% - 75%
Vegetation phase	65 - 85° F	50% - 75%
Flower/harvest phase	65 - 85° F	40% - 75%
Drying/extraction rooms	< 75° F	40% - 75%

3. Store cannabis plants, seeds, parts of plants, extracts, including cannabis products, that are outdated, damaged, deteriorated, misbranded, adulterated, or whose containers or packaging have been opened or breached, in a separate quarantined storage area until such cannabis plants, seeds, parts of plants, extracts, or cannabis products are destroyed;

4. Be maintained in a clean, sanitary, and orderly condition; and

5. Be free from infestation by insects, rodents, birds, or vermin of any kind.

B. A medical cannabis facility shall compartmentalize all areas in the facility based on function and shall restrict access between compartments.

C. The pharmaceutical processor or cannabis cultivation facility shall establish, maintain, and comply with written policies and procedures regarding best practices for the secure and proper cultivation of cannabis and production of cannabis products. These shall include policies and procedures that:

1. Restrict movement between compartments;

2. Provide for different colored identification cards for employees based on the compartment to which the employees are assigned at a given time so as to ensure that only employees necessary for a particular function have access to that compartment of the facility;

3. Require pocketless clothing for all employees working in an area containing cannabis plants, seeds, and extracts, including cannabis oil and cannabis products; and

4. Document the chain of custody of all cannabis plants, parts of plants, seeds, extracts, and cannabis products.

D. A cannabis dispensing facility shall establish, maintain, and comply with written policies and procedures regarding best practices for the secure and proper dispensing of cannabis products, including a requirement for pocketless clothing for all facility employees working in an area containing cannabis products.

E. The PIC or responsible party of a medical cannabis facility shall establish, maintain, and comply with written policies and procedures for the cultivation, production, security, storage, and inventory of cannabis, including the seeds, parts of plants, extracts, and cannabis products, as applicable. Such policies and procedures shall include methods for identifying, recording, and reporting diversion, theft, or loss and for correcting all errors and inaccuracies in inventories. Medical cannabis facilities shall include in their written policies and procedures a process for:

1. Handling mandatory and voluntary recalls of cannabis products and bulk cannabis oil, botanical cannabis, and usable cannabis distributed or received via wholesale distribution. The process shall be adequate to deal with recalls due to any action initiated at the request of the board and any voluntary action by the pharmaceutical processor or cannabis dispensing facility to (i) remove defective or potentially defective cannabis products from the market or (ii) promote public health and safety by replacing existing cannabis products with improved products or packaging;

2. Preparing for, protecting against, and handling any crises that affect the security or operation of any facility in the event of strike, fire, flood, or other natural disaster, or other situations of local, state, or national emergency;

3. Ensuring that any outdated, damaged, deteriorated, misbranded, or adulterated cannabis, including seeds, parts of plants, extracts, and cannabis products, is segregated from all other cannabis, seeds, parts of plants, extracts, and cannabis products and destroyed. This procedure shall provide for written documentation of the cannabis, including seeds, parts of plants, extracts, and cannabis product disposition; and

4. Ensuring the oldest stock of cannabis, including seeds, parts of plants, extracts, and cannabis products are used first. The procedure may permit deviation from this requirement if such deviation is temporary and appropriate.

F. The pharmaceutical processor or cannabis cultivation facility shall store all cannabis, including seeds, parts of plants, extracts, and cannabis products, in the process of production, transfer, or analysis in such a manner as to prevent diversion, theft, or loss; shall make cannabis, including the seeds, parts of plants, extracts, and cannabis products accessible only to the minimum number of specifically authorized employees essential for efficient operation; and shall return such items to their secure location immediately after completion of the production, transfer, or analysis process or at the end of the scheduled business day. If a production process cannot be completed at the end of a working day, the pharmacist, responsible party, or other person authorized by the responsible party to supervise cultivation and production at the pharmaceutical processor or cannabis cultivation facility shall securely lock the processing area or tanks, vessels, bins, or bulk containers containing cannabis, including the seeds, parts of plants, extracts, and cannabis products, inside an area or building that affords adequate security.

G. The cannabis dispensing facility shall store all cannabis products in such a manner as to prevent diversion, theft, or loss; shall make cannabis products accessible only to the minimum number of specifically authorized employees essential for efficient operation; and shall return the cannabis products to their secure location at the completion of the dispensing or at end of the scheduled business day.

3VAC10-40-220. Medical cannabis facility closings; going out of business; change of ownership.

A. At least 30 days prior to the date a medical cannabis facility closes, either temporarily or permanently, the owner shall:

1. Notify the board;

2. Send written notification to patients with current certification; and

3. Post a notice on the window or door of the medical cannabis facility.

B. The proposed disposition of all cannabis, industrial hemp extracts, cannabis products, dispensing records, patient information records, and other required records, as applicable, shall be reported to the board. If the cannabis, cannabis products, and records are to be transferred to another medical cannabis facility located in Virginia, the owner shall inform the board and the patients and include on the public notice the name and address of the processor or cannabis dispensing facility to whom the cannabis, cannabis products, and records are being transferred and the date of transfer.

C. The board may approve exceptions to the public notice requirement due to exigent circumstances, including sudden closing due to fire, destruction, natural disaster, death, property seizure, eviction, bankruptcy, or other emergency circumstances. If the medical cannabis facility is not able to meet the notification requirements, the owner shall ensure that the board and public are properly notified as soon as the owner knows of the closure and shall disclose the emergency circumstances preventing the notification within the required deadlines.

D. In the event of an exception to the notice, the PIC, responsible party, or owner shall provide notice as far in advance of closing as allowed by the circumstances.

E. At least 14 days prior to any change in ownership of an existing medical cannabis facility, the owner shall notify the board of the pending change.

1. Upon any change in ownership of an existing pharmaceutical processor or cannabis dispensing facility, the dispensing records for the two years immediately preceding the date of change of ownership and other required patient information shall be provided to the new owners on the date of change of ownership in substantially the same format as previously used immediately prior to the transfer to provide continuity of services.

2. The previous owner shall be held responsible for ensuring the proper and lawful transfer of records on the date of the transfer.

3. If a new owner's share constitutes 5.0% or greater of the total ownership, the new owner shall submit to fingerprinting and the criminal history record search required of § 4.1-1602 of the Code of Virginia.