Virginia Law

A. A pharmaceutical processor shall initially cultivate only the number of Cannabis plants necessary to produce cannabis products for the number of patients anticipated within the first nine months of operation. Thereafter, the processor shall

not maintain cannabis product in excess of the quantity required for normal, efficient operation.

B. At no time shall a cannabis dispensing facility maintain cannabis products in excess of the quantity required for normal, efficient operation.

C. Items a pharmaceutical processor shall properly secure include Cannabis plants, seeds, parts of plants, extracts, and cannabis products. A cannabis dispensing facility shall properly secure cannabis products. To secure these items a pharmaceutical processor and a cannabis dispensing facility shall:

1. Maintain all Cannabis plants, seeds, parts of plants, extracts, and cannabis products in a secure area or location accessible only by the minimum number of authorized employees essential for efficient operation;

2. Store all cut parts of Cannabis plants, extracts, or cannabis products in an approved safe or approved vault within the pharmaceutical processor or cannabis dispensing facility and not sell cannabis products when the pharmaceutical processor or cannabis dispensing facility is closed;

3. Keep all approved safes, approved vaults, or any other approved equipment or areas used for the production, cultivation, harvesting, processing, manufacturing, or storage of cannabis products securely locked or protected from entry, except for the actual time required to remove or replace the Cannabis, seeds, parts of plants, extracts, or cannabis products;

4. Keep all locks and security equipment in good working order;

5. Restrict access to keys or codes to all safes, approved vaults, or other approved equipment or areas in the dispensing area to pharmacists practicing at the pharmaceutical processor or cannabis dispensing facility;

6. Restrict access to keys or codes to all safes, approved vaults, or other approved equipment or areas in the cultivation and production areas to the responsible party and to those authorized by the responsible party who shall be the pharmacists practicing in the processor or persons supervising cultivation-related or production-related activities at the processor; and

7. Not allow keys to be left in the locks or accessible to persons not authorized by the PIC or responsible party.

D. Employees, other than a pharmacist or person supervising cultivation-related or production-related activities at the processor, but so designated by the PIC or responsible party, may have the ability to unlock a secured area to gain entrance to perform required job duties, but only during hours of operation of the processor or dispensing facility. At no time shall these employees have access to the security system.

E. The pharmaceutical processor or cannabis dispensing facility shall have an adequate security system to prevent and detect diversion, theft, or loss of Cannabis seeds, plants, extracts, or cannabis products. A device for the detection of breaking and a back-up alarm system with an ability to remain operational during a power outage shall be installed in each pharmaceutical processor or cannabis dispensing facility. The installation and the device shall be based on accepted alarm industry standards and subject to the following conditions:

1. The device shall be a sound, microwave, photoelectric, ultrasonic, or other generally accepted and suitable device;

2. The device shall be monitored in accordance with accepted industry standards, be maintained in operating order, have an auxiliary source of power, and be capable of sending an alarm signal to the monitoring entity when breached if the communication line is not operational;

3. The device shall fully protect the entire processor or facility and shall be capable of detecting breaking by any means when activated;

4. The device shall include a duress alarm, a panic alarm, and an automatic voice dialer; and

5. Access to the alarm system for the dispensing area of the processor or cannabis dispensing facility shall be restricted to the pharmacists working at the pharmaceutical processor or cannabis dispensing facility, and the system shall be activated whenever the processor or facility is closed for business. Access to the alarm system in areas of a pharmaceutical processor that are designated for cultivation and production shall be restricted to the responsible party and to those authorized by the responsible party who shall be the pharmacists practicing at the pharmaceutical processor or person supervising cultivation-related or production-related activities at the processor.

F. A pharmaceutical processor or cannabis dispensing facility shall keep the outside perimeter of the premises well lit. A processor or facility shall have video cameras in all areas that may contain Cannabis plants, seeds, parts of plants, extracts, or cannabis products and at all points of entry and exit, which shall be appropriate for the normal lighting conditions of the area under surveillance.

1. The processor or facility shall direct cameras at all approved safes, approved vaults, dispensing areas, or cannabis products sales areas, and any other area where Cannabis plants, seeds, extracts, or cannabis products are being produced, harvested, manufactured, stored, or handled. At entry and exit points, the processor or facility shall angle cameras so as to allow for the capture of clear and certain identification of any person entering or exiting the facility;

2. The video system shall have:

a. A failure notification system that provides an audible, text, or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to the processor or facility within five minutes of the failure, either by telephone, email, or text message;

b. The ability to immediately produce a clear color still photo that is a minimum of 9600 dpi from any camera image, live or recorded;

c. A date and time stamp embedded on all recordings. The date and time shall be synchronized and set correctly and shall not significantly obscure the picture; and

d. The ability to remain operational during a power outage;

3. All video recordings shall allow for the exporting of still images in an industry standard image format. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. A pharmaceutical processor or cannabis dispensing facility shall erase all recordings prior to disposal or sale of the facility; and

4. The processor or facility shall make 24-hour recordings from all video cameras available for immediate viewing by the board or the board's agent upon request and shall retain the recordings for at least 30 days. If a processor or facility is aware of a pending criminal, civil, or administrative investigation or legal proceeding for which a recording may contain relevant information, the processor or facility shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the pharmaceutical processor or cannabis dispensing facility PIC that it is not necessary to retain the recording.

G. The processor or facility shall maintain all security system equipment and recordings in a secure location so as to prevent theft, loss, destruction, or alterations. All security equipment shall be maintained in good working order and shall be tested at least every six months.

H. A pharmaceutical processor or cannabis dispensing facility shall limit access to surveillance areas to persons who are essential to surveillance operations, law-enforcement agencies, security system service employees, the board or the board's agent, and others when approved by the board. A processor or facility shall make available a current list of authorized employees and security system service employees who have access to the surveillance room to the processor or facility. The pharmaceutical processor or cannabis dispensing facility shall keep all onsite surveillance rooms locked and shall not use such rooms for any other function.

I. If diversion, theft, or loss of Cannabis plants, seeds, parts of plants, extracts, or cannabis products has occurred from a pharmaceutical processor, the board may require additional safeguards to ensure the security of the products.