Part III. Personnel and Security
3VAC10-40-100. Employee training.
A. All employees of a medical cannabis facility shall complete training prior to the employee commencing work at the medical cannabis facility. At a minimum, the training shall be in the following areas:
1. The proper use of security measures and controls that have been adopted for the prevention of diversion, theft, or loss of cannabis, to include the seeds, any parts or extracts of the cannabis plants, and cannabis products;
2. Procedures and instructions for responding to an emergency;
3. Professional conduct, ethics, and state and federal statutes and regulations regarding patient confidentiality; and
4. Developments in the field of the medical use of cannabis products.
B. The PIC and the responsible party shall ensure the continued competency of all employees, in the respective areas for which they have oversight, through continuing in-service training that is provided at least annually, is designed to supplement initial training, and includes any guidance specified by the board.
C. The PIC and the responsible party shall be responsible for maintaining a written record documenting the initial and continuing training of all their respective employees that shall contain:
1. The name of the person receiving the training;
2. The dates of the training;
3. A general description of the topics covered;
4. The name of the person supervising the training; and
5. The signatures of the person receiving the training and the PIC or the responsible party.
D. When a change of PIC or responsible party for the medical cannabis facility occurs, the new PIC or responsible party shall review the training record and sign it, indicating that the new PIC or responsible party understands its contents.
E. A medical cannabis facility shall maintain the record documenting the employee training and make it available in accordance with regulations.
Statutory Authority
§§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 40, Issue 11, eff. January 1, 2024.
3VAC10-40-110. Pharmacy technicians; ratio; supervision and responsibility.
A. The ratio of pharmacy technicians to pharmacists on duty in the areas of a pharmaceutical processor designated for production or dispensing or in a cannabis dispensing facility shall not exceed six pharmacy technicians to one pharmacist.
B. The pharmacist providing direct supervision of pharmacy technicians may be held responsible for the pharmacy technicians' actions. Any violations relating to the dispensing of cannabis products resulting from the actions of a pharmacy technician shall constitute grounds for action against the license of the pharmacist and the registration of the pharmacy technician. As used in this subsection, "direct supervision" means a supervising pharmacist who:
1. Is on duty where the pharmacy technician is performing routine production of cannabis products or dispensing functions; and
2. Conducts in-process and final checks on the pharmacy technician's performance.
C. Pharmacy technicians shall not:
1. Counsel a patient, a patient's parent, legal guardian, or registered agent regarding (i) cannabis products or other drugs either before or after cannabis products have been dispensed or (ii) any medical information contained in a patient medication record;
2. Consult with the practitioner who certified the patient, or the practitioner's agent, regarding a patient or any medical information pertaining to the patient's cannabis product or any other drug the patient may be taking;
3. Interpret the patient's clinical data or provide medical advice;
4. Determine whether a different formulation of cannabis product should be substituted for the cannabis product or formulation recommended by the practitioner or requested by the patient or parent or legal guardian; or
5. Communicate with a practitioner who certified a patient or the practitioner's agent to obtain a clarification on a qualifying patient's written certification or instructions.
Statutory Authority
§§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 40, Issue 11, eff. January 1, 2024.
3VAC10-40-120. Responsibilities of the responsible party.
A. A person may only serve as the responsible party for one pharmaceutical processor or cannabis cultivation facility at any one time. The responsible party shall be employed full time in a managerial position at the location of the pharmaceutical processor or cannabis cultivation facility and shall be actively engaged in daily operations of the processor during normal hours of operation.
B. The responsible party shall be aware of and knowledgeable about all policies and procedures pertaining to the operations of the pharmaceutical processor or cannabis cultivation facility.
C. The responsible party shall ensure compliance with all security measures to protect the cannabis within the cultivation and production areas from diversion at all times and ensure that cultivation and production is performed in a safe and compliant manner and free of adulteration and misbranding.
D. The responsible party shall be responsible for ensuring that:
1. All employees practicing in the cultivation and production areas are properly trained;
2. All record retention requirements are met;
3. All requirements are met for the physical security of the cannabis, to include the seeds, any parts or extracts of the cannabis plants, and the cannabis products within the cultivation and production area; and
4. Any other required filings or notifications regarding the cultivation and production areas are made on behalf of the processor as set forth in this chapter.
E. When the responsible party ceases practice at a pharmaceutical processor or cannabis cultivation facility or no longer wishes to be designated as the responsible party, the responsible party shall immediately return the pharmaceutical processor permit to the board indicating the effective date on which the responsible party ceased to be the responsible party.
F. The outgoing responsible party shall have the opportunity to take a complete and accurate inventory of all cannabis, to include plants, extracts, or cannabis products on hand in the cultivation and production areas, on the date he ceases to be the responsible party unless the owner submits written notice to the board showing good cause as to why this opportunity should not be allowed.
G. A responsible party who is absent from practice for more than 30 consecutive days shall be deemed to no longer be the responsible party. If the responsible party knows of an upcoming absence of longer than 30 days, the responsible party shall be responsible for notifying the board and returning the permit. For unanticipated absences by the responsible party that exceed 15 days with no known return date within the next 15 days, the permit holder shall immediately notify the board and shall obtain a new responsible party.
H. An application for a permit designating the new responsible party shall be filed with the required fee within 14 days of the original date of resignation or termination of the responsible party in a manner provided by the board. It shall be unlawful for a pharmaceutical processor to operate without a new permit past the 14-day deadline unless the board receives a request for an extension prior to the deadline. The chair of the board, or the chair's designee, may grant an extension for up to an additional 14 days for good cause shown.
Statutory Authority
§§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 40, Issue 11, eff. January 1, 2024.
3VAC10-40-130. Responsibilities of the PIC.
A. The PIC of a pharmaceutical processor shall not serve as PIC of any other medical cannabis facility at any one time. A processor shall employ the PIC at the pharmaceutical processor for at least 35 hours per week, except as otherwise authorized by the board. A person may serve simultaneously as the PIC for no more than two cannabis dispensing facilities located within the same health service area at any one time.
B. The PIC or the pharmacist on duty shall control all aspects of the practice in the dispensing area of the pharmaceutical processor or in a cannabis dispensing facility. Any decision overriding such control of the PIC or other pharmacist on duty may be grounds for disciplinary action against the pharmaceutical processor or cannabis dispensing facility permit.
C. The PIC of a pharmaceutical processor or cannabis dispensing facility shall be responsible for ensuring that:
1. Pharmacy technicians are registered and properly trained;
2. All record retention requirements pertaining to the dispensing area met;
3. All requirements for the physical security of the cannabis products are met;
4. The pharmaceutical processor or cannabis dispensing facility has appropriate pharmaceutical reference materials to ensure that cannabis products can be properly dispensed;
5. The following items are conspicuously posted in the pharmaceutical processor or cannabis dispensing facility in a location and in a manner so as to be clearly and readily identifiable to patients, parents, legal guardians, or registered agents:
a. Pharmaceutical processor permit or cannabis dispensing facility permit;
b. Licenses for all pharmacists practicing at the pharmaceutical processor or cannabis dispensing facility; and
c. The price of all cannabis products offered by the pharmaceutical processor or cannabis dispensing facility; and
6. Any other required filings or notifications are made on behalf of the dispensing area of the pharmaceutical processor or the dispensing facility as set forth in this chapter.
D. When the PIC ceases practice at a pharmaceutical processor or cannabis dispensing facility or no longer wishes to be designated as PIC, the PIC shall immediately return the permit to the board indicating the effective date on which the PIC ceased to be the PIC.
E. An outgoing PIC shall have the opportunity to take a complete and accurate inventory of all cannabis products on hand in the dispensing area of the pharmaceutical processor or the dispensing facility on the date the PIC ceases to be the PIC, unless the owner submits written notice to the board showing good cause as to why this opportunity should not be allowed.
F. A PIC who is absent from practice for more than 30 consecutive days shall be deemed to no longer be the PIC. If the PIC knows of an upcoming absence of longer than 30 days, the PIC shall be responsible for notifying the board and returning the permit. For unanticipated absences by the PIC that exceed 15 days with no known return date within the next 15 days, the permit holder shall immediately notify the board and shall obtain a new PIC.
G. An application for a permit designating the new PIC shall be filed with the required fee within 14 days of the original date of resignation or termination of the PIC on a form provided by the board. It shall be unlawful for a pharmaceutical processor or cannabis dispensing facility to operate without a new permit past the 14-day deadline unless the board receives a request for an extension prior to the deadline. The executive director for the board may grant an extension for up to an additional 14 days for good cause shown.
Statutory Authority
§§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 40, Issue 11, eff. January 1, 2024.
3VAC10-40-140. Security requirements.
A. A pharmaceutical processor shall initially cultivate only the number of cannabis plants necessary to produce cannabis products for the number of patients anticipated within the first nine months of operation. Thereafter, the processor shall not maintain cannabis product in excess of the quantity required for normal, efficient operation.
B. At no time shall a cannabis dispensing facility maintain cannabis products in excess of the quantity required for normal, efficient operation.
C. A medical cannabis facility shall properly secure cannabis plants, seeds, parts of plants, extracts, and cannabis products. To secure these items a medical cannabis facility shall:
1. Maintain all cannabis plants, seeds, parts of plants, extracts, and cannabis products in a secure area or location accessible only by the minimum number of authorized employees essential for efficient operation;
2. Store all cut parts of cannabis plants, extracts, or cannabis products in an approved safe or approved vault within the medical cannabis facility and not sell cannabis products when the regulated cannabis facility is closed;
3. Keep all approved safes, approved vaults, or any other approved equipment or areas used for the production, cultivation, harvesting, processing, manufacturing, or storage of cannabis products securely locked or protected from entry, except for the actual time required to remove or replace the cannabis, seeds, parts of plants, extracts, or cannabis products;
4. Keep all locks and security equipment in good working order;
5. Restrict access to keys or codes to all safes, approved vaults, or other approved equipment or areas in the dispensing area to pharmacists practicing at the pharmaceutical processor or cannabis dispensing facility;
6. Restrict access to keys or codes to all safes, approved vaults, or other approved equipment or areas in the cultivation and production areas to the responsible party and to those authorized by the responsible party. The responsible party shall authorize access to pharmacists practicing in the processor or persons supervising cultivation-related or production-related activities at the processor; and
7. Not allow keys to be left in the locks or otherwise accessible to persons not authorized by the PIC or responsible party.
D. The PIC or responsible party may designate employees, other than a pharmacist or person supervising cultivation-related or production-related activities at the processor, to have the ability to unlock a secured area to gain entrance to perform required job duties, but only during hours of operation of the processor or dispensing facility. At no time shall these employees have access to the security system.
E. The regulated cannabis facility shall have an adequate security system to prevent and detect diversion, theft, or loss of cannabis seeds, plants, extracts, or cannabis products. A failure notification system and a back-up alarm system with an ability to remain operational during a power outage shall be installed in each pharmaceutical processor or cannabis dispensing facility. The installation and the operation of the system shall meet accepted alarm industry standards, subject to the following conditions:
1. The system shall include a sound, microwave, photoelectric, ultrasonic, or other generally accepted and suitable device;
2. The system shall be monitored in accordance with accepted industry standards, be maintained in operating order, have an auxiliary source of power, and be capable of sending an alarm signal to the monitoring entity when breached if the communication line is not operational;
3. The system shall fully protect the entire processor or facility and shall be capable of detecting any failure in the system when activated;
4. The system shall include a duress alarm, a panic alarm, and an automatic voice dialer;
5. Access to the alarm system for the dispensing area of the pharmaceutical processor or cannabis dispensing facility shall be restricted to the pharmacists working at the pharmaceutical processor or cannabis dispensing facility, and the system shall be activated whenever the pharmaceutical processor or cannabis dispensing facility is closed for business; and
6. Access to the alarm system in a cannabis cultivation facility or areas of a pharmaceutical processor that are designated for cultivation and production shall be restricted to the responsible party and to those authorized by the responsible party who shall be the pharmacists practicing at the pharmaceutical processor or person supervising cultivation-related or production-related activities.
F. A medical cannabis facility shall keep the outside perimeter of the premises well lit.
G. A medical cannabis facility shall have video cameras in all areas that may contain cannabis plants, seeds, parts of plants, extracts, or cannabis products and at all points of entry and exit, which shall be appropriate for the normal lighting conditions of the area under surveillance.
1. The medical cannabis facility shall direct cameras at all approved safes, approved vaults, dispensing areas, or cannabis products sales areas, and any other area where cannabis plants, seeds, extracts, or cannabis products are being produced, harvested, manufactured, stored, or handled. At entry and exit points, the medical cannabis facility shall angle cameras so as to allow for the capture of clear and certain identification of any person entering or exiting the facility;
2. The video system shall have:
a. A failure notification system that provides an audible, text, or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to the medical cannabis facility within five minutes of the failure, either by telephone, email, or text message;
b. The ability to immediately produce a clear color still photo that is a minimum of 9600 dpi from any camera image, live or recorded;
c. A date and time stamp embedded on all recordings. The date and time shall be synchronized and set correctly and shall not significantly obscure the picture; and
d. The ability to remain operational during a power outage;
3. All video recordings shall allow for the exporting of still images in an industry standard image format. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. A medical cannabis facility shall erase all recordings prior to disposal or sale of the facility; and
4. The medical cannabis facility shall make 24-hour recordings from all video cameras available for immediate viewing by the board or the board's agent upon request and shall retain the recordings for at least 30 days. If a medical cannabis facility is aware of a pending criminal, civil, or administrative investigation or legal proceeding for which a recording may contain relevant information, the medical cannabis facility shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the medical cannabis facility PIC or responsible party that it is not necessary to retain the recording.
H. The medical cannabis facility shall maintain all security system equipment and recordings in a secure location so as to prevent theft, loss, destruction, or alterations. All security equipment shall be maintained in good working order and shall be tested at least every six months. The pharmaceutical processor or cannabis dispensing facility shall keep all onsite surveillance rooms locked and shall not use such rooms for any other function.
I. A medical cannabis facility shall limit access to surveillance areas to persons who are essential to surveillance operations, law-enforcement agencies, security system service employees, the board or the board's agent, and others when approved by the board. A medical cannabis facility shall make available a current list of authorized employees and security system service employees who have access to the surveillance room of the processor or facility.
J. If diversion, theft, or loss of cannabis plants, seeds, parts of plants, extracts, or cannabis products has occurred from a medical cannabis facility, the board may require additional safeguards to ensure the security of the products.
Statutory Authority
§§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 40, Issue 11, eff. January 1, 2024.
3VAC10-40-150. Reportable events.
A. Upon becoming aware of (i) diversion, theft, loss, or discrepancies identified during inventory; (ii) unauthorized destruction of any cannabis products; or (iii) any loss or unauthorized alteration of records related to cannabis products or qualifying patients, a pharmacist, responsible party, or medical cannabis facility shall immediately notify appropriate law-enforcement authorities and the board.
B. A pharmacist, responsible party, or medical cannabis facility shall provide the notice required by subsection A of this section to the board by way of a signed statement that details the circumstances of the event, including an accurate inventory of the quantity and registered cannabis product names of cannabis product diverted, stolen, lost, destroyed, or damaged and confirmation that the local law-enforcement authorities were notified. A pharmacist, responsible party, or medical cannabis facility shall make such notice no later than 24 hours after discovery of the event.
C. A pharmacist, responsible party, or medical cannabis facility shall notify the board no later than the next business day, followed by written notification no later than 10 business days, of any of the following:
1. An alarm activation or other event that requires a response by public safety personnel;
2. A breach of security;
3. The failure of the security alarm system due to a loss of electrical support or mechanical malfunction that is expected to last longer than eight hours; and
4. Corrective measures taken, if any.
D. A pharmacist, responsible party, pharmaceutical processor, or cannabis dispensing facility shall immediately notify the board of an employee convicted of a felony.
Statutory Authority
§§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 40, Issue 11, eff. January 1, 2024.