Part V. Records, Storage, and Transportation
3VAC10-40-200. Recordkeeping requirements.
A. If a medical cannabis facility uses an electronic system for the storage and retrieval of patient information or other records related to cultivating, producing, and dispensing cannabis products, as applicable, the pharmaceutical processor or cannabis dispensing facility shall use a system that:
1. Guarantees the confidentiality of the information contained in the system;
2. Is capable of safeguarding against erasures and unauthorized changes in data after the information has been entered and verified by the pharmacist or responsible party; and
3. Is capable of being reconstructed in the event of a computer malfunction or accident resulting in the destruction of the data bank.
B. All records relating to inventory, laboratory results, and dispensing shall be maintained for a period of three years and shall be made available to the board upon request.
Statutory Authority
§§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 40, Issue 11, eff. January 1, 2024.
3VAC10-40-210. Storage and handling requirements.
A. A medical cannabis facility shall:
1. Have storage areas that provide adequate lighting, ventilation, sanitation, space, equipment, and security conditions for the cultivation of cannabis and the production and dispensing of cannabis products;
2. Store cannabis plants, seeds, parts of plants, extracts, including cannabis products, that are outdated, damaged, deteriorated, misbranded, adulterated, or whose containers or packaging have been opened or breached, in a separate quarantined storage area until such cannabis plants, seeds, parts of plants, extracts, or cannabis products are destroyed;
3. Be maintained in a clean, sanitary, and orderly condition; and
4. Be free from infestation by insects, rodents, birds, or vermin of any kind.
B. A medical cannabis facility shall compartmentalize all areas in the facility based on function and shall restrict access between compartments.
C. The pharmaceutical processor or cannabis cultivation facility shall establish, maintain, and comply with written policies and procedures regarding best practices for the secure and proper cultivation of cannabis and production of cannabis products. These shall include policies and procedures that:
1. Restrict movement between compartments;
2. Provide for different colored identification cards for employees based on the compartment to which the employees are assigned at a given time so as to ensure that only employees necessary for a particular function have access to that compartment of the facility; and
3. Document the chain of custody of all cannabis plants, parts of plants, seeds, extracts, and cannabis products.
D. A cannabis dispensing facility shall establish, maintain, and comply with written policies and procedures regarding best practices for the secure and proper dispensing of cannabis products.
E. The PIC or responsible party of a medical cannabis facility shall establish, maintain, and comply with written policies and procedures for the cultivation, production, security, storage, and inventory of cannabis, including the seeds, parts of plants, extracts, and cannabis products, as applicable. Such policies and procedures shall include methods for identifying, recording, and reporting diversion, theft, or loss and for correcting all errors and inaccuracies in inventories. Medical cannabis facilities shall include in their written policies and procedures a process for:
1. Handling mandatory and voluntary recalls of cannabis products and bulk cannabis oil, botanical cannabis, and usable cannabis distributed or received via wholesale distribution. The process shall be adequate to deal with recalls due to any action initiated at the request of the board and any voluntary action by the pharmaceutical processor or cannabis dispensing facility to (i) remove defective or potentially defective cannabis products from the market or (ii) promote public health and safety by replacing existing cannabis products with improved products or packaging;
2. Preparing for, protecting against, and handling any crises that affect the security or operation of any facility in the event of labor strike, fire, flood, or other natural disaster, or other situations of local, state, or national emergency;
3. Ensuring that any outdated, damaged, deteriorated, misbranded, or adulterated cannabis, including seeds, parts of plants, extracts, and cannabis products, is segregated from all other cannabis, seeds, parts of plants, extracts, and cannabis products and destroyed. This procedure shall provide for written documentation of the cannabis, including seeds, parts of plants, extracts, and cannabis product disposition; and
4. Ensuring the oldest stock of cannabis, including seeds, parts of plants, extracts, and cannabis products are used first. The procedure may permit deviation from this requirement if such deviation is temporary and appropriate.
F. The pharmaceutical processor or cannabis cultivation facility shall:
1. Store all cannabis, including seeds, parts of plants, extracts, and cannabis products, in the process of production, transfer, or analysis in such a manner as to prevent diversion, theft, or loss;
2. Make cannabis, including the seeds, parts of plants, extracts, and cannabis products, accessible only to the minimum number of specifically authorized employees essential for efficient operation; and
3. Return such items to their secure location immediately after completion of the production, transfer, or analysis process or at the end of the scheduled business day.
G. If a production process cannot be completed at the end of a working day, the pharmacist, responsible party, or other person authorized by the responsible party to supervise cultivation and production at the pharmaceutical processor or cannabis cultivation facility shall securely lock the processing area or tanks, vessels, bins, or bulk containers containing cannabis, including the seeds, parts of plants, extracts, and cannabis products, inside an area or building that affords adequate security.
H. The cannabis dispensing facility shall store all cannabis products in such a manner as to prevent diversion, theft, or loss; shall make cannabis products accessible only to the minimum number of specifically authorized employees essential for efficient operation; and shall return the cannabis products to their secure location at the completion of the dispensing or at end of the scheduled business day.
Statutory Authority
§§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 40, Issue 11, eff. January 1, 2024; amended, Virginia Register Volume 41, Issue 14, eff. February 10, 2025.
3VAC10-40-220. Medical cannabis facility closings; going out of business; change of ownership.
A. At least 30 days prior to the date a medical cannabis facility closes, either temporarily or permanently, the owner shall:
1. Notify the board;
2. Send written notification to patients with current certification; and
3. Post a notice on the window or door of the medical cannabis facility.
B. The proposed disposition of all cannabis, industrial hemp extracts, cannabis products, dispensing records, patient information records, and other required records, as applicable, shall be reported to the board. If the cannabis, cannabis products, and records are to be transferred to another medical cannabis facility located in Virginia, the owner shall inform the board and the patients and include on the public notice the name and address of the processor or cannabis dispensing facility to whom the cannabis, cannabis products, and records are being transferred and the date of transfer.
C. The board may approve exceptions to the public notice requirement due to exigent circumstances, including sudden closing due to fire, destruction, natural disaster, death, property seizure, eviction, bankruptcy, or other emergency circumstances. If the medical cannabis facility is not able to meet the notification requirements, the owner shall ensure that the board and public are properly notified as soon as the owner knows of the closure and shall disclose the emergency circumstances preventing the notification within the required deadlines.
D. In the event of an exception to the notice, the PIC, responsible party, or owner shall provide notice as far in advance of closing as allowed by the circumstances.
E. At least 14 days prior to any change in ownership of an existing medical cannabis facility, the owner shall notify the board of the pending change.
1. Upon any change in ownership of an existing pharmaceutical processor or cannabis dispensing facility, the dispensing records for the two years immediately preceding the date of change of ownership and other required patient information shall be provided to the new owners on the date of change of ownership in substantially the same format as previously used immediately prior to the transfer to provide continuity of services.
2. The previous owner shall be held responsible for ensuring the proper and lawful transfer of records on the date of the transfer.
3. If a new owner's share constitutes 5.0% or greater of the total ownership, the new owner shall submit to fingerprinting and the criminal history record search required of § 4.1-1602 of the Code of Virginia.
Statutory Authority
§§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 40, Issue 11, eff. January 1, 2024.
3VAC10-40-230. Cannabis delivery and transportation general requirements.
A. Prior to transporting medical cannabis to another medical cannabis facility or offering cannabis delivery to patients, a medical cannabis facility shall submit the following items to the authority:
1. A list of the employees authorized to transport or deliver cannabis, along with a copy of each authorized employee's valid driver license; and
2. For each transport or delivery vehicle:
a. License plate number, vehicle identification number, make, and model;
b. An attestation that the vehicle is properly registered and insured;
c. A description of the locked, safe, and secure storage compartments in the vehicle; and
d. A description of the security system, form of secure communication, global positioning system (GPS) monitoring device, and any other equipment or system required pursuant to 3VAC10-40-240.
B. A medical cannabis facility shall provide written notice to the authority, along with the documentation required in subsection A of this section, in the event the facility adds or removes a transport or delivery vehicle or an authorized employee.
C. No medical cannabis facility shall advertise, offer, or commence delivery or transport operations prior to receiving written approval from the authority.
Statutory Authority
§§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 41, Issue 14, eff. February 10, 2025.
3VAC10-40-240. Vehicle security.
A. All transport or delivery vehicles shall be properly registered with the Commonwealth and be insured in the Commonwealth. Medical cannabis facilities shall maintain registration and insurance documents and provide the documents to the authority and law-enforcement officials upon request.
B. A transport or delivery vehicle shall bear no marking or outward appearance, including brand or company names, that would indicate to a reasonable person that the vehicle is used to transport cannabis.
C. At all times during the transportation of cannabis, a transport or delivery vehicle shall be equipped with the following functioning features:
1. Heating and air conditioning systems sufficient for maintaining appropriate temperatures for the storage of cannabis during transport in accordance with recommendations provided by the originating medical cannabis facility to protect the quality and integrity of the cannabis;
2. A locked, safe, and secure storage compartment where cannabis will be stored during transport that (i) is a secured part of the vehicle, (ii) is not easily removed, and (iii) ensures cannabis is not visible from the outside of the vehicle;
3. A global positioning system (GPS) monitoring device that is secured to the vehicle in a manner not easily removed and able to remain powered on when the transport vehicle is not running, the information from which shall be maintained in accordance with 3VAC10-40-260;
4. A secure form of communication between the transporting agent and the transporting facility, and any originating facility if required by 3VAC10-40-260 G, at all times during the transportation of cannabis. Secure forms of communication shall include a two-way digital or analog radio, cellular telephone, and satellite telephone, taking into consideration the functionality of the communication device within the geographic area of the transport; and
5. An adequate vehicle security system to prevent adulteration, diversion, theft, and loss of cannabis, including an audible alarm system.
D. Access to transport vehicle security equipment and records shall be limited to (i) persons who are essential to security operations, (ii) law-enforcement agencies, (iii) security system service employees, (iv) the authority, and (v) other persons approved by the authority. A transporting facility shall maintain a current list of all individuals who have access to any transport vehicle security equipment and records.
E. The authority may inspect a transport or delivery vehicle as well as its equipment, including security systems, forms of secure communication, and GPS monitoring devices at any time without prior notice. If the authority determines that the transport or delivery vehicle does not satisfy the requirements of this section, or that such transport or delivery vehicle requires additional security measures to address public health and safety concerns, the medical cannabis facility shall not use the transport vehicle until such time as it receives a satisfactory inspection from the authority.
Statutory Authority
§§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 41, Issue 14, eff. February 10, 2025.
3VAC10-40-250. Manifests.
A. Prior to transporting cannabis between medical cannabis facilities or from a medical cannabis facility to a testing laboratory:
1. The originating facility shall prepare a transport manifest on a form and in a manner prescribed by the authority, itemizing all cannabis to be transported. A separate copy of the transport manifest shall be provided to the transporting employee to accompany the itemized cannabis at all times during transport.
2. The originating facility shall securely transmit a copy of the transport manifest to the receiving facility at least 24 hours prior to transport.
3. An authorized transportation employee shall review the transport manifest prepared by the originating facility and confirm that it accurately describes the type and quantity of cannabis in the transport vehicle to be transported by the transporting employee, in the aggregate and for each delivery.
B. Prior to delivering cannabis to a qualifying patient, parent, legal guardian, or registered agent:
1. The pharmaceutical processor or cannabis dispensing facility shall prepare a delivery manifest on a form and in a manner prescribed by the authority, itemizing all cannabis to be delivered. A separate copy of the delivery manifest shall be provided to the delivery employee to accompany the itemized cannabis at all times during transport.
2. The delivery employee shall review the delivery manifest prepared by the medical cannabis facility and confirm that it includes sufficient identifying information for each patient, parent, legal guardian, or registered agent, including name and day and month of birth.
C. No transport vehicle shall carry any cannabis for which a manifest has not been provided, and all cannabis shall be packaged in sealed, labeled, and tamper-resistant packaging at all times.
Statutory Authority
§§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 41, Issue 14, eff. February 10, 2025.
3VAC10-40-260. Transportation of cannabis.
A. A transporting employee shall remain with the transport vehicle at all times that the vehicle contains cannabis, provided that if there is only one transporting employee, the transporting employee may leave the vehicle, which shall be securely locked, only for:
1. Delivering or transferring cannabis to a qualifying patient, parent, legal guardian, registered agent, or medical cannabis facility;
2. Meals, when the transport lasts more than three hours round trip;
3. Rest periods required by law;
4. Refueling; or
5. Exigent circumstances, including collisions, traffic stops, mechanical breakdowns, weather emergencies, or medical emergencies.
B. A transporting employee shall carry transportation credentials at all times during the transportation of cannabis and display such credentials to the appropriate persons at the originating facility prior to each instance of transportation of cannabis, and to any law-enforcement official or authorized authority representative upon request. For purposes of this section, "transportation credentials" shall mean the transporting employee's valid driver's license, a copy of the medical cannabis facility's permit, and all transport or delivery manifests for cannabis contained in the transport vehicle.
C. A transporting facility shall inspect and test all security systems, secure communications, and global positioning system (GPS) monitoring devices of each transport vehicle at least once per day of use, prior to the transport vehicle's first departure. The individual conducting the inspection on behalf of the transporting facility shall create a signed record of the inspection that includes (i) the name of the individual, (ii) the vehicle identification number of the transport vehicle, (iii) the date of inspection, and (iv) the status of all inspected systems, equipment, and devices. The transporting facility shall maintain all inspection records.
D. No transport vehicle shall transport cannabis unless every security system, form of secure communication, and GPS monitoring device is in good working order and functioning properly.
E. If any security system, form of secure communication, or GPS monitoring device fails during the transportation of cannabis, the transporting employee shall immediately notify the transporting facility and all impacted originating facilities of the specific failure and return directly to the transporting facility or originating facility. Such transport vehicle shall not resume transportation of cannabis until all systems resume full functioning capacity.
F. The transporting facility shall create a confidential delivery schedule within 24 hours of the transport and only provide the transporting employee with a copy of such confidential delivery schedule immediately prior to departure.
G. A transporting employee shall communicate with the transporting facility upon arriving at and departing from each scheduled delivery location.
H. A transporting employee shall strictly adhere to the delivery schedule provided by the transporting facility and not make any unscheduled stops. In the case of an emergency unscheduled stop, the transport vehicle shall remain securely locked, and the transporting employee shall verbally communicate with the transporting facility, describing the reason for the emergency unscheduled stop, the location and the duration of the emergency unscheduled stop, any activities of the transporting employee, and the identities and activities of any persons interacting with the transport vehicle or the transporting employee. The transporting facility shall maintain a record of any communications related to an unscheduled stop.
I. For a period of not less than 90 days, a transporting facility shall maintain a record of the GPS information of each of its transport vehicles for the entire duration of any transportation of cannabis and make such information available to the authority upon request. A transporting facility may contract with the GPS provider or similar service provider to conduct GPS monitoring, provided that any such third-party GPS monitor shall comply with all applicable state and federal laws regarding patient confidentiality.
J. A transporting employee shall return any undeliverable cannabis to the respective originating facility directly after the last scheduled delivery.
K. No cannabis shall be stored in a transport vehicle after the facility's hours of operation, and in no event longer than 24 hours, unless the vehicle is contained within an enclosed, secure part of the facility.
L. A transporting facility shall report to the authority and local law enforcement any transport vehicle accidents, transport vehicle theft, cannabis diversion, loss, or adulteration, and any other event deemed by the authority to be a reportable event in connection with the transportation of cannabis within 24 hours of such event being discovered.
Statutory Authority
§§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 41, Issue 14, eff. February 10, 2025.
3VAC10-40-270. Delivery to qualifying patients, parents, legal guardians, and registered agents.
A. Medical cannabis facilities offering delivery shall require each qualifying patient, parent, legal guardian, or registered agent who purchases cannabis for delivery to provide the medical cannabis facility with the full legal name, date of birth, address, email address, and telephone number of the qualifying patient and, if applicable, the legal name, date of birth, and address of the parent, legal guardian, or registered agent.
B. For each delivery of cannabis to a qualifying patient, parent, legal guardian, or registered agent, a transporting employee shall confirm from a valid driver's license or other valid, government-issued photographic identification that the identity of the individual accepting the cannabis delivery is the same as the individual who ordered the cannabis and confirm the qualifying patient's registration number.
C. If the identity, age, or registration of the individual accepting the cannabis delivery remains in question after presentation of the required documentation, the transporting employee shall (i) immediately alert the originating facility and (ii) return the cannabis to the originating facility directly after the last scheduled delivery.
D. Medical cannabis may only be delivered to a residence in Virginia. "Residence" means a dwelling such as a house, apartment, nursing home, or retirement center. It does not include a dormitory, hotel, motel, bed and breakfast, or other commercial business.
E. Medical cannabis may only be delivered between the hours of 6 a.m. and midnight.
Statutory Authority
§§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 41, Issue 14, eff. February 10, 2025.
3VAC10-40-280. Delivery and transportation incident notification.
A. A pharmaceutical processor transporting or delivering medical cannabis must report any traffic stop, breakdown, collision, or unscheduled stop lasting more than two hours to the authority with 24 hours.
B. An originating facility's authorized employees shall make a good faith effort to contact the authority if exigent circumstances require removal of cannabis or cannabis products from the vehicle prior to arrival at the destination listed on the transport manifest. Authorized employees shall make a good faith effort to protect the shipment from diversion.
Statutory Authority
§§ 4.1-601, 4.1-604, and 4.1-606 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 41, Issue 14, eff. February 10, 2025.