(A) Dispensary records may be maintained electronically and be available for inspection by the state board of pharmacy upon request. The dispensary shall develop recordkeeping policies and procedures consistent with this division.
(B) Any dispensary that uses an electronic system for the storage and retrieval of patient information or other medical marijuana records, shall use a system that:
(1) Guarantees the confidentiality of the information contained within;
(2) Can be accessed by the state board of pharmacy in accordance with this division;
(3) Can provide safeguards against erasures and unauthorized changes in data after the information has been entered and verified by the dispensary;
(4) Contains a true audit trail that indicates and dates any edits or deletions to a patient record; and
(5) Is capable of being reconstructed or retrieved within three business days, in the event of a computer malfunction or accident resulting in the destruction of the database.
(C) Each dispensary shall keep a record of all medical marijuana received, dispensed, sold, destroyed, or used. The acts of dispensing and destroying of a controlled substance must be documented with the positive identification of the responsible individual. These records may be kept electronically if the method is approved by the state board of pharmacy and the records are backed-up each business day.
(D) Any dispensary intending to maintain records at a location other than the licensed dispensary premises must first send a written request to the state board of pharmacy. The request shall contain the dispensary name and license number of the requestor and the name and address of the alternate location. The state board of pharmacy will send written notification to the dispensary documenting the approval or denial of the request. A copy of the board's approval shall be maintained with the medical marijuana records located on the licensed dispensary premises. Any alternate location shall be secured and accessible only to authorized dispensary employees.
(E) Documentation maintained and organized by a dispensary in the normal course of business must include, but is not limited to:
(1) Background checks for employees
(2) Operating procedures;
(3) Inventory records;
(4) Audit records;
(5) Staffing plan;
(6) Business records that include:
(a) Assets and liabilities;
(b) Third party vendor list;
(c) Monetary transactions;
(d) Written or electronic accounts that shall include bank statements, journals, ledgers, and supporting documents, agreements, checks, invoices and vouchers; and
(e) Any other financial accounts reasonably related to dispensary operations.
(7) Surveillance records;
(8) Attendance logs;
(9) Employee training records;
(10) Quality assurance review logs;
(11) All other records required under Chapter 3796. of the Revised Code and this division.
(F) All records relating to the purchase or return, dispensing, distribution, destruction, and sale of medical marijuana shall be maintained under appropriate supervision and control to restrict unauthorized access.