Chapter 1301:18-8 | Dispensary Patient Confidentiality

Rule 1301:18-8-01 | Dispensary Certificate of Operation.

• Effective: November 8, 2024
• Promulgated Under: 119.03

(A) Unless otherwise authorized by the division, each dispensary is precluded from distributing or selling cannabis as authorized under these rules until the division issues the dispensary a certificate of operation.

(B) The division will not issue a provisional dispensary a certificate of operation unless and until the dispensary meets all mandates outlined under this chapter.

(C) Each dispensary shall have twelve months from the date the dispensary is issued a provisional license pursuant to this chapter to obtain a certificate of operation.

(D) Upon receipt of its certificate of operation, a dispensary may engage in the following activities:

(1) Obtain cannabis from a cultivator, processor, or other dispensary licensed pursuant to this chapter;

(2) Distribute, transfer, and sell cannabis to a cultivator, processor, or other dispensary licensed pursuant to this chapter;

(3) Transfer cannabis for research and development or laboratory testing to a laboratory licensed pursuant to this chapter; and

(4) Deliver cannabis and cannabis paraphernalia pursuant to division 1301:18 of the Administrative Code.

(E) A certificate of operation shall be issued to, and valid only for, the designated business entity, owners, and licensed premises specified within the dispensary's initial application for licensure pursuant to rule 1301:18-2-02 of the Administrative Code.

Last updated November 8, 2024 at 8:19 AM

Supplemental Information

Authorized By: 3780.03, 3796.03
Amplifies: 3780.03, 3780.15, 3780.20, 3796.03, 3796.20
Five Year Review Date: 11/8/2029

Rule 1301:18-8-02 | Dispensary Operating Procedures and Quality Assurance.

• Effective: October 31, 2024
• Promulgated Under: 119.03

(A) Each dispensary shall establish, maintain, and comply with written policies and procedures for the daily operation and distribution of cannabis. The dispensary's standard operating policies and procedures shall mitigate the risk of diversion, theft, or loss and ensure compliance with all mandates under this chapter.

(B) Unless otherwise authorized, a dispensary shall only distribute cannabis, cannabis paraphernalia, or other inventory at the licensed premises.

(C) Major modifications

(1) Any proposed major renovation or modification of the licensed premises shall be submitted to the division at least sixty calendar days prior to implementation.

(2) The division will review the proposed modification and may do any of the following:

(a) Approve the submission;

(b) Deny the submission; or

(c) Mandate updates to the submission to ensure compliance with this chapter.

(3) The division may inspect the licensed premises pursuant to any proposed major renovation or modification.

(D) Each dispensary shall ensure the licensed premises:

(1) Conforms with all relevant local ordinances, zoning and planning requirements, and fire codes;

(2) Does not exceed maximum building capacity and prevents the presence of individuals not engaged in activities authorized pursuant to these rules;

(3) Prominently displays its certificate of operation and license seal issued by the division;

(4) Maintains proper cleanliness, ventilation, temperature control, and sanitation to ensure safe and consistent inventory;

(5) Contains sufficient lighting to ensure visibility, security, and proper surveillance;

(6) A dispensary licensed as a dual-use facility pursuant to these rules shall ensure the facility:

(a) Serves and accommodates medical patients and caregivers and adult-use consumers alike;

(b) Maintains ongoing inventory sufficient to maintain an adequate supply of medical cannabis to meet the current demand and projected patient and caregiver population;

(c) Provides accommodations to medical cannabis patients and caregivers that may include, but is not limited to:

(i) Dedicated hours of operation limited to medical-only patients and caregivers during which adult-use consumers are precluded from the facility.

(ii) Expanded options for medical cannabis delivery and online ordering.

(iii) Efficient point-of-sale accommodations that similarly and expeditiously serve medical patients and caregivers and adult-use consumers.

(E) Each dispensary shall designate areas within the facility that are compartmentalized based upon function.

(1) Each dispensary shall maintain designated secure, limited access areas that are accessible only by authorized registered employees.

(a) Each dispensary's designated secure, limited access areas shall include the following:

(i) A storage area for all cannabis, cannabis paraphernalia, and any other inventory;

(ii) A security area for all security and surveillance systems and equipment;

(iii) A cannabis destruction and disposal area that complies with rule 1301:18-3-12 of the Administrative Code;

(iv) An area for receipt of all deliveries to the facility.

(b) All secure, limited access areas shall be constantly monitored, video surveilled, and meet all requirements under rule 1301:18-8-05 of the Administrative Code;

(c) Each dispensary shall post conspicuous signage at all secure, limited access areas stating: "Do not enter- Restricted Access Area Access Restricted to Authorized Employees Only."

(d) Unless otherwise authorized by the division, no dispensary shall create or allow photographs, videos, or other media depicting any secure, limited access area.

(2) Each dispensary shall maintain a designated retail area.

(a) Pursuant to rule 1301:18-8-05 of the Administrative Code, the retail area shall be secure and video surveilled to prevent diversion, theft, loss, or unauthorized access by the public.

(b) Except as outlined under paragraph (E)(2)(c) of this rule, cannabis, cannabis paraphernalia, and other inventory may not be maintained in the designated retail area.

(c) Within the retail area, each dispensary shall establish a secure, limited access area that is physically separated from the remainder of the retail area and is accessible only by authorized registered employees. This secure, limited access area shall:

(i) Maintain all cash registers or other points of sale; and

(ii) Ensure any cannabis, cannabis paraphernalia, or other inventory maintained in this area is limited in quantity, separately secured to prevent theft, and not visible from outside the facility.

(F) Employees

(1) Prior to commencing employment, each dispensary shall ensure all employees are registered with the division pursuant to rule 1301:18-3-09 of the Administrative Code and receive adequate education and training on standard operating procedures and as mandated by rule 1301:18-3-10 of the Administrative Code.

(2) All registered employees are to display their employee badge at all times during working hours.

(3) A registered responsible party as outlined by rule 1301:18-8-03 of the Administrative Code is to be present at the licensed premises at least twenty hours per week.

(G) Hours of operation

(1) A dispensary may operate between the hours of seven a.m. and eleven p.m.

(2) Each dispensary shall maintain reasonable hours of operation and conspicuously post such hours of operation at the licensed premises.

(3) Each dispensary shall establish, maintain, and comply with written procedures for facility closure.

Each dispensary shall include in its written closure procedures a method to notify patients and caregivers of when the dispensary will resume normal hours of operation and conspicuously post such information at the licensed premises.

(4) Each dispensary shall notify the division in advance of any permanent, long-term modifications to its hours of operation.

(H) Daily operations

(1) Each dispensary shall mandate all members of the public to present valid, government-issued photographic identification containing the individual's date of birth prior to each of the following events:

(a) Entering the designated retail area;

(b) Executing any sale conducted at the licensed premises; and

(c) Transferring possession of any purchased materials to a customer.

(2) Unless otherwise authorized under these rules, no person under the age of twenty-one shall be granted access to the dispensary's licensed premises.

(a) Registered patients who are under the age of twenty-one may enter the premises if they present valid patient identification.

(b) Registered patients under the age of eighteen are to be accompanied by their registered caregiver.

(3) Prior to entering the dispensary's retail area, all members of the public shall be mandated to present valid, government-issued photographic identification containing the individual's date of birth.

A registered dispensary employee is to review the individual's identification and ensure the following:

(a) The individual is at least twenty-one years of age or older; or

(b) For registered patients:

(i) The individual is eighteen years of age or older or accompanied by the patient's registered caregiver; and

(ii) The dispensary employee will also mandate presentation of valid patient identification.

(I) Points of sale

(1) Prior to any sale, or the transfer of possession of any cannabis, a registered dispensary employee will review the customer's valid, government-issued photographic identification containing the customer's date of birth. The employee shall confirm the individual is:

(a) A customer is at least twenty-one years of age or older or authorized to engage in activities pursuant to this chapter;

(b) The information contained on the customer's identification matches the individual presenting the identification;

(c) The information contained on the customer's identification matches the information provided in the order; and

(d) If applicable, the registered employee will also review documentation evidencing the individual is a veteran or indigent status.

(2) A dispensary may accept orders and payment for cannabis and cannabis paraphernalia via the internet.

A dispensary that accepts orders and payment pursuant to this paragraph shall ensure a registered dispensary employee mandates the customer to present all identifying information outlined under paragraph (I)(1) of this rule prior to transferring possession of any purchased materials to the customer.

(3) A dispensary may utilize a self-serve ordering kiosk located within the physical premises of the facility.

(a) The dispensary shall ensure that the kiosk and surrounding area are secure and surveilled to prevent diversion, theft, and loss.

(b) A self-serve ordering kiosk may not automatically or directly dispense cannabis to individuals.

(4) Each dispensary shall maintain at each point-of-sale:

(a) Educational materials in compliance with section 3780.30 of the Revised Code on substance abuse and access to addiction services;

(b) Contact information for the division's toll-free telephone line in compliance with section 3796.17 of the Revised Code; and

(c) Any other information mandated by the division.

(J) Drive-up window:

(1) A dispensary may petition the division to distribute inventory via a drive-up window affixed to the physical premises of the facility.

(2) The dispensary shall ensure that the drive-up window, and the area immediately surrounding, is secure, video surveilled, and meet all mandates outlined under rule 1301:18-8-05 of the Administrative Code.

(3) The area immediately surrounding the drive-up window, must be possessed or controlled by the dispensary or authorized for use of the area via express written consent by the property owner.

(K) Curbside pickup:

(1) A dispensary may petition the division to distribute purchased inventory via curbside pickup.

(2) The dispensary shall ensure the area designated for curbside pickup, and the immediately surrounding area, is secure, video surveilled, and meets all mandates under rule 1301:18-8-05 of the Administrative Code.

(3) Any area designated for curbside pickup, and the immediately surrounding area, must be possessed or controlled by the dispensary or authorized for use of the area via express written consent by the property owner.

(4) The dispensary shall assign a registered dispensary employee who meets the mandates outlined under paragraph (B) of rule 1301:18-8-05 of the Administrative Code to monitor and assist with any curbside pickup distribution.

(5) A registered dispensary employee shall mandate presentation of the individual's identification as outlined under paragraph (I)(1) of this rule prior to transferring possession of the purchased inventory.

Last updated October 31, 2024 at 9:39 AM

Supplemental Information

Authorized By: 3780.03, 3796.03
Amplifies: 3780.03, 3780.15, 3780.20, 3796.03, 3796.20
Five Year Review Date: 10/31/2029

Rule 1301:18-8-03 | Dispensary Designated Responsible Party.

• Effective: October 31, 2024
• Promulgated Under: 119.03

(A) Prior to the issuance or renewal of a certificate of operation, each dispensary shall designate at least one, but not more than three individuals to serve as the licensee's responsible party as defined by rule 1301:18-3-09 of the Administrative Code.

(B) A dispensary's designated responsible party will manage the facility's daily operations and ensure compliance with all standard operating procedures.

(C) A responsible party is to be physically present at the licensed premises at least twenty hours per week and be immediately available to communicate with dispensary staff or the division during any operating hours when they are not physically present. The responsible party will ensure the following:

(1) The licensed premises remain secure, surveilled, and in compliance with rule 1301:18-8-05 of the Administrative Code;

(2) All inventory is maintained in the facility's secure, limited access storage area;

(3) All inventory is properly recorded and tracked in the state inventory tracking system;

(4) All delivery and receipt of cannabis occurs in a secure, limited access area;

(5) All dispensing errors are immediately remedied and reported to the division;

(6) In the event of any diversion, theft, or loss the dispensary complies with rule 1301:18-9-02 of the Administrative Code.

(D) Each dispensary shall notify the division in writing of a change of a designated responsible party within ten calendar days of the effective date of the appointment of a new designated responsible party.

Last updated October 31, 2024 at 9:39 AM

Supplemental Information

Authorized By: 3780.03, 3796.03
Amplifies: 3780.03, 3796.03
Five Year Review Date: 10/31/2029

Rule 1301:18-8-05 | Minimum Security and Surveillance Requirements.

• Effective: October 31, 2024
• Promulgated Under: 119.03

(A) Each dispensary shall establish, maintain, and comply with written policies and procedures that ensure adequate security, surveillance, and control of the licensed premises that prevent diversion, theft, or loss and meet the minimum requirements outlined under this rule.

Pursuant to rule 1301:18-8-02 of the Administrative Code each dispensary shall petition the division of cannabis control prior to implementing any major modification to the facility's security procedures, systems, or equipment.

(B) Prior to the commencement of business, each dispensary shall meet the following security and surveillance requirements that ensure compliance with all standards established by the division:

(1) Designate a secure, limited access area for all equipment maintained pursuant to this rule that is accessible only by authorized registered dispensary employees with foundational training in security and surveillance;

(2) Install a security alarm system with commercial grade equipment that includes the following:

(a) An access alarm on all entry points and windows;

(b) Motion detectors that identify unauthorized access into the facility; and

(c) A silent alarm, which may be utilized during instances of duress that sends a pre-recorded voice message to the facility's designated security personnel and law enforcement, public safety, or emergency services requesting dispatch, which includes the capability to enter a designated code into an arming station to signal that the alarm user is being forced to turn off the system.

(3) Install a video surveillance system that complies with the following:

(a) Capable of electronic monitoring of the facility and real-time access by the division;

(b) Collects twenty-four-hour live video feed with motion-activated recording capabilities for all video cameras that record in at least fifteen frames per second;

(c) Archives and retains recordings for at least forty-five calendar days;

(d) Contains a display monitor with a minimum screen size of nineteen inches;

(e) Exports still images in an industry standard format that guarantees authentication and prevents alteration of the recorded images;

(f) Produces clear color still photographs that are a minimum of 600 x 600 dpi from any camera image, live or recorded;

(g) Embeds a date and time stamp on all recordings; and

(h) Includes a failure notification system that provides an audible and visual notification of any failure in the electronic monitoring system.

(4) Install unobstructed cameras in a manner that prevents tampering, captures the entirety of the licensed premises, and clearly identifies all individuals and activities within the surveilled area;

(5) Camera placement at all the following locations:

(a) All points of ingress and egress;

(b) All secure, limited access areas;

(c) Any area that stores cannabis or facility inventory;

(d) The facility's cannabis destruction and disposal area;

(e) All areas where sales proceeds are stored or transferred; and

(f) Each point of sale.

(6) Daily records of all registered employees' access to any secure, limited access areas;

(7) Develop emergency policies and procedures for securing all inventory and currency in the event of diversion, theft, or loss; and

(8) Any other requirements the division deems necessary to maintain proper security and surveillance and ensure public safety.

(C) Each dispensary shall inspect and test all security and surveillance equipment at least once per month to ensure functionality.

(1) Pursuant to rule 1301:18-3-16 of the Administrative Code, each dispensary shall record and maintain of all security and surveillance equipment tests.

(2) Each dispensary shall notify the division of any failure in the facility's security or surveillance system or equipment.

Any necessary repair or replacement shall occur within twenty-four hours of identification.

(D) In the event a dispensary is made aware of any pending criminal, civil, or administrative investigations or legal proceedings for which a video recording may contain relevant information, the dispensary shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the dispensary that it is not necessary to retain the recording.

Last updated October 31, 2024 at 9:39 AM

Supplemental Information

Authorized By: 3780.03, 3796.03
Amplifies: 3780.03, 3780.15, 3780.20, 3796.03, 3796.20
Five Year Review Date: 10/31/2029

Rule 1301:18-8-07 | Dispensary Patient Confidentiality.

• Effective: December 20, 2024
• Promulgated Under: 119.03

(A) Each dispensary shall ensure the confidentiality of all records related to patient transactions. Except as authorized under paragraph (B) of this rule, patient records may only be released via written authorization and consent by the patient.

(1) Any consent must be signed by the patient and dated.

If a patient is unable to provide written consent, consent may only be provided by the patient's caregiver or legal guardian.

(2) Any consent for disclosure is valid until rescinded by the patient.

(B) A dispensary may release patient records to the following individuals:

(1) The patient;

(2) The patient's designated caregiver;

(3) The certified physician who issued the recommendation to the patient;

(4) Certified or licensed health care personnel responsible for the care of the patient;

(5) Any person that the dispensary is legally required to release the information to, including upon issuance of a valid subpoena, court order, or other similar document only in a criminal matter or an equivalent juvenile matter

(6) An agent who contracts with the dispensary as a "business associate" in accordance with the regulations promulgated by the secretary of the United States department of health and human services pursuant to the federal standards for the privacy of individually identifiable health information;

(7) If applicable, an agent of a medical insurance company who provides insurance coverage for medical cannabis upon authorization and proof of insurance by the patient or proof by the insurance company for those medications requested; and

(8) The Ohio division of cannabis control.

(C) In an emergency, a dispensary may disclose the recommendation information when it is deemed to be in the best interest of the patient.

A dispensary employee that orally discloses patient information pursuant to an emergency must prepare a written statement outlining the following:

(1) The name of the dispensary employee who disclosed the information;

(2) The patient's name;

(3) The date and time of disclosure;

(4) The nature of the emergency; and

(5) The names of the individuals to whom the information was disclosed.

Last updated December 20, 2024 at 7:44 AM

Supplemental Information

Authorized By: 3796.03
Amplifies: 3796.03, 3796.08
Five Year Review Date: 12/20/2029