(1) The department must contract with an entity to create, administer, and maintain a secure and confidential medical marijuana authorization database that, beginning July 1, 2016, allows:

(a) A marijuana retailer with a medical marijuana endorsement to add a qualifying patient or designated provider and include the amount of marijuana concentrates, useable marijuana, marijuana-infused products, or plants for which the qualifying patient is authorized under RCW 69.51A.210;

(b) Persons authorized to prescribe or dispense controlled substances to access health care information on their patients for the purpose of providing medical or pharmaceutical care for their patients;

(c) A qualifying patient or designated provider to request and receive his or her own health care information or information on any person or entity that has queried their name or information;

(d) Appropriate local, state, tribal, and federal law enforcement or prosecutorial officials who are engaged in a bona fide specific investigation of suspected marijuana-related activity that may be illegal under Washington state law to confirm the validity of the recognition card of a qualifying patient or designated provider;

(e) A marijuana retailer holding a medical marijuana endorsement to confirm the validity of the recognition card of a qualifying patient or designated provider;

(f) The department of revenue to verify tax exemptions under chapters 82.08 and 82.12 RCW;

(g) The department and the health care professional's disciplining authorities to monitor authorizations and ensure compliance with this chapter and chapter 18.130 RCW by their licensees; and

(h) Authorizations to expire six months or one year after entry into the medical marijuana authorization database, depending on whether the authorization is for a minor or an adult.

(2) A qualifying patient and his or her designated provider, if any, may be placed in the medical marijuana authorization database at a marijuana retailer with a medical marijuana endorsement. After a qualifying patient or designated provider is placed in the medical marijuana authorization database, he or she must be provided with a recognition card that contains identifiers required in subsection (3) of this section.

(3) The recognition card requirements must be developed by the department in rule and include:

(a) A randomly generated and unique identifying number;

(b) For designated providers, the unique identifying number of the qualifying patient whom the provider is assisting;

(c) A photograph of the qualifying patient's or designated provider's face taken by an employee of the marijuana retailer with a medical marijuana endorsement at the same time that the qualifying patient or designated provider is being placed in the medical marijuana authorization database in accordance with rules adopted by the department;

(d) The amount of marijuana concentrates, useable marijuana, marijuana-infused products, or plants for which the qualifying patient is authorized under RCW 69.51A.210;

(e) The effective date and expiration date of the recognition card;

(f) The name of the health care professional who authorized the qualifying patient or designated provider; and

(g) For the recognition card, additional security features as necessary to ensure its validity.

(4) For qualifying patients who are eighteen years of age or older and their designated providers, recognition cards are valid for one year from the date the health care professional issued the authorization. For qualifying patients who are under the age of eighteen and their designated providers, recognition cards are valid for six months from the date the health care professional issued the authorization. Qualifying patients may not be reentered into the medical marijuana authorization database until they have been reexamined by a health care professional and determined to meet the definition of qualifying patient. After reexamination, a marijuana retailer with a medical marijuana endorsement must reenter the qualifying patient or designated provider into the medical marijuana authorization database and a new recognition card will then be issued in accordance with department rules.

(5) If a recognition card is lost or stolen, a marijuana retailer with a medical marijuana endorsement, in conjunction with the database administrator, may issue a new card that will be valid for six months to one year if the patient is reexamined by a health care professional and determined to meet the definition of qualifying patient and depending on whether the patient is under the age of eighteen or eighteen years of age or older as provided in subsection (4) of this section. If a reexamination is not performed, the expiration date of the replacement recognition card must be the same as the lost or stolen recognition card.

(6) The database administrator must remove qualifying patients and designated providers from the medical marijuana authorization database upon expiration of the recognition card. Qualifying patients and designated providers may request to remove themselves from the medical marijuana authorization database before expiration of a recognition card and health care professionals may request to remove qualifying patients and designated providers from the medical marijuana authorization database if the patient or provider no longer qualifies for the medical use of marijuana. The database administrator must retain database records for at least five calendar years to permit the state liquor and cannabis board and the department of revenue to verify eligibility for tax exemptions.

(7) During development of the medical marijuana authorization database, the database administrator must consult with the department, stakeholders, and persons with relevant expertise to include, but not be limited to, qualifying patients, designated providers, health care professionals, state and local law enforcement agencies, and the University of Washington computer science and engineering security and privacy research lab or a certified cyber security firm, vendor, or service.

(8) The medical marijuana authorization database must meet the following requirements:

(a) Any personally identifiable information included in the database must be nonreversible, pursuant to definitions and standards set forth by the national institute of standards and technology;

(b) Any personally identifiable information included in the database must not be susceptible to linkage by use of data external to the database;

(c) The database must incorporate current best differential privacy practices, allowing for maximum accuracy of database queries while minimizing the chances of identifying the personally identifiable information included therein; and

(d) The database must be upgradable and updated in a timely fashion to keep current with state of the art privacy and security standards and practices.

(9)(a) Personally identifiable information of qualifying patients and designated providers included in the medical marijuana authorization database is confidential and exempt from public disclosure, inspection, or copying under chapter 42.56 RCW.

(b) Information contained in the medical marijuana authorization database may be released in aggregate form, with all personally identifying [identifiable] information redacted, for the purpose of statistical analysis and oversight of agency performance and actions.

(c) Information contained in the medical marijuana authorization database shall not be shared with the federal government or its agents unless the particular [qualifying] patient or designated provider is convicted in state court for violating this chapter or chapter 69.50 RCW.

(10)(a) The department must charge a one dollar fee for each initial and renewal recognition card issued by a marijuana retailer with a medical marijuana endorsement. The marijuana retailer with a medical marijuana endorsement shall collect the fee from the qualifying patient or designated provider at the time that he or she is entered into the database and issued a recognition card. The department shall establish a schedule for marijuana retailers with a medical marijuana endorsement to remit the fees collected. Fees collected under this subsection shall be deposited into the health professions account created under RCW 43.70.320.

(b) By November 1, 2016, the department shall report to the governor and the fiscal committees of both the house of representatives and the senate regarding the cost of implementation and administration of the medical marijuana authorization database. The report must specify amounts from the health professions account used to finance the establishment and administration of the medical marijuana authorization database as well as estimates of the continuing costs associated with operating the medical marijuana [authorization] database. The report must also provide initial enrollment figures in the medical marijuana authorization database and estimates of expected future enrollment.

(11) If the database administrator fails to comply with this section, the department may cancel any contracts with the database administrator and contract with another database administrator to continue administration of the database. A database administrator who fails to comply with this section is subject to a fine of up to five thousand dollars in addition to any penalties established in the contract. Fines collected under this section must be deposited into the health professions account created under RCW 43.70.320.

(12) The department may adopt rules to implement this section.

[2015 c 70 § 21.]

NOTES: