Archive for WA ST Dept of Health

Department of Health Confirms it, No Privacy for Patients In State Registry


From: Weeks, Kristi (DOH) <Kristi.Weeks@DOH.WA.GOV>
Sent: Wednesday, August 10, 2016 2:43 PM
To: John Novak
Subject: RE: Questions

The traceability system (under the authority of the LCB) lists the purchases and patient identification number. The database (under the authority of the Department of Health) lists the patient information including the patient identification number. The LCB cannot access the database. DOH could receive information from the LCB’s traceability system, and DOH employees with access to the database could connect the two dots. However, we have no reason to do so because an individual patient’s purchasing habits are of no interest to us.

From: John Novak []
Sent: Wednesday, August 10, 2016 12:22 PM
To: Weeks, Kristi (DOH)
Subject: RE: Questions

Thanks for the quick reply.

One follow up revised question: Can the State determine which products an individual patient has purchased?

“Can you determine which products a patient has purchased? Can I personally? No, I cannot tell what an individual patient has purchased.”


——– Original message ——–
From: “Weeks, Kristi (DOH)” <Kristi.Weeks@DOH.WA.GOV>
Date: 8/10/2016 8:58 AM (GMT-08:00)
To: John Novak <>
Subject: RE: Questions

See below.

From: John Novak []
Sent: Tuesday, August 09, 2016 11:49 AM
To: Weeks, Kristi (DOH)
Subject: Questions

Ms. Weeks,

If you have a few moments, I have some questions and hope you can provide some clarity. Still a lot of confusion out there.

Do you have a way to track each patient’s purchases? When a patient with a recognition card makes a purchase, the identification number on the card (but no other patient information) is entered into the traceability system in order to audit purchases that are made without sales tax. In other words, for the store to later prove (if requested by the Department of Revenue) that the sale was appropriately sales tax free.

Which information about the transaction does the system provide about the patients’s purchases? The items purchased and the patient’s recognition card number.

Can you determine which products a patient has purchased? Can I personally? No, I cannot tell what an individual patient has purchased.

Are patients in the registry able to get a sales tax discount on all products in any i502 shop, or just the endorsed shops? Just endorsed shops although some stores without an operational endorsement are offering patients a 10% discount in lieu of the sales tax relief.

If just the endorsed shops, then is that only on “medical” products, or any product in the shop? Any product in the shop.

Thank you again for your time. It is most appreciated.

-John Novak


Patient Database Screw up Accidently Exposes Information

Not even a week into the new rules for medical cannabis after the July 1, 2016 deadline, the WSLCB and Department of Health in Washington state revealed that trained medical consultants were entering private information into the database that was not supposed to be there.  The state is not capable of keeping your information private!Washington_State_seal_web_ready_color_for_educational_use_only


The following message was posted to their listserv:


——– Original message ——–
From: “No Reply (LCB)” <NoReply@LCB.WA.GOV>
Date: 7/6/2016 9:27 AM (GMT-08:00)
Subject: Medical Marijuana Sales Data Collection and Verification


It has come to the attention of both the Washington State Liquor and Cannabis Board (WSLCB) and the Department of Health (DOH) that some third party commercial traceability software systems are requesting patient information such as: conditions, history, and notes. Licensees are prohibited by law and rule from soliciting or retaining patient information in third party commercial software systems. Certified consultants are the only persons who should be seeing the information on the authorization forms to enter them into the database. All other retail employees are only to verify the recognition card by using the publicly available information on the recognition cards itself and by verifying the card number in the DOH medical marijuana authorization database (for a sale), which does not include the patients’ medical condition or any other information not printed on the recognition card.


Medical Marijuana Registration Database:

Under RCW 69.51A.230, the DOH database is the only authorized database for medical marijuana patients and designated providers, and was established as a secure and confidential database for the purposes of medical marijuana sales at licensed retailers holding a medical endorsement. A second database defeats the confidentiality and security of DOH’s database. DOH’s database is the only database authorized for verifications, including information to Dept. of Revenue for identification of tax exempt transactions (by recognition card ID#).


Under RCW 69.51A.240(1)(a) and (b), placing patient information into a different database means that persons involved are at risk of being charged with a Class C felony because they are disclosing information received from the DOH database. No one should have access to, or request, the information about the patient’s medical condition except for certified consultants entering the patient or providers name directly in to the DOH authorization database.


Traceability System vs. Third Party Systems:

The WSLCB Traceability system developed by BioTrackTHC and located at is the required reporting system identified in WAC 314-55-083(4). Licensees may use third party commercial software systems to satisfy reporting requirements in rule as described at our website: BioTrackTHC’s software is utilized by the WSLCB to track marijuana through the supply chain. Washington State licensed marijuana producers, processors, and retailers are free to employ their own inventory tracking software solutions as long as it allows for the collection and submission of the specific information and reports required by the WSLCB’s seed-to-sale inventory tracking rules for Licensees. Licensees are required to submit specific information and reports to the WSLCB.


Traceability System Verification for Medical Sales:

The WSLCB Traceability system requires the recognition card number for the patient or designated provider seeking to purchase a WAC 246-70 compliant product, or receive sales and use tax exemptions for the purchase of any marijuana product.


The WSLCB Traceability System does not:


·         Connect to the medical marijuana data base in any way

·         Verify any information with the medical marijuana data base

·         Cross reference the recognition card number with any data base

·         Require or allow the transferal of any information besides the recognition card number to complete a sales/use tax exempt sale


The WSLCB Traceability system only records the price, quantity, recognition card number, and whether the item was a WAC 246-70 compliant product.


For more information, please contact Marijuana Examiner Program at 360-664-1614 or





WSLCB Accidentally Leaks Confidential Information of I-502/SB 5052 Applicants

420leaks Detective
By John Novak
The email thread below shows you the timeline of a massive data leak to me, by accident, on a public records request revealing I-502/5052 applicants’ personal identifying information, including social security numbers, among other things.
The link provided by the public records officer will take you to the official account for the WSLCB so you can verify authenticity for yourself until the link expires at the end of June.
All files have now been properly redacted by the agency and are now available through the 420leaks database account at this link:
How many times in the last few years has this happened now?  Too many.  It was only last February when we learned that more than 91,000 patients in Washington State had their personal identification information and private health information compromised.
The public records laws in this state are vital to citizen oversight and participation in the process, helping to keep us informed and help show where we need improvements.  More money needs to be spent on upgrading public records departments.
This is the price we pay for large state agencies that keep mountains of data watched over by an underfunded and understaffed public records department.
Patients around the state have already faced uncomfortable situations as a result of this new standardized form, especially those with HIV. How can we turn over these patients in good conscience to I-502 shops with these serious privacy issues caused by legislative and bureaucratic indifference to patient needs?
By their own actions, these two agencies have proven to be deaf, dumb and blind to patient input.  They have instead fostered a culture of contempt, ineptitude and in some cases, outright corruption of the process.
This was clearly shown by the nearly $200,000 settlement paid out by the LCB to Arthur West after his hard work and effort revealing to the court evidence of 17 illegal secret meetings with law enforcement and other groups.
Recently, John Worthington filed a complaint against the WSLCB challenging the entire I-502 rule making process due to their tampering with the rule making file.  The LCB Board dismissed his claims outright, but a Thurston County Superior Court judge recently ruled in Worthington’s favor, calling their actions to be “arbitrary and capricious” and remanded it back to the LCB for another hearing.
Also, Douglas Hiatt filed a federal lawsuit last week in Federal court with an injunction to stop 5052.  The case will get its first hearing later this month.  One of the Plaintiffs on this case is the well known cannabis specialist, Dr. Gregory Carter, MD.
Dr. Carter wrote a letter to the legislators warning them of the harms of SB 5052.  View that document here:
Why are we doing this to patients in a state that sells it to anyone 21 and older with an ID?

It’s more than obvious that the state must start investing funds into training, implementation and oversight of their public records departments.  More public records officers, better training and upgraded systems with double triple checking on privacy concerns with personal and confidential information must be prioritized. State employees and the public deserve better.


Patients, health care providers, designated providers, their families and the ever increasing support base, most of which are registered voters and taxpayers, will be watching how the state handles it all.


——– Original message ——–
From: “Norton, Melissa K (LCB)” <>
Date: 6/3/2016 2:41 PM (GMT-08:00)
Subject: WSLCB PRR 16-02-174 correct 1st Installment

Dear Mr. Novak:

Thank you for your email.

You wrote the following: “I would like to have an official request from the WSLCB for deletion of these files that includes an explanation of what caused this request, both in writing for my records, please.”

The reason that we requested you to delete the files provided to you as your first installment of records was due to privacy concerns regarding the records that were provided. Within the “1st Installment” folder, there was a “redact” folder which contained 98 emails, many of which contained sensitive tax and financial information. It is our belief that in error the “redact” folder was included in the folder that was uploaded to Thank you again for working with us to ensure that these records were removed so that we could apply appropriate redactions.

We have completed the redactions on those particular emails. Here is a new link to the entirety of the first installment:

These records will be available for you to download for the next 30 days. Codes appear within the redactions on the records, and the basis for these exemptions is briefly explained as follows:



Brief Explanatory Description

Statutory Basis


Financial Account Numbers Liquor and Marijuana License Application

Financial Information, including but not limited to account numbers and values, on liquor license and marijuana applications are exempt from disclosure

RCW 42.56.230(5) and RCW 42.56.270 (10) (a)


Driver’s License Numbers

(5) Credit card numbers, debit card numbers, electronic check numbers, card expiration dates, or bank or other financial information as defined in RCW 9.35.005 including social security numbers, except when disclosure is expressly required by or governed by other law

RCW 42.56.230(5)


Social Security Number

Social Security Numbers are exempt from disclosure.

RCW 42.56.510 and 42 USC Section 405(c) (2) (C) (viii) (1)


Tax Information

Tax information, such as Federal Tax ID Number, or other tax documents are exempt from public disclosure.

RCW 82.32.330, RCW 42.56.230(5), and 26 U.S.C. 6103.

Attorney-Client Privilege

Attorney-Client Privilege

An attorney or counselor shall not, without the consent of his or her client, be examined as to any communication made by the client to him or her, or his or her advice given thereon in the course of professional employment.

RCW 5.60.060(2)(a)

We also wanted to communicate with you to let you know that Mr. Aguayo is no longer with the agency and Kelly McDermott from our office will be taking over this request.

If you have any questions, please feel free to contact me. Thank you.


Missy Norton
Records Manager
Office - 360-664-1693/Fax - 360-664-9689

From: John Novak []
Sent: Friday, June 03, 2016 1:33 PM
To: Norton, Melissa K (LCB) <>
Subject: RE: WSLCB PRR 16-02-174 1st Installment
Ms. Norton,

I would like to have an official request from the WSLCB for deletion of these files that includes an explanation of what caused this request, both in writing for my records, please.


——– Original message ——–
From: “Norton, Melissa K (LCB)” <>
Date: 6/2/2016 5:16 PM (GMT-08:00)
Subject: RE: WSLCB PRR 16-02-174 1st Installment
Dear John,Thank you for your understanding.  We are having trouble with uploading the correct first installment of records to Box.  We will provide those records to you tomorrow June 3, 2016.Thank you again,Missy Norton
Records Manager
Office - 360-664-1693/Fax - 360-664-9689


Patient Privacy Concerns Ignored by WA ST Dept of Health


The so-called Patient Protection Act (Senate Bill 5052) that was passed in the 2015 Legislative Session is showing all kinds of problems.  Instead of just dealing with our legislators in Olympia, now patients are being forced to follow the actions of the Department of Health and the WSLCB.

As has been the case from the start of I-502, patients and the public are being deliberately marginalized and excluded from the process.

The state mandated new standardized authorization forms under 5052.

However, when they came out, it included a checkbox section that now forced patients to reveal their qualifying condition on the front page!  It was not part of the language in the bill, but there it was with the statement that if not filled out, the authorization would be invalid.

Why is this a concern?  Because as of July 1, 2016, this is the form patients will use to sign up for the patient registry.  And you sign up for the registry, not with the Dept. of Health, not with your health care provider, but your local retail marijuana shop who have no experience with handling vital medical records or patient privacy!  And the registry is accessible by the Washington State Liquor and Cannabis Board, the Department of Health, law enforcement, etc.  All the while cannabis is still on schedule 1 in both state and federal law!

Remember, this is a state willing to sell it to anyone over the counter 21 and older with ID!

Patients now being forced to use these forms are already reporting issues.

Back in August 07, 2015, we contacted the Department of Health with the following question, believing this new requirement to be an invasion of patient privacy: Can you please provide the bill number, bill section and statute that requires a checkbox of the list of qualifying conditions?

Mon, 10 Aug 2015, the reply came:

Inclusion of the qualifying condition is not specifically required in the bill but it is not an exclusive list. We made the decision to include the qualifying condition for policy reasons. Many other states require this information on the physician’s statement and it is recommended in the model legislation promoted by Americans for Safe Access.
Kristi Weeks, JD
Review Officer/Policy Counsel
Washington Department of Health

 We followed up with a personal visit to Ms. Weeks at her office in Olympia.  She was very courteous.  When it was explained there were patients who do not wish the information to be listed, she understood but held firm.  The policy reason was wanting more information.  The other was that other states were doing it.

When asked why patients and the public were not allowed in the decision making process, Ms. Weeks said that it was not required.

So we asked what patients could do to get that removed from the form, she explained that we could try to lodge a complaint with the Rules committee.  The other option was to file a lawsuit.

Shortly after, we filed a public records request to the Department of Health on all the records and communications around this new form.

Make sure you all give Americans for Safe Access a big thanks (NOT) for being the inspiration for Ms. Weeks from the Department of Health to include your medical conditions in the patient authorization form and in the patient database when it was not required by a new bill that passed in the 2015 legislative session.

She seems to enjoy the irony at our expense…

From Weeks, Kristi (DOH) To Baumgartner, Chris J (DOH); Hodgson, Lisa (DOH); Schmitt, Kathy (DOH); Wise, Jeff (DOH); Fernando, Andres (DOH) Recipients Chris.Baumgartner@DOH.WA.GOV; Lisa.Hodgson@DOH.WA.GOV; Kathy.Schmitt@DOH.WA.GOV; Jeff.Wise@DOH.WA.GOV; Andres.Fernando@DOH.WA.GOV
Here is my version unless anyone has strong feeling otherwise. Yes, it’s two pages. Unfortunate, but necessary to get everything on it. And since I really only needed a page and a half, I used the extra space to reiterate some of the law. Can’t hurt.
I did end up listing the qualifying conditions (Chris – I didn’t know how to make auto text check boxes. Can you add those?) It’s the only possible way of getting this information into the database and it’s too valuable to forgo. I do have examples from many other states who require this information if we need to justify it.
When we have all agreed to the final version, we can brainstorm who we want to vet it through. Obviously, the boards and commissions. Definitely WSMA. They have had the most used example of a form for years. Probably the other associations as well. Jason McGill asked me to run it by Americans for Safe Access. They will probably hate it on principle but at least they can’t argue about including the patient’s condition since I noticed that their model legislation says:
( Y ) “Written recommendation” means a document authorizing a patient’s medical use of cannabis that is written on tamper-resistant paper and signed by a qualified medical professional. Such recommendation shall be made only in the course of a bona fide medical professional-patient relationship and shall specify the qualifying patient’s qualifying medical condition(s).

Ironically, the model legislation also establishes a registry. Wish I would have known that when the bill was still in process.
Kristi Weeks, JD Review Officer/Policy Counsel Washington Department of Health PO Box 47890 Olympia, WA 98504-7890 Phone (360) 236-4066 Email Public Health – Always Working for a Safer and Healthier Washington.

When interviewed by “The Stranger” in March, 2016, Ms. Weeks revealed that “…the state could put the data collected on the form to good use, juxtaposing it with data on opioid painkiller use to spot trends…”

That is code for those of you not aware. It is code that means, if you write an authorization for cannabis, you better not write a prescription for an opiate because if the DEA matches that, the doctor could get their federal licenses taken away.

I know this because I have had doctors refuse to do it for me. In fact, I was released from a hospital during a massive pacreatic attack because I admitted to being a medical cannabis patient. The hospital release form even stated to stop using marijuana.

This is an absolute outrage and Ms. Weeks answer if you don’t like it is, don’t get an authorization or as she told me in person, “You can sue us”.

View all the public records on this here:


Petitioning the Governor: Extend the July 1st Deadline for Medical Cannabis

To the Honorable Governor of Washington State,

Washington State passed ill advised legislation on cannabis for medical patients in the 2015 legislative session, SB 5052.  No fix was passed for the 2016 session.

As of July 1, 2016, patients will be left with no legitimate access to the quantities, types and quality control we have had since the passage of our medical laws back in 1998.