Patient Database Screw up Accidently Exposes Information

Not even a week into the new rules for medical cannabis after the July 1, 2016 deadline, the WSLCB and Department of Health in Washington state revealed that trained medical consultants were entering private information into the database that was not supposed to be there.  The state is not capable of keeping your information private!Washington_State_seal_web_ready_color_for_educational_use_only

 

The following message was posted to their listserv:

 

——– Original message ——–
From: “No Reply (LCB)” <NoReply@LCB.WA.GOV>
Date: 7/6/2016 9:27 AM (GMT-08:00)
Subject: Medical Marijuana Sales Data Collection and Verification

Summary:

It has come to the attention of both the Washington State Liquor and Cannabis Board (WSLCB) and the Department of Health (DOH) that some third party commercial traceability software systems are requesting patient information such as: conditions, history, and notes. Licensees are prohibited by law and rule from soliciting or retaining patient information in third party commercial software systems. Certified consultants are the only persons who should be seeing the information on the authorization forms to enter them into the database. All other retail employees are only to verify the recognition card by using the publicly available information on the recognition cards itself and by verifying the card number in the DOH medical marijuana authorization database (for a sale), which does not include the patients’ medical condition or any other information not printed on the recognition card.

 

Medical Marijuana Registration Database:

Under RCW 69.51A.230, the DOH database is the only authorized database for medical marijuana patients and designated providers, and was established as a secure and confidential database for the purposes of medical marijuana sales at licensed retailers holding a medical endorsement. A second database defeats the confidentiality and security of DOH’s database. DOH’s database is the only database authorized for verifications, including information to Dept. of Revenue for identification of tax exempt transactions (by recognition card ID#).

 

Under RCW 69.51A.240(1)(a) and (b), placing patient information into a different database means that persons involved are at risk of being charged with a Class C felony because they are disclosing information received from the DOH database. No one should have access to, or request, the information about the patient’s medical condition except for certified consultants entering the patient or providers name directly in to the DOH authorization database.

 

Traceability System vs. Third Party Systems:

The WSLCB Traceability system developed by BioTrackTHC and located at wslcb.mjtraceability.com is the required reporting system identified in WAC 314-55-083(4). Licensees may use third party commercial software systems to satisfy reporting requirements in rule as described at our website: http://lcb.wa.gov/mj2015/traceability_system. BioTrackTHC’s software is utilized by the WSLCB to track marijuana through the supply chain. Washington State licensed marijuana producers, processors, and retailers are free to employ their own inventory tracking software solutions as long as it allows for the collection and submission of the specific information and reports required by the WSLCB’s seed-to-sale inventory tracking rules for Licensees. Licensees are required to submit specific information and reports to the WSLCB.

 

Traceability System Verification for Medical Sales:

The WSLCB Traceability system requires the recognition card number for the patient or designated provider seeking to purchase a WAC 246-70 compliant product, or receive sales and use tax exemptions for the purchase of any marijuana product.

 

The WSLCB Traceability System does not:

 

·         Connect to the medical marijuana data base in any way

·         Verify any information with the medical marijuana data base

·         Cross reference the recognition card number with any data base

·         Require or allow the transferal of any information besides the recognition card number to complete a sales/use tax exempt sale

 

The WSLCB Traceability system only records the price, quantity, recognition card number, and whether the item was a WAC 246-70 compliant product.

 

For more information, please contact Marijuana Examiner Program at 360-664-1614 or mjexaminer@lcb.wa.gov.

 

###

 

 

Comments are closed.