(1) The department must contract with an entity to create, administer, and maintain a secure and confidential medical cannabis authorization database that allows:
(a) A cannabis retailer with a medical cannabis endorsement to add a qualifying patient or designated provider and include the amount of cannabis concentrates, useable cannabis, cannabis-infused products, or plants for which the qualifying patient is authorized under RCW
69.51A.210;
(b) Persons authorized to prescribe or dispense controlled substances to access health care information on their patients for the purpose of providing medical or pharmaceutical care for their patients;
(c) A qualifying patient or designated provider to request and receive his or her own health care information or information on any person or entity that has queried their name or information;
(d) Appropriate local, state, tribal, and federal law enforcement or prosecutorial officials who are engaged in a bona fide specific investigation of suspected cannabis-related activity that may be illegal under Washington state law to confirm the validity of the recognition card of a qualifying patient or designated provider;
(e) A cannabis retailer holding a medical cannabis endorsement to confirm the validity of the recognition card of a qualifying patient or designated provider;
(f) The department of revenue to verify tax exemptions under chapters
82.08 and
82.12 RCW;
(g) The department and the health care professional's disciplining authorities to monitor authorizations and ensure compliance with this chapter and chapter
18.130 RCW by their licensees; and
(h) Authorizations to expire six months or one year after entry into the medical cannabis authorization database, depending on whether the authorization is for a minor or an adult.
(2) A qualifying patient and his or her designated provider, if any, may be placed in the medical cannabis authorization database at a cannabis retailer with a medical cannabis endorsement. After a qualifying patient or designated provider is placed in the medical cannabis authorization database, he or she must be provided with a recognition card that contains identifiers required in subsection (3) of this section.
(3) The recognition card requirements must be developed by the department in rule and include:
(a) A randomly generated and unique identifying number;
(b) For designated providers, the unique identifying number of the qualifying patient whom the provider is assisting;
(c) A photograph of the qualifying patient's or designated provider's face taken by an employee of the cannabis retailer with a medical cannabis endorsement at the same time that the qualifying patient or designated provider is being placed in the medical cannabis authorization database in accordance with rules adopted by the department;
(d) The amount of cannabis concentrates, useable cannabis, cannabis-infused products, or plants for which the qualifying patient is authorized under RCW
69.51A.210;
(e) The effective date and expiration date of the recognition card;
(f) The name of the health care professional who authorized the qualifying patient or designated provider; and
(g) For the recognition card, additional security features as necessary to ensure its validity.
(4)(a) For qualifying patients who are eighteen years of age or older and their designated providers, recognition cards are valid for one year from the date the health care professional issued the authorization. For qualifying patients who are under the age of eighteen and their designated providers, recognition cards are valid for six months from the date the health care professional issued the authorization. Qualifying patients may not be reentered into the medical cannabis authorization database until they have been reexamined by a health care professional and determined to meet the definition of qualifying patient. After reexamination, a cannabis retailer with a medical cannabis endorsement must reenter the qualifying patient or designated provider into the medical cannabis authorization database and a new recognition card will then be issued in accordance with department rules.
(b) A qualifying patient's registration in the medical cannabis authorization database and his or her recognition card may be renewed by a qualifying patient's designated provider without the physical presence of the qualifying patient at the retailer if the authorization from the health care professional indicates that the qualifying patient qualifies for a compassionate care renewal, as provided in RCW
69.51A.030. A qualifying patient receiving renewals under the compassionate care renewal provisions is exempt from the photograph requirements under subsection (3)(c) of this section.
(5) If a recognition card is lost or stolen, a cannabis retailer with a medical cannabis endorsement, in conjunction with the database administrator, may issue a new card that will be valid for six months to one year if the patient is reexamined by a health care professional and determined to meet the definition of qualifying patient and depending on whether the patient is under the age of eighteen or eighteen years of age or older as provided in subsection (4) of this section. If a reexamination is not performed, the expiration date of the replacement recognition card must be the same as the lost or stolen recognition card.
(6) The database administrator must remove qualifying patients and designated providers from the medical cannabis authorization database upon expiration of the recognition card. Qualifying patients and designated providers may request to remove themselves from the medical cannabis authorization database before expiration of a recognition card and health care professionals may request to remove qualifying patients and designated providers from the medical cannabis authorization database if the patient or provider no longer qualifies for the medical use of cannabis. The database administrator must retain database records for at least five calendar years to permit the state liquor and cannabis board and the department of revenue to verify eligibility for tax exemptions.
(7) During development of the medical cannabis authorization database, the database administrator must consult with the department, stakeholders, and persons with relevant expertise to include, but not be limited to, qualifying patients, designated providers, health care professionals, state and local law enforcement agencies, and the University of Washington computer science and engineering security and privacy research lab or a certified cybersecurity firm, vendor, or service.
(8) The medical cannabis authorization database must meet the following requirements:
(a) Any personally identifiable information included in the database must be nonreversible, pursuant to definitions and standards set forth by the national institute of standards and technology;
(b) Any personally identifiable information included in the database must not be susceptible to linkage by use of data external to the database;
(c) The database must incorporate current best differential privacy practices, allowing for maximum accuracy of database queries while minimizing the chances of identifying the personally identifiable information included therein; and
(d) The database must be upgradable and updated in a timely fashion to keep current with state of the art privacy and security standards and practices.
(9)(a) Personally identifiable information of qualifying patients and designated providers included in the medical cannabis authorization database is confidential and exempt from public disclosure, inspection, or copying under chapter
42.56 RCW.
(b) Information contained in the medical cannabis authorization database may be released in aggregate form, with all personally identifiable information redacted, for the purpose of statistical analysis and oversight of agency performance and actions.
(c) Information contained in the medical cannabis authorization database shall not be shared with the federal government or its agents unless the particular qualifying patient or designated provider is convicted in state court for violating this chapter or chapter
69.50 RCW.
(10) The department must charge a one dollar fee for each initial and renewal recognition card issued by a cannabis retailer with a medical cannabis endorsement. The cannabis retailer with a medical cannabis endorsement shall collect the fee from the qualifying patient or designated provider at the time that he or she is entered into the database and issued a recognition card. The department shall establish a schedule for cannabis retailers with a medical cannabis endorsement to remit the fees collected. Fees collected under this subsection shall be deposited into the dedicated cannabis account created under RCW
69.50.530.
(11) If the database administrator fails to comply with this section, the department may cancel any contracts with the database administrator and contract with another database administrator to continue administration of the database. A database administrator who fails to comply with this section is subject to a fine of up to five thousand dollars in addition to any penalties established in the contract. Fines collected under this section must be deposited into the health professions account created under *RCW
43.70.320.
(12) The department may adopt rules to implement this section.
