The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.

(1) "Authorization" means a form developed by the department that is completed and signed by a qualifying patient's health care professional and printed on tamper-resistant paper approved by the Washington pharmacy quality assurance commission.

(2) "Compassionate care renewal" means a renewal of an authorization by a health care practitioner through the use of telemedicine if the health care practitioner determines that requiring the qualifying patient to attend an in-person physical examination would likely result in severe hardship to the qualifying patient because of the qualifying patient's physical or emotional condition. A compassionate care renewal of a qualifying patient's registration and recognition card also allows the qualifying patient's designated provider to renew the qualifying patient's registration in the database and recognition card without the qualifying patient being physically present at a retailer and without a new photograph being taken.

(3) "Consultant" means a person who holds a valid medical cannabis consultant certificate issued by the secretary under chapter 246-72 WAC and who is employed by a retail outlet with a medical cannabis endorsement.

(4) "Credential for access" or "credentials" means information, electronic device, or certificate provided by the department or the department's designee to a data requestor to electronically access the database. The authentication may include, but is not limited to, a user name, password, or an identification electronic device or certificate.

(5) "Database" means the medical cannabis authorization database established under RCW 69.51A.230.

(6) "Department" means the Washington state department of health.

(7) "Designated provider" has the same meaning as RCW 69.51A.010(4).

(8) "Dispenser" means a person authorized to dispense controlled substances other than cannabis under chapter 69.50 RCW.

(9) "Health care practitioner" or "authorizing health care practitioner," for purposes of this chapter only, means a physician licensed under chapter 18.71 RCW, a physician assistant licensed under chapter 18.71A RCW, an osteopathic physician licensed under chapter 18.57 RCW, an osteopathic physician's assistant licensed under chapter 18.57A RCW, a naturopath licensed under chapter 18.36A RCW, or an advanced registered nurse practitioner licensed under chapter 18.79 RCW.

(10) "Official" means an official of a local, state, tribal, or federal law enforcement or prosecutorial agency.

(11) "Prescriber" means a person authorized to prescribe or dispense controlled substances other than cannabis under chapter 69.50 RCW.

(12) "Qualifying patient" or "patient" has the same meaning as RCW 69.51A.010(19).

(13) "Recognition card" means a card issued to qualifying patients and designated providers by a cannabis retailer with a medical cannabis endorsement that has entered them into the medical cannabis authorization database.

(14) "Retail outlet with a medical cannabis endorsement" or "endorsed outlet" means a location licensed by the WSLCB under RCW 69.50.325 for the retail sale of usable cannabis and cannabis-infused products to the public, and under RCW 69.50.375 to qualifying patients and designated providers for medical use.

(15) "Telemedicine" has the same meaning as the definition of that term adopted by the authorizing health care practitioner's disciplining authority, whether defined in rule or policy.

(16) "Valid photographic identification" means:

(a) A driver's license or instruction permit issued by any state of the United States or province of Canada. If the patient's driver's license has expired, the patient must also show a valid temporary driver's license with the expired card.

(b) A state identification card issued by any state of the United States or province of Canada.

(c) An official passport issued by any nation.

(d) A United States armed forces identification card issued to active duty, reserve, and retired personnel and the personnel's dependents.

(e) A merchant marine identification card issued by the United States Coast Guard.

(f) An enrollment card issued by the governing authority of a federally recognized Indian tribe located in Washington, if the enrollment card incorporates security features comparable to those implemented by the department of licensing for Washington drivers' licenses.

A recognition card, whether current or expired, does not qualify as valid photographic identification.

(17) "Vendor" means the third-party administrator with whom the department has contracted to operate the database.

(18) "WSLCB" means the Washington state liquor and cannabis board.

A qualifying patient or designated provider may take their authorization to an endorsed outlet to be entered into the database.

(1) Only a consultant employed by an endorsed outlet is allowed to enter a qualifying patient's or designated provider's information into the database.

(2) Consultants must register with the department to receive credentials to access the database. The process for registration will be established by the department.

(3) The department shall verify the consultant's identity and certificate status before providing credentials to access the database.

(4) The consultant shall access the database using the credentials issued by the department or the department's designee. If the credentials are lost or missing, or the security of the credentials is compromised, the consultant shall notify the department by telephone and in writing within one business day.

(5) The consultant shall ensure that the authorization form provided is valid, complete, unaltered, and meets all requirements specified in RCW 69.51A.030 and complies with the instructions on the form. "Street address" on the authorization form means the physical address for the person's residence where plants may be grown under RCW 69.51A.210. If any requirement is not met, or the form is altered or incomplete, the person cannot be entered into the database.

(6) The consultant shall verify the identity of every patient age 18 and older and every designated provider by inspecting the patient's or designated provider's valid photographic identification. Except for patients under the age of 18, or qualifying patients renewing under a compassionate care renewal as authorized in RCW 69.51A.030, a person cannot be entered into the database without valid photographic identification.

(7) In the event of an inexact match of names on the identification and the authorization, the consultant shall ensure that the patient or designated provider named on the authorization form is the same person presenting the authorization for entry into the database.

(8) The consultant shall check the database to ensure that a designated provider is not currently associated with a different patient in the database before associating the designated provider with a new patient in the database. If a designated provider is still associated with a different patient, the consultant cannot enter the designated provider into the database as associated with the new patient.

(9) The consultant shall enter the following information into the database for each patient and designated provider (unless specified below):

(a) The type of valid photographic identification verified and the unique number from the identification;

(b) Full legal name, as it appears on the valid photographic identification, including first name, middle initial, last name, and generational suffixes, if any;

(c) Date of birth;

(d) Actual physical address if different from the address on the identification;

(e) Name of the authorizing health care practitioner;

(f) Authorizing health care practitioner's full license number;

(g) Business address of the authorizing health care practitioner;

(h) Telephone number of the authorizing health care practitioner, as listed on the authorization form;

(i) The patient's qualifying condition(s);

(j) For the designated provider only, the patient the designated provider is authorized to assist;

(k) The date the authorization was issued;

(l) The date the authorization expires; and

(m) The number of plants the patient is allowed to grow. If the authorizing health care practitioner does not indicate a specific number, the presumptive number is six plants. The health care practitioner cannot authorize more than 15 plants. An authorization for more than 15 plants is invalid.

(10) All requests for, uses of, and disclosures of information from the database by authorized persons must be consistent with chapter 69.51A RCW and this chapter.

(1) Recognition cards expire on the expiration date indicated on the patient's or designated provider's authorization. To be valid, an authorization must expire no later than:

(a) Twelve months after the date it was issued for patients age 18 and over;

(b) Twelve months after the date it was issued for designated providers; or

(c) Six months after the date it was issued for patients under the age of 18.

(2) To renew a recognition card a patient or designated provider must receive a new authorization following reexamination of the patient by a health care practitioner in-person or as authorized for compassionate care renewals as provided in RCW 69.51A.030. The qualifying patient or designated provider may take their new authorization to an endorsed outlet to be entered into the database.

(3) A qualifying patient's designated provider may renew the patient's registration and recognition card in the medical cannabis authorization database without the physical presence of the qualifying patient at the retailer if the authorization from the health care practitioner indicates that the qualifying patient qualifies for a compassionate care renewal as provided in RCW 69.51A.030. A qualifying patient receiving renewals under compassionate care renewal provisions is exempt from the requirement for a new photograph for the renewal.

(4) The procedures in WAC 246-71-020 must be used to enter the patient's or designated provider's new authorization into the database.

(5) The consultant shall ensure that the information required by WAC 246-71-020(9) is updated and accurate at the time of renewal.

(1) An endorsed outlet must have the following equipment readily available and maintained in good working order:

(a) A computer with internet access and capability of running a supported version of a common web browser;

(b) A digital camera with at least 10 megapixel resolution;

(c) A standard color printer able to print at least 300 dots per inch;

(d) A laminator; and

(e) A solid white, off-white, or light blue backdrop that is free of patterns, objects or textures, to use as the background for each picture.

(2) When issuing a recognition card to a qualifying patient or designated provider, an endorsed outlet must comply with the following requirements:

(a) Only a consultant employed by the endorsed outlet is allowed to print and create a card;

(b) The consultant shall take a picture of the face of the patient or designated provider at the same time they are entered into the database following the process specified by the department. Compassionate care renewals will use the qualifying patient's existing photograph and information retained securely in the database to generate a new recognition card for the patient. The endorsed outlet shall not otherwise retain or use the photograph or patient information for any purpose other than:

(i) Entering a qualifying patient or designated provider into the database;

(ii) Issuing a replacement card under WAC 246-71-120; or

(iii) Issuing a compassionate care renewal.

(c) The consultant shall create, print the card in full color, permanently laminate the card using a heat process, and issue it to the patient or designated provider following the process specified by the department; and

(d) The consultant shall return the authorization to the patient or designated provider. The endorsed outlet shall not retain a copy of the authorization.

(3) The database vendor shall ensure recognition cards contain the following:

(a) A randomly generated and unique identification number;

(b) The name of the patient or designated provider;

(c) For designated providers, the unique identification number of the patient they are assisting;

(d) A photograph of the patient or designated provider;

(e) The amounts of cannabis concentrates, usable cannabis, or cannabis-infused products the patient or designated provider is authorized to purchase or obtain at an endorsed outlet;

(f) The number of plants the patient or designated provider is authorized to grow;

(g) The effective date and expiration date of the card;

(h) The name of the health care professional who issued the authorization; and

(i) Additional security features required by the department to ensure the validity of the card.

Employees of an endorsed outlet may access the database to confirm the validity of a recognition card presented by a patient or designated provider.

(1) An employee of an endorsed outlet must register with the department to receive credentials for access. The registration process shall be established by the department.

(2) The department shall verify the employee's identity and employment status before providing credentials to access the database.

(3) The employee shall access the database using the credentials issued by the department or the department's designee. If the credentials issued are lost or missing, or the security of the credentials is compromised, the employee shall notify the department by telephone and in writing within one business day.

(4) An endorsed outlet owner or manager shall inform the department and the database vendor in writing immediately upon the termination of employment of an employee with access.

(5) All requests for, uses of, and disclosures of information from the database by authorized persons must be consistent with chapter 69.51A RCW and this chapter.

Qualifying patients and designated providers may request and receive their own authorization information from the database or information about any person or entity that has queried their name or information.

(1) A patient or designated provider may submit a request using a process and format established by the department for requesting and receiving information from the database.

(2) The department shall require proof of identity including, but not limited to, valid photographic identification prior to releasing any information to a patient or designated provider.

(3) The information will be delivered using a process and format established by the department.

Prescribers and dispensers may access patient information in the database for the purpose of providing medical or pharmaceutical care for their patients.

(1) Prescribers and dispensers who want access to the database shall register with the department in order to receive credentials for access. The registration process shall be established by the department.

(2) The department shall verify the prescriber's or dispenser's identity and health care practitioner license(s) before providing credentials to access the database.

(3) Prescribers and dispensers shall access the database using the credentials issued by the department or the department's designee. If the credentials issued are lost or missing, or the security of the credentials is compromised, the prescriber or dispenser shall notify the department by telephone and in writing within one business day.

(4) Prescribers and dispensers registered to access the database must inform the department and the database vendor immediately in writing when they no longer have the authority to prescribe or dispense controlled substances.

(5) All requests for, uses of, and disclosures of information from the database by authorized persons must be consistent with chapter 69.51A RCW and this chapter.

Officials who are engaged in a bona fide specific investigation of suspected cannabis-related activity that may be illegal under Washington state law may access the database to confirm the validity of the recognition card of a patient or designated provider.

(1) Officials who want access to the database shall register with the department in order to receive credentials for access. The registration process shall be established by the department.

(2) The department or the department's designee shall verify the official's identity and position before providing credentials to access the database.

(3) Officials shall access the database using the credentials issued by the department or the department's designee. If the credentials issued are lost or missing, or the security of the credentials is compromised, the official shall notify the department or its designee by telephone and in writing within one business day.

(4) Officials with an active database account must inform the department and the database vendor in writing immediately when they no longer hold a position as a law enforcement or prosecutorial official.

(5) All requests for, uses of, and disclosures of information from the database by authorized persons must be consistent with chapter 69.51A RCW and this chapter.

The Washington department of revenue may access information in the database to verify tax exemptions under chapters 82.08 and 82.12 RCW. The process and format for request and receiving the information shall be established by the department and the database vendor in coordination with the Washington department of revenue.

(1) Under RCW 42.56.625, records in the database containing names and other personally identifiable information of qualifying patients and designated providers are exempt from public disclosure, inspection, or copying.

(2) The vendor must retain database records for at least five calendar years to permit the WSLCB and Washington department of revenue to verify eligibility for tax exemptions.

(3) Authorization forms cannot be retained or copied by an endorsed outlet, and information from the form cannot be retained by the endorsed outlet or entered into other manual or electronic data collection or point of sale systems unless required by law or expressly authorized in writing by the patient or designated provider.

(4) Recognition cards cannot be retained by an endorsed outlet, and may only be copied by the endorsed outlet when required by law.

(1) Pursuant to RCW 69.51A.240, unlawful access to the database is a class C felony.

(2) If the department or vendor determines a person or entity has intentionally, knowingly, or negligently accessed, used or disclosed database information in violation of chapter 69.51A RCW or this chapter, the department may take action including, but not limited to:

(a) Terminating access to the database;

(b) Filing a complaint with appropriate health profession disciplining authority; or

(c) Reporting the violation to the appropriate government agency, including WSLCB or law enforcement.

A patient or designated provider may request a replacement recognition card at an endorsed outlet if the original recognition card is lost or stolen.

(1) The replacement recognition card will expire on the same date as the original recognition card unless the patient is reexamined by a health care practitioner and a new authorization is provided.

(2) Only consultants shall issue a replacement recognition card to the patient or designated provider. The consultant shall issue the replacement recognition card in compliance with the procedure in WAC 246-71-030.

(3) Information regarding the issuance of a replacement recognition card must be entered into the database as determined by the department prior to the card being printed and given to the patient or designated provider.

(1) The vendor must automatically deactivate patient and designated provider records in the database upon expiration of a recognition card.

(2) Patients and designated providers may request to be deactivated in the database before the expiration of their recognition card using the process established by the department.

(3) The authorizing health care practitioner may request deactivation of a patient or designated provider from the database if the patient no longer qualifies for the medical use of cannabis. This request must be made using the process established by the department.

(1) Patients may revoke their designation of a specific designated provider. The revocation must be in writing using a form developed by the department. The patient must send the revocation to the vendor and give a copy to the designated provider. The vendor must verify the form's authenticity prior to revoking the designated provider and deactivating the designated provider's recognition card.

(2) A patient may designate a new designated provider after revoking a prior designated provider. The new designated provider must receive an authorization form from the patient's authorizing health care practitioner. The new designated provider may then go to a retail outlet to be entered into the database and receive a recognition card.

(3) A person may stop serving as a designated provider by providing a letter to the patient. If the person is currently in the database as a designated provider for the patient, the person shall also submit a form established by the department to the vendor. The vendor shall verify the form's authenticity prior to revoking the designated provider in the database and deactivating the designated provider's recognition card.

(1) The department may provide aggregate information from the database, with all personally identifiable information redacted, for the purpose of statistical analysis and oversight of agency performance and actions.

(2) To obtain information from the program a person or public or private entity must submit a request on a form established by the department.

(3) All requests for, uses of, and disclosures of information from the authorization database must be consistent with chapter 69.51A RCW and this chapter.

(1) Endorsed outlets must collect a one dollar fee for each initial, replacement, and renewal recognition card. The fee shall be collected by the endorsed outlet from the patient or designated provider when the card is issued.

(2) Endorsed outlets must periodically remit fees collected using the process established by the department.

(3) Failure by an endorsed outlet to promptly remit fee revenue when due will result in notice to the WSLCB, removal of a store and store employee access to the database, and any other action necessary to ensure compliance.