Superseded 7/1/2023)

Superseded 7/1/2023
26B-4-202.  Electronic verification system.

(1)  The Department of Agriculture and Food, the department, the Department of Public Safety, and the Division of Technology Services shall:

Attorney's Note

Under the Utah Code, punishments for crimes depend on the classification. In the case of this section:
ClassPrisonFine
class C misdemeanorup to 90 daysup to $750
For details, see Utah Code § 76-3-204

Terms Used In Utah Code 26B-4-202

  • Cannabis: means marijuana. See Utah Code 26B-4-201
  • Cannabis product: means a product that:
    (a) is intended for human use; and
    (b) contains cannabis or any tetrahydrocannabinol or THC analog in a total concentration of 0. See Utah Code 26B-4-201
  • Cannabis production establishment: means the same as that term is defined in Section 4-41a-102. See Utah Code 26B-4-201
  • Controlled substance database: means the controlled substance database created in Section 58-37f-201. See Utah Code 26B-4-201
  • Department: means the Department of Health and Human Services. See Utah Code 26B-4-201
  • Directions of use: means recommended routes of administration for a medical cannabis treatment and suggested usage guidelines. See Utah Code 26B-4-201
  • Dosing guidelines: means a quantity range and frequency of administration for a recommended treatment of medical cannabis. See Utah Code 26B-4-201
  • Fraud: Intentional deception resulting in injury to another.
  • Guardian: A person legally empowered and charged with the duty of taking care of and managing the property of another person who because of age, intellect, or health, is incapable of managing his (her) own affairs.
  • Guardian: includes a person who:Utah Code 68-3-12.5
  • Inventory control system: means the system described in Section 4-41a-103. See Utah Code 26B-4-201
  • Limited medical provider: means an individual who:
    (a) meets the recommending qualifications; and
    (b) has no more than 15 patients with a valid medical cannabis patient card or provisional patient card as a result of the individual's recommendation, in accordance with Subsection 26B-4-204(1)(b). See Utah Code 26B-4-201
  • Medical cannabis: means cannabis in a medicinal dosage form or a cannabis product in a medicinal dosage form. See Utah Code 26B-4-201
  • Medical cannabis card: means a medical cannabis patient card, a medical cannabis guardian card, a medical cannabis caregiver card, or a conditional medical cannabis card. See Utah Code 26B-4-201
  • Medical cannabis cardholder: means :
    (a) a holder of a medical cannabis card; or
    (b) a facility or assigned employee, described in Subsection(17)(b), only:
    (i) within the scope of the facility's or assigned employee's performance of the role of a medical cannabis patient cardholder's caregiver designation under Subsection 26B-4-214(1)(b); and
    (ii) while in possession of documentation that establishes:
    (A) a caregiver designation described in Subsection 26B-4-214(1)(b);
    (B) the identity of the individual presenting the documentation; and
    (C) the relation of the individual presenting the documentation to the caregiver designation. See Utah Code 26B-4-201
  • Medical cannabis caregiver card: means an electronic document that a cardholder may print or store on an electronic device or a physical card or document that:
    (a) the department issues to an individual whom a medical cannabis patient cardholder or a medical cannabis guardian cardholder designates as a designated caregiver; and
    (b) is connected to the electronic verification system. See Utah Code 26B-4-201
  • Medical cannabis courier: means the same as that term is defined in Section 4-41a-102. See Utah Code 26B-4-201
  • Medical cannabis device: means a device that an individual uses to ingest or inhale cannabis in a medicinal dosage form or a cannabis product in a medicinal dosage form. See Utah Code 26B-4-201
  • Medical cannabis guardian card: means an electronic document that a cardholder may print or store on an electronic device or a physical card or document that:
    (a) the department issues to the parent or legal guardian of a minor with a qualifying condition; and
    (b) is connected to the electronic verification system. See Utah Code 26B-4-201
  • Medical cannabis patient card: means an electronic document that a cardholder may print or store on an electronic device or a physical card or document that:
    (a) the department issues to an individual with a qualifying condition; and
    (b) is connected to the electronic verification system. See Utah Code 26B-4-201
  • Medical cannabis pharmacy: means a person that:
    (a) 
    (i) acquires or intends to acquire medical cannabis or a cannabis product in a medicinal dosage form from a cannabis processing facility or another medical cannabis pharmacy or a medical cannabis device; or
    (ii) possesses medical cannabis or a medical cannabis device; and
    (b) sells or intends to sell medical cannabis or a medical cannabis device to a medical cannabis cardholder. See Utah Code 26B-4-201
  • Medical cannabis pharmacy agent: means an individual who holds a valid medical cannabis pharmacy agent registration card issued by the department. See Utah Code 26B-4-201
  • Medical cannabis treatment: means cannabis in a medicinal dosage form, a cannabis product in a medicinal dosage form, or a medical cannabis device. See Utah Code 26B-4-201
  • Medicinal dosage form: includes a portion of unprocessed cannabis flower that:
    (i) the medical cannabis cardholder has recently removed from the container described in Subsection (42)(a)(ii) for use; and
    (ii) does not exceed the quantity described in Subsection (42)(a)(ii). See Utah Code 26B-4-201
  • Person: means :Utah Code 68-3-12.5
  • Pharmacy medical provider: means the medical provider required to be on site at a medical cannabis pharmacy under Section 26B-4-219. See Utah Code 26B-4-201
  • Qualified medical provider: means an individual:
    (a) who meets the recommending qualifications; and
    (b) whom the department registers to recommend treatment with cannabis in a medicinal dosage form under Section 26B-4-204. See Utah Code 26B-4-201
  • recommendation: means , for a recommending medical provider, the act of suggesting the use of medical cannabis treatment, which:
    (a) certifies the patient's eligibility for a medical cannabis card; and
    (b) may include, at the recommending medical provider's discretion, directions of use, with or without dosing guidelines. See Utah Code 26B-4-201
  • State: when applied to the different parts of the United States, includes a state, district, or territory of the United States. See Utah Code 68-3-12.5
  • State central patient portal: means the website the department creates, in accordance with Section 26B-4-236, to facilitate patient safety, education, and an electronic medical cannabis order. See Utah Code 26B-4-201
  • State electronic verification system: means the system described in Section 26B-4-202. See Utah Code 26B-4-201
  • (a)  enter into a memorandum of understanding in order to determine the function and operation of the state electronic verification system in accordance with Subsection (2);

    (b)  coordinate with the Division of Purchasing, under Title 63G, Chapter 6a, Utah Procurement Code, to develop a request for proposals for a third-party provider to develop and maintain the state electronic verification system in coordination with the Division of Technology Services; and

    (c)  select a third-party provider who:

    (i)  meets the requirements contained in the request for proposals issued under Subsection (1)(b); and

    (ii)  may not have any commercial or ownership interest in a cannabis production establishment or a medical cannabis pharmacy.
  • (2)  The Department of Agriculture and Food, the department, the Department of Public Safety, and the Division of Technology Services shall ensure that the state electronic verification system described in Subsection (1):

    (a)  allows an individual to apply for a medical cannabis patient card or, if applicable, a medical cannabis guardian card, provided that the card may not become active until:

    (i)  the relevant qualified medical provider completes the associated medical cannabis recommendation; or

    (ii)  for a medical cannabis card related to a limited medical provider‘s recommendation, the medical cannabis pharmacy completes the recording described in Subsection (2)(d);

    (b)  allows an individual to apply to renew a medical cannabis patient card or a medical cannabis guardian card in accordance with Section 26B-4-213;

    (c)  allows a qualified medical provider, or an employee described in Subsection (3) acting on behalf of the qualified medical provider, to:

    (i)  access dispensing and card status information regarding a patient:

    (A)  with whom the qualified medical provider has a provider-patient relationship; and

    (B)  for whom the qualified medical provider has recommended or is considering recommending a medical cannabis card;

    (ii)  electronically recommend treatment with cannabis in a medicinal dosage form or a cannabis product in a medicinal dosage form and optionally recommend dosing guidelines;

    (iii)  electronically renew a recommendation to a medical cannabis patient cardholder or medical cannabis guardian cardholder:

    (A)  using telehealth services, for the qualified medical provider who originally recommended a medical cannabis treatment during a face-to-face visit with the patient; or

    (B)  during a face-to-face visit with the patient, for a qualified medical provider who did not originally recommend the medical cannabis treatment during a face-to-face visit ; and

    (iv)  submit an initial application, renewal application, or application payment on behalf of an individual applying for any of the following:

    (A)  a medical cannabis patient card;

    (B)  a medical cannabis guardian card; or

    (C)  a medical cannabis caregiver card;

    (d)  allows a medical cannabis pharmacy medical provider or medical cannabis pharmacy agent, in accordance with Subsection 26B-4-229(10)(a), to:

    (i)  access the electronic verification system to review the history within the system of a patient with whom the provider or agent is interacting, limited to read-only access for medical cannabis pharmacy agents unless the medical cannabis pharmacy’s pharmacist in charge authorizes add and edit access;

    (ii)  record a patient’s recommendation from a limited medical provider, including any directions of use, dosing guidelines, or caregiver indications from the limited medical provider;

    (iii)  record a limited medical provider’s renewal of the provider’s previous recommendation; and

    (iv)  submit an initial application, renewal application, or application payment on behalf of an individual applying for any of the following:

    (A)  a medical cannabis patient card;

    (B)  a medical cannabis guardian card; or

    (C)  a medical cannabis caregiver card;

    (e)  connects with:

    (i)  an inventory control system that a medical cannabis pharmacy uses to track in real time and archive purchases of any cannabis in a medicinal dosage form, cannabis product in a medicinal dosage form, or a medical cannabis device, including:

    (A)  the time and date of each purchase;

    (B)  the quantity and type of cannabis, cannabis product, or medical cannabis device purchased;

    (C)  any cannabis production establishment, any medical cannabis pharmacy, or any medical cannabis courier associated with the cannabis, cannabis product, or medical cannabis device; and

    (D)  the personally identifiable information of the medical cannabis cardholder who made the purchase; and

    (ii)  any commercially available inventory control system that a cannabis production establishment utilizes in accordance with Section 4-41a-103 to use data that the Department of Agriculture and Food requires by rule, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, from the inventory tracking system that a licensee uses to track and confirm compliance;

    (f)  provides access to:

    (i)  the department to the extent necessary to carry out the department’s functions and responsibilities under this part;

    (ii)  the Department of Agriculture and Food to the extent necessary to carry out the functions and responsibilities of the Department of Agriculture and Food under Title 4, Chapter 41a, Cannabis Production Establishments; and

    (iii)  the Division of Professional Licensing to the extent necessary to carry out the functions and responsibilities related to the participation of the following in the recommendation and dispensing of medical cannabis:

    (A)  a podiatrist licensed under Title 58, Chapter 5a, Podiatric Physician Licensing Act;

    (B)  a pharmacist licensed under Title 58, Chapter 17b, Pharmacy Practice Act;

    (C)  an advanced practice registered nurse licensed under Title 58, Chapter 31b, Nurse Practice Act;

    (D)  a physician licensed under Title 58, Chapter 67, Utah Medical Practice Act, or Title 58, Chapter 68, Utah Osteopathic Medical Practice Act; or

    (E)  a physician assistant licensed under Title 58, Chapter 70a, Utah Physician Assistant Act;

    (g)  provides access to and interaction with the state central patient portal;

    (h)  communicates dispensing information from a record that a medical cannabis pharmacy submits to the state electronic verification system under Subsection 26B-4-230(5)(a)(ii) to the controlled substance database;

    (i)  provides access to state or local law enforcement:

    (i)  during a law enforcement encounter, without a warrant, using the individual’s driver license or state ID, only for the purpose of determining if the individual subject to the law enforcement encounter has a valid medical cannabis card; or

    (ii)  after obtaining a warrant; and

    (j)  creates a record each time a person accesses the system that identifies the person who accesses the system and the individual whose records the person accesses.

    (3) 

    (a)  An employee of a qualified medical provider may access the electronic verification system for a purpose described in Subsection (2)(c) on behalf of the qualified medical provider if:

    (i)  the qualified medical provider has designated the employee as an individual authorized to access the electronic verification system on behalf of the qualified medical provider;

    (ii)  the qualified medical provider provides written notice to the department of the employee’s identity and the designation described in Subsection (3)(a)(i); and

    (iii)  the department grants to the employee access to the electronic verification system.

    (b)  An employee of a business that employs a qualified medical provider may access the electronic verification system for a purpose described in Subsection (2)(c) on behalf of the qualified medical provider if:

    (i)  the qualified medical provider has designated the employee as an individual authorized to access the electronic verification system on behalf of the qualified medical provider;

    (ii)  the qualified medical provider and the employing business jointly provide written notice to the department of the employee’s identity and the designation described in Subsection (3)(b)(i); and

    (iii)  the department grants to the employee access to the electronic verification system.

    (4) 

    (a)  As used in this Subsection (4), “prescribing provider” means:

    (i)  a podiatrist licensed under Title 58, Chapter 5a, Podiatric Physician Licensing Act;

    (ii)  an advanced practice registered nurse licensed under Title 58, Chapter 31b, Nurse Practice Act;

    (iii)  a physician licensed under Title 58, Chapter 67, Utah Medical Practice Act, or Title 58, Chapter 68, Utah Osteopathic Medical Practice Act; or

    (iv)  a physician assistant licensed under Title 58, Chapter 70a, Utah Physician Assistant Act.

    (b)  A prescribing provider may access information in the electronic verification system regarding a patient the prescribing provider treats.

    (5)  The department may release limited data that the system collects for the purpose of:

    (a)  conducting medical and other department approved research;

    (b)  providing the report required by Section 26B-4-222; and

    (c)  other official department purposes.

    (6)  The department shall make rules, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, to establish:

    (a)  the limitations on access to the data in the state electronic verification system as described in this section; and

    (b)  standards and procedures to ensure accurate identification of an individual requesting information or receiving information in this section.

    (7) 

    (a)  Any person who knowingly and intentionally releases any information in the state electronic verification system in violation of this section is guilty of a third degree felony.

    (b)  Any person who negligently or recklessly releases any information in the state electronic verification system in violation of this section is guilty of a class C misdemeanor.

    (8) 

    (a)  Any person who obtains or attempts to obtain information from the state electronic verification system by misrepresentation or fraud is guilty of a third degree felony.

    (b)  Any person who obtains or attempts to obtain information from the state electronic verification system for a purpose other than a purpose this part authorizes is guilty of a third degree felony.

    (9) 

    (a)  Except as provided in Subsection (9)(e), a person may not knowingly and intentionally use, release, publish, or otherwise make available to any other person information obtained from the state electronic verification system for any purpose other than a purpose specified in this section.

    (b)  Each separate violation of this Subsection (9) is:

    (i)  a third degree felony; and

    (ii)  subject to a civil penalty not to exceed $5,000.

    (c)  The department shall determine a civil violation of this Subsection (9) in accordance with Title 63G, Chapter 4, Administrative Procedures Act.

    (d)  Civil penalties assessed under this Subsection (9) shall be deposited into the General Fund.

    (e)  This Subsection (9) does not prohibit a person who obtains information from the state electronic verification system under Subsection (2)(a), (c), or (f) from:

    (i)  including the information in the person’s medical chart or file for access by a person authorized to review the medical chart or file;

    (ii)  providing the information to a person in accordance with the requirements of the Health Insurance Portability and Accountability Act of 1996; or

    (iii)  discussing or sharing that information about the patient with the patient.

    Renumbered and Amended by Chapter 307, 2023 General Session
    Amended by Chapter 317, 2023 General Session