In addition to words and terms defined in the Cannabis Control Act (§ 4.1-600 et seq. of the Code of Virginia), the following words and terms when used in this chapter shall have the following meanings, unless the context clearly indicates otherwise:

"Batch" means a quantity of (i) cannabis oil from a production lot or (ii) harvested botanical cannabis product that is identified by a batch number or other unique identifier.

"Board" means the Board of Directors of the Cannabis Control Authority.

"Cannabis cultivation facility" means a location at which the board has authorized a pharmaceutical processor to cultivate cannabis plants pursuant to § 4.1-1602 of the Code of Virginia and the requirements of 3VAC10-30-160.

"Cannabis product advertising" means the act of providing consideration for the publication, dissemination, solicitation, or circulation of visual, oral, or written communication through any means to directly induce any person to patronize a particular pharmaceutical processor or cannabis dispensing facility or to purchase particular approved cannabis products. Advertising includes marketing.

"Certification" means a written statement, consistent with requirements of § 4.1-1601 of the Code of Virginia, issued by a practitioner for the use of cannabis products for treatment of or to alleviate the symptoms of any diagnosed condition or disease determined by the practitioner to benefit from such use.

"Cartoon" means any drawing, sketch, computer-generated illustration, or other depiction of an object, person, animal, creature, or any similar caricature that meets any of the following criteria:

1. The use of comically exaggerated features;

2. The attribution of human characteristics to animals, plants, or other objects;

3. The attribution of animal, plant, or other object characteristics to humans; or

4. The attribution of unnatural or extra-human abilities.

"Companion" means a person who provides fellowship and protection for an elderly person or person with an illness, injury, or disability who requires assistance with self-care.

"Endorse" means declaring public approval, support, or recommendation of a practitioner, including sharing information online and hosting or facilitating events that would promote a particular practitioner's services above others. Patient education events are permissible provided the event (i) is clearly focused on patient education and (ii) offers information about multiple practitioners without favor or emphasis on a particular practitioner.

"Immediate container" means a container that is in direct contact with cannabis or a cannabis product or, if a wrapper is in direct contact with the cannabis or the cannabis product, with the wrapper.

"Medical cannabis facility" means a pharmaceutical processor, cannabis dispensing facility, or cannabis cultivation facility.

"On duty" means that a pharmacist, the responsible party, or a person who is qualified to provide supervision in accordance with 3VAC10-30-90 is on the premises at the address of the permitted pharmaceutical processor and is available as needed.

"Package" or "packaging" means any inner or outer container or covering.

"Perpetual inventory" means an ongoing system for recording quantities of cannabis products received, dispensed, or otherwise distributed by a cannabis dispensing facility.

"PIC" means the pharmacist-in-charge whose name is on the pharmaceutical processor or cannabis dispensing facility application for a permit that has been issued and who shall have oversight of the processor's dispensing area or cannabis dispensing facility.

"Production" or "produce" means the manufacture, planting, preparation, cultivation, growing, harvesting, propagation, conversion, or processing of marijuana for the creation of usable cannabis, botanical cannabis, or a cannabis product derived thereof, (i) directly or indirectly by extraction from substances of natural origin, (ii) independently by means of chemical synthesis, or (iii) by a combination of extraction and chemical synthesis. "Production" or "produce" includes any packaging or repackaging of the substance or labeling or relabeling of its container.

"Qualifying patient" means a Virginia resident who has received from a practitioner, as defined in § 4.1-1600 of the Code of Virginia, a written certification for the use of cannabis products for treatment of or to alleviate the symptoms of any diagnosed condition or disease.

"Registered cannabis product" means cannabis flower, concentrated cannabis, cannabis extracts, and products that are infused with cannabis or an extract thereof intended for use or consumption by humans and approved by the board.

"Registration" means an identification card or other document issued by the board that identifies a person as a qualifying patient, parent, legal guardian, or registered agent that has voluntarily registered with the board.

"Responsible party" means the person designated on the pharmaceutical processor application who shall have oversight of the cultivation and production areas of the pharmaceutical processor.

A. A pharmaceutical processor or cannabis dispensing facility shall only sell cannabis products in a child-resistant, secure, and light-resistant container. Upon a written request from the patient, parent, legal guardian, or registered agent, the product may be dispensed in a non-child-resistant container so long as all labeling is maintained with the product.

B. Only a pharmacist may dispense cannabis products to patients or parents or legal guardians of patients who are minors or vulnerable adults, or to a registered agent. A pharmacy technician who meets the requirements of 3VAC10-30-90 C D may assist, under the direct supervision of a pharmacist, in the dispensing and selling of cannabis products.

C. The PIC, pharmacist, responsible party, or person who is qualified to provide supervision in accordance with 3VAC10-30-90 on duty shall restrict access to the pharmaceutical processor or cannabis dispensing facility to:

1. A person whose responsibilities necessitate access to the pharmaceutical processor or cannabis dispensing facility and then for only as long as necessary to perform the person's job duties; or

2. A person who is a patient, parent, legal guardian, registered agent, or a companion of the patient, in which case such person shall not be permitted behind the service counter or in other areas where cannabis plants, extracts, or cannabis products are stored.

D. A pharmacist, pharmacy technician, or an employee of the pharmaceutical processor or cannabis dispensing facility who has routine access to confidential patient data and who has signed a patient data confidentiality agreement with the processor or dispensing facility may determine eligibility for access to the processor or facility by verifying through a verification source recognized by the board that the registration of the patient, parent, legal guardian, or registered agent is current.

E. All pharmacists and pharmacy technicians shall, at all times while at the pharmaceutical processor or cannabis dispensing facility, have their current license or registration available for inspection by the board or the board's agent.

F. While inside the pharmaceutical processor or cannabis dispensing facility, all employees shall wear name tags or similar forms of identification that clearly identify them, including their position at the pharmaceutical processor or cannabis dispensing facility.

G. A pharmaceutical processor or cannabis dispensing facility shall be open for patients, parents, legal guardians, or registered agents to purchase cannabis products for a minimum of 35 hours a week, except as otherwise authorized by the board.

H. A pharmaceutical processor or cannabis dispensing facility that closes the dispensing area during its normal hours of operation shall implement procedures to notify patients, parents, legal guardians, and registered agents of when the pharmaceutical processor or cannabis dispensing facility will resume normal hours of operation. Such procedures may include telephone system messages and conspicuously posted signs. If the cultivation, production, or dispensing area of the pharmaceutical processor or if a cannabis dispensing facility is or will be closed during its normal hours of operation for longer than two business days, the pharmaceutical processor or cannabis dispensing facility shall immediately notify the board.

I. A pharmacist shall counsel patients, parents, legal guardians, and registered agents, if applicable, regarding the use of cannabis products. Such counseling shall include information related to safe techniques for proper use and storage of cannabis products and for disposal of the products in a manner that renders them nonrecoverable.

J. I. The medical cannabis facility shall establish, implement, and adhere to a written alcohol-free, drug-free, and smoke-free workplace policy that shall be available to the board or the board's agent upon request.

A. No pharmaceutical processor shall:

1. Cultivate cannabis plants or produce or dispense cannabis products in any place except the approved facility at the address of record on the application for the pharmaceutical processor permit;

2. Sell, deliver, transport, or distribute cannabis, including cannabis products, to any other facility except for wholesale distribution pursuant to 3VAC10-40-50;

3. Produce or manufacture cannabis products for use outside of Virginia; or

4. Provide cannabis products samples;

5. Endorse or promote a practitioner; or

6. Provide anything of value, directly or indirectly, to a practitioner.

B. No cannabis dispensing facility shall:

1. Dispense cannabis products in any place except the approved facility at the address of record on the application for the cannabis dispensing facility permit;

2. Sell, deliver, transport, or distribute cannabis products to any other facility, except for wholesale distribution pursuant to 3VAC10-40-50; or

3. Provide cannabis product samples.

C. No cannabis cultivation facility shall:

1. Sell, deliver, transport, or distribute cannabis to any other facility, except for the pharmaceutical processor that established the cannabis cultivation facility;

2. Produce, manufacture, or dispense cannabis products; or

3. Provide cannabis samples.

D. When a pharmacist is not on the premises and directly supervising the activity within the dispensing area of the pharmaceutical processor or a cannabis dispensing facility:

1. The dispensing area shall not be open or in operation;

2. No person shall be in the dispensing area unless all cannabis products are contained in a vault or other similar container to which only the pharmacist has access controls; and

3. The dispensing area shall be closed and properly secured.

E. Employee access to secured areas designated for cultivation and production, as authorized by the responsible party pursuant to § 4.1-1602 of the Code of Virginia, is permissible when a pharmacist is not on the premises.

F. No pharmaceutical processor or cannabis dispensing facility shall sell anything other than cannabis products except for devices for administration of dispensed products or hemp-based CBD products.

G. Except as provided in subsections H and I of this section, no person other than a medical cannabis facility employee, a patient, parent, legal guardian, registered agent, or a companion of a patient shall be allowed on the premises of a processor or facility.

H. Laboratory staff may enter a pharmaceutical processor or cannabis cultivation facility for the sole purpose of identifying and collecting cannabis or cannabis products samples to conduct laboratory tests.

I. A medical cannabis facility may submit a written request for entry by other persons to the board or the board's authorized representative.

J. An employee of a business that is contracted by a pharmaceutical processor may be allowed on the premises of the processor to perform the employee's duties (e.g. security, cleaning, electrical, plumbing) without requesting board authorization. The pharmaceutical processor should apply the requirements for visitor access found in subsection K of this section to the contracted employee.

K. All persons who the board or the board’s representative has authorized in writing to enter the medical cannabis facility shall obtain a visitor identification badge from a medical cannabis facility employee prior to entering the processor or facility.

1. An employee shall escort and monitor an authorized visitor at all times the visitor is in the medical cannabis facility.

2. The visitor identification badge shall remain visible at all times the visitor is in the medical cannabis facility, and the visitor shall return the visitor identification badge to an employee upon exiting the medical cannabis facility.

3. All visitors shall log in and out. The medical cannabis facility shall maintain the visitor log that shall include the date, time, and purpose of the visit and be available to the board.

4. If an emergency requires the presence of a visitor and makes it impractical for the medical cannabis facility to obtain prior authorization from the board, the medical cannabis facility shall provide written notice to the board as soon as practicable after the onset of the emergency. Such notice shall include the name and company affiliation of the visitor, the purpose of the visit, and the date and time of the visit. A medical cannabis facility shall monitor the visitor and maintain a log of such visit as required by this subsection.

L. No cannabis products shall be sold, dispensed, or distributed via a delivery service or any other manner outside of a pharmaceutical processor or cannabis dispensing facility; however, a parent, legal guardian, or registered agent or an agent of the processor or cannabis dispensing facility may deliver cannabis products to the patient or in accordance with 3VAC10-50-80 A.

M. Notwithstanding the requirements of subsection G of this section, an agent of the board or local law enforcement or other federal, state, or local government officials may enter any area of a medical cannabis facility if necessary to perform such individual's governmental duties.

A. A pharmaceutical processor must implement and maintain an electronic tracking system as prescribed by the authority.

B. A pharmaceutical processor shall identify, monitor, and track all cannabis through a unique identifier assigned at seed acquisition or plant propagation.

C. A pharmaceutical processor shall maintain a record of all cannabis through cultivation and processing until transferred, distributed to qualifying patients, parents, legal guardians, or registered agents, or otherwise disposed of according to 3VAC10-50-110.

A. Cannabis oil, cannabis products, botanical cannabis, and usable cannabis from a batch that have passed the tests required in 3VAC10-60-20 G and H and are packaged and labeled for sale with an appropriate expiration date in accordance with 3VAC10-60-20 may be wholesale distributed between pharmaceutical processors, between a pharmaceutical processor and a cannabis dispensing facility, and between cannabis dispensing facilities.

B. Bulk cannabis oil, botanical cannabis, and usable cannabis that have not been packaged for sale and have not passed the tests required in 3VAC10-60-20 G and H and do not bear an appropriate expiration date may be wholesale distributed between pharmaceutical processors. Prior to distribution, the bulk cannabis oil, botanical cannabis, and usable cannabis shall be labeled in compliance with 3VAC10-70-30.

C. A pharmaceutical processor or cannabis dispensing facility engaged in wholesale distribution of cannabis products shall create a record of the transaction that shows (i) the date of distribution; (ii) the names and addresses of the processor or cannabis dispensing facility distributing the product and the processor or cannabis dispensing facility receiving the product; (iii) the kind and quantity of product being distributed; and (iv) the batch and lot identifying information to include harvest date, including testing date, processing or manufacturing date, and expiration date. The record of the transaction shall be maintained by the distributing pharmaceutical processor or cannabis dispensing facility with its records of distribution, and a copy of the record shall be provided to and maintained by the processor or facility receiving the product in its records of receipt. Such records shall be maintained by each processor or facility for three years in compliance with 3VAC10-40-200.

D. A pharmaceutical processor engaged in wholesale distribution of bulk cannabis oil, botanical cannabis, and usable cannabis shall create a record of the transaction.

1. The record of the transaction shall show (i) the date of distribution; (ii) the names and addresses of the processor distributing the bulk cannabis oil, botanical cannabis, and usable cannabis and the processor receiving the bulk cannabis oil, botanical cannabis, and usable cannabis; (iii) the quantity or weight of the cannabis oil, botanical cannabis, or usable cannabis in each container; (iv) the quantity of each type of container being distributed; (v) the identification of the contents of each container, including a brief description of the type or form of cannabis oil, botanical cannabis, or usable cannabis and the strain name, as appropriate; (vi) the lot or batch number or unique identifier so as to facilitate any warnings or recalls the board or pharmaceutical processor deem appropriate; and (vii) the dates of harvest and packaging.

2. The record of the transaction shall be maintained by the distributing pharmaceutical processor with its records of distribution, and a copy of the record shall be provided to and maintained by the processor receiving the product in its records of receipt.

3. Such records shall be maintained by each processor for three years in compliance with 3VAC10-40-200.

E. A pharmaceutical processor or cannabis dispensing facility engaged in the wholesale distribution of cannabis products shall provide the receiving processor or cannabis dispensing facility with a copy of the lab results for the distributed product or electronic access to the information that can be shared upon request to patients, parents, legal guardians, registered agents, practitioners who have certified qualifying patients, or an agent of the board.

F. A pharmaceutical processor or cannabis dispensing facility engaged in the wholesale distribution of cannabis products and pharmaceutical processors engaged in the wholesale distribution of bulk cannabis oil, botanical cannabis, and usable cannabis shall store and handle the items and maintain policies and procedures that include a process for executing or responding to mandatory and voluntary recalls in a manner that complies with 3VAC10-40-210.

G. If a pharmaceutical processor or cannabis dispensing facility participating in wholesale distribution uses an electronic system for the storage and retrieval of records related to distribution, the pharmaceutical processor shall use a system that is compliant with 3VAC10-40-200.

A. Each Upon commencing operation, each medical cannabis facility prior to commencing business shall: 1. Conduct conduct an initial comprehensive inventory of all cannabis plants, including the seeds, parts of plants, extracts, and cannabis products, at the facility. If a facility commences business with no cannabis or cannabis products on hand, the pharmacist or responsible party shall record this fact as the initial inventory.

2. Establish ongoing inventory controls and procedures for the conduct of inventory reviews and comprehensive inventories of all cannabis plants, including the seeds, parts of plants, extracts, and cannabis products, that shall enable the facility to detect any diversion, theft, or loss in a timely manner.

B. Each medical cannabis facility shall establish ongoing inventory controls and procedures to conduct inventory reviews and comprehensive inventories of all cannabis plants, including the seeds, parts of plants, extracts, and cannabis products, that shall enable the facility to detect any diversion, theft, or loss in a timely manner.

C. For all inventories conducted by a medical cannabis facility:

1. The responsible party shall ensure all required inventories are performed in the cultivation and production areas, and the PIC shall ensure all required inventories are performed in the dispensing area.

2. The inventory shall be conducted by a pharmacist, pharmacy technician, responsible party, or person authorized by the responsible party who provides supervision of cultivation or production-related activities.

3. The inventories shall include, at a minimum, the date of the inventory, a summary of the inventory findings, and the name, signature, and title of the person who conducted the inventory.

C. D. Upon commencing business operation, each pharmaceutical processor shall conduct a weekly inventory of all cannabis plants, including the seeds, parts of plants, and cannabis products in stock, that shall comply with the requirements of subsection B C of this section.

D. E. Upon commencing business operation, each cannabis dispensing facility shall maintain a perpetual inventory of all cannabis products received and dispensed that accurately indicates the physical count of each cannabis product on hand at the time of performing the inventory. The perpetual inventory shall include a reconciliation of each cannabis product at least monthly with a written explanation for any difference between the physical count and the theoretical count.

E. F. Upon commencing business operation, each cannabis cultivation facility shall conduct a weekly inventory of all cannabis plants, including the seeds and parts of plants, in stock that shall comply with the requirements of subsection B C of this section.

F. G. The record of all cannabis products sold, dispensed, or otherwise disposed of shall show the date of sale or disposition; the name of the pharmaceutical processor or cannabis dispensing facility; the name and address of the patient, parent, legal guardian, or registered agent to whom the cannabis product was sold; the kind and quantity of cannabis product sold or disposed of; and the method of disposal.

G. H. A complete and accurate record of all cannabis plants, including the seeds, parts of plants, and cannabis products on hand, shall be prepared annually on the anniversary of the initial inventory or such other date that the PIC or responsible party may choose, so long as it is not more than one year following the prior year's inventory.

H. I. All inventories, procedures, and other documents required by this section shall be maintained on the premises and made available to the board or its agent.

I. J. Inventory records shall be maintained for three years from the date the inventory was taken.

J. K. Whenever a person authorized to enforce state or federal law for the purpose of investigation or as evidence removes any sample or record, such person shall tender a receipt in lieu thereof and the receipt shall be kept for a period of at least three years.

A. All employees of a medical cannabis facility shall complete training prior to the employee commencing work at the medical cannabis facility. At a minimum, the training shall be in the following areas:

1. The proper use of security measures and controls that have been adopted for the prevention of diversion, theft, or loss of cannabis, to include including the seeds, any parts or extracts of the cannabis plants, and cannabis products;

2. Procedures and instructions for responding to an emergency;

3. Professional conduct, ethics, and state and federal statutes and regulations regarding patient confidentiality; and

4. Developments in the field of the medical use of cannabis products.

B. The PIC and the responsible party shall ensure the continued competency of all employees, in the respective areas for which they have oversight, through continuing in-service training that is provided at least annually, is designed to supplement initial training, and includes any guidance specified by the board.

C. The PIC and the responsible party shall be responsible for maintaining a written record documenting the initial and continuing training of all their respective employees that shall contain:

1. The name of the person receiving the training;

2. The dates of the training;

3. A general description of the topics covered;

4. The name of the person supervising the training; and

5. The signatures of the person receiving the training and the PIC or the responsible party.

D. When a change of PIC or responsible party for the medical cannabis facility occurs, the new PIC or responsible party shall review the training record and sign it, indicating that the new PIC or responsible party understands its contents.

E. A medical cannabis facility shall maintain the record documenting the employee training and make it available in accordance with regulations.

A. A person may only serve as the responsible party for one pharmaceutical processor or cannabis cultivation facility at any one time. The responsible party shall be employed full time in a managerial position at the location of the pharmaceutical processor or cannabis cultivation facility and shall be actively engaged in daily operations of the processor during normal hours of operation.

B. The responsible party shall be aware of and knowledgeable about all policies and procedures pertaining to the operations of the pharmaceutical processor or cannabis cultivation facility.

C. The responsible party shall ensure compliance with all security measures to protect the cannabis within the cultivation and production areas from diversion at all times and ensure that cultivation and production is performed in a safe and compliant manner and free of adulteration and misbranding.

D. The responsible party shall be responsible for ensuring that:

1. All employees practicing in the cultivation and production areas are properly trained;

2. All record retention requirements are met;

3. All requirements are met for the physical security of the cannabis, to include including the seeds, any parts or extracts of the cannabis plants, and the cannabis products within the cultivation and production area; and

4. Any other required filings or notifications regarding the cultivation and production areas are made on behalf of the processor as set forth in this chapter.

E. When the responsible party ceases practice at a pharmaceutical processor or cannabis cultivation facility or no longer wishes to be designated as the responsible party, the responsible party shall immediately return the pharmaceutical processor permit to notify the board indicating and indicate the effective date on which the responsible party ceased or will cease to be the responsible party.

F. The outgoing responsible party shall have the opportunity to take a complete and accurate inventory of all cannabis, to include plants, extracts, or cannabis products on hand in the cultivation and production areas, on the date he ceases to be the responsible party unless the owner submits written notice to the board showing good cause as to why this opportunity should not be allowed.

G. F. A responsible party who is absent from practice a pharmaceutical processor or cannabis cultivation facility for more than 30 consecutive days shall be deemed to no longer be the responsible party. If the responsible party knows of an upcoming absence of longer than 30 days, the responsible party shall be responsible for notifying the board and returning the permit. For unanticipated absences by the responsible party that exceed 15 days with no known return date within the next 15 days, the permit holder shall immediately notify the board and shall obtain a new responsible party.

H. An application for a permit designating the new responsible party shall be filed with the required fee within 14 days of the original date of resignation or termination of the responsible party in a manner provided by the board. G. If the responsible party resigns or otherwise ceases employment, the pharmaceutical processor or cannabis cultivation facility shall submit a change of responsible party application designating the new responsible party within 14 days of the former responsible party's resignation or termination date. It shall be unlawful for a pharmaceutical processor to operate without a new permit responsible party designated past the 14-day deadline unless the board receives a request for an extension prior to the deadline. The chair of the board, or the chair's designee, authority may grant an extension for up to an additional 14 days for good cause shown.

A. The PIC of a pharmaceutical processor shall not serve as PIC of any other medical cannabis facility at any one time. A processor shall employ the PIC at the pharmaceutical processor for at least 35 hours per week, except as otherwise authorized by the board. A person may serve simultaneously as the PIC for no more than two cannabis dispensing facilities located within the same health service area at any one time.

B. The PIC or the pharmacist on duty shall control all aspects of the practice in the dispensing area of the pharmaceutical processor or in a cannabis dispensing facility. Any decision overriding such control of the PIC or other pharmacist on duty may be grounds for disciplinary action against the pharmaceutical processor or cannabis dispensing facility permit.

C. The PIC of a pharmaceutical processor or cannabis dispensing facility shall be responsible for ensuring that:

1. Pharmacy technicians are registered and properly trained;

2. All record retention requirements pertaining to the dispensing area are met;

3. All requirements for the physical security of the cannabis products are met;

4. The pharmaceutical processor or cannabis dispensing facility has appropriate pharmaceutical reference materials to ensure that cannabis products can be properly dispensed;

5. The following items are conspicuously posted in the pharmaceutical processor or cannabis dispensing facility in a location and in a manner so as to be clearly and readily identifiable to patients, parents, legal guardians, or registered agents:

a. Pharmaceutical processor permit or cannabis dispensing facility permit;

b. Licenses for all pharmacists practicing at the pharmaceutical processor or cannabis dispensing facility; and

c. The price of all cannabis products offered by the pharmaceutical processor or cannabis dispensing facility; and

6. Any other required filings or notifications are made on behalf of the dispensing area of the pharmaceutical processor or the dispensing facility as set forth in this chapter.

D. When the PIC ceases practice at a pharmaceutical processor or cannabis dispensing facility or no longer wishes to be designated as PIC, the PIC shall immediately return the permit to the board indicating the effective date on which the PIC ceased to be the PIC.

E. An outgoing PIC shall have the opportunity to take a complete and accurate inventory of all cannabis products on hand in the dispensing area of the pharmaceutical processor or the dispensing facility on the date the PIC ceases to be the PIC, unless the owner submits written notice to the board showing good cause as to why this opportunity should not be allowed.

F. E. A PIC who is absent from practice for more than 30 consecutive days shall be deemed to no longer be the PIC. If the PIC knows of an upcoming absence of longer than 30 days, the PIC shall be responsible for notifying the board and returning the permit. For unanticipated absences by the PIC that exceed 15 days with no known return date within the next 15 days, the permit holder shall immediately notify the board and shall obtain a new PIC.

G. An application for a permit designating the new PIC shall be filed with the required fee within 14 days of the original date of resignation or termination of the PIC on a form provided by the board F. If the PIC resigns or otherwise ceases employment, the pharmaceutical processor or cannabis dispensing facility shall submit a change of PIC application within 14 days of the PIC's resignation or termination date. It shall be unlawful for a pharmaceutical processor or cannabis dispensing facility to operate without a new permit PIC designated past the 14-day deadline unless the board receives a request for an extension prior to the deadline. The executive director for the board authority may grant an extension for up to an additional 14 days for good cause shown.

A. A pharmaceutical processor shall initially cultivate only the number of cannabis plants necessary to produce cannabis products for the number of patients anticipated within the first nine months of operation. Thereafter, the processor shall not maintain cannabis product in excess of the quantity required for normal, efficient operation.

B. At no time shall a cannabis dispensing facility maintain cannabis products in excess of the quantity required for normal, efficient operation.

C. A medical cannabis facility shall properly secure cannabis plants, seeds, parts of plants, extracts, and cannabis products. To secure these items, a medical cannabis facility shall:

1. Maintain all cannabis plants, seeds, parts of plants, extracts, and cannabis products in a secure area or location accessible only by the minimum number of authorized employees essential for efficient operation;

2. Store all cut parts of cannabis plants, extracts, or cannabis products in an approved safe or approved vault within the medical cannabis facility and not sell cannabis products when the regulated cannabis facility is closed;

3. Keep all approved safes, approved vaults, or any other approved equipment or areas used for the production, cultivation, harvesting, processing, manufacturing, or storage of cannabis products securely locked or protected from entry, except for the actual time required to remove or replace the cannabis, seeds, parts of plants, extracts, or cannabis products;

4. Keep all locks and security equipment in good working order;

5. Restrict access to keys or codes to all safes, approved vaults, or other approved equipment or areas in the dispensing area to pharmacists practicing at the pharmaceutical processor or cannabis dispensing facility;

6. Restrict access to keys or codes to all safes, approved vaults, or other approved equipment or areas in the cultivation and production areas to the responsible party and to those authorized by the responsible party. The responsible party shall authorize access to pharmacists practicing in the processor or persons supervising cultivation-related or production-related activities at the processor; and

7. Not allow keys to be left in the locks or otherwise accessible to persons not authorized by the PIC or responsible party.

D. The PIC or responsible party may designate employees, other than a pharmacist or person supervising cultivation-related or production-related activities at the processor, to have the ability to unlock a secured area to gain entrance to perform required job duties, but only during hours of operation of the processor or dispensing facility. At no time shall these employees have access to the security system.

E. The regulated cannabis facility shall have an adequate security system to prevent and detect diversion, theft, or loss of cannabis seeds, plants, extracts, or cannabis products. A failure notification system and a back-up alarm system with an ability to remain operational during a power outage shall be installed in each pharmaceutical processor or cannabis dispensing facility. The installation and the operation of the system shall meet accepted alarm industry standards, subject to the following conditions:

1. The system shall include a sound, microwave, photoelectric, ultrasonic, or other generally accepted and suitable device;

2. The system shall be monitored in accordance with accepted industry standards, be maintained in operating order, have an auxiliary source of power, and be capable of sending an alarm signal to the monitoring entity when breached if the communication line is not operational;

3. The system shall fully protect the entire processor or facility and shall be capable of detecting any failure in the system when activated;

4. The system shall include a duress alarm, a panic alarm, and an automatic voice dialer;

5. Access to the alarm system for the dispensing area of the pharmaceutical processor or cannabis dispensing facility shall be restricted to the pharmacists working at the pharmaceutical processor or cannabis dispensing facility, and the system shall be activated whenever the pharmaceutical processor or cannabis dispensing facility is closed for business; and

6. Access to the alarm system in a cannabis cultivation facility or areas of a pharmaceutical processor that are designated for cultivation and production shall be restricted to the responsible party and to those authorized by the responsible party who shall be the pharmacists practicing at the pharmaceutical processor or person supervising cultivation-related or production-related activities.

F. A medical cannabis facility shall keep the outside perimeter of the premises well lit.

G. A medical cannabis facility shall have video cameras in all areas that may contain cannabis plants, seeds, parts of plants, extracts, or cannabis products and at all points of entry and exit, which shall be appropriate for the normal lighting conditions of the area under surveillance.

1. The medical cannabis facility shall direct cameras at all approved safes, approved vaults, dispensing areas, or cannabis products sales areas, and any other area where cannabis plants, seeds, extracts, or cannabis products are being produced, harvested, manufactured, stored, or handled. At entry and exit points, the medical cannabis facility shall angle cameras so as to allow for the capture of clear and certain identification of any person entering or exiting the facility;

2. The video system shall have:

a. A failure notification system that provides an audible, text, or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to the medical cannabis facility within five minutes of the failure, either by telephone, email, or text message;

b. The ability to immediately produce a clear color still photo that is a minimum of 9600 dpi from any camera image, live or recorded;

c. A date and time stamp embedded on all recordings. The date and time shall be synchronized and set correctly and shall not significantly obscure the picture; and

d. The ability to remain operational during a power outage;

3. All video recordings shall allow for the exporting of still images in an industry standard image format. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. A medical cannabis facility shall erase all recordings prior to disposal or sale of the facility; and

4. The medical cannabis facility shall make 24-hour recordings from all video cameras available for immediate viewing by the board or the board's agent upon request and shall retain the recordings for at least 30 days. If a medical cannabis facility is aware of a pending criminal, civil, or administrative investigation or legal proceeding for which a recording may contain relevant information, the medical cannabis facility shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the medical cannabis facility PIC or responsible party that it is not necessary to retain the recording.

H. The medical cannabis facility shall maintain all security system equipment and recordings in a secure location so as to prevent theft, loss, destruction, or alterations. All security equipment shall be maintained in good working order and shall be tested at least every six months. The pharmaceutical processor or cannabis dispensing facility shall keep all onsite surveillance rooms locked and shall not use such rooms for any other function.

I. A medical cannabis facility shall limit access to surveillance areas to persons who are essential to surveillance operations, law-enforcement agencies, security system service employees, the board or the board's agent, and others when approved by the board. A medical cannabis facility shall make available a current list of authorized employees and security system service employees who have access to the surveillance room of the processor or facility.

J. If diversion, theft, or loss of cannabis plants, seeds, parts of plants, extracts, or cannabis products has occurred from a medical cannabis facility, the board may require additional safeguards to ensure the security of the products.

A. Upon A medical cannabis facility shall immediately notify appropriate law-enforcement authorities and the board upon becoming aware of (i) diversion any of the following:

1. Diversion, theft, loss, or discrepancies identified during inventory;

(ii) unauthorized 2. Unauthorized destruction of any cannabis products; or

(iii) any 3. Any loss or unauthorized alteration of records related to cannabis products or qualifying patients, a pharmacist, responsible party, or medical cannabis facility shall immediately notify appropriate law-enforcement authorities and the board.

B. A pharmacist, responsible party, or medical cannabis facility shall provide the notice required by subsection A of this section to the board by way of a signed statement that details the circumstances of the event, including an accurate inventory of the quantity and registered cannabis product names of cannabis product diverted, stolen, lost, destroyed, or damaged and confirmation that the local law-enforcement authorities were notified. A pharmacist, responsible party, or medical cannabis facility shall make such notice no later than 24 hours after discovery of the event.

C. A pharmacist, responsible party, or medical cannabis facility shall notify the board no later than the next business day, followed by written notification no later than 10 business days, of any of the following:

1. An alarm activation or other event that requires a response by public safety personnel;

2. A breach of security; or

3. The failure of the security alarm system due to a loss of electrical support or mechanical malfunction that is expected to last longer than eight hours; and

4. Corrective measures taken, if any.

D. In addition to the notice required by subsection C of this section, the medical cannabis facility shall provide written notification to the board no later than 10 business days that details the circumstances of the event and identifies corrective measures taken, if any.

E. A pharmacist, responsible party, pharmaceutical processor, or cannabis dispensing facility shall immediately notify the board of an employee convicted of a felony.

F. A medical cannabis facility shall immediately notify the board upon becoming aware or having reasonable suspicion of a violation of any provision of 3VAC10-30-30 or 3VAC10-30-40.

A medical cannabis facility may engage in marketing activities related to products, the medical cannabis program, the pharmaceutical processor company, and related communications, except those marketing activities that:

1. Include false or misleading statements;

2. Promote excessive consumption;

3. Depict a person younger than 21 years of age consuming cannabis;

4. Include any image designed or likely to appeal to minors, specifically including cartoons, toys, animals, fruit, children, or any other likeness to images, character, or phrases that are popularly used to advertise to children;

5. Depict products or product packaging or labeling that bears reasonable resemblance to any product legally available for consumption as a candy or that promotes cannabis consumption; or

6. Contain any seal, flag, crest, coat of arms, or other insignia that is likely to mislead patients or the general public to believe that the cannabis product has been endorsed, made, or used by the Commonwealth of Virginia or any of its representatives except where specifically authorized.

A. A medical cannabis facility shall not advertise (i) through any means unless at least 85% of the audience is reasonably expected to be 18 years of age or older, as determined by reliable, up-to-date audience composition data or (ii) on television or the radio at any time outside of regular school hours for elementary and secondary schools.

B. Advertising shall not:

1. Display cannabis products or images of products where the advertisement is visible to members of the public from any street, sidewalk, park, or other public place; and or

2. Include coupons, giveaways of free cannabis products, or distribution of merchandise that displays anything other than the facility name and contact information.

C. No outdoor cannabis product advertising shall be placed within 1,000 500 feet of (i) a school or daycare;, (ii) a public or private playground or similar recreational or child-centered facility;, or (iii) a substance use disorder treatment facility.

D. Signs placed on the property of a medical cannabis facility shall not:

1. Display imagery of cannabis or the use of cannabis or utilize long luminous gas-discharge tubes that contain rarefied neon or other gases; or

2. Draw undue attention to the facility, but may be designed to assist patients, parents, legal guardians, and registered agents to find the medical cannabis facility; or

3. Be illuminated during nonbusiness hours.

E. A medical cannabis facility shall not advertise at any sporting event or use any billboard advertisements.

F. No cannabis product advertising shall be on or in a public transit vehicle, public transit shelter, bus stop, taxi stand, transportation waiting area, train station, airport, or any similar transit-related location.

G. No advertising shall be conducted through the marketing of free promotional items, including gifts and "free" or "donated" cannabis.

A. Advertising must accurately and legibly identify the medical cannabis facility responsible for its content and include a statement that cannabis products are for use by patients only.

B. Any advertisement for cannabis products that is related to the benefits, safety, or efficacy, including therapeutic or medical claims, shall:

1. Be supported by substantial, current clinical evidence or data; and

2. Include information on side effects or risks associated with the use of cannabis.

B. C. Any website or social media site owned, managed, or operated by a medical cannabis facility shall employ a neutral age-screening mechanism that verifies that the user is at least 18 years of age, including by using an age-gate, age-screen, or age verification mechanism.

C. D. All outdoor signage must comply with local or state requirements.

A. A medical cannabis facility shall:

1. Have storage areas that provide adequate lighting, ventilation, sanitation, space, equipment, and security conditions for the cultivation of cannabis and the production and dispensing of cannabis products;

2. Have storage areas with temperature and humidity maintained in the following ranges:

3. 2. Store cannabis plants, seeds, parts of plants, extracts, including cannabis products, that are outdated, damaged, deteriorated, misbranded, adulterated, or whose containers or packaging have been opened or breached, in a separate quarantined storage area until such cannabis plants, seeds, parts of plants, extracts, or cannabis products are destroyed;

4. 3. Be maintained in a clean, sanitary, and orderly condition; and

5. 4. Be free from infestation by insects, rodents, birds, or vermin of any kind.

B. A medical cannabis facility shall compartmentalize all areas in the facility based on function and shall restrict access between compartments.

C. The pharmaceutical processor or cannabis cultivation facility shall establish, maintain, and comply with written policies and procedures regarding best practices for the secure and proper cultivation of cannabis and production of cannabis products. These shall include policies and procedures that:

1. Restrict movement between compartments;

2. Provide for different colored identification cards for employees based on the compartment to which the employees are assigned at a given time so as to ensure that only employees necessary for a particular function have access to that compartment of the facility;

3. Require pocketless clothing for all employees working in an area containing cannabis plants, seeds, and extracts, including cannabis oil and cannabis products; and

4. 3. Document the chain of custody of all cannabis plants, parts of plants, seeds, extracts, and cannabis products.

D. A cannabis dispensing facility shall establish, maintain, and comply with written policies and procedures regarding best practices for the secure and proper dispensing of cannabis products, including a requirement for pocketless clothing for all facility employees working in an area containing cannabis products.

E. The PIC or responsible party of a medical cannabis facility shall establish, maintain, and comply with written policies and procedures for the cultivation, production, security, storage, and inventory of cannabis, including the seeds, parts of plants, extracts, and cannabis products, as applicable. Such policies and procedures shall include methods for identifying, recording, and reporting diversion, theft, or loss and for correcting all errors and inaccuracies in inventories. Medical cannabis facilities shall include in their written policies and procedures a process for:

1. Handling mandatory and voluntary recalls of cannabis products and bulk cannabis oil, botanical cannabis, and usable cannabis distributed or received via wholesale distribution. The process shall be adequate to deal with recalls due to any action initiated at the request of the board and any voluntary action by the pharmaceutical processor or cannabis dispensing facility to (i) remove defective or potentially defective cannabis products from the market or (ii) promote public health and safety by replacing existing cannabis products with improved products or packaging;

2. Preparing for, protecting against, and handling any crises that affect the security or operation of any facility in the event of labor strike, fire, flood, or other natural disaster, or other situations of local, state, or national emergency;

3. Ensuring that any outdated, damaged, deteriorated, misbranded, or adulterated cannabis, including seeds, parts of plants, extracts, and cannabis products, is segregated from all other cannabis, seeds, parts of plants, extracts, and cannabis products and destroyed. This procedure shall provide for written documentation of the cannabis, including seeds, parts of plants, extracts, and cannabis product disposition; and

4. Ensuring the oldest stock of cannabis, including seeds, parts of plants, extracts, and cannabis products are used first. The procedure may permit deviation from this requirement if such deviation is temporary and appropriate.

F. The pharmaceutical processor or cannabis cultivation facility shall store:

1. Store all cannabis, including seeds, parts of plants, extracts, and cannabis products, in the process of production, transfer, or analysis in such a manner as to prevent diversion, theft, or loss;

shall make 2. Make cannabis, including the seeds, parts of plants, extracts, and cannabis products, accessible only to the minimum number of specifically authorized employees essential for efficient operation; and

shall return 3. Return such items to their secure location immediately after completion of the production, transfer, or analysis process or at the end of the scheduled business day.

G. If a production process cannot be completed at the end of a working day, the pharmacist, responsible party, or other person authorized by the responsible party to supervise cultivation and production at the pharmaceutical processor or cannabis cultivation facility shall securely lock the processing area or tanks, vessels, bins, or bulk containers containing cannabis, including the seeds, parts of plants, extracts, and cannabis products, inside an area or building that affords adequate security.

G. H. The cannabis dispensing facility shall store all cannabis products in such a manner as to prevent diversion, theft, or loss; shall make cannabis products accessible only to the minimum number of specifically authorized employees essential for efficient operation; and shall return the cannabis products to their secure location at the completion of the dispensing or at end of the scheduled business day.

A. Prior to transporting medical cannabis to another medical cannabis facility or offering cannabis delivery to patients, a medical cannabis facility shall submit the following items to the authority:

1. A list of the employees authorized to transport or deliver cannabis, along with a copy of each authorized employee's valid driver license; and

2. For each transport or delivery vehicle:

a. License plate number, vehicle identification number, make, and model;

b. An attestation that the vehicle is properly registered and insured;

c. A description of the locked, safe, and secure storage compartments in the vehicle; and

d. A description of the security system, form of secure communication, global positioning system (GPS) monitoring device, and any other equipment or system required pursuant to 3VAC10-40-240.

B. A medical cannabis facility shall provide written notice to the authority, along with the documentation required in subsection A of this section, in the event the facility adds or removes a transport or delivery vehicle or an authorized employee.

C. No medical cannabis facility shall advertise, offer, or commence delivery or transport operations prior to receiving written approval from the authority.

A. All transport or delivery vehicles shall be properly registered with the Commonwealth and be insured in the Commonwealth. Medical cannabis facilities shall maintain registration and insurance documents and provide the documents to the authority and law-enforcement officials upon request.

B. A transport or delivery vehicle shall bear no marking or outward appearance, including brand or company names, that would indicate to a reasonable person that the vehicle is used to transport cannabis.

C. At all times during the transportation of cannabis, a transport or delivery vehicle shall be equipped with the following functioning features:

1. Heating and air conditioning systems sufficient for maintaining appropriate temperatures for the storage of cannabis during transport in accordance with recommendations provided by the originating medical cannabis facility to protect the quality and integrity of the cannabis;

2. A locked, safe, and secure storage compartment where cannabis will be stored during transport that is (i) a secured part of the vehicle, (ii) not easily removed, and (iii) not visible from the outside of the vehicle.

3. A global positioning system (GPS) monitoring device that is secured to the vehicle in a manner not easily removed and able to remain powered on when the transport vehicle is not running, the information from which shall be maintained in accordance with 3VAC10-40-260;

4. A secure form of communication between the transporting agent and the transporting facility, and any originating facility if required by 3VAC10-40-260 G, at all times during the transportation of cannabis. Secure forms of communication shall include a two-way digital or analog radio, cellular telephone, and satellite telephone, taking into consideration the functionality of the communication device within the geographic area of the transport; and

5. An adequate vehicle security system to prevent adulteration, diversion, theft, and loss of cannabis, including an audible alarm system.

D. Access to transport vehicle security equipment and records shall be limited to (i) persons that are essential to security operations, (ii) law-enforcement agencies, (iii) security system service employees, (iv) the authority, and (v) other persons approved by the authority. A transporting facility shall maintain a current list of all individuals that have access to any transport vehicle security equipment and records.

E. The authority may inspect a transport or delivery vehicle as well as its equipment, including security systems, forms of secure communication, and GPS monitoring devices at any time without prior notice. If the authority determines that the transport or delivery vehicle does not satisfy the requirements of this section, or that such transport or delivery vehicle requires additional security measures to address public health and safety concerns, the medical cannabis facility shall not use the transport vehicle until such time as it receives a satisfactory inspection from the authority.

A. Prior to transporting cannabis between medical cannabis facilities or from a medical cannabis facility to a testing laboratory:

1. The originating facility shall prepare a transport manifest on a form and in a manner prescribed by the authority, itemizing all cannabis to be transported. A separate copy of the transport manifest shall be provided to the transporting employee to accompany the itemized cannabis at all times during transport.

2. The originating facility shall securely transmit a copy of the transport manifest to the receiving facility at least 24 hours prior to transport.

3. An authorized transportation employee shall review the transport manifest prepared by the originating facility and confirm that it accurately describes the type and quantity of cannabis in the transport vehicle to be transported by the transporting employee, in the aggregate and for each delivery.

B. Prior to delivering cannabis to a qualifying patient, parent, legal guardian, or registered agent:

1. The pharmaceutical processor or cannabis dispensing facility shall prepare a delivery manifest on a form and in a manner prescribed by the authority, itemizing all cannabis to be delivered. A separate copy of the delivery manifest shall be provided to the delivery employee to accompany the itemized cannabis at all times during transport.

2. The delivery employee shall review the delivery manifest prepared by the medical cannabis facility and confirm that it includes sufficient identifying information for each patient, parent, legal guardian, or registered agent, including name and day and month of birth.

C. No transport vehicle shall carry any cannabis for which a manifest has not been provided, and all cannabis shall be packaged in sealed, labeled, and tamper-resistant packaging at all times.

A. A transporting employee shall remain with the transport vehicle at all times that the vehicle contains cannabis, provided that if there is only one transporting employee, the transporting employee may leave the vehicle, which shall be securely locked, only for:

1. Delivering or transferring cannabis to a qualifying patient, parent, legal guardian, registered agent, or medical cannabis facility;

2. Meals, when the transport lasts more than three hours round trip;

3. Rest periods required by law;

4. Refueling; or

5. Exigent circumstances, including collisions, traffic stops, mechanical breakdowns, weather emergencies, or medical emergencies.

B. A transporting employee shall carry transportation credentials at all times during the transportation of cannabis and display such credentials to the appropriate persons at the originating facility prior to each instance of transportation of cannabis, and to any law-enforcement official or authorized authority representative upon request. For purposes of this section, "transportation credentials" shall mean the transporting employee's valid driver's license, a copy of the medical cannabis facility's permit, and all transport or delivery manifests for cannabis contained in the transport vehicle.

C. A transporting facility shall inspect and test all security systems, secure communications, and global positioning system (GPS) monitoring devices of each transport vehicle at least once per day of use, prior to the transport vehicle's first departure. The individual conducting the inspection on behalf of the transporting facility shall create a signed record of the inspection that includes (i) the name of the individual, (ii) the vehicle identification number of the transport vehicle, (iii) the date of inspection, and (iv) the status of all inspected systems, equipment, and devices. The transporting facility shall maintain all inspection records.

D. No transport vehicle shall transport cannabis unless every security system, form of secure communication, and GPS monitoring device is in good working order and functioning properly.

E. If any security system, form of secure communication, or GPS monitoring device fails during the transportation of cannabis, the transporting employee shall immediately notify the transporting facility and all impacted originating facilities of the specific failure and return directly to the transporting facility or originating facility. Such transport vehicle shall not resume transportation of cannabis until all systems resume full functioning capacity.

F. The transporting facility shall create a confidential delivery schedule within 24 hours of the transport and only provide the transporting employee with a copy of such confidential delivery schedule immediately prior to departure.

G. A transporting employee shall communicate with the transporting facility upon arriving at and departing from each scheduled delivery location.

H. A transporting employee shall strictly adhere to the delivery schedule provided by the transporting facility and not make any unscheduled stops. In the case of an emergency unscheduled stop, the transport vehicle shall remain securely locked, and the transporting employee shall verbally communicate with the transporting facility, describing the reason for the emergency unscheduled stop, the location and the duration of the emergency unscheduled stop, any activities of the transporting employee, and the identities and activities of any persons interacting with the transport vehicle or the transporting employee. The transporting facility shall maintain a record of any communications related to an unscheduled stop.

I. For a period of not less than 90 days, a transporting facility shall maintain a record of the GPS information of each of its transport vehicles for the entire duration of any transportation of cannabis and make such information available to the authority upon request. A transporting facility may contract with the GPS provider or similar service provider to conduct GPS monitoring, provided that any such third-party GPS monitor shall comply with all applicable state and federal laws regarding patient confidentiality.

J. A transporting employee shall return any undeliverable cannabis to the respective originating facility directly after the last scheduled delivery.

K. No cannabis shall be stored in a transport vehicle after the facility's hours of operation, and in no event longer than 24 hours, unless the vehicle is contained within an enclosed, secure part of the facility.

L. A transporting facility shall report to the authority and local law enforcement any transport vehicle accidents, transport vehicle theft, cannabis diversion, loss, or adulteration, and any other event deemed by the authority to be a reportable event in connection with the transportation of cannabis within 24 hours of such event being discovered.

A. Medical cannabis facilities offering delivery shall require each qualifying patient, parent, legal guardian, or registered agent that purchases cannabis for delivery to provide the medical cannabis facility with the full legal name, date of birth, address, email address, and telephone number of the qualifying patient and, if applicable, the legal name, date of birth, and address of the parent, legal guardian, or registered agent.

B. For each delivery of cannabis to a qualifying patient, parent, legal guardian, or registered agent, a transporting employee shall confirm from a valid driver's license or other valid, government-issued photographic identification that the identity of the individual accepting the cannabis delivery is the same as the individual that ordered the cannabis and confirm the qualifying patient's registration number.

C. If the identity, age, or registration of the individual accepting the cannabis delivery remains in question after presentation of the required documentation, the transporting employee shall (i) immediately alert the originating facility and (ii) return the cannabis to the originating facility directly after the last scheduled delivery.

D. Medical cannabis may only be delivered to a residence in Virginia. "Residence" means a dwelling such as a house, apartment, nursing home, or retirement center. It does not include a dormitory, hotel, motel, bed and breakfast, or other commercial business.

E. Medical cannabis may only be delivered between the hours of 6 a.m. and midnight.

A. A pharmaceutical processor transporting or delivering medical cannabis must report any traffic stop, breakdown, collision, or unscheduled stop lasting more than two hours to the authority with 24 hours.

B. An originating facility's authorized employees shall make a good faith effort to contact the authority if exigent circumstances require removal of cannabis or cannabis products from the vehicle prior to arrival at the destination listed on the transport manifest. Authorized employees shall make a good faith effort to protect the shipment from diversion.