Tag Archives: data

Top Five Insurances Cannabis Businesses Need in 2022

By Eric Rahn
No Comments

Cannabis remains one of the fastest growing industries with no signs of slowing down. According to a recent article in Forbes Magazine, the legal cannabis market is poised to grow 20-30% per year to the tune of $50 billion by 2026.[1]With great opportunity comes numerous risks. Claims and lawsuits against cannabis businesses are increasing in frequency and magnitude. As an insurance broker who specializes in the cannabis industry and works with a wide variety of cannabis, hemp and CBD businesses in every state where cannabis laws are established, our recent analysis has unveiled the top five insurances your cannabis business needs in 2022.

  1. General Liability

General liability is the most essential coverage your business needs to protect you from a variety of claims including personal injury, bodily harm, property damage and other situations that may arise including slander, libel, copyright infringement and more.

Since general liability is not always required to obtain a cannabis license, many businesses are tempted to forgo the expense. This is one of the biggest mistakes you can make as one single lawsuit has the potential to cripple your business. With a comprehensive, cannabis-specific general liability insurance policy in place, your insurance company, not you, will pay medical expenses and property damage claims from third parties, in addition to hefty legal fees and fines.

  1. Property & Casualty Insurance
P&C insurance is an important part of your security and protection plan.

If you own a dispensary, grow operation, warehouse, testing facility or any other type of cannabis business with inventory, you need to protect your assets from potential loss or damage. Property & casualty (P&C) insurance safeguards your business against common and costly perils such as a fire, lightning, explosion/implosion, and even less common – but still possible – risks like riots, strikes and terrorism.

P&C insurance not only pays for damages to your business property resulting from a covered loss but it also covers the contents within your place of business, including office furniture, computers, inventory and other assets essential to your business operations. There are policies that will also provide the funds required to keep your business afloat until the damages from the loss are repaired. Any cannabis business with a physical property and location(s) should have a comprehensive property and casualty P&C policy in place.

  1. Product Liability/Product Recall

Recently, we’ve seen a dramatic influx of product liability claims, and in particular, product recalls. Lawsuits have ranged from a single plaintiff seeking damages for personal injuries to class action lawsuits where a defective product is tied to an entire group of claimants.

control the room environment
Preventing contamination can save a business from extremely costly recalls. Having the right insurance can prevent a recall from becoming costly in the first place.

As a cannabis business owner, you can be sued for any damage resulting from products that cause harm to others, this includes false advertising, mislabeled or defective products. No matter where you are in the supply chain, your business could be held liable. The process of defending litigation or reaching a settlement agreement can completely drain a company’s resources. You’ll have to deal with regulatory compliance, producing and distributing product warnings, recalling products, claim investigation, product testing and additional risk assessment.

Product liability insurance is often overlooked, especially by small to mid-size businesses. However, your cannabis business needs this type of coverage if you sell any goods or products that end up in the hands of the public. In fact, your business may be contractually obligated to have product liability insurance. One such lawsuit is enough to fold a business due to costly legal fees and fines, as well reputation damage beyond repair.

Product liability insurance is designed to protect your cannabis company from claims that can happen anywhere along the supply chain, including product contamination, mislabeled products, false advertising or defective products. With proper coverage, your insurance company will pay for damages and legal expenses if you are sued, up to your policy limits. Your product liability policy will also cover any medical expenses for those who are harmed by your business. Making sure your insurance policy includes product liability insurance should be a top priority in 2022.

  1. Cyber Defense/Data Breach Insurance

Cyber fraud and data breaches are two of the greatest risks facing cannabis companies in 2022. With so much cash pouring into the space, cannabis businesses of all sizes are bulls-eye targets for cybercriminals. Even the smallest of cannabis businesses are at risk of data breaches because they are part of a larger interconnected network of seed to sale vendors. These types of crimes can have detrimental effects on your business in numerous ways. In the case of a data breach resulting in the disclosure of a third party’s private information, the third party could sue your business. The SEC could also find your company negligent in cyber fraud cases and impose significant fines.

By forgoing cyber defense & data breach insurance, your business will be solely responsible for expensive legal bills, significant revenue losses and hefty fines and penalties from regulators. Cyber defense & data breach insurance is a must-have coverage in 2022, and beyond, to protect your business from cybercrimes.

  1. Directors & Officers Insurance

If you are looking to secure venture capital or funding from investors in 2022, and/or attract and retain qualified leadership, you need directors & officers (D&O) Insurance. D&O protects corporate directors and officers, as well as their spouses and estates, from being personally liable in the event your company is sued by investors, employees, vendors, competitors, customers, or other parties, for actual or alleged wrongful acts in managing the company. In the event of litigation, your D&O insurance will cover legal fees, fines, settlements and other expensive costs.

D&O is often the most overlooked coverage because many cannabis businesses are independently run, and no one foresees the potential for operational failures and mismanagement. However, businesses with any sort of vision for growth should make D&O a top priority. It not only protects your current executives and board members but is critical in attracting leading talent in the space, as well as drawing in new investors to scale up your business. In fact, we’re seeing more prospective investors and board members requiring D&O insurance prior to engaging with a company to ensure they are fully protected in the event of litigation.

When it comes to mitigating risk in this business, the stakes are sky high. Cannabis companies that have not incorporated risk management into their business/operational plans will need to in 2022. It all boils down to the THREE P’s: being “Proactive, Prepared and Protected.”

Soapbox

User-Generated Data Brings Revenue: It’s Time for the Users to Get Some

By Dr. Markus Roggen, Amanda Assen, Dr. Tom Dupree
No Comments

You generate the product, you should benefit from it too.

If you are not paying for the service, you are the product. This pithy phrase is often heard in discussions about social media’s use of personal information and user-generated content. The idea can be traced back to a 1973 short film that critiques television’s impact on culture and politics. Although about television, the quote, “you are the end product delivered en masse to the advertiser,” still rings true when talking about major online corporations.

We have all seen it with big corporations. In the first three months of 2021, of Facebook’s $26.2B revenue, a whopping $25.4B was from advertising sales. However, the space for an advertisement to be delivered en masse to the public is not the only thing purchased from Facebook. Access to personal information such as your search history, likes and posts are also purchased by companies to determine which advertisements they should target you with.Access to user-generated data by advertisers has sparked privacy and ownership concerns regarding large internet platforms. The idea of being surveilled all the time is uncomfortable, and many large corporations like Facebook have royalty-free and transferable licenses to your posts.

Similarly, many websites in the cannabis industry gain value from information submitted by consumers. As an example, the website Leafly provides over 1.3 million consumer product reviews that are often used for purchasing decisions. These reviews play a role in attracting more people to websites that operate with a similar system to Leafly, and in turn advertising space to reach those people is sold. According to their About page, more than 4.5 million orders for advertising space are placed with businesses on Leafly each year, generating annually about $460 million in gross merchandise value. So, the users work for free to attract an audience to these websites for the advertisers, and the websites make money from advertisers.

Can we empower users with ownership of their content, data and participation in profits?

Frustrated social media users exclaiming “We are the product!” does nothing to change our reality. It is unlikely we will change how big corporations like Facebook work, but can we ensure users receive some of the benefits in our own cannabis industry? Many of these websites, especially those for medicinal cannabis, are designed to genuinely help users. Can we further increase this feeling of having a transaction with the websites rather than feel like we are being sold to advertisers? The world of NFTs may offer some guidance.

An NFT (or non-fungible token) acts as a digital certificate of authenticity. Unlike cryptocurrencies (like Bitcoin), each NFT is unique, so it cannot be exchanged or multiplied. They are kept on a blockchain system, which is a growing list of computationally secure ledgers. The blockchain allows proof of ownership to be established for the person with the NFT, and prevents others from being able to tamper with or claim ownership of the artwork, game, tweet or cat picture it is assigned to. Although non-exchangeable, NFTs can be traded on a digital marketplace, like how a physical piece of art can be auctioned.

While NFTs and cryptocurrencies are certainly not without controversy and flaws, an NFT-like system that provides users with proof of ownership for their data and grants them control over what is done with it may be the way of the future for websites in the cannabis industry. Just like Facebook, when it comes to sales, online display advertisements are some of the top revenue generators for websites in the cannabis industry that utilize user-generated content. With an NFT-like system, users could be granted a royalty for their content, which would obligate websites to give a portion of their profits to the users when their content is sold to an advertiser. Users may be able to have a portfolio of their generated content, have some control over who can access their content and who their personal data can be sold to.

Websites that are more focused on cannabis for medicinal use often pride themselves on being more patient-focused and professional – no pothead puns or crass logos. An NFT-like system might be especially beneficial for these companies, as it would further increase the emphasis of trust and respect for users. In this case, an NFT-like system could be used to assign ownership of reviews to individual website users. Since these reviews attract new people to these websites, when access to a user’s data is sold to advertisement companies, then a portion of that revenue is given to the people who created the reviews. The estimated amount of revenue that reviewers help to bring into the company can be calculated and distributed accordingly. While this may seem like it would cause a significant loss of revenue for the websites, the increased trust that would come with this system would likely promote more users, generating an overall increase in revenue and credibility. Users could become more engaged and spend more time writing reviews, increasing web traffic considerably. Advertisers would be more attracted to the larger audience and the prestige of having their advertisement on a well-respected site.

An NFT-like system could hold large internet corporations accountable.

The new normal is corporations on the internet making money from the content created by users. In return, users receive none of the monetary benefits and have their personal information shared with hundreds of businesses. An NFT-like system, although theoretical, may be able to empower users to hold large corporations accountable for what is done with user-generated data. It is unlikely we can change big companies like Facebook, but if adopted early, this may be plausible in our cannabis industry. This in turn may not only give more ownership to the website users, but could also benefit the websites, and the advertisers. Overall, the product should be the website and the services it provides. An NFT-like system might help promote this and could make users who generate value for the website partners in business.

Keep ‘em Safe: Cash, Records, Products, People – Technology Helps Cannabis Businesses Succeed

By Dede Perkins
No Comments

It wasnt that long ago that cannabis was underground, sometimes literally, and operators protected what was theirs any way they knew how. Before legalization, cannabis operators needed to secure their plants, cash, supplies and equipment not just from people who wanted to steal them, but also from law enforcement. The legacy cannabis market is now transitioning into a legal one, and licensed operators are joining the industry at an incredible rate, but security is still part of the success equation. Like before, operators need to protect plants, products, equipment and cash, but they now also need to protect records, privacy and data, and do so in a manner that complies with state regulations.

Cannabis regulatory authorities set security guidelines that cannabis business owners must follow in order to obtain and renew operational licenses. For instance, there are state-specific security regulations regarding video surveillance, camera placement, safes, ID verification, and more. While security measures help protect the business, they also protect the public. Its a win-win for everyone involved. Here are five best practices and techniques to protect cash, records, products and people.

Hybrid cloud storage

State regulations call for reliable video surveillance footage that is accessible, in most cases, 24/7 and upon demand by cannabis regulatory authorities and local law enforcement acting within the limits of their jurisdiction. SecurityInfoWatch.com reports that video data is the industrys next big investment, meaning there will be an increased demand and need to store video surveillance footage. Most states require video surveillance footage to be retained for a specific amount of time, often 45-90 days or longer if there is an ongoing investigation or case that requires the footage. While some businesses only retain video data for the state-required length of time, others choose to keep it longer.

Storing data on-site can become expensive and precarious. Best practices call for a hybrid cloud storage solution model as it provides on-site and both public and private cloud data storage solutions. This model provides users with the ability to choose which files are stored on-site and which files live in the cloud. Doing so improves file accessibility without impacting or compromising on-premises storage. In addition, its helpful to have two methods of digitizing data, for safetys sake. In the event an on-site storage method crashes—though hopefully this wont ever happen—theres a version available off-site via the cloud. That said, with cloud-based storage solutions come cybersecurity threats that must be managed.

Cybersecurity

Dispensaries are prime targets for burglary. Defending a storefront requires a comprehensive security plan

Due to the ongoing COVID-19 pandemic, more businesses are online than ever before. Unsurprisingly, cyberthreats are on an upward trend, including in the cannabis industry. Earlier this year, MJBizDaily reported that a data breach exposed personal information of current and former employees of Aurora Cannabis. The incident involved unauthorized parties [accessing] data in (Microsoft cloud software) SharePoint and OneDrive”. Although this breach involved only employees, confidential customer information is also at risk of being compromised during a data breach. 

On a separate occasion, an unsecured Amazon S3 data storage bucket caused a large-scale database breach that impacted almost 30,000 people across the industry, according to the National Cannabis Industry Association. The breach included scanned versions of government-issued ID cards, purchase dates, customer history and purchase quantities. Unlike the Aurora Cannabis breach, this one included customer data. 

Just like other more established industries, the cannabis industry needs to protect and secure confidential data. If you dont have a cybersecurity expert on your team, consider hiring a consultant to evaluate your risk or partnering with a credible cybersecurity technology company to implement proactive solutions. Before signing a contract, do your due diligence. Does the consultant and/or technology company understand the compliance regulations specific to the cannabis industry? Do their solutions meet the regulations in the state(s) where your facility operates? Taking the time to protect your companys data before a breach occurs is proactive, smart business.

Smart Safes 

A smart safe like this one can helps secure cash handling

Smart safes help secure cash handling, which given the difficult banking environment for cannabis companies, means theyre on the list of best practice security technology products. What is a smart safe? A smart safe is a device that securely accepts, validates, records and stores cash and connects to the other cash management technology solutions such as point of sale systems. They connect to the internet and provide off-site stakeholders visibility into a facilitys cash position.

A high-speed smart safe counts cash by hand faster than a human and is an overall more secure way to deliver cash bank deposits. At the end of the night, making a deposit at a physical bank location can be dangerous, exposing your cash and the individuals responsible for making the deposit to unsecured threats. Using a smart safe reduces that threat and also helps cannabis operators comply with financial recordkeeping and documentation requirements. Due to federal cannabis prohibition, many cannabis businesses lack enough insurance to fully cover their exposure to cash theft, which has led to a trending industry-wide investment in smart safes.

Advanced access control

Best practice access control means more than a ring of keys hanging off the facility managers belt. Advanced access control gives cannabis business owners and managers the ability to manage employee access remotely via the cloud. This feature can limit access areas within a facility, enabling an individual to revoke access instantly from a remote location making it a useful tool in the event of a facility lockdown or emergency. A mobile app and/or website can be used to lock or unlock secure doors, monitor access in real time and export access logs.

Advanced access control devices arent a standard in the industry yet. Although many state regulators dont require cannabis businesses to utilize advanced electronic access control, using this technology is a best practice and may be required in the future.

Compliance software 

Understanding the ramifications and keeping up with state-mandated compliance is challenging. While state regulations can be found online, theyre often in pieces, leaving operators unsure about whether or not they have them all. Once an operator is confident that they have the most current version of all the laws, rules, and regulations that apply to their cannabis business, making way through the dense legal jargon can be exhausting. Even after multiple readings, it can be unclear about how to apply these guidelines to the operators cannabis business, which is one reason cannabis businesses work with a trusted legal counsel to meet compliance requirements. For trusted advisors and cannabis business licensees and operators alike, cannabis compliance software solutions are designed to not just check boxes for a cannabis business, but to help everyone involved understand how the regulations apply to the operation. These solutions improve accessibility so that employees at all organizational levels understand the rules and requirements of their position and the products they work with.

In addition, compliance software can help licensees and operators establish and implement best practice SOPs to meet regulatory requirements. Because the cannabis industry is young and many operators are moving fast, many cannabis businesses are vulnerable to security breaches and threats. Prioritizing security and compliance can help cannabis leaders protect against potential threats. Investing in the latest and most innovative security technology solutions—beyond what is required by state regulations—can help operators outsmart those who seek to steal from them and position their companies as industry leaders that prioritize safety and compliance, protecting not just cash and products, but the people who work in their facilities and the customers who purchase their products.

ASTM Introduces Retail Cybersecurity Standard

By Cannabis Industry Journal Staff
No Comments

ASTM International, the international standards development organization, has proposed a cannabis standard for establishing retail cybersecurity protocols. Their D37 cannabis committee is currently working on the development of the standard.

The standard is designed to establish best practices for protecting critical databases in dispensaries, like inventory data, customer and patient information. The guide, developed by subcommittee D37.05, addresses “the company or government organizational need to mitigate the likelihood of cyberattacks and reduce the extent of potential cyberattacks, which can leave sensitive personal data, corporate information, and critical infrastructure vulnerable to attackers,” reads the scope of the project.

Technical Lead for the subcommittee and president of ezGreen Compliance, Michael Coner, says they hope to provide SOPs for retail operations to protect business data while staying compliant. “Cybersecurity is among the most prevailing issues concerning the cannabis industry as well as the global cannabis economy,” says Coner. “Establishing strong cybersecurity protocols for dispensary retail owners will help ensure the protection of data to maintain the integrity of cannabis consumers’ personal information.”

The ASTM committee is currently inviting stakeholders such as retailers and regulators to help with things like “identifying new data security issues that arise while operating active retail dispensary businesses.”

The Importance of Smart Cannabis Packaging

By John Shearman
No Comments

Regardless of their size, all consumer package brands spend a significant amount of money and resources on packaging to attract consumers’ attention. We are all very visually oriented and gravitate to items that pique our interests. Cannabis brands are no exception when it comes to branding their products. Packaging plays a big part in carrying their brand forward and standing out on the dispensary shelves. When I was in Las Vegas at a CBD tradeshow in early 2020, I visited a dispensary, and it was beautiful. I remember commenting to a colleague that was with me how spectacular the product packaging was in the glass cases. One had unique artwork on each different product they offered, and it was indeed art. Yes, I did purchase this one that pulled me in.

The cannabis industry in the United States presents a challenge to brands because there is no overall federal guidance for packaging. Each state is controlling the cannabis legislation and, with it, the packaging guidelines. So multi-state operators (MSOs) have to manage each state as a separate entity and abide by the packaging regulations, which is not very efficient and adds a cost burden. As the industry matures and becomes federally legal across the country, packaging regulations will be easier to implement.

Louis Vuitton bags are one of the many goods that are commonly counterfeited
Image: UK Home Office, Flickr

Let’s take a look at counterfeit products across all product categories. There is a significant global problem with counterfeits, as articulated by the below statistics.

The total global trade in fakes is estimated at around $4.5 trillion. 

Fake luxury merchandise accounts for 60% to 70% of that amount, ahead of pharmaceuticals, entertainment products and representing perhaps a quarter of the estimated $1.2 trillion total trade in luxury goods.

Digital plays a big role in this and perhaps 40% of the sales in luxury fakes take place online.

Customs and Border Patrol confiscated $1.3 billion worth of counterfeit goods in the U.S. for Fiscal Year 2020. (The value of 2020’s seizures are actually down compared to the $1.5 billion worth of counterfeit goods seized by CBP in 2019).

Unfortunately, the figures above are concerning, and the cannabis industry will face the same counterfeit issues that will add to these stats in the future. What can be done to help fight the problem and alleviate the pain for cannabis brands? Smart technology.

The trend towards “smart technology” varies by sector, but the underlying concept involves building levels of technology systems designed to impede or limit the highly sophisticated counterfeiter from replicating or replacing products. These levels typically include a forensic level control on the product, digital systems to track the material and customer facing systems to articulate the underlying value to the consumer.

Building these levels of smart technology into cannabis-products and packaging allows consumers to authenticate real versus fake, and in the case often in cannabis, legal versus illegal. Molecular technology is one forensic level of control option that can be used as a unique identifier for product authentication. Each brand would get its unique identifier to apply to the raw materials that make up its product, such as oil or an isolate. Then a sample can be tested at the origin point and subsequent nodes in the supply chain using a remote testing device. All the digital data is captured in a secure cloud database for traceability and transparency to the end consumer, to show them the authenticity of the product they are consuming. The same molecular technology can be applied to the ink or varnish for packaging and labels. A great application to help combat counterfeits and product diversion across the globe.

Counterfeiters can create near duplicate versions of the original

Another engaging platform is called StrainSecure by TruTrace Technologies. Their SAAS platform allows cannabis manufacturers to track all their product batches and SKUs tied to a blockchain. It also facilitates the interaction between the manufacturer and third-party testing facilities to conduct product testing and reporting. The data is captured within the platform, and with easy access dashboard views, it provides the insights to authenticate products at any time.

A company out of Australia called Laava is producing a product called Smart Fingerprints. It’s the next evolution of QR codes. The Smart Fingerprints can be applied to each package, providing a unique identifier that consumers can read with a mobile phone application. The consumer is provided with information concerning the product’s authenticity and any additional information the brand wants to share with the user. Smart Fingerprints are a great example of customer engagement at the point of activity that is secure.

The above three solutions show the availability of advanced technologies the cannabis industry can implement on its packaging and products to ensure authentic and safe products are sold to consumers. It provides consumers with vital information and insights about products so they can make informed buying decisions. There is no one silver bullet solution that provides all the answers. As with every high value product, counterfeiters will work to create near duplicate versions of the original until it becomes unsustainable to do so. It will take a technology ecosystem to seamlessly connect and provide actuate and timely information between supply chain partners and ultimately the end consumer. As the US works to separate the legal from illegal production for both the adult use and medical supply of cannabis, the looming challenge will be on protecting and communicating authenticity, packaging will be the first step in this.

Lab Shopping: Highlighting the Need for Checks and Balances in Cannabis

By Josh Swider
No Comments

Cannabis, we have a problem. Legalizing adult use cannabis in California caused the demand for high-potency cannabis to increase dramatically over the last several years. Today, many dispensary buyers enforce THC minimums for the products that they sell. If smokeable flower products don’t have COAs proving the THC levels are above 20% or more, there is a good chance many dispensaries won’t carry them on their shelves. Unfortunately, these kinds of demands only put undue pressure on the industry and mislead the consumer.

Lab Shopping: Where the Problems Lie

Lab shopping for potency analysis isn’t new, but it has become more prevalent with the increasing demand for high-potency flower over the last couple of years. Sadly, many producers submit valid, certified COAs to the California Bureau of Cannabis Control (BCC), which show two to three times the actual potency value.

At InfiniteCAL, we’ve purchased products from dispensary shelves and found significant discrepancies between the analysis we perform and the report submitted to the BCC by the producer. So, how can this happen? Several factors are creating the perfect storm in cannabis testing.

Problems with Potency

Many consumers still don’t understand that THC potency is not the only factor in determining quality cannabis, and they are unwittingly contributing to the demand for testing and analysis fraud. It is alarming for cultivation pioneers and ethical labs to see producers and profit-hungry testing facilities falsifying data to make it more appealing to the unaware consumer.

Basically, what’s happening is growers are contacting labs and asking, “I get 30% THC at this lab; what can you do?” When they see our COA reporting their flower tested lower than anticipated, they will go to another lab to get higher test results. Unfortunately, there are all too many labs that are willing to comply.

I recently saw a compliant COA that claimed that this particular flower was testing at 54% THC. Understanding cannabis genetics, we know this isn’t possible. Another product I reviewed claimed that after diluting an 88% THC distillate with 10-15% terpenes, the final potency test was 92% THC. You cannot cut a product and expect the potency to increase. Finally, a third product we reviewed claimed 98% total cannabinoids (while only looking at seven cannabinoids) with 10% terpenes for a total of 108% of the product.

These labs only make themselves look foolish to professionals, mislead laymen consumers and skirt under the radar of the BCC with basic mathematical errors.

The Pesticide Predicament

Frighteningly, inflating potency numbers isn’t the most nefarious testing fraud happening in the cannabis industry. If a manufacturer has 1000 liters of cannabis oil fail pesticide testing, they could lose millions of dollars – or have it retested by a less scrupulous lab.

Photo: Michelle Tribe, Flickr

As the industry continues to expand and new labs pop up left and right, cultivators and manufacturers have learned which labs are “easy graders” and which ones aren’t. Certain labs can miss up to ten times the action level of a pesticide and still report it as non-detectable. So, if the producer fails for a pesticide at one lab, they know four others won’t see it.

In fact, I’ve had labs send my clients promotional materials guaranteeing compliant lab results without ever receiving a sample for testing. So now, these companies aren’t just tricking the consumer; they are potentially harming them.

An Easy Fix

Cannabis testing is missing just one critical factor that could quickly fix these problems – checks and balances. The BCC only needs to do one of two things:

Verifying Lab Accuracy

InfiniteCAL also operates in Michigan, where the Marijuana Regulatory Agency (MRA) has already implemented a system to ensure labs are maintaining the highest testing standards. The MRA will automatically flag all COAs which test above a certain percentage and require the product to be retested by multiple labs.

labsphotoLabs are required to keep a back stock of material. So, when test results come back abnormally high from Lab A, then Labs B, C and D are commissioned to retest the material to compare data. If Lab A reports 40% THC, but the other labs all report 18%, then it’s easy to see Lab A has made an error.

Secret Shopping

By simply buying products off the shelves and having them blind-tested by other labs, it would be simple for the BCC to determine if the existing COA is correct. They already have all the data in Metrc, so this would be a quick and easy fix that could potentially solve the problem overnight.

For example, at InfiniteCAL, we once purchased 30 samples of Blue Dream flower from different cultivators ranging in certified COA potencies from 16% to 38%. Genetically, we know the Blue Dream cultivar doesn’t produce high levels of THC. When we tested the samples we purchased, nearly every sample came back in the mid-teens to low 20% range.

Labs Aren’t Supposed to Be Profit Centers

At InfiniteCAL, we’ve contacted labs in California where we’ve uncovered discrepancies to help find and flush out the errors in testing. All too often, we hear the excuses:

  • “If I fix my problem, I’ll lose my clients.”
  • “I’m just a businessman who owns a lab; I don’t know chemistry.”
  • “My chemist messed up; it’s their fault!”

If you own a lab, you are responsible for quality control. We are not here to get rich; we are here to act as public safety agents who ensure these products are safe for the consumer and provide detailed information about what they choose to put in their bodies. Be professional, and remember you’re testing for the consumer, not the producer.

ISO/IEC 17025 Accreditation Falls Short for Cannabis Testing Laboratories

By Kathleen May
2 Comments

What is the role of the Quality Control (QC) Laboratory?

The Quality Control (QC) laboratory serves as one of the most critical functions in consumer product manufacturing. The QC laboratory has the final say on product release based on adherence to established product specifications. Specifications establish a set of criteria to which a product should conform to be considered acceptable for its intended use. Specifications are proposed, justified and approved as part of an overall strategy to ensure the quality, safety, and consistency of consumer products. Subsequently, the quality of consumer products is determined by design, development, Good Manufacturing Practice (GMP) controls, product and process validations, and the specifications applied throughout product development and manufacturing. These specifications are specifically the validated test methods and procedures and the established acceptance criteria for product release and throughout shelf life/stability studies.

The Code of Federal Regulations, 21 CFR Part 211, Good Manufacturing Practice for Finished Pharmaceuticals, provides the minimum requirements for the manufacture of safe products that are consumed by humans or animals. More specifically, 21 CFR Part 211: Subpart I-Laboratory Controls, outlines the requirements and expectations for the quality control laboratory and drug product testing. Additionally, 21 CFR Part 117, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventative Controls for Human Food: Subpart B-Processes and Controls states that appropriate QC operations must be implemented to ensure food products are safe for consumption and food packing materials and components are safe and fit for purpose. Both food and drug products must be tested against established specifications to verify quality and safety, and laboratory operations must have the appropriate processes and procedures to support and defend testing results.

ISO/IEC 17025, General Requirements for the Competence of Testing and Calibration Laboratories is used to develop and implement laboratory management systems. Originally known as ISO/IEC Guide 25, first released in 1978, ISO/IEC 17025 was created with the belief that “third party certification systems [for laboratories] should, to the extent possible, be based on internationally agreed standards and procedures”7. National accreditation bodies are responsible for accrediting laboratories to ISO/IEC 17025. Accreditation bodies are responsible for assessing the quality system and technical aspects of a laboratory’s Quality Management System (QMS) to determine compliance to the requirements of ISO/IEC 17025. ISO/IEC 17025 accreditation is pursued by many laboratories as a way to set them apart from competitors. In some cannabis markets accreditation to the standard is mandatory.

The approach to ISO/IEC 17025 accreditation is typically summarizing the standard requirements through the use of a checklist. Documentation is requested and reviewed to determine if what is provided satisfies the item listed on the checklist, which correlate directly to the requirements of the standard. ISO/IEC 17025 covers the requirements for both testing and calibration laboratories. Due to the wide range of testing laboratories, the standard cannot and should not be overly specific on how a laboratory would meet defined requirements. The objective of any laboratory seeking accreditation is to demonstrate they have an established QMS. Equally as critical, for product testing laboratories in particular, is the objective to establish GxP, “good practices”, to ensure test methods and laboratory operations verify product safety and quality. ISO/IEC 17025 provides the baseline, but compliance to Good Laboratory Practice (GLP), Good Manufacturing Practice (GMP) and even Good Safety Practices (GSP) are essential for cannabis testing laboratories to be successful and demonstrate testing data is reliable and accurate.

Where ISO/IEC 17025 accreditation falls short

Adherence to ISO/IEC 17025, and subsequently receiving accreditation, is an excellent way to ensure laboratories have put forth the effort to establish a QMS. However, for product testing laboratories specifically there are a number of “gaps” within the standard and the accreditation process. Below are my “Top Five” that I believe have the greatest impact on a cannabis testing laboratory’s ability to maintain compliance and consistency, verify data integrity and robust testing methods, and ensure the safety of laboratory personnel.

Standard Operating Procedures (SOPs)

The understanding of what qualifies as a Standard Operating Procedure (SOP) is often misunderstood by cannabis operators. An SOP is a stand-alone set of step-by-step instructions which allow workers to consistently carry out routine operations, and documented training on SOPs confirms an employee’s comprehension of their job tasks. Although not required per the current version of the standard, many laboratories develop a Quality Manual (QM). A QM defines an organization’s Quality Policy, Quality Objectives, QMS, and the procedures which support the QMS. It is not an uncommon practice for cannabis laboratories to use the QM as the repository for their “procedures”. The intent of a QM is to be a high-level operations policy document. The QM is NOT a step-by-step procedure, or at least it shouldn’t be.

Test Method Transfer (TMT)

Some cannabis laboratories develop their own test methods, but a common practice in many cannabis laboratories is to purchase equipment from vendors that provide “validated” test methods. Laboratories purchase equipment, install equipment with pre-loaded methods and jump in to testing products. There is no formal verification (what is known as a Test Method Transfer (TMT)) by the laboratory to demonstrate the method validated by the vendor on the vendor’s equipment, with the vendor’s technicians, using the vendor’s standards and reagents, performs the same and generates “valid” results when the method is run on their own equipment, with their own technician(s), and using their own standards and reagents. When discrepancies or variances in results are identified (most likely the result of an inadequate TMT), changes to test methods may be made with no justification or data to support the change, and the subsequent method becomes the “validated” method used for final release testing. The standard requires the laboratory to utilize “validated” methods. Most laboratories can easily provide documentation to meet that requirement. However, there is no verification that the process of either validating in house methods or transferring methods from a vendor were developed using any standard guidance on test method validation to confirm the methods are accurate, precise, robust and repeatable. Subsequently, there is no requirement to define, document, and justify changes to test methods. These requirements are mentioned in ISO/IEC 17025, Step 7.2.2, Validation of Methods, but they are written as “Notes” and not as actual necessities for accreditation acceptance.

Change Control

The standard speaks to identifying “changes” in documents and authorizing changes made to software but the standard, and subsequently the accreditation criteria, is loose on the requirement of a Change Control process and procedure as part of the QMS. The laboratory is not offered any clear instruction of how to manage change control, including specific requirements for making changes to procedures and/or test methods, documented justification of those changes, and the identification of individuals authorized to approve those changes.

Out of Specification (OOS) results

The documentation and management of Out of Specification (OOS) testing results is perhaps one of the most critical liabilities witnessed for cannabis testing laboratories. The standard requires a procedure for “Nonconforming Work”. There is no mention of requiring a root cause investigation, no requirement to document actions, and most importantly there is no requirement to document a retesting plan, including justification for retesting. “Testing into compliance”, as this practice is commonly referred to, was ruled unacceptable by the FDA in the highly publicized 1993 court case United States vs. Barr Laboratories.

Laboratory Safety

FDAlogoSafe laboratory practices are not addressed at all in ISO/IEC 17025. A “Culture of Safety” (as defined by the Occupational Safety and Health Administration (OSHA)) is lacking in most cannabis laboratories. Policies and procedures should be established to define required Personal Protective Equipment (PPE), the safe handling of hazardous materials and spills, and a posted evacuation plan in the event of an emergency. Gas chromatography (GC) is a common test method utilized in an analytical testing laboratory. GC instrumentation requires the use of compressed gas which is commonly supplied in gas cylinders. Proper handling, operation and storage of gas cylinders must be defined. A Preventative Maintenance (PM) schedule should be established for eye wash stations, safety showers and fire extinguishers. Finally, Safety Data Sheets (SDSs) should be printed and maintained as reference for laboratory personnel.

ISO/IEC 17025 accreditation provides an added level of trust, respect and confidence in the eyes of regulators and consumers. However, the current process of accreditation misses the mark on the establishment of GxP, “good practices” into laboratory operations. Based on my experience, there has been some leniency given to cannabis testing laboratories seeking accreditation as they are “new” to standards implementation. In my opinion, this is doing cannabis testing laboratories a disservice and setting them up for failure on future accreditations and potential regulatory inspections. It is essential to provide cannabis testing laboratory owners and operators the proper guidance from the beginning and hold them up to the same rigor and scrutiny as other consumer product testing laboratories. Setting the precedence up front drives uniformity, compliance and standardization into an industry that desperately needs it.


References:

  1. 21 Code of Federal Regulations (CFR) Part 211- Good Manufacturing Practice for Finished Pharmaceuticals.
  2. 21 Code of Federal Regulations (CFR) Part 117;Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventative Controls for Human Food: Subpart B-Processes and Controls.
  3. ICH Q7 Good Manufacturing Practice Guidance for Active Pharmaceutical Ingredients; Laboratory Controls.
  4. World Health Organization (WHO).
  5. International Building Code (IBC).
  6. International Fire Code (IFC).
  7. National Fire Protection Association (NFPA).
  8. Occupational Safety and Health Administration; Laboratories.
  9. ASTM D8244-21; Standard Guide for Analytical Operations Supporting the Cannabis/Hemp Industry.
  10. org; ISO/IEC 17025.

How ERP Tech Helps Companies Manage Traceability & Process Control

By Scott Deakins
No Comments

Commercial real estate took a dive last year as companies began to work from home, but changing regulatory environments have opened doors to a new industry in need of property: cannabis. Growing rapidly at both the medical and adult use levels, cannabis businesses have been eager to move into vacant buildings, quickly buying up space as more states adjust their laws regarding cannabis.

Cannabis businesses cannot go at it blindly, however. Legal cannabis firms of all sizes – from the smallest startup to the biggest enterprise – will face regulatory challenges, traceability requirements, process control standards and, ultimately, the right technology to keep them moving forward in this promising industry.

Use data to keep track of plants, patients and regulations 

As a highly regulated industry, cannabis companies could be investigated at any time. Regulatory authorities may, at the very least, request proof that they are compliant with state restrictions. Cannabis enterprises will only be able to quickly and easily provide that proof if they have immediate access to accurate historical data. With that information, they can generate the necessary reports at a moment’s notice and maintain a reliable audit trail.

Cultivation is where the tracking process begins.

Historical data is also useful for both growers looking to evaluate why certain plants are more successful than others and for sellers looking to improve their customer experience. By tracking everything from mother plants to clones, growers can build a strong genetics profile and gain a powerful competitive edge. Historical data also aids sellers, who can use it to enhance their digital storefronts and keep track of customer information, shopping history and other details that could improve the e-commerce experience.

In addition to customer details, sellers must also keep track of patient information when selling in a medical-only environment. Prescriptions need to be carefully managed to ensure that patients only receive products that they have been approved to purchase and use.

Utilize process control to foster scalable and repeatable processes

Process control is another vital component that every cannabis grower, manufacturer, processor and distributor must possess. They need scalable and repeatable processes to prevent steps from being bypassed, ensuring that every finished product matches the same high-quality standards. If there are no stopgaps in place, steps could be missed if employees are rushing to meet a deadline or simply think that a particular test or check isn’t needed. Those kinds of mistakes can be hugely detrimental to any cannabis company and may waste product, diminish profits and turn off customers.

PlantTag
A plant tagged with a barcode and date for tracking

Similarly, visibility and control over inventory is a top priority for any business, but it reigns supreme in the cannabis space. Managers should always, at all times, know where the product is as it moves throughout the warehouse, or risk costs and waste. By directly tying scanners and barcodes to the right technology, organizations can ensure that all product is accounted for and easily located using real-time data.

Build a foundation for scalability 

Cannabis businesses don’t have the time to manually keep track of these aspects, and it wouldn’t even be possible as they grow and expand their operations. As they evolve, so too will the list of software requirements that are needed to operate smoothly, reliably and efficiently.

Cannabis processors have traditionally invested in seed-to-sale technology, relying on barcodes to track products throughout their lifecycle. While it is critical for cannabis enterprises to keep a strong level of control over lot tracking, this type of software is very limited. Cannabis firms would therefore be better served by an ERP solution with a single data source that provides centralized, real-time access to vital business information.

ERP technology can also help cannabis businesses better manage their production schedule, material requirements planning, accounting, purchasing, inventory management and document generation. The key, however, is to choose the right technology, avoiding ERP solutions that rely on customizations and bolt-ons, which will impede an organization’s ability to scale. Cannabis businesses should instead use technology that makes all of its features, enhancements and extensibility available to all customers, ensuring that every user has access to the same benefits.

A Q&A with Matt Hawkins, Co-Founder & Managing Partner at Entourage Effect Capital

By Aaron Green
No Comments

The cannabis industry saw close to $15.5B in deals across VC, private equity, M&A and IPOs in 2020 according to PitchBook data. Early and growth stage capital has been a key enabler in deal activity as companies seek to innovate and scale, taking advantage of trends towards national legalization and consolidation. Entourage Effect Capital is one of the largest VC firms in cannabis with over $150MM deployed since its inception in 2014. Some of their notable investments include GTI, CANN, Harborside (CNQ: HBOR), Acreage Holdings, Ebbu, TerrAscend and Sunderstorm.

We spoke with Matt Hawkins, co-founder and managing partner at Entourage Effect Capital. Matt started Entourage in 2014 after exiting his previous company. He has 20+ years of private equity experience and serves on the Boards of numerous cannabis companies. Matt’s thought leadership has been on Fox Business in the past and he has also recently featured on CNBC, Bloomberg, Yahoo! Finance, Cheddar and more.

Aaron Green: How did you get involved in the cannabis industry?

Matt Hawkins: We’ve been making investments in the cannabis industry since 2014. We’ve made 65 investments to date. We have a full team of investment professionals, and we invest up and down the value chain of the industry.

I had been in private equity for 25 years and I kind of just fell into the industry after I’d had an exit. I started lending to warehouse owners in Denver that were looking to refinance their mortgages out of commercial debt into private debt, which would then give them the ability to lease their facilities to growers. I realized there would be a significant opportunity to place capital in the private equity side of the cannabis business. So, I just started raising money for that project and I haven’t looked back. It’s been a great run and we’ve built a fantastic portfolio. We look forward to continuing to deploy capital up to and through legalization.

Green: Do you consider Entourage Effect Capital a VC fund or private equity firm? How do you talk about yourself?

Hawkins: In the early stages of the industry, we were more purely venture capital because there was hardly any revenue. We’re probably still considered a venture capital firm, by definition, just because of the risk factors. As the industry has matured, the investments we make are going to be larger. The reality is that the checks we write now will go to companies that have a track record of not only 12 months of revenue, but EBITDA as well. We can calculate a multiple on those, and that makes it more like lower/middle-market private equity investing.

Green: What’s your investment mandate?

Matt Hawkins, Co-Founder and Managing Partner at Entourage Effect Capital

Hawkins: From here forward our mandate is to build scale in as many verticals as we can ahead of legalization. In the early days, we were focused on giving high net worth individuals and family offices access to the industry using a very diversified approach, meaning we invested up and down the value chain. We’ll continue to do that, but now we’re going to be really laser focused on combining companies and building scale within companies to where they’re going to be more attractive for exit partners upon legalization.

Green: Are there any particular segments of the industry that you focus on whether it’s cultivation, extraction or MSOs?

Hawkins: We tend to focus on everything above cultivation. We feel like cultivation by itself is a commodity, but when vertically integrated, for example with a single-state operator or multi-state operator, that makes it intrinsically more valuable. When you look at the value chain, right after cultivation is where we start to get involved.

Green: Are you also doing investments in tech and e-commerce?

Hawkins: We’ve made some investments in supply chain, management software, ERP solutions, things like that. We’re not really focused on e-commerce with the exception of the only CBD company we are invested in.

Green: How does Entourage’s investment philosophy differ from other VC and private equity firms in cannabis?

Hawkins: We really don’t pay attention to other people’s philosophies. We have co-invested with others in the past and will continue to do so. There’s not a lot of us in the industry, so it’s good that we all work together. Until legalization occurs, or institutional capital comes into play, we’re really the only game in town. So, it behooves us all to have good working relationships.

Green: Across the states, there’s a variety of markets in various stages of development. Do you tend to prefer investing in more sophisticated markets? Say California or Colorado where they’ve been legalized for longer, or are you looking more at new growth opportunities like New York and New Jersey?

Hawkins: Historically, we’ve focused on the most populous states. California is obviously where we’ve placed a lot of bets going forward. We’ll continue to build out our portfolio in California, but we will also exploit the other large population states like New Jersey, New York, Arizona, Massachusetts, Michigan, Ohio and Illinois. All of those are big targets for us. 

Green: Do you think legalization will happen this Congress?

Hawkins: My personal opinion is that it will not happen this year. It could be the latter part of next year or the year after. I think there’s just too much wood to chop. I was encouraged to see the SAFE Banking Act reappear. I think that will hopefully encourage institutional capital to take another look at the game, especially with the NASDAQ and the New York Stock Exchange open up. So that’s a positive.

I think with the election of President Biden and with the Senate runoffs in Georgia going Democrat, the timeline to legalization has sped up, but I don’t think it’s an overnight situation. I certainly don’t think it’ll be easy to start crossing state lines immediately, either.

Green: Can you explain more about your thoughts on interstate commerce?

Hawkins: I think it’s pretty simple. The states don’t want to give up all the tax revenue that they get from their cultivation companies that are in the state. For example, if you allow Mexico and Colombia to start importing product, we can’t compete with that cost structure. States that are neighbors to California, but need to grow indoors which is more expensive, are not going to want to lose their tax revenues either. So, I just think there’s going to be a lot of butting heads at the state level.

The federal government is going to have to outline what the tax implications will be, because at the end of the day the industry is currently taxed as high as it ever will be or should be. Anything North of current tax levels will prohibit businesses from thriving further, effectively meaning not being able to tamp down the illicit market. One of the biggest goals of legalization in my opinion should be reducing the tax burden on the companies and thereby allowing them to be able to compete more directly with the illicit market, which obviously has all the benefits of reduced crime, etc.

Green: Do you foresee 280E changes coming in the future?

Hawkins: For sure. If the federal illegality veil is removed – which means there’ll be some type of rescheduling – cannabis would be removed from the 280E category. I think 280E by definition is about just illegal drugs and manufacturing and selling of that. As long as cannabis isn’t part of that, then it won’t be subject to it.

Green: What have been some of the winners in your portfolio in terms of successful exits?

Hawkins: When the CSC started allowing companies in Canada to own U.S. assets, the whole landscape changed. We were fortunate to be early investors in Acreage and companies that sold to Curaleaf and GTI before they were public. We are big investors in TerrAscend. We were early investors in Ebbu which sold to Canopy Growth. Those were huge wins for us in Fund I. We also have some interesting plays in Fund II that are on the precipice of having similar-type exits.

You read about the big ones, but at the end of the day, the ones that kind of fall under the radar – the private deals – actually have even greater multiples than what we see on some of the public M&A activity.

Green: Governor Cuomo has been hinting recently at being “very close” on a deal for opening up the cannabis market in New York. What do you think are the biggest opportunities in New York right now?

Hawkins: If it can get done, that’s great. I’m just concerned that distractions in the state house right now in New York may get in the way of progress there. But if it doesn’t, and it is able to come to fruition, then there isn’t a sector that doesn’t have a chance to thrive and thrive extremely well in the state of New York.

Green: Looking at other markets, Curaleaf recently announced a big investment in Europe. How do you look at Europe in general as an investment opportunity?

Hawkins: We have a pretty interesting play in Europe right now through a company called Relief Europe. It’s poised to be one of the first entrants to Germany. We think it could be a big win for us. But let’s face it, Europe is still a little behind, in fact, a lot behind the United States in terms of where they are as an industry. Most of the capital that we’re going to be deploying is going to be done domestically in advance of legalization.

Green: What industry trends are you seeing in the year ahead?“We’re constantly learning from other industries that are steps ahead of us to figure out how to use those lessons as we continue to invest in cannabis.”

Hawkins: Well, I think you’ll see a lot of consolidation and a lot of ramping up in advance of legalization. I think that’s going to apply in all sectors. I just don’t see a scenario wherein mom and pops or smaller players are going to be successful exit partners with some of the new capital that’s coming in. They’re going to have to get to a point where they’re either selling to somebody bigger than them right now or joining forces with companies around the same size as them and creating mass. That’s the only way you’re going to compete with companies coming in with billions of dollars to deploy.

Green: How do you see this shaking out?

Hawkins: That’s where you start to look into the crystal ball. It’s really difficult to say because I think until we get to where we truly have a national footprint of brands, which would require crossing state lines, it’s going be really difficult to tell where things go. I do know that liquor, tobacco, beer, the distribution companies, they all are standing in line. Big Pharma, big CPG, nutraceuticals, they all want access to this, too.

In some form or fashion, these bigger players will dictate how they want to go about attacking the market on their own. So, that part remains to be seen. We’ll just have to wait and see where this goes and how quickly it goes there.

Green: Are you looking at other geographies to deploy capital such as APAC or Latin America regions?

Hawkins: Not at this point. It’s not a focus at all. What recently transpired here in the elections just really makes us want to focus here and generate positive returns for investors.

Green: As cannabis goes more and more mainstream, federal legalization is maybe more likely. How do you think the institutional investor scene is evolving around that? And is it a good thing to bring in new capital to the cannabis market?

Hawkins: I don’t see a downside to it. Some people are saying that it could damage the collegial and cottage-like nature of the industry. At the end of the day, if you’ve got tens of billions of dollars that are waiting to pour into companies listed on the CSC and up-listing to the NASDAQ or New York Stock Exchange, that’s only going to increase their market caps and give them more cash to acquire other companies. The trickle-down effect of that will be so great to the industry that I just don’t know how you can look the other way and say we don’t want it. 

Green: Last question: What’s got your attention these days? What’s the thing you’re most interested in learning about?

Hawkins: We’re constantly learning about just where this industry is headed. We’re constantly learning from other industries that are steps ahead of us to figure out how to use those lessons as we continue to invest in cannabis. We all saw the correlation between cannabis and alcohol prohibition. The reality is that the industry is mature enough now where you can see similarities to industries that have gone from infancy to their adolescent years. That’s kind of where we are now and so we spend a lot of time studying industries that have been down this path before and see what lessons we can apply here.

Green: Okay, great. So that concludes the interview!

Hawkins: Thanks, Aaron.

Cannabis Registry Reality Check: Privacy Must be Paramount

By Shadrach White
No Comments

The task of preserving privacy for any records platform, especially a cannabis registry, cannot simply be relegated to ones and zeros lurking in some forgotten codebase. This past year taught us many lessons, especially related to the trauma unleashed by vulnerabilities in government domains. We learned time and again that a registrant’s privacy must be the first order of business for the architects of registries.

But the first order of business isn’t the last order of business. That intention and effort to secure privacy must then be communicated and reinforced through real-world reality checks.

Lapses in data security and rising distrust for government institutions block the efficacy of well-intentioned and vital registries. Those states launching new registries in 2021 are at a precarious crossroads as public trust erodes.

As I write this, we’ve just learned illicit operators hacked a third-party service provider for the Washington State Auditor’s office. The attack compromised the personal data of 1.4 million users seeking unemployment benefits. Security hacks are a cautionary tale, whose impact is felt too often.

But many in the government sector are staring at a once-in-a-generation challenge to launch new registries – those related to cannabis – with privacy top-of-mind from the initial Request For Bid.“The question isn’t when these privacy-first registries will be implemented, it’s a question of whether they’ll be implemented proactively ahead of hacks or after the damage is done.”

Here’s how:

Table Stakes for New Cannabis Registries

These suggestions are just the beginning, and I see them as the minimum buy-in to begin the architecture of a new cannabis registry. They include:

  • End-to-end data encryption while in transit and within the system while the data is at rest.
  • A solution that is a cloud-native web application which is managed as a service for maximum uptime and strong security posture.
  • Registries should also leverage algorithms and machine learning to ensure accurate data entry by analyzing incorrect or duplicate data before it is saved within the system.

Beyond HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) requires privacy and security measures to protect Personal Health Information (PHI). Debate exists on whether compliance is a requirement for all entities transacting in the medicinal cannabis space. While some state registries are exempt from HIPAA, others choose to provide HIPAA compliance not just for the optics, but the known benefit to users’ privacy and confidence. New cannabis registries should commit to HIPAA-compliance to set a trusted new privacy standard for medical patient credentials and legal authorization for the use of cannabis for medical purposes.

That’s just the start. Registries should also ensure SOC2 Type II certification, which safeguards security, site availability, confidentiality and privacy through independent third-party auditors.

Connect with Confidence

Registries function as a hub of information in an often-confusing cannabis space. The California Bureau of Cannabis Control displays more than 25 links wired into its top navigation bar alone. Each link sends the curious to new resources. Registries must establish themselves as credible resources, especially when directing users to third-party sites.

One example is for cannabis registries to provide secure access to healthcare professionals who are verified by the Drug Enforcement Agency (DEA). These healthcare professionals are licensed to distribute controlled substances including cannabis. Each third-party link should offer the same high-level of scrutiny to enshrine confidence and credibility in the registry.

Next-Generation ID Cards

A cannabis registry card should not just be a document, but a toolset that attests to the identity and the authority of the carrier represented. An illicit counterfeiting market seeks to exploit registry card vulnerabilities. Next generation ID cards present the best defense against counterfeiting and illegal use with robust security measures. That starts with assuring that any credential is mobile ID compatible with iOS Wallet and GooglePay for mobile identification.

ID cards should also include:

The automated modification of the document bearer’s photograph to ICAO (International Civil Aviation Organization) standards. This critical modification makes the photograph easier to use for ID verification; it also facilitates the detection of photograph substitution.

A two-dimensional barcode compiles information contained in a one-dimensional barcode. It also delivers confirmation of other data shown on the card or in the system such as license authorization and limitations. Adding additional material to the physical document such as holograms, UV image, micro-printing or laser perforations offers another level of protection against illicit use or counterfeiting.

While cannabis registries are the beginning, they’re not the end. Driving efficacy for government registries needed for COVID19 track-and-tracing, cannabis plant track-and-tracing and vaccine distribution require the same attention to privacy, security and ultimate useability. A sea change is required – not just for the sake of those who use the registries but also for those who must implement, deploy and maintain those registries. The question isn’t when these privacy-first registries will be implemented, it’s a question of whether they’ll be implemented proactively ahead of hacks or after the damage is done. I believe the government sector leaders exploring new cannabis registries offer the wisdom and foresight to choose the proactive approach.