Medical cannabis database

AN ACT Relating to allowing the liquor and cannabis board to 1
verify excise tax exemptions through the medical cannabis 2
authorization database; and amending RCW 69.51A.230.3
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:4
Sec. 1. RCW 69.51A.230 and 2022 c 16 s 127 are each amended to 5
read as follows: 6
(1) The department must contract with an entity to create, 7
administer, and maintain a secure and confidential medical cannabis 8
authorization database that allows: 9
(a) A cannabis retailer with a medical cannabis endorsement to 10
add a qualifying patient or designated provider and include the 11
amount of cannabis concentrates, useable cannabis, cannabis-infused 12
products, or plants for which the qualifying patient is authorized 13
under RCW 69.51A.210; 14
(b) Persons authorized to prescribe or dispense controlled 15
substances to access health care information on their patients for 16
the purpose of providing medical or pharmaceutical care for their 17
patients; 18
(c) A qualifying patient or designated provider to request and 19
receive his or her own health care information or information on any 20
person or entity that has queried their name or information;21
Z-0010.2
HOUSE BILL 1341
State of Washington 69th Legislature 2025 Regular Session
By Representative Wylie; by request of Liquor and Cannabis Board
Read first time 01/16/25. Referred to Committee on Consumer
Protection & Business.
p. 1 HB 1341
(d) Appropriate local, state, tribal, and federal law enforcement 1
or prosecutorial officials who are engaged in a bona fide specific 2
investigation of suspected cannabis-related activity that may be 3
illegal under Washington state law to confirm the validity of the 4
recognition card of a qualifying patient or designated provider;5
(e) A cannabis retailer holding a medical cannabis endorsement to 6
confirm the validity of the recognition card of a qualifying patient 7
or designated provider; 8
(f) The department of revenue to verify tax exemptions under 9
chapters 82.08 and 82.12 RCW; 10
(g) The liquor and cannabis board to verify excise tax exemptions 11
under RCW 69.50.535;12
(h) The department and the health care professional's 13
disciplining authorities to monitor authorizations and ensure 14
compliance with this chapter and chapter 18.130 RCW by their 15
licensees; and 16
(((h))) (i) Authorizations to expire six months or one year after 17
entry into the medical cannabis authorization database, depending on 18
whether the authorization is for a minor or an adult.19
(2) A qualifying patient and his or her designated provider, if 20
any, may be placed in the medical cannabis authorization database at 21
a cannabis retailer with a medical cannabis endorsement. After a 22
qualifying patient or designated provider is placed in the medical 23
cannabis authorization database, he or she must be provided with a 24
recognition card that contains identifiers required in subsection (3) 25
of this section. 26
(3) The recognition card requirements must be developed by the 27
department in rule and include: 28
(a) A randomly generated and unique identifying number;29
(b) For designated providers, the unique identifying number of 30
the qualifying patient whom the provider is assisting;31
(c) A photograph of the qualifying patient's or designated 32
provider's face taken by an employee of the cannabis retailer with a 33
medical cannabis endorsement at the same time that the qualifying 34
patient or designated provider is being placed in the medical 35
cannabis authorization database in accordance with rules adopted by 36
the department; 37
(d) The amount of cannabis concentrates, useable cannabis, 38
cannabis-infused products, or plants for which the qualifying patient 39
is authorized under RCW 69.51A.210; 40
p. 2 HB 1341
(e) The effective date and expiration date of the recognition 1
card; 2
(f) The name of the health care professional who authorized the 3
qualifying patient or designated provider; and 4
(g) For the recognition card, additional security features as 5
necessary to ensure its validity. 6
(4)(a) For qualifying patients who are eighteen years of age or 7
older and their designated providers, recognition cards are valid for 8
one year from the date the health care professional issued the 9
authorization. For qualifying patients who are under the age of 10
eighteen and their designated providers, recognition cards are valid 11
for six months from the date the health care professional issued the 12
authorization. Qualifying patients may not be reentered into the 13
medical cannabis authorization database until they have been 14
reexamined by a health care professional and determined to meet the 15
definition of qualifying patient. After reexamination, a cannabis 16
retailer with a medical cannabis endorsement must reenter the 17
qualifying patient or designated provider into the medical cannabis 18
authorization database and a new recognition card will then be issued 19
in accordance with department rules. 20
(b) A qualifying patient's registration in the medical cannabis 21
authorization database and his or her recognition card may be renewed 22
by a qualifying patient's designated provider without the physical 23
presence of the qualifying patient at the retailer if the 24
authorization from the health care professional indicates that the 25
qualifying patient qualifies for a compassionate care renewal, as 26
provided in RCW 69.51A.030. A qualifying patient receiving renewals 27
under the compassionate care renewal provisions is exempt from the 28
photograph requirements under subsection (3)(c) of this section.29
(5) If a recognition card is lost or stolen, a cannabis retailer 30
with a medical cannabis endorsement, in conjunction with the database 31
administrator, may issue a new card that will be valid for six months 32
to one year if the patient is reexamined by a health care 33
professional and determined to meet the definition of qualifying 34
patient and depending on whether the patient is under the age of 35
eighteen or eighteen years of age or older as provided in subsection 36
(4) of this section. If a reexamination is not performed, the 37
expiration date of the replacement recognition card must be the same 38
as the lost or stolen recognition card. 39
p. 3 HB 1341
(6) The database administrator must remove qualifying patients 1
and designated providers from the medical cannabis authorization 2
database upon expiration of the recognition card. Qualifying patients 3
and designated providers may request to remove themselves from the 4
medical cannabis authorization database before expiration of a 5
recognition card and health care professionals may request to remove 6
qualifying patients and designated providers from the medical 7
cannabis authorization database if the patient or provider no longer 8
qualifies for the medical use of cannabis. The database administrator 9
must retain database records for at least five calendar years to 10
permit the state liquor and cannabis board and the department of 11
revenue to verify eligibility for tax exemptions. 12
(7) During development of the medical cannabis authorization 13
database, the database administrator must consult with the 14
department, stakeholders, and persons with relevant expertise to 15
include, but not be limited to, qualifying patients, designated 16
providers, health care professionals, state and local law enforcement 17
agencies, and the University of Washington computer science and 18
engineering security and privacy research lab or a certified 19
cybersecurity firm, vendor, or service. 20
(8) The medical cannabis authorization database must meet the 21
following requirements: 22
(a) Any personally identifiable information included in the 23
database must be nonreversible, pursuant to definitions and standards 24
set forth by the national institute of standards and technology;25
(b) Any personally identifiable information included in the 26
database must not be susceptible to linkage by use of data external 27
to the database; 28
(c) The database must incorporate current best differential 29
privacy practices, allowing for maximum accuracy of database queries 30
while minimizing the chances of identifying the personally 31
identifiable information included therein; and 32
(d) The database must be upgradable and updated in a timely 33
fashion to keep current with state of the art privacy and security 34
standards and practices. 35
(9)(a) Personally identifiable information of qualifying patients 36
and designated providers included in the medical cannabis 37
authorization database is confidential and exempt from public 38
disclosure, inspection, or copying under chapter 42.56 RCW.39
p. 4 HB 1341
(b) Information contained in the medical cannabis authorization 1
database may be released in aggregate form, with all personally 2
identifiable information redacted, for the purpose of statistical 3
analysis and oversight of agency performance and actions.4
(c) Information contained in the medical cannabis authorization 5
database shall not be shared with the federal government or its 6
agents unless the particular qualifying patient or designated 7
provider is convicted in state court for violating this chapter or 8
chapter 69.50 RCW. 9
(10) The department must charge a one dollar fee for each initial 10
and renewal recognition card issued by a cannabis retailer with a 11
medical cannabis endorsement. The cannabis retailer with a medical 12
cannabis endorsement shall collect the fee from the qualifying 13
patient or designated provider at the time that he or she is entered 14
into the database and issued a recognition card. The department shall 15
establish a schedule for cannabis retailers with a medical cannabis 16
endorsement to remit the fees collected. Fees collected under this 17
subsection shall be deposited into the dedicated cannabis account 18
created under RCW 69.50.530. 19
(11) If the database administrator fails to comply with this 20
section, the department may cancel any contracts with the database 21
administrator and contract with another database administrator to 22
continue administration of the database. A database administrator who 23
fails to comply with this section is subject to a fine of up to five 24
thousand dollars in addition to any penalties established in the 25
contract. Fines collected under this section must be deposited into 26
the health professions account created under RCW 43.70.320.27
(12) The department may adopt rules to implement this section.28
--- END ---
p. 5 HB 1341