3VAC10-40-200: Recordkeeping requirements

A. If a medical cannabis facility uses an electronic system for the storage and retrieval of patient information or other records related to cultivating, producing, and dispensing cannabis products, as applicable, the pharmaceutical processor or cannabis dispensing facility shall use a system that:

1. Guarantees the confidentiality of the information contained in the system;

2. Is capable of safeguarding against erasures and unauthorized changes in data after the information has been entered and verified by the pharmacist or responsible party; and

3. Is capable of being reconstructed in the event of a computer malfunction or accident resulting in the destruction of the data bank.

B. All records relating to inventory, laboratory results, and dispensing shall be maintained for a period of three years and shall be made available to the board upon request.