Cannabis Dispensary Records Management

This discusses the importance of maintaining a comprehensive and organized record management system. It describes the key records management procedures and requirements.

Including records management for digital files and physical files, a records inventory list, and patient records for medical dispensaries.

Importance of Records Management

Operating a business involves a host of transactions, contracts, purchases and sales, tax filings, and numerous other processes for which records must be kept. To effectively operate a business – and to comply with applicable federal, state, and local laws – the business must maintain these records in an organized, safe, and secure manner.

Business Risks

Implementation of a Records Management System is not simply a matter of staying organized. Damage to or loss of records can lead to legal liability or lawsuits. In the case of a cannabis operation, these consequences could potentially lead to the loss of licenses that allow the business to operate at all.

In the case of a medical dispensary, there are additional legal requirements involving compliance with patient records. Failure to implement an organized, safe, and secure Records Management System can be fatal to the business.

Managing Risk

The importance of a Records Management System for cannabis businesses cannot be overstated. The risks posed by improper records management are not just a matter of lost profit but can lead to loss of licenses and possibly force the closure of the business (that’s why cannabis dispensary training is so desperately needed).

If the operation is a medical dispensary, additional records management requirements apply to patient records. Good managers should maintain an effective Records Management System:

1. Records Inventory List
2. Destruction Process
3. HIPAA Compliance

An effective Records Management System is necessary for the longevity of every business, especially a cannabis business. An organized, safe, and secure Records Management System will minimize the risk of lawsuits or other legal liability that could be fatal to the business.

Records Management

Records management is critical for maintaining an orderly operation and complying with applicable laws. For this reason, every operation must maintain a Records Management System and follow established procedures.

An effective Records Management System will ensure the organized storage, retention, and protection of all records and supporting data. Every Records Management System must include the following:

1. Records Inventory List: The Records Inventory List is a master list of all records and control requirements.
2. Destruction Process: The Records Management System must include policies on retention time and destruction/deletion methods of all records.
3. HIPAA Compliance: Patient records control and destruction requirements by HIPAA.

Given the prevalence of digital records in a modern business, the operation must have specific procedures for the management of all digital files. Below you’ll learn the specific procedures relating to digital files that must be included in every Records Management System:

1. System Access Controls
2. User Controls and Tracking (Viewing, Printing, Editing, and Deleting)
3. Standard File Labeling and Organized Storage Hierarchy
4. Data Encryption
5. File deletion schedules and processes including deletion of data on obsolete computers and data storage devices.
6. Data Backup: Cloud Storage, Digital Storage Service, Offsite Storage (of Backup Hard Drives)
7. Automatic File Backup
8. Long-Term Protection and File Integrity

Physical Records Management

In addition to the procedures for digital files, the Records Management System must include specific procedures for physical records. So you’ll need to learn the specific procedures relating to physical files that must be included in every Records Management System.

1. Restricted Storage Areas
2. Lockable Filing Systems
3. Sign-In/Sign-Out Procedures for File Review/Removal
4. Organized Filing Systems
5. Physical Records (filed promptly)
6. Destruction Schedules and Processes
7. Crisis Protection
8. Long-Term Storage and Environmental Controls

Worker Responsibilities

• The operation must assign a worker to manage the records system, and the worker must have the time allotment, skills, and experience to adequately meet the position requirements.

Management Responsibilities

• Management must conduct a self-assessment of the records process at least every 90 days, document the assessment, and complete any corrective action.

Legal Compliance

All records management procedures must comply with applicable federal, state, and local regulations. Records management is critical for maintaining an orderly operation and complying with applicable laws.

Every operation must implement a Records Management System that includes specific procedures for digital files and physical files.

The operation must assign a worker to manage the records system and a manager to conduct a self-assessment every 90 days. Next, we will learn about creating a Records Inventory List.

Records Inventory List

To ensure that all records are included in the Records Management System, the operation must list all records used or received by the business on a Records Inventory List. The Records Inventory List should identify the following aspects of the records:

1. Each Record (by title)
2. Persons/Positions Authorized (to view the record)
3. The Revision or Deletion Authorizations
4. Retention Period
5. Destruction Method
6. Storage and Back-Up Requirements
7. Record Location
8. Other Controls (as required)

Records Identification

The Records Inventory List must identify all records related to the categories listed below. There may be multiple records per category. 32 categories have been grouped into related fields. Below we’ll learn the 32 categories of records that must be identified by the Records Inventory List.

Finance

The Records Inventory List must include the following financial records:

1. Accounting Ledgers and Reports
2. Tax Returns, Tax Correspondence, and Supporting Information
3. Payroll and Wages

Legal

The Records Inventory List must include the following legal records:

1. Contracts and Agreements
2. Corporate Organization, Bylaws, Organization Charts
3. Insurance
4. Intellectual Property
5. Legal Files, Court Documents, Attorney Files
6. Public Filings
7. Security Records

Electronic

The Records Inventory List must include the following electronic records:

1. Logins and Electronic Permissions
2. Electronic Mail

Employment

The Records Inventory List must include the following employment records:

1. Employment and Worker Files
2. Training Records and Program Documentation
3. Safety and Health (OSHA, worker’s comp, medical, SDS)

Operations

The Records Inventory List must include the following operations records:

1. Audit Reports, Inspection Reports, and Self-Assessments
2. Quality Control Procedures, Logs, and Records
3. Vendor Records
4. Customer Information
5. Patient/Customer Records
6. Inventory Records

Product

The Records Inventory List must include the following product records:

1. Production Records
2. Product Test Data and Test Lab Reports
3. Product Transfers
4. Test Method Documentation (Lab Only)
5. Sample Management and Control Records

Sales and Communication

The Records Inventory List must include the following sales and communication records:

1. Sales and Marketing Plans
2. Sales Transactions
3. Press Releases

Facility and Equipment

The Records Inventory List must include the following facility and equipment records:

1. Maintenance Logs for Facilities and Equipment
2. Calibration, Maintenance, and Repair Logs
3. Sanitation Logs

To ensure that all records are included in the Records Management System, the operation must list all records used or received by the business on a Records Inventory List. The List must identify the records using several aspects of the records. 32 categories of records must be included in the Record Inventory List.

Patient Records

As has been discussed in this module, all records management must be done in compliance with federal, state, and local laws. For medical dispensaries, one such law is the Health Insurance Portability and Accountability Act of 1996 (HIPAA). A medical dispensary must manage patient records according to HIPAA regulations.

HIPAA Compliant Procedures (United States)

The operation must have procedures and controls for all Protected Health Information such as:

• Medical Record Numbers
• Contact Information
• Diagnosis Codes
• Patient Verification Information (ex. Driver’s License, Passport, etc.)
• Data Security

To protect patient records, the operation must install and use website security (SSL Certificate) or similar for patient data access or Internet transmission. Procedures must control patient verification system access and output. Compliance with HIPAA regulations for medical dispensaries requires additional procedures for patient records.

Let us know what you think.