Certain states such as Alabama and Florida require medical cannabis dispensaries, as well as vertically-integrated cannabis businesses with dispensary operations, to achieve and maintain HIPAA compliance at all times. Aside from that, every organization in the US that handles protected health information (PHI) is required by law to follow the HIPAA Privacy and Security Rules. This includes all medical dispensaries. Enforcement of this requirement will only increase once cannabis is federally legalized.