Assuming the patient agrees that a business can keep the hash derived from its processing of the medical marijuana owned by the patient there is nothing per se improper about such a situation. If there is no agreement allowing such, the business should return the hash to the patient.