UT Code § 26-61a-103 (2021)
2021 Utah Code|Title 26 - Utah Health Code|Chapter 61a - Utah Medical Cannabis Act|Part 1 - General Provisions|Section 103 - Electronic verification system.

 Effective 7/1/2021  26-61a-103. Electronic verification system.    (1) The Department of Agriculture and Food, the department, the Department of Public Safety, and the Division of Technology Services shall:   (a) enter into a memorandum of understanding in order to determine the function and operation of the state electronic verification system in accordance with Subsection (2);     (b) coordinate with the Division of Purchasing, under Title 63G, Chapter 6a, Utah Procurement Code, to develop a request for proposals for a third-party provider to develop and maintain the state electronic verification system in coordination with the Division of Technology Services; and     (c) select a third-party provider who:   (i) meets the requirements contained in the request for proposals issued under Subsection (1)(b); and     (ii) may not have any commercial or ownership interest in a cannabis production establishment or a medical cannabis pharmacy.         (2) The Department of Agriculture and Food, the department, the Department of Public Safety, and the Division of Technology Services shall ensure that, on or before March 1, 2020, the state electronic verification system described in Subsection (1):   (a) allows an individual to apply for a medical cannabis patient card or, if applicable, a medical cannabis guardian card, provided that the card may not become active until:   (i) the relevant qualified medical provider completes the associated medical cannabis recommendation; or     (ii) for a medical cannabis card related to a limited medical provider's recommendation, the medical cannabis pharmacy completes the recording described in Subsection (2)(d);       (b) allows an individual to apply to renew a medical cannabis patient card or a medical cannabis guardian card in accordance with Section 26-61a-201;     (c) allows a qualified medical provider, or an employee described in Subsection (3) acting on behalf of the qualified medical provider, to:   (i) access dispensing and card status information regarding a patient:   (A) with whom the qualified medical provider has a provider-patient relationship; and     (B) for whom the qualified medical provider has recommended or is considering recommending a medical cannabis card;       (ii) electronically recommend, after an initial face-to-face visit with a patient described in Subsection 26-61a-201(4)(b), treatment with cannabis in a medicinal dosage form or a cannabis product in a medicinal dosage form and optionally recommend dosing guidelines;     (iii) electronically renew a recommendation to a medical cannabis patient cardholder or medical cannabis guardian cardholder:   (A) using telehealth services, for the qualified medical provider who originally recommended a medical cannabis treatment during a face-to-face visit with the patient; or     (B) during a face-to-face visit with the patient, for a qualified medical provider who did not originally recommend the medical cannabis treatment during a face-to-face visit; and       (iv) notate a determination of physical difficulty or undue hardship, described in Subsection 26-61a-202(1), to qualify a patient to designate a caregiver;       (d) beginning on the earlier of September 1, 2021, or the date on which the electronic verification system is functionally capable of facility medical cannabis pharmacy recording, allows a medical cannabis pharmacy medical provider or medical cannabis pharmacy agent, in accordance with Subsection 26-61a-501(11)(a), to record:   (i) a patient's recommendation from a limited medical provider, including any directions of use, dosing guidelines, or caregiver indications from the limited medical provider; and     (ii) a limited medical provider's renewal of the provider's previous recommendation;       (e) connects with:   (i) an inventory control system that a medical cannabis pharmacy uses to track in real time and archive purchases of any cannabis in a medicinal dosage form, cannabis product in a medicinal dosage form, or a medical cannabis device, including:   (A) the time and date of each purchase;     (B) the quantity and type of cannabis, cannabis product, or medical cannabis device purchased;     (C) any cannabis production establishment, any medical cannabis pharmacy, or any medical cannabis courier associated with the cannabis, cannabis product, or medical cannabis device; and     (D) the personally identifiable information of the medical cannabis cardholder who made the purchase; and       (ii) any commercially available inventory control system that a cannabis production establishment utilizes in accordance with Section 4-41a-103 to use data that the Department of Agriculture and Food requires by rule, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, from the inventory tracking system that a licensee uses to track and confirm compliance;       (f) provides access to:   (i) the department to the extent necessary to carry out the department's functions and responsibilities under this chapter;     (ii) the Department of Agriculture and Food to the extent necessary to carry out the functions and responsibilities of the Department of Agriculture and Food under Title 4, Chapter 41a, Cannabis Production Establishments; and     (iii) the Division of Occupational and Professional Licensing to the extent necessary to carry out the functions and responsibilities related to the participation of the following in the recommendation and dispensing of medical cannabis:   (A) a podiatrist licensed under Title 58, Chapter 5a, Podiatric Physician Licensing Act;     (B) a pharmacist licensed under Title 58, Chapter 17b, Pharmacy Practice Act;     (C) an advanced practice registered nurse licensed under Title 58, Chapter 31b, Nurse Practice Act;     (D) a physician licensed under Title 58, Chapter 67, Utah Medical Practice Act, or Title 58, Chapter 68, Utah Osteopathic Medical Practice Act; or     (E) a physician assistant licensed under Title 58, Chapter 70a, Utah Physician Assistant Act;         (g) provides access to and interaction with the state central patient portal;     (h) communicates dispensing information from a record that a medical cannabis pharmacy submits to the state electronic verification system under Subsection 26-61a-502(6)(a)(ii) to the controlled substance database;     (i) provides access to state or local law enforcement:   (i) during a law enforcement encounter, without a warrant, using the individual's driver license or state ID, only for the purpose of determining if the individual subject to the law enforcement encounter has a valid medical cannabis card; or     (ii) after obtaining a warrant; and       (j) creates a record each time a person accesses the system that identifies the person who accesses the system and the individual whose records the person accesses.       (3)   (a) Beginning on the earlier of September 1, 2021, or the date on which the electronic verification system is functionally capable of allowing employee access under this Subsection (3), an employee of a qualified medical provider may access the electronic verification system for a purpose described in Subsection (2)(c) on behalf of the qualified medical provider if:   (i) the qualified medical provider has designated the employee as an individual authorized to access the electronic verification system on behalf of the qualified medical provider;     (ii) the qualified medical provider provides written notice to the department of the employee's identity and the designation described in Subsection (3)(a)(i); and     (iii) the department grants to the employee access to the electronic verification system.       (b) An employee of a business that employs a qualified medical provider may access the electronic verification system for a purpose described in Subsection (2)(c) on behalf of the qualified medical provider if:   (i) the qualified medical provider has designated the employee as an individual authorized to access the electronic verification system on behalf of the qualified medical provider;     (ii) the qualified medical provider and the employing business jointly provide written notice to the department of the employee's identity and the designation described in Subsection (3)(b)(i); and     (iii) the department grants to the employee access to the electronic verification system.         (4)   (a) As used in this Subsection (4), "prescribing provider" means:   (i) a podiatrist licensed under Title 58, Chapter 5a, Podiatric Physician Licensing Act;     (ii) an advanced practice registered nurse licensed under Title 58, Chapter 31b, Nurse Practice Act;     (iii) a physician licensed under Title 58, Chapter 67, Utah Medical Practice Act, or Title 58, Chapter 68, Utah Osteopathic Medical Practice Act; or     (iv) a physician assistant licensed under Title 58, Chapter 70a, Utah Physician Assistant Act.       (b) Beginning on the earlier of September 1, 2021, or the date on which the electronic verification system is functionally capable of allowing provider access under this Subsection (4), a prescribing provider may access information in the electronic verification system regarding a patient the prescribing provider treats.       (5) The department may release limited data that the system collects for the purpose of:   (a) conducting medical and other department approved research;     (b) providing the report required by Section 26-61a-703; and     (c) other official department purposes.       (6) The department shall make rules, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, to establish:   (a) the limitations on access to the data in the state electronic verification system as described in this section; and     (b) standards and procedures to ensure accurate identification of an individual requesting information or receiving information in this section.       (7)   (a) Any person who knowingly and intentionally releases any information in the state electronic verification system in violation of this section is guilty of a third degree felony.     (b) Any person who negligently or recklessly releases any information in the state electronic verification system in violation of this section is guilty of a class C misdemeanor.       (8)   (a) Any person who obtains or attempts to obtain information from the state electronic verification system by misrepresentation or fraud is guilty of a third degree felony.     (b) Any person who obtains or attempts to obtain information from the state electronic verification system for a purpose other than a purpose this chapter authorizes is guilty of a third degree felony.       (9)   (a) Except as provided in Subsection (9)(e), a person may not knowingly and intentionally use, release, publish, or otherwise make available to any other person information obtained from the state electronic verification system for any purpose other than a purpose specified in this section.     (b) Each separate violation of this Subsection (9) is:   (i) a third degree felony; and     (ii) subject to a civil penalty not to exceed $5,000.       (c) The department shall determine a civil violation of this Subsection (9) in accordance with Title 63G, Chapter 4, Administrative Procedures Act.     (d) Civil penalties assessed under this Subsection (9) shall be deposited into the General Fund.     (e) This Subsection (9) does not prohibit a person who obtains information from the state electronic verification system under Subsection (2)(a), (c), or (f) from:   (i) including the information in the person's medical chart or file for access by a person authorized to review the medical chart or file;     (ii) providing the information to a person in accordance with the requirements of the Health Insurance Portability and Accountability Act of 1996; or     (iii) discussing or sharing that information about the patient with the patient.        Amended by Chapter 17, 2021 General SessionAmended by Chapter 337, 2021 General SessionAmended by Chapter 344, 2021 General SessionAmended by Chapter 350, 2021 General Session