Alabama Administrative Code › Title 538 - ALABAMA MEDICAL CANNABIS COMMISSION › Chapter 538-X-4 - Licensee Requirements - Generally › Section 538-X-4-.05 - Maintenance Of Proper Technology

Current through Register Vol. 42, No. 9, June 28, 2024
(1) Licensees shall, at all times, maintain
			 technology (whether proprietary, provided through a third party, or if
			 applicable, through the Statewide Seed-to-Sale Tracking System), and through
			 such technology shall track information, sufficient to comply with the
			 requirements of §
								20-2A-60,
Code of Ala. 1975
, (as amended), and any other
			 requirements of the Commission. Tracking information contained in any databases
			 created or maintained by such licensees shall be updated no less often than
			 daily (during the next business day after the incident is discovered or new
			 information has been received) and maintained for a minimum of six years or
			 longer at the request of the Commission, law enforcement personnel, or any
			 court having jurisdiction of a matter arising out of or relating to the
			 information so tracked.
(2)
			 Licensees' network security shall, at a minimum, comply with cyber security
			 standards set by the International Society of Automation (ISA) and the
			 International Electrotechnical Commission (IEC) standard ISA/IEC 62443
			 applicable to industrial facilities operated by manufacturers of medical or
			 pharmaceutical businesses.
(3)
			 Licensees shall bear the cost of technology sufficient to comply with the
			 requirements of §
								20-2A-60.
			 The Commission will not pay for licensees' systems or upgrades, RFIDs,
			 barcodes, and/or hardware. Licensees' costs are outside the scope of the
			 Commission's responsibility to maintain or procure; such responsibility, at all
			 times, remains upon each licensee to procure the necessary technology for
			 itself.
(4) Consistent with the
			 requirements of §
								20-2A-54,
Code of Ala. 1975
, (as amended), licensees shall
			 support, participate in, and contribute to the Statewide Seed-to-Sale Tracking
			 System. The licensee shall ensure that its third-party inventory and tracking
			 systems, if any, shall properly interface with the Statewide Seed-to-Sale
			 Tracking System and, as appropriate, with the patient registry. Licensees'
			 technology and uploads to the Statewide Seed-to-Sale Tracking System shall be
			 sufficient to allow access to said system by the Commission, and, to the extent
			 necessary and appropriate, patients and caregivers, qualified certifying
			 physicians, other state agencies, other licensees, and law enforcement
			 personnel, for all purposes set forth in said section.
(5) Notwithstanding any other requirements
			 for training or continuing education, all individuals who as part of their
			 duties to licensees must interact with the patient registry, the AMCC website,
			 or the Statewide Seed-to-Sale Tracking System, shall undergo pre-employment
			 (or, for new licensees, pre-commencement) IT certification for each database
			 with which they must interact, demonstrating their proficiency in respect to
			 those databases. IT certification as set forth herein shall be administered by
			 the third-party IT provider, or another, as the Commission may
			 designate.
(6) Licensees shall
			 identify to the Commission an individual, by name and position within the
			 licensee's business, who shall be the designated liaison with the Commission
			 for purposes of coordinating, monitoring, and updating the Licensee's input to
			 the Statewide Seed-to-Sale- Tracking System.
(7) Licensees shall take all necessary steps
			 to ensure the confidentiality of the information received, maintained, and
			 uploaded to any of the above databases.
Author:
William H. Webster
Statutory Authority:
Code of Ala.
				  1975
, §§
										20-2A-22, as
				  amended.