ARC 7360C

ARC 7360C

PUBLIC HEALTH DEPARTMENT[641]

Notice of Intended Action

Proposing rulemaking related to the medical cannabidiol program and providing an opportunity for public comment

The Department of Health and Human Services (HHS) hereby proposes to rescind Chapter 154, "Medical Cannabidiol Program," Iowa Administrative Code, and to adopt a new chapter with the same title.

Legal Authority for Rulemaking

This rulemaking is proposed under the authority provided in Iowa Code chapter 124E.

State or Federal Law Implemented

This rulemaking implements, in whole or in part, Iowa Code chapter 124E.

Purpose and Summary

Proposed Chapter 154 implements a medical cannabidiol program for the in-state manufacture and dispensing of medical cannabis products for patients with qualifying debilitating medical conditions. Registration cards to purchase at a dispensary in Iowa are issued to patients who are at least 18 years of age, who are permanent residents of Iowa, and who are determined by a health care practitioner to suffer from a medical condition that qualifies for use of medical cannabidiol. Registration cards may also be issued to the primary caregivers of such patients.

The chapter defines licensing requirements for medical cannabidiol manufacturers and dispensaries, fees for application and licensure, safety protocols, marketing and advertising restrictions, and limits on manufacturing and dispensing. Manufacturers may only manufacture products in the forms recommended by the Medical Cannabidiol Board and approved by the Board of Medicine. The General Assembly maintains sole authority to revise the definition of medical cannabidiol.

The HHS maintains a secure sales and inventory tracking system available to dispensaries 24 hours a day, seven days a week for the purpose of verifying that a person is lawfully in possession of a registration card and for tracking the date of the sale and quantity purchased. This system tracks products and inventory from creation by a manufacturer to transfers for testing and delivery, dispensing at a dispensary, and chain of custody or "seed-to-sale."

A Regulatory Analysis, including the proposed rule text, was published on November 1, 2023. A public hearing was held on November 28, 2023. The HHS received no public comments. The Administrative Rules Coordinator provided preclearance for publication of this Notice of Intended Action on December 4, 2023.

Fiscal Impact

This rulemaking has no fiscal impact to the State of Iowa.

Jobs Impact

After analysis and review of this rulemaking, no impact on jobs has been found.

Waivers

Any person who believes that the application of the discretionary provisions of this rulemaking would result in hardship or injustice to that person may petition the HHS for a waiver of the discretionary provisions, if any, pursuant to 441—Chapter 6.

Public Comment

Any interested person may submit written comments concerning this proposed rulemaking. Written comments in response to this rulemaking must be received by the HHS no later than 4:30 p.m. on February 26, 2024. Comments should be directed to:

Public Hearing

Public hearings at which persons may present their views orally or in writing will be held as follows:

Persons who wish to make oral comments at a public hearing may be asked to state their names for the record and to confine their remarks to the subject of this proposed rulemaking.

Any persons who intend to attend a public hearing and have special requirements, such as those related to hearing or mobility impairments, should contact the HHS and advise of specific needs.

Review by Administrative Rules Review Committee

The Administrative Rules Review Committee, a bipartisan legislative committee which oversees rulemaking by executive branch agencies, may, on its own motion or on written request by any individual or group, review this rulemaking at its regular monthly meeting or at a special meeting. The Committee's meetings are open to the public, and interested persons may be heard as provided in Iowa Code section 17A.8(6).

The following rulemaking action is proposed:

Item 1. Rescind 641—Chapter 154 and adopt the following new chapter in lieu thereof:

CHAPTER 154

MEDICAL CANNABIDIOL PROGRAM

641—154.1(124E) Definitions. For the purposes of these rules, the following definitions shall apply:

"Acceptance criteria" means the specified limits placed on characteristics of an item or method that are used to determine data quality.

"Action level" means the threshold value that provides the criterion for determining whether a sample passes or fails a test performed pursuant to these rules.

"Advertisement" means all representations disseminated in any manner or by any means, other than by labeling, for the purpose of inducing, or which are likely to induce, directly or indirectly, the purchase of medical cannabidiol.

"Analyte" means a chemical, compound, element, bacteria, yeast, fungus, or toxin to be identified or measured.

"Analytical batch" means a group of samples that are prepared together for the same analysis and analyzed sequentially using the same instrument calibration curve and common analytical quality control checks.

"Analytical method" means a technique used qualitatively or quantitatively to determine the composition of a sample or a microbial contamination of a sample.

"Audit" means a review by authorized personnel that includes select scope engagement or other methods of review that analyze operational or compliance issues.

"Background investigation" means a thorough review of an entity, an owner, investors, and employees conducted by the department of public safety, including but not limited to state and national criminal history records, credit records, and internal revenue service records.

"Batch" means a specifically identified quantity of dried flower and other cannabis plant matter that is uniform in strain or cultivar, harvested at the same time, and cultivated using the same pesticides and other crop inputs.

"Biosecurity" means a set of preventative measures designed to reduce the risk of transmission of:

1.Infectious diseases in crops;

2.Quarantined pests;

3.Invasive alien species;

4.Living modified organisms.

"Cannabinoid" means a chemical compound that is unique to and derived from cannabis.

"Cannabis" means seeds, plants, cuttings, or plant waste material from Cannabis sativa L. or Cannabis indica used in the manufacture of medical cannabidiol.

"CBD" means cannabidiol, Chemical Abstracts Service number 13956-29-1.

"CBDA" means cannabidiolic acid, Chemical Abstracts Service number 1244-58-2.

"Certificate of analysis" means the report prepared for the requester about the analytical testing performed and the results obtained by a laboratory.

"Certified" means that a laboratory demonstrates to the satisfaction of the department its ability to consistently produce valid data within the acceptance limits as specified in the department's requirements for certification and meets the minimum requirements of this chapter and all applicable regulatory requirements.

"Certified reference material" means a reference material prepared by a certifying body.

"Combusted" means the addition of a flame to medical cannabidiol or raw flower cannabis for the purposes of burning for inhalation, or smoking cannabis.

"Consumable hemp product" means a hemp product that includes a substance that is metabolized or is otherwise subject to a biotransformative process when introduced into the human body.

1.A consumable hemp product may be introduced into the human body by ingestion or absorption by any device including but not limited to an electronic device.

2.A consumable hemp product may exist in a solid or liquid state.

3.A hemp product is deemed to be a consumable hemp product if it is any of the following:

●Designed by the processor, including the manufacturer, to be introduced into the human body.

●Advertised as an item to be introduced into the human body.

●Distributed, exported, or imported for sale or distribution to be introduced into the human body.

"Consumable hemp product" includes but is not limited to any of the following:

1.A noncombustible form of hemp that may be digested, such as food; internally absorbed, such as chew or snuff; or absorbed through the skin, such as a topical application.

2.Hemp processed or otherwise manufactured, marketed, sold, or distributed as food, a food additive, a dietary supplement, or a drug.

"Consumable hemp product" does not include a hemp product if the intended use of the hemp product is introduced into the human body by any method of inhalation, as prohibited under Iowa Code section 204.14A.

"Crop input" means any substance applied to or used in the cultivation and growth of a cannabis plant. "Crop input" includes, but is not limited to, pesticides, fungicides, fertilizers, and other soil or medium amendments.

"Date of expiration" means one year from the date of issuance of the medical cannabidiol registration card by the department of transportation.

"Date of issuance" means the date of issuance of the medical cannabidiol registration card by the department.

"Debilitating medical condition" means the same as defined in Iowa Code section 124E.2.

"Dispensary" means an individual or entity licensed by the department to dispense medical cannabidiol to patients and primary caregivers pursuant to Iowa Code chapter 124E and these rules. "Dispensary" includes the employees and agents of the dispensary.

"Dispensary facility" means any secured building, space, grounds, and physical structure of a dispensary licensed by the department to dispense medical cannabidiol and where the dispensing of medical cannabidiol is authorized.

"Dispense" or "dispensing" means to supply medical cannabidiol to patients pursuant to Iowa Code chapter 124E and these rules.

"Disqualifying felony offense" means the same as defined in Iowa Code section 124E.2.

"Edible medical cannabidiol products" means food items containing medical cannabidiol. "Edible medical cannabidiol products" does not include pills, tinctures, oils, or other forms of medical cannabidiol that may be consumed orally or through the nasal cavity that do not contain food or food additives; provided that food or food additives used as carriers, excipients, or processing aids shall not be considered food or food additives.

"Field duplicate sample" means a sample that is taken in the identical manner and from the same batch, process lot, or lot being sampled as the primary sample. A field duplicate sample is analyzed separately from the primary sample and is used for quality control only.

"Health care practitioner" means the same as defined in Iowa Code section 124E.2.

"Inspection" means an on-site evaluation by the department, the department of public safety, or a department-approved independent consultant of facilities, records, personnel, equipment, methodology, and quality assurance practices for compliance with these rules.

"Investor" means a person making a cash investment of at least 5 percent interest in an applicant or licensed manufacturer or dispensary with the expectation of receiving financial returns.

"Laboratory" means the same as defined in Iowa Code section 124E.2.

"Limit of detection" or "LOD" means the lowest quantity of a substance or analyte that can be distinguished from the absence of that substance within a stated confidence limit.

"Limit of quantitation" or "LOQ" means the minimum concentration of an analyte in a specific matrix that can be reliably quantified while also meeting predefined goals for bias and imprecision.

"Lot" means a specific quantity of medical cannabidiol that is uniform and intended to meet specifications for identity, strength, purity, and composition, and that is manufactured, packaged, and labeled during a specified time period according to a single manufacturing, packaging, and labeling record.

"Lot number" means a unique numeric or alphanumeric identifier assigned to a lot by a manufacturer when medical cannabidiol is produced. The lot number shall contain the manufacturer's number and a sequence to allow for inventory, traceability, and identification of the plant batches used in the production of a lot of medical cannabidiol.

"Manufacture" or "manufacturing" means the process of converting harvested cannabis plant material into medical cannabidiol.

"Manufacturer" means an individual or entity licensed by the department to produce medical cannabidiol and distribute it to dispensaries pursuant to Iowa Code chapter 124E and these rules. "Manufacturer" includes the employees and agents of the manufacturer.

"Manufacturing facility" means any secured building, space, grounds, and physical structure of a manufacturer for the cultivation, harvesting, packaging, processing, storage, and distribution of cannabis or medical cannabidiol and where access is restricted to designated employees of a manufacturer and escorted visitors.

"Matrix" means the component or substrate that contains the analyte of interest.

"Matrix spike duplicate" means a duplicate sample prepared by adding a known quantity of a target analyte to a field sample matrix or other matrix that is as closely representative of the matrix under analysis as possible.

"Matrix spike sample" means a sample prepared by adding a known quantity of the target analyte to a field sample matrix or to a matrix that is as closely representative of the matrix under analysis as possible.

"Medical assistance program" means IA Health Link, Medicaid Fee-for-Service, or hawki, as administered by the Iowa Medicaid enterprise of the department.

"Medical cannabidiol" means the same as defined in Iowa Code section 124E.2.

"Medical cannabidiol waste" means medical cannabidiol that is unused, unwanted, damaged, defective, expired, or contaminated and that is returned to a dispensary or manufacturer for disposal.

"Medical cannabis goods" means medical cannabidiol process lots, medical cannabidiol products, and cannabis plant material, including dried tissue.

"Method blank" means an analyte-free matrix to which all reagents are added in the same volumes or proportions as are used in sample preparation.

"National criminal history background check" means fingerprint processing through the department of public safety and the Federal Bureau of Investigation (FBI) and review of records on file with national organizations, courts, and law enforcement agencies to the extent allowed by law.

"Owner" means a person with a 5 percent or greater ownership interest in an applicant or licensed manufacturer or dispensary.

"Patient" means a person who is a permanent resident of the state of Iowa who suffers from a debilitating medical condition that qualifies for the use of medical cannabidiol pursuant to Iowa Code chapter 124E and these rules.

"Patient registration number" means the unique identification number issued to a patient by the department upon approval of a patient's application by the department as described in these rules.

"Percent recovery" means the percentage of a measured concentration relative to the added (spiked) concentration in a reference material, matrix spike sample, or matrix spike duplicate.

"Plant material" means any plant of Cannabis sativa L. or Cannabis indica, or any part thereof, including flowers, leaves, trichomes, and tissue.

"Plant material waste" means plant material that is not used in the production of medical cannabidiol in a form allowable under these rules.

"Primary caregiver" means the same as defined in Iowa Code section 124E.2.

"Primary care provider" means any health care practitioner involved in the diagnosis and treatment of a patient's debilitating medical condition.

"Primary sample" means a portion of a batch, process lot, or lot that is used for testing for identity, strength, purity, and composition.

"Process lot" means any amount of cannabinoid concentrate or extract that is uniform, produced from one or more batches, and used for testing for identity, strength, purity, and composition prior to being packaged.

"Product expiration date" means the date after which a medical cannabidiol product is sold by a manufacturer or a dispensary.

"Production" or "produce" means:

1.Cultivating or harvesting plant material;

2.Processing or manufacturing; or

3.Packaging of medical cannabidiol.

"Proficiency test" means an evaluation of a laboratory's performance against preestablished criteria by means of interlaboratory comparisons of test measurements.

"Qualitative analysis" means identification of an analyte in a substance or mixture.

"Quality assurance" means a set of operating principles to produce data of known accuracy and precision. "Quality assurance" encompasses employee training, equipment preventative maintenance procedures, calibration procedures, and quality control testing, among other things.

"Quality control" means a set of measures implemented within an analytical procedure to ensure that the measurement system is operating in a state of statistical control in which errors have been reduced to acceptable levels.

"Quality control samples" means samples produced and used for the purpose of ensuring quality control. Quality control samples include but are not limited to blank samples, spike samples, duplicate samples, and reference material samples.

"Reagent" means a compound or mixture added to a system to cause a chemical reaction or to test if a reaction occurs. A reagent may be used to tell whether or not a specific chemical substance is present by causing a reaction to occur with the chemical substance.

"Recall" means the return of medical cannabidiol from patients and dispensaries to a manufacturer because of the potential for serious health consequences from the use of the medical cannabidiol.

"Reference material" means a material containing a known concentration of an analyte of interest that is in solution or in a homogeneous matrix. Reference material is used to document the bias of the analytical process.

"Relative percent difference" or "RPD" means a comparative statistic used to calculate precision or random error. RPD is calculated using the following equation: RPD = absolute value (primary sample measurement - duplicate sample measurement) / ([primary sample measurement + duplicate sample measurement] / 2) × 100.

"Requester" means a person who submits a request to a licensed testing laboratory for state-mandated testing of medical cannabis goods. The requester may be a licensed manufacturer or the department.

"Residual solvents and processing chemicals" means volatile organic chemicals that are used or produced in the manufacture or production of medical cannabidiol.

"Restricted access area" means a building, room, or other contiguous area on the premises where plant material is grown, cultivated, harvested, stored, packaged, or processed for sale under control of the manufacturer, and where no person under the age of 18 is permitted.

"Sample" means a representative part of or a single item from a larger whole or group.

"Sanitize" means to sterilize, disinfect, or make hygienic.

"Security alarm system" means the same as defined in rule 661—277.2(100C).

"Semiquantitative analysis" means less than quantitative precision and does not involve a full calibration. Analyte identification is based on a single-point reference or high-probability library match. The determination of amount uses the ratio of the unknown chemical analyte to that of a known analyte added to the sample before analysis. Uncertainty for semiquantitative results is higher than for quantitative results.

"Significant figures" means the number of digits used to express a measurement.

"Stability study" or "studies" means the process of determining the shelf-life or expiration date of a medical cannabidiol product. After storage of an unopened package of medical cannabidiol at a licensed manufacturing facility or dispensary facility, the contents shall not vary in concentrations of THC and CBD by more than an amount determined by the department and listed in the laboratory testing requirements and acceptance criteria document described in 641—Chapter 154.

"Standard operating procedure" means a written document that provides detailed instructions for the performance of all aspects of an analysis, operation, or action.

"Synthetic or semisynthetic cannabinoid" means a cannabinoid extracted from a cannabis plant, a cannabis flower, a hemp plant, or hemp plant parts with a chemical makeup that is changed after extraction to create a different cannabinoid or other chemical compound by applying a catalyst other than heat or light. "Synthetic or semisynthetic derived cannabinoid" includes but is not limited to any tetrahydrocannabinol created from cannabidiol.

"Tamper-evident" means that one or more one-time-use seals are affixed to the opening of a package, allowing a person to recognize whether or not the package has been opened.

"Testing laboratory record" means information relating to the testing laboratory and the analyses it performs that is prepared, owned, used, or retained by the laboratory and includes electronic files and video footage.

"THC" or "delta-9 THC" means tetrahydrocannabinol, Chemical Abstracts Service number 1972-08-3.

"THCA" means tetrahydrocannabinolic acid, Chemical Abstracts Service number 23978-85-0.

"Total tetrahydrocannabinol" means 87.7 percent of the amount of tetrahydrocannabinolic acid plus the amount of tetrahydrocannabinol.

"Tracking number" means the sales identification number assigned by a dispensary to a transaction at the time of the sale of a medical cannabidiol product.

"Trade name" means the name that manufacturers give to a product or range of products.

"Validation" means the confirmation by examination and objective evidence that the particular requirements for a specific intended use are fulfilled.

"Vaporization" means the heating of a medical cannabidiol concentrate or extract to a specific temperature using a device. For the purposes of these rules, vaporization does not include raw or dried cannabis flower.

"Valid photo identification" means any of the following for a patient or primary caregiver: (1) valid Iowa driver's license, (2) valid Iowa nonoperator's identification card, (3) an alternative form of valid photo identification. An individual who possesses or is eligible for a driver's license or a nonoperator's identification card shall present such document as valid photo identification. An individual who is ineligible to obtain a driver's license or a nonoperator's identification card may apply for an exemption and request submission of an alternative form of valid photo identification. An individual who applies for an exemption is subject to verification of the primary caregiver's identity through a process established by the department to ensure the genuineness, regularity, and legality of the alternative form of valid photo identification.

"Written certification" means a document signed by a health care practitioner, with whom the patient has established a patient-provider relationship, which states that the patient has a debilitating medical condition and identifies that condition and provides any other relevant information.

REGISTRATION CARDS

641—154.2(124E) Health care practitioner certification—duties and prohibitions.

154.2(1) Prior to a patient's submission of an application for a medical cannabidiol registration card pursuant to this rule, a health care practitioner shall follow all provisions of Iowa Code section 124E.3, this chapter and requests from the department for more information.

a. The written documentation required by Iowa Code section 124E.3(1)"a" shall be submitted on the application form at the department's website.

b. Explanatory information pursuant to Iowa Code section 124E.3(1)"b" is located at the department's website.

154.2(2) A health care practitioner may make a written request to the department to rescind a written certification the practitioner previously provided, based on reasons deemed appropriate by the health care practitioner.

154.2(3) Health care practitioner prohibitions. A health care practitioner shall not:

a. Accept, solicit, or offer any form of remuneration from or to any individual, including but not limited to a patient, a primary caregiver, or an employee, investor, or owner of a manufacturer or dispensary for the purposes of:

(1)Certifying a patient's condition, other than accepting a fee for a patient consultation to determine if the patient should be issued a certification under Iowa Code chapter 124E.

(2)Certifying an individual as a primary caregiver, other than accepting a fee for a consultation to determine if the individual is a necessary caretaker taking responsibility for managing the well-being of the patient with respect to the use of medical cannabidiol.

b. Advertise the certification of patients as one of the health care practitioner's services.

c. Certify a qualifying debilitating medical condition for a patient who is the health care practitioner or a family or household member of the health care practitioner.

d. Be designated to act as a primary caregiver for a patient for whom the health care practitioner has certified a qualifying debilitating medical condition.

e. Receive or provide medical cannabidiol product samples.

641—154.3(124E) Medical cannabidiol registration card—application and issuance to patient.

154.3(1) The department may issue a registration card to a patient who meets the criteria listed at Iowa Code section 124E.4(1). The application form is available on the department's website. The department shall not approve an application that does not include the information requested on the application form.

154.3(2) Upon the completion, verification, and approval of the patient's application and the receipt of the required fee, the department shall issue a registration card to the patient.

154.3(3) A registration card issued to a patient shall contain all of the following:

a. The patient's full legal name, Iowa residence address, date of birth, and sex designation, as shown on the patient's valid photo identification. If the patient's information has changed since the issuance of the patient's valid photo identification, the patient shall first update the patient's valid identification to reflect the patient's current information.

b. The date of issuance and the date of expiration, which shall be one year from the date of issuance.

c. A distinguishing registration number that is not the patient's social security number.

d. A statement that the registration card is not valid for identification purposes.

154.3(4) Every patient 18 years of age or older must obtain a valid registration card to use medical cannabidiol in Iowa.

154.3(5) An authorization to use medical cannabidiol or cannabis for medicinal purposes issued by another state, territory, or jurisdiction does not satisfy the requirements of Iowa Code chapter 124E and is not a valid registration card for purposes of purchasing medical cannabidiol at dispensaries in Iowa.

641—154.4(124E) Medical cannabidiol registration card—reciprocity. A registration card's reciprocity with other states is established in Iowa Code section 124E.18.

154.4(1) A patient with a valid registration card from another state or jurisdiction maintains the affirmative defense for possession of medical cannabidiol provided the cannabis product in the patient's possession may be manufactured and sold at a licensed dispensary in Iowa.

154.4(2) A patient with a valid registration card under the laws of another state or jurisdiction has no affirmative defense for possession of medical cannabidiol if the cannabis product in their possession may not be manufactured and sold at a licensed dispensary in Iowa. Prohibited forms of medical cannabidiol include:

a. Raw cannabis flower that may be combusted or smoked;

b. Edible products with a "total THC" concentration greater than 0.3 percent that is not a consumable hemp product.

641—154.5(124E) Medical cannabidiol registration card—application and issuance to primary caregiver.

154.5(1) For a patient in a primary caregiver's care, the department may issue a registration card to a primary caregiver who meets the criteria listed at Iowa Code section 124E.4(3). The application form is available on the department's website. The department shall not approve an application that does not include the information requested on the application form.

154.5(2) Upon the completion, verification, and approval of the primary caregiver's application, the department shall issue a registration card to the primary caregiver.

154.5(3) A registration card issued to a primary caregiver shall contain all of the following:

a. The primary caregiver's full legal name, current residence address, date of birth, and sex designation, as shown on the primary caregiver's valid photo identification. If the primary caregiver's information has changed since issuance of the primary caregiver's valid photo identification, the primary caregiver shall first update the primary caregiver's valid photo identification to reflect the primary caregiver's current information.

b. The date of issuance and the date of expiration, which shall be one year from the date of issuance.

c. A distinguishing registration number that is not the primary caregiver's social security number.

d. The registration number for each patient in the primary caregiver's care. This number shall not be the primary caregiver's or patient's social security number. If the patient in the primary caregiver's care is under the age of 18, the full name of the patient's parent or legal guardian shall be printed on the primary caregiver's registration card in lieu of the patient's registration number.

e. A statement that the registration card is not valid for identification purposes.

f. A statement distinguishing the registration cardholder as a primary caregiver.

154.5(4) An authorization to use, or to act as a primary caregiver for a patient authorized to use medical cannabidiol or cannabis for medicinal purposes issued by another state, territory, or jurisdiction does not satisfy the requirements of Iowa Code chapter 124E and is not a valid registration card for purposes of purchasing medical cannabidiol at dispensaries in Iowa.

641—154.6(124E) Denial and cancellation. The department may deny an application for a registration card, or may cancel a registration card, for any of the following reasons:

1.Information contained in the application is illegible, incomplete, falsified, misleading, deceptive, or untrue.

2.The department is unable to verify the identity of the applicant from the photo identification or other documentation presented during application.

3.The department has reasonable belief, or proof, that the patient is engaged in diversion of medical cannabidiol.

4.The applicant violates or fails to satisfy any of the provisions of Iowa Code chapter 124E or these rules.

5.A patient, the patient's legal guardian, or other person with durable power of attorney requests in writing that the department cancel the patient's registration card. The department shall notify a primary caregiver in writing when the registration card of the primary caregiver's patient has been canceled.

6.A primary caregiver requests in writing that the department cancel the primary caregiver's registration card. The department shall notify a patient in writing when the registration card of the patient's primary caregiver has been canceled.

7.The department becomes aware of the death of a patient or primary caregiver.

8.A health care practitioner requests in writing that the department rescind the written certification the practitioner provided to a patient or caregiver.

9.A patient requests in writing that the department cancel the patient's primary caregiver's registration card.

641—154.7(124E) Appeal.

154.7(1) Written notice of denial or cancellation. If the department denies an application for or cancels a registration card, the department shall inform the applicant or cardholder of the denial or cancellation, state the reasons for the denial or cancellation in writing, and state the effective date of the denial or cancellation. If the department cancels a card upon request from a patient or primary caregiver, or the department becomes aware of the death of a patient or primary caregiver, the cancellation is effective immediately upon issuance of the written notice of cancellation. If the department cancels a card upon any other ground listed, the cancellation shall become effective 30 days following issuance of the written notice of cancellation.

154.7(2) Effect of written notice of cancellation on use and possession of medical cannabidiol. A cardholder is authorized to purchase, possess, and use medical cannabidiol up to and including the effective date of the cancellation. For purposes of the affirmative defenses in Iowa Code section 124E.12, a patient or primary caregiver shall be deemed to be in possession of a valid registration card up to and including the effective date of the cancellation.

154.7(3) Request for appeal. A request for appeal concerning the denial or cancellation of a registration card shall be submitted pursuant to the provisions of 441—Chapter 7. In the event of a timely appeal, cancellation of the card shall be deemed to be suspended pending the outcome of the contested case proceeding. If the cancellation is affirmed following the contested case proceeding, the card cancellation shall become effective 30 days following issuance of the department's final agency action.

641—154.8(124E) Duplicate card.

154.8(1) Lost, stolen, or destroyed card. To replace a registration card that is lost, stolen, or destroyed, a cardholder shall present to the department the cardholder's valid photo identification that was provided at the time of application.

154.8(2) Change in card information and voluntary replacement.

a. To replace a registration card that is damaged, the cardholder shall surrender the card to be replaced to the department and present the cardholder's valid photo identification that was provided at the time of application.

b. A patient or primary caregiver to whom a registration card is issued shall notify the department of a change in information listed on the card, within ten calendar days of the change. To replace a registration card to change the patient or primary caregiver's information, the cardholder shall surrender the card to be replaced to the department and present the patient or primary caregiver's updated valid photo identification.

c. To replace a registration card held by a primary caregiver to change, add, or remove a patient's registration number or the name of a patient's parent or legal guardian listed on the primary caregiver's card, the primary caregiver shall submit a new application to the department pursuant to rule 641—154.5(124E). A registration card issued pursuant to this paragraph shall not be considered a duplicate card.

154.8(3) Expiration date. A duplicate registration card shall have the same expiration date as the registration card being replaced, changed, or amended.

641—154.9(124E) Renewal. A registration card shall be valid for one year from the date of issuance, unless canceled. Renewal of a registration card will follow the application and issuance rules of this chapter.

641—154.10(124E) Confidentiality. The department will follow the confidentiality provisions in Iowa Code section 124E.11(1).

154.10(1) Personally identifiable information of patients and primary caregivers will be maintained as confidential and is not accessible to the public. The department will release aggregate and statistical information regarding the registration card program in a manner that prevents the identification of any patient or primary caregiver.

154.10(2) Personally identifiable information of patients and primary caregivers may be disclosed only pursuant to Iowa Code section 124E.11(1)"b" and to a patient, primary caregiver, or health care practitioner, upon written authorization of the patient or primary caregiver.

641—154.11(124E) Fees. All fees are nonrefundable. Application fees are established in Iowa Code section 124E.4.

641—154.12(124E) Consumption of medical cannabidiol. Medical cannabidiol should be consumed privately, and patients are subject to all applicable laws regarding public impairment and operating a vehicle, including but not limited to Iowa Code section 123.46 and chapter 321J. Medical cannabidiol products shall not be consumed on the property of a medical cannabidiol dispensary or manufacturer.

641—154.13(124E) Allowable forms of medical cannabidiol.

154.13(1) Modification of allowable forms. Allowable forms of medical cannabidiol may be modified by approval of a recommendation by the medical cannabidiol board, subsequent approval of the board of medicine, and adoption of the recommendations by the department.

154.13(2) Allowable forms.

a. A manufacturer may only manufacture medical cannabidiol in the following forms:

(1)Oral forms, including but not limited to:

1.Tablet.

2.Capsule.

3.Liquid.

4.Tincture.

5.Sublingual.

(2)Topical forms, including but not limited to:

1.Gel.

2.Ointment, cream or lotion.

3.Transdermal patch.

(3)Inhaled forms, limited to:

1.Nebulizable.

2.Vaporizable.

(4)Rectal/vaginal forms, including but not limited to suppository.

b. A manufacturer shall not produce medical cannabidiol in any form that may be smoked.

c. A manufacturer shall not produce edible medical cannabidiol products.

MANUFACTURER AND DISPENSARY LICENSING

641—154.14(124E) Notice to law enforcement. The department shall notify local law enforcement agencies and the department of public safety of the locations of manufactures and dispensaries. If the department has sufficient cause to believe that there is a threat to public safety, the department shall notify local law enforcement agencies and the department of public safety.

641—154.15(124E) Manufacturer and dispensary licensure.

154.15(1) To be eligible for licensure, an applicant manufacturer or dispensary shall complete a background investigation pursuant to Iowa Code section 124E.19. Applicants must provide information on forms and in a manner required by the department of public safety.

154.15(2) The license shall be renewed annually unless a manufacturer or dispensary relinquishes the license, there is a change in state law prohibiting the department from renewing the license, or the license is revoked pursuant to Iowa Code chapter 124E or these rules.

154.15(3) A license to manufacture or dispense medical cannabidiol issued by the department is not assignable or transferable.

641—154.16(124E) Collection of fees in competitive licensing. Except as provided in this rule, all fees are nonrefundable, shall be retained by the department, and shall be considered repayment receipts as defined in Iowa Code section 8.2.

154.16(1) Fees to the department for manufacturers and dispensaries.

a. Fees for manufacturing applicants are established by Iowa Code section 124E.6(4). Fees for dispensary applicants are established by Iowa Code section 124E.8(4).

b. Licensed manufacturers and dispensaries shall pay an annual fee to the department to cover costs associated with regulating and inspecting, and for other expenses necessary for the administration of the medical cannabidiol program. The department shall assess the fee with the notice of approval of license, payable to the department no later than December 1. Annual fees assessed by the department shall not exceed $100,000 for a manufacturing license and shall not exceed $50,000 for a dispensary license.

154.16(2) Fees to the department of public safety.

a. An applicant manufacturer or dispensary shall reimburse the department of public safety the full cost of conducting background investigations related to an application for licensure. The department of public safety retains the right to bill a licensee for additional background investigations, as needed.

b. Each manufacturer or dispensary awarded a license shall, at the time of notice of award to license, submit to the department of public safety a deposit of $10,000 for each business owner subject to a background investigation and a national criminal history background check. Background investigation costs shall be deducted from the funds deposited. If the background investigation fees exceed the funds deposited, the applicant shall submit additional funds as required by the department of public safety. If the background investigation fees are less than the funds deposited, the department of public safety may refund or retain the fees as mutually agreed with the manufacturer or dispensary.

c. A licensed manufacturer or dispensary shall pay a deposit of $200 per employee to the department of public safety for a background investigation and a national criminal history background check on any person being considered for hire as an employee of the manufacturer or dispensary. Background investigation costs shall be deducted from the funds deposited. If the background investigation fees exceed the funds deposited, the manufacturer or dispensary shall submit additional funds as required by the department of public safety. If the background investigation fees are less than the funds deposited, the department of public safety may refund or retain the fees as mutually agreed with the manufacturer or dispensary. The department shall retain the right to preclude a potential employee from hire based upon the results of the background investigation and national criminal history background check.

154.16(3) Criminal background checks.

a. A manufacturer or the owner of a dispensary shall not have been convicted of a disqualifying felony offense and shall be subject to a background investigation conducted by the department of public safety, including but not limited to a national criminal history record check.

b. An employee of a manufacture or a dispensary shall not have been convicted of a disqualifying felony offense and shall be subject to a background investigation conducted by the department of public safety, including but not limited to a national criminal history background check.

c. An applicant or licensed manufacture or dispensary shall respond within 30 days to a request from the department or the department of public safety for more information to complete a background investigation and national criminal history background check on an owner, investor, or employee.

641—154.17(124E) Licensure renewal.

154.17(1) A licensed manufacturer or dispensary shall apply to renew its license with the department at least six months before the license expires. The application shall be submitted on a form on the department's website.

154.17(2) The department shall notify a manufacturer or dispensary of the decision to approve or deny the manufacturer or dispensary's license by August 1 of the year in which the renewal application is submitted.

641—154.18(124E) Suspension or revocation of a manufacturing or dispensary license.

154.18(1) The department may suspend or revoke a manufacturer or dispensary license upon any of the following grounds:

a. Submission of false, inaccurate, misleading, or fraudulent information to the department in the application or inspection processes.

b. Failure to submit required reports and documents.

c. Violation of Iowa Code chapter 124E or these rules, or violation of state or local law related to operation of the licensee.

d. Conduct or practices detrimental to the safety, health, or welfare of a patient, primary caregiver, or the public.

e. Criminal, civil, or administration action taken against a license or registration in this or another state or country related to manufacturing or dispensing medical cannabidiol.

f. False, misleading, or deceptive representations to the department, another state or federal agency, or a law enforcement agency.

g. Discontinuance of operation for more than 30 days, unless the department approves an extension of such period for good cause shown.

h. Failure to maintain effective controls against diversion, theft, or loss of medical cannabidiol.

i. Failure to correct a deficiency within the time frame required by the department.

j. Failure of a manufacturer or dispensary's business owner or investors to have a satisfactory result in a background investigation or national criminal history background check as determined by the department.

154.18(2) The department shall notify the manufacturer or dispensary of the proposed action pursuant to Iowa Code sections 17A.12 and 17A.18. Notice of issuance of a suspension or revocation shall be served by restricted certified mail, return receipt requested, or by personal service.

154.18(3) A request for appeal concerning the suspension or revocation of a license shall be submitted pursuant to the provisions of 441—Chapter 7.

641—154.19(124E) Assessment of penalties. The department shall assess to a manufacturer a civil penalty of up to $1,000 per violation of Iowa Code chapter 124E or these rules in addition to other applicable penalties.

641—154.20(124E) Closure of operations.

154.20(1) A manufacturer or dispensary shall notify the department at least six months before the closure of the manufacturing facility.

154.20(2) If a manufacturer or dispensary ceases operation, the manufacturer or dispensary shall work with the department to verify the remaining inventory of the manufacturer or dispensary and ensure that any plant material, plant material waste, and/or medical cannabidiol products are destroyed at a waste facility or returned to a manufacturer.

641—154.21(124E) Manufacturer and dispensary security requirements.

154.21(1) Restricted access. A manufacturer or dispensary shall limit entrance to all restricted areas by completing all of the following:

a. Mark restricted access areas with signs that state: "Do Not Enter – Restricted Access Areas Access Limited to Authorized Personnel Only".

b. Use a controlled access system that:

(1)Limits access to authorized individuals;

(2)Maintains a log of individuals with approved access, including dates of approvals and revocations;

(3)Tracks times of personnel entry to and exit from the facility;

(4)Stores data for retrieval for a minimum of one year; and

(5)Limits access to authorized individuals in the event of a power failure.

c. If the controlled access system cannot electronically record visitors, visitors to restricted access areas sign manifests with name, date, and times of entry and exit. These manifests shall be kept and stored for a minimum of one year.

d. Visitors wear badges that are visible at all times and identify them as visitors.

e. If requested by the department, submit stored controlled access system data to the department within five business days.

154.21(2) Perimeter intrusion detection system.

a. Computer-controlled video surveillance system. A manufacturer or dispensary shall operate and maintain a computer-controlled, closed-circuit television surveillance system on its premises that operates 24 hours per day, seven days a week, and visually records:

(1)All phases of medical cannabidiol production, if applicable;

(2)All areas that might contain plant material and/or medical cannabidiol;

(3)All points of entry and exit;

(4)The entrance to the video surveillance control room; and

(5)Parking areas, which shall have appropriate lighting for the normal conditions of the area under surveillance.

b. Camera specifications. Cameras shall:

(1)Capture clear and certain identification of any person entering or exiting a manufacturer or dispensary or its parking areas;

(2)Produce a clear, color still photograph live or from a recording;

(3)Have an embedded date-and-time stamp that is synchronized to the recording and does not obscure the picture; and

(4)Continue to operate during a power outage.

c. Video recording specifications. Video recording equipment shall:

(1)Export still images in an industry standard image format, such as .jpg, .bmp, or .gif;

(2)Archive exported video in a format that ensures authentication and guarantees that the recorded image has not been altered; and

(3)Save exported video shall be saved in an industry standard file format that can be played on a standard computer operating system.

d. Location. A dispensary shall maintain all security system equipment and recordings in a secure location to prevent theft, loss, destruction, corruption, and alterations.

e. Retention. A manufacturer or dispensary shall ensure that recordings from all video cameras are:

(1)Available for viewing by the department upon request;

(2)Retained for at least 60 days; and

(3)Maintained free of alteration or corruption.

f. Required signage. A manufacturer or dispensary shall post a sign in capital letters in a conspicuous location at every entrance to the manufacturing facility or dispensary that reads, "THESE PREMISES ARE UNDER CONSTANT VIDEO SURVEILLANCE."

154.21(3) Security alarm system requirements.

a. A manufacturer or dispensary shall use a professionally monitored security alarm system that provides intrusion and fire detection of all the following:

(1)Dispensary entrances and exits;

(2)Facility entrances and exits;

(3)Rooms with exterior windows;

(4)Rooms with exterior walls;

(5)Roof hatches;

(6)Skylights; and

(7)Storage rooms.

b. A manufacturer or dispensary's security alarm system and all devices shall continue to operate during a power outage.

c. A manufacturer or dispensary shall provide documentation of the annual inspection and device testing, by a qualified alarm vendor, to the department upon request.

154.21(4) Personnel identification system. A manufacturer or dispensary shall use a personnel identification system that controls and monitors individual employee access to restricted access areas.

a. An employee identification card shall contain:

(1)The name of the employee;

(2)The date of issuance and expiration;

(3)An alphanumeric identification number that is unique to the employee; and

(4)A photographic image of the employee.

b. A manufacturer or dispensary's employee shall keep the identification card visible at all times when the employee is in a manufacturing facility, a dispensary, or a vehicle transporting medical cannabidiol.

c. Upon termination or resignation of an employee, a manufacturer or dispensary shall immediately:

(1)Revoke the employee's access to the manufacturing facility or dispensary; and

(2)Destroy the employee's identification card, if possible.

641—154.22(124E) Advertising and marketing.

154.22(1) Permitted marketing and advertising activities. A manufacturer or dispensary must include medical cannabidiol pricing and hours of operation on its website and may do the following:

a. Display the manufacturer or dispensary's business name and logo on medical cannabidiol labels, signs, website, and informational material provided to patients. The name or logo shall not include:

(1)Images of cannabis or cannabis-use paraphernalia;

(2)Colloquial references to cannabis;

(3)Names of cannabis plant strains or varieties;

(4)Unsubstantiated medical claims; or

(5)Medical symbols that bear a reasonable resemblance to established medical associations.

b. Display signs on the manufacturing facility or dispensary; and

c. Maintain a business website that contains the following information:

(1)The manufacturer or dispensary's name and contact information;

(2)The medical cannabidiol forms and quantities manufactured or available in Iowa; and

(3)Other information as approved by the department.

154.22(2) Prohibited conduct, statements and illustration.

a. An advertisement for medical cannabidiol shall not contain:

(1)Colloquial references to cannabis;

(2)Names of cannabis plant strains or varieties;

(3)Any statement that is false or misleading;

(4)Any statement that disparages a competitor's products;

(5)Any statement, design, or representation, picture or illustration that is obscene or indecent;

(6)Any statement, design, representation, picture or illustration that reasonably appeals to or targets children. Appealing to children means:

1.When taken literally or as a plan language reading, there is a resemblance to food or product used by children;

2.Contains child-appealing visuals/graphics, such as intense colors, bubble letters, or other interesting fonts or lettering;

3.Unconventional or interesting product names;

4.Unconventional or unexpected flavor, color, or shape of the product;

5.Games or activities present on the package; or

6.Presence of branded characters, spokespersons, licensed characters, cartoons, or celebrities;

(7)Any statement, design, representation, picture or illustration that encourages or represents the use of medical cannabidiol for a condition other than a qualifying debilitating medical condition;

(8)Any statement, design, representation, picture or illustration that encourages or represents the recreational use of medical cannabidiol or marijuana, tobacco or nicotine products, or alcohol;

(9)Any statement, design, representation, picture or illustration related to the safety or efficacy of medical cannabidiol, unless supported by substantial evidence, substantial clinical data, and/or direct patient testimonials;

(10) Any statement, design, representation, picture or illustration portraying anyone reasonably appearing to be under the age of 18, objects suggestive of the presence of anyone under the age of 18, or containing the use of a figure, symbol or language that is customarily associated with anyone under the age of 18, except that an advertisement may address medical cannabidiol products as they relate to minor patients;

(11)Any offer of a prize, award or inducement to a qualifying patient, primary caregiver, or health care practitioner related to the purchase of medical cannabidiol or a certification for the use of medical cannabidiol, except that non-product specific price discounts are allowed;

(12)Any statement or assertion that medical cannabidiol products are safe because they are regulated under this chapter or have been tested by an approved laboratory;

(13)Any reference to a prohibited form of medical cannabidiol;

(14)Any statement that claims that medical cannabidiol products are endorsed or supported by any government agency; or

(15)Any statement that indicates or implies that the product or entity in the advertisement has been approved or endorsed by the department, the state of Iowa or any person or entity associated with the state of Iowa.

b. A manufacturer or dispensary shall not engage in any of the following activities:

(1)Host, promote, refer, or otherwise advertise a third-party patient certification service;

(2)Engage in any advertising, marketing, or branded educational activities within 1,000 feet of a school;

(3)Host, promote, sponsor, or otherwise participate in a cannabis consumption lounge or other such encouragement of public consumption of cannabis or medical cannabidiol; or

(4)Advertise, or make reference to, non-approved forms of medical cannabidiol in any of its advertisements, including, but not limited to:

1.Referring to an approved form of medical cannabidiol as a prohibited form of medical cannabidiol.

2.Advertising non-approved forms of medical cannabidiol. Consumable hemp products regulated under Iowa Code chapter 204 and 641—Chapter 156 are exempt from this provision.

154.22(3) Review of advertisements by the department. Any advertisement for medical cannabidiol shall be submitted to the department, on a form or in a format prescribed by the department, at the same time as, or prior to, the dissemination of the advertisement.

a. The department may:

(1)Require a specific disclosure be made in the advertisement in a clear and conspicuous manner if the department determines that the advertisement would be false or misleading without such a disclosure; or

(2)Require changes that are necessary to protect the public health, safety and welfare; or

(3)Require statements for inclusion in the advertisement to address the specific efficacy of medical cannabidiol as it relates to specific disease states or approved debilitating medical conditions, disease symptoms, and population groups.

b. The department reserves the right to require that a licensee amend or remove a public advertisement.

641—154.23(124E) Sales and inventory tracking system. The department shall establish and maintain a secure, electronic system that is available 24 hours a day, seven days a week to track:

1.Inventory of plant material and medical cannabidiol;

2.Transport of plant material, and laboratory samples;

3.Application and use of crop inputs and other solvents and chemicals;

4.Sales of medical cannabidiol to dispensaries;

5.Sales of medical cannabidiol from dispensaries to patients and primary caregivers.

641—154.24(124E) Financial transactions.

154.24(1) A manufacturer or dispensary shall maintain records that reflect all financial transactions and the financial condition of the business.

154.24(2) The following records shall be maintained for at least five years and made available for review, upon request of the department:

a. Purchase invoices, bills of lading, sales records, copies of bills of sale, and any supporting documents, to include the items or services purchased, from whom the items were purchased, and the date of purchase;

b. Bank statements and canceled checks for all business accounts;

c. Accounting and tax records; and

d. Records of all financial transactions, including contracts and agreements for services performed or services received.

641—154.25(124E) Inspection by department or independent consultant. A manufacturer or dispensary is subject to reasonable inspection by the department, a department-approved consultant, or other agency pursuant to Iowa Code chapter 124E and these rules and as authorized by laws and regulations.

154.25(1) Types of inspections. Inspections may include:

a. Aspects of the business operations;

b. The manufacturing facility or the physical location of a dispensary, including any storage facility;

c. Vehicles used for transport or delivery of medical cannabidiol or plant material;

d. Financial information and inventory documentation;

e. Physical and electronic security alarm systems;

f. Health and sanitary inspection; and

g. Other inspections as determined by the department.

154.25(2) Compliance required. A manufacturer or dispensary shall respond to deficiencies found during inspections or inventory reconciliation as follows:

a. Deficiencies not related to inventory reconciliation.

(1)Upon written notification by the department of deficiencies that do not involve reconciliation of inventory, a manufacturer or dispensary shall have up to 30 days to submit an action plan to the department with proposed remedies and timelines for completion of the remedies.

(2)The department shall have up to two weeks to accept or require revision of the action plan.

b. Deficiencies related to inventory reconciliation.

(1)Upon notifying the department that the manufacturer or dispensary cannot reconcile the physical inventory with the inventory recorded in the secure sales and inventory tracking system, the manufacturer or dispensary shall have up to two business days to submit an action plan to the department with proposed remedies and timelines for completion of the remedies.

(2)The department shall have up to two business days to accept or require revision of the action plan.

(3)Failure to complete actions in the action plan within the timelines mutually agreed upon by the manufacturer and the department shall result in assessment of penalties or in suspension or revocation of a manufacturer or dispensary license.

(4)At the department's request and in a timely manner, a manufacturer or dispensary shall pay for and undergo an independent health and sanitary inspection in accordance with this rule.

MANUFACTURING

641—154.26(124E) Manufacturer operations.

154.26(1) Operating documents.

a. A manufacturer shall maintain operating documents that accurately reflect the manufacturer's standard operating procedures. Unless otherwise noted, a manufacturer shall make the operating documents available to the department upon request, through secure means.

b. The operating documents of a manufacturer shall include all of the following:

(1)Procedures for the oversight of the manufacturer, including descriptions of operational and management practices regarding:

1.The forms and quantities of medical cannabidiol products that are produced at the manufacturing facility;

2.The methods of planting, harvesting, drying, and storing cannabis. A manufacturer may make operating documents for these procedures available on site only;

3.The estimated types and amounts of all crop inputs used in the production of medical cannabidiol;

4.The disposal methods for all waste materials;

5.Employee training methods for the specific phases of production. A manufacturer may make operating documents for these procedures available on site only;

6.Biosecurity measures and standard operating procedures used in the production and manufacturing of medical cannabidiol. A manufacturer may make operating documents for these procedures available on site only;

7.Strategies for identifying and reconciling discrepancies in inventory of plant material or medical cannabidiol;

8.Sampling strategy and quality testing for labeling purposes. A manufacturer may make operating documents for these procedures available on site only;

9.Medical cannabidiol packaging and labeling procedures;

10.Procedures for recall of medical cannabidiol;

11.Plans for responding to a security breach at a manufacturing facility or while medical cannabidiol is in transit to a dispensary. A manufacturer may make operating documents for these procedures available on site only;

12.A business continuity plan. A manufacturer may make this operating document available on site only;

13.Records relating to all transport activities; and

14.Other information requested by the department.

(2)Procedures to ensure accurate recordkeeping.

(3)Procedures for the implementation of appropriate security measures to deter and prevent the theft of medical cannabidiol and unauthorized entrance into areas containing medical cannabidiol. A manufacturer may make operating documents for these procedures available on site only.

154.26(2) Prohibited activities. In addition to following all provisions of Iowa Code section 124E.7, a manufacturer shall not:

a. Produce or manufacture medical cannabidiol in any location except in those areas approved by the department;

b. Sell, deliver, transport, or distribute medical cannabidiol from any location except its manufacturing facility or a dispensary facility;

c. Produce or manufacture medical cannabidiol in Iowa for sales or distribution outside of Iowa;

d. Sell or distribute medical cannabidiol to any person or business other than a dispensary or manufacturer licensed by the department under Iowa Code chapter 124E;

e. Refuse to sell, deliver, transport, or distribute medical cannabidiol in any form or quantity produced by the manufacturer to a dispensary, unless deemed appropriate in the manufacturer's reasonable business judgment and approved by the department in writing;

f. Transport or deliver medical cannabidiol to any location except as allowed in subrule 154.22(1);

g. Introduce synthetic or semisynthetic cannabinoids derived from hemp into medical cannabidiol products;

h. Produce synthetic or semisynthetic cannabinoids within the licensed manufacturing facility.

641—154.27(124E) Recordkeeping requirements.

154.27(1) Manufacturer sales and distribution. A manufacturer shall maintain complete and accurate electronic sales transaction records in the department's secure sales and inventory tracking system, including:

a. The date of each sale or distribution;

b. The item number, product name and description, and quantity of medical cannabidiol sold or otherwise distributed; and

c. The sale price.

154.27(2) Manufacturer operations and inventory reporting other records.

a. A manufacturer or dispensary shall maintain the following for at least five years, unless otherwise noted, and provide to the department upon request:

(1)All personnel records;

(2)Records of any theft, loss, or other unaccountability of any medical cannabidiol or plant material;

(3)Transportation manifests and incident reports; and

(4)Records of all samples sent to a testing laboratory and the quality assurance test results.

b. A manufacturer or dispensary shall maintain for at least one year and provide to the department upon request its controlled access system data and visitor manifests.

154.27(3) Manufacturer entry into the secure sales and tracking system.

a. A manufacturer or dispensary shall use the secure sales and inventory tracking system to maintain the following:

(1)Batch and harvest records;

(2)Crop input and additive records;

(3)Extraction and production records;

(4)Transportation records;

(5)Inventory records;

(6)Solvent and processing chemical records; and

(7)Other records as determined by the department.

b. Unless otherwise provided in these rules, a manufacturer shall adhere to the following schedule for entering data into the secure sales and inventory tracking system. A manufacturer shall enter data in real time for data related to:

(1)Transport of medical cannabidiol, plant material, and laboratory samples;

(2)Sales of medical cannabidiol to dispensaries;

(3)The creation of process lots containing a unique identifier; and

(4)The creation of package lots containing a unique identifier.

c. A manufacturer shall enter inventory reports on key inventory events into the secure sales and inventory tracking system within five business days in which the event occurred. These inventory reports include, but are not limited to:

(1)Batch reports;

(2)Crop input and additive reports;

(3)Harvest reports;

(4)Extraction reports;

(5)Solvent and processing chemical reports;

(6)Package lot reports;

(7)Certificates of Analysis from a laboratory;

(8)Other records as determined by the department.

d. State of Iowa Manufacturer API guide. The department shall maintain a document describing the IT requirements and acceptance criteria for reporting information to the secure sales and inventory tracking system. The department shall provide manufacturers no less than 14 days in which to comment on proposed revisions to the document, and the department shall provide no less than 30 days' notice before a revision takes effect. The document shall include:

(1)The schedule and means of data reporting;

(2)Integration requirements for third party vendors; and

(3)Be available on the department's website (hhs.iowa.gov).

641—154.28(124E) Recall of medical cannabidiol products. Medical cannabidiol products may be recalled in the following ways:

154.28(1) Voluntarily by a licensed manufacturer.

154.28(2) By the department. If the department determines, based on an evaluation, that there is a reasonable probability that use of, or exposure to, a violative medical cannabidiol product will cause a serious adverse health consequence or death, the department may require a manufacturer to recall such violative medical cannabidiol products from dispensaries. An evaluation of the health hazard presented by medical cannabidiol being considered for recall shall be conducted by an ad hoc committee of scientists appointed by the department and shall consider, but need not be limited to, each of the following factors:

a. Whether any disease or injuries have already occurred from the product.

b. Whether any existing conditions could contribute to a clinical situation that could expose humans to a health hazard. Any conclusion shall be supported as completely as possible by scientific documentation and/or statements that the conclusion is the opinion of the individual(s) making the health hazard determination.

c. A holistic assessment of the hazard and its present and future potential consequences.

641—154.29(124E) Quality assurance and control.

154.29(1) Quality control program. A manufacturer shall develop and implement a written quality assurance program that assesses the chemical and microbiological composition of medical cannabidiol. Assessment includes a profile of the active ingredients, including stability studies, and the presence of inactive ingredients and contaminants. A manufacturer shall use these testing results to determine appropriate storage conditions and product expiration dates.

154.29(2) Sampling protocols. A manufacturer shall develop and follow written procedures for sampling medical cannabidiol that require the manufacturer to:

a. Conduct sample collection in a manner that provides analytically sound and representative samples;

b. Document every sampling event and provide this documentation to the department upon request;

c. Describe all sampling and testing plans in written procedures that include the sampling method and the number of units per lot to be tested;

d. Ensure that random samples from each lot are:

(1)Taken in an amount necessary to conduct the applicable test;

(2)Labeled with the lot number; and

(3)Submitted for testing;

e. Retain the results from the random samples for at least five years; and

f. Notify the department at least two business days prior to sample collection and allow the department or its designees to be present to observe the sampling procedures when the samples are to be sent to a laboratory for testing.

154.29(3) Sampling and testing. A manufacturer shall:

a. Work with the department and laboratory personnel to develop acceptance criteria for contaminants, including, but not limited to, cannabinoid content, metals, microbiological impurities, solvents, or other contaminants that the manufacturer uses in cultivating and producing medical cannabidiol;

b. Conduct sampling and testing of plant material and medical cannabidiol lots using acceptance criteria that are protective of patient health. sampling methods results shall be approved by the department and laboratory personnel and shall ensure that lots of medical cannabidiol are homogenous and representative of the process or package lot;

c. Reject and destroy medical cannabidiol from a lot that fails to meet established standards, and any other relevant quality control criteria when remixing and retesting are not warranted;

d. Develop and follow a written procedure for responding to results failing to meet established standards, and any other relevant quality control criteria, including:

(1)Criteria for when remixing and retesting are warranted;

(2)Instructions for destroying contaminated or substandard medical cannabidiol when remixing and retesting are not warranted; and

(3)Instructions for determining the source of contamination;

e. Retain documentation of test results, assessment, and destruction of medical cannabidiol for at least five years.

154.29(4) Stability testing.

a. The quality assurance program shall include procedures for performing stability testing of each product type produced to determine product expiration dates. The procedures shall describe:

(1)Sample size and test intervals based on departmental guidance pursuant to subrule 154.47(1);

(2)Storage conditions for samples retained for testing; and

(3)Reliable and specific test methods.

b. Stability studies shall include:

(1)Medical cannabidiol testing at appropriate intervals; and

(2)Medical cannabidiol testing in the same container-closure system in which the medical cannabidiol is marketed and dispensed.

c. If product-expiration-date studies have not been completed a manufacturer shall assign a tentative product expiration date, not to exceed one year, based on any available stability information.

d. If a manufacturer determines a product expiration date beyond one year, a manufacturer shall submit justification to the department, and receive approval, prior to labeling a product with an expiration date beyond one year.

154.29(5) Reserve samples.

a. A manufacturer shall retain a uniquely labeled reserve sample that represents each lot of medical cannabidiol and store the reserve sample under conditions consistent with product labeling. The reserve sample shall be stored in the same immediate container-closure system in which the medical cannabidiol is marketed or in one that has similar characteristics. The reserve sample shall consist of at least twice the quantity necessary to perform all the required tests.

b. A manufacturer shall retain the reserve for at least one year from the date of manufacture.

c. After one year from the date of manufacture, reserve samples shall be destroyed.

154.29(6) Retesting. If the department deems that public health may be at risk, the department may require the manufacturer to retest any sample of medical cannabidiol.

154.29(7) Disposal of substandard product. A manufacturer shall dispose of all medical cannabidiol when samples fail to meet established standards, and other relevant quality control criteria.

154.29(8) Recall procedures. Each manufacturer shall establish a procedure for recalling product from the market that has a reasonable probability of causing an unexpected or harmful response in a patient population, despite appropriate use, that outweighs the potential benefit of the medical cannabidiol. This procedure shall include:

a. Factors that make a recall necessary;

b. Manufacturer's personnel who are responsible for overseeing the recall; and

c. How to notify affected parties of a recall.

641—154.30(124E) Packaging and labeling.

154.30(1) Trade names. A manufacturer's medical cannabidiol trade names shall comply with the following:

a. Names shall be limited to those that clearly reflect the form's medical cannabidiol nature;

b. Any name that is identical to, or similar to, the name of an existing nonmedical cannabidiol product is prohibited;

c. Any name that is identical to, or similar to, the name of an unlawful product or substance is prohibited; and

d. Any name that contains language that suggests using medical cannabidiol for recreational purposes or for a condition other than a qualifying debilitating medical condition is prohibited.

154.30(2) Medical cannabidiol packaging.

a. Requirements of medical cannabidiol package containers. The manufacturer shall use medical containers that are:

(1)Of sufficient size to accommodate a separate dispensary label containing the information described in paragraph 154.30(2)"c";

(2)Designed to maximize the shelf life of the contained medical cannabidiol;

(3)Tamper-evident; and

(4)Child-resistant.

b. Medical cannabidiol package prohibitions. The packaging for medical cannabidiol shall not:

(1)Bear a reasonable resemblance to commonly available nonmedical commercial products;

(2)Depict images other than the manufacturer's business name or logo on the packaging;

(3)Reasonably appeal to children. More information is provided in rule 641—154.22(2);

(4)Reasonably appeal to recreational or adult use; or

(5)Depict images other than the manufacturer's business name or logo on the packaging.

c. Requirements of medical cannabidiol packaging. A manufacturer shall ensure that all medical cannabidiol packaging includes the following information:

(1)The name of the manufacturer, and trade name if applicable;

(2)A label claim concentration for cannabinoid content including:

1.Tetrahydrocannabinol,

2.Tetrahydrocannabinolic acid; concentrations of tetrahydrocannabinolic acid may be omitted if the manufacturer uses decarboxylation or other means to substantially remove the acids from the product prior to testing;

3.Cannabidiol; and

4.Cannabidiolic acid; concentrations of cannabinolic acid may be omitted if the manufacturer uses decarboxylation or other means to substantially remove the acids from the product prior to testing;

(3)The number of servings per package;

(4)The directions for use of the product, including recommended and maximum amount by age and weight, if applicable;

(5)All ingredients of the product shown with common or usual names, including but not limited to, any additives, terpenes or artificial flavors, diluents and carriers, and preservatives, listed in descending order by predominance of weight. Any third-party hemp-derived cannabinoids into medical cannabidiol products shall be specifically indicated on the ingredients list, separately from medical cannabidiol produced within the manufacturer's facility;

(6)Instructions for storage, including light and temperature requirements, if any; and

(7)The universal warning symbol provided by the department.

d. The following information shall be included with medical cannabidiol packaging, or contained within a package insert:

(1)A notice with the statement, including capitalization: "This product has not been analyzed or approved by the United States Food and Drug Administration. There is limited information on the side effects of using this product, and there may be associated health risks and medication interactions. This product is not recommended for use by pregnant or breastfeeding women. KEEP THIS PRODUCT OUT OF REACH OF CHILDREN.";

(2)A notice with the statement: "This medical cannabidiol is for therapeutic use only. Use of this product by a person other than the patient listed on the label is unlawful and may result in the cancellation of the patient's medical cannabidiol registration card. Return unused medical cannabidiol to a dispensary for disposal.";

(3)A package may contain multiple labels if the information required by this rule is not obstructed.

154.30(3) Medical cannabidiol labeling.

a. After receiving a passing certification of analysis for a package lot from a laboratory, and prior to distribution to dispensaries, a manufacturer shall affix a label to each individual package of medical cannabidiol containing that contains following information:

(1)A unique lot number;

(2)The date of manufacture;

(3)Product expiration date. This date shall be one year from the date of manufacture unless a manufacturer has conducted stability studies, and received approval from the department for an extended expiration date.

b. Cannabinoid content for:

(1)Tetrahydrocannabinol;

(2)Tetrahydrocannabinolic acid, concentrations of tetrahydrocannabinolic acid may be omitted if the manufacturer uses chemical decarboxylation or other means to substantially remove the acids from the product prior to testing;

(3)Cannabidiol; and

(4)Cannabidiolic acid.

641—154.31(124E) Transportation of medical cannabidiol and plant material.

154.31(1) Transport of medical cannabidiol or plant material. A manufacturer is authorized to transport medical cannabidiol or plant material to and from:

a. Dispensaries;

b. A laboratory for testing;

c. A waste facility for disposal;

d. A manufacturer licensed by the department under Iowa Code chapter 124E;

e. Other sites only with departmental approval.

154.31(2) Chain-of-custody tracking system.

a. A manufacturer shall use the secure sales and inventory tracking system, if available, or a department-approved manifest system to track shipping of medical cannabidiol. The system shall include a chain of custody that records:

(1)The name and address of the destination;

(2)The unique ID of each individual process lot or package lot that is part of the shipment, and the total number of individual packages;

(3)The date and time the medical cannabidiol shipment is placed into the transport vehicle;

(4)The date and time the shipment is accepted at the delivery destination;

(5)The person's identity; and

(6)Any handling or storage instructions.

b. Before transporting medical cannabidiol, a manufacturer shall:

(1)Record in the secure sales and inventory tracking system or on the manifest information about the material to be transported; and

(2)Notify the dispensary, laboratory, manufacturer, or waste facility, as applicable, of the expected arrival time and transmit a copy of the manifest to the dispensary, laboratory, manufacturer, or waste facility, if applicable.

c. Each transport shall be approved electronically or in writing by:

(1)An authorized manufacturer employee when the transport vehicle is departing the manufacturing facility; and

(2)An authorized employee of the receiving dispensary, laboratory, manufacturer, or waste facility.

d. An authorized employee at the dispensary, laboratory, manufacturer, or waste facility receiving medical cannabidiol shall:

(1)Verify and document the type and quantity of the transported medical cannabidiol against the information in the secure sales and inventory tracking system or written manifest;

(2)Approve the transport electronically or return a signed copy of the manifest to the manufacturing facility; and

(3)Record the medical cannabidiol that is received as inventory in the secure sales and inventory tracking system, if available. If a manifest system is being used, the dispensary, laboratory, manufacturer, or waste facility shall also maintain a signed copy of manifest, and shall maintain records of the inventory received consistent with these rules.

e. A manufacturer shall maintain all manifests for at least five years and make them available upon request of the department.

154.31(3) Vehicle requirements for transport.

a. A manufacturer shall ensure that all medical cannabidiol transported on public roadways is:

(1)Packaged in tamper-evident, bulk containers;

(2)Transported so it is not visible or recognizable from outside the vehicle; and

(3)Transported in a vehicle that does not bear any markings to indicate that the vehicle contains medical cannabidiol or bears the name or logo of the manufacturer.

b. When the motor vehicle contains medical cannabidiol, manufacturer employees who are transporting the medical cannabidiol on public roadways shall:

(1)Travel directly to a dispensary or other department-approved locations; and

(2)Document refueling and all other stops in transit, including:

1.The reason for the stop;

2.The duration of the stop; and

3.The location of the stop.

c. If the vehicle must be stopped due to an emergency situation, the employee shall notify 911 and complete an incident report on a form approved by the department.

d. Under no nonemergency circumstance shall any person other than a designated manufacturer employee have actual physical control of the motor vehicle that is transporting the medical cannabidiol.

e. An employee in a transport motor vehicle shall have telephone access with the manufacturer's personnel.

641—154.32(124E) Disposal of medical cannabidiol and plant material.

154.32(1) Return of medical cannabidiol from dispensaries and laboratory. A manufacturer may collect at no charge medical cannabidiol waste from dispensaries. A manufacturer who chooses to collect medical cannabidiol waste may use it for research and development or retained samples, but the manufacturer shall not introduce medical cannabidiol returned from laboratory into lots of products intended for sale. Notwithstanding this provision, a manufacturer shall:

a. Dispose of medical cannabidiol waste; and

b. Maintain a written record of disposal.

154.32(2) Medical cannabidiol and plant material waste. A manufacturer shall store, secure, manage, and record medical cannabidiol waste and plant material waste in accordance with all applicable federal, state, and local regulations.

a. The manufacturer shall dispose of medical cannabidiol waste and plant material waste at an approved facility.

b. Before transport of plant material waste, the manufacturer shall render the plant material waste unusable and unrecognizable.

c. A manufacturer shall dispose of all liquid and chemical product waste generated in the process of cultivating, manufacturing, and distributing medical cannabidiol in accordance with applications regulations.

641—154.33(124E) Production requirements.

154.33(1) Cultivation and processing.

a. All phases of production shall take place in designated, restricted access areas in accordance with rule 641—154.21(124E).

b. The production process shall be designed to limit contamination.

c. Each production area shall allow for access, observation, and inventory of each plant group.

154.33(2) Crop inputs and plant batches.

a. The manufacturer shall use the secure sales and inventory tracking system to maintain an electronic record of all crop inputs. The record shall include the following:

(1)The date of input application;

(2)The name of the employee applying the crop input;

(3)The crop input that was applied;

(4)The plants that received the application; and

(5)A copy of or electronic link to the safety data sheet for the crop input applied.

b. At the time of harvesting, all plants shall be tracked in a batch process with a unique batch number that shall remain with the batch through final processing into medical cannabidiol.

c. Each batch or part of a batch of cannabis plants that contributes to a lot of medical cannabidiol shall be recorded in the secure sales and inventory tracking system or other manifest system.

154.33(3) Production of medical cannabidiol.

a. A manufacturer shall obtain approval from the department for use of any hydrocarbon-based extraction process.

b. Medical cannabidiol shall be prepared, handled, and stored in compliance with the sanitation requirements in this rule.

c. A manufacturer shall produce shelf-stable, nonperishable forms of medical cannabidiol.

d. A manufacturer shall ensure that the cannabinoid content of the medical cannabidiol it produces is homogenous.

e. Each lot of medical cannabidiol shall be assigned a unique lot number and recorded in the secure sales and inventory tracking system or other manifest system.

154.33(4) General sanitation requirements. A manufacturer shall take all reasonable measures and precautions to ensure that:

a. Any employee who has a communicable disease does not perform any tasks that might contaminate plant material or medical cannabidiol;

b. Hand-washing facilities are:

(1)Convenient and furnished with running water at a suitable temperature;

(2)Located in all production areas; and

(3)Equipped with effective hand-cleaning and -sanitizing preparations and sanitary towel service or electronic drying devices;

c. All employees working in direct contact with plant material and medical cannabidiol use hygienic practices while on duty, including:

(1)Maintaining personal cleanliness; and

(2)Washing hands thoroughly in a hand-washing area before starting work and at any other time when the hands may have become soiled or contaminated;

d. Litter and waste are routinely removed and the operating systems for waste disposal are routinely inspected;

e. Floors, walls, and ceilings are constructed with a surface that can be easily cleaned and maintained in good repair to inhibit microbial growth;

f. Lighting is adequate in all areas where plant material and medical cannabidiol are processed, stored, or sold;

g. Screening or other protection against the entry of pests is provided, including that rubbish is disposed of to minimize the development of odor and the potential for the waste becoming an attractant, harborage, or breeding place for pests;

h. Any buildings, fixtures, and other facilities are maintained in a sanitary condition;

i. Toxic cleaning compounds, sanitizing agents, and other potentially harmful chemicals are identified and stored in a separate location away from plant material and medical cannabidiol and in accordance with applicable local, state, or federal law;

j. All contact surfaces, utensils, and equipment used in the production of plant material and medical cannabidiol are maintained in a clean and sanitary condition;

k. The manufacturing facility water supply is sufficient for necessary operations;

l. Employees have accessible toilet facilities that are sanitary and in good repair; and

m. Plant material and medical cannabidiol that could support the rapid growth of undesirable microorganisms are isolated to prevent the growth of those microorganisms.

154.33(5) Storage.

a. A manufacturer shall store plant material and medical cannabidiol during production, transport, and testing, ensuring that:

(1)Plant material and medical cannabidiol are returned to a secure location immediately after completion; and

(2)The tanks, vessels, bins, or bulk containers containing plant material or medical cannabidiol are locked inside a secure area.

b. A manufacturer shall store all plant material and medical cannabidiol during production, transport, and testing, and all saleable medical cannabidiol:

(1)In areas that are maintained in a clean, orderly, and well-ventilated condition; and

(2)In storage areas that are free from infestation by insects, rodents, birds, and other pests of any kind.

c. To prevent degradation, at all times, a manufacturer shall store all plant material and medical cannabidiol under conditions that will protect the product and its container against physical, chemical, and microbial contamination and deterioration.

d. A manufacturer shall maintain a separate secure storage area for medical cannabidiol that is returned from a dispensary.

154.33(6) Scales. All scales used to weigh usable plant material for purposes of these rules shall be certified in accordance with ISO/IEC 17025 dated 2017, which is incorporated herein by reference.

641—154.34(124E) Supply and inventory.

154.34(1) Reliable and ongoing supply. A manufacturer shall provide a reliable and ongoing supply of medical cannabidiol to medical cannabidiol dispensaries.

154.34(2) Inventory controls and procedures. A manufacturer shall establish inventory controls and procedures for conducting inventory reviews to prevent and detect any diversion, theft, or loss in a timely manner.

154.34(3) Inventory tracking required. A manufacturer shall use the secure sales and inventory tracking system to track medical cannabidiol production from seed or plant cutting through distribution of medical cannabidiol to a dispensary.

154.34(4) Reconciliation. No less often than every two calendar weeks, a manufacturer shall reconcile its physical inventory with the inventory recorded in the secure sales and inventory tracking system.

a. Reconciliation shall include:

(1)Plant material at the manufacturing facility and in transit; and

(2)Medical cannabidiol at the manufacturing facility.

b. Discrepancies between the physical inventory of the manufacturer and the inventory recorded in the secure sales and inventory system shall be handled as follows:

(1)A manufacturer shall report suspected diversion of medical cannabidiol to the department within 72 hours of discovery.

(2)A manufacturer shall have up to 72 hours to reconcile discrepancies in the manufacturer's physical inventory with the inventory recorded in the secure sales and inventory tracking.

DISPENSING

641—154.35(124E) Duties of the department.

154.35(1) Inspection of dispensaries. The department or its agents shall conduct regular inspections of dispensaries and their facilities.

154.35(2) Establishment and maintenance of a secure sales and inventory tracking system. The department shall establish and maintain a secure, electronic system that is available 24 hours a day, seven days a week to track:

a. Inventory of medical cannabidiol and waste material;

b. Sales of medical cannabidiol from dispensaries to patients and primary caregivers;

c. Total tetrahydrocannabinol purchased in the last 90 days by a patient and the patient's primary caregiver.

154.35(3) Recall of medical cannabidiol products. If the department determines, based on an evaluation of the health hazard presented, that there is a reasonable probability that use of, or exposure to, a violative medical cannabidiol product will cause a serious adverse health consequence or death, the department may require a dispensary to recall such violative medical cannabidiol products from the dispensary facility and from patients. An evaluation of the health hazard presented by medical cannabidiol being considered for recall shall be conducted by an ad hoc committee of scientists appointed by the director of the department and shall consider, but need not be limited to, each of the following factors:

a. Whether any disease or injuries have already occurred from the product.

b. Whether any existing conditions could contribute to a clinical situation that could expose humans to a health hazard. Any conclusion shall be supported as completely as possible by scientific documentation and/or statements that the conclusion is the opinion of the individual(s) making the health hazard determination.

c. A holistic assessment of the hazard and its present and future potential consequences.

154.35(4) Permissible disclosure. The department may disclose patient-specific dispensing data to the certifying provider upon written request by the patient, caregiver, or certifying provider.

641—154.36(124E) Dispensary operations.

154.36(1) Operating documents.

a. A dispensary shall maintain operating documents that accurately reflect the dispensary's standard operating procedures. Unless otherwise noted, a dispensary shall make the operating documents available to the department upon request, through secure means.

b. The operating documents of a dispensary shall include all of the following:

(1) Procedures for the oversight of the dispensary, including descriptions of operational and management practices regarding:

1.The forms and quantities of medical cannabidiol products that will be stored and dispensed at the dispensary;

2.The estimated forms and quantities of medical cannabidiol waste to be generated or collected;

3.The disposal methods for all waste materials;

4.Employee training methods for the dispensary employees;

5.Strategies for identifying and reconciling discrepancies in inventory of medical cannabidiol;

6.Procedures to ensure the dispensary does not dispense more than a patient's certified limit of total tetrahydrocannabinol to a patient and the patient's primary caregiver(s) in a 90-day period;

7.Medical cannabidiol labeling procedures;

8.Procedures for recall of medical cannabidiol;

9.Plans for responding to a security breach at the dispensary facility;

10.A business continuity plan; and

11.Other information requested by the department.

(2)Procedures to ensure accurate recordkeeping.

(3)Procedures for the implementation of appropriate security measures to deter and prevent the theft of medical cannabidiol and unauthorized entrance into areas of the dispensary facility containing medical cannabidiol.

154.36(2) Prohibited activities. In addition to following all provisions of Iowa Code section 124E.7, a dispensary shall not:

a. Dispense medical cannabidiol in any location except in those areas approved by the department;

b. Sell, receive, transport, or distribute medical cannabidiol from any location except its dispensary;

c. Sell, receive, or distribute medical cannabidiol from any entity other than a manufacturer licensed by the department;

d. Sell or distribute medical cannabidiol to any person other than an approved patient or primary caregiver;

(1)Transport or deliver medical cannabidiol to any location, unless approved by the department;

(2)Sell medical cannabidiol that is not packaged and labeled in accordance with rules;

(3)Repackage medical cannabidiol or remove the manufacturer's label.

641—154.37(124E) Recordkeeping requirements.

154.37(1) Dispensary sales. Within one business day of sale, a dispensary shall record complete and accurate electronic sales transaction records in the secure sales and inventory tracking system, including:

a. The name of the patient and, if purchase is made by the primary caregiver, the name of the primary caregiver;

b. The date and time of each sale;

c. The item number, product name and description, and quantity of medical cannabidiol sold;

d. The sale price;

e. Other information required by the department.

154.37(2) Reserved.

641—154.38(124E) Storage.

154.38(1) Storage of saleable medical cannabidiol.

a. A dispensary shall store medical cannabidiol to prevent diversion, theft, or loss, including ensuring that:

(1)Medical cannabidiol is kept in a secure and monitored location within the dispensary; and

(2)Cabinets or storage containers inside the secure and monitored area are locked at the end of a business day.

b. A dispensary shall store all medical cannabidiol:

(1)In areas that are maintained in a clean, orderly, and well-ventilated condition;

(2)In areas that are free from infestation by insects, rodents, birds, and other pests of any kind;

(3)According to the manufacturer's requirements regarding temperature, light exposure, or other environmental conditions;

(4)Under conditions that will protect the product and its container against physical, chemical, and microbial contamination and deterioration.

154.38(2) Storage of returned medical cannabidiol. A dispensary shall maintain a separate secure storage area for medical cannabidiol that is to be returned to a manufacturer for disposal, including medical cannabidiol that is outdated, damaged, deteriorated, mislabeled, or contaminated, or whose containers or packaging has been opened or breached, until the medical cannabidiol is collected by a manufacturer.

641—154.39(124E) Dispensing.

154.39(1) Access to all forms of product. A dispensary shall provide access to all medical cannabidiol forms produced by each licensed manufacturer.

154.39(2) Dispensing to a patient or primary caregiver. Prior to dispensing any medical cannabidiol to a patient, a dispensary shall do all of the following:

a. Verify the patient or primary caregiver's identity using acceptable photo identification and is over 18 years of age. Acceptable photo identification includes:

(1)A valid Iowa driver's license;

(2)A valid Iowa nonoperator's identification card;

(3)A U.S. passport;

(4)A U.S. military ID or veteran ID;

(5)A tribal ID card/document;

b. Verify that the patient and primary caregiver, if applicable, is registered and listed in the secure sales and inventory tracking system and has a valid medical registration card;

c. Check the secure sales and inventory tracking system for the patient's total tetrahydrocannabinol 90-day purchase limit and the amount of total tetrahydrocannabinol that the patient and the patient's primary caregiver(s) have purchased on behalf of the patient in the past 90 days to ensure that the amount of total tetrahydrocannabinol sold by the dispensary to the patient does not exceed the patient's purchase limit;

d. Assign a tracking number to any medical cannabidiol that is to be dispensed to the patient or primary caregiver;

e. Issue a label that contains the following information, which may be printed on a secondary label or package insert:

(1)The medical cannabidiol tracking number;

(2)The patient registration number;

(3)The date and time the medical cannabidiol is dispensed;

(4)The name and address of the dispensary; and

(5)Any specific instructions for use based upon manufacturer guidelines or department rules. Text shall not include any false, misleading, or unsubstantiated statements regarding health or physical benefits to the patient.

641—154.40(124E) Transportation of medical cannabidiol. A dispensary is not authorized to transport medical cannabidiol, unless approved by the department. Any approved transport shall be logged in the secure sales and inventory tracking system.

641—154.41(124E) Disposal of medical cannabidiol.

154.41(1) Identification of excess, expired, or damaged medical cannabidiol. Dispensaries shall identify unused, excess, expired, or damaged medical cannabidiol.

154.41(2) Return of medical cannabidiol from a patient or primary caregiver to a dispensary.

a. A dispensary shall accept at no charge medical cannabidiol waste from any patient or primary caregiver. A dispensary may provide all medical cannabidiol waste to the manufacturer for disposal.

b. The dispensary shall enter the following information into the secure sales and inventory tracking system for medical cannabidiol returned from a patient or primary caregiver being returned to the manufacturer:

(1)The tracking number assigned at the time of the dispensing, if available, or the name of the patient, if the tracking number is unavailable;

(2)The date the medical cannabidiol was returned;

(3)The quantity of medical cannabidiol returned; and

(4)The type and lot number of medical cannabidiol returned.

c. A dispensary shall store medical cannabidiol returned from patients and primary caregivers.

154.41(3) Unused, excess, expired, damaged, or returned medical cannabidiol. Unused, excess, expired, damaged, or returned medical cannabidiol shall be stored as described in subrule 154.38(2).

154.41(4) Return of medical cannabidiol to a manufacturer. A dispensary shall record information on all medical cannabidiol collected by the manufacturer in the secure sales and inventory tracking system. Information shall include:

a. The date the medical cannabidiol was collected by the manufacturer;

b. The quantity of medical cannabidiol collected; and

c. The type and lot number of medical cannabidiol collected.

641—154.42(124E) Inventory.

154.42(1) Inventory controls and procedures. A dispensary shall establish inventory controls and procedures for conducting inventory reviews to prevent and detect any diversion, theft, or loss in a timely manner.

154.42(2) Real-time inventory required. A dispensary shall use the secure sales and inventory tracking system to maintain a real-time record of the dispensary's inventory of medical cannabidiol to include:

a. The quantity and form of saleable medical cannabidiol maintained at the dispensary on a daily basis;

b. The amount of damaged, expired, or returned medical cannabidiol being held at the dispensary for return to a manufacturer; and

c. Other information deemed necessary and requested by the department.

154.42(3) Reconciliation. At least once a calendar week, a dispensary shall reconcile all medical cannabidiol with the inventory recorded in the secure sales and inventory tracking system. Discrepancies shall be handled as follows:

a. A dispensary shall report suspected diversion of medical cannabidiol to the department and law enforcement within 24 hours of discovery.

b. A dispensary shall have up to 24 hours to reconcile the dispensary's physical inventory with the inventory recorded in the secure sales and inventory tracking system. If the dispensary cannot reconcile the dispensary's physical inventory with the secure sales and inventory tracking system's inventory within 24 hours but diversion of product is not suspected, the dispensary shall immediately contact the department to report the discrepancy and to initiate a compliance action.

641—154.43(124E) Quality assurance and control. A dispensary shall cooperate with manufacturers and the department on quality assurance and control procedures, including participating in stability-testing studies, developing sampling strategies, and returning medical cannabidiol that has been recalled.

MEDICAL CANNABIDIOL BOARD

641—154.44(124E) Purpose and duties of board. The purpose of the board is to administer the provisions of Iowa Code section 124E.5.

641—154.45(124E) Organization of board and proceedings.

154.45(1) Membership. The board shall be composed of members as set forth in Iowa Code section 124E.5. The appointments, unless provided otherwise by law, shall be for three-year staggered terms that shall expire on June 30. Board members shall be knowledgeable about the use of medical cannabidiol. The medical practitioners appointed to the board shall be licensed in Iowa and be nationally board-certified in their area of specialty.

154.45(2) Vacancies. Vacancies shall be filled in the same manner in which the original appointments were made for the balance of the unexpired term.

154.45(3) Absences. Three consecutive unexcused absences shall be grounds for the governor to consider dismissal of a board member and to appoint another. Department staff is charged with providing notification of absences to the governor's office.

154.45(4) Board meetings.

a. Board meetings shall be conducted in accordance with the open meetings requirements of Iowa Code chapter 21.

b. The department's Bureau of Cannabis Regulation shall schedule the time, date and location of meetings.

c. A majority of the members shall constitute a quorum for conducting business of the board.

d. An affirmative vote of a majority of the board members present at a meeting is required for a motion to pass.

154.45(5) Facilities and staffing. The department shall furnish the board with the necessary facilities and employees to perform the duties required by this chapter but shall be reimbursed for all costs incurred by fee revenue generated from licensing activities and registration card applications.

154.45(6) Subcommittees. The board may designate one or more subcommittees to perform such duties as may be deemed necessary.

641—154.46(124E) Petitions for the addition or removal of medical conditions, medical treatments or debilitating diseases. Pursuant to Iowa Code section 124E.5(3)"a," the board shall accept and review petitions to modify the list of debilitating medical conditions for the medical use of cannabidiol. The petition shall be in accordance with 441—Chapter 4, except that the caption should read "Petition for Addition or Removal."

154.46(1) Inquiries. Inquiries concerning the status of a petition may be made to the bureau of cannabis regulation at the department's address.

154.46(2) Additional information. The board may request the petitioner to submit additional information concerning the petition. The board may also solicit comments from any person on the substance of the petition. Comments on the substance of the petition may be submitted to the board by any person.

154.46(3) Presentation to the board. The board may request or allow the petitioner to make an oral presentation of the contents of a petition at a board meeting following submission of the petition.

154.46(4) Board response. The board shall notify the petitioner in writing of the decision within six months after the filing, unless the petitioner agrees to a time extension. If the petition is granted, the board will recommend addition or removal of the medical condition, medical treatment or debilitating disease to the board of medicine. If the petition is denied the board will provide the rationale for the denial. Notification occurs when the board mails the writing to the petitioner.

154.46(5) Denials. Denial of a petition because it does not substantially conform to the required form does not preclude the filing of a new petition on the same subject that seeks to eliminate the grounds for the agency's rejection of the petition.

LABORATORY TESTING

641—154.47(124E) Requirements of the department.

154.47(1) Laboratory testing requirements and acceptance criteria. The department shall work with manufacturers and laboratories to create and maintain a document describing required sampling methodology, acceptance criteria, stability-testing procedures, and other guidance for manufacturers and laboratories on testing procedures. The department shall provide manufacturers and laboratories no less than 14 days in which to comment on proposed revisions to the document, and the department shall provide no less than 30 days' notice before a revision takes effect. The document shall:

a. Describe the minimum number of sample units and reserve samples required for testing by the laboratory;

b. Describe an option for manufacturers to reduce the amount of testing conducted by allowing compositing of sample units or other techniques that reduce the number of tests required without compromising the safety of the products once a manufacturer has satisfactorily completed a control study for a specific extraction or production process;

c. Describe the minimum requirements for sample size and testing intervals for stability testing;

d. Be available on the department's website (hhs.iowa.gov).

154.47(2) Review and approval of manufacturer sampling protocols. The department shall have two weeks to review and approve or request revisions to a manufacturer's sampling protocols.

154.47(3) Review and approval of manufacturer stability-testing procedures. The department shall have two weeks to review and approve or request revisions to a manufacturer's stability-testing procedures.

154.47(4) Establish a laboratory review committee. The department shall establish a laboratory review committee to assist with the review of applications by laboratories and the establishment of accepted laboratory testing standards and practices.

154.47(5) Review of laboratory applications. The department shall establish a process to review applications from prospective medical cannabidiol testing laboratories. Prospective laboratories shall apply on a form created by the department. The department will determine whether the laboratory meets the criteria for an independent medical cannabidiol testing facility as set forth in the definition of "laboratory" in Iowa Code section 124E.2 in addition to determining whether the laboratory meets laboratory requirements pursuant to these rules.

154.47(6) Regulation of independent laboratories. The department shall determine on an annual basis whether any approved independent laboratory continues to meet the application criteria of this rule. The department shall establish a process for the annual review of approved independent laboratories. An independent laboratory is subject to reasonable inspection by the department, a department-approved consultant, or other agency pursuant to Iowa Code chapter 124E and these rules and as authorized by laws and regulations.

641—154.48(124E) Requirements of a laboratory.

154.48(1) Minimum testing requirements. A laboratory shall establish and implement test methods, corresponding standard operating procedures for the analyses of cannabinoids, residual solvents and processing chemicals, pesticides, microbiological impurities, and metals and other analyses as requested by the department.

154.48(2) Level of quantitation. A laboratory shall be able to demonstrate that its level of quantitation (LOQ) is below any action level established by the department.

154.48(3) Inventory tracking. A laboratory shall record the following:

a. The receipt of medical cannabidiol from a manufacturer for testing.

b. The return of medical cannabidiol or waste to a manufacturer.

154.48(4) Hazardous waste disposal. A laboratory shall do the following when dealing with hazardous waste:

a. Discard hazardous waste, including hazardous waste containing medical cannabis goods, in accordance with federal and state hazardous waste laws.

b. Document the waste disposal procedures followed for each sample.

641—154.49(124E) Requirements of a manufacturer.

154.49(1) Assuming costs. A manufacturer shall assume the costs for all laboratory testing pertaining to verification studies on new products, the cost of standard testing protocols as outlined in a Laboratory Acceptance and Criteria Document and other tests as requested by the department. A manufacturer shall provide any necessary reference materials to the laboratory at no cost.

154.49(2) Obtaining approval for sampling protocols. A manufacturer shall obtain approval from the department for the manufacturer's sampling protocols prior to submitting samples for laboratory testing related to content and contamination.

154.49(3) Obtaining approval for stability-testing procedures. A manufacturer shall obtain approval from the department for the manufacturer's stability-testing procedures prior to submitting samples for laboratory testing related to stability testing and product-expiration-date studies.

641—154.50(124E) Content testing.

154.50(1) Cannabinoids.

a. For each unique lot of medical cannabidiol, and if asked to do so by a requester for other medical cannabis goods, a laboratory shall, at minimum, test for and report measurements for the following cannabinoid analytes:

(1)THC;

(2)THCA;

(3)CBD; and

(4)CBDA.

b. A laboratory shall report that the primary sample passed or failed THC and CBD potency testing according to guidance in the laboratory testing requirements and acceptance criteria document described in subrule 154.47(1).

c. For each cannabinoid analyte test, a laboratory shall issue a certificate of analysis that contains the following:

(1)Concentrations of cannabinoid analytes in mg/ml for liquids and mg/g for solids, or other measures approved by the department.

(2)Whether the primary sample passed or failed the test in accordance with paragraph 154.50(1)"b."

d. The laboratory may test for and provide test results for additional cannabinoid analytes if asked to do so by a requester.

154.50(2) Contaminants testing.

a. For each unique lot of medical cannabidiol, unless otherwise referenced in the laboratory testing requirements and acceptance criteria document described in subrule 154.47(1), a laboratory shall conduct contaminants testing for the following analytes:

(1)Residual solvents and processing chemicals.

(2)Pesticides.

(3)Microbiological impurities.

(4)Heavy metals.

b. The laboratory may test and provide test results for additional contaminants if asked to do so by a requestor.

c. The department shall provide a list of contaminants for which primary samples are to be tested with corresponding action levels on the department's website (hhs.iowa.gov).

d. For each contaminant for which a laboratory tests, the laboratory shall report that the primary sample passed the testing if the concentration of contaminant is at or below the action level approved by the department.

e. For each contaminant for which a laboratory tests, the laboratory shall report that the primary sample failed the testing if the concentration of contaminants is above the action level approved by the department.

f. If a laboratory is using GC-mass spectrometry instrumentation to analyze primary samples for contaminants and the laboratory determines that a primary sample contains contaminants or chemical analytes that are not included in the department-approved list of required tests, the laboratory shall attempt to achieve tentative identification and semiquantitative results of the contaminants analytes.

g. The laboratory may test for and provide test results for additional contaminants or processing chemicals if asked to do so by a requester.

h. For each primary sample tested, a laboratory shall issue a certificate of analysis that contains the following:

(1)The name and concentration of each contaminant for which the primary sample was tested.

1.The concentrations shall be listed in parts per million (ppm) or other units as determined by the department.

2.The laboratory shall report a result of "detected but not quantified" for any contaminant that falls below the LOQ, has a signal-to-noise ratio of greater than 3:1, and meets identification criteria.

(2)Whether the primary sample passed or failed the test in accordance with paragraphs 154.50(2)"c" and "d."

(3)The names and amounts of any additional contaminants identified by the laboratory.

i. If the primary sample fails testing for residual solvents and processing chemicals, the lot fails laboratory testing.

j. When a laboratory identifies additional contaminants in a primary sample, the laboratory shall:

(1)Notify the department of the additional contaminants and the amounts detected, if applicable.

(2)Refrain from issuing a final certificate of analysis until given approval to do so by the department.

641—154.51(124E) Reporting requirements.

154.51(1) Reporting test results. The laboratory shall generate a certificate of analysis for each primary sample that it tests and make the certificate of analysis available to the manufacturer and the department.

154.51(2) Tentatively identified analytes. A laboratory shall report on the certificate of analysis any tentatively identified analytes detected during the analysis of the primary sample. When a laboratory identifies additional analytes in a primary sample, the laboratory shall:

a. Notify the department of the additional analytes detected.

b. Refrain from issuing a final certificate of analysis until given approval to do so by the department.

154.51(3) Additional reporting requirements. In addition to the requirements described in rule 641—154.50(124E), the certificate of analysis shall contain, at a minimum, the following information:

a. All requirements of ISO/IEC 17025 dated 2017;

b. Date of primary sample collection;

c. Date the primary sample was received by the laboratory;

d. Date of each analysis;

e. The LOQ and action level for each analyte, as applicable;

f. Whether the primary sample and lot passed or failed laboratory testing; and

g. A signature by the laboratory quality officer or delegate and the date the certificate of analysis was validated as being accurate by the laboratory quality officer or delegate.

154.51(4) Measurements.

a. Any test result that is not covered under the laboratory's ISO/IEC 17025 scope of accreditation shall be clearly identified on the certificate of analysis.

b. Measurements below a method's limit of detection shall be reported as "<" (less than) or "not detected" and reference the reportable limit. The reporting of zero concentration is not permitted.

c. Measurements greater than or equal to LOD but less than LOQ shall be reported as "detected but not quantified."

d. The number of significant figures reported shall reflect the precision of the analysis.

641—154.52(124E) Recordkeeping requirements.

154.52(1) Data package. A laboratory shall create a data package for each analytical batch of primary samples that the laboratory analyzes. The data package shall contain at minimum the following information:

a. The name and address of the laboratory that performed the analytical procedures;

b. The names, functions, and signatures (electronic or handwritten) of the laboratory personnel who performed the primary sample preparation, analyzed the primary samples, and reviewed and approved the data;

c. All primary sample and analytical batch quality control sample results;

d. Raw data for each primary sample analyzed;

e. Instrument raw data, if any was produced;

f. Instrument test method with parameters;

g. Instrument tune report, if one was created;

h. All instrument standard calibration data;

i. Test-method worksheets or forms used for primary sample identification, characterization, and calculations, including chromatograms, sample-preparation worksheets, and final datasheets;

j. The quality control report with worksheets, forms, or copies of laboratory notebook pages containing pertinent information related to the identification and traceability of all reagents, reference materials, and standards used for analysis;

k. The analytical batch sample sequence;

l. The field sample log; and

m. The chain-of-custody form.

154.52(2) Review of data package. After the laboratory has compiled a data package, an individual at the laboratory who was not previously involved in the creation of the data package shall:

a. Assess the analytical results for technical correctness and completeness;

b. Verify that the results of each analysis carried out by the laboratory are reported accurately, clearly, unambiguously, and objectively;

c. Verify that the measurements can be traced back; and

d. Approve the measurement results by signing and dating the data package prior to release of the certificate of analysis by the laboratory.

154.52(3) Data package record retention. The entire data package shall be stored by a laboratory for a minimum of five years and shall be made available upon request by the department or the requester of the laboratory testing.

154.52(4) Other records. A laboratory shall maintain all documents, forms, records, and standard operating procedures associated with the testing of medical cannabidiol.

a. A laboratory shall maintain analytical testing laboratory records in such a manner that the analyst, the date the analysis was performed, the approver of the certificate of analysis, the reviewer and approver of the data package, the test method, and the materials that were used can be determined by the department.

b. Records shall be stored in such a way that the data may be readily retrieved when requested by the department.

c. All testing laboratory records shall be kept for a minimum of five years, unless otherwise noted in these rules.

d. The department shall be allowed access to all electronic data, including standards records, calibration records, extraction logs, and laboratory notebooks.

e. A laboratory shall keep and make available to the department the following records related to the testing of medical cannabidiol:

(1)Personnel qualification, training, and competency documentation, including but not limited to résumés, training records, continuing education records, analytical proficiency testing records, and demonstration of competency records for laboratory work. These records shall be kept current.

(2)Method verification and validation records, including method modification records, method detection limit and quantitation limit determination records, ongoing verification records such as proficiency test records and reference material analysis records.

(3)Quality control and quality assurance records, including the laboratory's quality assurance manual and control charts with control limits.

(4)Chain-of-custody records, including chain-of-custody forms, field sample logs, sample-receipt records, sample-description records, sample-rejection records, laboratory information management system records, sample-storage records, sample-retention records, and disposal records.

(5)Purchasing and supply records, equipment-services records, and other equipment records, including purchase requisition records, packing slips, supplier records, and certificates of analysis.

(6)Laboratory equipment installation records, maintenance records, and calibration records. These records shall include the date and name of the person performing the installation of, calibration of, or maintenance on the equipment, with a description of the work performed, maintenance logs, pipette calibration records, balance calibration records, working and reference mass calibration records, and daily verification-of-calibration records.

(7)Customer service records, including customer contracts, customer requests, certificates of analysis, customer transactions, customer feedback, records related to the handling of complaints and nonconformities, and corrective action pertaining to complaints.

(8)Nonconforming work and corrective action records, including corrective action, nonconformance, nonconformities resolved by correction, customer notification of nonconformities, internal investigations, implementation of corrective action, and resumption-of-work records.

(9)Internal-audit and external-audit records, including audit checklists, standard operating procedures, and audit observation and findings reports. These records shall include the date and name of the person performing the audit.

(10)Management review records, including technical data review reports and final management-review reports. These records shall include the review date and the name of the reviewer.

(11)Laboratory data reports, data review, and data approval records, including instrument and equipment identification records, records with unique sample identifiers, analysts' laboratory notebooks and logbooks, traceability records, test-method worksheets and forms, instrumentation-calibration data, and test-method raw data. These records shall include the analysis date and the name of the analyst.

(12) Proficiency testing records, including the proficiency test schedule, proficiency tests, data-review records, data-reporting records, nonconforming work and corrective actions, and quality control and quality assurance records related to proficiency testing.

(13)Electronic data, backed-up data, records regarding the protection of data, including unprocessed instrument output data files and processed quantitation output files, electronic data protocols and records, and authorized personnel records.

(14)Security data, including laboratory-security records and laboratory-access records, surveillance-equipment records, and security-equipment records. These records shall be stored for at least one year.

(15)Traceability, raw data, standards records, calibration records, extraction logs, reference materials records, analysts' laboratory notebooks and logbooks, supplier records, and certificates of analysis, and all other data-related records.

(16)Laboratory contamination and cleaning records, including autoclave records, acid-wash logs and records, and general laboratory-safety and chemical-hygiene protocols.

641—154.53(124E) Quality control. The laboratory shall have quality control protocols that include the following elements:

154.53(1) Quality control samples required.

a. The laboratory shall run quality control samples with every analytical batch of samples for chemical and microbiological analysis.

b. For microbiological analysis, the laboratory shall develop procedures for quality control requirements for each analytical batch of samples.

c. The laboratory shall analyze the quality control samples in exactly the same manner as the test samples to validate the laboratory testing results.

154.53(2) Types of quality control samples. At a minimum, a laboratory shall have the following quality control samples as part of every analytical batch tested for chemical analytes:

a. Negative control (method blank). A laboratory shall prepare and run at least one method blank sample with an analytical batch of samples along with and under the same conditions, including all sample preparation steps, as the other samples in the analytical batch, to demonstrate that the analytical process did not introduce contamination.

b. Positive control (laboratory control sample). A laboratory shall prepare and run at least one laboratory control sample with an analytical batch of samples along with and under the same conditions, including all sample preparation steps, as the other samples in the analytical batch.

c. Matrix spike sample. A laboratory shall prepare and run one or more matrix spike samples for each analytical batch.

(1)A laboratory shall calculate the percent recovery for quantitative chemical analysis by dividing the sample result by the expected result and multiplying that by 100. All quality control measures shall be assessed and evaluated on an ongoing basis, and quality control acceptance criteria shall be used. When necessary, the department may establish acceptance criteria on the department's website (hhs.iowa.gov).

(2)If quality control acceptance criteria are not acceptable, a laboratory shall investigate the cause, correct the problem, and rerun the analytical batch of samples. If the problem persists, the laboratory shall reprepare the samples and run the analysis again, if possible.

d. Field duplicate sample. A laboratory shall prepare and run a duplicate sample as described in the laboratory testing requirements and acceptance criteria document in subrule 154.47(1). The acceptance criterion between the primary sample and the duplicate sample is less than or equal to 20 percent relative percent difference.

154.53(3) Certified reference material for chemical analysis. The laboratory shall use a reference material for each analytical batch in accordance with the following standards:

a. The reference material should be certified and obtained from an outside source, if possible. If a reference material is not available from an outside source, the laboratory shall make its own in-house reference material.

b. Reference material made in-house should be made from a different source of standards than the source from which the calibration standards are made.

c. The test result for the reference material shall fall within the quality control acceptance criteria. If it does not, the laboratory shall document and correct the problem and run the analytical batch again.

154.53(4) Calibration standards. The laboratory shall prepare calibration standards by serially diluting a standard solution to produce working standards used for calibration of an instrument and quantitation of analyses in samples.

154.53(5) Quality control-sample report. A laboratory shall generate a quality control-sample report that includes quality control parameters and measurements, analysis date, and type of matrix.

154.53(6) Limit-of-detection and limit-of-quantitation calculations. For chemical method analysis, a laboratory shall calculate the limit of detection and limit of quantitation using generally accepted methodology.

641—154.54(124E) Security requirements.

154.54(1) Security policy requirement. A laboratory shall maintain a security policy to prevent the loss, theft, or diversion of medical cannabidiol samples. The security policy shall apply to all staff and visitors at a laboratory facility.

154.54(2) Restricted access. A laboratory shall limit entrance to all restricted areas by completing all of the following:

a. The controlled access system shall do all of the following:

(1)Limit access to authorized individuals;

(2)Maintain a log of individuals with approved access, including dates of approvals and revocations;

(3)Track times of personnel to and exit from the laboratory;

(4)Track times of personnel movement between restricted access areas;

(5)Store data for retrieval for a minimum of one year; and

(6)Remain operable in the event of a power failure.

b. A laboratory shall promptly, but no later than five business days after receipt of request, submit stored controlled access system data to the department.

154.54(3) Personnel identification system. A laboratory shall use a personnel identification system that controls and monitors individual employee access to restricted access areas within the laboratory facility.

a. An employee identification card shall contain:

(1)The name of the employee;

(2)The date of issuance and expiration;

(3)An alphanumeric identification number that is unique to the employee; and

(4)A photographic image of the employee.

b. A laboratory employee shall keep the identification card visible at all times when the employee is in the laboratory.

c. Upon termination or resignation of an employee, a laboratory shall immediately:

(1)Revoke the employee's access to the laboratory; and

(2)Obtain and destroy the employee's identification card, if possible.

154.54(4) Video monitoring and surveillance. A laboratory shall operate and maintain in good working order a video surveillance system for its premises that operates 24 hours per day, seven days a week, and visually records all areas where medical cannabis goods are stored or tested.

a. Camera specifications. Cameras shall:

(1)Capture clear and certain identification of any person entering or exiting a restricted access area containing medical cannabis goods;

(2)Produce a clear, color still photograph live or from a recording;

(3)Have an embedded date-and-time stamp that is synchronized to the recording and does not obscure the picture; and

(4)Continue to operate during a power outage.

b. Video recording specifications. Video recording equipment shall:

(1)Export still images in an industry standard image format, such as .jpg, .bmp, or .gif.

(2)Archive in a format that ensures authentication and guarantees that the recorded image has not been altered.

(3)Save exported video shall also be saved in an industry standard file format that can be played on a standard computer operating system.

(4)All recordings shall be erased or destroyed at the end of the retention period and prior to disposal of any storage medium.

c. Additional requirements. A laboratory shall maintain all security system equipment and recordings in a secure location to prevent theft, loss, destruction, corruption, and alterations.

d. Retention. A laboratory shall ensure that 24-hour recordings from all video cameras are:

(1)Available for viewing by the department upon request;

(2)Retained for a minimum of 60 days;

(3)Maintained free of alteration or corruption; and

(4)Retained longer, as needed, if a laboratory is given actual notice of a pending criminal, civil, or administrative investigation, or other legal proceeding for which the recording may contain relevant information.

154.54(5) Chain-of-custody policy and procedures. A laboratory shall maintain a current chain-of-custody policy and procedures. The policy should ensure that:

a. Chain of custody is maintained for samples that may have probable forensic evidentiary value; and

b. Annual training is available for individuals who will be involved with testing medical cannabis goods.

154.54(6) Information technology systems security. A laboratory shall maintain information technology systems protection by employing comprehensive security controls that include security firewall protection, antivirus protection, network and desktop password protection, and security patch management procedures.

These rules are intended to implement Iowa Code chapter 124E.