Inventory tracking, records, reports, and audits

(a) Monthly reports. Licensed growers, processors, and dispensaries shall complete a monthly report on a form and in a manner prescribed by the Department. These reports shall be deemed untimely if not received by the Department by the fifteenth (15th) of each month for 2021.11.23_OSDH681_OMMARulesChapterAsAmended 60 the preceding month. (1) Dispensary reports shall include: (A) The amount of marijuana purchased in pounds; (B) The amount of marijuana sold or otherwise transferred in pounds; (C) The amount of marijuana waste in pounds; (D) If necessary, a detailed explanation of why any medical marijuana product purchased by the licensee cannot be accounted for as having been sold or still remaining in inventory; (E) Total dollar amount of all sales to medical marijuana patients and caregivers; (F) Total dollar amount of all taxes collected from sales to medical marijuana patients and caregivers; and (G) Any information the Department determines is necessary to ensure that all marijuana grown in Oklahoma is accounted for as required under 63 O.S. § 420 et seq. and the Oklahoma Medical Marijuana and Patient Protection Act, 63 O.S. § 427.1 et seq. (2) Grower reports shall include: (A) The amount of marijuana harvested in pounds; (B) The amount of marijuana purchased in pounds; (C) The amount of marijuana sold or otherwise transferred in pounds; (D) The amount of drying or dried marijuana on hand; (E) The amount of marijuana waste in pounds; (F) If necessary, a detailed explanation of why any marijuana cannot be accounted for as having been sold, disposed of, or maintained in current inventory; (G) Total dollar amount of all sales; and (H) Any information the Department determines is necessary to ensure that all marijuana grown in Oklahoma is accounted for as required under 63 O.S. § 420 et seq. and the Oklahoma Medical Marijuana and Patient Protection Act, 63 O.S. § 427.1 et seq. (3) Processor reports shall include: (A) The amount of marijuana purchased in pounds; (B) The amount of marijuana sold or otherwise transferred in pounds; (C) The amount of medical marijuana manufactured or processed in pounds; (D) If necessary, a detailed explanation of why any marijuana cannot be accounted for as having been purchased, sold, processed, or maintained in current inventory; (E) The amount of marijuana waste in pounds; and (F) Any information the Department determines is necessary to ensure that all marijuana grown in Oklahoma is accounted for as required under 63 O.S. § 420 et seq. and the Oklahoma Medical Marijuana and Patient Protection Act, 63 O.S. § 427.1 et seq. (4) Upon implementation, Submission submission of information and data to the Department through the seed-to-sale tracking system established by the Department, or a seed to sale tracking system that integrates with the Department-established system, State inventory tracking system will be required in accordance with the Oklahoma Medical Marijuana Protection Act, 63 O.S. § 427.1 et seq., 2021.11.23_OSDH681_OMMARulesChapterAsAmended 61 and these Rules, and submission of the information and data to the Department through the State inventory tracking system shall be sufficient to satisfy monthly reporting requirements. (b) Records. Pursuant to the Department's audit and inspection responsibilities, medical marijuana business shall keep onsite and readily accessible, either in paper or electronic form, a copy of the records listed below. Except as otherwise specifically provided in Oklahoma law and this Chapter, all records shall be maintained for at least seven (7) years from the date of creation. (1) Business records, which may include but are not limited to employee records, organizational documents or other records relating to the governance and structure of the licensee, manual or computerized records of assets and liabilities, monetary transactions, tax records, journals, ledgers, and supporting documents, including agreements, checks, invoices, receipts, and vouchers. (2) As applicable, any documents related to the cultivation, processing, preparation, transportation, sampling, and/or testing of medical marijuana and medical marijuana products, including but not limited to sample field logs, patient processing logs, safety data sheets and inventory for each chemical utilized by a processor, inventory manifests, transporter agent licenses, lab reports, testing records, equipment inspections, training materials, and standard operating procedures. (3) Except as otherwise provided in this Subsection, documentation of every instance in which medical marijuana was sold or otherwise transferred to or purchased or otherwise obtained from another licensee, which shall include, but is not limited to: (A) The name, license number, address, and phone number of all licensees involved in each transaction; and (B) The quantity and type of medical marijuana or medical marijuana products involved in each transaction; (C) The batch number of the medical marijuana or medical marijuana products involved in each transaction; (D) The date of each transaction; (E) The monetary value of the medical marijuana or medical marijuana products involved in each transaction, including the total sale or purchase amounts; (F) All point-of-sale and tax records; and (G) All inventory manifests and other documentation relating to the transport of medical marijuana and medical marijuana products. (4) For processors processing medical marijuana directly on behalf of a patient or caregiver, a log documenting each instance in which the processor processed medical marijuana received from a licensed patient into a concentrate form on behalf of the licensed patient, which shall include, but is not limited to, the following information: (A) The patient and, if applicable, caregiver license number; (B) The date the processor received the medical marijuana from the patient or caregiver; (C) The weight of medical marijuana received from the patient; 2021.11.23_OSDH681_OMMARulesChapterAsAmended 62 (D) The weight or amount of concentrate produced, along with the weight of any excess medical marijuana, if applicable; and (E) The date the concentrate was returned to the patient or caregiver. (5) Any and all documents relating to the disposal or destruction of medical marijuana, medical marijuana products, and medical marijuana waste. (6) Commercial licensees must also have the following documentation readily available on the licensed premise: (A) the square footage of the licensed premises; (B) a diagram of the licensed premises; (C) if applicable, the number and type of lights at the licensed premise of a commercial grower; (D) if applicable, the number, type and production capacity of equipment located at the licensed premise of a commercial processor; (E) the names, addresses and telephone numbers of employees or agents of a medical marijuana business; (F) employment manuals and standard operating procedures for the medical marijuana business; and (G) any other information the Department deems reasonably necessary. (c) Patient information. Records containing private patient or caregiver information shall not be retained by a medical marijuana business commercial licensee for more than sixty (60) days without the patient's or caregiver's consent shall comply with all relevant state and federal laws. "Private patient information" means personally identifiable information, such as the patient name, address, date of birth, social security number, telephone number, email address, photograph, and financial information. This term does not include the patient's medical marijuana license number, which shall be retained by the business and provided to the Department upon request for compliance and public health purposes, including the verification of lawful sales or patient traceability in the event of product recall. (d) Inventory tracking system. Pursuant to 63 O.S. § 427.3(D)(8) and 63 O.S. § 427.13(B), Each each business commercial licensee shall use the seed-to-sale State inventory tracking system established by the Department or by inputting inventory tracking data required to be reported to the Department directly into the State inventory tracking system or by utilizing a seed-to-sale tracking system that integrates with the State inventory tracking system Department established system at the time of its implementation. The system utilized by each licensee shall be a system that: All commercial licensees must have an inventory tracking system account activated to lawfully operate and must ensure all information is reported to the Department accurately and in real time or after each individual sale in accordance with 63 O.S. § 427.13(B)(1) and these Rules. All commercial licensees shall ensure the following information and data are accurately tracked and timely reported to the Department though the State inventory tracking system: (1) Documents the The chain of custody of all medical marijuana and medical marijuana products, including every transaction with another 2021.11.23_OSDH681_OMMARulesChapterAsAmended 63 commercial licensee, patient, or caregiver;, including but not limited to: (A) The name, address, license number, and phone number of the medical marijuana business that cultivated, manufactured, sold, purchased, or otherwise transferred the medical marijuana or medical marijuana product(s); (B) The type, item, strain, and category of medical marijuana or medical marijuana product(s) involved in the transaction; (C) The weight, quantity, or other metric required by the Department, of the medical marijuana or medical marijuana product(s) involved in the transaction; (D) The batch number of the medical marijuana or medical marijuana product(s); (E) The total amount spent in dollars; (F) All point-of-sale records as applicable; (G) Transportation information documenting the transport of medical marijuana or medical marijuana product(s) as required under OAC 310:681-3-6(b); (H) Testing results and information; (I) Waste records and information; (J) Marijuana excise tax records, if applicable; (K) RFID tag number(s); (2) Establishes ongoing inventory controls and procedures for the conduct of inventory reviews and comprehensive inventories of medical marijuana and medical marijuana products for traceability which shall enable the licensee to detect any diversion, theft, or loss in a timely manner; (3) Identifies and allows for tracking and documentation of the The entire life span of a licensee's stock of medical marijuana and medical marijuana products, including, at a minimum, notifying the Department: (A) When medical marijuana seeds or clones are planted; (B) When medical marijuana plants are harvested and/or destroyed; (C) When medical marijuana is transported, or otherwise transferred, sold, stolen, diverted, or lost; (D) A complete inventory of all medical marijuana; seeds; plant tissue; clones; usable marijuana; trim; leaves; other plant matter; and medical marijuana products; When medical marijuana changes form, including, but not limited to, when it is planted, cultivated, processed, and infused into a final form product; (E) All samples sent to a testing laboratory or used for internal quality testing or other purposes; A complete inventory of all medical marijuana; seeds; plant tissue; clones; usable marijuana; trim; shake; leaves; other plant matter; and medical marijuana products; (F) All samples sent to a testing laboratory or used for internal quality and testing or other purposes; (4) In event of a serious adverse event or recall, is capable of tracking medical marijuana or medical marijuana product from a patient back to the source of the medical marijuana or medical marijuana product; and (5)(3) Tracks medical marijuana using an assigned batch number and 2021.11.23_OSDH681_OMMARulesChapterAsAmended 64 bar code. Any further information the Department determines is necessary to ensure all medical marijuana and medical marijuana products are accurately and fully tracked throughout the entirety of the lifespan of the plant and product. (e) Seed-to-sale tracking system. A commercial licensee shall use a seed-to-sale tracking system or integrate its own seed-to-sale tracking system with the State inventory tracking system established by the Department. If a commercial licensee uses a seed-to-sale tracking system that does not integrate with the State inventory tracking system, or does integrate but does not share all required information, the commercial licensee shall ensure all required information is reported directly into the State inventory tracking system. Audits. The Department may perform on-site audits of all commercial licensees to ensure the accuracy of the monthly reports and to ensure that all marijuana grown in Oklahoma is accounted for. Submission of an application for a medical marijuana commercial license constitutes permission for entry to any licensed premises and auditing of the commercial licensee during hours of operation and other reasonable times. Refusal to permit the Department entry or refusal to permit the Department to inspect all books and records shall constitute grounds for administrative penalties, which may include, but are not limited to, fines as set forth in Appendix C and the denial, nonrenewal, suspension, and/or revocation of a license. (1) The Department may review any and all records and information of a commercial licensee and may require and conduct interviews with such persons or entities and persons affiliated with such licensees, for the purpose of determining compliance with Department rules and applicable laws. Failure to make documents or other requested information available to the Department and/or refusal to appear or cooperate with an interview shall constitute grounds for administrative penalties, which may include, but is not limited to, fines as set forth in Appendix C and the denial, nonrenewal, suspension, and/or revocation of a license or any other remedy or relief provided under law. All records shall be kept on-site and readily accessible. (2) Commercial licensees shall comply with all written requests from the Department to produce or provide access to records and information within ten (10) business days. (3) If the Department identifies a violation of 63 O.S. § 420 et seq., the Oklahoma Medical Marijuana and Patient Protection Act, 63 O.S. § 427.1 et seq.; or these Rules during an audit of the commercial licensee, the Department shall take administrative action against the licensee in accordance with the Oklahoma law, including the Oklahoma Administrative Procedures Act, 75 O.S. § 250 et seq. (4) The Department may refer all complaints alleging criminal activity or other violations of Oklahoma law that are made against a commercial licensee to appropriate Oklahoma state or local law enforcement or regulatory authorities. (5) If the Department discovers what it reasonably believes to be criminal activity or other violations of Oklahoma law during an audit, the Department may refer the matter to appropriate Oklahoma 2021.11.23_OSDH681_OMMARulesChapterAsAmended 65 state or local law enforcement or regulatory authorities for further investigation. (6) Except as is otherwise provided in Oklahoma law or these Rules, correctable violations identified during an audit shall be corrected within thirty (30) days of receipt of a written notice of violation. (7) If a licensee fails to correct violations within thirty (30) days, the licensee will be subject to a fine in the amount set forth in Appendix C for each violation and any other administrative action and penalty authorized by law. (8) The Department may assess fines in the amounts set forth in Appendix C and seek any other administrative penalties authorized by law against a licensee without providing opportunity to correct when the violation is not capable of being corrected. (f) Inventory Tracking System Requirements. (1) At a minimum, commercial licensees shall track, update, and report inventory after each individual sale to the Department in the State inventory tracking system. (2) All commercial licensees must ensure all on-premises and in- transit medical marijuana and medical marijuana product inventories are reconciled each day in the State inventory tracking system at the close of business, if not already done. (3) Commercial licensees are required to use RFID tags from a Department-approved supplier for the State Inventory Tracking System. Each Licensee is responsible for the cost of all RFID tags and any associated vendor fees. (A) A commercial licensee shall ensure its inventories are properly tagged and that a RFID tag is properly assigned to medical marijuana, medical marijuana products, and medical marijuana waste as required by the Department. (B) A commercial licensee shall ensure it has an adequate supply of RFID tags at all times. If a commercial licensee is unable to account for unused RFID tags, the commercial licensee must report to the Department and the State inventory tracking system vendor within forty-eight (48) hours. (C) RFID tags must contain the legal name and correct license number of the commercial licensee that ordered them. Commercial licensees are prohibited from using another licensee's RFID tags. (D) Prior to a plant reaching a point where it is able to support the weight of the RFID tag and attachment strap, the RFID tag may be securely fastened to the stalk or other similarly situated position approved by the Department. (E) When the plant becomes able to support the weight of the RFID tag, the RFID tag shall be securely fastened to a lower supporting branch. The RFID tag shall remain affixed for the entire life of the plant until disposal. (F) Mother plants must be tagged before any cuttings or clones are generated therefrom. (G) If a RFID tag gets destroyed, stolen, or falls off of a medical marijuana plant, the licensee must ensure a new RFID tag is placed on the medical marijuana plant and the change of the RFID tag is properly reflected in the State inventory tracking system. 2021.11.23_OSDH681_OMMARulesChapterAsAmended 66 (H) Commercial licensees shall not reuse any RFID tag that has already been affixed to any regulated medical marijuana or medical marijuana products. (4) Each wholesale package of medical marijuana must have a RFID tag during storage and transfer and may only contain one harvest batch of medical marijuana. (5) Prior to transfer, commercial licensees shall ensure that each immature plant is properly affixed with an RFID tag if the plant was not previously tagged in accordance with these Rules. (6) Commercial licensees' inventory must have a RFID tag properly affixed to all medical marijuana products during storage and transfer in one of the following manners: (A) Individual units of medical marijuana products shall be individually affixed with a RFID tag; or (B) Medical marijuana products may only be combined in a single wholesale package using one RFID tag if all units are from the same production batch. (7) If any medical marijuana or medical marijuana products are removed from a wholesale package, each individual unit or new wholesale package must be separately tagged. (8) All packages of medical marijuana waste shall have a RFID tag affixed and the contents of the waste package shall be reported in the State inventory tracking system. (g) Inventory tracking system administrators and users. (1) A commercial licensee must have at least one owner, or manager, who is an inventory tracking system administrator. (2) The inventory tracking system administrator must attend and complete all required inventory tracking system training. (3) If at any point, the inventory tracking system administrator for a commercial licensee changes, the commercial licensee shall change or assign a new inventory tracking system administrator within three business days. (4) Commercial licensees shall maintain an accurate and complete list of all inventory tracking system administrators and employee users. (5) Commercial licensees shall ensure that all owners and employees that are granted inventory tracking system account access for the purpose of conducting inventory tracking functions are trained and authorized before the owners or employees may access the State inventory tracking system. (6) All inventory tracking system users shall be assigned an individual account in the State inventory tracking system. (7) Any individual entering data into the State inventory tracking system shall only use the inventory tracking system account assigned specifically to that individual. Each inventory tracking system administrator and inventory tracking system user must have unique log-in credentials that shall not be used by any other person. (8) Within three (3) business days, commercial licensees must remove access for any inventory tracking system administrator or user from their accounts if any such individual no longer utilizes the State inventory tracking system or is no longer employed by the commercial licensee. 2021.11.23_OSDH681_OMMARulesChapterAsAmended 67 (h) Loss of use of the State inventory tracking system. If at any time a commercial licensee loses access to the State inventory tracking system due to circumstances beyond the commercial licensee's control, the commercial licensee shall keep and maintain records detailing all inventory tracking activities that were conducted during the loss of access. Once access is restored, all inventory tracking activities that occurred during the loss of access must be immediately entered into the State inventory tracking system. If a commercial licensee loses access to the State inventory tracking system due to circumstances within its control, the commercial licensee may not perform any business activities that would be required to be reported into the State inventory tracking system until access is restored and reporting is resumed; any transfer, sale, or purchase of medical marijuana or medical marijuana products shall be an unlawful sale. (i) Audits. The Department shall perform on-site audits of all commercial licensees to ensure the accuracy of information and data reported to the Department and to ensure that all marijuana grown in Oklahoma is accounted for. Submission of an application for a medical marijuana commercial license constitutes permission for entry to any licensed premises and auditing of the commercial licensee during hours of operation and other reasonable times. Refusal to permit the Department entry or refusal to permit the Department to inspect all books and records shall constitute grounds for and administrative penalties, which may include, but are not limited to, fines as set forth in Appendix C and the denial, nonrenewal, suspension, and/or revocation of a license. (1) The Department may review any and all records and information of a commercial licensee and may require and conduct interviews with such persons or entities and persons affiliated with such licensees, for the purpose of determining compliance with Department Rules and applicable laws. Failure to make documents or other requested information available to the Department and/or refusal to appear or cooperate with an interview shall constitute grounds for nonrenewal, suspension, or revocation of a license or any other remedy or relief provided under law. All records shall be kept onsite and readily accessible. (2) Commercial licensees shall comply with all written requests from the Department to produce or provide access to records and information within ten (10) business days. (3) If the Department identifies a violation of 63 O.S. § 420 et seq., the Oklahoma Medical Marijuana and Patient Protection Act, 63 O.S. § 427.1 et seq., or these Rules during an audit of the commercial licensee, the Department shall take administrative action against the licensee in accordance with the Oklahoma law, including the Oklahoma Administrative Procedures Act, 75 O.S. § 250 et seq. (4) The Department may refer all complaints alleging criminal activity or other violations of Oklahoma law that are made against a commercial licensee to appropriate Oklahoma state or local law enforcement or regulatory authorities. (5) If the Department discovers what it reasonably believes to be criminal activity or other violations of Oklahoma law during an audit, the Department may refer the matter to appropriate Oklahoma 2021.11.23_OSDH681_OMMARulesChapterAsAmended 68 state or local law enforcement or regulatory authorities for further investigation. Except for license information concerning licensed patients, the Department may share confidential information to assist other agencies in ensuring compliance with applicable laws, Rules and regulations. (6) Except as is otherwise provided in Oklahoma law or these Rules, correctable violations identified during an audit shall be corrected within thirty (30) days of receipt of a written notice of violation. (7) If a licensee fails to correct violations within thirty (30) days, the licensee will be subject to a fine of $500.00 for each violation and any other administrative action and penalty authorized by law. (j) All monthly report, inventory tracking and seed-to-sale information, data, and records submitted to the Department are treated as confidential records and are exempt from the Oklahoma Open Records Act.