(1) The Department of Agriculture and Food, the department, the Department of Public Safety, and the Department of Technology Services shall: (a) enter into a memorandum of understanding in order to determine the function and operation of the state electronic verification system in accordance with Subsection (2); (b) coordinate with the Division of Purchasing, under Title 63G, Chapter 6a, Utah Procurement Code, to develop a request for proposals for a third-party provider to develop and maintain the state electronic verification system in coordination with the Department of Technology Services; and (c) select a third-party provider who: (i) meets the requirements contained in the request for proposals issued under Subsection (1)(b); and (ii) may not have any commercial or ownership interest in a cannabis production establishment or a medical cannabis pharmacy.

(a) enter into a memorandum of understanding in order to determine the function and operation of the state electronic verification system in accordance with Subsection (2);

(b) coordinate with the Division of Purchasing, under Title 63G, Chapter 6a, Utah Procurement Code, to develop a request for proposals for a third-party provider to develop and maintain the state electronic verification system in coordination with the Department of Technology Services; and

(c) select a third-party provider who: (i) meets the requirements contained in the request for proposals issued under Subsection (1)(b); and (ii) may not have any commercial or ownership interest in a cannabis production establishment or a medical cannabis pharmacy.

(i) meets the requirements contained in the request for proposals issued under Subsection (1)(b); and

(ii) may not have any commercial or ownership interest in a cannabis production establishment or a medical cannabis pharmacy.

(2) The Department of Agriculture and Food, the department, the Department of Public Safety, and the Department of Technology Services shall ensure that, on or before March 1, 2020, the state electronic verification system described in Subsection (1): (a) allows an individual, with the individual's qualified medical provider in the qualified medical provider's office, to apply for a medical cannabis patient card or, if applicable, a medical cannabis guardian card; (b) allows an individual to apply to renew a medical cannabis patient card or a medical cannabis guardian card in accordance with Section 26-61a-201; (c) allows a qualified medical provider to: (i) access dispensing and card status information regarding a patient: (A) with whom the qualified medical provider has a provider-patient relationship; and (B) for whom the qualified medical provider has recommended or is considering recommending a medical cannabis card; (ii) electronically recommend, during a visit with a patient, treatment with cannabis in a medicinal dosage form or a cannabis product in a medicinal dosage form and optionally recommend dosing parameters; (iii) electronically renew a recommendation to a medical cannabis patient cardholder or medical cannabis guardian cardholder: (A) for the qualified medical provider who originally recommended a medical cannabis treatment, as that term is defined in Section 26-61a-102, using telehealth services; or (B) for a qualified medical provider who did not originally recommend the medical cannabis treatment, during a face-to-face visit with a patient; and (iv) notate a determination of physical difficulty or undue hardship, described in Subsection 26-61a-202(1), to qualify a patient to designate a caregiver; (d) connects with: (i) an inventory control system that a medical cannabis pharmacy uses to track in real time and archive purchases of any cannabis in a medicinal dosage form, cannabis product in a medicinal dosage form, or a medical cannabis device, including: (A) the time and date of each purchase; (B) the quantity and type of cannabis, cannabis product, or medical cannabis device purchased; (C) any cannabis production establishment, any medical cannabis pharmacy, or any medical cannabis courier associated with the cannabis, cannabis product, or medical cannabis device; and (D) the personally identifiable information of the medical cannabis cardholder who made the purchase; and (ii) any commercially available inventory control system that a cannabis production establishment utilizes in accordance with Section 4-41a-103 to use data that the Department of Agriculture and Food requires by rule, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, from the inventory tracking system that a licensee uses to track and confirm compliance; (e) provides access to: (i) the department to the extent necessary to carry out the department's functions and responsibilities under this chapter; (ii) the Department of Agriculture and Food to the extent necessary to carry out the functions and responsibilities of the Department of Agriculture and Food under Title 4, Chapter 41a, Cannabis Production Establishments; and (iii) the Division of Occupational and Professional Licensing to the extent necessary to carry out the functions and responsibilities related to the participation of the following in the recommendation and dispensing of medical cannabis: (A) a pharmacist licensed under Title 58, Chapter 17b, Pharmacy Practice Act; (B) an advanced practice registered nurse licensed under Title 58, Chapter 31b, Nurse Practice Act; (C) a physician licensed under Title 58, Chapter 67, Utah Medical Practice Act, or Title 58, Chapter 68, Utah Osteopathic Medical Practice Act; or (D) a physician assistant licensed under Title 58, Chapter 70a, Utah Physician Assistant Act; (f) provides access to and interaction with the state central patient portal; (g) provides access to state or local law enforcement: (i) during a traffic stop for the purpose of determining if the individual subject to the traffic stop is in compliance with state medical cannabis law; or (ii) after obtaining a warrant; and (h) creates a record each time a person accesses the database that identifies the person who accesses the database and the individual whose records the person accesses.

(a) allows an individual, with the individual's qualified medical provider in the qualified medical provider's office, to apply for a medical cannabis patient card or, if applicable, a medical cannabis guardian card;

(b) allows an individual to apply to renew a medical cannabis patient card or a medical cannabis guardian card in accordance with Section 26-61a-201;

(c) allows a qualified medical provider to: (i) access dispensing and card status information regarding a patient: (A) with whom the qualified medical provider has a provider-patient relationship; and (B) for whom the qualified medical provider has recommended or is considering recommending a medical cannabis card; (ii) electronically recommend, during a visit with a patient, treatment with cannabis in a medicinal dosage form or a cannabis product in a medicinal dosage form and optionally recommend dosing parameters; (iii) electronically renew a recommendation to a medical cannabis patient cardholder or medical cannabis guardian cardholder: (A) for the qualified medical provider who originally recommended a medical cannabis treatment, as that term is defined in Section 26-61a-102, using telehealth services; or (B) for a qualified medical provider who did not originally recommend the medical cannabis treatment, during a face-to-face visit with a patient; and (iv) notate a determination of physical difficulty or undue hardship, described in Subsection 26-61a-202(1), to qualify a patient to designate a caregiver;

(i) access dispensing and card status information regarding a patient: (A) with whom the qualified medical provider has a provider-patient relationship; and (B) for whom the qualified medical provider has recommended or is considering recommending a medical cannabis card;

(A) with whom the qualified medical provider has a provider-patient relationship; and

(B) for whom the qualified medical provider has recommended or is considering recommending a medical cannabis card;

(ii) electronically recommend, during a visit with a patient, treatment with cannabis in a medicinal dosage form or a cannabis product in a medicinal dosage form and optionally recommend dosing parameters;

(iii) electronically renew a recommendation to a medical cannabis patient cardholder or medical cannabis guardian cardholder: (A) for the qualified medical provider who originally recommended a medical cannabis treatment, as that term is defined in Section 26-61a-102, using telehealth services; or (B) for a qualified medical provider who did not originally recommend the medical cannabis treatment, during a face-to-face visit with a patient; and

(A) for the qualified medical provider who originally recommended a medical cannabis treatment, as that term is defined in Section 26-61a-102, using telehealth services; or

(B) for a qualified medical provider who did not originally recommend the medical cannabis treatment, during a face-to-face visit with a patient; and

(iv) notate a determination of physical difficulty or undue hardship, described in Subsection 26-61a-202(1), to qualify a patient to designate a caregiver;

(d) connects with: (i) an inventory control system that a medical cannabis pharmacy uses to track in real time and archive purchases of any cannabis in a medicinal dosage form, cannabis product in a medicinal dosage form, or a medical cannabis device, including: (A) the time and date of each purchase; (B) the quantity and type of cannabis, cannabis product, or medical cannabis device purchased; (C) any cannabis production establishment, any medical cannabis pharmacy, or any medical cannabis courier associated with the cannabis, cannabis product, or medical cannabis device; and (D) the personally identifiable information of the medical cannabis cardholder who made the purchase; and (ii) any commercially available inventory control system that a cannabis production establishment utilizes in accordance with Section 4-41a-103 to use data that the Department of Agriculture and Food requires by rule, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, from the inventory tracking system that a licensee uses to track and confirm compliance;

(i) an inventory control system that a medical cannabis pharmacy uses to track in real time and archive purchases of any cannabis in a medicinal dosage form, cannabis product in a medicinal dosage form, or a medical cannabis device, including: (A) the time and date of each purchase; (B) the quantity and type of cannabis, cannabis product, or medical cannabis device purchased; (C) any cannabis production establishment, any medical cannabis pharmacy, or any medical cannabis courier associated with the cannabis, cannabis product, or medical cannabis device; and (D) the personally identifiable information of the medical cannabis cardholder who made the purchase; and

(A) the time and date of each purchase;

(B) the quantity and type of cannabis, cannabis product, or medical cannabis device purchased;

(C) any cannabis production establishment, any medical cannabis pharmacy, or any medical cannabis courier associated with the cannabis, cannabis product, or medical cannabis device; and

(D) the personally identifiable information of the medical cannabis cardholder who made the purchase; and

(ii) any commercially available inventory control system that a cannabis production establishment utilizes in accordance with Section 4-41a-103 to use data that the Department of Agriculture and Food requires by rule, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, from the inventory tracking system that a licensee uses to track and confirm compliance;

(e) provides access to: (i) the department to the extent necessary to carry out the department's functions and responsibilities under this chapter; (ii) the Department of Agriculture and Food to the extent necessary to carry out the functions and responsibilities of the Department of Agriculture and Food under Title 4, Chapter 41a, Cannabis Production Establishments; and (iii) the Division of Occupational and Professional Licensing to the extent necessary to carry out the functions and responsibilities related to the participation of the following in the recommendation and dispensing of medical cannabis: (A) a pharmacist licensed under Title 58, Chapter 17b, Pharmacy Practice Act; (B) an advanced practice registered nurse licensed under Title 58, Chapter 31b, Nurse Practice Act; (C) a physician licensed under Title 58, Chapter 67, Utah Medical Practice Act, or Title 58, Chapter 68, Utah Osteopathic Medical Practice Act; or (D) a physician assistant licensed under Title 58, Chapter 70a, Utah Physician Assistant Act;

(i) the department to the extent necessary to carry out the department's functions and responsibilities under this chapter;

(ii) the Department of Agriculture and Food to the extent necessary to carry out the functions and responsibilities of the Department of Agriculture and Food under Title 4, Chapter 41a, Cannabis Production Establishments; and

(iii) the Division of Occupational and Professional Licensing to the extent necessary to carry out the functions and responsibilities related to the participation of the following in the recommendation and dispensing of medical cannabis: (A) a pharmacist licensed under Title 58, Chapter 17b, Pharmacy Practice Act; (B) an advanced practice registered nurse licensed under Title 58, Chapter 31b, Nurse Practice Act; (C) a physician licensed under Title 58, Chapter 67, Utah Medical Practice Act, or Title 58, Chapter 68, Utah Osteopathic Medical Practice Act; or (D) a physician assistant licensed under Title 58, Chapter 70a, Utah Physician Assistant Act;

(A) a pharmacist licensed under Title 58, Chapter 17b, Pharmacy Practice Act;

(B) an advanced practice registered nurse licensed under Title 58, Chapter 31b, Nurse Practice Act;

(C) a physician licensed under Title 58, Chapter 67, Utah Medical Practice Act, or Title 58, Chapter 68, Utah Osteopathic Medical Practice Act; or

(D) a physician assistant licensed under Title 58, Chapter 70a, Utah Physician Assistant Act;

(f) provides access to and interaction with the state central patient portal;

(g) provides access to state or local law enforcement: (i) during a traffic stop for the purpose of determining if the individual subject to the traffic stop is in compliance with state medical cannabis law; or (ii) after obtaining a warrant; and

(i) during a traffic stop for the purpose of determining if the individual subject to the traffic stop is in compliance with state medical cannabis law; or

(ii) after obtaining a warrant; and

(h) creates a record each time a person accesses the database that identifies the person who accesses the database and the individual whose records the person accesses.

(3) The department may release limited data that the system collects for the purpose of: (a) conducting medical and other department approved research; (b) providing the report required by Section 26-61a-703; and (c) other official department purposes.

(a) conducting medical and other department approved research;

(b) providing the report required by Section 26-61a-703; and

(c) other official department purposes.

(4) The department shall make rules, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, to establish: (a) the limitations on access to the data in the state electronic verification system as described in this section; and (b) standards and procedures to ensure accurate identification of an individual requesting information or receiving information in this section.

(a) the limitations on access to the data in the state electronic verification system as described in this section; and

(b) standards and procedures to ensure accurate identification of an individual requesting information or receiving information in this section.

(5) (a) Any person who knowingly and intentionally releases any information in the state electronic verification system in violation of this section is guilty of a third degree felony. (b) Any person who negligently or recklessly releases any information in the state electronic verification system in violation of this section is guilty of a class C misdemeanor.

(a) Any person who knowingly and intentionally releases any information in the state electronic verification system in violation of this section is guilty of a third degree felony.

(b) Any person who negligently or recklessly releases any information in the state electronic verification system in violation of this section is guilty of a class C misdemeanor.

(6) (a) Any person who obtains or attempts to obtain information from the state electronic verification system by misrepresentation or fraud is guilty of a third degree felony. (b) Any person who obtains or attempts to obtain information from the state electronic verification system for a purpose other than a purpose this chapter authorizes is guilty of a third degree felony.

(a) Any person who obtains or attempts to obtain information from the state electronic verification system by misrepresentation or fraud is guilty of a third degree felony.

(b) Any person who obtains or attempts to obtain information from the state electronic verification system for a purpose other than a purpose this chapter authorizes is guilty of a third degree felony.

(7) (a) Except as provided in Subsection (7)(e), a person may not knowingly and intentionally use, release, publish, or otherwise make available to any other person information obtained from the state electronic verification system for any purpose other than a purpose specified in this section. (b) Each separate violation of this Subsection (7) is: (i) a third degree felony; and (ii) subject to a civil penalty not to exceed $5,000. (c) The department shall determine a civil violation of this Subsection (7) in accordance with Title 63G, Chapter 4, Administrative Procedures Act. (d) Civil penalties assessed under this Subsection (7) shall be deposited into the General Fund. (e) This Subsection (7) does not prohibit a person who obtains information from the state electronic verification system under Subsection (2)(a), (c), or (f) from: (i) including the information in the person's medical chart or file for access by a person authorized to review the medical chart or file; (ii) providing the information to a person in accordance with the requirements of the Health Insurance Portability and Accountability Act of 1996; or (iii) discussing or sharing that information about the patient with the patient.

(a) Except as provided in Subsection (7)(e), a person may not knowingly and intentionally use, release, publish, or otherwise make available to any other person information obtained from the state electronic verification system for any purpose other than a purpose specified in this section.

(b) Each separate violation of this Subsection (7) is: (i) a third degree felony; and (ii) subject to a civil penalty not to exceed $5,000.

(i) a third degree felony; and

(ii) subject to a civil penalty not to exceed $5,000.

(c) The department shall determine a civil violation of this Subsection (7) in accordance with Title 63G, Chapter 4, Administrative Procedures Act.

(d) Civil penalties assessed under this Subsection (7) shall be deposited into the General Fund.

(e) This Subsection (7) does not prohibit a person who obtains information from the state electronic verification system under Subsection (2)(a), (c), or (f) from: (i) including the information in the person's medical chart or file for access by a person authorized to review the medical chart or file; (ii) providing the information to a person in accordance with the requirements of the Health Insurance Portability and Accountability Act of 1996; or (iii) discussing or sharing that information about the patient with the patient.

(i) including the information in the person's medical chart or file for access by a person authorized to review the medical chart or file;

(ii) providing the information to a person in accordance with the requirements of the Health Insurance Portability and Accountability Act of 1996; or

(iii) discussing or sharing that information about the patient with the patient.