Dispensary vs. Cultivation: Let's Get Ready to Rumble...

Jeremy Unruh
General Counsel and Chief Compliance Officer, PharmaCann LLC (IL & NY)

There is another competition going on inside the Illinois Medical Cannabis Pilot Program:

The Fight Card

In one corner weighing in at a healthy 96 pages, the dispensary regulations.  

In the other corner, coming in at a stout 108 pages...the cultivation regulations.

In Illinois, separate agencies govern the dispensary and cultivation center  medical cannabis providers.  The Illinois Department of Agriculture ("Ag") regulates the cultivation centers that produce medical cannabis products on a wholesale level, while the Illinois Department of Financial and Professional Regulation ("DFPR") keeps an eye on the dispensaries that sell medical cannabis to patients on the retail level. 

As a result, there are two separate sets of regulations.  One for growers, and the other for sellers.  Of course, each agency has a separate sphere of responsibility.  For example, why would DFPR, who regulates the sellers, be concerned about cultivation practices; or Ag, who regulates the growers, make rules about the maintenance of patient records? 

Both sets of regulations, however, touch on many of the same points, like security, the licensing of applicants, inventory control, dispute resolution, and operational matters.  This bifurcated scheme is a bit unusual since most other states keep all cannabis-related activity -- at least legal activity -- under the watchful eye of a single agency, even if that state's regulations recognize separate growing and dispensing entities (though in some states, licensees do both as a rule).  Think New York, where medical cannabis is entirely regulated by the Department of Health; or Colorado, where the Marijuana Enforcement Division of the Colorado Department of Revenue rules the roost. 

Tale of the Tape:

In this duality, sometimes Ag's cultivation regs are more favorable to the licensee, while in other areas DFPR's dispensary rules win out.  Here are just a few of of the highlights:

  • Security recording storage
  • Camera recording (continuous vs. motion-activated)
  • Visitor access
  • Advertising 
  • Audits



Security Recording Storage:

Security Recording Storage:  In Illinois cultivation centers, license holders must keep 90-days of security recordings onsite, ready to be accessed immediately.  So too, must dispensaries.  This requirement makes sense.  In my days as a criminal prosecutor, it wasn't unusual to need a printed image or security recording from a surveillance camera in a jiffy, whether for the grand jury, or the investigation of a criminal act as it unfolded.  

The problem is that a ~100,000 square foot facility might have hundreds of state-of-the-art cameras.  Storage for this amount of data can equal 50 or 60 terabytes of data each month or more.  Put this in perspective:  A mere ten terabytes can hold the entire printed collection of the Library of Congress.  Here is where the regulations diverge:  Cultivation centers must also keep an additional 90 days of security recordings offsite.  This means that while days 1 through 90 are onsite, days 91 through 180 have to be somehow moved off of the premises of the cultivation center to be held for another three months.  

The additional cost required to store this old footage isn't worth the benefit of having it around because a need for security recordings will usually fall into one of two camps.  Either you have a relatively sudden incident (fire, break-in, burst pipe, etc.) and need to go back and review the footage, or you use archival footage to investigate a difficult-to-detect internal scenario over time (the processing technician who seems to always be the last one out of the vault each day).  In the first instance, which is far more common, you'll know almost immediately that there is a reason to search, review, and keep surveillance footage.  In truth, if you are unable to detect a diversion of any materiality in 90-days time, then there is a bigger inventory control issue to blame than lost surveillance footage.  

Don't get me wrong, there are instances when old archival footage might be useful, but one must weight the cost of storage against the benefit of having the footage around.  A less burdensome fallback would require the cultivation centers to keep older footage onsite.  That would ameliorate the need to move hours and hours of video data offsite, which is complicated by the constraints of data pipelines generally available in rural Illinois.  Win goes to the dispensaries.

Camera Recording:

Dispensaries = continuous, 24-hour, 7-days a week recording in each and every room of the facility, as well as all entrances, exits, and wherever cannabis is kept.  Cultivation centers = motion activated recording.  In a cultivation center, the cameras only need to record when there is activity.  The Ag regs are far better of the two on this count.  Do you have any idea how much data storage is needed to capture the continuous camera view of a pitch-black mop closet at 4:00 a.m.?  

Good cameras of the sort used in cultivation centers are sensitive enough to start recording when the plants in the greenhouses wave back and forth in the fan breeze, or pick up the aircraft warning lights on distant windmills as they blink on the horizon at night.  Today's motion-sensitive CCTV cameras have sufficient horsepower to ensure the security of medical cannabis facilities and reduce the need to maintain useless security recordings from inactive areas.  Win goes to the cultivation centers. 


Visitor Access:  

Dispensaries are required to maintain a visitor access log that an inspector can review.  This access log identifies all non-patients and non-employees that a dispensary wants to allow to access the facility.  Under the DFPR regs, these "vendor logs" are intended for cleaning crews, electricians, and other service personnel who may need to access a dispensary periodically.  There is an interesting issue of law here, because the statute governing medical cannabis in Illinois bars all non-vendors, except properly credentialed employees, from accessing "restricted" areas of the dispensary, while the subordinate regulations have created an intermediate "limited access" area inside dispensaries where employees, patients, caregivers, vendors can go, but the general public cannot.  

Sometimes, its complicated for dispensary owners to make the right decision on whether an associate ought to be on that vendor list or not.  This leaves room for an honest (but potentially expensive) disagreement between a dispensary owner and the state.  On the other hand, cultivation centers must notify the Department when they have a contractor who needs to access the facility to work on a job unrelated to cannabis, and must request permission in order to bring a regular visitor onto the premises.  I'm not really sure which agency's regulation is better, but at the end of the day, the only concern is to make sure that access to restricted areas where high-value commodities are kept (like cash and cannabis), remains secure.  I don't take issue with this, I would just like to see some coordination of the rules on one side or the other.  I'd probably give this one to the cultivation centers, but its close. 



This is an interesting comparison.  Cultivation centers are only allowed to advertise to dispensaries or physicians.  Cultivation centers may not advertise cannabis products through any medium intended to reach the general public.  This can be read a few different ways.  First, it seems that as long as cultivation centers are not pushing actual products, it has carte blanche to tout branding and message.  Second, if a cultivator can identify a medium that is not available to the "general public" (perhaps an age or password-restricted website), then it's on solid footing.  Third, there may be an open question as to whether these rigid restrictions on commercial speech are able to pass the intermediate scrutiny of a court under a First Amendment analysis, particularly as it relates to the separate Election Code's prohibition on campaign contributions by medical cannabis licensees.  

On the flip side, dispensaries are only barred from advertising cannabis within 1000 feet of a school, park, library, etc.; on the public transit system; or in a public building.  However, dispensaries have a duty of education and outreach.  This affirmative obligation provides a clear mandate for dispensaries to inform the public about the risks and benefits of medical cannabis products.  Clearly, the dispensaries have a wonderful opportunity to reach out and touch the patients of Illinois that cultivators will never know.



In the cultivation world, there is no requirement for a third-party external audit, as exists in the dispensaries where a quarterly audit must be submitted, and an annual audit must be compiled by an auditor or certified public accountant.  Best practice requires real-time inventory tracking and some sort of periodic, independent third-party verification of inventory stock at a cultivation center, but the Ag rules require nothing more than weekly and annual inventories.  Though this external auditing is not without drawbacks, I believe the program will benefit from the transparency of a periodic third-party review.  Advantage dispensaries.

The Scorecard:

 These are just a handful of the differences between the regs for cultivation centers versus dispensaries.  Both Ag and DFPR have rules that on any given point may favor one class of medical marijuana licensee over the other.  Many of the current regulations dovetail with one another nicely, while others create a bit of  confusion at first blush.  For those tuned in to both cultivation centers and dispensaries, make sure you pay close attention to keep them straight, or risk being, ummm, knocked out...



Read Jeremy's original post on LinkedIn.