This bill amends RCW 69.51A.230 to require the department to contract with an entity to create, administer, and maintain a secure, confidential medical cannabis authorization database. The database must allow endorsed cannabis retailers to add qualifying patients and designated providers and record authorized amounts of concentrates, usable cannabis, infused products, or plants; allow authorized prescribers/dispensers to access patient health information for care; allow patients and designated providers to request their own records and see which entities queried them; permit retailers and specified law enforcement or prosecutorial officials engaged in bona fide specific investigations to confirm recognition card validity; and allow the Department of Revenue and the Liquor and Cannabis Board to verify tax exemptions. Authorizations entered in the database expire after six months for qualifying patients under 18 and after one year for qualifying patients 18 or older. The bill creates a recognition card process and associated procedural rules: patients and designated providers may be placed in the database at a medical-endorsement retailer and issued a recognition card containing a randomly generated unique ID, photographic ID taken at the retailer, authorized amounts, effective and expiration dates, the authorizing health care professional’s name, and other required security features. Compassionate care renewals may be performed by a designated provider without the patient’s physical presence and are exempt from the photograph requirement. Replacement card rules, reexamination requirements for reentry, and a five-year minimum retention period for records are specified. The department must charge a $1 fee for each initial and renewal recognition card collected by the retailer and deposited into the dedicated cannabis account; database administrators who fail to comply may face contract cancellation and fines up to $5,000, with fines deposited into the health professions account. The department may adopt implementing rules. The bill imposes specific security and privacy requirements and confidentiality limits: personally identifiable information must be rendered nonreversible consistent with NIST standards, not be linkable using external data, incorporate current differential privacy practices, be upgradable, and be exempt from public disclosure under chapter 42.56 RCW, although aggregate redacted data may be released for oversight. The text also specifies that information shall not be shared with the federal government unless the particular qualifying patient or designated provider is convicted in state court for violating chapter 69.51A or chapter 69.50 RCW. Important context is missing in the extracted text: the specific department named is not identified, statutory definitions for “qualifying patient” and “designated provider” are not provided here, procedures and criteria for law enforcement “bona fide specific investigation” access are not detailed, the contracting and selection process for the database administrator is not described, NIST technical methods are not spelled out, and the department’s rule language and fee remittance schedule are not included.

If enacted, the state will require a contracted entity to run a secure, confidential medical cannabis authorization database and issue recognition cards when qualifying patients or their designated providers are entered by cannabis retailers with a medical endorsement. The cards will include a photo, a unique ID, authorized product amounts, dates, and the authorizing clinician’s name; authorizations automatically expire after six months for minors and one year for adults and need a new health care reexamination for reentry. Authorized access will include treating prescribers/dispensers, endorsed retailers, tax and regulatory agencies, and law enforcement on bona fide investigations; personally identifiable information must meet NIST-aligned nonreversible and differential privacy standards, is withheld from public disclosure and federal access unless a state conviction occurs, and records must be kept for at least five years. The immediate burden and changes fall heaviest on cannabis retailers and the contracted database administrator: retailers must collect a $1 fee per initial or renewal, take photos, enter patients/providers, issue and replace recognition cards, and remit fees to the state’s dedicated cannabis account, adding modest operational steps and a small revenue flow; the administrator must meet strict privacy rules and can be fined up to $5,000 for noncompliance. Qualifying patients, designated providers, and health care professionals will have authorizations tracked and subject to review by disciplining authorities, and departments such as revenue and the liquor and cannabis board will use the system to verify tax exemptions. Important details are missing here—most notably which specific department will run the program, the statutory definitions of qualifying patient and designated provider, the exact standards for law enforcement “bona fide” access, and how the database contractor will be selected and overseen.