Title 26B Chapter 4 Part 2 Section 202

Download Options PDF | RTF | XML

Index	Utah Code
Title 26B	Utah Health and Human Services Code
Chapter 4	Health Care - Delivery and Access
Part 2	Cannabinoid Research and Medical Cannabis
Section 202	Electronic verification system. *(Effective 5/6/2026)*

Effective 5/6/2026
26B-4-202. Electronic verification system.

(1)

The department, the Department of Public Safety, and the Division of Technology Services shall:

(a)	enter into a memorandum of understanding in order to determine the function and operation of the state electronic verification system in accordance with Subsection (2);

(b)

coordinate with the Division of Purchasing and General Services, under Title 63G, Chapter 6a, Utah Procurement Code, to develop a request for proposals for a third-party provider to develop and maintain the state electronic verification system in coordination with the Division of Technology Services; and

(c)

select a third-party provider who:

(i)	meets the requirements contained in the request for proposals issued under Subsection (1)(b); and

(ii)	may not have any commercial or ownership interest in a cannabis production establishment or a medical cannabis pharmacy.

(2)

The department, the Department of Public Safety, and the Division of Technology Services shall ensure that the state electronic verification system described in Subsection (1):

(a)

allows an individual to apply for a medical cannabis patient card or, if applicable, a medical cannabis guardian card, provided that the card may not become active until:

(i)	the relevant recommending medical provider completes the associated medical cannabis recommendation; or

(ii)	the medical cannabis pharmacy completes the recording described in Subsections (2)(d)(ii) and (iii);

(b)	allows an individual to apply to renew a medical cannabis patient card or a medical cannabis guardian card in accordance with Section 26B-4-213;

(c)

allows a recommending medical provider, or an employee described in Subsection (3) acting on behalf of the recommending medical provider, to:

(i)

access dispensing and card status information regarding a patient:

(A)	with whom the recommending medical provider has a provider-patient relationship; and

(B)	for whom the recommending medical provider has recommended or is considering recommending a medical cannabis card;

(ii)	electronically recommend treatment with medical cannabis and optionally recommend dosing guidelines;

(iii)

electronically renew a recommendation to a medical cannabis patient cardholder or medical cannabis guardian cardholder:

(A)	using telehealth services, for the recommending medical provider who originally recommended a medical cannabis treatment during a face-to-face visit with the patient; or

(B)	during a face-to-face visit with the patient, for a recommending medical provider who did not originally recommend the medical cannabis treatment during a face-to-face visit; and

(iv)

submit an initial application, renewal application, or application payment on behalf of an individual applying for any of the following:

(A)	a medical cannabis patient card;

(B)	a medical cannabis guardian card; or

(C)	a medical cannabis caregiver card;

(d)

allows a medical cannabis pharmacy medical provider or medical cannabis pharmacy agent, in accordance with Subsection 4-41a-1101(10)(a), to:

(i)	access the electronic verification system to review the history within the system of a patient with whom the provider or agent is interacting, limited to read-only access for medical cannabis pharmacy agents unless the medical cannabis pharmacy's pharmacist in charge authorizes add and edit access;

(ii)	record a patient's recommendation from a recommending medical provider, including any directions of use, dosing guidelines, or caregiver indications from the recommending medical provider;

(iii)

record a recommending medical provider's renewal of the provider's previous recommendation; and

(iv)

submit an initial application, renewal application, or application payment on behalf of an individual applying for any of the following:

(A)	a medical cannabis patient card;

(B)	a medical cannabis guardian card; or

(C)	a medical cannabis caregiver card;

(e)

connects with:

(i)

an inventory control system that a medical cannabis pharmacy uses to track in real time and archive purchases of any medical cannabis or a medical cannabis device, including:

(A)	the time and date of each purchase;

(B)	the quantity and type of medical cannabis or medical cannabis device purchased;

(C)	any cannabis production establishment, any medical cannabis pharmacy, or any medical cannabis courier associated with the medical cannabis or medical cannabis device; and

(D)	the personally identifiable information of the medical cannabis cardholder who made the purchase; and

(ii)

any commercially available inventory control system that a cannabis production establishment utilizes in accordance with Section 4-41a-103 to use data that the department requires by rule, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, from the inventory tracking system that a licensee uses to track and confirm compliance;

(f)

provides access to:

(i)	the department to the extent necessary to carry out the department's functions and responsibilities under this part;

(ii)	the department to the extent necessary to carry out the functions and responsibilities of the department under Title 4, Chapter 41a, Cannabis Production Establishments and Pharmacies; and

(iii)

the Division of Professional Licensing to the extent necessary to carry out the functions and responsibilities related to the participation of the following in the recommendation and dispensing of medical cannabis:

(A)	a podiatrist licensed under Title 58, Chapter 5a, Podiatric Physician Licensing Act;

(B)	a pharmacist licensed under Title 58, Chapter 17b, Pharmacy Practice Act;

(C)	an advanced practice registered nurse licensed under Title 58, Chapter 31b, Nurse Practice Act;

(D)	a physician licensed under Title 58, Chapter 67, Utah Medical Practice Act, or Title 58, Chapter 68, Utah Osteopathic Medical Practice Act; or

(E)	a physician assistant licensed under Title 58, Chapter 70a, Utah Physician Assistant Act;

(g)	communicates dispensing information from a record that a medical cannabis pharmacy submits to the state electronic verification system under Subsection 4-41a-1102(3)(a)(ii) to the controlled substance database;

(h)	provides access to state or local law enforcement only to verify the validity of an individual's medical cannabis card for the administration of criminal justice and through a database used by law enforcement; and

(i)	creates a record each time a person accesses the system that identifies the person who accesses the system and the individual whose records the person accesses.

(3)

(a)

An employee of a recommending medical provider may access the electronic verification system for a purpose described in Subsection (2)(c) on behalf of the recommending medical provider if:

(i)	the recommending medical provider has designated the employee as an individual authorized to access the electronic verification system on behalf of the recommending medical provider;

(ii)	the recommending medical provider provides written notice to the department of the employee's identity and the designation described in Subsection (3)(a)(i); and

(iii)

the department grants to the employee access to the electronic verification system.

(b)

An employee of a business that employs a recommending medical provider may access the electronic verification system for a purpose described in Subsection (2)(c) on behalf of the recommending medical provider if:

(i)	the recommending medical provider has designated the employee as an individual authorized to access the electronic verification system on behalf of the recommending medical provider;

(ii)	the recommending medical provider and the employing business jointly provide written notice to the department of the employee's identity and the designation described in Subsection (3)(b)(i); and

(iii)

the department grants to the employee access to the electronic verification system.

(c)

Every two years, an employee described in Subsections (3)(a) and (3)(b) shall complete education regarding health information privacy laws that is offered by the department or an accredited or approved education provider that the department recognizes before the department may grant the employee access to the electronic verification system.

(4)

(a)

Subject to Subsection (4)(c), a medical cannabis pharmacy agent may access the electronic verification system for a purpose described in Subsection (2)(d) if:

(i)	the pharmacist-in-charge has designated the agent as an individual authorized to access the electronic verification system;

(ii)	the agent completes continuing education regarding health information privacy laws that is offered by the department or an accredited or approved education provider that the department recognizes;

(iii)

the agent has completed the training described in Subsection (4)(a)(ii) within the previous two years; and

(iv)	the department grants to the agent access to the electronic verification system.

(b)	The pharmacist-in-charge shall ensure that each medical cannabis pharmacy agent working in the medical cannabis pharmacy who has access to the state electronic verification system is in compliance with Subsection (4)(a).

(c)	A medical cannabis pharmacy agent may not access the electronic verification system if the medical cannabis agent is not employed by a medical cannabis pharmacy.

(5)

(a)

As used in this Subsection (5), "prescribing provider" means:

(i)	a podiatrist licensed under Title 58, Chapter 5a, Podiatric Physician Licensing Act;

(ii)	an advanced practice registered nurse licensed under Title 58, Chapter 31b, Nurse Practice Act;

(iii)

a physician licensed under Title 58, Chapter 67, Utah Medical Practice Act, or Title 58, Chapter 68, Utah Osteopathic Medical Practice Act; or

(iv)	a physician assistant licensed under Title 58, Chapter 70a, Utah Physician Assistant Act.

(b)	A prescribing provider may access information in the electronic verification system regarding a patient the prescribing provider treats.

(6)

The department may release limited data that the system collects for the purpose of:

(a)	conducting medical and other department approved research;

(b)	providing the report required by Section 26B-4-222; and

(c)	other official department purposes.

(7)

The department shall make rules, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, to establish:

(a)	the limitations on access to the data in the state electronic verification system as described in this section; and

(b)	standards and procedures to ensure accurate identification of an individual requesting information or receiving information in this section.

(8)	Any person who negligently or recklessly releases any information in the state electronic verification system in violation of this section is guilty of a class C misdemeanor.

(9)	Any person who obtains or attempts to obtain information from the state electronic verification system by misrepresentation or fraud is guilty of a third degree felony.

(10)

(a)

Except as provided in Subsection (9)(e) and Subsection (11), a person may not knowingly and intentionally use, release, publish, or otherwise make available to any other person information obtained from the state electronic verification system for any purpose other than a purpose specified in this section.

(b)

Each separate violation of Subsection (10) is:

(i)	a third degree felony; and

(ii)	subject to a civil penalty not to exceed $5,000.

(c)	The department shall determine a civil violation of this Subsection (10) in accordance with Title 63G, Chapter 4, Administrative Procedures Act.

(d)	Civil penalties assessed under this Subsection (10) shall be deposited into the General Fund.

(e)

This Subsection (10) does not prohibit a person who obtains information from the state electronic verification system under Subsection (2)(a), (c), or (f) from:

(i)	including the information in the person's medical chart or file for access by a person authorized to review the medical chart or file;

(ii)	providing the information to a person in accordance with the requirements of the Health Insurance Portability and Accountability Act of 1996; or

(iii)

discussing or sharing that information about the patient with the patient.

(11)	A law enforcement officer who uses the database used by law enforcement to access information in the electronic verification system for a reason that is not the administration of criminal justice is guilty of a class B misdemeanor.

Amended by Chapter 421, 2026 General Session

<< Previous Section (26B-4-201.1)

Download Options PDF | RTF | XML

Next Section (26B-4-203) >>