MORE

Marijuana patients to protest introduction of new tracking system

At 10:30 a.m., state officials will unveil the Marijuana Inventory Tracking Solution, or MITS, a system intended to keep tabs pot for sale in Colorado. But while the press is invited to the event, a number of medical marijuana patients coordinated by the Cannabis Therapy Institute have invited themselves -- to protest what they believe will be regular breaches of confidentiality.

Get details about the event and the history of allegations regarding alleged info sharing.

First, some background about confidentiality complaints.

As we noted in an August post, we first wrote about efforts to establish computer access to the state's marijuana registry database for police in May 2012. Our William Breathes noted at the time that House Bill 1284, the medical marijuana regulatory measure passed in 2010, charged the state with developing a tracking system that funnels information from the Colorado Bureau of Investigations, the Colorado Department of Public Health and Environment and the Medical Marijuana Enforcement Division into a database accessible by local law enforcement needing to verify legal status.

A damning auditor's report released earlier this year reveals that the final version of the system, described as an "automated interface between the Registry and the Colorado Crime Information Center (CCIC), a statewide computer system that delivers criminal justice information to law enforcement agencies," went live in April. But the document suggests that the data available through this interface may go beyond simply registry confirmation by providing law enforcers access to details like the number of plants and amount of cannabis a given patient is allowed to possess. This particularly concerned CTI's Laura Kriho, since the CCIC computer is part of a national law enforcement database -- and as we know, marijuana remains illegal in all quantities and for every use at the federal level.

The auditor's report documented at least five confidentiality breaches related to this system. Here they are:

• Patient information sent to the wrong recipients (5 incidents)

• Patient red cards sent to the wrong recipients (5 incidents)

• Incorrect caregiver listed on a patient's red card (3 incidents)

• Patient information exposed to Public Health staff who do not perform work related to medical marijuana (1 incident)

• Names of all caregivers who were active as of December 2012 sent in a spreadsheet to the State Auditor (1 incident)

Given this history, Kriho is even more wary about MITS, which ran afoul of critics back in October thanks to a video intended to reassure members of the cannabis industry about the system, but wound up alarming them instead.

Here's the aforementioned MITS video:

According to Kriho, "the video said they had patient identification information and patient plant counts in their database -- and we were curious how they got this information, since the state constitution says in order for law enforcement to access the database, they have to have stopped or arrested a patient, and the patient has to hand them their identification card. And now they will be able to do it online, with the MITS system -- and you know every patient who goes to a dispensary hasn't been stopped or arrested."

With this in mind, Kathleen Chippi of the Patient and Caregiver Rights Litigation Project, who shares concerns about MITS with Kriho, reached out to Ron Hyman, state registrar and Office of Vital Statistics and Medical Marijuana Registry director, and Marijuana Enforcement Division spokeswoman Julie Postlethwait. And according to Kriho, Chippi received contradictory information. Below, we've reproduced a CTI release featuring links to e-mails with Hyman and Postlethwait, among many other things -- but here's an excerpt from a December 2 note from Chippi to Hyman:

You told me clearly in an e-mail dated Nov. 15 that "The Department has not shared patient information with DOR."

You asked me to contact Julie Postlethwait of the DOR, which I did. I asked her by e-mail, "If there is no data-sharing with the CDPHE, how do you verify an MMC's plant counts and cannabis amount counts?"

Julie Postlethwait confirms my suspicions that the CDPHE is sharing confidential, protected patient information with the DOR, despite your denial of this fact.

On Nov. 29, 2013, Postlethwait responded to my inquiry by saying: "The MED is able to verify registry card numbers and plant counts with CDPHE; we request the info on a specific card number and they confirm it is current and the recommended plant count."

This issue is among those at the heart of today's protest.

"They're all guilty of violating patient confidentiality, and we're asking them to stop," Kriho says. She adds that, in her view, the Colorado Department of Public Health and Environment "is not doing a good job of keeping the registry confidential. They breached the registry with the police database, and now they've breached the registry for the convenience of the Department of Revenue -- and what's the point of being on the registry if your information isn't going to be confidential?"

The protest's theme? "Get your MITS off my meds!"

Continue to read releases from the Marijuana Enforcement Division/Department of Revenue about today's news conference and the Cannabis Therapy Institute in regard to the protest.

Marijuana Enforcement Division/Department of Revenue release:

Marijuana Inventory Tracking solution

Demonstration News Conference

WHAT: Demonstration of the Department of Revenue Marijuana Enforcement Division's inventory tracking system, known as the Marijuana Inventory Tracking Solution (MITS). The introductions and MITS demonstrations will be followed by a questions-and-answers session.

WHEN: Wednesday, December 11 from 10:30 a.m.-11:30 a.m.

WHERE: 455 Sherman Street, First Floor Conference Room, Denver 80203

(Free street parking is available, 2 hour limit)

WHY: MITS is part of the robust marijuana enforcement program and will work in concert with 24-hour video surveillance, scheduled and unscheduled compliance checks, issue specific enforcement actions and focused investigations based on tips and risk analysis. MITS will also provide industry members and MED staff with an efficient and easy to use tool to collect, review and analyze inventory data.

Speakers: Barbara Brohl, Executive Director for the Colorado Department of Revenue; Jeff Wells, President of Framwell, Inc. (program vendor), Ron Kammerzell, Enforcement Senior Director; and Lewis Koski, Marijuana Enforcement Chief of Investigations.

A video of the news conference will be posted on the Division website's News and Information Page later that day.

Cannabis Therapy Institute release:

Patient Privacy Protest at Department of Revenue -- Wednesday

DOR Illegally Accesses Confidential Patient Registry

Patient Privacy Protest

Wed., Dec. 11, 2013

10:00am

DOR's Marijuana Criminal Enforcement Division (MCED)

455 Sherman Street, Denver, Colorado

{Denver} -- The Department of Revenue is holding a press conference on Wed. at 10:30am at the headquarters of the DOR's Marijuana Criminal Enforcement Division (MCED) to unveil their multi-million dollar patient and medicine tracking system, that uses Radio Frequency Identification (RFID) chips to track every gram of cannabis in the state from "seed to sale."

The Department of Revenue admits that it illegally obtains information from the confidential medical marijuana Registry, run by the Colorado Department of Public Health and Environment (CDPHE), to confirm medical marijuana patient status, plant counts, and dosage recommendations in their new online system, called the Marijuana Inventory Tracking System (MITS).

CLICK HERE for the link.

The MITS system is designed to make sure Medical Marijuana Centers (MMCs) stay within their plant and medicine count, based on the number of patients each MMC has. However, there is no legal way for the DOR to confirm patient numbers and plant counts aside from confirming it with the constitutionally-protected confidential MMJ Registry.

The Constitution requires the CDPHE to keep a confidential Registry of medical marijuana patients who voluntarily give their name to the state in order to be protected from law enforcement. The Constitution states that law enforcement can only receive information from the Registry if they have "stopped or arrested" someone who presents them a with medical marijuana Registry ID card. The DOR-MCED is a criminal law enforcement agency, but they have not "stopped or arrested" the thousands of medical marijuana patients who have voluntarily registered so they can shop at MMCs.

A joint investigation by the Cannabis Therapy Institute, the Patient and Caregiver Rights Litigation Project, and the Cannabis Press Association reveals that the MCED says they routinely "verify registry card numbers and plant counts with CDPHE", even though it is illegal to do so. In an e-mail dated Nov. 29 to PCRLP from the MCED's PIO Julie Postlethwait, the MCED states "we request the info on a specific card number and they (CDPHE) confirm it is current and the recommended plant count."

CLICK HERE TO READ DOR and CDPHE E-MAILS:

However, the CDPHE flatly denies Postlethwait's statement. On Nov. 15, in response to a Colorado Open Records Act (CORA) request, CDHPE's Ron Hyman, director of the Medical Marijuana Registry, wrote in an e-mail, "Medical Marijuana Registry (MMR) information is not shared for the purpose of maintaining or updating the DOR MITS database." Hyman claimed, "The Department has not shared patient information with DOR."

When confronted with Postlethwait's comments that they do get information from CDPHE, Hyman had no response. On Dec. 5, he provided PCRLP with a copy of CDHPE's policy for dealing with law enforcement and MMC requests for patient information, which he said is "no longer in effect." He did not provide the current policy, nor did he say when the policy he sent became "no longer in effect."

CLICK HERE for more information.

In his Dec. 5 e-mail, Hyman also stated that CDPHE has "requested a legal opinion from the Attorney General's Office regarding some of the issues raised in the State Auditor's Report, including law enforcement access to registry information, and we are awaiting their response. Once those opinions are received, we will evaluate our processes to ensure full legal compliance."

This is the second time that CTI and PCRLP have documented registry breaches by law enforcement. Previously, breaches were exposed between the Registry and the Colorado Bureau of Investigation's CCIC online interface that allows the confidential MMJ Registry to be accessed from the squad car of any local, state or federal law enforcement entity.

CLICK HERE for more information.

The CDPHE admitted they could not control what law enforcement does with the Registry with regards to the CBI. At the Board of Health meeting on Aug. 21, 2013, Hyman stated repeatedly that "We don't control what law enforcement does with the Registry information."

The DOR's breaches for the MITS database, on top of the CBI breaches for the CCIC database, prove the CDPHE cannot be trusted to keep the MMJ Registry confidential. Patients must assume that all law enforcement has access to all their patient information, especially if they have ever shopped at an MMC.

The Colorado Office of the State Auditor gave the CDPHE an "F" for maintaining a confidential Registry in June. The Auditor uncovered several incidents where the MCED tried to "verify red card information about multiple patients at one time, ranging from five to 107 patients. According to Public Health, Revenue officers wanted to determine if a dispensary's medical marijuana inventory correlated to the amount of medical marijuana authorized for the dispensary's registered patients. We question whether Revenue enforcement officers have legal authority to verify patient Registry data during their dispensary investigations, because it is unlikely that those officers have actually 'stopped or arrested' every patient associated with a particular dispensary."

June Auditor's Report on CDPHE MMJ Registry, page 64

In an October 16, 2013 Board of Health hearing, Registry Director Hyman insisted that he never gave the MCED any patient information. The head IT director of the Registry testified that, even though the MCED requested information on multiple patients at once, those requests were denied. MCED's Postlethwait's e-mail of Nov. 29 directly contradicts this.

"Patients should be concerned," says Kathleen Chippi, of the Patient and Caregiver Rights Litigation Project, who has paid for the only lawsuits ever filed in the state to try to protect patient privacy, without the help of a single MMC. "Breaches of patient confidentiality could cause the loss of child custody, employment, drivers license, occupational licenses, and firearms. MMC owners should step up to help protect their customers' privacy."

Send your story tips to the author, Michael Roberts.

More from our Marijuana archive circa October: "Marijuana Inventory Tracking system security complaints to prompt video changes."


Sponsor Content