In March, state auditors gave the Medical Marijuana Enforcement Division a bad review for its ineffective tracking systems and delayed application processes. But that was only part one of a two-part report. The other half was released yesterday.

The second part of the audit had the same dismal view of medical marijuana enforcement, but this time focused on the shortcomings of the Colorado Department of Public Health and Environment (CDPHE) and Department of Revenue (DOR).

The department was shown to have few oversights when it came to monitoring physicians, caregivers and processing applications, has been collecting too much in fees and needs to update technology.

The report is almost ninety pages long, and gives recommendations to correct problems in three areas: regulation, program administration and fiscal management. Here are the audit's main points on each issue:

REGULATION

Physician Oversight

The auditors found several issues regarding physicians issuing red cards. For the 106,000 MMJ patients currently on file, only a small number of doctors issued their referrals.

Below is a graphic which shows the average number of patients per physician in the country (the red line), and compares that with the top fifty physicians giving MMJ referrals.

Auditors also looked at several web advertisements for physicians, and found twelve made claims that indicated their medical evaluations would be genuine or objective. They claimed convenience for easy access to marijuana, said medical records were not necessary, offered refunds and guarantees, and showed that some dispensaries had on-site doctors. Much of this alludes to financial ties between dispensaries and physicians, which are prohibited.

The audit also had issues with physicians authorizing high plant counts, with one patient being recommended 501 plants (the typical is 6). More patients are also being referred to MMJ for severe pain, which the auditors say may be a cover for using the drug illegally.

The CDPHE has the ability to refer doctors to the medical board for further investigation, which it has -- but not since 2011.

Caregivers The report shows that caregivers are almost completely unregulated; they do not have to pass any sort of checks to become a caregiver, their names are almost impossible to gain by law enforcement officials, and they are not monitored to ensure that they are doing their job. Caregivers are also supposed to do more than just grow for patients; they are supposed to provide living assistance, which is something that is presumably not happening in most scenarios.

Continue reading for more CDPHE flaws.

PROGRAM ADMINISTRATION

Confidential Data

Auditors had several concerns regarding state employees dealing with confidential data. Only public health employees were supposed to be granted access to MMJ records, but they gave access to other agencies, including Colorado Health Emergency Line for Public Information, which had read only access to all registry data, Express Employment Professionals and Division of Central Services, which supplied temporary workers to handle increased workloads from 2010 to 2012, and the Governor's Office of Information Technology, which acts as the system administrator for the registry.

The agency was also shown to have fifteen confidentiality breaches from 2009 to 2012. The breaches included sending patient information and red cards to wrong addresses, having the incorrect caregiver listed on a red card, exposing information to a public health employee that did not do work related to marijuana, and sending a spreadsheet with the names of all caregivers active in December 2012.

Database Controls

The database that holds the patient registry has false information and is not secure. According to the audit, 7 percent of the active records had false or missing information. There is also no way to look at any changes that have been made to an application -- according to state auditor Reed Larsen, this opens the system to fraud. While there have been no reported cases so far, Larsen says that it would be easy to change the name and birthdate on an application, print a red card and then change it back.

Both flaws could be prevented with technology upgrades.

FISCAL MANAGEMENT

Unlike the MED, which has a shortage of money, the CDPHE has an excess of money in the Medical Marijuana Cash Fund from application fees. The cash fund has seen significant growth, climbing from a year-end balance of $301,000 in 2009 to over $12 million last year. Which this over-abundance of cash may not seem like a problem, it violates state statutes: The cash fund is supposed to generate only enough money to support the services being provided.

There have been steps taken to correct this, but auditors say they were not enough. The application fee has gone down dramatically, from $110 in 2007 to the current $35, but according to the audit the CDPHE could run on its current fund for four years without charging any fees. Two legislative transfers have already moved money from the cash fund to the General Fund: $260,000 in 2009 and $3 million in 2010. There was also talk of using the excess money to fund technology upgrades.

"The department typically oversees facilities, not people," says interim director Karin McGowen in the CDPHE's defense. "We're normally not overseeing people and what they do and how they do it. It is a unique animal and we are learning as we are moving forward."

The audit report made a total of nine recommendations to fix the problems; the CDPHE and DOR agreed to at least try to carry them out.

More from our Marijuana archive: "Photos: 710 hash event touted as Denver's first."

• Marijuana