Marijuana advocates call for shutdown of police database and more

The Colorado Department of Public Health and Environment has been illegally sharing confidential patient information through an online database, and the only way to prevent more breaches is to shut it down immediately.

That's the contention of activists organizing a protest at tomorrow's state Board of Health meeting -- and their argument is bolstered by a damning report from the state auditor and a database agreement obtained through an open-records request. See both documents and get details about the claims below.

Cannabis Therapy Institute's Laura Kriho and Kathleen Chippi of the Patient and Caregiver Rights Litigation Project are listed as co-authors on an emergency petition calling for the database to be disabled; we've shared that document as well. According to Kriho, the main focus of tomorrow's event is "disabling the access of the police to the registry. Our petition says now that the registry has been compromised, we want you to destroy it and start over with something that actually is confidential."

We first wrote about efforts to establish computer access to the state's marijuana registry database for police in May 2012. As our William Breathes noted at the time, House Bill 1284, the medical marijuana regulatory measure passed in 2010, charged the state with developing a tracking system that funnels information from the Colorado Bureau of Investigations, the Colorado Department of Public Health and Environment and the Medical Marijuana Enforcement Division into a database accessible by local law enforcement needing to verify legal status.

The auditor's report reveals that the final version of the system, described as an "automated interface between the Registry and the Colorado Crime Information Center (CCIC), a statewide computer system that delivers criminal justice information to law enforcement agencies," went live in April. But the document suggests that the data available through this interface may go beyond simply registry confirmation by providing law enforcers access to details like the number of plants and amount of cannabis a given patient is allowed to possess. This particularly concerns Kriho, since the CCIC computer is part of a national law enforcement database -- and as we know, marijuana remains illegal in all quantities and for every use at the federal level.

Here's an excerpt from the report:

It is not clear that Public Health has constitutional authority to provide information about patient plant and ounce counts through the Registry-CCIC interface. The Colorado Constitution [art. XVIII, sec. 14(3)(a)] specifies that law enforcement shall be granted Registry access "only for the purpose of verifying that an individual who has presented a registry identification card to a state or local law enforcement official is lawfully in possession of such card." In the 2000 Blue Book, Amendment 20 proponents reiterated that law enforcement could access the Registry "to verify that an individual who is arrested for the possession or use of marijuana is registered" with Public Health. Knowing the quantities of medical marijuana that patients and their caregivers can legally possess does not appear to be necessary to verify that an individual is lawfully in possession of a red card.

Also worrisome to Kriho and other advocates is a section of the auditor's report labeled "Confidentiality Breaches."

Continue for more about tomorrow's protest, including additional photos and three original documents. The report points out fifteen instances of such breaches. They break down like so:

• Patient information sent to the wrong recipients (5 incidents)

• Patient red cards sent to the wrong recipients (5 incidents)

• Incorrect caregiver listed on a patient's red card (3 incidents)

• Patient information exposed to Public Health staff who do not perform work related to medical marijuana (1 incident)

• Names of all caregivers who were active as of December 2012 sent in a spreadsheet to the State Auditor (1 incident)

This last incident is the big one -- a gaffe that involved thousands of people, as sketched out in this paragraph:

In one instance from December 2012, Public Health did not notify the 5,400 caregivers who were active as of December 2012 to inform them that their names were inappropriately provided to the State Auditor. According to guidance we obtained from the Office of the Attorney General, the State Auditor cannot legally access personally identifiable data from the Registry, including caregiver names, despite the State Auditor's authority under Section 2-3-107(2)(a), C.R.S., to access state records.

Afterward, auditor's office personnel told the MMED the release of these names was improper and a new version of the spreadsheet was created with the monikers redacted. But given how freely available the information from the database appears to be, Kriho fears other agencies might not take the same approach.

"Who knows how many copies of the registry are floating around in different locations," she says. "They have no control over it whatsoever. It's not confidential at all at this point."

Continue for more about tomorrow's protest, including additional photos and three original documents. To emphasize this assertion, Kriho says participants at tomorrow's rally in advance of the Board of Health meeting will "wear paper bags over their heads. That's the only way for patients to maintain their privacy now."

Here's information from a Cannabis Therapy Institute release about the protest, including time, place and some specifics. That's followed by the auditor's report (the information cited here is featured in a section that begins on page 59), plus the emergency petition and the database agreement obtained by activists under provisions of the Colorado Open Records Act.

Cannabis Therapy Institute release:

Wednesday, August 21, 2013 Board of Health Public Meeting Colorado Department of Public Health and Environment Sabin-Cleere Conference Room 4300 Cherry Creek Drive South, Denver, CO 80246

9:00 a.m.: PROTEST by Patients of Registry Confidentiality Breaches -- Bring Signs

9:45 a.m.: Sign-up for General Public Comment: Sign-up to speak during general Public Comment. It is unclear at this point if the Board will discuss the CTI/PCRLP Emergency Rules Petition. In order to make sure patient concerns on violations of their privacy are heard at this meeting, we must take the opportunity for public comment at the beginning of the meeting during the open comment period.

10:00 a.m.: General Public Comment: The Board President may limit comment time. Please be prepared to speak only 2 minutes.

11:00 a.m.: The CDHPE's Annual Report on the Medical Marijuana Registry by Registry Director Ron Hyman was previously scheduled for this meeting. This is a "discussion" item, so there will be no opportunity for public comment on this item.

Medical Marijuana Regulatory System Audit Part 2

Emergency Rule Petition

Online Registry Database Agreement

More from our Marijuana archive circa July: "Marijuana enforcement audit, part two, reveals more messes -- and too much money."