Member Blog: As Cannabis Sales Rise, So Do Questions About Privacy and Security

Frank Nisemboum, Vice President of ERP Sales at c2b teknologies

Legal cannabis is a big business that handles big data. From personalized data to protected health information to cannabis information that requires regulatory compliance with cybersecurity and data privacy laws–the entire cannabis industry faces data privacy and cybersecurity challenges not faced by other sectors.

But wait, other sectors have to navigate data concerns, too right? Cannabis is different. Aside from adhering to all the typical privacy concerns, cannabis data comes with a layer of complexity for cannabis operators due to industry-specific data collection and mandatory retention requirements surrounding it.

Growing Cannabis Data Collection

A cannabis customer provides a vast amount of personally identifiable information every time they buy legal marijuana products. These individuals present a government-issued ID card to confirm they are at least 21 for adult-use purchases or prove they have a prescription to access medical marijuana. The data collected on each transaction includes customer or patient name, date of birth, address, phone number, driver’s license or medical ID card numbers as well as email addresses and signatures.

Cannabis dispensaries also provide equally large amounts of operations data to METRC (Marijuana Enforcement Tracking Reporting Compliance), used in 13 states and the District of Columbia. METRC is not the only government reporting company used to maintain cannabis compliance. For example, California relies on the CCTT (California Cannabis Track-and-Trace) system to report the inventory and movement of cannabis and cannabis products throughout the cannabis supply chain.

Cannabis legalization is expected to spread across the country to all 50 states now that adult-use cannabis is permitted in 11 states and Washington D.C. and 36 states allow medical marijuana. Many of those states require all cannabis licensees, both annual and provisional, to use METRC to track marijuana products through the entire supply chain.

Cannabis cultivators, manufacturers, retailers, distributors, testing labs, and micro-businesses need to manage and maintain those records for a minimum of seven years. It’s a tremendous amount of valuable data for cannabis companies to track, the precious data cybercriminals and hackers seek out, including combinations of protected personal and health data like social security numbers and diagnoses with supplemental information like addresses, copies of ID cards.

If a cannabis company dispenses medical marijuana to patients or supports one who does, they fall into the regulatory oversight of the Health Insurance Portability and Accountability Act (HIPAA) and the Office of Civil Rights (OCR).

Safeguarding Cannabis Data

Legal cannabis and the data security issues it creates form multi-prong challenges from a legal and technological perspective. The cybersecurity and data privacy requirements don’t come with a roadmap cannabis operators can borrow from other industries due to the massive repositories of personalized data that require regulatory compliance with cybersecurity and data privacy laws.

The collection, storage, and security of all this valuable data raise many privacy and security concerns, especially when guidelines for collecting the information vary by state. For example, Ohio and California must house personal data using third-party software to track inventory and retail point-of-sales, whereas Illinois dispensaries cannot store any personally identifiable information onsite and instead use cloud or other off-location services.

Healthcare companies make attractive targets for hackers and often suffer data breach more often due to their huge storage of protected health information (PHI). Medical dispensaries and supporting companies handle PHI too, but PHI is not all a cybercriminal may want from a cannabis operation.

Employee records often contain background checks and financial data along with personally identifiable information such as name, date of birth, and SSN, all in one nice package. And cannabis data has been breached several times in recent years.

Cannabis Data Breaches Happen

Even as a newly legitimized industry, cannabis organizations have already experienced high-impact data and security breaches. In early 2020, a database breach that impacted almost 30,000 people connected to the marijuana industry resulting from an unsecured Amazon S3 data storage bucket was reported. The data breach included scanned versions of government-issued ID cards, purchase dates, customer history, and purchase quantities.

In 2019, a Canadian cannabis company exposed the electronic medical records of over 34,000 customers.

Between 2016 and 2018, the cannabis-tracking software provider MJ Freeway endured significant data breaches where over 1,000 dispensaries in 23 states were hacked. Less than six months later, hackers stole a portion of MJ Freeway’s source code and posted it publicly to social media.

Prior to that, Nevada’s Medical Marijuana Program database was breached in 2016, exposing sensitive personal data of over 11,000 people involved in the Nevada cannabis industry. This breach included names, social security numbers, race, as well as home and business addresses.

Cannabis Operators Short on Cybersecurity Budgets

Cannabis companies are responsible for securing their data to protect their customers and staff. To prevent data leakage, point-of-sale machines need endpoint protection, encryption, secure backups with proper network segmentation.

Unfortunately, some cannabis organizations fall short of installing appropriate cybersecurity measures that could have far-reaching effects on a cannabis user. Leaked personal data could have negative personal and professional consequences for the cannabis patient whose workplace prohibits cannabis use.

To avoid becoming an easy target, cannabis companies need to focus on data privacy and security just as much marketing and sales. The penalties from having a customer or employee’s personally identifiable information and cannabis-related data exposed can be too expensive to ignore and fail to give confidence that their data is secure.

Vice President of ERP Sales, Frank Nisemboum, is a trusted advisor at c2b teknologies who has guided organizations of all sizes enabling them to establish a technology presence and expand their business through technology. His proven ability to analyze the current and future plans of a company and work with team members to subsequently bring technology solutions to the organization result in improved processes and controls that assure continued growth and profitability.

Frank has worked in the ERP and CRM software selection, sales and consulting industry for almost 25 years. His strong ability to understand, interpret and match the needs of an organization to the right solution make him an asset to all of his clients.

c2b teknologies integration and engineering experts have partnered with leading cannabis industry experts to develop a software solution that provides a complete cannabis operations system. The best-in-class solution not only handles tracking of seed-to-sale activities but encompasses your entire cannabis operations with compliance needs handles along the way. Our passion for solving problems drives us to deliver innovative solutions for everyone we work with. Visit c2btek.com for more information.

Member Blog: Top 8 IT Concerns for the Cannabis Industry

by Sean Dawson, Director of IT Solutions at Office1

Integrating and measuring innovation for cannabis businesses can be daunting, mostly because cannabis has been considered illegal for decades. Luckily for the cannabis industry, the laws prohibiting the use of marijuana and marijuana products are tumbling down, and windows of opportunities are opening for people to integrate information technology with their cannabis businesses. As in other industries, information technology is shaping the cannabis industry as a frontier of opportunities for professionals in many exciting ways.

Despite being stereotyped and demonized for close to a century, the marijuana industry is swiftly reconstructing itself, thanks to cutting-edge technology that’s ensuring inventions, innovations, and progress. IT remains the ultimate lever for changing how people view and relate to the cannabis industry. Over the last few years, IT revamped the cannabis industry and transformed how marijuana is grown, processed, distributed, purchased, branded, and consumed.

Despite the remarkable progress, there are a few IT concerns for the cannabis industry. Here are the top 8 IT concerns for the emerging cannabis industry:

Automated Cultivation

Marijuana grow-boxes with fully automated grow technology for high-quality yields are a potential game-changer for the cannabis industry. A perfect example is a home-grow technology that allows people to discreetly plant a seedling or two in every corner of their houses. Every bit of the home-grow technology is highly guided and fully automated. This gives growers a deep personal satisfaction of growing their own marijuana without having to go through the taxing learning curve that other farmers have to endure to get the best quality yields. With this technology, you don’t even need an outdoor garden.

On a larger scale, there are tech-driven innovations in seed genetics and breeding as crucial aspects of cannabis cultivation. This technology modifies the DNA of cannabis to develop a cultivar with rich taste and more resistant to pests, diseases, and harsh elements of weather.

On the applications frontier, cannabis farmers now have access to customizable apps that allow them to configure cannabis cultivation to their geographical locations, soil texture, climate, and desired outcomes, among other considerations.

Automated cultivation is a growing concern for the cannabis industry as IT companies are striving to improve the cultivation technology even further, and growers are looking to leverage the best technology to gain more control over the quality and quantity of their yields.

Access Control

Cannabis dispensaries face the need to ramp up security within their premises. These dispensaries mostly deal with large cash transactions, which expose them to crime. These businesses are vulnerable to burglary, forgery, and robbery, necessitating advanced security options.

The need for improved security has led these dispensaries to incorporate stringent security options that effectively prevent malicious activity. For instance, to protect their crucial product, processing plants and growers utilize remote and cloud-based access control to the facilities.

Cannabis dispensaries normally take advantage of the flexibility that comes with current security systems to ensure that only authorized persons can access various areas within their facilities. To enhance security and access, these systems combine various security applications within one package, making them robust and efficient.

For instance, an access control system that grants keyless entry also combines with surveillance cameras, alarms, and the check-in systems to store a proper record of all personnel who visit specific areas within their premises. This ensures a safe work environment where the company maintains trust with their staff while simultaneously reducing liability. Remote access control also triggers rapid growth since it facilitates the management of many branches from a single point.

Automated Vending and Online Recommendation

With advances in computing and robotics, various companies have been experimenting with non-human point of sale vending technologies. The cannabis industry has not been left behind. Artificial intelligence has allowed companies to aggregate HIPAA compliant data thus allowing for the creation of platforms where doctors and patients to better predict treatment outcomes as well as managing analytic data points from seed to consumption. Enter, opportunity. Companies have now been utilizing this to innovate the way cannabis is being purchased. Through the creation of search engines designed off the AI data aggregation, consumers are now able to find the best available strains for their desired use case in both a medical and recreational use case.

Such technologies revolutionize the supply and delivery of the product as they help users make informed decisions regarding consumption methods and available strains, and therefore pivotal IT concerns for the cannabis industry.

Artificial Intelligence

Artificial intelligence (AI) has significantly transformed the way every industry does business, and the cannabis industry is not lagging far behind on this. The grade and strain of cannabis produced majorly depend on the environment in which it was grown. Artificial intelligence helps growers to enhance the plants’ genetic makeup and CBD/THC concentration to produce popular strains.

AI also helps in optimizing the supply chain, ensuring efficient and fast delivery of marijuana products. Companies are diligently exploring ways in which AI can help improve how quickly and efficiently the product can be moved, from the growers to the processors and, finally, the consumer.

For example, a California-based startup, Eaze, collects consumer data relating to consumption and delivery. The data is then processed, analyzed, and leveraged to help dispensaries keep track of demand and update their stock.

Other companies use artificial intelligence to forecast price changes, fluctuations in product supply, and to analyze trends within the cannabis Industry.

AI is, therefore, a critical concern for the cannabis Industry.

Retail, eCommerce, and Delivery

Retail, too, has benefited from advances in delivery technology. Today, you can order a product or service with the click of a button, pay for it remotely, and have it delivered at your doorstep. The cannabis industry is already in on these advances. In states where marijuana consumption is legal, there are apps you can use to order a marijuana product and expect a home delivery in minutes.

Marijuana dispensaries have also turned to technology to help educate the public on cannabis production and consumption. For instance, some dispensaries are adopting the use of augmented reality to guide consumers through the available strains and their effects on the human body. There are also tons of education programs that cover everything from how cannabis functions in the body, growing options, and the best strains for different types of consumers.

Customized Consumption

Technology has revolutionized how we consume the product. Unlike the previous years, when smoking was the most popular means of consumption, modern consumers have a wide range of options. These include skin patches, e-cigs, and dosed inhalers. These technologies have disrupted the cannabis industry, and are paving the way for even safer options.

No doubt, modern technology has led to the invention and discovery of safe practices in the consumption of marijuana. For instance, it is known that different consumers react differently to various methods of marijuana delivery. Today, it is not uncommon for a doctor to take a swab of saliva to determine the best strain and delivery method for a particular user.

Electricity Storage and Consumption Monitoring

Marijuana growers attest that one of the highest costs of marijuana production arises from the use of electricity. The use of LED lights and climate control are responsible for these power costs. One way to reduce these costs involves the use of storage batteries. Growers can buy electricity during off-peak times when power is cheaper, store it batteries and use it during peak times. This also calls for the use of energy monitoring solutions to determine power consumption trends within the cannabis farms.

Seed-To-Sale Technology

With the growth of the marijuana industry, producers and growers seek ways to improve efficiency in the cannabis production process, following the laid-out regulations and maximizing profit. Seed-to-sale technologies equip producers with all knowledge regarding their product supply chain. This way, marijuana growers function the same way as any legitimate pharmaceutical or distribution chain.

Seed-to-sale software allows for vertical integration, which means the grower can track the product through various phases of distribution (manufacturing, supply, and dispensing). Point of sale software can combine with the company accounting software to create a fully-fledged Enterprise Resource Planning system, making it easy to manage the product like any other business.

Seed-to-sale software also helps with the documentation of cannabis transactions, which helps with compliance management, inventory management, and analysis of consumption trends.

The Bottom Line with Cannabis and Technology

With the increased decriminalization of cannabis comes unprecedented growth, which attracts investors. This growth has brought with it some industry shifts, especially in technology. This article has explored various IT concerns that have spurred growth in the marijuana industry. Legalization has also helped debunk myths formerly associated with the cannabis industry, which has encouraged IT startups to create solutions for the marijuana supply chain. This way, growers and suppliers can focus on developing high-end products, while technology helps with compliance, bookkeeping, and product improvement.

The relationship between IT and marijuana growth will spur developments that propel it into a multi-billion-dollar industry in the coming decades.

Sean Dawson is the Director of IT Solutions at Office1. Office1’s mission is to innovate and progressively modernize the inefficient business landscape by providing a proactive, personalized, and eco-friendly office technology solution from planning to implementation and optimization. One solution from one company – Office1. Sean seeks to understand the heart of a challenge and then focuses on creating practical and timely solutions. He is an avid DIYer, gardener, and master house re-doer who loves spending his free time with his wife, four children, and six chickens.

Member Blog: Attracting Investors Requires Compliance And Scalability

by Frank Nisenbaum, Vice President of ERP Sales, c2b teknologies

More new cannabis entrepreneurs are trying to carve out space in the industry, and as the market continues to expand, so are cannabis investors.

This comes as no surprise. Cannabis investors have more predictable ways to invest in cannabis companies since marijuana can now be found in everything from beverages to beauty creams.

But the needed operating capital coming from these investors isn’t being thrown at new upstarts riding on nothing more than the dream of success in the legal marijuana marketplace. Cannabis investors want to see the people and businesses into which they put capital have a strong commitment to their industry and a dedication to their processes. Of course, this entails strict adherence to local, state and federal regulations for compliance initiatives, but investors also want to see a solid foundation for expansion and scalability in place.

Scalability

Consider your projected growth over the next few years, what are you doing to meet it? Investors want to see more than forward-thinking ideas, they want to see the initiatives you’ve put in motion to meet your projections. Are you upgrading suppliers, creating new products, or even better, adding new locations?

Investors need to believe that organizational leadership has a sound plan for scalability in place. More importantly, as you expand into new markets and grow your product offerings, you have invested in the framework and infrastructure in order to grow their operation in line with your business plan.

Regulation and Compliance

Among the more burdensome compliance issues for cannabis operators is the need to track the entire lifecycle of cannabis products from seed to sale. You need to be able to account for every step in the lifecycle of your cannabis plants and be able to provide this information to regulatory agencies at a moment’s notice.

Adding to the complexity of tracking the plant, you’ll need tracking for each employee who works with the plant. These seemingly minor details can derail the best intentions, so demonstrating success surrounding mandated quality assurance testing at key points in the plants’ development will get the attention of would-be investors.

Multiple Jurisdictions for Added Complexity

Compliance is even harder to achieve due to the multiple bodies which have jurisdiction. Local, state, and federal agencies all jockey for partial control of regulatory measures placed upon your cannabusiness.

Some of the federal agencies involved in the regulation of legal cannabis plants include, but are not limited to:

United States Department of Justice
Environmental Protection Agency
Internal Revenue Service

Each state in the U.S. has its own regulatory body for cannabis operations. Examples include:

Department of Public Health
Department of Food and Agriculture
Department of Fish and Wildlife
Department of Pesticide Regulation
Alaska Marijuana Control Board
California Bureau of Cannabis Control
Colorado Department of Revenue Enforcement Division Marijuana Enforcement
Illinois Department of Financial and Professional Regulation, Cannabis Regulation
Maryland Medical Cannabis Commission
Massachusetts Cannabis Control Commission
Michigan Department of Licensing and Regulatory Affairs Bureau of Marijuana Regulation
Nevada Department of Taxation
Oregon Liquor Control Commission
Washington State Liquor and Cannabis Board

The full list of regulatory bodies is much longer. Compliance concerns are not exclusive to this industry, but as a cannabis operator, you face a tremendous number of regulatory bodies and each of these agencies has specific requirements to adhere to in order to stay compliant and stay in business.

As cannabis legalization becomes more widespread, each jurisdiction develops its own guidelines surrounding cannabis, from seed to sale. Unfortunately, this often creates confusion and leaves cannabis compliance open to interpretations. Without the systems in place to track and document multiple aspects of the cannabis industry, you’re at risk for considerable fines for non-compliance.

How to Present Your Cannabusiness

If you’re seeking capital from cannabis investors, understand that building a cannabusiness for compliance and scalability is nearly impossible without purpose-built technology. To that end, cannabis operations software is an invaluable platform for your cannabusiness when looking to attract investors.

Beyond your core business functions, investors consider the systems in place which support your cannabusiness. By planning ahead and incorporating a cannabis operations solution before you seek outside funding, you’re able to enjoy the fruits of efficiency, but you’re also able to prove it.

Cannabis operations software features tools for inventory tracking, asset management, and personnel scheduling and management, which means that the regulatory guidelines with which a cannabusiness must remain compliant are areas intrinsically handled by the platform. These systems excel at tracking inventory and allocating resources while maintaining clear audit trails, which is extremely important if a regulatory agency knocks on your door.

Cannabis operations software gives you and potential investors a unified view of your entire operation by bringing all operational data under the same umbrella, standardizing the data reporting and making it available for easy cross-referencing. By collecting all data into a single pipeline, a best-in-class solution gives everyone in the process the tools and insights necessary to make the right decision.

Vice President of ERP Sales, Frank Nisemboum, is a trusted advisor at c2b teknologies who has guided organizations of all sizes enabling them to establish a technology presence and expand their business through technology. His proven ability to analyze the current and future plans of a company and work with team members to subsequently bring technology solutions to the organization result in improved processes and controls that assure continued growth and profitability.