Book:LIMS Buyer’s Guide for Cannabis Testing Laboratories/LIMS, informatics, and cannabis testing/Data privacy and management

3.4 Data privacy and management

Though "strong data security and confidentiality" was listed in Table 2 as a cannabis testing LIMS consideration, more should be said about that consideration. The security of data housed in the LIMS is paramount. Standards like ISO/IEC 17025 require it, as do laws and regulations in many U.S. states. But data security goes beyond complying with standards and regulations; it's an element found in broad areas of the cannabis industry itself.

3.4.1 Across the broad cannabis industry

In the fall of 2018, Canada legalized the purchase, growth, and consumption of marijuana in small amounts across the country.^[1] Ahead of and after the official date of legalization, concerns were being raised about the protection of Canadian cannabis consumers' personally identifiable information (PII)^[2], particularly in regards to data processed and stored in the United States.^[3]^[4]^[5] In truth, comparisons of Canada's privacy laws with those of the United States existed well before the vote, with resources such as FindLaw detailing risks to any Canadian data transferred to the United States.^[6] However, concerns grew that Ontario's mandated use of the e-commerce platform Shopify (until private retail outlets opened in April 2019) would put Canadian cannabis consumers' data at risk.^[3]^[7] In particular, Canadian consumers remain worried that if their purchase history becomes available to United States government officials, who function in an environment of criminalization of cannabis use, they will not be allowed entry into the U.S. at minimum, or be treated as criminals upon attempting entry at worst. As such, some developers of cannabis data management software—such as Cova Software—have publicly acknowledged that any cannabis retail data for Canadian customers will remain in Canada "over and above the current legal requirements."^[5] Yet even with data providers' intentions to follow Canadian privacy rules and recommendations, data breaches still occur, as happened with the Canada Post in November 2018.^[2]^[8], further emphasizing the need for strict protocols and protections for cannabis consumer data.

In the United States, despite cannabis' federal prohibition, many states have been taking on various levels of legalization of cannabis. As Rachel Hutchinson of Foley Hoag LLP noted in March 2017, much like Canada, "[l]egalization has led to increased oversight and monitoring, as well as to the collection and storage of personally identifiable information ... [and the] threat of a federal crackdown leaves most customers resistant to creating any sort of paper trail."^[9] In this sort of environment, where federal threats still exist, a patchwork collection of state-based laws have sprung up, including Oregon's Senate Bill 863, which prevents retailers of recreational cannabis from collecting and sharing customers' PII.^[10] California has also implemented a variation of this type of protection for both recreational and medical cannabis consumers.^[11] Of note is California's classification of medical marijuana identification cards as "medical information," which lends additional credence to the idea that medical marijuana consumers' PII held in dispensaries should be protected by U.S. Health Insurance Portability and Accountability Act (HIPAA) regulations.^[12] However, without a unified policy and legal framework for cannabis use and its associated data, its difficult to foresee what future data collection and privacy regulations will look like in the United States. Despite this, some software development companies are betting on further demand for privacy of PII with the development of "personal privacy and HIPAA complaint cannabis consumer transaction solution[s]."^[13]

Additionally, like Canada, concerns still abound concerning data privacy in the United States. Companies such as THSuite, LLC have already been found to inadvertently expose sensitive personal data—and possibly even protected health information (PHI)—from multiple U.S. cannabis dispensaries, potentially violating HIPAA regulations.^[14]^[15] As the anonymous author of the original report concerning THSuite points out, "most legal experts agree that dispensaries must follow HIPAA regulations just like any other health care provider," and even in a realm without legal risk, exposed data could mean "individuals may suffer backlash if their families, friends, and colleagues find out that they use cannabis."^[14] Again, these issues firmly fall at the feet of the main problem of not having unified cannabis legislation, let alone not having a federally recognized legalized status of cannabis. With the unclear and mismatched state of law regarding cannabis user data protection, the onus still remain firmly with software developers and business' data managers in regards to thoroughly testing software and implementing (as well as enforcing) stricter controls such as encryption, intrusion detection, and authentication mechanisms.^[15]

3.4.2 What this means for the lab

While many cannabis testing laboratories won't be handling medical marijuana patient information, let alone dispensary sales information, lab managers must consider the data privacy issues of those realms and relate them to the data and workflows of the cannabis testing lab. What data must be protected? What standards must be followed to ensure that data's protection?

Take for example ISO/IEC 17025:2017, item 8.4.2, which requires a lab to have "controls" in place "for the identification, storage, protection, back-up, archive, retrieval, retention time, and disposal of its records."^[16] The long-term implication here is that data should be clearly identified, securely stored, backed up and archived, and have clear information about their retention and disposal. The data should be thoughtfully "controlled" so it doesn't get lost or fall into the wrong people's hands. This is further evidenced by ISO/IEC 17025:2017, item 7.11.3, which calls for the data to be "protected from unauthorized access" and "safeguarded against tampering and loss."^[17]

As such, it's obvious that cannabis testing labs, at a minimum, have to take data privacy and management seriously to stay in step with the ISO/IEC 17025 standard. That of course doesn't take into consideration any regulatory requirements for chain of custody and certificates of authority to be preserved by the lab for a specific period of time, nor does it account for any proprietary methods and business details that could potentially harm a lab in the wrong hands. Just like the personal health information of medical marijuana patients, and like the customer information of dispensaries, cannabis testing labs are charged with ensuring the security and privacy of the data they collect and manage.

To meet those requirements and more, a LIMS that includes functionality that helps labs support ISO/IEC 17025:2017, NELAC, ELAP, and Patient Focused Certification (PFC) requirements makes for a wise investment. Cannabis testing workflows can be difficult, as is the management of associated analytical instruments and their data. Throw in the complication of a semi-fractured regulatory atmosphere, and the cannabis testing lab is forced to operate with tight, enforced procedures to ensure not only the quality of tested cannabis substances but also the chain of custody of samples that come into the lab's possession. A LIMS that can carefully and automatically collect, manage, track, retain, and archive operational data—as well as the audit trails associated with those activities—is required to better maintain the security and privacy of that data, as well as the long-term viability of the lab.^[18]