1. (1) A person authorized to access information in the EVS or ICS shall only access the minimum amount of information necessary to perform an authorized function, as specified in:

   1. (a) Title 26B, Chapter 4, Part 2, Cannabinoid Research and Medical Cannabis;
   2. (b) Title 4, Chapter 41a, Cannabis Production Establishments and Pharmacies; and
   3. (c) this rule.
2. (2) A person authorized to access information in the EVS or ICS shall safeguard any information stored in the system.
3. (3) A person authorized to access the EVS and ICS shall safeguard login credentials and not share those credentials with anyone.

4. (4) A person authorized to access the EVS and ICS who fails to observe the confidentiality requirements of this rule may:

   1. (a) be subject to the penalties listed in Section 26B-4-202; and
   2. (b) lose access to the EVS or ICS.

KEY: medical cannabis, medical cannabis pharmacy, inventory control system, electronic verification system

Date of Last Change: January 26, 2026

Authorizing, and Implemented or Interpreted Law: 26B-4-201(1); 26B-4-202(6)