Tag Archives: tracking

Amy-Ankrum-headshot
From The Lab

The Case for ISO/IEC 17025 Accreditation in Cannabis Testing Laboratories

By Amy Ankrum
No Comments
Amy-Ankrum-headshot

Government regulations keep millions of Americans safe every year by controlling what companies can put in their products and the standards those products must meet to be sold to consumers.

Enter the strange case of legal cannabis: In order for cannabis to be legally distributed by licensed medical professionals and businesses, it must be tested. But unlike other consumable goods, cannabis is not regulated by the FDA. Without an overarching federal policy requiring cannabis testing laboratory accreditation, the testing and laboratory requirements differ greatly across state lines.For medical cannabis specifically, accredited testing facilities are especially important. 

To be federally regulated, cannabis would first have to be federally legalized. It turns out that states and businesses alike are not willing to wait for a federal mandate. Many states have begun to adopt standards for cannabis testing and some, such as Ohio, have even announced mandatory ISO/IEC 17025 accreditation for all cannabis testing laboratories. As the industry evolves, increased compliance expectations are certain to evolve in tandem.

Some cannabis labs have even taken the initiative to seek ISO/IEC 17025 accreditation of their own volition. Seth Wong, President of TEQ Analytics Laboratories, shared in a press release:

“By achieving ISO/IEC 17025 accreditation, TEQ Analytical Labs believes that we can address the concerns throughout the cannabis industry regarding insufficient and unreliable scientific analysis by providing our clients with State required tests that are accredited by an international standard.”

Other laboratories, such as DB Labs in Las Vegas and EVIO Labs in Florida are also leading the accreditation charge in their respective states, ahead of any state mandates.

There are key reasons why accreditation in cannabis testing labs is important. First and foremost, cannabis is a consumable product. Like fruits and vegetables, cannabis is prone to pesticides, fungi and contaminants. The result of putting a potentially hazardous material on the market without proper and documented testing could lead to a public health crisis. An accredited testing lab, however, will ensure that the cannabis products they test are free from harmful contaminants.

By utilizing role-based trainings, labs can trust employees are receiving proper onboarding.

For medical cannabis specifically, accredited testing facilities are especially important. Because many consumers of medical cannabis are immuno-compromised (such as in the case of chemotherapy patients), ensuring that products are free from any and all contaminants is critical. Further, in order to accurately determine both short- and long-term effects of prescribed cannabis consumption, accredited and compliant laboratories are necessary.

Accreditation standards like ISO/IEC 17025 also provide confidence that testing is performed properly and to an internationally accepted standard. Rather than returning a “pass/fail” rating on products, the Cannabis Safety Institute reports that an ISO/IEC 17025 laboratory is required to produce numerical accuracy percentages in testing for “at a minimum, cannabinoids, pesticides, microbiology, residual solvents, and water activity.” Reliable data sets that can be reviewed by both accreditors and the public foster trust between producers and consumers.

Finally, ISO/IEC 17025 accreditation demonstrates that a laboratory is properly staffed and trained. The Cannabis Safety Institute’s “Standards for Cannabis Testing Laboratories” explains that conducting proper analytical chemistry on cannabinoids (the chemical compounds extracted from cannabis that alter the brain’s neurotransmitter release) requires personnel who have met specific academic and training credentials. A system to monitor, manage and demonstrate proficiency is necessary to achieve and maintain accreditation. With electronic systems in place, this management and documentation minimizes risk and also minimizes administrative time tracking and maintaining training records.

Following the proper steps of a standardized process is key to improving and growing the cannabis industry in coming yearsFor cannabis testing labs, utilizing a comprehensive software solution to achieve and maintain compliance to standards such as ISO/IEC 17025 is key. Absent of a software solution, the necessary compliance requirements can become a significant burden to the organization. Paper tracking systems and complex spreadsheets open up organizations to the likelihood of errors and ultimately risk.

Because ISO/IEC 17025 has clearly defined expectations for training, a software solution also streamlines the training process while simultaneously documenting proficiency. By utilizing role-based trainings, organizations can be confident employees are receiving proper onboarding and in-service training. Additionally, the effectiveness of training can be proven with reports, which results in smoother audits and assessments.

Following the proper steps of a standardized process is key to improving and growing the cannabis industry in coming years- which means utilizing technology tools such as electronic workflows to ensure proper process controls. Beyond adding critical visibility, workflows also create efficiencies that can eliminate the need to increase staffing as companies expand and grow.

For an industry that is changing at a rapid pace, ensuring traceability, efficient processes and visibility across organizations is paramount. Using a system that enables automation, process control, document management and documented training procedures is a step in the right direction. With the proper software tools in place, cannabis testing labs can achieve compliance goals, demonstrate reliable and relevant results and most importantly ensure consumer safety.

Iowa’s Medical CBD Program Gets Tracking System

By Aaron G. Biros
No Comments

BioMauris, LLC became the 5th company in the United States to win a state contract for a seed-to-sale platform today. BioMauris is a technology company that manages product tracking, fulfillment and distribution with a focus on the healthcare market. According to a press release, the company announced today that the state of Iowa selected BioMauris to manage their tracking system for the medical cannabidiol (CBD) program.

That program’s contract includes inventory tracking, medical cannabidiol sales and patient and caregiver registration. In 2014, Iowa’s Medical Cannabidiol Act was signed into law. Three years later, in May of 2017, Governor Terry Branstad expanded the state’s program, including manufacture and dispensing in the previous legislation. On December 1st, 2018, Iowa expects sales to begin and fully implement the program.

This is BioMauris’ first state contract in the cannabis industry. According to the press release, BioMauris bases their platform on Salesforce for point of sale, tracking, customer loyalty and distribution services in the healthcare sector. The company says they use Salesforce because it is extremely customizable and secure.

Erik Emerson
Erik Emerson, founder and president of Biomauris

According to Erik Emerson, founder and president of BioMauris, they’re poised to deliver on this front, given their experience in other industries. “Our team has extensive history in the pharmaceutical business, and therefore has a unique appreciation for data integrity and security,” says Emerson. “Additionally, we fundamentally believe the opportunity to track patient progress and associate the benefits received with the products used, is an incredible opportunity for the cannabis industry.” BioMauris has worked with clients on similar projects in the healthcare space for some time.

The company touts their platform as fully PCI-DSS and HIPAA compliant, allowing them to process payments and protect sensitive patient information. “Our patented technology, makes this not only possible, but simple for all users,” says Emerson. “We are excited to bring our product to the great state of Iowa and look forward to a long partnership with them. We believe strongly in what Iowa is attempting to do with their program and believe it is a perfect fit with our strategy for the cannabis industry.”

OLCC-Logo

Audit Finds Oregon Lacking Regulatory Oversight and Proper Security

By Aaron G. Biros
No Comments
OLCC-Logo

Last week, Oregon Secretary of State Dennis Richardson published his office’s audit of The Oregon Liquor Control Commission (OLCC). The audit uncovered a number of inadequacies with the regulatory agency, most notably the problems with their tracking system, designed to prevent cannabis form being sold on the black market.

The report highlights the need for Oregon to implement a more robust tracking system, citing reliance on self-reporting, overall poor data quality and allowing untracked inventory for newly licensed businesses. The audit also found an insufficient number of inspectors and unresolved security issues. According to The Oregonian, the OLCC only has 18 inspectors, roughly one for every 83 licensed businesses.

Auditors also found inadequacies in the application system, saying the OLCC doesn’t monitor third-party service providers and doesn’t have a process in place for reconciling data between the licensing and tracking systems. The audit found there is a risk that decisions made for the program could be based on unreliable data. It also found a risk of unauthorized access to the systems, due to a lack of managing user accounts.

Oregon Secretary of State Dennis Richardson
Oregon Secretary of State Dennis Richardson

This audit’s publication is very timely. Most notably because U.S. Attorney Billy Williams, who called Oregon’s black market problem “formidable,” convened a summit this week to examine how Oregon can prevent cannabis being exported to other states. According to the Oregonian, Williams said Oregon has an “identifiable and formidable overproduction and diversion problem.” The audit’s findings highlighting security issues are also very timely, given that in the same week, Oregon’s neighbor to the North, Washington, experienced a security breach in its own tracking system.

The problems with the Oregon tracking system’s security features are numerous, the audit says. They found that the OLCC lacks a good security plan, IT assets aren’t tracked well, there are no processes to determine vulnerabilities, servers and workstations not using supported operating systems and a lack of appropriately managing antivirus solutions. “Long-standing information security issues remain unresolved, including insufficient and outdated policies and procedures necessary to safeguard information assets,” reads the report’s summary.

The audit proposes 17 recommendations for the state to bolster its regulatory oversight. Those recommendations intend to address undetected compliance violations, weaknesses in application management, IT security weaknesses and weaknesses in disaster recovery and media backup testing. You can read the full audit here.

Washington Security Breach Delays Traceability System Rollout

By Aaron G. Biros
No Comments

On February 8th, Peter Antolin, the deputy director for the Washington State Liquor and Cannabis Board (WSLCB), sent an email to licensees explaining why the transition to their new traceability system was disrupted. Last Saturday, someone gained access to the sensitive information in Leaf Data Systems, the state’s traceability software that is powered by MJ Freeway.

“A computer vulnerability was exploited on Saturday, allowing unauthorized access to the traceability system,” Antolin told licensees in the email. “There are indications an intruder downloaded a copy of the traceability database and took action that caused issues with inventory transfers for some users. We believe this was the root cause of the transfer/manifest issue experienced between Saturday and Monday.”WSLCB

The email goes on to say that no personally identifiable information was available to the ‘intruder,’ but some sensitive information was clearly accessed. That data includes route information of manifests filed between February 1st and 4th as well as transporter vehicle information including VIN, license plate number and vehicle type, according to the email.

That email leaves much to be desired. For one, they do not exactly have a solution, instead trying to alleviate licensees’ worries with a hollow inanity full of meaningless jargon: “The WSLCB and MJ Freeway continue to implement several strategies to prevent future vulnerabilities to future intrusions,” reads the email. “This includes full logging and monitoring and working with third-party entities. Since this remains an active investigation, details on security are not publicly available.” However, today the WSLCB is hosting a webinar where Peter Antolin, their IT division, the MJ Examiners unit and enforcement will be available to answer questions, according to the email.

WSLCB emailThis is by no means the first security breach that Washington and MJ Freeway have suffered. In May of 2017, Washington originally selected Franwell’s METRC as the contract partner for their traceability software system. Less than a month later in June of 2017, after a mistake in the selection process, Washington selected MJ Freeway instead of Franwell for the traceability contract. Three days later, MJ Freeway’s source code was stolen and published online. Then in September, Nevada cancelled their contract with MJ Freeway after a security breach, their services crashed in Pennsylvania and Spain, and in October it became clear that the company could not meet the October 31 deadline for their new Washington contract.

In November of 2017, BioTrackTHC, the company that held the previous contract for Washington’s traceability software, helped the state through the transition period with a temporary Band-Aid solution to hold the state over until January of 2018. A month after they expected to implement the new MJ Freeway system, the latest security breach occurred this week and disrupting the rollout yet again.

At the end of the email Antolin sent to licensees yesterday, he says there will continue to be attempts to breach the system’s security. “The bottom line is that this incident is unfortunate,” says Antolin. “There will continue to be malicious cyberattacks on the system. This is true of any public or private system and is especially true of the traceability system.” This begs a few questions: why aren’t we hearing about this kind of security breach in other states’ traceability systems? What are other companies doing that prevents this from happening? Why does this keep happening to MJ Freeway?

Open For Business: California Market Launches

By Aaron G. Biros
No Comments

California’s full legal cannabis market officially opened its doors for business on January 1st, 2018. Following a relatively short time frame when they announced the first licenses awarded less than a month ago, retail stores were open for business in counties throughout California. Customers came out in full force, with long lines on the opening day, with some hundreds deep stretching around blocks.

For the quick turn around time between implementing regulations and awarding temporary licenses, the grand opening of the cannabis market in the nation’s most populous state proceeded smoothly. Only a handful of minor hiccups associated with the launch were reported throughout the state. In the grand scheme of things, that’s a pretty good job for a new regulatory agency (The Bureau) tasked with regulating such a massive fledgling market.

One major and definitely foreseeable hiccup in the launch of California’s new medical and adult use markets was the failure to implement tracking software. According to Michael Blood with The Associated Press, licensed businesses are being asked by the California Department of Food and Agriculture to manually document sales and transfers of cannabis with paper invoices.

Los Angeles
Image: Kevin Stanchfield, Flickr

While the Department said the traceability system was implemented Tuesday, Blood says, cannabis businesses are not required to use it and will be trained on how to operate it before it becomes required to use later in 2018.

Local control regulations in California means that businesses must first seek approval from local authorities before attaining a temporary license from the state to operate. That coupled with the rolling process of awarding licenses meant that only some cannabis businesses could officially open their doors. Municipalities throughout California handle regulating cannabis differently.

The handful of adult use dispensaries with temporary licenses in the Los Angeles area received a massive influx of customers on opening day. Residents of LA came in droves to the four West Hollywood dispensaries open for adult use business.

Integrating Your LIMS System With State Tracking Systems

By Cannabis Industry Journal Staff
No Comments

Cannabis Labs Virtual Conference: Part 3

Integrating Your LIMS System With State Tracking Systems
By Hannah O’Brien, Operations Manager, Confident Cannabis

Running a lab is hard. Running a cannabis lab is harder. Watch this webinar hosted by Confident Cannabis, the most popular and only free cannabis LIMS in the country, to learn how cannabis compliance and regulatory burdens impact analytical testing laboratories in any state, and how important purpose-built software solutions are to make their business run smoothly.

BioTrackTHC To The Rescue: Contingency Plan for Washington

By Aaron G. Biros
1 Comment

According to a press release published this morning, BioTrackTHC successfully implemented their Universal Cannabis System (UCS) in Washington State, a temporary solution for the state’s seed-to-sale cannabis tracking system, while the new system is yet to be deployed.

BioTrackTHC had a contract with Washington State for four years, which expired just weeks ago at the beginning of November. Back in June, after a few minor hiccups, the state announced that MJ Freeway would be the successive software platform used for the state’s seed-to-sale traceability system.

The deadline for the new software to be ready for deployment was set for November 1st, when the BioTrackTHC contract would expire and the MJ Freeway contract would begin. Between when the contract was awarded and the deadline for implementation, MJ Freeway made headlines for a series of security hacks and systems failures. Subsequently, MJ Freeway said they could not deliver the software platform until January of 2018, leaving a two-month gap where businesses have no state-mandated software to use for the tracking system.

The contingency plan that the state laid out consisted of business owners manually inputting data in excel spreadsheets. When first pressed for a Band-Aid solution, representatives of BioTrackTHC cited security concerns related to MJ Freeway’s hacks as reason for being hesitant to extend their contract through the interim period.

In an open letter to the Washington cannabis industry back in October before the end of their contract, Patrick Vo, president and chief executive officer of BioTrackTHC, laid out an explanation for what went wrong and provided an alternative solution, essentially a private sector version of their government-mandated traceability software system.

The open letter to the Washington cannabis industry, written by Patrick Vo

Announced this morning, the new system, UCS, is being used by over 1,600 of the 1,700 cannabis licensees in Washington. The UCS has so far submitted 39,000 individual excel spreadsheets to the Washington State Liquor and Cannabis Board (WSLCB). “After the WSLCB announced that their replacement system would not be ready in time and that the only other option was for all 1,700 licensees to submit their seed-to-sale data via manual spreadsheets, BioTrackTHC created the UCS—a privatized clone of the government system—within a few days and deployed it minutes after the termination of the old system to minimize the impact on all licensees,” reads the press release.

The UCS allows business owners to streamline data recording, instead of manually entering information into spreadsheets. It is also integrating with 3rd party software competitors such as WeedTraQR, GrowFlow, Mr. Kraken, TraceWeed, GreenBits, S2Solutions and DopePlow. “After the WSLCB’s announcement, we knew that we had only a few days to provide a universal system to which the whole industry could submit compliance data and enable communication across the supply chain between licensees and their seed-to-sale system,” says Vo. “Our priority was to ensure that licensees could continue to operate in the absence of a government seed-to-sale system. Not having that system in place could have left Washington licensees vulnerable to noncompliance in a variety of ways, not to mention the potentially crippling volume of extra work needed to manually track a business’ entire inventory.”

Washington State’s new traceability software system by MJ Freeway is expected to deploy in January of 2018.

MJ Freeway Hardships Linger

By Aaron G. Biros
No Comments

MJ Freeway, a seed-to-sale traceability software company with a number of government contracts, has been making headlines this year for all the wrong reasons. A series of security breaches, website crashes and implementation delays have beleaguered the software company throughout 2017.

Just this morning, the Philadelphia Inquirer reported the company’s services crashed Saturday night and Monday afternoon. That article also mentions an anonymous hacker tried to sell sensitive information from the Washington and Nevada hacks in September. Back in April, when Pennsylvania awarded the state’s contract to MJ Freeway for its tracking system, Amy Poinsett, co-founder and chief executive officer of MJ Freeway told reporters “I think I can confidently say we are the most secure cannabis company in this particular industry.” It is safe to say this is now being called into question.

Earlier this week, New Cannabis Venture’s Alan Brochstein reported that MJ Freeway is unable to meet Washington’s October 31st deadline to integrate their software with the state, forcing customers to manually report data.

Roughly a month ago, Nevada suddenly cancelled their contract with MJ Freeway, just two years into their five-year deal. Back in June, the company’s source code was stolen and published online. And back in January of this year, the company’s sales and inventory system was the target of a cyber attack.

According to an email we obtained, all of MJFreeway’s clients in Spain experienced an online outage, but that services were restored within 24 hours. In an email sent to clients in Spain, the company told customers that the problems were the result of a system failure. “Our initial analysis indicates that this was a system failure and unfortunately none of the data was able to be successfully retrieved from the backup archive due to an error but we can assure you that none of your data was extracted or viewed at any moment,” reads the email. “We are extremely distressed regarding the event that occurred with the system and the service interruption that occurred yesterday. We recognize that this is a situation that is very serious and negatively impacts your club.” The email says that MJ Freeway is addressing those problems in a few ways, one of which being ongoing audits of their data backups. “The event has led us to reconstruct our “hosting environment” in Europe to use the latest technology from Amazon Web Services with the best redundancy, flexibility and security, using the highest stability measures in the AWS environment,” reads the email. While the site will be restored fully, according the email, historical data is lost. The company is working with their clients to help them get data back into the system. 

Biros' Blog

Washington Changes Course, Selects MJ Freeway as New ASV

By Aaron G. Biros
3 Comments

Two weeks ago, we reported on the State of Washington choosing Franwell as their apparent successful vendor (ASV) for their seed-to-sale traceability system contract. Late last week, the Washington State Liquor and Cannabis Board (WSLCB) sent out an email explaining that they are no longer going with Franwell and the new ASV is MJ Freeway.

The email (left) consisted of a letter sent by Peter Antolin, Deputy Director of the WSLCB, to licensees “who had written to the Board and staff regarding the marijuana traceability Apparent Successful Vendor and RFID tags.” Apparently, the reason behind switching the ASV to MJ Freeway is because Franwell’s system requires only one method for tagging plants- RFID tags. According to the letter, Deputy Director Antolin says the initial request for proposal (RFP) stated that the traceability system needs to support a variety of tagging methods, including bar codes and RFID. “The RFP requirements did not allow a vendor to make any assumptions regarding use of a single tagging methodology or allow vendors to include any such costs affecting the state or our licensees in their proposal,” says Antolin. As they made clear in the previous press release, the ASV is not the official contract winner until they complete negotiations and sign the contract.

On June 7th, Franwell withdrew their proposal for the state’s traceability system, thus Washington went with the second highest scoring vendor, MJ Freeway. Deputy Director Antolin says they submitted a strong bid, but there are still many questions left unanswered. How could such a glaring mistake be overlooked when the state named Franwell the highest scoring bidder? Is MJ Freeway’s system robust enough and capable of handling the state’s cannabis licensees’ traceability requirements even though they were not the highest scoring bidder? The deadline for the new system to be in place is October 31, 2017, which is quickly approaching for such a massive systems overhaul.

The WSLCB’s oversight highlights a few inadequacies with the state’s regulatory agency, particularly their indecision and lack of foresight. So much of the concept behind seed-to-sale traceability rests on Cole Memo compliance. A big reason why some states seek to implement a robust tracking system is to remain compliant with the Cole Memo; preventing diversion to crime organizations with regulatory oversight is a key tool that states use to tell the federal government they are complying with their directive and intend to protect their state’s legal cannabis operations from federal prosecution. Without a proper system in place, the state runs the risk of exposing their entire cannabis market to threats of federal enforcement, a scenario that seems unlikely but could be disastrous to cannabis businesses and the local economy.

The WSLCB needs to get their act together fast.

BioTrackTHC Awarded Delaware’s Tracking Software Contract

By Aaron G. Biros
No Comments

According to a press release, the State of Delaware has chosen BioTrackTHC as their partner in seed-to-sale tracking software. Delaware’s Department of Health and Social Services (DHSS) signed a contract with BioTrackTHC for the tracking and patient registry software.

In 2016, Delaware issued a request for proposals for “the Delaware Enterprise Consolidated Cannabis Control System,” which encompasses the statewide patient registry and seed-to-sale traceability systems. “Our sincerest thanks to DHSS for choosing Team BioTrack,” says Patrick Vo, CEO of BioTrackTHC. “DHSS has been wonderful to work with throughout the contracting process, and we look forward to partnering with them to provide the tools and data they need to continue overseeing the industry and protecting their patients.” BioTrack’s software was selected as the winner of a number of government contracts in other states previously for the same role.

Their software is currently used in government traceability systems in Washington, New Mexico, Illinois, Hawaii, New York and the city of Arcata, California. The press release states regulators will have the ability to view the retail data “including plant counts and usable inventory, lab results, transportation, and point-of-sale data—to perform periodic audits and ensure compliance.” The patient registry will also provide better patient accessibility through the new software with a faster turn around time and automated application processing.

BioTrackTHC provides technology solutions for businesses and governments to tracking products throughout the supply chain to the point of sale. The software systems help businesses remain compliant with regulations and monitor data for things like inventory management.