Section 1290.410  Security Requirements

a)         A dispensing organization shall implement security measures to deter and prevent entry into and theft of cannabis or currency. 

b)         A dispensing organization shall submit changes to the floor plan or security plan to the Division for pre-approval.  All cannabis shall be maintained and stored in a restricted access area during construction.

c)         The dispensing organization shall implement security measures to protect the premises, registered qualifying patients, provisional patients, designated caregivers, OAPP participants and dispensing organization agents including, but not limited to the following:

1)         Establish a locked door or barrier between the facility's entrance and the limited access area;

2)         Prevent individuals from remaining on the premises if they are not engaging in activity permitted by the Act or this Part;

3)         Develop a policy that addresses the maximum capacity and patient flow in the waiting rooms and patient care areas;

4)         Dispose of cannabis in accordance with this Part;

5)         During hours of operation, store and dispense all cannabis from the restricted access area or a pickup-location in close proximity to the dispensary.  For purposes of this subsection (c)(5), "pickup-location in close proximity to the dispensing organization" means an area contiguous to the real property of the dispensary, such as a sidewalk or parking lot; additionally, during operational hours, cannabis shall be stored in an enclosed locked room or cabinet and shall be accessible only to specifically authorized agents;

6)         When the dispensary is closed, store all cannabis and currency in a reinforced vault room in the restricted access area and in a manner as to prevent diversion, theft or loss;

7)         Keep the reinforced vault room and any other equipment or cannabis storage areas securely locked and protected from unauthorized entry;

8)         Keep an electronic daily log of dispensary agents with access to the reinforced vault room and knowledge of the access code or combination;

9)         Keep all locks and security equipment in good working order;

10)         The security and alarm system shall be operational at all times.

11)         Prohibit keys, if applicable, from being left in the locks, or stored or placed in a location accessible to persons other than specifically authorized personnel;

12)         Prohibit accessibility of security measures, including combination numbers, passwords or electronic or biometric security systems to persons other than specifically authorized agents;

13)         Ensure the dispensary interior and exterior premises are sufficiently lit to facilitate surveillance;

14)         Ensure that trees, bushes and other foliage outside of the dispensary premises do not allow for a person or persons to conceal themselves from sight;

15)         Develop emergency policies and procedures for securing all product and currency following any instance of diversion, theft or loss of cannabis, and conduct an assessment to determine whether additional safeguards are necessary; and

16)         Develop sufficient additional safeguards in response to any special security concerns, or as required by the Division.

d)         The Division may request or approve alternative security provisions that it determines are an adequate substitute for a security requirement specified in this Part. Any additional protections may be considered by the Division in evaluating overall security measures.

e)         A dispensing organization shall provide additional security as needed and in a manner appropriate for the community where it operates.

f)         Restricted Access Areas

1)         All restricted access areas must be identified by the posting of a sign that shall be a minimum of 12" x 12" and that states "Do Not Enter – Restricted Access Area – Authorized Personnel Only" in lettering no smaller than one inch in height.

2)         All restricted access areas shall be clearly described in the floor plan of the registered premises, in the form and manner determined by the Division, reflecting walls, partitions, counters and all areas of entry and exit. The floor plan shall show all storage, disposal and retail sales areas.

3)         All restricted access areas must be secure, with locking devices that prevent access from the limited access areas.

g)         Security and Alarm

1)         A dispensing organization shall have an adequate security plan and security system to prevent and detect diversion, theft or loss of cannabis, currency or unauthorized intrusion using commercial grade equipment installed by an Illinois licensed private alarm contractor or private alarm contractor agency that shall, at a minimum, include:

A)        A perimeter alarm on all entry points to the premises and glass break protection on perimeter windows;

B)        Security shatterproof tinted film on exterior of perimeter windows;

C)        A failure notification system that provides an audible, text or visual notification of any failure in the surveillance system, including, but not limited to, panic buttons, alarms and video monitoring system. The failure notification system shall provide an alert to designated dispensing organization agents within five minutes after the failure, either by telephone or text message;

D)        A duress alarm, panic button and alarm, or holdup alarm and after-hours intrusion detection alarm that by design and purpose will directly or indirectly notify, by the most efficient means, the Public Safety Answering Point (PSAP) for the law enforcement agency having primary jurisdiction;

E)        Security equipment to deter and prevent unauthorized entrance into the dispensary, including electronic door locks on the limited and restricted access areas that include devices or a series of devices to detect unauthorized intrusion that may include a signal system interconnected with a radio frequency method, cellular, private radio signals or other mechanical or electronic device.

2)         All security system equipment and recordings shall be maintained in good working order, in a secure location so as to prevent theft, loss, destruction or alterations. 

3)         Access to surveillance monitoring recording equipment resides shall be limited to persons that are essential to surveillance operations, law enforcement authorities acting within their jurisdiction, security system service personnel and the Division. A current list of authorized dispensary agents and service personnel that have access to the surveillance equipment must be available to the Division upon request.

4)         All security equipment shall be inspected and tested at regular intervals, not to exceed one month from the previous inspection and test to ensure the systems remain functional.

5)         The security system shall provide protection against theft and diversion that is facilitated or hidden by tampering with computers or electronic records.

6)         The dispensary shall ensure all access doors are not solely controlled by an electronic access panel to ensure that locks are not released during a power outage.

h)         To monitor the dispensary, the dispensing organization shall incorporate continuous electronic video monitoring, including the following:

1)         Monitors of 19-inches or greater;

2)         Unobstructed video surveillance of all enclosed dispensary areas, unless prohibited by law, including all points of entry and exit that shall be appropriate for the normal lighting conditions of the area under surveillance.  The cameras shall be directed so all areas are captured, including, but not limited to, safes, vaults, sales areas and areas where cannabis is stored, handled, dispensed or destroyed.  Cameras shall be:

A)        angled to allow for facial recognition, the capture of clear and certain identification of any person entering or exiting the dispensary area; and

B)        in lighting sufficient during all times of night or day;

3)         Unobstructed video surveillance of outside areas, the storefront and the parking lot, that shall be appropriate for the normal lighting conditions of the area under surveillance.  Cameras shall be angled so as to allow for the capture of facial recognition, clear and certain identification of any person entering or exiting the dispensary, the immediate surrounding area, and license plates of vehicles in the parking lot;

4)         Twenty-four-hour recordings from all video cameras available for immediate viewing by the Division upon request.  Recordings shall not be destroyed or altered and shall be retained for at least 90 days.  Recordings shall be retained as long as necessary if the dispensing organization is aware of the loss or theft of cannabis; a pending criminal, civil or administrative investigation; or a legal proceeding for which the recording may contain relevant information;

5)         The ability to immediately produce a clear, color still photo from the surveillance video, either live or recorded;

6)         A date and time stamp embedded on all video surveillance recordings. The date and time shall be synchronized and set correctly and shall not significantly obscure the picture;

7)         The ability to remain operational during a power outage and ensure all access doors are not solely controlled by an electronic access panel to ensure that locks are not released during a power outage;

8)         Exporting of still images in an industry standard image format, including JPG, BMP and GIF. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. All recordings shall be erased or destroyed prior to disposal;

9)         A video surveillance system that is operational during a power outage with a four-hour minimum battery backup;

10)        A video printer capable of immediately producing a clear still photo from any video camera image;

11)        A video camera or cameras recording at each point of sale terminal allowing for the identification of the dispensary agent distributing the cannabis and any qualifying patient or designated caregiver purchasing medical cannabis.  The camera or cameras shall capture the sale, the individuals and the computer monitors used for the sale;

12)        Storage of video recordings from the video cameras for at least 90 calendar days; and

13)        A failure notification system that provides an audible and visual notification of any failure in the electronic video monitoring system.

i)          All electronic video surveillance monitoring must record at least the equivalent of eight frames per second and be available to the Division and ISP 24 hours a day in real-time via a secure web-based portal with reverse functionality.

j)          The dispensing organization shall maintain policies and procedures that include:

1)         Security plan with protocols for patient, provisional patient, OAPP participant, caregiver and agent safety, and management and security of cannabis and currency, as outlined in the Act and this Part;

2)         Restricted access to the areas in the dispensary that contain cannabis to authorized agents;

3)         Identification of authorized agents;

4)         Controlled access and prevention of loitering both inside and outside the dispensary;

5)         Conducting electronic monitoring; and

6)         Use of a panic button.

(Source:  Amended at 47 Ill. Reg. 17846, effective November 20, 2023)