skip to main content

DOH Issues Temporary Regulations for Medical Marijuana Dispensaries

The Pennsylvania Department of Health (“DOH”) took a major step forward last week in its ongoing implementation of the state’s medical-marijuana program. On October 25, 2016, DOH issued temporary regulations for dispensaries. DOH is soliciting feedback from the industry on the temporary regulations through November 4, and will publish the final version of the regulations in the Pennsylvania Bulletin.[1] 

The Pennsylvania Medical Marijuana Act, (the “Act”), 35 P.S. § 10231.101 et seq., signed into law on April 17, 2016, authorized DOH to grant permits to up to 50 dispensaries, each of which may provide medical marijuana at up to three separate locations.[2]  As discussed below, the dispensary regulations issued on October 25 establish requirements for the dispensing of medical marijuana, the role of onsite licensed personnel, labeling, and security, among other items. While the regulations create greater structure around the role of the dispensary, and process for dispensing medical marijuana to patients, they also raise a number of questions. 

We have previously written about the state and federal regulatory scheme surrounding medical marijuana in the August 2016 article, "Federal DEA Guidance Impacts Pennsylvania Medical Cannabis Research." 

Overview of Dispensary Regulations

Dispensing Medical Marijuana

Dispensaries are facilities where patients may obtain medical marijuana after receiving a physician certification that the patient has a “serious medical condition.”[3]  Dispensaries may only dispense medical marijuana to a patient or caregiver who presents a valid identification card. Patients and caregivers will be able to receive identification cards from DOH – pursuant to procedures not yet developed – after they obtain a certification from a “practitioner” (i.e., a physician registered with DOH to issue certifications to patients to use medical marijuana).[4]  After verifying the validity of the identification card, the dispensary must review the information on the patient’s most recent certification in DOH’s database.[5] 

According to the Act, the physician certification must state that the patient has a serious medical condition and is under the physician’s continuing medical care, and can only be issued pursuant to a determination that the patient is likely to receive therapeutic or palliative benefit from the use of medical marijuana.[6]  The physician certification must also include “any requirement or limitation concerning the appropriate form of medical marijuana and limitation on the duration of use, if applicable . . . .”[7]

Under the regulations, a dispensary must comply with any requirements or limitations included in the physician certification as to the form of medical marijuana, including dose and duration of use.[8]  A dispensary may not dispense an amount greater than that recommended by the certifying physician.[9]  A dispensary may not dispense more than a 30-day supply of medical marijuana until the patient has exhausted all but a seven-day supply provided pursuant to the patient’s current certification.[10]  A dispensary may not dispense marijuana in dry leaf or plant form.[11]

If the physician certification does not specify limitations as to the form or dose of medical marijuana, however, the onsite practitioner, pharmacist, physician assistant (“PA”), or certified registered nurse practitioner (“CRNP”) shall consult with the patient or caregiver regarding the appropriate form and dose, as discussed further below.[12]

The employee conducting the transaction shall prepare a receipt of the transaction and file it with the DOH using a mandatory electronic tracking system, which the DOH will develop.[13] 

Because insurance does not yet cover medical marijuana, patients will likely self-pay.

On-Site Physician, Pharmacist, CRNP, or PA

On-Site Physician, Pharmacist, CRNP, or PAEach dispensary must ensure that a “practitioner” (i.e., registered physician) or pharmacist is present at the dispensary at all times during operating hours.[14]  If a dispensary is authorized to operate more than one facility under its permit, at least one site must have a practitioner or pharmacist present, but the other sites may staff a PA or CRNP in lieu of the physician or pharmacist.[15]  Any physician, pharmacist, PA or CRNP who works at a dispensary must complete a four-hour training course developed by DOH.[16]

As noted above, in the event that the physician certification on file for the patient does not set forth any requirements or limitations as to the form of medical marijuana, the onsite physician, pharmacist, CRNP, or PA shall consult with the patient or caregiver regarding the appropriate form and dose of medical marijuana to be provided.[17]  The regulations do not place any other restrictions on the licensed personnel in determining the appropriate form or dose of medical marijuana, such as inquiring about their medical history or conducting a medical exam.

A practitioner or a physician at a dispensary may not issue a certificate to a patient or otherwise treat a patient on-site.[18]

Additional Services

In addition to dispensing medical marijuana, dispensaries may sell medical devices and instruments needed to administer medical marijuana.[19]  A dispensary may also sell, with the prior written approval of the Department, services related to the use of medical marijuana.[20]  Neither the Act nor the regulations define “services related to the use of medical marijuana,” and it is not clear what range of services will be covered under this provision. 

Dispensaries shall not sell products with a tetrahydrocannabinol (“THC”) concentration of .3 percent or less, and cannot provide or advertise medical marijuana for free, as a promotional item, as part of a giveaway, or as part of a coupon program.[21]  They also cannot condition the dispensing of medical marijuana upon the purchase of a device, instrument, or service, or offer the delivery of medical marijuana to a patient or caregiver as part of a service related to the use of medical marijuana.[22] 


Medical marijuana must be dispensed in a sealed, labeled package.  The label shall contain:

  • The packaging date;
  • Any applicable date by which the medical marijuana should be used;
  • The following warning: “This product is for medicinal use only. Women should not consume during pregnancy or while breastfeeding except on the advice of the practitioner who issued the certification and, in the case of breastfeeding, the infant’s pediatrician. This product might impair the ability to drive or operate heavy machinery.  Keep out of reach of children.”
  • The amount of individual doses contained within the package;
  • The species and percentage of THC and cannabidiol (“CBD”);
  • A warning that the medical marijuana must be kept in the original container in which it was dispensed; and
  • A warning that unauthorized use is unlawful and will subject the purchaser or user to criminal penalties. [23]

Packages shall also contain a safety insert to be developed by the DOH including potential dangers associated with the use of medical marijuana, how to recognize problematic usage of medical marijuana and how to obtain appropriate services or treatment for problematic usage, and how to prevent the misuse of medical marijuana by minors.[24]

Facility Security and Plan of Operation

Dispensaries must have in place a plan of operation, for review by DOH, that includes: (1) employment policies and procedures; (2) security policies and protocols; (3) a process for receiving, packaging, labeling, handling, tracking, transporting, disposing, returning, and recalling products; (4) workplace safety; (5) inventory maintenance and reporting;[25] and (7) investigation of complaints.[26]  Dispensaries must have a professionally-monitored security and surveillance system, subject to extensive DOH requirements.[27]  Facilities are also subject to inventory tracking, storage, and sanitation and safety requirements.[28]  There are strict requirements for continuous, commercial-grade security monitoring and video surveillance to protect against diversion, theft, or loss of medical marijuana.[29]  Finally, the regulations permit dispensaries to transport and deliver medical marijuana to another dispensary or grower/processor, subject to transportation security requirements.

Dispensaries may only dispense medical marijuana in an indoor, enclosed, secure facility approved by DOH.[30]  The regulations segregate dispensaries geographically:  a dispensary may not be located within 1,000 feet of a school or day-care center; at the same site used for growing and processing medical marijuana; inside the same physical space of another retail business; in a building adjacent to a commercial operation that shares ingress and egress with the commercial operation; or in the office space of a practitioner or other physician.[31]

Unanswered Questions and Problematic Requirements

While the regulations represent forward progress for DOH in implementing the Pennsylvania medical marijuana program, they raise a number of questions.

First, the regulations incorporate a number of steps which DOH has not yet taken, including unfolding an electronic tracking system to be used by all dispensaries, and developing a safety insert which will include warnings regarding potential dangers associated with the use of medical marijuana. Notably, the regulations require a dispensary to delete any electronically recorded information stored on the network, server, or computer system as a result of the transaction after entering the receipt into the DOH electronic tracking system, which could create a problem for a dispensary seeking to access a patient’s dispensing record if the DOH website becomes corrupted or unavailable for any reason.   

The regulations are also vague in certain areas. For instance, the regulations state that a dispensary may sell, with the prior written approval of the Department, “services related to the use of medical marijuana.”[32]  It is not clear what types of services are encompassed by this provision.  Regulations prohibit dispensaries from delivering, or offering to deliver, medical marijuana to a patient or caregiver as part of a service related to the use of medical marijuana,[33] and prohibit a practitioner or physician working onsite at a dispensary from issuing a certification to a patient, or otherwise treating a patient at the facility.[34]

In addition, the regulations raise significant questions regarding the discretion given to the dispensary in dispensing medical marijuana. For instance, the regulations prohibit a dispensary from dispensing an amount of medical marijuana greater than a 30-day supply to a patient or caregiver, but do not define how much a 30-day supply is. Most states that have enacted laws to legalize medical marijuana limit the quantity a patient can receive by ounces or number of plants.[35]  Likewise, the regulations specify that a patient’s supply cannot be renewed until the patient has “exhausted all but a seven-day supply” of that which has been previously dispensed, but fails to specify how a dispensary would determine or confirm that the patient had only a seven-day supply remaining. 

An issue of concern for dispensaries and their licensed personal will be the regulatory provision permitting an onsite physician, pharmacist, PA, or CRNP to determine the appropriate form and dose of medical marijuana in the event that the certifying physician’s certification does not limit the form or dose. As a preliminary matter, this provision is somewhat in tension with the Act, which states that a physician certification “shall include . . . any requirement or limitation concerning the appropriate form of medical marijuana and limitation on the duration of use, if applicable . . . .”  (emphasis supplied).[36]  If the physician certification is required to include applicable requirements or limitations as to the form and dose of medical marijuana appropriate for a patient, it is not clear when circumstances would arise in which dispensary licensed personnel would be needed to advise the patient. 

Allowing onsite licensed personnel to advise a patient as to the form or dose of medical marijuana also conflicts with normal prescribing practice in the pharmacy and general medical practice. In the pharmacy context, a prescription for a controlled substance that does not specify the dose or duration of use is invalid, and a pharmacist must contact the prescribing physician to request a new prescription.[37]  Pharmacists are also prohibited from “prescribing.” The dispensary regulations suggest that the onsite licensed personnel could exercise independent judgment regarding the appropriate form of medical marijuana, rather than seeking input from the physician who has a relationship with the patient.  Further, in the medical context, prescribing controlled substances without performing a medical exam, or establishing a patient-physician relationship, violates rules of medical practice.[38]  While advising a patient regarding the dose and form of medical marijuana is not necessarily equivalent to prescribing, the regulations appear to depart from traditional practice norms, and thereby create uncertainty and legal risk for dispensary owners, as well as for the licensed personnel who consult with patients. 

Further, while not mentioned in the regulations, dispensaries should consider whether their dispensing activity and provision of services related to medical marijuana qualify them as covered entities under HIPAA, and should evaluate their privacy and security policies as related to their handling of protected health information.

Finally, all providers need to continue to bear in mind that despite the state regulatory scheme that is being developed to permit the lawful dispensing of medical marijuana in Pennsylvania, marijuana remains a Schedule I Controlled Substance whose distribution and sale is illegal under federal law. 


In short, while the publication of the temporary dispensary regulations represents a significant step forward with regard to the provision of medical marijuana in Pennsylvania, there are still major areas of uncertainty for licensed professionals and providers interested in becoming part of the statewide distribution network.    


[1] DOH previously issued temporary regulations for grower/processors in August and regarding the general permit process for both grower/processors and dispensaries, and will publish the final version of the regulations, incorporating feedback from industry participants, on October 29 in the Pennsylvania BulletinSee 28 Pa. Code Chs. 1141 and 1151.  DOH also published temporary safe harbor regulations, which permit parents and caregivers of children with serious medical conditions to obtain medical marijuana, in June.  See 28 Pa. Code § 1131 et seq.

[2] 35 P.S. § 10231.616(2). 

[3] 35 P.S. § 10231. 403(a); 501(a); 28 Pa. 1161.22(a). “Serious medical conditions” include: cancer; positive HIV or AIDS status; amytrophic lateral sclerosis; Parkinson’s disease, multiple sclerosis; damage to the nervous tissue of the spinal cord with objective neurological indication of intractable spasticity; epilepsy; inflammatory bowel disease; Huntington’s disease; neuropathies, Crohn’s Disease; post-traumatic stress disorder; intractable seizures, glaucoma, sickle cell anemia, severe chronic or intractable pain of neuropathic origin or severe chronic or intractable pain in which conventional therapeutic intervention and opiate therapy is contraindicated or ineffective; and autism.  35 P.S. § 10231.103. 

[4]35 P.S. §§ 10231.401(a), 403(a), (b). 501(a), (b). 

[5] 28 Pa. Code § 1161.22(b)(1). [All of the regulations referenced herein beginning at 28 Pa. Code § 1161.21 are temporary, and have not yet been published in the Pennsylvania Bulletin or Pennsylvania Administrative Code].

[6] 35 P.S. § 10231.403(a), (b). 

[7] 35 P.S. § 10231.403(b)(6). 

[8] 28 Pa. Code § 1161.22(b)(2)(i). 

[9] § 1161.23(a)(1).

[10] § 1161.23(b).

[11] § 1161.23(a)(2); 35 P.S. 10231.303(b)(3).

[12] § 1161.22(b)(2)(ii).

[13] § 1161.22(c).

[14] § 1161.24(a).

[15] § 1161.24(b). 

[16] § 1161.24(c).

[17] § 1161.22(b)(2)(ii).

[18] § 1161.24(e). 

[19] § 1161.26(b).

[20] § 1161.26(c).

[21] § 1161.26(d)(2). 

[22] § 1161(d)(3), (4).  

[23] § 1161.27(b)(1)-(8).  

[24] § 1161.27(d).

[25] Note that, for the time being, the inventory and record-keeping requirements set forth in the state regulations are less onerous than DEA regulations in effect for DEA registrants.  Should DEA reschedule marijuana, a dispensary may be required to become a registrant, and additional record-keeping requirements could attach.

[26] § 1161.28(a)(1)-(7). 

[27] § 1161.30.

[28] § 1161.31-36.

[29] § 1161.30.

[30] § 1161.25(a).

[31] § 1161.25(c).

[32] § 1161.26(c).

[33] § 1161.26(d)(4). 

[34]§ 1161.24(e).

[35] See, e.g., “25 Legal Medical Marijuana States and DC: Laws, Fees, and Possession Limits,” ProCon.Org, (last visited on 10/28/2016).

[36] 35 P.S. § 10231.403(b)(6).

[37] Cf. DEA Pharmacist’s Manual, Section IX (Valid Prescription Requirements), available at

[38] 49 Pa. Code § 16.92(b).  


Robin Locke Nagele is a Principal in the firm's Health Care Practice Group. She has a national health care litigation and consulting practice, in which she represents, in complex commercial, regulatory and antitrust matters, proprietary and not-for-profit health care providers, multi-hospital systems, integrated delivery systems, academic/teaching medical centers, and ancillary service providers, along with their medical, executive and corporate leadership.

Read more >

Amalia V. Romanowicz is a Principal in the Firm's Professional Liability Defense and Medical Malpractice Litigation Practice Groups. She focuses her practice on the defense of healthcare providers, including physicians, nurses, hospitals, life care and assisted living facilities, physician assistants, nurse practitioners, and pharmacists at trials, mediations, and arbitrations involving cases with often catastrophic losses and significant injuries that present substantial exposure.

Read more >