Cannabis Therapy Institute

Patient Advocacy Project

P.O. Box 19084, Boulder, CO 80308
Phone: 877-420-4205
Email: info@cannabistherapyinstitute.com
Web: http://www.cannabistherapyinstitute.com

January 18, 2011

TO: COLORADO BOARD OF HEALTH

RE: PETITION FOR EMERGENCY RULES TO PROTECT PATIENT PRIVACY

This is a petition for emergency rules pursuant to the state Administrative Procedures Act, CRS 24-4-103 (6).

BASIS AND PURPOSE

The Cannabis Therapy Institute is a patient advocacy and education organization. We speak on behalf of
thousands of Colorado patients who are too sick to participate in the political process. It has come to our
attention that the Confidential Medical Marijuana Registry administered by the Colorado Department of Public
Health and Environment is slated to be "replaced" by a Non-Confidential Registry run by the Department of
Revenue.

The purpose of these emergency rules is to protect the confidentiality of the CDPHE Confidential Medical
Marijuana Registry. Colorado medical marijuana patients will suffer irreparable harm if their confidential registry
information is shared outside the state health agency or if their information is breached in an accidental leak.
Medical marijuana patients stand to lose their homes, their children, their jobs, their health insurance and more
if they are outed as medical marijuana users. See Original Action Petition to the Colorado Supreme Court filed
Jan. 5, 2011 (Filing #2011SA4 – See attached PDF) on behalf of caregiver and dispensary owner Kathleen
Chippi and the Patient and Caregiver Rights Litigation Project.

STATUTORY AND CONSTITUTIONAL AUTHORITY

Colorado Constitution Article XVIII, Section 14 3 (a) provides that:
"The state health agency shall create and maintain a confidential registry of patients who have applied for and
are entitled to receive a registry identification card."
"No person shall be permitted to gain access to any information about patients in the state health agency's
confidential registry, or any information otherwise maintained by the state health agency about physicians and
primary care-givers, except for authorized employees of the state health agency in the course of their official
duties and authorized employees of state or local law enforcement agencies which have stopped or arrested a
person who claims to be engaged in the medical use of marijuana and in possession of a registry identification
card or its functional equivalent."

CRS 25-1.5-106 (3) (a) (I) provides that the state health agency shall administer "the establishment and
maintenance of a confidential registry of patients who have applied for and are entitled to receive a registry
identification card."

5 CCR 1006-2 Regulation ONE (1) of CDPHE rules concerning medical marijuana also provide for a
confidential registry of medical marijuana patients.

BACKGROUND
On Dec. 6, 2010, Fern Epstein, a consultant with Rebound Solutions, gave a talk about the Patient and
Medicine Tracking Database that she helped design under contract with the Colorado Department of Revenue.
Click here to watch the video of her presentation on the new system:
http://www.youtube.com/watch?v=wuYn9C_BbjM

1
According to Epstein, the database will be shared among several state agencies, including the Department of
Revenue, the Colorado Department of Public Health and Environment, the Colorado Division of Labor and
Employment and all state, local and federal law enforcement, including the Colorado Crime Information Center
and the Colorado Bureau of Investigation.

Epstein stated that law enforcement will have "24/7 access to Registry data" and the new database will "give
access to officers on the street and in their patrol cars -- access to registry and Department of Revenue data."

Epstein continued that there "needs to be some interface between various information technology databases."
She explained, "Revenue needs information from the Registry. The Registry needs information from the
Department of Revenue, and law enforcement needs information from both of those organizations."

Epstein said, "The goal is for replacement of the (CDPHE) Registry."

The Department of Revenue's planned Patient and Medicine Tracking Database is a clear violation of the
Article XVIII, Section 14 of Constitution, which requires that only the CDPHE can maintain a confidential
registry that can only be accessed by CDPHE employees and can only be shared with law enforcement for the
purposes of determining whether a person who has been detained by law enforcement is a member of the
confidential registry.

The Department of Revenue will promulgate new rules at a rulemaking hearing on Jan. 27-28, 2011 that will
allow the process of replacing the CDPHE confidential registry to begin. The DoR has proposed no security
guidelines for their new Non-Confidential Registry. As we have seen with WikiLeaks, even the federal
government's most guarded electronic secrets are impossible to secure.

JUSTIFICATION FOR EMERGENCY NATURE OF RULES

CRS 24-4-103 (6) (a) provides that an "emergency rule may be adopted … if the agency finds that immediate
adoption of the rule is imperatively necessary to comply with a state or federal law or federal regulation or for
the preservation of public health, safety, or welfare..."

It is unclear whether or not the Department of Revenue's Medical Marijuana Law Enforcement Division has
already gained access to the CDPHE Confidential Registry. If the CDPHE Registry confidentiality has already
been compromised, patients need to be notified immediately to begin damage control. Often, by the time
confidential information is leaked or shared, the damage may already have been done. For these reasons,
these emergency rules are necessary for the immediate preservation of the public peace, health, and safety.

In addition, these emergency rules allow the State of Colorado to comply with the Fifth Amendment of the U.S.
Constitution's protection against self-incrimination. Marijuana possession and cultivation are still illegal under
federal law. The CDPHE is therefore required to maintain a strictly confidential Registry in order to protect the
Fifth Amendment right of patients not to incriminate themselves in federal crimes.

PROPOSED EMERGENCY RULES

Be it hereby amended that the Rules and Regulations Pertaining to Medical Use of Marijuana (5 CCR 1006-2)
Regulation 1, which governs the "establishment and confidentiality of the registry for the medical use of
marijuana", be amended by the inclusion of the following new Section C. to be added to Regulation 1.

Section C. Security of the CDPHE Confidential Medical Marijuana Registry

(i) The CDPHE shall be responsible for all aspects of maintaining a confidential Registry of medical
marijuana patients in accordance with Article XVIII, Section 14 of the Colorado Constitution.
(ii) No information contained in the CDPHE Confidential Medical Marijuana Registry shall be shared
with the Department of Revenue, any other local, state or federal agencies, or any other entity
except as provided for in this section.
(iii) Access to the Registry is limited to CDPHE key employees. In order to be appointed a key
employee, the CDPHE worker must have been a resident of Colorado for the past two years, must
not have not have been convicted of a felony in the past 5 years, must have a current Public Official

2
 Surety Bond in the amount of $5,000 or more, and must maintain a current set of fingerprints on file
with the Colorado Bureau of Investigation.
(iv) The CDPHE may maintain only one confidential Registry electronic database.
(v) This electronic Registry database must reside on a single computer located securely inside the
Colorado Department of Public Health and Environment.
(vi) This computer must not be connected to or accessible through any internal or external computer
network.
(vii) One electronic backup of this database may be stored in an off-site, secret location.
(viii) Patients shall be referred to in the electronic database only by their Registry ID number and never
by name. Names and other details necessary to identify individuals shall not be included in the
electronic database. The only place that the Registry will link patient names with their Registry ID
numbers shall be in the original application documents filed by the patient in order to become a
member of the Registry. These original application documents shall never be digitized or duplicated
in any way. These hard copy records and any keys linking the Registry ID card and the patient's
name shall be kept in a locked cabinet in a locked room.
(ix) A database security package shall be implemented on this single computer and the electronic
backup to control unauthorized access to the Registry. Attempts to gain access by unauthorized
individuals are automatically recorded and reviewed on a regular basis.
(x) Physical Safeguards: Access to the CDPHE Confidential Registry computer room and offsite
backup location shall be controlled by a cardkey system. These rooms shall be under constant
video surveillance. Surveillance tapes shall be kept for a minimum of 30 days. The rooms shall be
protected by an automatic sprinkler system and numerous automatic sensors (e.g., water, heat,
smoke, etc.). Portable fire extinguishers shall be located throughout the computer room. The
computer room and offsite backup location shall be guarded by one security guard person at all
times.
(xi) Procedural Safeguards: Protection for computerized records includes programmed verification of
valid user identification code and password prior to logging on to the system, mandatory password
changes, limited log-ins, virus protection, and user rights/file attribute restrictions. Password
protection imposes user name and password log-in requirements to prevent unauthorized access.
(xii) Pursuant to Article XVIII, Section 14 of the Colorado Constitution, caregiver registration is not
required. Therefore, patients shall not be linked with their caregivers in the electronic database.
(xiii) Pursuant to Article XVIII, Section 14 of the Colorado Constitution, physician registration is not
required. Therefore, patients shall not be linked with their physicians in the electronic database.
(xiv) Pursuant to Article XVIII, Section 14 patient registration with the CDPHE is voluntary. It is required
to receive exemption from criminal laws. However, only a previous diagnosis of a debilitating
medical condition is required for a patient to raise an affirmative defense at trial. Therefore,
participation in the confidential Registry is optional for the patient.
(xv) By Feb. 1, 2011, the CDPHE must appoint an electronic security expert to the Medical Marijuana
Advisory Committee (MMAC). The goal of the electronic security expert shall be to make
recommendations to the MMAC of actions and procedures necessary to protect the confidentiality
of the Registry from a breach of any kind.
(xvi) All Registry information shall be confidential and shall not be revealed in any report or any other
matter prepared, released or published, except that the CDPHE may release information about the
confidential Registry in a statistical form that does not identify the patient, physician, or caregiver in
any way, including by address.
(xvii) Law enforcement inquiries will be by telephone or fax only.
(xviii) Law enforcement inquiries will be responded to promptly 24 hours a day / 7 days a week by an
authorized CDPHE employee.
(xix) The CDPHE shall create an Incident Report any time the electronic database or original application
documents are inquired about, accessed or breached in any way. This shall include all law
enforcement inquiries or inquiries from any other entity, including state, local or federal government
agencies.
a. The Incident Report shall include:
i. What information was requested.
ii. Who requested the information.

3
 iii. When and how the information was requested.
iv. Under what authority the information was requested.
v. What information was provided to the requesting entity.
(xx) Patient shall be notified every time law enforcement or any other entity requests information about
them contained in the Confidential Registry. The CDPHE shall mail a letter in a discreet envelope to
the patient's last known address within 30 days of the Registry inquiry.
(xxi) The CDPHE shall provide a quarterly Registry Security Status Report containing a detailed audit of
the current security of the Confidential Medical Marijuana Registry. The Report shall include
detailed specifications for the current security of both physical and electronic Registry documents.
The report shall also include a listing of which, if any, entities outside of the CDPHE have accessed
or copied the Registry since its inception in 2001 and the purpose of that access. This shall include
any breaches of the Registry, even if by unknown sources. The Report shall not include law
enforcement requests for status checks of patients if such requests did not allow law enforcement
to have direct access to the Registry. Reports will include all Incident Reports collected by the
CDPHE.
(xxii) The first Registry Security Status Report shall be submitted to the Board of Health by Feb. 1, 2011.
Thereafter, Reports will be due one week before every Board of Health meeting.
(xxiii) If any state government official or employee fails to perform their ministerial duties in accordance
with Article XVIII, Section 14 of the Colorado Constitution, that person shall be guilty of a
misdemeanor.
(xxiv) It is the duty of all state employees and public officials to implement this rule, notwithstanding their
own personal beliefs, and they shall carry out their duties as herein provided.
(xxv) Should any state employee or public official be unable to separate his or her own personal beliefs
from the implementation of this rule, it is that person's duty to resign.
(xxvi) Failure of a state employee or public official to perform their ministerial duties as provided in this
rule shall subject the public official to impeachment for malfeasance in office pursuant Article XIII of
the state constitution or shall subject a state employee to a misdemeanor criminal offense.

We respectfully ask the Board of Health to consider these emergency rules on behalf of Colorado's patients,
who have a Constitutional right to confidential access to medical marijuana. If the Board denies this emergency
petition, we request the Board to set a formal rulemaking hearing on the petition as soon as possible.

Sincerely,

Laura Kriho, Director

Cannabis Therapy Institute

Kathleen Chippi
Patient and Caregiver Rights Litigation Project

Attachments: Original Action Petition to the Colorado Supreme Court filed Jan. 5, 2011. (Filing #2011SA4 –
See attached PDF) filed on behalf of Kathleen Chippi and the Patient and Caregiver Rights Litigation Project.

4
To: Karen Osthus
Board of Health Administrator
kosthus@smtpgate.dphe.state.co.us

Cc: Board of Health Members

Glenn H. Schlabs , President

Sherman & Howard, LLC
90 S. Cascade Ave.
Colorado Springs, CO 80903
E-mail: gschlabs@sah.com

Laura J. Davis, Vice-President

Ball Aerospace & Technologies
9675 W. 108th Circle
Westminster, CO 80021
E-mail: ldavis@ball.com

Larry W. Kipe, MD
Moffat Family Clinic
600 Russell Craig, CO 81625-2018
E-mail: lwkipe@aim.com

Jeanne T. McGinnis
Exempla Lutheran Medical Center
8300 West 38th Avenue
Wheat Ridge, CO 80033
E-mail: mcginnisj@exempla.org

Philip Mehler, MD
Denver Health
777 Bannock Street, MC 0278
Denver, CO 80204
E-mail: pmehler@dhha.org

Kindra Mulch
Kit Carson County
P.O. Box 70
Burlington, CO 80807
E-mail: hhskm@kitcarsoncounty.org

Christine Nevin-Woods, DO, MPH

Pueblo City-County Health Dept.
101 West 9th Street
Pueblo, CO 81003
E-mail: cnw@co.pueblo.co.us

Joelle Riddle
La Plata County Board of County Commissioners
1060 E. 2nd Ave. Durango, CO 81301
E-mail: RiddleJX@co.laplata.co.us

Joan Sowinski
Centennial, CO 80015
E-mail: jwsowinski@earthlink.net