10B Action 2016 0718 - Laserfiche WebLink

Home

delivery. Only employees, officials in the course of their duties, and approved/vetted outside vendors, contractors, and visitors are allowed access to the facility. Employees are required to display identification at all times while working. Employees must immediately report a lost identification badge to their supervisor. Lost employee identification and /or access card will result in immediate deactivation of the lost card and issuance of a new identification and/or access card. All doors without biometric or electronic access control systems must be re-coded or re- keyed annually, as well as following any involuntary termination. Transactional Security Policies Maintaining fiscal integrity and discipline is paramount in the medical cannabis industry. A majority of transactions are still cash based, and a secure method of accounting for and securing the cash is imperative. Blüm SL will encourage use of credit and debit cards when possible in an effort to automate the process, and reduce and mitigate problems associated with cash, including theft and fraud. The entire transaction process occurs with Blüm SL’s POS system, which ties directly into our inventory management systems, and is monitored by high definition cameras. When a transaction occurs, payment will be collected in the form of credit or debit card, or cash. The outgoing medication will be scanned and removed from the inventory system. Blüm SL can undertake a flash audit at any time to reveal any discrepancies in payments or medication quantities. All cash drawers are reconciled after each shift and reconciliation is signed off by a dispensary manage, to enable Blüm SL to reconcile individual cash stations quickly and accurately. Any discrepancies will be identified at the close of a drawer or station and can further be reviewed by camera. Daily batch reports are created and reviewed by management. This series of checks and balances effectively mitigates risk of financial indiscretions that may otherwise occur at any level of the financial reporting process. A contracted armored car service will be provided as deemed appropriate and dedicated to delivering, receiving and securing facility proceeds, which may significantly reduce the risk of robbery and theft. Patient/Transactional Security Blüm SL has the experience, knowledge, and tools necessary to control sensitive, confidential patient information and employee records, and to maintain a unified, secure, HIPAA-compliant registry of its medical cannabis patients. The MJ Freeway software system provides the requisite fields and protections necessary to control security issues, to secure employee records, and to meet confidentiality requirements for patient records. Pursuant to California Health and Safety Code Section 11362.7 et seq., Blüm SL shall maintain records of its patients on site using only the State of California Medical Cannabis Identification Card issued by the County or its designee, or a copy of the prescribing doctor’s written recommendation, to further protect confidentiality of the cardholder. The Blüm SL network will utilize a layered defense to protect patient information, and information systems containing patient data will be physically and logically segregated from POS systems and from website infrastructure. Internal and external digital firewalls will protect the internal network from external attacks directed against the website. All physical and system access to patient information will be logged and monitored on a regular schedule. Access control lists mapped to assigned job roles, combined with real- time alerts, will ensure immediate notification to management should there be an unauthorized attempt to access patient data. Visitor Security Visitors, including outside vendors and consultants are only allowed when escorted by a general manager, after proper clearance through Blüm SL protocol. Such visitors must obtain a visitor identification badge before entering a limited access area, and will be escorted at all times. The visitor identification badge must be visibly displayed at all times while the visitor is in any limited access area. All visitors must be logged in and out, and the log will be available for inspection by the City of San Leandro at all times. All visitor identification badges will be returned to Blüm SL upon exit. Third Party Contractor Security, Requirements and Responsibilities As with visitor protocol, third party contractors are only allowed when escorted by a general manager, after proper clearance through Blüm SL protocol. Such visitors must obtain a visitor identification badge before entering a limited access area, and will be escorted at all times. The visitor identification badge must be 432