The Data Compliance Laws You Need to Know About

US Data Compliance Laws

HIPAA

The Health Insurance Portability and Accounting Act governs the collection and use of protected health information. And if you’re a medical dispensary or serve patients, you need to abide by it.
According to the CDC, to be compliant, you must:

• Ensure the confidentiality, integrity, and availability of all electronic protected health information.
• Detect and safeguard against anticipated threats to the security of the information.
• Protect against anticipated, impermissible uses or disclosures.
• Certify compliance by their workforce.

Basically, make sure the computer you use to check in patients, verify their prescriptions or recommendations, and catalog their purchases is secure. Install anti-virus software and run regular checks on your system to mitigate the chance of a data breach. Anything with personally identifiable information should only be accessible to HIPAA-trained personnel. Teach staff to close out of windows immediately so no one encounters data they shouldn’t have access to.

You can certainly talk about medical conditions in your blogs and newsletters and even highlight patient stories. Just don’t share personally identifiable information unless a patient has given you permission to do so (even then, an alias is a good idea).

Quick Tip: Be Careful with Segmentation

While your state’s database may give you info on a patient’s medical condition or symptoms, don’t use this to segment them into different groups. Instead, ask patients to identify what they’re interested in using cannabis for and segment them that way. That way, you’re not disclosing medical information through your segmentation, you’re simply allowing your customers to share their area of interest. For example, they can choose from general topics, such as anxiety, nausea, sleep, and pain relief.

CAN-SPAM Act of 2003 (20 characters)

CAN-SPAM is all about emails, and most email providers have processes in place to protect themselves and, to some extent, to protect you.

However, you still need to be mindful.

Your email platform should:

• Have an obvious opt-in box or text (preferably express consent)
• Collect your opt-outs and remove them from your mailing list.
• Have an easy-to-see unsubscribe link.

You should:

• Only email people who have opted to receive messages from you
• Remove contacts who ask to be removed from your list.
• Be clear about how often you send messages and what will be in them, and stick to that.
• Send emails with clear subject lines (misleading ones will get you in trouble)
• Always identify yourself or your company in the front line.
• Have an accurate business address in your email.
• Control who has access to your email list
• Set a strong password for your email account so you don’t get in trouble for a hacker’s actions.

Even if you’re headquartered outside of the US, if you’re using a US-based email marketing company or are primarily sending emails to US addresses, you need to comply with CAN-SPAM or you face large fines (up to $16,000 per instance with no max).

The Telephone Consumer Protection Act (TCPA) (44 characters)

SMS marketing is crucial for dispensaries, but if you don’t comply with TCPA, you’ll face hefty fines. Initially instituted as a way to reign in telemarketers, TCPA has had a major impact on text marketing.

To be compliant, you need to get express written consent from subscribers, share how frequently you’ll be sending messages, and provide opt-out options.

You can’t purchase phone numbers—everyone on your list must opt-in to receive your texts.

In addition, you need to ensure that you’re only capturing data from individuals of age in your state. Make sure that your text signup pops up after your age gate.

Regarding content, skip gifs and images that use licensed materials, even if it’s your favorite movie quote. They can land you in hot water.

Data Compliance Outside the US

CASL

If you have locations in Canada or are thinking of expanding to Canada, you’ll need to abide by The Fighting Internet and Wireless Spam Act (CASL), which is similar to the CAN-SPAM Act. If you’re following CAN-SPAM, you’re CASL compliant.

GDPR

You’ve probably noticed that some platforms are GDPR-compliant. They may allow you to choose whether or not to use the GDPR-compliant settings or force you to use them (especially if they do a lot of business in the EU). GDPR is all about the personal data of EU citizens. You can learn more about it here.

Data Privacy at the State Level

Many individual states have followed in the footsteps of the EU by enacting legislation similar to—and sometimes based on—the GDPR.

California, Nevada, Illinois, New York, Oregon, Texas, Maine, Washington, and more have all developed—or are in the process of developing—updated data collection and privacy laws. To date, 25 US states have, or will soon have, some kind of law governing the collection and use of personal data. Here’s a sampling of some of these laws. Make sure to check for such laws in every state you operate in.

California

The California Consumer Privacy Act went into effect on January 1, 2020. This piece of legislation seeks to give Californians greater control over how their personal information is collected and used. Under the CCPA, Californians have the right to restrict an organization’s use of their personal data and to request the deletion of any personal data previously given to an organization. It’s worth noting that the CCPA has no cap on penalties for non-compliance, making it extremely important that all businesses in California operate within the law.

The CCPA applies to businesses that make more than $25 million annually or that “buys, receives, or sells the personal information of 50,000 or more consumers, households, or devices.”

To be compliant, you’ll need to be able to share customer data upon request and delete a customer’s data if they wish. It’s a good idea to include this process on your privacy policy so customers know how to reach you and how long it will take to share or delete their data.

New York

Considered by some to be a ‘copycat’ of the CCPA, the New York SHIELD Act seeks to provide New Yorkers with more protections for their data. This law goes into effect on March 23rd and requires that businesses take adequate measures to protect private data and notify users of a breach.

Nevada

Nevada’s Senate Bill 220 places restrictions on what organizations can do with collected data—namely, you can’t sell it without an individual’s consent. If you want to be able to sell your email list at some point, you’ll need to make that clear in order to be compliant.

Privacy is a big concern for consumers, and politicians have taken note of it. Look for more upcoming bills at the state level.

Cannabis Data Compliance Best Practices

Stay on top of compliance—implement processes that ensure your site and online activities abide by or exceed current regulations.

Make Clear Processes

Have a process in place to help ensure compliance at every stage: data collection, storage, and use. Ensure that everyone who needs access to it can find it quickly and get the answers they need so their activities are in line with company policy.

Use a Privacy Policy

Share your privacy policy on your website. Let your customers know exactly how their info will be used.

Get Express Consent

When collecting emails or phone numbers, ensure the opt-in process is clear. For example, if you’re collecting phone numbers, you can ask customers to text your shortcode with a particular phrase to opt in. This counts as “express consent”. The first text they receive should let them know how many messages to expect from you and how to unsubscribe.

Make it Clear Who You Are

Your dispensary’s name and address should be at the bottom of your emails. If you’re sending a text, you should also identify your dispensary.

For example:
Save $10 on two Cresco cartridges when you stop by Herbology today. Reserve yours now!

Make it Easy to Unsubscribe

All of your emails should have a link at the bottom for your customers to unsubscribe. If you’re using a mail platform like MailChimp or Active Campaign, they will add this for you.

Double-Check

Service providers can be useful for identifying how your marketing can be compliant, but it’s up to you to ensure that your messages meet any legal guidelines. For example, even if you’ve set your MailChimp to share your address and unsubscribe info, you must verify this yourself. Ultimately, you’ll be held responsible if it’s missing, not the service provider.

Set Up a Google Alert

Stay on top of any changes to regulations by setting up a Google alert. For example, if you’re following the status of the Illinois Data Transparency And Privacy Act, set an alert so you’re notified of any changes to the law that may affect your dispensaries.

What Does the Future Hold?

I’m no Zoltar, but if I had to place a bet, I think we’ll see more states implement data privacy laws. Plus, the federal government may also take action. While they’re unlikely to enact something on par with the EU’s GDPR, they may use it as a model for protecting privacy rights.

Multi-state operators would be wise to implement the strictest of data privacy policies to ensure compliance across the board. This will hopefully save you time in the future since you’ll know that your robust policy will likely cover additional regulations that pop up. Some tech providers like SMS, webinars, and email platforms already allow you to implement GDPR regulations, which isn’t a bad idea if you want to be ahead of the curve.

Want help creating compliant dispensary advertising campaigns? Let's talk! Give us a call at 925-393-0444.