DENVER (AP) — Medical marijuana patients asked Colorado health authorities on Wednesday to destroy and rebuild the state’s 107,000-person marijuana patient registry because of security breaches.
The Board of Health unanimously rejected the emergency petition. But officials expressed alarm about a recent state audit showing the Colorado Department of Health and Environment isn’t keeping the registry confidential, as required by law.
Colorado last year made marijuana legal for all adults, but medical marijuana cards are still required to shop in dispensaries.
Colorado’s medical marijuana patient list is supposed to be accessible to law enforcement only under limited circumstances. But state auditors in June blasted the health department for lax security of the registry.
In one 2012 case, the health department turned over 107 names to an officer investigating a dispensary, a violation of the protocol for sharing registry information with authorities. In another case, the health department shared with auditors the names of 5,400 people designated to grow marijuana on behalf of others, without notifying the caregivers of the breach.
Auditors also criticized the health department for not getting confidentiality agreements from temporary employees hired to help process medical marijuana applications.
“The registry is compromised beyond repair. We don’t believe there’s any reason to trust this,” said Laura Kriho, who leads a patient advocacy group and filed the emergency petition asking the health department to destroy the database and start it again.
About a dozen protesters pulled paper bags over their heads to protest the privacy breaches outside the Board of Health meeting.
“I’m disgusted. No other patients’ medical information is treated this way,” protester Kathleen Chippi said.
The administrator of Colorado’s pot patient registry insisted the state is making security upgrades suggested in the audit. Ron Hyman, the state’s registrar of vital statistics, said the agency needs more time to work with law enforcement and other state agencies to rectify problems involved in keeping the database secure.
“We take every breach seriously,” he said.
Hyman told the health board that isolated breaches notwithstanding, police are allowed to perform only individual registry checks, and only if the patient provides a registry number.
“We feel we have prudent practices in place,” Hyman said. “They are not permitted to go on fishing expeditions.”
Washington state, the only other state to allow medical and recreational marijuana use, does not keep a patient registry.
Colorado’s medical registry has declined since adult use was made legal, but only slightly. Colorado had 108,481 patients a month before the legalization measure passed, and 106,817 patients at the end of June, the most recent statistics available.
The protesters said they want the registry to continue, but they want it to be rebuilt and kept more secure. Colorado’s pot patients can possess more marijuana than recreational users, and they could face lower taxes, depending on what voters approve this November.
Kristen Wyatt can be reached at http://www.twitter.com/APkristenwyatt
Colorado medical marijuana registry audit: http://bit.ly/12Bt6Z6