(a) The DPHSS shall create and maintain a confidential database for the consistent and accurate online tracking of the provisions of this Act. The DPHSS shall use best available practices to ensure the confidentiality of a qualified patient’s status and records from the general public, and be guided by all HIPAA rules and regulations. The confidential database will include:

(1) a tracking system for licenses granted to commercial cultivators, commercial manufacturers, and medical cannabis dispensaries;

(2) a tracking system that includes the names and addresses of qualified patients and the qualified patient’s primary caregivers to ensure compliance with the provisions of this Act; and

(3) the names and addresses of the persons who have either applied for or received a registry identification card.

(b) This confidential database shall not include the medical records or medical condition of the qualified patient.

(c) Medical conditions of qualified patients shall not be requested or required by the DPHSS.

(d) The DPHSS shall provide medical cannabis dispensaries with the means to electronically verify the valid status and expiration date of a qualified patient’s written certification or patient caregiver’s registration via the confidential database to ensure that a person is lawfully in possession of a valid written certification or registration according to the following guidelines:

(1) This information will be provided by the DPHSS on an as needed basis.

(2) At no time will a medical cannabis dispensary be given access to the confidential database in its entirety.

184

COL 6/21/2023

10 Guam Code Ann. HEALTH AND SAFETY
CH. 12 MEDICAL PRACTICES

(3) All new patients will be verified by medical cannabis dispensaries via the confidential database before provision of services.

(4) A record of the expiration date of the qualified patient’s written certification or primary caregiver’s registration will be kept by the medical cannabis dispensary.

(5) Medical cannabis dispensaries shall not provide services to a person whose written Certification or registration has expired until proof of renewal of the written certification or registration is obtained from the DPHSS.

(e) Records maintained by the DPHSS that identify qualified patients, primary caregivers, and qualified patient’s practitioners are confidential and shall not be subject to disclosure, except:

(1) to authorized employees or agents of the DPHSS as necessary to perform the duties of the DPHSS pursuant to the provisions of this Act;

(2) to authorized employees of state or local law enforcement agencies, but only for the purpose of verifying participation in Guam’s medical cannabis program;

(3) pursuant to a court order or subpoena issued by a court;

(4) as provided in the federal Health Insurance
Portability and Accountability Act of 1996, codified at 42
U.S.C. §1320d et seq.;

(5) with the written permission of the qualified patient or the qualified patient’s legal guardian, or a parent or person with legal custody if the qualified patient has not attained eighteen (18) years of age;

(6) to a law enforcement official for verification purposes. The records may not be disclosed further than necessary to verify a qualified patient’s participation in the medical cannabis program; and

(7) to a qualified patient’s treating practitioner and to a qualified patient’s primary caregiver for the purpose of carrying out this Act. This confidential database shall not

185

COL 6/21/2023

10 Guam Code Ann. HEALTH AND SAFETY
CH. 12 MEDICAL PRACTICES

include the medical records or medical condition of the qualified patient.

(8) Medical conditions of qualified patients shall not be requested or required by the DPHSS.

SOURCE: Added as part of the amendments by P.L. 33-220:2 (Dec. 17,
2016).