Dispensary Record Keeping and Coordination with Treating Physicians

Dispensaries operating in medical cannabis programs sit at an unusual intersection: they are retail environments governed by pharmaceutical-grade documentation requirements. Record keeping in this context covers everything from seed-to-sale tracking mandated by state regulators to the quieter, less-codified question of how dispensary staff communicate with the physicians who wrote the recommendations in the first place. Both sides of that equation matter enormously for patient safety and regulatory survival.

Definition and scope

A medical cannabis dispensary's record-keeping obligations are not optional interpretations of good practice — they are statutory requirements embedded in state medical marijuana acts and enforced through licensing conditions. Most states with operational medical programs require dispensaries to maintain purchase records, patient registry verification logs, batch testing documentation, and inventory reconciliation reports. The METRC tracking system, which 18 states had adopted as their seed-to-sale platform as of its most recent public deployment data, assigns a unique radio-frequency identification tag to every plant and package, creating an auditable chain of custody from cultivation through point of sale.

Coordination with treating physicians occupies a different, narrower lane. Unlike pharmacy benefit managers, dispensaries typically do not receive electronic prescribing data or sit within hospital information systems. The physician's role ends — legally speaking — at the written recommendation or certification. What happens after that is largely structured by state program rules, patient privacy rights, and whatever voluntary protocols a dispensary builds internally.

The scope of record keeping therefore splits into two distinct categories:

1. Regulatory compliance records — inventory, sales, testing certificates, employee credentialing, and surveillance logs required by the state licensing authority
2. Clinical coordination records — documentation of patient medical history, dosing guidance notes, contraindication flags, and any communication channels established with recommending physicians

These two categories operate under different legal frameworks and carry different risk profiles.

How it works

On the regulatory side, the mechanics are relatively standardized. Each transaction at a dispensary point-of-sale system captures the patient's registry ID, the product's METRC tag, the quantity sold, and the date — all of which feed into state-auditable reports. Purchase limits are enforced in real time through registry lookups, preventing patients from exceeding state-defined thresholds. Records must typically be retained for a minimum of 3 to 7 years depending on state statute, with California's Bureau of Cannabis Control (now the Department of Cannabis Control) requiring 7-year retention for most transaction records.

Clinical coordination is structurally messier. Because cannabis remains a Schedule I controlled substance under the federal Controlled Substances Act (21 U.S.C. § 812), federal health information frameworks like the DEA's prescription drug monitoring programs (PDMPs) do not include cannabis transactions. HIPAA applies to covered entities — meaning the physician's office — but dispensaries are generally not HIPAA covered entities unless they are structured as part of a healthcare system.

That gap matters. When a dispensary budtender asks about a patient's other medications to flag potential interactions, any notes taken are governed by state dispensary privacy regulations rather than HIPAA. States like New Mexico and Minnesota have explicit statutes protecting medical cannabis patient records, while others rely on general business privacy law.

Voluntary coordination protocols — where dispensaries build intake forms that ask patients to identify their recommending physician and consent to information sharing — represent the most functional bridge between retail and clinical care. Some dispensary staff training programs now include modules on drug interaction screening tools developed by clinical pharmacists specifically for the cannabis context.

Common scenarios

Three scenarios illustrate where record keeping and physician coordination intersect most visibly:

Oncology patients: A patient undergoing chemotherapy may use cannabis for nausea and appetite stimulation. The oncologist's recommendation typically specifies a condition but not a product. The dispensary's records will show purchase history; the physician's chart may show nothing. Dispensaries serving cancer patients increasingly maintain internal notes — with patient consent — about treatment phase and dosing response to enable continuity across budtender interactions.

Epilepsy and seizure management: In states where cannabis is approved for seizure disorders, patients with epilepsy often work with neurologists who may want to track CBD-to-THC ratios across product changes. Some dispensaries maintain product-switch logs specifically for this population, though the format is not mandated by any federal standard.

Veterans with PTSD: Veterans accessing dispensaries through state programs frequently carry complex medication profiles from VA care. The VA does not prescribe cannabis, but VA physicians may document patient self-reported use. Dispensary records are almost never integrated with VA health records, creating a coordination gap that falls entirely on the patient to bridge.

Decision boundaries

Understanding what a dispensary is — and is not — responsible for clarifies where the record-keeping burden properly rests.

Dispensaries are responsible for: verifying patient registration status, enforcing purchase limits, maintaining seed-to-sale documentation, retaining lab testing certificates, and protecting patient purchase records from unauthorized disclosure under applicable state law.

Dispensaries are not responsible for: clinical diagnosis, drug interaction counseling as a medical service, updating the recommending physician's chart, or integrating with electronic health record systems. The regulatory context for dispensaries consistently treats them as licensed retailers with enhanced documentation obligations — not as clinical providers.

The practical decision boundary arrives when a patient presents information suggesting a medical emergency or a clear contraindication — say, a known drug interaction between cannabis and a blood thinner like warfarin, which carries a documented risk of elevated bleeding (NIH National Library of Medicine, drug interaction data). In that scenario, dispensary compliance requirements do not mandate clinical intervention, but staff training protocols at responsible operations treat it as a referral moment: document the interaction, advise the patient to consult their physician, and decline to make a clinical recommendation.

That line — between informed retail guidance and medical advice — is the defining boundary of the entire coordination question.