The new rules state that "Surveillance recordings and clear still photos must be made available to the Medical Marijuana Enforcement Division and law enforcement upon an administrative or law enforcement request demonstrating that the information sought is relevant and material to a legitimate regulatory or law enforcement inquiry."

There is no definition of the word "legitimate", so this would probably require medical marijuana centers to give patient surveillance recordings to the Department of Revenue or any other law enforcement agency on demand, unless the medical marijuana center was willing to go to court to challenge the "legitimacy" of the request.

Here's a "Cliff Notes" version I just made from a first reading of the rules. Disclaimer: Do not take this as legal advice. This is intended only to inform readers and members of the public, in a general, non-legalese way of what the rules provide. It's not intended for those involved in the business of medical marijuana. Nor does it cover every section.

Authority for the rules: The State Medical Marijuana Licensing Authority was granted authority to make rules by the Colorado Medical Marijuana Code which went into effect on July 1, 2010.

The rules cover both medical marijuana centers (aka dispensaries and retail sales) and those engaged in medical marijuana cultivation. The cultivation sites are called "Optional Premises Cultivation Operation (OPC)." Both medical marijuana centers and OPC's can have an inventory of 6 plants or 2 ounces of marijuana for each patient that has designated them as their primary caregiver. If the patient is allowed more under state law, the centers and OPC's can have the increased amount.

Terms to become familiar with, particularly with respect to how inventory is counted and required licenses: Propogation, Vegetation, Flowering and Processed. All are defined in detail. In order to engage in propogation, vegetation or flowering, the premises must have an OPC license.

Not good news: Inventory for marijuana plants include clones. Inventory for packaged marijuana includes shake.

Medical marijuana centers with a licensed OPC facility may sell the marijuana it grows to other licensed centers or to those with Medical Marijuana Infused Product (MIP) licenses (e.g., licenses for edible marijuana products)if certain conditions are met. One condition:

A MMC may purchase not more than thirty percent (30%) of its total on-hand medical marijuana inventory from another licensed medical marijuana center in Colorado. A medical marijuana center may sell no more than thirty percent (30%) of its total on-hand medical marijuana inventory to another Colorado medical marijuana licensee.

Another rule: All parties to the buying and selling transactions are required to verify the license status of the other licensees.

Other rules spell out violations that may be charged. Probable cause gets a buddy word: Probable truth. When a complaint is filed, the licensing authority investigates the probable truth of the accusation, and if it finds probable cause to believe a violation occurred, it sends the licensee an order to show cause why its license should not be suspended or revoked or otherwise subject to disciplinary action. It also schedules a hearing.

If the license is suspended, a two foot notice in the following form must be posted prominently both inside and outside of the premises for the duration of the suspension

NOTICE OF SUSPENSION
MEDICAL MARIJUANA LICENSES ISSUED FOR THESE PREMISES HAVE BEEN SUSPENDED BY ORDER OF THE STATE OR LOCAL LICENSING AUTHORITY FOR VIOLATION OF THE COLORADO MEDICAL MARIJUANA CODE

If suspended, the licensee can hold onto its marijuana inventory and continue to care for it, but it may not sell it or give it away.

If the licensing authority "objectively and reasonably" believes the licensee has wilfully violated the rules, or that there's a public health or safety issue, it can shut the business down immediately through a "temporary suspension."

The investigators of the Medical Marijuana Enforcement Division and their supervisors are deemed to be police officers and are granted similar powers.

The rules also spell out penalties for first and subsequent offenses, which vary depending on the degree of mitigation or aggravation shown at the hearing. Example: For a violation for sale to nonqualified persons, if it's a first violation and there's only one count charged, the penalty is a license suspension of 30 days and "15 days in abeyance." Also, "A fine is okay."

For a second violation within a year, the licensee must go to hearing. "Note: Criminal charges should also be filed and upon conviction of a drug related felony the license must also be revoked."

An example of mitigation for this violation: "The patient has been a regular and the licensee was shown prior identification and/or management was not involved. " Or, "Patient registry card shown and had just expired."

An aggravating factor for this violation: No identification or registry card presented or checked and/or management involved.

Other potential violations include: After-hours sales, violation of the 70%/30% rule, purchase from unlicensed sources, unlawful consumption or medication on the premises, failure to maintain adequate books and records, failure to report or register personnel changes, employing underage persons, hidden ownership or unlawful financial interest, failure to meet sanitary standards, and failure to display credentials.

The most severe violation seems to be Purchase of Marijuana from Unlicensed Sources. Even for a first offense, the rules states: "Go to Hearing. License should be revoked immediately as these violations are generally indicative of the presence of other criminal activity."

After the violations section, the rules move on to employee licenses, for which there are different categories. Essentially, anyone employed in a capacity related to the actual marijuana must be licensed. Who doesn't need to be licensed?

any person employed or contracted to perform activities not directly related to the possession, cultivation, dispensing, selling, serving, delivering or giving of marijuana as permitted by law. Services such as advertising, legal, or emergency HVAC shall be exempt from licensure pursuant to this rule.

At least the rules recognize that "possession, cultivation, dispensing, selling, serving, delivering or giving of marijuana" may be authorized by law. When you think about it, Colorado's come a long way, especially considering the Feds won't concede any of those with respect to federal law.

Transporters who move the marijuana from OPC premises to a medical marijuana center must also be licensed. And they better hustle. There's a time limitation on how long they can take to do the transport.

Also from the rules for transporters, a good provision, considering that several Colorado towns have opted out or imposed a moratorium on medical marijuana businesses:

When determining and reporting the route to take, licensees should select the best direct route that provides efficiency and safety. When medical marijuana or medical marijuana-infused products are transported in the manner described by the MMED through these regulations, it may be transported on any public road through any city, town, city and county or county, whether or not that city, town, city and county or county has allowed for medical marijuana licensees to operate there.

The rules then move onto security issues, such as requirements for alarm systems and surveillance cameras. The meaty stuff starts on page 37, with "10.400 - Specifications for Video Surveillance and Recording of Medical Marijuana Licensed Premises – Minimum Requirements." Here's where patient privacy issues arise:

• All limited access areas, point of sale areas, security rooms/areas and all points of ingress/egress to limited access areas and all points of ingress/egress to the exterior of the licensed premises must have fixed camera coverage capable of identifying any activity occurring within a minimum of twenty (20) feet of all entry and exit points.
• All medical marijuana licensed premises shall have camera placement which allows for the clear and certain identification of any individual in and/or on the licensed premises
• All entrances and exits to the facility shall be recorded from both indoor and outdoor vantage points, and capable of clearly identifying the individual entering or exiting the facility.
• All camera views of customer areas must be continuously recorded twenty-four (24) hours a day. The use of motion detection is authorized with a minimum of ten (10) second pre- and post- event recording.
• A chronological point of sale transaction log must be made available to be used in conjunction with recorded video of those transactions.

Who gets to see the footage?

Data which is captured from licensee point of sale and video surveillance systems shall be held in confidence by all employees or representatives of the State Licensing Authority and the MMED, and shall only be disclosed upon an administrative or law enforcement request demonstrating that the information sought is relevant and material to a legitimate regulatory or law enforcement inquiry.

Sounds like the Patriot Act. "Relevant and material" is a lesser standard than probable cause.

The rules also provide for "Storage-Warehouse Storage Permits." This too is progress, except again, everything must be recorded:

Any medical marijuana stored in a storage warehouse licensed premises shall be packaged, sealed, weighed and recorded on video before it is transported directly to or from the storage warehouse directly from or to the primary licensed premises only. Any discrepancy in weight shall be documented and reported to the MMED within twenty-four (24) hours. It shall be unlawful to open a pre-sealed package of medical marijuana except upon the primary licensed premises.

Next up are rules for edibles and related "infused" products, mostly pertaining to sanitation. They read like a code for restaurants. Interestingly, they also apply to making hashish:

That all sanitary requirements shall also apply to any person making hashish on the premise of an OPC licensee. Production of water based hashish may only be made in an area so designated clearly on the diagram of the premises on file with the licensing authority. All other methods of extraction shall meet these standards and only be produced in a facility licensed to manufacture MIPs.

There are rules for disposal of marijuana waste. And there are more requirements pertaining to selling marijuana:

Upon entry into a licensed facility by a patient or caregiver, the licensee shall physically view and inspect the patient or caregiver’s registry card and proof of identification to confirm the information contained on the documents and also to judge the authenticity of the documents presented.

Proper labeling is required:

No licensee shall sell, transfer or give away any medical marijuana that does not contain a label with a list of all ingredients, including all chemical additives, including but not limited to nonorganic pesticides, herbicides, and fertilizers that were used in its cultivation and production.

For non-infused products, the labels must also contain:

• the license number of the OPC licensee, the MMC if medical marijuana was obtained from a center not licensed the same as the OPC facility, or if being sold by a different licensed MMC,
  that Center’s license number;
• the date of sale; and
• the patient registry number of the purchaser

Infused products must also be labeled with things like weight and ingredients, and must state:

“This product is infused with medical marijuana and was produced without regulatory oversight for health, safety or efficacy and there may be health risks associated with the consumption of the product.”

Next is a list of chemicals that may not be used in the cultivation of marijuana, having been banned at both the federal and state levels. I didn't recognize any of them.

There are strict rules for residency for those applying for licenses. A non-resident business entity may only get a license if "all owners, officers, managers and employees of the applicant are residents."

As for people applicants, "Any natural person applying for a license or serving as an owner, officer, manager or employee of an applicant for licensure must establish Colorado residency." The rule then goes into a detailed discussion of what constitutes a primary home for residency purposes. But the physical home isn't the only thing that can establish a primary home and residency. Other things that lean towards establishing residency:

Evidence of business pursuits, place of employment, income sources, residence for income or other tax purposes, age, residence of parents, spouse, and children, if any, leaseholds, situs of personal and real property, existence of any other residences outside of Colorado and the amount of time spent at each such residence, and any motor vehicle or vessel registration.

Full time students in Colorado and their spouses are presumed to be residents, as are members of the military and those working in Colorado for the diplomatic service of any country recognized by the U.S. Also, residents of Colorado who leave the state to go to school elsewhere are still considered residents.

There are rules for paying and collecting state taxes.

There's a list of administrative violations that result in "citations."

A violation of the Colorado Medical Marijuana Code or rules is classified as a general violation unless otherwise specified.

A general violation is defined as a violation which is specifically determined not to be of a serious nature, but has a relationship to the Colorado Medical Marijuana Code or rules.

Example: Working without a badge.

Those receiving citations can request a hearing, but it's up to the Division whether to grant one. If there's a hearing, the only issue is whether the violation occurred. (Mitigation isn't relevant.)

End of my "Cliff Notes" version.

When these rules were first promulgated in November, I wrote:

All this will do is drive medical marijuana users back to the illegal market. ....Colorado's medical marijuana law was passed as a constitutional amendment, not a statute. The protections of the Fourth Amendment apply to everyone. No one should be forced to exercise one constitutional right at the expense of another. And medical marijuana patients should have the same privacy rights as those who use other medicines.

The final version of the rules released today have some beneficial changes from the November version. (I detailed the November version here.) The introduction to the new rules state that they were made after input from the medical marijuana community, lawyers and others:

During the period of August 27, 2010 through December 15, 2010, the Medical Marijuana Enforcement Division (“Division” or “MMED”) consulted with interested parties from the medical marijuana industry, the legal profession, and local and state government to draft the proposed rules and ensure adequate oversight and regulation of the medical marijuana industry. In addition, in January, 2011, the State Licensing Authority conducted a public rulemaking in accordance with the requirements of section 24-4-103, C.R.S., of the Administrative Procedure Act, and allowed all interested persons the opportunity to submit their views and opinions regarding the rules.

The troubling provisions to me remain the excessive 24/7 surveillance requirements, including of customers for whom there is no suspicion of wrongdoing, the ease with which law enforcement can get videotapes and sales records and the conversion of the confidential registry into a database accessible by law enforcement. What other medicine would receive such scrutiny?

In November, 2010, Colorado had 113,000 registered medical marijuana users. (Applications continue to come in at the rate of 1,000 a week.) Also, as of November,

So far, 1,218 pot farms, 808 dispensaries and 318 businesses that infuse candy, olive oils, pizzas and other edibles with marijuana have applied for state licenses. Every facet of their operations will soon be governed by the new regulations....

The MMED says the rules have been modified so that law enforcement won't be able to access the planned database to get names or personal identifying information. Rather, if a person is arrested and claims to be a patient in lawful possession, an officer can call the database, provide the patient's name as given by the arrestee or suspect, and get a yes or no answer as to whether he's on the database. Of course, the database doesn't yet exist, so we'll just have to wait and see if it turns out this way.

How is this all going to be paid for? With the $9 million in license application fees Colorado took in last year. That's enough to hire 100 agents. The Department plans on hiring around 50 for now. Given the massive budget cuts to education this year, and the hard time the Colorado Bureau of Investigation is having keeping up with work on violent crimes, it's a bit ironic that the one agency with a budget surplus is the one overseeing medical marijuana. Wouldn't that money be better spent on agents catching violent criminals and on hiring more teachers than hiring revenue agents to make sure centers aren't selling more pot than allowed, or watching surveillance footage, or checking up on whether every employee is wearing a badge?

On the other hand, the fact that Colorado lawmakers agree that "the possession, cultivation, dispensing, selling, serving, delivering or giving of marijuana" is permitted by law to any extent, is progress. And it seems like Matt Cook, Senior Director of the Enforcement Line of Business and Dan Hartman, Division Director of the Medical Marijuana Enforcement Division (MMED) are trying to balance competing interests. Personally, I'd rather see decriminalization than legalization, and have it apply to all marijuana users, not just medical users, so all these rules and the cost of enforcing them weren't necessary. Over-regulation is just going to feed the black market. Why do that when you could just as easily eliminate the black market?