Cannabis
Cannabis facility visitor logs: the strictest rules in the country
If you want to see what a regulator asks for when it writes a visitor log rule from scratch, read a state cannabis regulation. They specify the fields, the ID check, the escort, and a retention period measured in years.
Most frameworks describe an outcome. Cannabis rules describe a form. For operators this is unusually clear, and unusually unforgiving: there is little room to argue your process was equivalent when the rule lists the fields.
What a typical state rule requires
West Virginia's rule for medical cannabis facilities is representative and specific. The visitor log must record the visitor's full name, their badge number, the time of arrival, the time of departure, and the purpose of the visit including the areas visited and each employee visited.
Beyond the fields, the rule requires that a government-issued ID is checked against the name in the log, that a photocopy of that ID is retained with the log, that the visitor is escorted at all times, and that the whole record is kept for four years. Ohio's dispensary access rule follows the same pattern.
The parts that catch operators out
- Areas visited, not just the site. A log recording that someone entered the building does not satisfy a rule asking which rooms they entered.
- Employees visited. Named individuals, which means the record has to capture more than a single host.
- The ID photocopy. This is a data protection problem the rule creates for you: four years of retained identity documents need to be stored securely and disposed of on schedule.
- Badge numbers. The badge is part of the record, so badge issuance and the log have to be the same system or they will disagree.
- Four years. Long enough that a paper system becomes a storage and retrieval problem, and long enough that staff turnover guarantees the process drifts.
Check your own state before you build the process
Cannabis rules are state law and they differ in detail. The pattern above is common but the specifics, particularly retention and what must be done with the ID copy, vary. Read your own regulation rather than a summary, including this one.
Where BeckonDesk fits
The visit record carries visitor name, company, host name, purpose, check-in and check-out timestamps, badge number and an optional photo captured at the kiosk, which covers most of the field list above. Retention is configurable per tenant, so a four-year period can be set rather than approximated.
Two gaps worth naming before you evaluate. BeckonDesk has no escort assignment field, so the continuous escort duty is not tracked in the system. And it captures a visitor photo, not a photocopy of a government ID, so if your state requires the ID image retained with the log, that part needs another answer.
Related reading
See it on your own site.
A 30-minute walkthrough of sign-in, screening, and the record an auditor asks for. 30-day free trial, no credit card.