When Pennsylvania passed its Medical Marijuana Act in 2016, the state launched a four-year pilot licensing program. The Keystone State extended the pilot program’s temporary rules in April.
Though the rules stand until November 2021, Tim Sutton, a noted subject matter expert in the cannabis industry, hopes for a new mandate addressing video storage requirements. “For whatever reason, Pennsylvania requires cannabis companies to keep all records, including video archives, for four years. This is the only state where I’ve seen this,” he says.
Consider the storage implications of the mandate. Video footage from a single 2-megapixel camera operating at 10 frames per second eats up 1.87 terabytes of storage a year, or 7.48 terabytes in four years. Now multiply the storage needs times 100 video cameras operating continuously.
“The amount of hard drive space you need is tremendous,” states Sutton, a senior security consultant and cannabis security practice leader at Guidepost Solutions.
Until the law changes, Sutton recommends following the practice schools use to keep archiving costs down. Put the most recent 90 days of storage at the highest quality possible, then degrade the remaining video footage as time passes. After four years, the video remains useable but consumes less hard drive space.
“The law doesn’t set a resolution for stored video. That is open for interpretation,” he says. “Just be sensible and make sure that stored video is still usable.”
Sutton predicts Pennsylvania will eventually reduce video storage requirements. He suggests the state originally set it at four years to cover the duration of the four-year pilot program.
“You should only store video as long as you really need it, and nobody needs video for four years,” he says.
Additional Video Requirements
Beyond the four-year storage requirement, Pennsylvania requires licensees to install a professionally monitored security and surveillance system that operates 24 hours a day, seven days a week and records all activity in images capable of revealing facial detail.
The law mandates placing fixed cameras that capture images of all individuals and activities in and around:
- Where workers load and unload medical marijuana products from transport vehicles,
- At entrances and exits from both indoor and outdoor vantage points,
- Five feet from the exterior of the facility for dispensaries and 20 feet from the exterior for cultivation facilities,
- In rooms with exterior windows, walls, roof hatches or skylights and storage rooms, and
- In all limited access areas which would include any area where plant material in any form may be present.
“If you cover your building as you should, none of these requirements are difficult,” Sutton says.
The state always required monitoring a cultivation center’s security surveillance systems 24 hours a day, seven days a week. However, Pennsylvania originally required professional monitoring by on-site security. Today, the state allows an organization to have security on-site only during operational hours as long as someone can respond to an alarm within an hour.
Cannabis businesses also may use motion detectors with surveillance systems. Licensees can install a Passive Infrared Motion Detector, like those used for alarm systems. When these detectors sense motion, they signal cameras to record. Or licensees can install cameras that leverage machine learning and intelligence to learn a scene and begin recording when they detect a change in pixels.
“When these cameras detect that a certain percentage of pixels have changed, they interpret that change as motion,” Sutton says. “The cameras are functional and operational at all times. They are looking and checking the scene and analyzing it to see if they should archive the video.”
Full Alarm Coverage
The state expects licensees to install a professionally monitored security alarm system that covers all facility entrances and exits; rooms with exterior windows and walls, roof hatches and skylights; storage rooms; and the perimeter.
“Pennsylvania law includes more requirements for alarms than other states, but this is how an alarm system should be designed,” Sutton says.
Every licensed cannabis business needs a silent security alarm signal, known as a duress alarm, generated by the entry of a designated code into an arming station. When employees enter this code, it signals that someone forced them to turn off the system.
The state also mandates a silent alarm signal, known as a holdup alarm, generated by the manual activation of a device intended to signal a robbery in progress. The state also demands an audible security alarm signal, known as a panic alarm, generated by the manual activation of a device to signal a life-threatening, emergency situation.
“Panic alarms and holdup alarms are not the same things,” Sutton says. “A holdup alarm signals police that you’re being held up, and it is silent. A panic alarm produces lights and sounds to notify everyone in the facility of an issue. It may or may not connect to the police. Employees use a duress alarm when someone forces them to turn off the alarm system to enter the building. They enter a duress code and the system silently notifies the police.”
Pennsylvania also looks for an electrical, mechanical, or another device capable of being programmed to send a prerecorded voice message requesting dispatch when activated. This message must go over a telephone line, radio, or other communications system to public safety agencies.
This device, which is separate of the alarm system, dials out to a predetermined number upon activation and plays a recorded message. “These devices are not expensive, and they are not a big deal. But no alarm company installs them unless you ask them to,” Sutton says. “This is not standard equipment. Not many alarm manufacturers make these devices.”
The law also requires a failure notification system that alerts key individuals within 5 minutes of system failure, smoke and fire alarms, and auxiliary power sufficient to keep the systems operational within 48 hours following a power outage.
Restrict Access
Pennsylvania regulations say little about access control, reports Sutton. Businesses must restrict access, but regulations do not mandate electronic access control systems.
“They allow keyed locks, but there are very few places that require electronic locks. And, if you use electronic systems, the state requires ‘the ability to ensure all access doors are not solely controlled by an electronic access panel to prevent locks from becoming released during a power outage,’” Sutton says. “The bottom line is that if you use electronic locks, you need to make sure your facility remains locked and is not reliant on electrical power to keep it locked.”
Locks should be fail-secure, he adds. Never use magnetic locks on an entry or exit door because magnetic locks only work if there is power.
If licensees adhere to standard security practices, they will meet most of Pennsylvania’s laws for cannabis businesses with ease. But do not overlook Pennsylvania’s lengthy video storage requirements as they go beyond what most states require.
About the author: Patrick Chown is the owner and president of security system integrator, Safe and Sound Security, and the president of Seed to Sale Security, a national brand serving the cannabis industry. Seed to Sale Security offers security system installation, cannabis security plans, and cannabis security consulting to cannabis companies.
