Minnesota Department of Health
Office of Medical Cannabis
Internal Controls and Compliance Audit
July 2016 through December 2018

January 2020

Financial Audit Division

Office of the Legislative Auditor
State of Minnesota

 Financial Audit Division
The Financial Audit Division conducts 40 to 50
audits each year, focusing on government entities
in the executive and judicial branches of state
government. In addition, the division
periodically audits metropolitan agencies, several
“semi-state” organizations, and state-funded
higher education institutions. Overall, the
division has jurisdiction to audit approximately
180 departments, agencies, and other
organizations.
Policymakers, bond rating agencies, and other
decision makers need accurate and trustworthy
financial information. To fulfill this need, the
Financial Audit Division allocates a significant
portion of its resources to conduct financial
statement audits. These required audits include
an annual audit of the State of Minnesota’s
financial statements and an annual audit of major
federal program expenditures. The division also
conducts annual financial statement audits of the
three public pension systems. The primary
objective of financial statement audits is to
assess whether public financial reports are fairly
presented.

The Office of the Legislative Auditor (OLA) also
has a Program Evaluation Division. The Program
Evaluation Division’s mission is to determine the
degree to which state agencies and programs are
accomplishing their goals and objectives and
utilizing resources efficiently.
OLA also conducts special reviews in response to
allegations and other concerns brought to the
attention of the Legislative Auditor. The
Legislative Auditor conducts a preliminary
assessment in response to each request for a
special review and decides what additional action
will be taken by OLA.
For more information about OLA and to access
its reports, go to: www.auditor.leg.state.mn.us.

The Financial Audit Division conducts some
discretionary audits; selected to provide timely
and useful information to policymakers.
Discretionary audits may focus on entire
government entities, or on certain programs
managed by those entities. Input from
policymakers is the driving factor in the selection
of discretionary audits.

Photo provided by the Minnesota Department of Administration with recolorization done by OLA.
(https://www.flickr.com/photos/139366343@N07/25811929076/in/album-72157663671520964/)
Creative Commons License: https://creativecommons.org/licenses/by/2.0/legalcode

 OFFICE OF THE LEGISLATIVE AUDITOR
STATE OF MINNESOTA • James Nobles, Legislative Auditor

January 2020
Members
Legislative Audit Commission
Jan Malcolm, Commissioner
Minnesota Department of Health
This report presents the results of our internal controls and compliance audit of the Office of Medical
Cannabis for the period July 2016 through December 2018. The objectives of this audit were to
determine if the department had adequate internal controls over selected activities and complied with
significant legal requirements.
This audit was conducted by Valerie Bombach (Audit Director), Todd Pisarski (Auditor-in-Charge),
and Kelsey Carlson (Senior Auditor).
We received the full cooperation of the Minnesota Department of Health’s staff while performing
this audit.
Sincerely,

Valerie Bombach
Audit Director

Room 140 Centennial Building, 658 Cedar Street, St. Paul, Minnesota 55155-1603 • Phone: 651-296-4708 • Fax: 651-296-4712
E-mail: legislative.auditor@state.mn.us • Website: www.auditor.leg.state.mn.us • Minnesota Relay: 1-800-627-3529 or 7-1-1

  

Table of Contents
Page
Report Summary ...............................................................................................................1
Conclusions ...................................................................................................................1
Audit Overview .................................................................................................................3
Background ...................................................................................................................3
Audit Scope, Objectives, Methodology, and Criteria ...................................................8
Authorize Program Participants ......................................................................................11
Verify Health Care Practitioner License .....................................................................11
Validate Caregiver Relationship with Patient .............................................................12
Collect and Safeguard Patient Fees .................................................................................15
Collect Correct Fee Amounts ......................................................................................16
Safeguard Registration Fees ........................................................................................17
Tested and Reliable Supply of Medical Cannabis ..........................................................19
Contract with a Laboratory .........................................................................................19
Track the Testing and Sale of Medical Cannabis........................................................20
Detect Diversion..........................................................................................................22
List of Recommendations ...............................................................................................25
Agency Response ............................................................................................................27

  

Internal Controls and Compliance Audit

1

Report Summary
Minnesota is one of 33 states that allows qualifying patients the legal access to medical
cannabis for health care treatment. Derived from the cannabis plant, medical cannabis
has been reported to help treat some illnesses and symptoms.
The Minnesota Department of Health (MDH) oversees Minnesota’s medical cannabis
program and must ensure that participants and medical cannabis manufacturers comply
with eligibility, payment, and other legal requirements. In Fiscal Year 2019, 17,200
patients were enrolled in the program, and MDH expenditures totaled $1.57 million.
The Office of the Legislative Auditor conducted this audit to determine whether MDH
had adequate internal controls and complied with significant legal requirements. The
audit scope included MDH’s oversight of patient eligibility, participating health care
practitioners, and fee revenues. We also examined the department’s oversight of
manufacturer and laboratory processes to ensure a tested and reliable supply of medical
cannabis for patients. Our work did not include a comprehensive audit of medical
cannabis manufacturers and laboratories or their compliance with legal requirements.
The period we examined was from July 1, 2016, through December 31, 2018.

Conclusions
Internal Controls
OLA found that the Minnesota Department of Health’s internal controls were generally
not adequate to safeguard financial assets and ensure compliance with selected legal
requirements for the medical cannabis program.
Internal Controls
Not
Adequate

Generally Not
Adequate

Generally
Adequate

Adequate

We identified the following weaknesses in internal controls related to authorizing
participants, processing fees, tracking and testing medical cannabis, and preventing and
detecting diversion of the drug. We discuss these more thoroughly in the findings and
recommendations in the report.


Finding 1. The Minnesota Department of Health did not verify for all new
patients that the license of their health care practitioner was active and in good
standing. (p. 11)



Finding 2. The Minnesota Department of Health did not keep valid
documentation of the eligibility of parents or legal guardians for the medical
cannabis program. (p. 12)

 Minnesota Department of Health – Office of Medical Cannabis

2



Finding 4. The Minnesota Department of Health did not adequately reconcile
some medical cannabis patient fees or ensure employee separation of duties
when handling these payments. (p. 17)



Finding 5. The Minnesota Department of Health did not ensure that each of the
two medical cannabis manufacturers had a formal contract with a testing
laboratory. (p. 19)



Finding 6. The Minnesota Department of Health did not have adequate controls
to ensure manufacturers accurately tracked and tested medical cannabis prior to
sale. (p. 20)



Finding 7. The Minnesota Department of Health did not have adequate controls
to help prevent and timely detect diversion or loss of medical cannabis by a
manufacturer. (p. 22)

Legal Compliance
The Minnesota Department of Health generally complied with most legal requirements
that we tested, although we noted some exceptions related to the authorization of health
care practitioners, some fee payments, and manufacturer contracts.
Legal Compliance

Did Not
Comply

Generally Did
Not Comply

Generally
Complied

Complied

OLA found the following issues of noncompliance, discussed more thoroughly in the
findings and recommendations in this report.


Finding 1. The Minnesota Department of Health did not verify for all new
patients that the license of their health care practitioner was active and in good
standing. (p. 11)



Finding 3. The Minnesota Department of Health charged some medical
cannabis patients a lower registration fee than permitted in state statutes. (p. 16)



Finding 5. The Minnesota Department of Health did not ensure that each of the
two medical cannabis manufacturers had a formal contract with a testing
laboratory. (p. 19)

 Internal Controls and Compliance Audit

3

Audit Overview
This report presents the results of an
internal controls and compliance audit of
selected activities in the Minnesota
Department of Health (MDH).
Management is responsible for
establishing internal controls to safeguard
assets and ensure compliance with
applicable laws, regulations, and state
policies.

Control
Environment

Risk
Assessment

Monitoring

A strong system of internal controls
begins with management’s philosophy,
Information and
Control
Communication
Activities
operating style, and commitment to ethical
values. It also includes processes to
continuously assess risks and implement
control activities to mitigate risks. A successful internal controls system includes
iterative processes to monitor and communicate the effectiveness of control activities.

Background
Medical cannabis is derived from the cannabis
plant and has been reported to potentially help
treat some illnesses and symptoms.
Minnesota is one of 33 states that allows
qualifying health care patients the legal access
to medical cannabis. Minnesota law passed in
2014 directed MDH to establish a new medical
cannabis “Patient Registry Program” for this
purpose.1 As part of its duties, MDH must
collect and evaluate data from the program and
report to the Minnesota Legislature the
benefits, risks, and outcomes regarding patients
with a qualifying medical condition engaged in
the therapeutic use of medical cannabis.2

Medical Cannabis:
 Includes any species, mixture, or
preparation of the cannabis plant.
 Is administered in the form of liquid or
pill, vaporized with the use of oil or
liquid, or other form approved by
MDH.
 Does not involve the use of dried
leaves or plant form and may not be
smoked.
— Minnesota Statutes 2019,
152.22, subd. 6(a) 1-4.

1
Laws of Minnesota 2014, chapter 311, codified as Minnesota Statutes 2014, 152.22-152.37. Through the
remainder of this report, we refer to the program as the medical cannabis program.
2

Minnesota Statutes 2019, 152.27, subds. 1(a) and 2(a)(7).

 Minnesota Department of Health – Office of Medical Cannabis

4

Internal controls are particularly important for the state’s
medical cannabis program due to the federal classification of
marijuana as a Schedule I controlled substance and the risk
of its diversion for unauthorized purposes.3 Federal
regulations also prohibit the transport of medical cannabis
across state lines.4 To address these risks, Minnesota
statutes direct MDH to register and oversee two “in-state”
medical cannabis manufacturers in their production and
distribution of medical cannabis.5 The department also
oversees other program participants and functions.

Diversion:
The intentional transfer of
medical cannabis to a
person other than another
registered manufacturer, a
patient, a registered
designated caregiver, or a
registered parent, legal
guardian, or spouse of a
patient.

Roles and Responsibilities

— Minnesota Statutes
2019, 152.33, subd. 1.

Department of Health – Office of Medical Cannabis
The Office of Medical Cannabis (OMC) administers the medical cannabis program.6
Exhibit 1 summarizes key roles and responsibilities for OMC and program participants.
For example, OMC must provide to potential health care practitioners information on
program requirements and the therapeutic use of medical cannabis, allow qualifying
practitioners to participate, and supervise their compliance with patient treatment
requirements.7
OMC also oversees the patient enrollment processes, verifies the eligibility of
designated caregivers for patients, and collects patient registration fees.8 However, the
department may deny a patient who was previously removed from the program for a
qualifying violation or if they provided false information.9
State statutes also direct the department to adopt rules and procedures for the
enforcement of legal requirements for the program.10 For example, OMC must notify
law enforcement whenever there is sufficient cause to believe there is a threat to public
safety, which includes diversion or potential diversion of medical cannabis by any
manufacturer or participant in the program.11 OMC publishes its procedures in its OMC
Regulatory & Enforcement Plan, which outlines controls over program compliance,
enforcement processes, and remedies to resolve and correct any noncompliance by
participants or manufacturers.

3

21 U.S. Code, sec. 812(c) (2011); and Minnesota Rules, 4770.4002, subp. 4, published electronically
June 20, 2016.
4

21 U.S. Code, sec. 841(a) (2019).

5

Minnesota Statutes 2014, 152.25, subd. 1.

6

Minnesota Statutes 2019, 152.27, subd. 1(a). Minnesota Statutes 2019, 152.26, grants the commissioner
the authority to adopt rules to oversee the medical cannabis program.
7

Minnesota Statutes 2019, 152.27, subd. 2(a) (1)-(6).

8

Minnesota Statutes 2019, 152.27, subds. 3 and 4; and 152.35(a).

9

Minnesota Statutes 2019, 152.27, subd. 6.

10

Minnesota Statutes 2019, 152.261.

11

Minnesota Rules, 4770.0300, subp. 2, published electronically June 20, 2016.

 Internal Controls and Compliance Audit

5

Exhibit 1: Medical Cannabis Program, Key Roles and
Responsibilities
Office of Medical Cannabis (OMC)
 Explain program requirements and therapeutic uses of medical cannabis.
 Enroll and oversee health care practitioners providing treatment to participating patients.
 Verify and enroll qualifying patients, designated caregivers, parents, legal guardians, and spouses.
 Collect annual registration fees from patients and registered medical cannabis manufacturers.
 Examine the business and financial affairs, practices, and conditions of the medical cannabis
manufacturers.
Health Care Practitioners (HCP)
 Determine if a patient suffers from a qualifying condition; provide the patient with a certification of
diagnosis.
 Determine whether a patient is disabled and requires assistance to administer or obtain medical cannabis.
 Provide patient’s health records to MDH on an ongoing basis.
Patients
 Complete and submit the application and annual registration fee.
 Agree to receive regular treatment for the qualifying condition from a designated HCP.
 Designate a caregiver (if certified by HCP as disabled and needing assistance to administer or obtain
medical cannabis).
Parents, Legal Guardians, Spouses, and Designated Caregivers
 Agree to possess medical cannabis for the purposes of assisting the patient.
 Undergo a background check by the Bureau of Criminal Apprehension (designated caregivers only).
 Serve as the patient’s registered caregiver to help the patient administer and obtain medical cannabis.
 Notify OMC within 30 days of any change in patient information and within 10 days of a patient’s death.
 Dispose of unused medical cannabis within 10 days of the patient leaving the program.
Registered Medical Cannabis Manufacturers
 Provide a reliable and ongoing supply of medical cannabis for the patients in the Patient Registry Program.
 Cultivate, produce, and distribute medical cannabis in an allowable form within the state.
 Contract with a laboratory to test medical cannabis produced.
 Assign a tracking number to any medical cannabis distributed and ensure accurate record keeping.
 Ensure dispensary pharmacists have a current license issued by the Minnesota Board of Pharmacy.
 Enact security measures to deter and prevent the diversion or theft of medical cannabis.
 Report monthly to OMC any medical cannabis distributed to each patient including the dosages, chemical
composition, and tracking number assigned to the medical cannabis.
Independent Laboratories
 Demonstrate its eligibility to perform required testing.
 Test medical cannabis in the allowed deliverable form for content, contamination, and stability.
SOURCES: Minnesota Statutes 2019, 152.25, subd. 1(e); 152.27; 152.28, subd. 1; 152.29; 152.30; 152.35 (a) and (c);
152.37, subd. 3; Minnesota Rules, 4770.1900, subp. 2, published electronically September 7, 2018; Minnesota Rules,
4770.2700, subp. A, published electronically February 20, 2015; and Minnesota Rules, 4770.4008, subps. A and B,
published electronically July 7, 2015.

 Minnesota Department of Health – Office of Medical Cannabis

6

Program Participants
Health care practitioners, patients, designated caregivers, parents, legal guardians, and
spouses must comply with certain requirements to remain eligible to participate in the
program. For example, health care practitioners determine whether a patient suffers
from a qualifying condition and, if so, provides the patient with a certification annually
of that diagnosis.12 The practitioner also determines and certifies annually whether the
patient is developmentally or physically unable to acquire or self-administer the medical
cannabis and may need a designated caregiver.13
A designated caregiver agrees to possess medical cannabis in order to assist the
patient.14 A designated caregiver must apply to MDH and obtain a background check,
although a parent or legal guardian may serve in this role without having to register as a
caregiver.15 A designated caregiver also must notify OMC within 30 days of any
change in required patient information, provide notice to OMC within 10 days of a
patient’s death, and properly dispose of any unused medical cannabis within 10 days of
the patient leaving the program.16

Medical Cannabis Manufacturers
On December 1, 2014, MDH approved and registered two in-state manufacturers—
LeafLine Labs, LLC, and Minnesota Medical Solutions, LLC—to cultivate, produce,
and dispense medical cannabis within Minnesota. Each manufacturer must provide a
reliable and ongoing supply of medical cannabis for program patients, process any
medical cannabis plant material into an allowable form, and assign a tracking number to
its product prior to its distribution.17 Through their pharmacy dispensaries, each
manufacturer also must ensure that licensed pharmacists verify the identity and
eligibility of patients and designated caregivers, parents, or legal guardians if they are
picking up a prescription for the patient.18
Exhibit 2 illustrates the service regions and locations for these two manufacturers to
dispense medical cannabis in Minnesota, as of July 2019. Each manufacturer was
limited to one manufacturing location and four regions within which it must operate a
dispensary.19

12

Minnesota Statutes 2019, 152.28, subd. 1(a)(1) and (b)(3).

13

Minnesota Statutes 2019, 152.28, subd. 1(a)(2).

14

Minnesota Statutes 2019, 152.27, subd. 4(a)(2).

15

Minnesota Statutes 2019, 152.27, subds. 4(b) and 5.

16

Minnesota Rules, 4770.4008, sec. A, published electronically July 7, 2015.

17

Minnesota Statutes 2019, 152.29, subds. 2 and 3(c)(3).

18

Minnesota Statutes 2019, 152.29, subd. 3(a) and (c)(1) - (2).

19

Minnesota Statutes 2018, 152.29, subd. 1(a). The statute was amended in 2019 to require each
manufacturer to operate eight distribution facilities.

 Internal Controls and Compliance Audit

7

Exhibit 2: Minnesota Medical Cannabis Manufacturers and Dispensary
Locations, by Service Area, July 2019

Moorhead

Hibbing

LeafLine Labs, LLC
Minnesota Medical Solutions

Otsego
Minnesota Medical
Solutions

St. Cloud
Minneapolis
St. Paul
Bloomington
Eagan
Cottage Grove
LeafLine Labs, LLC
Rochester

SOURCE: Office of the Legislative Auditor.

 Minnesota Department of Health – Office of Medical Cannabis

8

Independent Laboratories
Minnesota statutes require that each of the two manufacturers contract with a qualified
laboratory approved by OMC to test their medical cannabis products for various
elements, such as content, contamination, and stability.20 In April 2015, OMC
approved two laboratories—Aspen Research Corporation and Legend Technical
Services, Inc.—and has annually reapproved these entities to test medical cannabis for
the program.

Audit Scope, Objectives, Methodology, and Criteria
We audited MDH’s internal controls and compliance with selected legal requirements
for the medical cannabis program during the period of July 1, 2016, through
December 31, 2018. We focused on the design and implementation of MDH’s internal
controls to (1) ensure that only eligible patients had access to medical cannabis;
(2) collect and safeguard fees from the program; (3) ensure a tested and reliable supply
of medical cannabis; and (4) prevent and timely detect potential diversion of the drug
for unauthorized purposes. Our scope did not include internal controls or legal
compliance by the manufacturers or testing laboratories.

Authorize Program Participants
We designed our work to address the following questions:


Did MDH have adequate controls to verify that enrolled patients, health care
practitioners, parents, legal guardians, and designated caregivers were eligible
to participate in the medical cannabis program?



Did MDH comply with significant legal requirements related to participant
eligibility for the medical cannabis program?

To answer these questions, we interviewed staff from the Office of Medical Cannabis to
understand the enrollment and verification processes for patients, health care
practitioners, parents, legal guardians, and designated caregivers. We reviewed federal
and state laws and rules and MDH policies governing the program. To understand
MDH’s Medical Cannabis Registry (MCR) information system and the process for
recording and reporting the sale of medical cannabis, we interviewed staff and reviewed
information from MDH, LeafLine Labs, and Minnesota Medical Solutions. We also
obtained data from the MCR system and reviewed a sample of 90 patients and 40 health
care practitioners to test the effectiveness of OMC’s internal controls and MCR system
controls to confirm participants’ eligibility for the program.

20

Minnesota Statutes 2019, 152.29, subd. 1(c); and Minnesota Rules, 4770.1900, subps. 2 and 2A,
published electronically September 7, 2018.

 Internal Controls and Compliance Audit

9

Collect and Safeguard Patient Fees
We designed our work to address the following questions:


Did MDH have adequate financial-related controls over the medical cannabis
program?



Did MDH impose the correct patient registration fees and properly secure,
record, and deposit receipts for the medical cannabis program in accordance
with legal and administrative requirements?

To answer these questions, we reviewed Minnesota statutes, Minnesota Management
and Budget operating policies for state agencies, and MDH internal policies and
procedures. We interviewed MDH and OMC staff responsible for processing electronic
and manual financial transactions and fee payments. Using data from the state’s
accounting system (SWIFT) and OMC’s Patient Registry, we performed a
reconciliation of patient registration fees received for the period July 1, 2016, through
December 31, 2018. We also tested a sample of 90 financial transactions to verify how
OMC determines eligibility and applies the patient registration fee.

Ensure a Tested and Reliable Supply of Medical
Cannabis and Prevent and Detect Diversion
We designed our work to address the following questions:


Did MDH have adequate controls to ensure that the manufacturers complied
with significant legal requirements for testing and tracking medical cannabis
and to prevent and detect diversion of the drug?



Did MDH comply with significant legal requirements related to the testing and
distribution of medical cannabis for the program?

To answer these questions, we reviewed federal and state laws and rules governing the
cultivation, production, and distribution of medical cannabis. We also interviewed
representatives from OMC, LeafLine Labs, Minnesota Medical Solutions, and the
independent laboratories that test medical cannabis sold through the program; we also
conducted on-site visits of these facilities. To understand the processes for tracking,
recording, and reporting the sale of medical cannabis, we interviewed staff, reviewed
information, and analyzed data from MDH and the medical cannabis manufacturers.
To understand the internal controls to prevent and detect diversion, we observed OMC
staff conduct an unannounced inspection at each of the manufacturers and, as part of
this inspection, inventoried their product to test the manufacturer’s compliance with
OMC and legal requirements. We also reviewed certain documents and reports
required in law regarding the tracking of medical cannabis produced and sold under the
program. Finally, we reviewed any compliance actions OMC conducted during the
audit period and compared OMC enforcement actions to its internal control procedures
for oversight of the manufacturers.

 Minnesota Department of Health – Office of Medical Cannabis

10

We conducted this performance audit in accordance with generally accepted
government auditing standards.21 Those standards require that we plan and perform the
audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that the evidence
obtained provides a reasonable basis for our findings and conclusions based on our
audit objectives.
We assessed internal controls against the most recent edition of the internal control
standards, published by the U.S. Government Accountability Office.22 To identify legal
compliance criteria for the activity we reviewed, we typically examine state and federal
laws, state administrative rules, state contracts, and policies and procedures established
by the departments of Management and Budget and Administration.

21
Comptroller General of the United States, Government Accountability Office, Government Auditing
Standards (Washington, DC, December 2011).
22

Comptroller General of the United States, Government Accountability Office, Standards for Internal
Control in the Federal Government (Washington, DC, September 2014). In September 2014, the State of
Minnesota adopted these standards as its internal control framework for the executive branch.

 Internal Controls and Compliance Audit

11

Authorize Program Participants
The Minnesota Department of Health’s Office of Medical Cannabis (OMC) must enroll
health care practitioners and verify that individuals are qualified to participate in the
medical cannabis program.23 These processes help prevent unauthorized access to
medical cannabis or diversion of the drug for other purposes.
We concluded that the department had generally adequate controls to authorize
participants for the program, but found exceptions in its processes to verify (1) that
participating health care practitioners had valid licenses after their initial enrollment,
and (2) the relationship of a parent or legal guardian with the patient.

Verify Health Care Practitioner License
The Office of Medical Cannabis validates that a physician, physician’s assistant, or
advanced practice registered nurse may participate in the program.24 Specifically, OMC
requires each practitioner to provide background information and a valid medical
license number so that OMC staff can verify the data with the Minnesota Board of
Medical Practice or respective licensing board.
FINDING 1
The Minnesota Department of Health did not verify for all new patients
that the license of their health care practitioner was active and in good
standing.
MDH lacked adequate processes to approve health care practitioners for the program
because OMC staff only reviewed a practitioner’s medical license upon initial
application. OMC staff told us that they do not reverify this information when the
department enrolls a new patient for the same practitioner or upon annual patient
renewal. This initial, one-time license review is not sufficient to identify health care
practitioners whose licenses subsequently expired or lapsed. An OMC representative
told us that staff do periodically review reports of disciplinary actions from each of the
licensing boards and inactivate practitioners whose licenses are restricted to prevent
their future participation in the program. However, Minnesota rules do not require
health care practitioners to notify the department of a change in license status, further
compounding the risk.

23

Minnesota Statutes 2019, 152.27, subds. 2(a) and 3-6; and Minnesota Department of Health, Office of
Medical Cannabis, OMC Regulation-Enforcement Plan, v1.3, April 2018, 38.
Minnesota Rules, 4770.4014, subp. 1(A), published electronically June 20, 2016, requires that, “The
commissioner must accept written certifications for the therapeutic use of medical cannabis only from
health care practitioners who hold…an active license, in good standing….”

24

 Minnesota Department of Health – Office of Medical Cannabis

12

We examined OMC’s process to verify a health care practitioner’s license and found
that, for 2 of 40 samples (5 percent) of participating practitioners listed as active in the
OMC registry, the information in the OMC registry did not align with information in
the licensing board.25 For one of these samples, the practitioner’s license was expired
and inactivated by the licensing board after OMC’s initial approval.26 For the other
sample, the incorrect license number was entered into OMC’s registry and did not
match the name of the practitioner. Despite this discrepancy, it appeared that OMC
approved the correct practitioner for the program.

RECOMMENDATIONS
The Minnesota Department of Health should:


Verify that a health care practitioner’s license is active and in good
standing when the department approves a new patient for the medical
cannabis program, as required by state statute.



Amend the Minnesota Department of Health’s rules to require a health
care practitioner to notify the department of a change in license status or
when discontinuing care for patients in the program.

Validate Caregiver Relationship with Patient
State statutes and MDH rules require a caregiver to provide MDH with assurances of
their qualifications so that MDH may approve their enrollment in the program.27 For
example, a parent or legal guardian of a patient must provide proof of their identity and
relationship to the patient to MDH.28
FINDING 2
The Minnesota Department of Health did not keep valid documentation of
the eligibility of parents or legal guardians for the medical cannabis
program.
MDH lacks adequate controls to confirm the eligibility of parents or legal guardians for
the medical cannabis program due to system limitations within the Medical Cannabis
25

We tested the licenses of 40 of 852 health care practitioners who were enrolled in the medical cannabis
program and were listed in the OMC patient registry as having active licenses in good standing.
26

The one sample practitioner whose license had expired was no longer treating medical cannabis patients.

27

Minnesota Statutes 2019, 152.27, subds. 4 and 5; and Minnesota Rules, 4770.4007, subp. 1, published
electronically July 7, 2015. Minnesota statutes were amended in 2019 to allow an eligible spouse to act as
a caregiver.
28

Minnesota Department of Health, OMC Regulation-Enforcement Plan, 42. Minnesota Rules,
4007.4005, subp. 1(B), published electronically July 7, 2015, requires that, if a patient is a minor, a parent
or legal guardian must provide proof of their Minnesota residency.

 Internal Controls and Compliance Audit

13

Registry and weak OMC documentation standards. Specifically, the patient registry can
hold only two documents for this verification task. If a parent or legal guardian uploads
a third document into the system, the registry will remove the oldest document and
replace it with the new document. The registry also does not have an event log to
record documents previously loaded into the system.
We examined OMC’s verification of parents and legal guardians and, for 4 out of 25
sample cases (16 percent) that we tested, we could not verify that OMC obtained valid
documents to confirm a relationship between the caregiver and the patient.29 For the
samples we tested, a parent or legal guardian may have provided the required
documents. However, neither we nor OMC staff could confirm whether the evidence
was received, adequate, or required follow-up.
Failure to request and keep appropriate documents that establish the parent or legal
guardian relationship with a patient could allow for unauthorized access or diversion of
medical cannabis.

RECOMMENDATIONS
The Minnesota Department of Health should:


Comply with department policy and ensure that a parent or a legal
guardian provides valid, original documents that establish the
relationship with the patient.



Continue to work with Minnesota IT Services to improve the storage
capacity of the Medical Cannabis Registry.

We tested OMC’s verification for 25 of a total 2,036 parents and legal guardians who were enrolled in
the medical cannabis program.
29

  

Internal Controls and Compliance Audit

15

Collect and Safeguard Patient Fees
In Fiscal Year 2019, MDH expenditures for the medical cannabis program totaled about
$1.57 million, as shown in Exhibit 3. The medical cannabis program is supported
through appropriations and also fees paid by manufacturers and patients, which are
deposited into the state’s special revenue fund.30 Patients must pay an initial enrollment
and annual fee, and the two manufacturers must pay fees that help cover the cost of
MDH oversight and inspections. During fiscal years 2017 through 2019, 22,819
patients were enrolled in the program.
We found that OMC did not collect the correct fee amounts from some patients and did
not have adequate controls over the processing and reconciliation of fee payments.

Exhibit 3: Total Medical Cannabis Program Patients,
Revenues, Appropriations, and Expenditures, Fiscal Years
2017-2019
Program

2017

Total Patients

Fiscal Years
2018

2019

Total

6,184

10,738

17,202

22,819a

Fee Revenuesb
Patient Registration Fee
Manufacturer Regulatory Fees
Total Revenues

$ 802,500
387,000
$1,189,250

$1,414,500
294,010
$1,708,510

$2,168,451
292,000
$2,460,451

$4,385,201
973,010
$5,358,211

Total General Fund and Special
Revenue Fund Appropriations to MDH

$1,437,000

$1,907,000

$1,922,000

$5,266,000

Program Expenditures
Payroll
Purchased Services
All Other Expenditures
Total Expenditures

$ 990,301
243,800
176,593
$1,410,693

$1,042,956
418,471
222,115
$1,683,542

$1,078,089
273,245
219,973
$1,571,307

$3,111,346
935,516
618,680
$4,665,543

a Total

represents an unduplicated count of patients for all fiscal years 2017 through 2019. Some patients were enrolled in
more than one year and, thus, total does not represent a sum of all years.
b Patient

registration and manufacturer regulatory fees are deposited into the state treasury and credited to the state
government special revenue fund.
SOURCE: State of Minnesota accounting system (SWIFT).

30

Minnesota Statutes 2019, 152.35 (a) and (c).

 Minnesota Department of Health – Office of Medical Cannabis

16

Collect Correct Fee Amounts
State statutes define fee rates that MDH must collect from patients for the medical
cannabis program. Most patients must pay a $200 enrollment fee, however, the fee is
reduced to $50 if the patient receives Social Security disability or Supplemental
Security Insurance payments or is enrolled in medical assistance or MinnesotaCare.31

FINDING 3
The Minnesota Department of Health charged some medical cannabis
patients a lower registration fee than permitted in state statutes.
MDH extended the $50 reduced fee to patients who met criteria not defined in state
statutes, including disabled veterans or enrollees in the federal Civilian Health and
Medical Program of the Department of Veterans Affairs (CHAMPVA).32 We examined
OMC’s collection of patient enrollment fees and found that OMC incorrectly charged
the reduced $50 fee for 25 of 28 sample payments from patients who OMC identified as
a disabled veteran. We estimated that these types of fee rate errors resulted in about
$136,800 in lost revenue for the period July 1, 2016, through December 31, 2018.
We also tested the registration fees for all patients who paid by cash and check and
found that, for 2 of 40 patient samples (5 percent), OMC incorrectly charged the $50
reduced fee rather than the required $200 fee.33 These two patients had reached full
retirement age and received Social Security retirement benefits (a status not eligible for
the reduced fee) and, thus, were no longer entitled to Social Security disability.
For purposes of the medical cannabis program and patient enrollment fees, Minnesota
statutes do not give MDH authority to add other qualifying criteria or assistance
programs or otherwise revise the fee schedule.

RECOMMENDATIONS


The Minnesota Department of Health should comply with state statutes
and collect the correct fees from patients in the medical cannabis program.



The Legislature should consider whether disabled patients who receive
Social Security retirement benefits should pay a reduced medical
cannabis fee and amend state statutes accordingly.

31

Minnesota Statutes 2019, Chapter 152.35 (a).

32
Minnesota Statutes 2019, 152.35 (a). OMC staff told us they believe disabled veterans meet the criteria
“enrolled in medical assistance or MinnesotaCare” and are eligible for reduced fees.
33

We tested the registration fees of 40 of all 763 patients who paid a reduced fee between July 1, 2016,
and December 31, 2018.

 Internal Controls and Compliance Audit

17

Safeguard Registration Fees
Some medical cannabis patients are unable to complete their applications electronically
online and, instead, submit a paper application and pay the registration fee using a
check or cash. OMC staff must then manually transfer information into the registry and
process the payments.
In November 2017, the Minnesota Department of Health conducted an agency-wide
internal audit for fee receipts, the results of which included findings on OMC’s policies
and processing of fee payments. As part of OLA’s audit work, we followed up on the
MDH audit findings.

FINDING 4
The Minnesota Department of Health did not adequately reconcile some
medical cannabis patient fees or ensure employee separation of duties when
handling these payments.
MDH did not resolve prior audit findings regarding weaknesses in internal controls over
fee collections. For our audit period, OMC was unable to fully reconcile fee revenue
between the program’s internal accounting records and the state’s accounting system.34
This inability to reconcile fees was due to technical limitations in the Payment Registry,
which only has functionality to record electronic payments. For patient registration fees
paid by cash or check—totaling $151,000 during our audit scope—OMC reconciled fee
revenue within their accounting records but did not verify payments against records in
the Patient Registry. Reconciling deposits in the state treasury to the detailed patient
accounting records is a key control to detect errors and irregularities.
OMC also did not resolve separation of duties issues that were reported by MDH
auditors. OMC staff told us that, as a small office, turnover and keeping sufficient
staffing is a struggle, and sometimes employees must fill multiple roles.
Minnesota Management and Budget policy directs state agencies to avoid the practice
of assigning an employee multiple payment processing roles and to perform monthly
reconciliations of receipts.35

RECOMMENDATION
The Minnesota Department of Health should comply with state policy and
perform monthly reconciliations and ensure separation of employee duties
when registering patients and processing fee payments for the medical
cannabis program.

We performed a reconciliation between OMC’s check log and SWIFT and found that the overall
monetary amounts materially matched (noting a $52 difference) for the period we reviewed.
34

MMB Statewide Operating Policy 0602-01 states, “Agencies must develop internal policies and
procedures to ensure that receipts are properly safeguarded, deposited and recorded in the state’s
accounting system…and that adequate separation of duties exists.”
35

  

Internal Controls and Compliance Audit

19

Tested and Reliable Supply of
Medical Cannabis
The Office of Medical Cannabis oversees the two manufacturers approved to cultivate,
produce, and distribute medical cannabis for Minnesota’s program. We examined the
processes, inventory systems, and reporting requirements for manufacturers to
accurately record the production, testing, and sale of medical cannabis.
We concluded that OMC did not have adequate controls to (1) ensure medical cannabis
was tested by a laboratory before manufacturers dispensed it to patients, and (2) timely
detect diversion of the drug.

Contract with a Laboratory
MDH must ensure that each of the two registered manufacturers has a contract with an
approved independent laboratory to test medical cannabis for content, contamination,
and stability.36 The manufacturers also must provide a reliable and ongoing supply of
medical cannabis needed for the program.37
FINDING 5
The Minnesota Department of Health did not ensure that each of the two
medical cannabis manufacturers had a formal contract with a testing
laboratory.
In April 2015, MDH approved two laboratories—Aspen Research Corporation and
Legend Technical Services, Inc.—and has annually reapproved these entities to test
medical cannabis for the program. These entities have performed such testing.
However, Minnesota Medical Solutions did not have a formal contract with either
laboratory until July 2018, and LeafLine Labs did not have a formal contract until May
2019, after we began our audit. OMC did not sanction either of the manufacturers for
their lack of compliance with this legal requirement.38
In response to our inquiries regarding the lack of formal contracts, representatives from
OMC, manufacturers, and laboratories told us that a formal contract for these testing

36

Minnesota Statutes 2019, 152.25, subd. 1(e); and 152.29, subd. 1(c).

37

Minnesota Statutes 2019, 152.29, subd. 2.

Minnesota Statutes 2019, 152.25, subd. 1b, states that, “The commissioner may institute proceedings to
temporarily suspend the registration of a medical cannabis manufacturer…if any action by…[the]
manufacturer violates” statutory or regulatory requirements of the program. Minnesota Statutes 2019,
152.33, subd. 6, states that “a manufacturer shall be fined up to $1,000 for any violation” related to the
statutory or regulatory requirements under the program.
38

 Minnesota Department of Health – Office of Medical Cannabis

20

services is unusual, and they instead rely on the laboratories’ “chain of custody” testing
forms for this purpose.
Testing the medical cannabis helps identify contaminants and ensures that the end
product contains the appropriate dosage as prescribed by a pharmacist for a patient.
The lack of a formal written contract and vague legal requirements impede the state’s
ability to hold manufacturers accountable for insufficient testing and take corrective
action, if merited, for adverse reactions by patients who use medical cannabis dispensed
through the program.39

RECOMMENDATION
The Minnesota Department Health should comply with state statutes and
ensure that each of the registered manufacturers maintains a contract with
an independent laboratory for purposes of testing medical cannabis.

Track the Testing and Sale of Medical Cannabis
Each medical cannabis manufacturer must assign and report to OMC unique identifying
numbers of its product to help facilitate inventory tracking of medical cannabis from its
cultivation through production, testing, and sale to a patient.40 For example, each
manufacturer must submit a monthly report to OMC that includes information about
medical cannabis that was distributed to each patient, including the amount, dosage,
chemical composition, and the tracking number assigned to the drug.41 A tracking
number helps ensure a product has been adequately tested prior to dispensing, allows
for follow-up in the event of a patient’s adverse drug reaction, and facilitates inventory
accounting to prevent and detect diversion of medical cannabis for illegal purposes.
FINDING 6
The Minnesota Department of Health did not have adequate controls to
ensure manufacturers accurately tracked and tested medical cannabis
prior to sale.
Unlike medical cannabis programs in some other states, Minnesota does not use a single
“seed-to-sale” reporting and inventory system that identifies and tracks a medical
cannabis product from the point of cultivation through testing and sale to a patient.
Instead, Minnesota relies on multiple reporting and recordkeeping mechanisms to track
medical cannabis products.

39

Minnesota Statutes 2019, 152.25, subd. 1(e); and 152.29, subd. 1(c), do not require the manufacturer or
the laboratory to notify OMC if they alter their contract.
40

Minnesota Statutes 2019, 152.29, subd. 4(c); and Minnesota Rules, 4770.1700, subp. 1(H) (J), published
electronically June 20, 2016, which requires that at the time of planting, all plants must be tracked in a
batch process with a unique batch number that must remain with the batch through final packaging. The
batch number must be displayed on the label of the medical cannabis.
41

Minnesota Statutes 2019, 152.29, subd. 4(c).

 Internal Controls and Compliance Audit

21

We found that we—and OMC—could not independently track and verify in the
Medical Cannabis Registry that a medical cannabis product was tested prior to its sale,
for several key reasons. First, the medical cannabis program relies on different
information systems used by OMC, the manufacturers, and the laboratories. Second,
the manufacturers do not assign and use a single unique identifier to track a specific
medical cannabis product from cultivation through testing and point of sale. Third,
OMC does not collect complete inventory data from the manufacturers and laboratories
and does not verify whether the data are accurate.42 Lastly, we found data entry errors
and omissions in the Medical Cannabis Registry. 43
We also tested whether we could better track medical cannabis with more data from the
manufacturers. We obtained directly from LeafLine Labs and Minnesota Medical
Solutions (MMS) more detailed records and information that are not otherwise reported
to OMC. For LeafLine Labs, we were able to verify that its medical cannabis was
tested prior to sale, using the additional data. However, we were still unable to trace all
of Minnesota Medical Solutions’ product and verify that it was tested prior to its sale
because of Minnesota Medical Solutions’ data entry errors in its own tracking system,
LeafLogix.44
Compliance with state reporting requirements and effective internal controls over the
medical cannabis seed-to-sale process is important. In May 2017, OMC issued a
revised administrative penalty order in the amount of $1,000 to Minnesota Medical
Solutions for dispensing medical cannabis that had not passed potency testing at an
MDH-approved independent laboratory prior to sale.45 OMC made this finding as a
result of an investigation initiated from a patient who reported they had used and
experienced an adverse reaction from MMS’s product.

42

Minnesota Statutes 2019, 152.29, subd. 4, requires that, for each patient, each manufacturer must report
on a monthly basis (1) the amount and dosages of medical cannabis distributed; (2) the chemical
composition of the medical cannabis; and (3) the tracking number assigned to any medical cannabis
distributed. However, OMC staff told us that they directed each of the manufacturers to exclude patient
identifiers and medical cannabis tracking numbers from their monthly reports to OMC.
In particular, the data in the Medical Cannabis Registry (specifically, the tracking number and “lot ID”)
used by OMC are not reliable for tracking purposes. In many instances, the lot ID or the tracking number
assigned to sold medical cannabis was missing or did not align with a manufacturer’s own naming
protocols.
43

44

Minnesota Medical Solutions used one tracking number to monitor its own medical cannabis
production and a different identifier for prescriptions recorded in the Medical Cannabis Registry. Within
Minnesota Medical Solutions’ own tracking system—LeafLogix—the assigned tracking number did not
follow MMS’s own naming protocols in 94 out of 665 instances, for a 14 percent exception rate.
45

Michelle Larson, Director, Office of Medical Cannabis, Minnesota Department of Health, letter to Kyle
Kingsley, Chief Executive Officer, Minnesota Medical Solutions, LLC (aka Vireo Health), May 30, 2017,
Administrative Penalty Order.

 Minnesota Department of Health – Office of Medical Cannabis

22

RECOMMENDATIONS
The Minnesota Department of Health should improve its internal controls
over the tracking and testing of medical cannabis. Specifically, the
Minnesota Department of Health should:


Require accurate and complete reporting of tracking numbers for the
cultivation, production, testing, and sale of any medical cannabis.



Routinely review the Medical Cannabis Registry data for accuracy and
completeness.



Continue to work with Minnesota IT Services and the manufacturers to
modernize the Medical Cannabis Registry system and reporting process
to ensure more accurate seed-to-sale recordkeeping.

Detect Diversion
As part of MDH’s oversight of the medical cannabis manufacturers, OMC staff conduct
unannounced inspections of their facilities to review their recordkeeping, inventory, and
premises.46 The department also may examine the manufacturers’ business and
financial affairs, practices, and conditions of the entities, and may enlist subject matter
experts—such as experts in security controls—for this purpose.47 MDH oversight helps
ensure that the two approved manufacturers comply with legal requirements to provide
a reliable and ongoing supply of medical cannabis and have controls to help prevent and
detect diversion of the drug from the program.48

FINDING 7
The Minnesota Department of Health did not have adequate controls to help
prevent and timely detect diversion or loss of medical cannabis by a
manufacturer.
OMC did not require an independent examination of either manufacturer until March
2018, nearly three years after they began selling medical cannabis to patients. At that
time, OMC contracted with a certified public accountant to examine Minnesota Medical
Solutions’ production operations, including inventory control measures, regulatory
compliance, physical and data security, and other activities. At the time of our audit,
OMC had yet to conduct an independent examination of LeafLine Labs.
Independent examinations can identify potential risks and help MDH inspectors target
areas to monitor compliance with legal requirements. Had there been more rigorous
oversight of manufacturers’ compliance, OMC may have been able to detect a serious
46

Minnesota Statutes 2019, 152.29, subd. 1(h).

47

Minnesota Statutes 2019, 152.37, subd. 3.

48

Minnesota Rules, 4770.1800, subp. 1, electronically published February 20, 2015.

 Internal Controls and Compliance Audit

23

compliance issue that occurred at Minnesota Medical Solutions. Specifically, OMC
was notified in mid-2016 that two Minnesota Medical Solutions’ officers had
transported the product across state lines to New York in December 2015. These
individuals subsequently left Minnesota Medical Solutions. In February 2017, a Wright
County prosecutor charged the two MMS officers with intentionally transferring
medical cannabis to a person other than allowed by law.49 In September 2019, a Wright
County judge approved an agreement that the Wright County Attorney’s Office would
dismiss the charges if each of the individuals completed one year of unsupervised
probation and performed 80 hours of community service.50
In response to these events, OMC staff told us that they would have better, ongoing
insight into the manufacturers’ production and inventory if Minnesota’s medical
cannabis program utilized a single, state-centralized seed-to-sale track and trace
inventory system. As we noted in the previous section, we observed deficiencies in the
way medical cannabis products and testing are recorded and tracked for the program. A
state-centralized system could provide more timely access to manufacturers’ inventory
records and other business information, enhance product recall capabilities, and help
track the reasons that plants get removed from inventory.
OMC representatives also told us that they have recently expanded their oversight of the
manufacturers in response to changes in state law.51 The 2019 Legislature amended the
state’s Health Enforcement Consolidation Act—an initiative to promote compliance,
deterrence, and effective enforcement—to include the medical cannabis program. The
statutory change allows MDH wider discretion in the enforcement of legal requirements
and use of administrative penalties for noncompliance.

RECOMMENDATION
The Minnesota Department of Health should conduct more frequent
examinations of the medical cannabis manufacturers that include a review of
their internal controls to prevent and detect diversion, theft, or loss of
medical cannabis in a timely manner.

49
State v. Bultman, No. 86-CR-17-499 (10th Dist. Wright County, Feb. 6, 2017) (complaint); State v.
Owens, No. 86-CR-17-500 (10th Dist. Wright County, Feb. 6, 2017) (complaint). The Wright County
prosecutor charged Minnesota Medical Solutions’ chief security officer and chief medical officer with
intentionally transferring medical cannabis to a person other than allowed by law, in violation of
Minnesota Statutes 2017, 152.33, subd. 1. According to the complaints, the defendants transferred
5.6 kilograms of concentrated cannabis oil from Minnesota Medical Solutions to Vireo Health, a
Minnesota Medical Solutions-owned business located in New York.
50

Bultman, No. 86-CR-17-499 (10th Dist. Wright County, Sept. 26, 2019) (unpublished order); Owens,
No. 86-CR-17-500 (10th Dist. Wright County, Sept. 26, 2019) (unpublished order). As part of this case,
the judge asked the Minnesota Court of Appeals to decide whether sister wholly owned subsidiaries of the
same parent company are one “person,” so that a transfer of cannabis oil from one subsidiary to the other
cannot violate Minnesota Statutes 2017, 152.33, subd. 1. The appellate court ruled no. The panel held
that sister wholly owned subsidiaries of the same parent corporation are separate “persons” under the plain
language of Minnesota Statutes 2017, 152.33, subd. 1. State v. Owens, 930 N.W.2d 1, 7 (Minn. Ct. App.
2019), review denied (Aug. 6, 2019).
51

See Minnesota Statutes 2019, 144.989- 144.993; and Laws of Minnesota 2019, First Special Session,
chapter 9, art. 11, sec. 37, codified as Minnesota Statutes 2019, 144.99, subd. 1.

  

Internal Controls and Compliance Audit

25

List of Recommendations


The Minnesota Department of Health should verify that a health care practitioner’s
license is active and in good standing when the department approves a new patient
for the medical cannabis program, as required by state statute. (p. 12)



The Minnesota Department of Health should amend the Minnesota Department of
Health’s rules to require a health care practitioner to notify the department of a
change in license status or when discontinuing care for patients in the program.
(p. 12)



The Minnesota Department of Health should comply with department policy and
ensure that a parent or a legal guardian provides valid, original documents that
establish the relationship with the patient. (p. 13)



The Minnesota Department of Health should continue to work with Minnesota IT
Services to improve the storage capacity of the Medical Cannabis Registry. (p. 13)



The Minnesota Department of Health should comply with state statutes and collect
the correct fees from patients in the medical cannabis program. (p. 16)



The Legislature should consider whether disabled patients who receive Social
Security retirement benefits should pay a reduced medical cannabis fee and amend
state statutes accordingly. (p. 16)



The Minnesota Department of Health should comply with state policy and perform
monthly reconciliations and ensure separation of employee duties when registering
patients and processing fee payments for the medical cannabis program. (p. 17)



The Minnesota Department Health should comply with state statutes and ensure that
each of the registered manufacturers maintains a contract with an independent
laboratory for purposes of testing medical cannabis. (p. 20)



The Minnesota Department of Health should improve its internal controls over the
tracking and testing of medical cannabis. Specifically, the Minnesota Department
of Health should:





Require accurate and complete reporting of tracking numbers for the cultivation,
production, testing, and sale of any medical cannabis.



Routinely review the Medical Cannabis Registry data for accuracy and
completeness.



Continue to work with Minnesota IT Services and the manufacturers to
modernize the Medical Cannabis Registry system and reporting process to
ensure more accurate seed-to-sale recordkeeping. (p. 22)

The Minnesota Department of Health should conduct more frequent examinations
of the medical cannabis manufacturers that include a review of their internal
controls to prevent and detect diversion, theft, or loss of medical cannabis in a
timely manner. (p. 23)

  

Protecting, Maintaining and Improving the Health of All Minnesotans

January 8, 2020
James Nobles
Office of the Legislative Auditor
140 Centennial Building
658 Cedar Street
St. Paul, MN 55155
Dear Mr. Nobles:
Thank you for the opportunity to review and comment on the findings and recommendations from the
recent audit of the Office of Medical Cannabis for the time period July 2016 through December 2018.
We appreciate and value the professional review conducted by the audit staff.
The department takes its responsibility to ensure adequate internal controls over the medical cannabis
program seriously and has provided a detailed response to each finding below. While the purpose of the
audit is to focus on specific finance-related legal requirements and internal controls and not to consider
the overall structure or environment in which the program operates, it is important to offer a few points
of context before responding to each finding.
The Office of Medical Cannabis (OMC) is a relatively new program. The law establishing this program
was passed in the 2014 legislative session and the program served its first patients in 2015. When the
OMC was first established, Minnesota was one of only a few states with legalized cannabis for medical
purposes. While there are now 33 states where medical cannabis is legal, the regulation of medical
cannabis in Minnesota and across the country is still in its early stages of development. Consequently,
there have been very few established best practices to draw on.
At the same time, OMC is regulating an industry that continues to evolve rapidly and our program
continues to expand. The report notes that each manufacturer is limited to one patient center in each of
four regions. The 2019 legislature passed a law to double the number of patient centers permitted in the
program. OMC anticipates new centers to begin serving patients in 2020.
Finally, the program by its very design presents regulatory challenges. For example, the law requires a
vertically integrated system limited to two companies that each cultivate, process, and dispense medical
cannabis. The current model puts the state at risk if we were to lose a manufacturer due to regulatory
action or other factors. One manufacturer could not adequately serve the existing patient population.
We must consider these challenges with each regulatory action we take.
The following statements describe the corrective actions already taken or that will be taken to address
the findings and recommendations in your audit report.

An equal opportunity employer.

 Finding #1
The Minnesota Department of Health did not verify for all new patients that the license of a health care
practitioner was active and in good standing.
Recommendation
The Minnesota Department of Health should verify that a health care practitioner’s license is active and
in good standing when the department approves a new patient for the medical cannabis program, as
required by state statute.
Response
The department agrees with this finding but only partially agrees with the recommendation. MDH
currently verifies practitioners are active and in good standing when the practitioner enrolls in our
program. We also verify the practitioner is enrolled and was verified when a patient enrolls in our
program. Verifying the practitioner more frequently than once per quarter would not improve controls
substantially, since the Board of Medical Practice takes actions only once per quarter.
What the audit found is that one practitioner had retired and their license had become inactive after
OMC’s initial verification, and another practitioner had entered their license number incorrectly. To
address the issue where a practitioner’s status may change, OMC will, on a quarterly basis beginning
April 2020, request a list of inactive doctors, physician’s assistants, and Advanced Practice Registered
Nurses (APRNs) from the Board of Medical Practice since the last request and query the Registry for
matches. If a match is found, OMC staff will manually inactivate the health care practitioner in the
system.
To address transcription issues, OMC will provide training to call center staff, by March 2020, to catch
application discrepancies upon initial approval.
Person Responsible: Megan Thompson, Operations Supervisor
Recommendation
The Minnesota Department of Health should amend the Minnesota Department of Health’s rules to
require a health care practitioner to notify the department of a change in license status or when
discontinuing care for patients in the program.
Response
The department agrees with this finding and recommendation and will amend the administrative rules
to reflect this change by June 30, 2020.
Person Responsible: Chris Tholkes, Acting Director Office of Medical Cannabis
Finding #2
The Minnesota Department of Health did not keep valid documentation of the eligibility of parents or
legal guardians for the medical cannabis program.

2

 Recommendation
The Minnesota Department of Health should comply with department policy and ensure that a parent or
legal guardian provides valid, original documents that establish the relationship with the patient.
Response
The department agrees with this finding and recommendation, and is currently complying with our
policy but lacks the controls within our registry system to maintain the documentation. The department
currently requests and verifies documentation demonstrating the parent or legal guardian relationship
to the patient during the initial review process. However, OMC staff has identified major technology
limitations with our registry--it will only maintain two documents at a time and does not create an event
log when documents are added. If the patient uploads a new document, the initial document is lost.
MNIT staff have developed a solution to this deficiency and are prepared to deploy the change by March
30, 2020. OMC staff are reviewing the solution and to determine its workability.
Person Responsible: Megan Thompson, Operations Supervisor
Recommendation
The Minnesota Department of Health should continue to work with the Minnesota IT Services to
improve the storage capacity to the Medical Cannabis Registry.
Response
The department agrees with this finding and recommendation. MNIT staff have developed a solution to
this deficiency and are prepared to deploy the change by March 30, 2020. OMC staff are reviewing the
solution to determine its workability.
Person Responsible: Chris Tholkes, Acting Director Office of Medical Cannabis and Robert Maki, Chief
Business Technology Officer
Finding #3
The Minnesota Department of Health charged some medical cannabis patients a lower registration fee
than permitted in state statutes.
Recommendation
The Minnesota Department of Health should comply with state statutes and collect the correct fees
from patients in the medical cannabis program.
Response
The department has interpreted statute differently than the Office of the Legislative Auditor. The
department will work with the Governor and Legislature to clarify who is eligible for the reduced fee.
OMC staff will implement any changes needed to comply with legislative intent. Until then, OMC will
continue charging fees based on our interpretation—that disabled veterans receiving Civilian Health and
Medical Program of the Department of Veterans Affairs (CHAMPVA), and disabled seniors who had
received Social Security Disability Insurance and have transitioned to Social Security retirement benefits
are both eligible for the reduced fee. The department anticipates this issue to be resolved after the
legislative session ends and can notify patients of changes, if needed with an estimated completion date
of June 30, 2020.

3

 Person Responsible: Chris Tholkes, Acting Director Office of Medical Cannabis
Recommendation
The Legislature should consider whether disabled patients who receive Social Security Retirement
benefits should pay a reduced medical cannabis fee and amend state statutes accordingly.
Response
The department agrees with this finding and recommendation and is ready to work with the legislature
to address the issue in the 2020 legislative session.
Person Responsible: Chris Tholkes, Acting Director Office of Medical Cannabis
Finding #4
The Minnesota Department of Health did not adequately reconcile some medical cannabis patient fees
or ensure employee separation of duties when handling these payments.
Recommendation
The Minnesota Department of Health should comply with state policy and perform monthly
reconciliations and ensure separation of employee duties when registering patients and processing fee
payments for the medical cannabis program.
Response
The department agrees with this finding and recommendation. To conduct a full three-way financial
reconciliation, our existing patient registry system would need to be modified in order to log and report
non-electronic payments to allow department staff to see individual payment records. OMC staff will
work with MNIT Services to determine if there is a way to modify our existing system, or if need be
upgrade our registry to address this issue. OMC has been working with MNIT to identify solutions that
will expand and enhance our ability to track the many aspects of our program documentation. If new
functionality is needed, it could take several years to issue a Request for Proposal (RFP), and implement
new software. In that scenario, the estimated completion date would be July 2022.
To accommodate the needed separation of duties, OMC took an interim step in May 2019 to lock the
deposits workbook and limit access to two staff, neither of whom can approve patients in the registry.
Given the size of the OMC staff (12, half of whom are call center staff), OMC will work with other MDH
divisions to provide needed staff support to meet the MMB standards related to separation of duties.
OMC should have the backup support staff identified and trained by July 1, 2020.
Person Responsible: Chris Tholkes, Acting Director Office of Medical Cannabis and Robert Maki, Chief
Business Technology Officer
Finding #5
The Minnesota Department of Health did not ensure that each of the two medical cannabis
manufacturers had a formal contract with a testing laboratory.

4

 Recommendation
The Minnesota Department of Health should comply with state statutes and ensure that each of the
registered manufacturers maintains a contract with an independent laboratory for purposes of testing
medical cannabis.
Response
The department agrees with this finding and recommendation and is currently in compliance. Each
manufacturer currently holds a formal contract with a testing laboratory. Minnesota Medical Solutions
executed a formal contract with a laboratory in July 2018, and LeafLine Labs executed a formal contract
in May 2019. During each manufacturer renewal process, the department will confirm that each
registered manufacturer continues to hold a valid contract with independent laboratories for purposes
of testing medical cannabis. The December 2019 renewal process confirmed that both manufactures
had contracts. The department considers this recommendation complete.
Person Responsible: Megan Thompson, Operations Supervisor
Finding #6
The Minnesota Department of Health did not have adequate controls to ensure manufacturers
accurately tracked and tested medical cannabis prior to sale.
Recommendation
The Minnesota Department of Health should improve its internal controls over the tracking and testing
of medical cannabis. Specifically, the Minnesota Department of Health should require accurate and
complete reporting of tracking numbers for the cultivation, production, testing, and sale of any medical
cannabis.
Response
The department agrees with this finding and recommendation. OMC’s current controls to track the
manufacturer’s product are manual and paper-based. A state-centralized seed-to-sale system would
significantly improve our controls. OMC would need additional resources to acquire and implement this
IT solution.
In December 2019, as a temporary measure until seed-to-sale software can be acquired, the
manufacturer registration agreements were renewed including a provision that each manufacturer
provide read-only access to OMC of the manufacturer’s seed-to-sale system to monitor for activity
suspect of diversion, inversion or lack of inventory control. Having read-only access does have
limitations, but is a step forward in tracking and monitoring cultivation, processing, testing, and sale of
medical cannabis.
In a future legislative session, the department will seek funding and technology solutions to review and
revise our internal controls and systems; including a state-centralized seed-to-sale system, which the
program currently does not have.
Person Responsible: Chris Tholkes, Acting Director Office of Medical Cannabis

5

 Recommendation
The Minnesota Department of Health should routinely review the Medical Cannabis Registry data for
accuracy and completeness.
Response
The department agrees with this finding and recommendation. The department currently receives the
laboratory results in PDF format. As of August 2019, OMC has established a system to enter the reports
into a centralized searchable spreadsheet, which will allow us to better manage and track the data. The
department considers this recommendation completed.
Person Responsible: Megan Thompson, Operations Supervisor
Recommendation
The Minnesota Department of Health should continue to work with Minnesota IT Services and the
manufacturers to modernize the Medical Cannabis Registry system and reporting process to ensure
more accurate “seed-to-sale” recordkeeping.
Response
The department agrees with this finding and recommendation. The registry and a seed-to-sale system
are two separate systems. The OMC currently does not have a seed-to-sale software, but believes a
state-centralized seed-to-sale system would be the best solution. OMC would need additional resources
to acquire and implement this IT solution.
OMC has worked closely with MNIT Services to begin evaluating either upgrades to our existing registry,
or moving to an RFP process to seek a new registry system. The estimated timeline for RFP,
implementation and data migration is 2.5 years, which means the earliest a new system would be
available would be July 2022.
In order to address some of the data entry errors, MNIT Services in conjunction with OMC and the
manufacturers has piloted a new interface that links the State of Minnesota registry directly to the
manufacturers’ Seed to Sale systems for some data entry points. This interface sends some real time
patient disbursement information to the registry at the time of a successful transaction, eliminating
delays/double entry and mistakes in the registry and ensuring that data in both systems are consistent.
As of early December 2019, the new method had been successfully piloted at both manufacturers.
Deployment of the change is anticipated first quarter of CY2020.
In a future legislative session, the department will seek funding and technology solutions to review and
revise our internal controls and systems, including a state-centralized seed-to-sale system, which the
program currently does not have.
Person Responsible: Chris Tholkes, Acting Director Office of Medical Cannabis and Robert Maki, Chief
Business Technology Officer
Finding #7
The Minnesota Department of Health did not have adequate controls to help prevent and timely detect
diversion or loss of medical cannabis by a manufacturer.

6

 Recommendation
The Minnesota Department of Health should conduct more frequent examinations of the medical
cannabis manufacturers that include a review of their internal controls to prevent and detect diversion,
theft, or loss of medical cannabis in a timely manner.
Response
The department partially agrees with this finding and recommendation. More frequent independent
examinations are only one way to prevent and detect diversion and inversion. Independent
examinations are incredibly time and budget intensive and at least one manufacturer has stated to us
that any costs they incur in conducting independent examinations will be passed along to the patients.
An alternative to independent examinations is a state-centralized seed-to-sale system, which could
provide real-time inventory data, chain of custody information, as well as proactive system alerts,
without having to physically visit each cannabis patient center across the state with increased
frequency, or having to engage budget intensive contractors to provide examination reports.
In a future legislative session, the department will seek funding either for independent examinations, to
avoid the costs being added to the price of medication, or a state-centralized seed-to-sale system, which
the program currently does not have.
Person Responsible: Chris Tholkes, Acting Director Office of Medical Cannabis

Sincerely,

Jan Malcolm
Commissioner of Health
PO Box 64975
St. Paul, MN 55164-0975
www.health.state.mn.us

7

  

 

 

Financial Audit Staff
James Nobles, Legislative A uditor
Christopher Buse, Deputy Legislative A uditor
Education and Environment Audits
Lori Leysen, A udit Director
Kevin Herrick
Paul Rehschuh
Kris Schutta
Emily Wiant
Zakeeyah Taddese
General Government Audits
Tracy Gebhard, A udit Director
Tyler Billig
Scott Dunning
Daniel Hade
Lisa Makinen
Erick Olsen
Sarah Olsen
Valentina Stone
Joseph Wallis
Health and Human Services Audits
Valerie Bombach, A udit Director
Jordan Bjonfald
Kelsey Carlson
William Hager
Jennyfer Hildre
Zachary Kempen
April Lee
Crystal Nibbe
Duy (Eric) Nguyen
Todd Pisarski

Information Technology Audits
Mark Mathison, A udit Director
Joe Sass
Nonstate Entity Audits
Lori Leysen, A udit Director
Shannon Hatch
Heather Rodriguez
Melissa Strunc
Safety and Economy Audits
Scott Tjomsland, A udit Director
Ryan Baker
Allison Cole
Bill Dumas
Gabrielle Johnson
Alec Mickelson
Tracia Polden
Zach Yzermans

For more information about OLA and to access its reports, go to: www.auditor.leg.state.mn.us.
To offer comments about our work or suggest an audit, evaluation, or special review, call
651-296-4708 or email legislative.auditor@state.mn.us.
To obtain printed copies of our reports or to obtain reports in electronic ASCII text, Braille, large print,
or audio, call 651-296-4708. People with hearing or speech disabilities may call through Minnesota
Relay by dialing 7-1-1 or 1-800-627-3529.
Printed on Recycled Paper

 O L A

OFFICE OF THE LEGISLATIVE AUDITOR

CENTENNIAL OFFICE BUILDING – SUITE 140
658 CEDAR STREET – SAINT PAUL, MN 55155