DCP details remote pharmacy rules for Connecticut cannabis retailers; 8 in-person hours, 1:3 tech ratio, strict PHI safeguards

Lila McKinley, director of the Cannabis Control Division at the Department of Consumer Protection, outlined new guidance allowing remote pharmacy work for hybrid cannabis retailers and dispensary facilities and explained the department’s interpretation of recently enacted statutory requirements.

McKinley said the public act authorizing remote pharmacy permits telehealth consultations for qualifying patients and caregivers and remote dispensing, but it does not eliminate in-person requirements. “There still is a requirement that a pharmacist dispense. However, they can do so remotely,” she said, adding that the department must follow what the statute requires.

Why this matters: the guidance affects how licensed cannabis retailers staff stores, protect patient privacy, retain records and demonstrate compliance for possible audits. McKinley told attendees that each licensed facility must register a pharmacist as a key employee and meet two minimum hour tests per license: a pharmacist registered for 20 hours per calendar week (for telehealth availability) and at least 8 consecutive in-person hours per calendar week on site.

Key rules explained - Minimum staffing and ratios: McKinley reiterated that one pharmacist may supervise up to three dispensary technicians — “it is 1 to 3, and it doesn’t matter whether it’s remote or in person or a combo” — and that the ratio is measured per pharmacist and must not be exceeded. - Licensure per location: each hybrid retailer or dispensary facility is a separate license; hour requirements apply per licensed location. If a business owns multiple locations, each license must meet the 20-hour and 8-hour requirements. - Telehealth and privacy: telehealth consultations must be conducted in a private space that meets HIPAA requirements. McKinley said a separate room is a clear example of compliance but the department will consider alternative on-site solutions that preserve confidentiality. - Technology and verification: systems used for telehealth and remote final verification must be HIPAA-compliant with encryption, access controls, audit trails, and safeguards against erasure or tampering. McKinley listed acceptable platforms such as Zoom for Healthcare and Teams or Skype with security add-ons and discouraged public chat or social platforms for consultations. - Remote final verification: remote dispensing requires the remote pharmacist to visually inspect orders, labels and products via audio-visual communications and certify final verification. Final verification records must include items such as patient name, quantity, strength, a photo of product and label, and the names/initials of the dispensary technician and remote pharmacist. - Recordkeeping and retention: telehealth records are subject to existing cannabis record-retention rules. McKinley clarified that if video verification is used it is a dispensation record subject to three-year retention (not the 30-day surveillance retention period), and that the department needs an auditable record (including an audible record of the verification) so investigators can trace errors if needed.

Questions and clarifications Attendees asked about private-space examples, combinations of remote and in-person supervision, whether one pharmacist can cover multiple locations, continuing education (CE) timing, and auditing processes. McKinley said: telephone consultations are acceptable for telehealth visits but are not sufficient for remote final verification; a pharmacist may oversee multiple locations’ remote hours if they remain reasonably available and the 1:3 ratio and other requirements are met; CE enforcement for this new remote model is likely a low priority for 2025 and stakeholders should plan for 2026; and detailed recordkeeping/audit questions should be directed to the DCP cannabis inbox for granular guidance.

How to get further guidance McKinley invited businesses to submit specific platform or SOP questions to the department (dcp.cannabis@ct.gov) for issue-spotting; the department said it will advise where it sees compliance risks though it will not formally approve systems. She also pointed participants to HHS resources on HIPAA-compliant telehealth platforms.

Next steps The department said it will consider updating written guidance to address specific recordkeeping questions raised during the session and urged businesses with detailed scenarios to follow up by email.