User:Shawndouglas/sandbox/sublevel1

From CannaQAWiki
Jump to navigationJump to search
The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.

LIMS functionality requirements specific to cannabis testing

The average general-purpose laboratory information management system (LIMS) will have a wide array of functionality. However, such a LIMS developed with quality in mind will take into account additional factors, such as the requirements that current regulatory schemes, industry standards, and organizational guidelines place on the development of a LIMS. This development can and should be framed with a strong specification based on those regulations, standards, and guidelines, a specification such as LIMSpec. Such a specification ideally addresses system requirements involving aspects including but not limited to sample management, reporting, resource management, quality control, system and instrument integration, data integrity, and cybersecurity.

But what about the special requirements of a cannabis testing laboratory? How does a specification document like LIMSpec—and by extension, a LIMS—address those laboratory needs?

The following examines the special requirements of cannabis testing and how a LIMS can address them. In particular, those requirements are matched to existing requirements in the original base LIMSpec specification document. (Note: You'll see slightly modified text of these same LIMSpec items in the following chapters.) Additional background is also provided. In a few rare cases, a LIMSpec requirement may not have a specific regulation, standard, or guidance document matched to it. These represent areas where regulatory bodies and standards agencies may need to address a gap in the future.

Sample registration

Cannabis testing LIMS requirement: The system should provide sample registration screens optimized for the cannabis testing industry, including the ability to differentiate among medical marijuana, recreational marijuana, and hemp, as well as derivative products and their various substrates.

Relevant LIMSpec:

  • 1.11 The system should support the creation of user-definable default sample registration input screens and/or preferences.

Additional background: Even though some LIMS already provide the ability for users to define their own sample registration screens and fields, it doesn't necessarily mean the vendor will also include pre-loaded screens and preferences for a specific industry or scientific discipline. Those vendors tailoring sample registration screens and preferences specifically to cannabis testing lab requirements for launch-day deployment have a step up on other LIMS vendors. Also, sample registration should also support both remote sampling and in-lab sampling activities.


Pre-loaded cannabis testing protocols, labels, and analytical reports

Cannabis testing LIMS requirement: The system should offer pre-loaded compliant cannabis testing protocols, labels, and analytical reports that are optimized to and readily adjustable for a rapidly changing industry.

Relevant LIMSpec:

  • 1.2 The system should allow for creation and use of pre-configured (e.g., for basic clinical samples) and customizable (e.g., for regulated activities such as blood collection and storage) sample labels, with barcode support.
  • 1.6 The system shall allow for the addition, modification, and removal of new, pre-defined, and custom analytical tests.
  • 4.1 The system shall allow for the verification of specification limits for accuracy or tolerances while indicating to the user when values are exceeded.
  • 6.5 The system shall substantiate the status of verified results by using tools like a certificate of analysis, which shall include details like unique identifiers; analysis procedures used; reference intervals; environmental conditions; who provided the results; additional comments, opinions, and interpretations and who provided them; and applicable times and dates.
  • 6.6 The system shall allow a certificate of analysis to be generated upon the verification and approval of results and associated metadata by authorized personnel.
  • 6.7 The system shall provide the ability to clearly and accurately generate reports for a variety of standard situations, including certificates of analysis from testing, pending samples for approval, out-of-specification samples and tests, instruments pending calibration, expired reagents to be disposed, and trend charts of laboratory performance.
  • 6.8 The system should, in addition to standard reports, provide the means for custom automatic and manual reporting, including but not limited to sample registration reports, work and backlog lists, laboratory performance reports, instrument reports, statistical analysis reports, regulatory reports, incident reports, chain of custody reports, quality assurance reports, service reports, inventory analysis reports, and investigator/sponsor reports.

Additional background: As with sample registration, end users of a cannabis testing LIMS will appreciate having a wide array of pre-loaded testing protocols, label templates, and report templates. This includes the ability to customize analytical reports such as certificates of analysis (COAs) for multiple testing scenarios like batch testing and batch-by-batch variance analysis.


Creation and management of additional protocols, labels, and analytical reports

Cannabis testing LIMS requirement: The system should provide users the tools for creating new, compliant test protocols, labels, and reports, as well as managing them as the industry changes.

Relevant LIMSpec:

  • 1.2 The system should allow for creation and use of pre-configured (e.g., for basic clinical samples) and customizable (e.g., for regulated activities such as blood collection and storage) sample labels, with barcode support.
  • 1.6 The system shall allow for the addition, modification, and removal of new, pre-defined, and custom analytical tests.
  • 4.1 The system shall allow for the verification of specification limits for accuracy or tolerances while indicating to the user when values are exceeded.
  • 6.8 The system should, in addition to standard reports, provide the means for custom automatic and manual reporting, including but not limited to sample registration reports, work and backlog lists, laboratory performance reports, instrument reports, statistical analysis reports, regulatory reports, incident reports, chain of custody reports, quality assurance reports, service reports, inventory analysis reports, and investigator/sponsor reports.
  • 32.9 The system shall support configurable laboratory workflows based on appropriate laboratory process and procedure.

Additional background: As with pre-loaded protocols, labels, and analytical reports, providing users the ability to create and manage their own protocols, labels, and reports—including COAs—as the industry changes is vital. Similarly, the same need for a flexible yet robust means of adjusting limit sets—and preserving older ones—is also required.

Flexible specification limit sets

Cannabis testing LIMS requirement: The system should support the development and maintenance of flexible and robust limit sets for various state and local regulations, as well as specific substrate testing requirements.

Relevant LIMSpec:

  • 4.1 The system shall allow for the verification of specification limits for accuracy or tolerances while indicating to the user when values are exceeded.
  • 32.2 The system shall allow authorized users to configure the specification limits for sample and instrument tests.

Additional background: A vital component of the previously mentioned testing protocols that should not be overlooked is how flexible their test parameter/specification limit sets are. As regulations and standards concerning cannabis testing—across many different substrates—may change rapidly at the federal, state, and local level, adjustments to the limits declared within testing protocols must be easy to make. Additionally, the system should be capable of retaining older historic limit sets, such that past results can later be accurately linked to their original limit sets.[1]


Third-party system integration

Cannabis testing LIMS requirement: The system should provide a means to manually or automatically connect with and securely transfer information between (integrate with) state-required compliance reporting systems, seed-to-sale systems, and other software systems like enterprise resource management (ERP) solutions.

Relevant LIMSpec:

  • 27.1 The system should be capable of communicating any status changes for samples, lots, instruments, and other dynamic entities to and from external systems.
  • 27.6 The system should be able to interface directly with a third-party reporting tool.
  • 27.15 The system shall provide a means to integrate and exchange data electronically based on relevant methods, and in such a way so as to ensure accurate and secure data transfer and processing.

Additional background: Seed-to-sale systems, like METRC, or other types of government-mandated reporting systems may have a web-based user interface (webUI) for manual entry of results data, or they may even support a .csv upload of data. However, manual entry of results can be time consuming and result in a higher likelihood of errors. As such, the more efficient way to report data to those types of systems is through more automated means, connecting your LIMS with a web-based application programming interface (API), typically provided by the vendor of the seed-to-sale or reporting software. This means the LIMS must either be pre-configured to connect with all the necessary APIs or be equipped to handle connection with any API.


Instrument integration

Cannabis testing LIMS requirement: The system should provide robust support for accurately and securely integrating with and collecting data from numerous types of scientific instruments.

Relevant LIMSpec:

  • 26.1 The system should be able to use an application programming interface or web services to communicate with instrument data systems.
  • 26.2 The system should be capable of sending samples and test orders to instrument data systems.
  • 26.3 The system should be capable of receiving test results from instrument data systems and verifying those results for completeness and readability.
  • 26.4 The system should be capable of generically parsing instrument data to extract important sample details and results.

Additional background: From mass spectrometers and chromatography equipment to quantitative polymerase chain reaction (qPCR) systems and moisture balances, being able to accurately and securely transfer analytical data automatically improves turnaround time and better ensures the accuracy of entered results (versus manual data entry). This is particularly important in the highly regulated industry that is cannabis testing.


Granular chain-of-custody

Cannabis testing LIMS requirement: The system should provide accurate, automatic chain-of-custody (CoC) tracking, down to a granular location level (e.g., "Storage Room 3, Freezer 1, Shelf 3"), and at every step (including package receipt and sending).

Relevant LIMSpec:

  • 1.9 The system shall be able to define the sample collection details for registered samples, including container size and type, number of containers, collection date and time, name of the collector, lot number, storage location, preservation method, collection methods used (standard and nonstandard), safety concerns, and retention period.
  • 1.12 The system should allow for the recording of sample delivery details such as deliverer, location, and date and time for a preregistered sample.
  • 1.14 The system shall provide a user-friendly means for acknowledging the physical reception of sample material in the laboratory, including date and time of reception.
  • 1.18 The system shall have the ability to maintain the chain of custody of every sample, meaning the recording of every single sample distribution step to personnel—including details such as unique identifier, name, location, date, and time—while the sample is in the laboratory’s possession.
  • 15.5 The system should provide a means for accurately recording the receipt, issue, distribution, and disposal of materials.

Additional background: A nickname for a seed-to-sale system is a "track-and-trace" system, highlighting the importance of always knowing the who, what, where, when, and how much of cannabis materials and related products in the industry life cycle. This concept is often referred to as the "chain-of-custody" of cannabis related material. This chain-of-custody is not limited to received cannabis samples, either; it also includes any subsamples and aliquots generated in the testing laboratory, as well as any disposed materials. As such, it's vital the LIMS be able to accurately document the chain of steps received cannabis materials go through, from reception and retention to delivery and destruction. Without this careful documentation, a cannabis testing lab is open to costly fines or, worst case, having their license suspended.


Inventory reconciliation

Cannabis testing LIMS requirement: The system should support inventory reconciliation, including sample weight reconciliation, while limiting data entry errors.

Relevant LIMSpec:

  • 1.13 The system shall assign each sample registered in the system a unique identifier using methodologies such as an ID with an incrementing integer or a user-defined naming format.
  • 1.15 The system shall allow for the comparison of received samples to the sampling requirements of the customer or laboratory in order to identify variances from those requirements.
  • 2.9 The system should provide a means to manually or automatically track sample inventory amounts and status.
  • 4.1 The system shall allow for the verification of specification limits for accuracy or tolerances while indicating to the user when values are exceeded.
  • 15.1 The system should be capable of accurately tracking the specific quantities of received and consumed test samples.
  • 15.5 The system should provide a means for accurately recording the receipt, issue, distribution, and disposal of materials.

Additional background: Related to the "how much" of chain-of-custody tracking, sample weight reconciliation is an important element of avoiding regulatory violations.[2] The LIMS should be able to either automatically deduct sample and inventory quantities when consumed as part of a test (including subsamples and aliquots), or it should allow manual entry of such changes with background validation checks or warnings. For example, the system would need to clearly warn the user when attempting to pull more weight from a sample than exists, which would create a negative value. Speaking of which...


Real-time alerts

Cannabis testing LIMS requirement: The system should support real-time alerts of out-of-specification (OOS) results, so immediate action can be taken, if required.

Relevant LIMSpec:

  • 3.12 The system should effectively alert users upon entry of out-of-specification test results.
  • 16.8 The system should provide a means for configurable workflows to manage OOS and OOT incidents according to an organization’s standard operating procedures.

Additional background: As part of maintaining quality assurance and compliance with regulations and standards, it's important users be warned when something goes awry with data entry and analysis. This is typically controlled through the previously mentioned limit sets associated with pre-loaded and custom test protocols. However, other error checking of automatic and manual calculations, e.g., weight reconciliation, should also be inherently built into the LIMS. However, the checks are not enough; users must clearly and promptly be notified of errors and OOS results (via the limit sets) in order to, for example, identify health risks associated with a tested product and send notification that the product should be pulled from store shelves. Additionally, the requirement for maintaining quality testing outcomes for consumer safety further drives the need for prompt real-time alerts.


Data security and confidentiality

Cannabis testing LIMS requirement: The system should ensure data security and confidentiality for at-rest and in-transit data.

Relevant LIMSpec:

  • 35.1 The system should use secure communication protocols like SSL/TLS over Secure Hypertext Transfer Protocol with 256 bit encryption.
  • 35.2 The system should support database encryption and be capable of recording the encryption status of the data contained within.

Additional background: When it comes to cannabis and protected health information (PHI), dispensaries are the most likely to require careful attention to consumer information.[3][4] However, that does not preclude laboratories from making strong efforts to protect sensitive personal data related to clients and their analyses (let alone to protect the lab's own validated methods and documentation). As such, cannabis testing labs should rely on a LIMS that uses industry-standard communication protocols and encryption methods to protect not only the data housed in the LIMS but also data moving in and out of it.


Accounting and billing

Cannabis testing LIMS requirement: The system should provide accounting and billing functionality for not only optimal business operations but also to ensure compliance with any regulations involving monetary transactions for cannabis-related services.

Relevant LIMSpec:

  • Currently no regulatory- or standard-based requirement for this and thus not in the original LIMSpec.

Additional background: Though not necessarily backed by any regulation or standard, carefully tracking expenditures and payments received related to cannabis activities is vital. This is especially true given that the non-hemp (low-THC) Cannabis plant is still technically illegal to grow and process in the eyes of U.S. federal law. As such, some business taking in money from cannabis-related activities have had problems with managing the financial aspects of their operations.[5][6][7][8] Given the remaining uncertainty of cannabis legalization in the U.S., and the natural benefits of managing accounting and billing within the LIMS, it makes sense that a LIMS should be able to accurately track receipts and more, down to the penny.


Secure web portal

Cannabis testing LIMS requirement: The system should provide a secure web portal for client results review and test ordering.

Relevant LIMSpec:

  • Currently no regulatory- or standard-based requirement for this and thus not in the original LIMSpec.

Additional background: Similar to accounting and billing functionality, this requirement for a portal for customer access isn't necessarily mandated by any regulation or standard. However, it remains a useful time-saving and customer service element. Additionally, the "secure" part of this requirement must be emphasized. This ties directly to the prior requirement for data security and confidentiality. Web-based attacks remain some of the most popular cybersecurity attacks, targeting the likes of online customer portals and WordPress sites for credentials and sensitive information.[9][10] A quality LIMS that has already proven strong data security gives confidence in the LIMS vendor's ability to implement a web-based customer portal for order review and test ordering.


ISO/IEC 17025 compliance support

Cannabis testing LIMS requirement: The system should support a laboratory's ISO/IEC 17025 compliance efforts.

Relevant LIMSpec:

  • 1.13 The system shall assign each sample registered in the system a unique identifier using methodologies such as an ID with an incrementing integer or a user-defined naming format.
  • 2.8 The system should allow for the accurate identification of a physical sample in the system via barcode or RFID technology.
  • 4.4 The system shall provide one or more levels of review, as well as interpretation and documentation of results—whether entered manually or via an automated process—before release.
  • 6.5 The system shall substantiate the status of verified results by using tools like a certificate of analysis, which shall include details like unique identifiers; analysis procedures used; reference intervals; environmental conditions; who provided the results; additional comments, opinions, and interpretations and who provided them; and applicable times and dates.
  • 6.9 The system shall clearly identify a changed, amended, or re-issued report as being such, and clearly identify any change of information and reason for change in such a report.
  • 7.1 The system shall be capable of creating, managing, and securely holding a variety of document types, while also allowing for the review and approval of those documents using version and release controls.
  • 7.2 The system shall have the ability to readily provide access to electronic documents such as standard operating procedures, quality manuals, instrument manuals, information exchange agreements, and other applicable documents to designated personnel and officials.
  • 7.3 The system shall be able to clearly provide the most current version of a document and archive prior versions.
  • 7.5 The system shall allow the creation, approval, rejection, and management of sampling and test methods performed at the laboratory, capturing details about the test method, method reference, specifications, assigned limits, holding times, etc. as required by a reference method or regulation.
  • 7.6 The system shall provide a means for recording validation information for modified existing or new in-house test methods, either as a method itself or through some other means. Validation information such as procedures used, specifications, performance characteristics, and results obtained shall be allowed as input.
  • 7.7 The system shall maintain training and certification records for personnel and allow the assignment of available training paths and certifications to specific personnel, such that only trained, certified, and experienced personnel are able to perform assigned tasks.
  • 8.8 The system shall map available system tasks (such as approved test methods) or sample types (such as select agents and toxins) to available training paths and certifications, such that only trained, certified, and experienced personnel are able to perform assigned tasks.
  • 10.7 The system shall allow for the configuration of calibration and maintenance frequency and time frames for—as well as the manual and automatic scheduling of calibration or maintenance of—equipment, instruments, and systems. Available intervals should be include days, weeks, months, and years.
  • 10.9 The system shall clearly identify any instrument that is out-of-calibration, beyond its preventative maintenance due date, or under investigation and prevent it from being selected for use.
  • 10.10 The system shall be able to show all instances of scheduled calibration, preventative maintenance, and service dates for an instrument.
  • 10.11 The system shall be able to link a calibration activity to certified reference material or designated measurement processes.
  • 10.13 The system shall be able to uniquely identify each instrument and any associated components and maintain that and other information—such as manufacturer, model number, serial number, and calibration and maintenance history—within the system.
  • 10.15 The system shall be capable of chronologically logging details for scheduled and unscheduled calibration and maintenance activities for each instrument, including calibration status, calibration standard, date and time of calibration or maintenance, work performed, who conducted it, and signatures of those verifying the completed activities.
  • 16.3 The system shall be able to record instances of identified nonconformance and method deviation, as well as the actions required to restore the process to conformity. In the case of a planned deviation, the system shall require documentation, justification, proof of validation, adjusted reference intervals, and authorization for the deviated process.
  • 27.3 The system shall provide a means to choose—based on date and type of data—electronic data and metadata to archive.
  • 27.4 The system shall provide a guaranteed means to retrieve and restore archived data and metadata that is readable and accurate.
  • 27.11 The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure from manipulation and loss.
  • 30.9 The system should allow for other types of facility monitoring (such as alarm, light, lock, and door statuses) and send notifications when necessary with recommendations for immediate and corrective action. The system should also maintain a log of all such monitored systems and their status changes.
  • 30.11 The system should allow for environmental control and monitoring of equipment (such as incubators and freezers) and send notifications when necessary with recommendations for immediate and corrective action. The system should also maintain a log of all such monitored equipment and their associated status changes.
  • 31.4 The system shall have a mechanism to securely retain data in the system for a specific time period and enable protections that ensure the accurate and ready retrieval of that data throughout the records retention period.
  • 32.22 The system shall provide a security interface usable across all modules of the system that secures data and operations and prevents unauthorized access to data and functions.
  • 33.4 The system should be well documented by the vendor in comprehensive training material for all aspects of system use, including administration, operation, and troubleshooting.
  • 33.5 The system shall be validated initially and periodically, with those validation activities being documented, to ensure the accuracy, consistency, and reliability of system performance and its electronic records.
  • 34.7 The vendor shall restrict logical access to database storage components to authorized individuals. If providing a hosted service, the vendor should also restrict physical access to database storage components to authorized individuals. (In the case of an on-site solution, the buyer is responsible for limiting physical access to database storage components to meet 21 CFR Part 11, HIPAA, and CJIS guidelines.)

Additional background: In the U.S., many states mandate analytical testing of cannabis and its related products. This testing is prescribed as a public health safety measure, to ensure those consuming cannabis and derived products are not adversely affected by any harmful substances picked up during processing stages. By extension the public must place trust in those labs conducting this testing, requiring a high level of quality within the laboratory and how it operates. This quality is better assured through laboratory accreditation checks to standards like ISO/IEC 17025, which provides competence requirements for testing and calibration laboratories. ISO/IEC 17025 requirements are non-trivial, covering many aspects of how the laboratory operates, and chief among those requirements is the need for a quality management system. And maintaining quality requires maintaining traceable documentary evidence of those efforts.[11] This includes certificates of analysis, quality manuals, standard operating procedures, calibration and maintenance logs, and much more. Your LIMS should make strong efforts towards helping you maintain that documentary evidence to not only assist with compliance efforts, but also push your lab to maintain high levels of quality for those depending on accurate analyses.


NELAC, ORELAP, and ELAP compliance support

Cannabis testing LIMS requirement: The system should support a laboratory's NELAC or ORELAP compliance efforts.

Cannabis testing LIMS requirement: The system should support a laboratory's ELAP compliance efforts.

Relevant LIMSpec:

  • NOTE: NELAC's Volume 1: Management and Technical Requirements for Laboratories Performing Environmental Analysis (2016) is proprietary and could not be obtained. The following LIMSpec items are based off New York's ELAP requirements.
  • 2.11 The system shall allow samples and tests to be created and used specifically for capturing data related to unique forms of sampling and testing such as representative sampling, calibration testing, quality control testing, preventative maintenance testing, stability testing, sterility testing, compatibility testing, identity testing, proficiency testing, and service-event-related testing.
  • 7.1 The system shall be capable of creating, managing, and securely holding a variety of document types, while also allowing for the review and approval of those documents using version and release controls.
  • 7.2 The system shall have the ability to readily provide access to electronic documents such as standard operating procedures, quality manuals, instrument manuals, information exchange agreements, and other applicable documents to designated personnel and officials.
  • 7.5 The system shall allow the creation, approval, rejection, and management of sampling and test methods performed at the laboratory, capturing details about the test method, method reference, specifications, assigned limits, holding times, etc. as required by a reference method or regulation.
  • 7.6 The system shall provide a means for recording validation information for modified existing or new in-house test methods, either as a method itself or through some other means. Validation information such as procedures used, specifications, performance characteristics, and results obtained shall be allowed as input.
  • 7.7 The system shall maintain training and certification records for personnel and allow the assignment of available training paths and certifications to specific personnel, such that only trained, certified, and experienced personnel are able to perform assigned tasks.
  • 16.6 The system shall allow for the documentation of and corrective and preventive action towards all types of nonconformance.
  • 16.7 The system should track and record incidents and associated corrective actions, allowing authorized personnel to document the effectiveness of the actions, identify insufficient resolutions, and curb repeat occurrences.

Additional background: Though ISO/IEC 17025 remains the major standard to be accredited to, other accreditation requirements exist in the world of cannabis testing. These requirements may be state-based, as with the Oregon Environmental Laboratory Accreditation Program (ORELAP)[12] or New York's Environmental Laboratory Approval Program, Certification Manual Item 180.7 for Medical Marijuana.[13] Others like the non-profit NELAC Institute provide national accreditation thought its National Environmental Laboratory Accreditation Program (NELAP), which ORELAP is largely guided by.[12] This includes NELAC's[14]:

  • EL-V1M1-2016-Rev2.1 Module 1, "Proficiency Testing"
  • EL-V1M2-ISO-2016-Rev2.1 Module 2 "Quality Systems General Requirements"
  • EL-V1M4-2017-Rev2.2 Module 4, "Quality Systems for Chemical Testing"
  • EL-V1M5-2016-Rev2.0 Module 5, "Quality Systems for Microbiological Testing"

As such, this means covering ground similar to ISO/IEC 17025 regarding quality in the laboratory. To better meet these requirements, a cannabis testing LIMS should assist with the maintenance of documentation such as quality manuals, tracking laboratorians' credentials and experience, documenting corrective and preventative action, and documenting proficiency testing results, among other tasks.[15]


Patient Focused Certification (PFC) compliance support

Cannabis testing LIMS requirement: The system should support a laboratory's Americans for Safe Access (ASA) Patient Focused Certification (PFC) Program laboratory compliance efforts.

Relevant LIMSpec:

  • Unknown; unable to acquire document

Additional background: The American Association for Laboratory Accreditation (A2LA) incorporates the ASA's PFC Program into its cannabis testing laboratory accreditation, described in its R243 - Specific Requirements - Cannabis Testing Laboratory Accreditation Program document.[16] However, the A2LA will "only give that document to prospective accreditation customers," according to personal communication. As such, it's not clear what those specific PFC requirements are and how they may relate to a LIMS' ability to maintain A2LA's PFC compliance. Presumably those requirements can be better met with a LIMS, whatever the requirements may be. If a vendor indicates their LIMS helps support PFC requirements, it's best to engage in a conversion with the vendor to determine how.

References

  1. LabLynx, Inc (13 October 2011). "LabLynx KB:SysAdmin - 5.4 LIMS system setup". LIMSwiki.org. https://www.limswiki.org/index.php/LabLynx_KB:SysAdmin_-_5.4_LIMS_system_setup. Retrieved 18 December 2020. 
  2. Moberly, R. (14 May 2020). "Avoid Infractions: Top 5 METRC Cultivation Violations". RMCC Blog. https://www.rockymountaincannabisconsulting.com/cannabis-business-blog/2020/5/14/avoid-infractions-top-5-metrc-cultivation-violations. Retrieved 18 December 2020. 
  3. Fawkes, G. (24 January 2020). "Report: Cannabis Users’ Sensitive Data Exposed in Data Breach". vpnMentor Blog. https://www.vpnmentor.com/blog/report-thsuite-breach/. Retrieved 20 January 2020. 
  4. Shaghaghi, S.; Weinstein, I. (18 February 2020). "Leak of 30,000 cannabis customer records heightens need for effective data security". Insights. CohnReznick LLP. https://www.cohnreznick.com/insights/leak-of-30000-cannabis-customer-records-heightens-need-for-effective-data-security. Retrieved 20 January 2020. 
  5. Kovaleski, S.F. (14 February 2014). "U.S. Issues Marijuana Guidelines for Banks". The New York Times. The New York Times Corporation. https://www.nytimes.com/2014/02/15/us/us-issues-marijuana-guidelines-for-banks.html. Retrieved 18 December 2020. 
  6. Financial Crimes Enforcement Network (14 February 2014). "BSA Expectations Regarding Marijuana-Related Businesses". U.S. Department of the Treasury. https://www.fincen.gov/resources/statutes-regulations/guidance/bsa-expectations-regarding-marijuana-related-businesses. Retrieved 18 December 2020. 
  7. Angell, T. (14 June 2018). "More Banks Working With Marijuana Businesses, Despite Federal Moves". Forbes. Forbes Media, LLC. https://www.forbes.com/sites/tomangell/2018/06/14/more-banks-working-with-marijuana-businesses-despite-federal-moves/#4d828ed21b1b. Retrieved 18 December 2020. 
  8. Boomstein, A.L.; Miller, C.D.; Owen, J.L. (30 October 2019). "California DBO Offers Guidance on Cannabis Banking". Manatt, Phelps & Phillips, LLP. https://www.manatt.com/insights/newsletters/financial-services-law/california-dbo-offers-guidance-on-cannabis-banking. Retrieved 18 December 2020. 
  9. Talalev, A. (14 September 2020). "Website Hacking Statistics in 2020". WebARX Blog. https://www.webarxsecurity.com/website-hacking-statistics-2018-february/. Retrieved 18 December 2020. 
  10. Ensighten (11 February 2020). "op Five Cyberattacks Targeting Your Website in 2020". Ensighten Blog. https://www.ensighten.com/blog/top-five-cyberattacks-targeting-your-website-in-2020. Retrieved 18 December 2020. 
  11. JonP (31 July 2020). "How can a cannabis testing lab pass ISO 17025?". IMSM News. https://www.imsm.com/us/news/how-can-a-cannabis-testing-lab-pass-iso-17025/. Retrieved 23 December 2020. 
  12. 12.0 12.1 "Accreditation for Laboratories Testing Cannabis in Oregon". Oregon Health Authority. https://www.oregon.gov/oha/ph/LaboratoryServices/EnvironmentalLaboratoryAccreditation/Pages/Cannabis-accreditation.aspx. Retrieved 23 December 2020. 
  13. "Environmental Laboratory Approval Program". New York State Department of Health Wadsworth Center. https://www.wadsworth.org/regulatory/elap. Retrieved 23 December 2020. 
  14. "Fla. Admin. Code R. 64E-1.0015". CaseText. 8 December 2020. https://casetext.com/regulation/florida-administrative-code/department-64-department-of-health/division-64e-division-of-environmental-health/chapter-64e-1-certification-of-environmental-testing-laboratories/section-64e-10015-laboratory-certification-standards. Retrieved 23 December 2020. 
  15. New York State Department of Health – Wadsworth Center (3 December 2020). "Environmental Laboratory Approval Program (ELAP) and Laboratory of Environmental Biology (LEB): Procedure on How to Perform an Initial Demonstration of Capability (iDOC) for Medical Marijuana Microbiology" (PDF). New York Department of Health. https://www.wadsworth.org/sites/default/files/WebDoc/MM%20guidance%20procedure%20for%20Micro%20iDOC-120320.pdf. Retrieved 23 December 2020. 
  16. A2LA. "Cannabis Testing Laboratory Accreditation Program". https://www.a2la.org/accreditation/cannabis-testing. Retrieved 23 December 2020.