Patient/Customer Verification SOP

Acceptable Forms of ID

• Driver's License: State-issued, valid (not expired)
• State ID Card: Non-driver identification card
• Passport: U.S. or foreign passport
• Military ID: Active duty or veteran ID with photo and DOB
• Tribal ID: Government-issued tribal identification
• ID must be physical (no digital/mobile IDs unless state-approved)
• ID must have photo, date of birth, and expiration date

ID Verification Steps

Perform these checks for EVERY customer, EVERY transaction:

• Step 1: Request ID from customer
• Step 2: Verify ID is not expired (check expiration date)
• Step 3: Verify photo matches customer's appearance
• Step 4: Calculate age from date of birth (must be 21+ for adult-use, 18+ for medical)
• Step 5: Check for signs of tampering or fake ID (holograms, fonts, thickness)
• Step 6: Scan ID with ID scanner (if available) to verify authenticity
• Step 7: If any doubt, refuse sale and notify manager

Detecting Fake IDs

• Holograms: Real IDs have state-specific holograms (check under light)
• Microprinting: Tiny text visible under magnification
• UV Features: Use UV light to check for hidden security features
• Thickness: Fake IDs often feel thinner or thicker than real IDs
• Font/Spacing: Inconsistent fonts or spacing indicate fake
• Photo Quality: Blurry or poorly laminated photos are red flags
• Barcode: Scan barcode to verify information matches front of ID

ID Scanner Systems

• Recommended: Use ID scanner to verify authenticity and capture data
• Benefits: Detects fake IDs, auto-calculates age, stores customer data
• Popular Systems: IDScan.net, TokenWorks, PatronScan
• Cost: $500-$2,000 per scanner + monthly subscription
• Compliance: Some states require ID scanning (check local regulations)

Medical Card Requirements

• Valid Card: State-issued medical cannabis card (not expired)
• Photo ID: Must also present government-issued photo ID
• Name Match: Name on medical card must match name on photo ID
• Age: Minimum 18 years old (some states allow minors with caregiver)
• State-Specific: Most states do not accept out-of-state medical cards (check reciprocity)

Medical Card Verification Steps

• Step 1: Request medical card and photo ID
• Step 2: Verify card is not expired (check expiration date)
• Step 3: Verify name on card matches name on ID
• Step 4: Check card number format (state-specific format)
• Step 5: Verify card with state registry (online lookup if available)
• Step 6: Check for any purchase limit restrictions on card
• Step 7: Document medical card number in POS system

State Registry Verification

Some states provide online verification systems:

• California: No online verification (visual inspection only)
• Colorado: Online verification available (optional)
• Oregon: OMMP online verification system (required)
• Michigan: Online verification available
• If online verification available, use it to confirm card is active and valid
• Document verification in POS system or customer record

Caregiver Verification

• Caregiver Card: Caregiver must present valid caregiver card
• Patient Card: Caregiver must also present patient's medical card
• Authorization: Verify caregiver is authorized to purchase for patient
• Limits: Caregiver can only purchase up to patient's daily limit
• Documentation: Record both caregiver and patient information

Daily Purchase Limits by State

Equivalency Calculations

Convert different product types to flower equivalent:

• Concentrates: 1g concentrate = 3.5g flower (typical)
• Edibles: 100mg THC = 1g flower (typical)
• Tinctures: 100mg THC = 1g flower (typical)
• Topicals: Usually not counted toward purchase limits
• Check state-specific equivalency formulas (vary by state)
• POS system should auto-calculate equivalencies

Tracking Customer Purchases

• POS System: Track purchases by customer ID or medical card number
• Daily Limits: System should prevent sales exceeding daily limits
• Reset Time: Limits reset at midnight (24-hour rolling period)
• Multiple Visits: Track cumulative purchases across multiple visits same day
• Alerts: POS should alert if customer approaching or exceeding limit
• Override: Manager approval required to override limit warnings

Refusing Sales (Over Limit)

• Politely explain customer has reached daily purchase limit
• Show customer their purchase history in POS system
• Inform customer they can return tomorrow for additional purchases
• Do not make exceptions (license risk)
• Document refusal in POS system notes
• Escalate to manager if customer becomes confrontational

Customer Registration Process

• First-Time Customers: Create customer profile in POS system
• Required Info: Name, date of birth, ID number, contact info (optional)
• Medical Patients: Also record medical card number and expiration
• Consent: Obtain consent for data collection and marketing (if applicable)
• Loyalty Program: Offer enrollment in loyalty/rewards program (optional)
• Privacy Notice: Provide privacy notice explaining data use

Data Privacy & Security

• Minimal Data: Only collect data necessary for compliance and operations
• Secure Storage: Encrypt customer data in POS system
• Access Control: Limit employee access to customer data
• Retention: Retain purchase records for 7 years (compliance requirement)
• No Sharing: Do not share customer data with third parties without consent
• CCPA/GDPR: Comply with state privacy laws (CA, CO, VA, etc.)

Customer Rights

• Access: Customers can request copy of their data
• Correction: Customers can request corrections to inaccurate data
• Deletion: Customers can request deletion (subject to retention requirements)
• Opt-Out: Customers can opt out of marketing communications
• Establish process for handling customer data requests
• Respond to requests within 30 days (typical requirement)

When to Refuse Sale

• No Valid ID: Customer cannot provide acceptable ID
• Expired ID: ID is expired
• Underage: Customer is under 21 (or 18 for medical)
• Fake ID: ID appears fake or tampered
• No Medical Card: Medical patient cannot provide valid card
• Over Limit: Customer has exceeded daily purchase limit
• Intoxicated: Customer appears intoxicated or impaired
• Suspicious Behavior: Customer appears to be purchasing for minors (straw purchase)

How to Refuse Sale (De-escalation)

• Be Polite: Remain calm and professional
• Explain Reason: Clearly state reason for refusal (compliance requirement)
• Offer Alternatives: "You can return with valid ID" or "Come back tomorrow"
• Do Not Argue: Do not debate or negotiate
• Call Manager: If customer becomes upset, call manager for support
• Document: Record refusal in POS system with reason
• Security: If customer becomes threatening, call security or police

Straw Purchase Detection

Signs customer may be purchasing for minors or unauthorized persons:

• Customer is with minors or young-looking individuals
• Customer asks questions on behalf of someone else
• Customer purchases maximum daily limit repeatedly
• Customer appears nervous or evasive
• Customer receives instructions from someone outside store
• If suspected, refuse sale and document in incident log

Required Training Topics

• ID Verification: How to check IDs, detect fakes, use ID scanner
• Medical Card Verification: State-specific requirements, registry lookup
• Purchase Limits: Daily limits, equivalencies, tracking in POS
• Refusing Sales: When and how to refuse, de-escalation techniques
• Data Privacy: Customer data protection, privacy laws
• Compliance: State regulations, penalties for violations

Training Schedule

• New Hires: Complete verification training before working register
• Refresher: Annual refresher training for all staff
• Updates: Training when regulations change
• Documentation: Maintain training records for 7 years
• Testing: Quiz staff to verify understanding

Compliance Monitoring

• Manager spot-checks ID verification procedures
• Review POS system logs for limit overrides and refusals
• Mystery shopper testing (send underage-looking person with valid ID)
• Review security camera footage periodically
• Address violations immediately with retraining or discipline
• Document all compliance monitoring activities