State lawmakers and medical marijuana patient advocates are concerned that a bill at the Colorado state Capitol to regulate cannabis concentrates, in part by tracking purchases, could compromise patient privacy.

Colorado uses “seed-to-sale” software known as METRC to track cannabis production from the moment a seed is planted to when it’s harvested, turned into a product and sold to a recreational or medical consumer. House Bill 1317 would expand use of the software to track daily purchases by medical marijuana patients to prevent them from exceeding limits.

Other states that use METRC have been plagued by software outages and other delays. Sponsors of the bill say Colorado hasn’t reported security problems with METRC since the Florida-based company Franwell was contracted to develop the system in 2011, but the mere collection of the data makes some people nervous.

“Who knows what that data can be used for in the future,” said Rep. Edie Hooton, a Boulder Democrat and one of three Democrats who voted against the measure in the House.

Although medical and recreational marijuana are legal in Colorado, using pot is still against federal law. Lawmakers raised concerns that people could lose jobs or face other ramifications if data about their medical marijuana purchases is leaked.

But proponents say tracking purchases of cannabis concentrate is essential to enforcing limits and preventing people, especially teenagers, from visiting multiple shops a day to get around daily limits. Although recreational marijuana is limited to people age 21 and older, people of all ages can get a medical card.

“It’s hard to have a daily limit if no one’s tracking what you’re buying per transaction,” said House Speaker Alec Garnett, a Denver Democrat and prime sponsor of the bill.

Lawmakers have since added language to the bill affirming that data collected under the measure would be covered by existing language protecting the privacy of medical marijuana patients.

“The patient community has asked for some reassurance they would have confidentiality with this data that was reported,” said Senate Minority Leader Chris Holbert, a Douglas County Republican.

David Eagleson, director of Program Management for METRC, said the company has not had digital security issues across all its contracts in 15 states and the District of Columbia based on how the system is designed or implemented.

“One thing we’re super proud of is we’ve had no known security breaches,” said Eagleson.

House Bill 1317 is backed by a bipartisan coalition of Colorado state lawmakers and aims to limit illegal access to high-potency marijuana products by teens by adding new barriers for people under 21 to get a medical marijuana card, lowering daily purchase limits for medical marijuana concentrate products, and tracking patients’ medical marijuana purchases to ensure buying-limits are being enforced.

Specifically, the legislation lowers the marijuana-concentrate purchase limit for patients between the ages of 18 and 20 to 2 grams per day, and 8 grams per day for patients 21 and older. There would be exceptions for people whose doctors vouch for a medical need for a greater quantity, are homebound or have other barriers to access.

Currently, patients can buy up to 40 grams of marijuana concentrate a day. Because sales aren’t tracked, proponents of the measure argue people can easily go from store-to-store to skirt restrictions.

“These products range in terms of THC potency from 50 to 99.9%,” said Garnett, citing studies on increased use of cannabis concentrate among teens.

Under the bill, dispensary staff would be required to check METRC to make sure people haven’t hit their daily purchasing limit before making a sale. The tracking only applies to medical marijuana, which proponents of the measure say is driving teen abuse because medical cards are available to individuals under the age of 21, the minimum age for people to purchase recreational pot. Parents say medical marijuana patients under age 21 are purchasing large amounts of cannabis and distributing it to their friends.

Ashley Weber, executive director of the cannabis decriminalization advocacy group Colorado NORML, said the bill unfairly targets medical pot patients. She’s also concerned that glitches or human error with entering purchase data into the system could unintentionally keep patients from legitimate access of medical marijuana.

“To track patients even more, and then to have patients pay for themselves to be tracked, is irresponsible,” Weber said.

Weber also asked lawmakers to consider exempting medical marijuana patients age 21 and older from the bill, given its focus on youth misuse.

“If we are saying this is coming from the 21 and above medical patients, we’re fooling ourselves if we think it’s not coming from the recreational side,” Weber told the Senate Finance Committee last week. “I believe there’s many other ways to figure out…where the diversion is coming from.”

Although the bill had broad bipartisan support in the House — it passed the chamber 55-8 — five Republicans and three Democrats voted “no,” citing a range of concerns, including data privacy.

Colorado doesn’t currently tie sales data to specific people, although dispensaries can enter information about specific medical patients into an optional field, according to the Department of Revenue, which maintains the METRC system. That optional data is only accessible by “select staff at the Marijuana Enforcement Division,” said Shannon Gray, a spokesperson for the revenue department.

METRC records information like the quantity and weight of a product, price and a patient identification number. It does not include names, dates of birth or other identifiable personal information, which is stored separately in the Colorado Department of Public Health and Environment’s Medical Marijuana Registry, according to Gray.

A growing number of states are looking into tracking sales to medical marijuana patients, Eagleson said. At least six jurisdictions now use the software to enforce limits on patient use of medical marijuana, Eagleson said.

In states where sales to patients are tracked, the only identifying information stored in METRC is the patient’s ID number.

“We aren’t providing details about where it was purchased, the date it was purchased,” said Eagleson of the company’s existing software. “If it’s a program with a 30-day window, all the budtender would see is the patient number, if they have an active card, and the amount they have available to purchase.”

The company could customize the software to collect more information if requested, Eagleson said.

Rep. Tim Geitner, a Colorado Springs Republican who supports House Bill 1317, said the state constitution already protects information collected from medical marijuana patients. He also points out that access to METRC data is limited.

State or local law enforcement is allowed to access the registry only to verify if a person is in lawful possession of a medical card, Geitner said, citing existing language in state law.

Rep. Yadira Caraveo, a Thornton Democrat and prime sponsor of the legislation, said as a physician she already has access to patient prescriptions for controlled substances, such as opioids, through a state database called the Prescription Drug Monitoring Program. Lawmakers this year are considering a separate measure to expand that program to all prescriptions.

“Just like that data, the METRC system would be treated confidentially, and is very secure,” Caraveo said.

Advocates and opponents, however, point to the fact that budtenders at stores across the state will be able to access the data, and say that the purchase history would be kept at all creates a new privacy vulnerability.

Rep. Kevin Van Winkle, a Highlands Ranch Republican, introduced a number of unsuccessful amendments to have the patient purchase data in METRC periodically deleted.

“We could find that good balance between making sure no one’s doing too much marijuana in one day or one week without having to permanently keep every transaction on record for the rest of someone’s life,” Van Winkle said.

Seventeen states, two U.S. territories and the District of Columbia have passed laws legalizing adult recreational marijuana use, according to the National Conference of State Legislatures. Thirty-six states and four U.S. territories have laws allowing for medical use.

In Maryland, where the state uses METRC to track medical marijuana sales and enforce purchasing limits, dispensaries complained about software bugs caused by high volume that caused the system to freeze or take hours to load. Some patients said they waited hours to complete a transaction, according to Slate.

Cannabis businesses in California had similar complaints about METRC software outages earlier this year, the industry publication MJBizDaily reported.

METRC has since made improvements to improve the efficiency of those systems, Eagleson said.

Washington and Pennsylvania, which use a different cannabis-tracking software from a Denver-based company called MJ Freeway, reported widespread problems when the system was first launched, from software glitches messing up orders, to hackers stealing and posting the company’s source code online in 2017.

Industry groups know that implementing a new system will take time, said Truman Bradley, executive director of the Marijuana Industry Group, which represents cannabis businesses.

“I think any time there’s a switch to…instantaneous reporting, there are concerns about the efficacy of the system, whether it will bog it down,” Bradley said. “There will need to be some (software) developments, and that’s widely acknowledged.”

House Bill 1317 needs one more vote of approval from the state Senate. After that, the bill would go back to the House for final approval.