If you are enrolled in a state medical cannabis program, or thinking about applying, the first question usually isn’t about the product. It’s about the paperwork: who actually sees your name, your diagnosis and your registry status once you submit them. The short answer is that access is narrow almost everywhere — but the exact list of who qualifies, and what counts as “identifying” information, is set state by state. There is no single federal privacy law governing these registries.
Who Can Legally See Your Information in a Medical Cannabis Registry
Medical cannabis patient registries are run by state health departments or equivalent agencies, not by the federal government. Federal agencies such as the FDA and DEA regulate cannabis as a controlled substance nationally, but neither administers a state patient registry or has standing access to one. Registry access is governed by each state’s own statute or regulation, and it typically narrows to a short, named list rather than a general “government” category. Categories that show up in the state examples below include:
- The patient or caregiver themselves, usually by written request to the administering agency
- The certifying physician, generally limited to that physician’s own patients
- Designated state health department staff who administer the registry
- Health care licensing boards, when investigating a specific complaint against a certifying physician
- Researchers, in some states, only under a signed confidentiality agreement and without re-contact rights
- Law enforcement, in some states, though the exact standard for that access is not always spelled out in the same section as the general confidentiality rule — see the Colorado note below
That list is illustrative, not a guarantee of what your state allows. The only reliable source is the statute or regulation itself, which is why the next section walks through three states where the primary text is public and specific.
Three State Examples, Verified From Primary Sources
These three states were chosen because each has a different, publicly verifiable approach. They are not a ranking and not a claim that any other state works the same way.
Florida: a constitutional exemption with a named access list
Florida Statute 381.987 makes a patient’s or caregiver’s personal identifying information in the state medical marijuana use registry confidential and exempt from Florida’s public records law, under the authority of Article I of the Florida Constitution. The statute lists, by role, who the Department of Health may release that information to — including an approved medical marijuana treatment center, a physician actively treating or monitoring that specific patient, the department’s own health care regulatory boards when investigating a physician, and researchers who sign an agreement not to re-identify or contact patients. Information released for research or reporting must have personal identifying details removed first.
Pennsylvania: confidential at the individual level, not at the aggregate level
Pennsylvania’s Medical Marijuana Act keeps the patient and caregiver registry confidential and exempt from the state’s Right-to-Know Law. That protection has been tested in court. A Pennsylvania reporter requested aggregate, de-identified data — such as how many patients statewide were certified for a given qualifying condition — and the Department of Health initially refused, arguing the confidentiality provision covered that too. The Commonwealth Court disagreed in its 2022 ruling in Pennsylvania Department of Health v. Mahon: it held that the Act’s confidentiality language protects an individual patient’s identifying information, not statewide counts and categories with no names attached. For a Pennsylvania patient, the practical read is that your own identity and medical details are shielded, while the state can still be required to publish how the program is being used in aggregate.
Colorado: a direct confidentiality rule, with access details that need their own check
Colorado’s medical marijuana registry regulation (5 CCR 1006-2, Regulation 1) states directly that all personal medical records and personal identifying information held by the Department of Public Health and Environment in administering the registry are confidential. The same chapter of regulations has separate sections addressing communications with law enforcement about registered patients (Regulation 5) and how the registry responds to subpoenas (Regulation 13). This guide has verified the confidentiality statement in Regulation 1 directly against the primary regulatory text; it has not independently verified the exact conditions under which law enforcement or a subpoena can obtain patient information under Regulations 5 and 13, so those specifics are left for a Colorado patient to confirm directly with the department rather than summarized here.
Which Exact State Privacy Rules You Need to Check
The examples above already diverge on several points that matter to a patient. Before assuming your state works like any of them, check your own program’s rules on each of these:
- Whether the confidentiality protection is set by statute, by regulation, or by agency policy — statutes and regulations are generally harder for an agency to narrow after the fact than internal policy is
- Exactly which roles are named as authorized recipients, and whether dispensaries, employers, insurers or landlords appear anywhere on that list
- Whether aggregate or de-identified program data is treated as public record, separate from individual patient data
- Whether law enforcement access requires a subpoena, court order or active investigation, or whether the statute leaves that standard unclear
- Whether the cannabis registry is linked to, or cross-checked against, a separate state prescription drug monitoring program
- Whether caregivers are covered by the same confidentiality language as patients, or listed separately with different terms
- What happens to your record after you leave the program — deleted, retained, or simply marked inactive
A Worksheet for Checking Your Own State
Use this while reading your state’s program page and statute, not as a substitute for either:
- Program name and administering agency: the specific department or board that runs the registry
- Statute or regulation citation: the exact section number for the confidentiality provision, not just a general “privacy policy” page
- Authorized-access list: every role named in that provision, copied verbatim
- Public-records status of aggregate data: confirmed exempt, confirmed public, or unclear from the text
- Law-enforcement access standard: named explicitly, or not addressed in the section you found
- Contact for the program office: a phone number or email for the administering agency, not a dispensary
- Open question to raise with them: whatever this worksheet didn’t resolve from the statute alone
Questions to Ask Program Administrators Directly
- “Can you send me the exact statute or regulation section that covers patient confidentiality in this program?”
- “Besides me, who is legally permitted to see my registry record, and under what circumstances?”
- “Is any aggregate or de-identified program data published, and where?”
- “What happens to my record if I let my registration lapse or leave the state?”
- “Is this registry connected to any other state database, such as a prescription monitoring program?”
What This Guide Does Not Cover
This is regulatory education, not legal advice, and it covers only the three states named above, each tied to a specific, checkable source — not every state program. Privacy protections differ by state, by statute language, and by how courts interpret that language, as the Pennsylvania example shows. Nothing here should be read as a guarantee that any particular state’s registry is confidential in every circumstance. The only way to know your own state’s rules is to read the current statute or regulation and confirm directly with your program administrator. For background on evaluating a health claim or a source before relying on it, see our guide to reading health research. You can also review our editorial standards for how this publication sources and verifies regulatory claims.