Ala. Admin. Code r. 538-X-4-.05

Current through Register Vol. 43, No. 1, October 31, 2024

Section 538-X-4-.05 - Maintenance Of Proper Technology

(1) Licensees shall, at all times, maintain technology (whether proprietary, provided through a third party, or if applicable, through the Statewide Seed-to-Sale Tracking System), and through such technology shall track information, sufficient to comply with the requirements of § 20-2A-60, Code of Ala. 1975, (as amended), and any other requirements of the Commission. Tracking information contained in any databases created or maintained by such licensees shall be updated no less often than daily (during the next business day after the incident is discovered or new information has been received) and maintained for a minimum of six years or longer at the request of the Commission, law enforcement personnel, or any court having jurisdiction of a matter arising out of or relating to the information so tracked.

(2) Licensees' network security shall, at a minimum, comply with cyber security standards set by the International Society of Automation (ISA) and the International Electrotechnical Commission (IEC) standard ISA/IEC 62443 applicable to industrial facilities operated by manufacturers of medical or pharmaceutical businesses.

(3) Licensees shall bear the cost of technology sufficient to comply with the requirements of § 20-2A-60. The Commission will not pay for licensees' systems or upgrades, RFIDs, barcodes, and/or hardware. Licensees' costs are outside the scope of the Commission's responsibility to maintain or procure; such responsibility, at all times, remains upon each licensee to procure the necessary technology for itself.

(4) Consistent with the requirements of § 20-2A-54, Code of Ala. 1975, (as amended), licensees shall support, participate in, and contribute to the Statewide Seed-to-Sale Tracking System. The licensee shall ensure that its third-party inventory and tracking systems, if any, shall properly interface with the Statewide Seed-to-Sale Tracking System and, as appropriate, with the patient registry. Licensees' technology and uploads to the Statewide Seed-to-Sale Tracking System shall be sufficient to allow access to said system by the Commission, and, to the extent necessary and appropriate, patients and caregivers, qualified certifying physicians, other state agencies, other licensees, and law enforcement personnel, for all purposes set forth in said section.

(5) Notwithstanding any other requirements for training or continuing education, all individuals who as part of their duties to licensees must interact with the patient registry, the AMCC website, or the Statewide Seed-to-Sale Tracking System, shall undergo pre-employment (or, for new licensees, pre-commencement) IT certification for each database with which they must interact, demonstrating their proficiency in respect to those databases. IT certification as set forth herein shall be administered by the third-party IT provider, or another, as the Commission may designate.

(6) Licensees shall identify to the Commission an individual, by name and position within the licensee's business, who shall be the designated liaison with the Commission for purposes of coordinating, monitoring, and updating the Licensee's input to the Statewide Seed-to-Sale- Tracking System.

(7) Licensees shall take all necessary steps to ensure the confidentiality of the information received, maintained, and uploaded to any of the above databases.

Ala. Admin. Code r. 538-X-4-.05

Adopted by Alabama Administrative Monthly Volume XL, Issue No. 11, August 31, 2022, eff. 10/15/2022.

Author: William H. Webster

Statutory Authority:Code of Ala. 1975, §§ 20-2A-22, as amended.