Section 691-5-3 - Certification of Testing FacilitiesSection 3.1 - Certification Required A cannabis testing facility may test cannabis or cannabis products only if it holds a current certification from DHHS, CDC. Initial certification will be for a period of 1 year, and annual recertification is required.3.1.1.Applications must meet all CDC requirements.A. At a minimum, the application for certification must include:(1) The name of the facility director in charge of the cannabis testing facility and each employee's qualifications or job descriptions;(2) Resumes that document appropriate experience and education, including college transcripts and evidence of a completed degree, for personnel specified in section 4;(3) A quality assurance manual, meeting the specifications of subsection 3.2;(4) Standard operating procedures, meeting the specifications of subsection 3.3; and(5) The fields of testing for which the applicant seeks provisional certification or certification using the technology analyte table (TAT) maintained by the program and proof of ISO/IEC 17025:2017 or most recent version accreditation for such fields of testing or, if applying for a provisional certification, proof that the applicant has submitted an approved application for ISO/IEC 17025:2017 or most recent version accreditation for such fields of testing.B. Applications for certification will not be considered complete until payment of the non-refundable application fee.C. Applications for renewal certification shall be submitted no less than sixty days prior to the expiration of current certification.D. The cannabis testing facility must submit the following additional documentation to obtain provisional or full certification from the CDC:(1) A description of the organization and management structure of the cannabis testing facility, its place in any parent organization and the relationships between quality management, technical operations and support services;(2) A management plan defining the responsibilities of key personnel in the organization who have any involvement or influence on the testing, and if the cannabis testing facility is part of an organization performing activities other than testing, identifying potential conflicts of interest;(3) Written policies and procedures that ensure the protection of its clients' confidential information and proprietary rights, including procedures for protecting the electronic storage and transmission of results;(4) Written policies and procedures for receipt of samples for mandatory or other testing; and(5) A written policy defining legal chain of custody protocols and including procedures to control access to certificate of analysis data and other testing data to prevent it from being falsified or manipulated.3.1.2.Certification is granted for specified matrices, technology and analytes.A. The CDC will only certify applicants for the matrices, technologies and analytes required for testing under this rule.B. The CDC may, at its discretion, allow applicants to submit an application to expand the scope of its certification for one or more of the fields of testing on an individual basis rather than requiring the applicant to meet all fields of testing for all available testing types.C. The CDC must conduct a comprehensive on-site inspection of each cannabis testing facility prior to granting certification. Following its inspection, the CDC must issue a written initial on-site assessment report which identifies any deficiencies noted during the CDC inspection. In order to receive certification, the cannabis testing facility must correct any deficiencies identified and provide documentation of the correction to CDC within 30 days of receipt of the initial on-site inspection report.3.1.3.A cannabis testing facility must maintain its CDC certification at all times to remain licensed by DAFS.A. The CDC may, upon reasonable cause, complaint, or to assess continued compliance with this rule, conduct an onsite inspection or review written or electronic records to determine the cannabis testing facility's compliance with the certification requirements described in this section.B. Upon the finding of significant or intentional deviation from certification requirements or if the cannabis testing facility refuses to permit access to the site or records, the CDC may suspend or revoke the cannabis testing facility's certification. (1) A cannabis testing facility may not conduct testing of cannabis or cannabis products while its certification is suspended or revoked.(2) The CDC shall communicate any suspension or revocation in writing, along with a notice of the licensee's right to appeal, consistent with the Maine Administrative Procedures Act, 5 MRS, chapter 375.(3) Simultaneously, the CDC shall inform OCP of its actions.C. Annual recertification is required. (1) The CDC will provide at notice to a testing facility least 90 days prior to the testing facility's scheduled annual recertification.(2) The recertification application shall include at minimum, the following: (a) Any changes to assertions made during initial certification or most recent recertification;(b) Any fines, enforcement or letters of warning by OCP;(c) Copies of updated SOPs;(d) Copy of current QA manual; and(e) Updated copies, at the CDC's discretion, of any materials required for initial certification.(3) The CDC may consider a cannabis testing facility's compliance with certification requirements, proficiency testing, accuracy of testing and reporting implicated in this rule when determining whether to renew the cannabis testing facility's certification.Section 3.2 - Quality Assurance Program and Manual3.2.1.The cannabis testing facility must develop and implement a quality assurance program. The program must be sufficient to ensure the reliability and validity of the analytical data produced by the cannabis testing facility. The cannabis testing facility operations must also meet the requirements of the ISO 17025:2017 accreditation.3.2.2.The cannabis testing facility must develop and maintain a written quality assurance program manual.A. The manual must contain the following elements:(2) Identification on each page to ensure that the page is recognized as part of the manual and clear identification of the end of the manual;(3) The cannabis testing facility's name and address;(4) Identification of the cannabis testing facility's approved signatories;(6) A date indicating when the revision became effective;(7) A table of contents, applicable lists of references, glossaries and appendices;(8) Listing of all certified testing methods;(9) Relevant organizational charts showing the organization and management structure of the cannabis testing facility and, if applicable, its place within a larger business entity; and(10) Job descriptions of key staff and reference to the job descriptions of other cannabis testing facility staff;B. The manual must address all aspects of the cannabis testing facility's quality assurance program, including without limitation the following:(2) Quality assurance objectives for measurement data;(3) Traceability of all data, analytical results and certificates of analysis;(4) Equipment preventative maintenance;(5) Equipment calibration procedures and frequency;(6) Performance and system audits;(8) Record retention, including retention of quality assurance records;(10) Standardization of testing procedures;(12) Maintenance, calibration and verification procedures;(13) Major equipment, support equipment and reference measurement standards (e.g., NIST traceable thermometers and weights);(14) Verification practices, which may include proficiency testing programs, use of reference materials, internal quality control processes and inter-cannabis testing facility comparisons;(15) Reporting analytical results and generating the certificate of analysis;(16) Traceability of measurements;(17) Adoption of new testing methods;(18) Handling of samples;(19) Collection and transportation of samples, as applicable;(20) Receipt of samples for mandatory testing, or testing for research and development purposes;(22) Feedback and corrective action related to testing discrepancies or departures from documented policies and procedures;(23) Policy for permitting departures from documented policies and procedures or from standard specifications;(24) Handling of complaints;(25) Protection of confidentiality and proprietary rights;(27) Chain of custody forms;(28) Annual internal audits;(29) Evaluation of employee credentials;(30) Employee training, including initial data integrity training for new personnel and annual data integrity training for all current employees with written documentation of attendance;(31) Electronic signatures, where applicable;(32) How data accuracy and precision are determined for each accredited method and analyte within each test category;(33) Disposal of cannabis waste; and(34) Review of all new work to ensure that the cannabis testing facility has appropriate facilities and resources before commencing such work; and(35) Meeting all applicable ISO 17025:2017 accreditation requirements.C. The manual may include separate procedures or incorporate documents by reference.3.2.3.The quality assurance program and manual must be reviewed and updated regularly to remain current.A. The facility director and quality assurance officer must review, amend if necessary and approve the quality assurance program and manual.(1) Routine review is required at least annually.(2) The facility director must also review and amend the quality assurance program and manual whenever there is a change in methods, cannabis testing facility equipment or facility director.(3) Documentation of the review process must include the scope of the review, identification and signature of the reviewer and the date the review was completed.B. Method detection limits and reporting limits may be determined by methods used by the U.S. Environmental Protection Agency.(1) The cannabis testing facility may use the procedure for determining the method detection limit described in 40 C.F.R. Part 136, Appendix B, revised as of July 1, 2017, as amended by Federal Register, Vol. 82, No. 165, p. 40836-40941, August 28, 2017; or(2) Other methods published by the federal U.S. Food and Drug Administration for the determination of limit of detection (LOD) and limit of quantitation including Guidelines for the Validation of Analytical Methods for the Detection of Microbial Pathogens in Foods and Feeds, 2nd Edition, April 2015.Section 3.3 - Standard Operating Procedures (SOPs).3.3.1.Written SOPs are required. The cannabis testing facility must possess written SOPs used by cannabis testing facility personnel for the analysis of samples and must prepare written procedures for all cannabis testing facility activities, including, but not limited to, sample collection, sample acceptance, sample analysis, operation of instrumentation, generation of data and performance of corrective action.A. Only the facility director, quality assurance officer or designee may make changes to SOPs.B. Such changes are effective only when documented in writing and approved by the facility director or quality assurance officer.C. The SOPs must be formatted to include:(2) A unique identification of the SOP, such as a serial number, an identification on each page to ensure that the page is recognized as a part of the manual and a clear identification of the end of the manual;(4) The cannabis testing facility's name;(5) A revision number; and(6) A date indicating when the revision became effective.D. Each analytical method SOP must include or reference the following topics, where applicable: (1) Identification of the method;(2) Applicable matrix or matrices;(3) Limits of detection and quantitation;(4) Scope and application, including parameters to be analyzed;(5) Summary of the method;(9) Equipment and supplies;(10) Reagents and standards;(11) Sample collection, preservation, shipment and storage;(12) Quality control (QC);(13) Calibration and standardization;(15) Data analysis and calculations;(17) Pollution prevention;(18) Data assessment and acceptance criteria for QC measures;(19) Corrective actions for out-of-control data;(20) Contingencies for handling out-of-control or unacceptable data;(23) Any tables, diagrams, flowcharts and validation data.E. For pesticide analysis, the SOP must include established and documented detection limits for each matrix type.3.3.2.Written SOPs are requirements of certification and licensing and must be followed.A. Actual practice must conform to the written procedures.(1) The cannabis testing facility must maintain copies of the methods from which the procedures are developed and must ensure that the applicable requirements are incorporated into each procedure.(2) A copy of each procedure must be available to all personnel that engage in that activity.(3) An analyst must use the cannabis testing facility's SOP beginning on its effective date.B. Standard operating procedure requirements may be considered confidential material, and OCP and the CDC may not disclose the information except in conjunction with agency actions.C. The cannabis testing facility must maintain a record of effective dates for all procedures and must review SOPs at least annually. A copy of the procedure and the record of effective dates must be maintained for the same period that records of the data generated by those procedures are required to be maintained.D. The cannabis testing facility must keep all standard operating procedures on the cannabis testing facility premises and in the field, as necessary, and must ensure that each standard operating procedure is accessible to cannabis testing facility personnel during operating hours. The cannabis testing facility must make the standard operating procedures available to the CDC upon request.E. All changes to the SOPs must be documented.(1) Changes to the SOPs must be incorporated at least annually.(2) The cannabis testing facility's facility director must review, approve, sign and date each SOP and each revision to a SOP.(3) The SOPs must include the dates of issue and dates of revision, if any.Section 3.4 - Proficiency Testing The cannabis testing facility must participate in a proficiency-testing program provided by an ISO-17043-accredited proficiency test provider, at least annually each year. The CDC may waive proficiency testing requirements if no proficiency tests are available.
3.4.1.Proficiency tests are required.A. Any cannabis testing facility seeking to obtain certification must successfully complete at least one proficiency test sample for each requested field of testing. (1) The proficiency test must occur within six months prior to the date that the cannabis testing facility submits its initial application, and annually thereafter(2) When any cannabis testing facility is granted certification, it must continue to complete proficiency testing studies for each field of testing and maintain a history of at least one acceptable evaluation for each field of testing out of the most recent two proficiency test sample results submitted to the proficiency test provider.(3) To maintain certification, the cannabis testing facility must complete the annual study, and any corrective action study required, each year.(4) Failure to participate in a proficiency test may result in disciplinary action against the cannabis testing facility, including suspension or revocation of certification.B. Proficiency testing must be conducted according to the following guidelines: (1) The cannabis testing facility must rotate the proficiency tests among cannabis testing facility staff, so that all methods and all staff performing the methods have participated in proficiency tests over a reasonable planned period, as defined in the cannabis testing facility quality assurance manual.(2) The cannabis testing facility must analyze the proficiency test samples following the approved cannabis testing facility standard operating procedures and using the same equipment that are used for testing.(3) Cannabis testing facility employees who participate in a proficiency test must sign corresponding analytical reports or attestation statements to certify that the proficiency test was conducted in the same manner as the cannabis testing facility ordinarily conducts testing.(4) The facility director must review and approve all proficiency test samples analyzed and results reported.(5) The cannabis testing facility must authorize the proficiency test provider to release the results of the proficiency test to OCP and CDC at the same time that the results are submitted to the cannabis testing facility.(6) Prior to the closing date of a study, cannabis testing facility personnel, including corporate personnel, may not: (a) Communicate with any individual at another cannabis testing facility, concerning the analysis of the proficiency test sample prior to the closing date of the study;(b) Subcontract the analysis of any proficiency test sample or a portion of a proficiency test sample to another cannabis testing facility for any analysis;(c) Knowingly receive and analyze any proficiency test sample or portion of a proficiency test sample from another cannabis testing facility, for which the results of the proficiency test sample are intended for use for initial or continued certification; or(d) Attempt to obtain the assigned value of any proficiency test sample.(7) The cannabis testing facility must analyze proficiency test samples in the same manner used for routine samples, using the same staff, sample tracking, sample preparation and analysis methods, SOPs, calibration techniques, QC procedures and acceptance criteria.(8) The cannabis testing facility must follow sample preparation steps for the proficiency test sample, as instructed by the approved proficiency test provider for which the proficiency test sample was obtained.(9) Testing facilities under the same ownership may not participate in the same study by the same approved proficiency test provider for the same fields of testing, except when a study is not again available for that field of testing by any approved proficiency test provider within the calendar year.C. Errors in reporting the proper matrix, the method used or the tested analytes in the proficiency test study by the cannabis testing facility must be graded as "not acceptable."3.4.2.Cannabis testing facilities must provide proficiency test results.A. The cannabis testing facility must evaluate and report the analytical result for certification as follows: (1) For instrument technology that employs a multi-point calibration, the working range of the calibration under which the proficiency test sample is analyzed must be the same range as used for routine samples.(a) A result for any proficiency test at a concentration above or equal to the lowest calibration standard must be reported as the resultant value.(b) A result for any proficiency test at a concentration less than the lowest calibration standard must be reported as less than the value of the lowest calibration standard.(c) A result for any proficiency test greater than the highest calibration standard must be diluted to fall within the range of the calibration curve.(2) For instrument technology that employs standardization with a zero point and a single point calibration standard, the cannabis testing facility must evaluate the analytical result in the same range as used for routine samples.(a) A result for any proficiency test at a concentration above or equal to the reporting limit must be reported as the resultant value.(b) A result for any proficiency test at a concentration less than the reporting limit must be reported as less than the value of the reporting limit.(c) A result for any proficiency test greater than the high calibration standard must be diluted to be within the working range.B. The cannabis testing facility must ensure that the proficiency test results include the correct physical address of the cannabis testing facility.C. The cannabis testing facility must report the analytical results to the proficiency test provider on or before the closing date of the study using the reporting format specified by the proficiency test provider.D. On or before the closing date of the study, the cannabis testing facility must authorize the proficiency test provider to release the cannabis testing facility's final evaluation report directly to OCP and the CDC.E. The cannabis testing facility must supply results by authorizing the approved proficiency test provider to release all PT results and corrective action results to the certification officer by an electronic format specified by the certification officer. The CDC must evaluate only results received directly from the proficiency test provider.F. The cannabis testing facility may not request a revised report from the proficiency test provider, when the revisions to the report are due to any error on the part of the cannabis testing facility.3.4.3.Successful performance is required.A. The cannabis testing facility must successfully participate in a proficiency test for each matrix, technology and analyte. (1) Test results are considered "satisfactory" for an analyte tested in a specific technology, or if the results demonstrate a positive identification of an analyte tested in a specific technology, including quantitative results, when applicable.(2) A cannabis testing facility must analyze only the analytes for which proficiency test results were considered "satisfactory."(3) The reporting of a false-positive result is an "unsatisfactory" score for the proficiency test.B. The cannabis testing facility must take corrective action and document corrective action, when the cannabis testing facility fails to score 100% on a proficiency test. (1) Within 30 days of receiving an "unacceptable," "questionable," or "unsatisfactory" proficiency test result, a cannabis testing facility must submit the proficiency-test results and detailed corrective action responses to the CDC.(a) This information must include root-cause analysis and remedial action plans.(b) The cannabis testing facility must not accept samples or analyze the analytes for which proficiency test results were considered "unacceptable," or "unsatisfactory," until completing the corrective action and resolving the problem.(c) The cannabis testing facility must enroll in the next available round of proficiency tests.(d) Such enrollment should be documented in the corrective action plan initiated in response to a proficiency test failure.(2) The cannabis testing facility may not continue to report results for analytes that were deemed "unacceptable," "questionable" or "unsatisfactory" if the cannabis testing facility has two successive failed proficiency test studies for any analyte and technologies.(3) Within 180 days of an unacceptable or unsatisfactory proficiency test result, the cannabis testing facility must submit a written report showing whether the cannabis testing facility successfully implemented the corrective action to the CDC.(4) Within 30 days of receipt of a corrective action report, the cannabis testing facility must order a new proficiency test to demonstrate proficiency for reinstatement of certification.C. If the facility fails two successive proficiency test studies for any analyte and technology, certification for that analyte and technology is suspended immediately. Certification may be reinstated pending successful completion of two successive proficiency test studies.3.4.4.Proficiency test sample study records must be maintained.A. The cannabis testing facility must maintain copies of all written, printed and electronic records pertaining to proficiency test sample analyses for 5 years.B. Proficiency test records must include, without limitation:(2) Instrument strip charts or printouts;(5) Proficiency test study report forms used by the cannabis testing facility to record proficiency test results.C. The cannabis testing facility must make all retained records available to cannabis certification officers during on-site assessments of the cannabis testing facility.Section 3.5 - Conducting Annual Internal Audit A. The cannabis testing facility must conduct an internal audit at least once per year, or per the ISO/IEC 17025:2017 or most recent version accrediting body's requirement, whichever is more frequent.B. The internal audit must cover everything required to be covered by this Rule and ISO/IEC 17025:2017 or most recent version internal-audit standards.C. The internal audit will be reviewed during the on-site assessment by the CDC, during an inspection by the CDC, or at the request of the CDC.D. Failure to conduct an internal audit or failure to submit the results of an internal audit to the CDC may subject the cannabis testing facility to suspension or revocation of certification.