Healthcare Cannabis Storage Protocols: Regulatory Requirements and Best Practices
Last reviewed: February 2026 | Audience: Clinical directors, compliance leads, harm reduction program operators
This guide distinguishes federal obligations under the Cannabis Regulations from institutional practices that exceed them. It is written for administrators who need that distinction to be accurate under scrutiny, not merely plausible.
A note on limits: this guide does not constitute legal advice. The Cannabis Regulations establish different obligations for different facility types, and whether your facility qualifies as a “hospital,” a healthcare setting, or a social services provider under the Regulations affects which provisions apply to you. Read the scoping section carefully before applying anything here to your situation, and consult legal counsel for facility-specific analysis.
For the operational setup of patient-facing holding programs, see Cannabis Holding Programs in Supportive Housing and Community Health. For a structured, audit-ready checklist, see the Institutional Medical Cannabis Compliance Checklist.
Scope: Which Facilities This Covers
The Cannabis Regulations (SOR/2018-144) do not create a single category called “healthcare facility.” Federal obligations for cannabis depend on your specific regulatory status. This guide addresses three situations:
Hospitals: Facilities licensed, approved, or designated by a province to provide care or treatment, or owned and operated by a federal or provincial government to provide health services. Division 3 of Part 14 (sections 346–352) governs these facilities directly.
Health care practitioners: Physicians and nurse practitioners possessing cannabis for professional practice. Sections 330–331 apply.
Harm reduction programs, shelters, MAPs, and supportive housing: Programs that are not provincially licensed hospitals occupy a different position under the Regulations. Flora’s registration and delivery model for participants in these settings has been developed in consultation with legal counsel and verified against the Cannabis Regulations. Participants without fixed addresses can be registered clients of a licensed seller under provisions specifically designed for this population. Program operators interested in understanding how this works in their setting should contact our institutional team.
If you are uncertain which category applies to your facility, you should seek legal advice before designing your compliance program.
Part 1: Federal Obligations for Hospitals
Security
The individual in charge of a hospital must, in respect of cannabis products permitted to be administered, distributed, or sold:
(a) take reasonable steps to protect them from theft or loss; and (b) report any theft or loss to the Minister of Health within 10 days of becoming aware of it.
Cannabis Regulations, SOR/2018-144, s.347
The standard is reasonable steps — a conduct standard assessed against your specific circumstances, not a checklist of required hardware. The Regulations do not specify lock types, safe grades, cabinet specifications, surveillance systems, or environmental controls. A locked medication cabinet satisfies this standard. More elaborate measures may be warranted by your patient population, quantity on hand, or facility type, but they are not federally mandated.
Loss and Theft Reporting
Hospitals must report theft or loss to the Minister of Health within 10 days of becoming aware of it (s.347). Health care practitioners hold the same obligation (s.330). The Regulations do not independently require a police report for these facility types, though your provincial framework or institutional policy may.
Cannabis Regulations, SOR/2018-144, ss.330, 347
Record Keeping
The individual in charge of a hospital must ensure records are retained for all cannabis products:
Received: class of cannabis, brand names, quantity, source name and address, date received.
Distributed or sold to a patient: patient name; prescriber name, profession, and signature date; daily gram quantity from the medical document; cannabis class; quantity distributed or sold; date.
Transferred to another authorized person or returned: recipient name, date, quantity, brand names, and address.
Records must be retained for a minimum of two years from the date of preparation. Provincial healthcare documentation standards may require longer retention — verify with your provincial authority.
Cannabis Regulations, SOR/2018-144, ss.351(1), 351(2)
Distribution Limits
When distributing or selling to a patient or their responsible adult, quantity must not exceed 30 times the daily gram amount in the medical document, capped at 150g dried cannabis equivalent. Products must be in the original container from the licensed seller, with a label showing the prescriber’s name and profession, the patient’s name, the daily quantity, and the date. The patient or responsible adult must receive the current Government of Canada Consumer Information — Cannabis document.
Cannabis Regulations, SOR/2018-144, s.348(3)
Cannabis That Cannot Be Used or Has Expired
Hospitals cannot independently dispose of cannabis. Products may be returned to the supplying licensed seller on written request or transferred to a licensed seller authorized to destroy cannabis. Independent disposal — including mixing with waste — is not an authorized option for hospitals under Division 3.
Cannabis Regulations, SOR/2018-144, s.348(7)
Part 2: What Is Not Required by Federal Cannabis Law
The following are commonly implemented in healthcare settings. None are mandated by the Cannabis Regulations for hospitals or health care practitioners under Division 3. Each is an institutional decision:
Environmental monitoring (temperature, humidity): Not a federal cannabis requirement. Standards come from pharmaceutical guidelines and provincial pharmacy regulations. Appropriate for product integrity — not legally required by cannabis law.
Dual custody or co-signature for dispensing: Not mandated. An institutional risk management decision.
Surveillance systems: Not mandated by cannabis law. May be required by provincial facility licensing or accreditation.
Daily inventory reconciliation: Not mandated. Records must account for all cannabis received and distributed — reconciliation frequency is an institutional decision.
Cannabis-specific staff training: Not mandated by cannabis law. May be required by your regulatory college, provincial health authority, or accreditation body.
Temperature logs: Not mandated. Appropriate for product quality assurance.
The clinical and operational rationale for these practices is often sound. The compliance rationale — that they are legally required under cannabis law — is not. Design programs on the former basis, not the latter.
Part 3: Provincial Overlay
Federal cannabis law sets the floor. Provincial healthcare legislation, facility licensing requirements, and regulatory college standards impose additional obligations that vary by jurisdiction and facility type and, in many cases, significantly exceed the federal minimum.
Facilities in Ontario operating under the Long-Term Care Homes Act are subject to medication management standards that the Cannabis Regulations do not address. Accreditation Canada standards impose governance and documentation requirements beyond Division 3. Provincial pharmacy regulations govern hospital pharmacists in ways that interact with but are not superseded by the federal cannabis framework.
Federal cannabis compliance is necessary but not sufficient for most licensed healthcare settings. Verify applicable provincial requirements with your health authority and regulatory college before finalizing your compliance program.
Part 4: Governance
Policy Documentation
A written policy grounded in the actual applicable sections — not inflated assumptions about what the law requires — is the foundation of defensible compliance. The policy should explicitly cite applicable regulatory sections, designate accountability for each obligation, establish an annual review cycle, and be reviewed by legal counsel.
Insurance
Cannabis programs may not be covered under standard healthcare facility liability policies. Confirm with your insurer that coverage explicitly extends to your cannabis holding and dispensing activities before the program launches.
Supplier Documentation
Obtain a Certificate of Analysis for every batch received from your licensed seller. A COA confirms potency and testing for microbial contamination, heavy metals, and pesticides. Retain COAs alongside your Section 351 records. Any compliant licensed seller provides these as standard.
Part 5: Inspection Readiness
Health Canada
Health Canada’s inspection authority targets licensed sellers. A direct inspection of an unlicensed healthcare facility solely for cannabis compliance is uncommon — but your licensed seller’s compliance status affects your supply chain. A supplier placed under Health Canada action can disrupt your program regardless of your own compliance posture.
If Health Canada assessed your facility’s cannabis holdings, they would examine whether reasonable steps are being taken to prevent theft or loss, whether a loss/theft reporting procedure exists, and whether records adequately account for all cannabis received and distributed.
Provincial Health Authorities
Provincial reviews are more likely for facilities that receive provincial funding or operate under provincial healthcare licences. They typically examine medication management compliance, privacy and consent documentation, professional practice standards, and facility licensing conditions.
Funder Audits
Funders for harm reduction or housing programs often have documentation requirements that exceed regulatory minimums. Review your funding agreement explicitly. Batch-level COAs, client registration summaries, and monthly supply reports are commonly requested.
Summary: Federal Obligations for Hospitals Under Division 3
Under Cannabis Regulations, SOR/2018-144, Part 14, Division 3, a hospital must:
Take reasonable steps to protect cannabis products from theft or loss (s.347(a)); report theft or loss to the Minister of Health within 10 days (s.347(b)); maintain records of all cannabis received, distributed, sold, and transferred (s.351(1)); retain those records for at least two years (s.351(2)); comply with distribution limits and labelling requirements when providing cannabis to patients (s.348(3)); and return or transfer cannabis for destruction rather than disposing of it independently (s.348(7)).
Everything beyond this list is institutional governance — appropriate, often advisable, and sometimes required by provincial law or accreditation bodies — but not the federal floor under cannabis law.
This guide is based on the Cannabis Regulations, SOR/2018-144, current to February 4, 2026. It does not constitute legal advice. Facility type determines which provisions apply, and that determination requires legal analysis specific to your situation. Consult legal counsel and your provincial regulatory body before finalizing your compliance program. Cannabis is not an approved therapeutic product in Canada.