Highly regulated industries typically require key information to be readily available to regulators related to the production, movement, and sale ($$$) of products, which is the case in the cannabis industry (try our free METRC training here).
The two main reasons for “Seed-to-Sale” record keeping are (1) to reduce the diversion of cannabis products to the unregulated market and (2) to protect consumer health with an efficient track and recall product method.
However, cannabis operators are facing many challenges with the state-mandated track-and-trace requirements, causing their business operations to suffer inefficiencies, delays, and sometimes even interruptions, which can ultimately impact consumers and patients.
The point of frustration begins with the method in which the track-and-trace requirements are implemented. Most U.S. states with some form of legal cannabis sales (medical and/or adult use) have selected a single mandated technology platform that all operators must use to track and trace their cannabis seeds, plants, and products.
The track-and-trace system selected by the state is independently configured to match the adopted cannabis regulations for that region. Because each state has adopted different cannabis regulations, there are variations in what can and cannot be accomplished within the selected track-and-trace systems, even within the states that have selected the same technology provider.
What is an API?
While the definition of an API may seem complex, at its most basic level, the API is the communication pathway between two (2) systems.
API stands for “Application Programming Interface,” which means that it is a software intermediary that allows two systems to “talk” to each other, meaning communicating and sending or receiving information.
The communication pathway is intended to be two-way, with third-party business management software being able to retrieve (“GET”) information in the track-and-trace system, as well as send (“PUT”) updated information back into the system. Let’s turn to an everyday example of an API integration that most consumers would be familiar with: travel booking applications that aggregate flight information.
Let’s say you are planning a flight for a summer vacation and you have two (2) options:
- Go directly to each airline’s website to search for and compare flight options.
- Or use a third-party travel booking application to simultaneously access all flights across all airlines within your search parameters.
The ability to search and review all the available flights, across many airlines, is because of the airlines’ and applications’ APIs. When you use the travel booking application, it sends the search parameters to the airlines it is connected with via the API. The airline API then sends available flights, seats, and prices to the travel booking application.
In the more sophisticated travel booking applications, you can also purchase the ticket for your flight through the travel booking application, which then also utilizes other APIs for your secure banking/payment information. If all of the APIs are open to send and receive data between the systems, then the transaction is seamless, and all of the required information (identity verification, payment method, etc.) is shared with the airline for your booking.
Understanding API Limitations
State regulators intend for the cannabis track-and-trace technology to serve as a way to accurately collect and record information about the flow of goods in the cannabis industry from “Seed-to-Sale”.
What is consistent across all states (regardless of the track-and-trace technology selected) is the acknowledgment from regulators that the mandated systems are not intended to serve as an operator’s compliance solution or business management software system. The state-mandated track-and-trace systems are not built in a way that would allow a business operator to manage day-to-day operations and transactions between operators and retailers to consumers.
This acknowledgment of the business management limitations within the track-and-trace systems and the need for interoperability with operators’ software is often stated outright by regulators and policymakers and/or codified in regulations, such as in California’s Business and Professions Code.
Instead of directly managing operations within the track-and-trace systems, cannabis businesses utilize 3rd-party software that has been vetted and certified to connect with (and communicate important transaction details to the state systems). Cannabis operators are then relying heavily on third-party software and API integrations for the communication and transmittal of that important information and data.
Software Providers Failures
Now let’s think about how cannabis businesses utilize APIs regularly: for example, Point-of-Sale (POS) software. Regulations require that the cannabis retailer record all sales in the central, state-mandated track-and-trace system, but the actual on-site transaction is conducted through POS software at the checkout.
The retailer is therefore encouraged to use POS software that provides the necessary sales tools and controls that make running the business manageable for all employees (while also providing API integration with state-mandated track-and-trace systems).
Without the API integration, a cannabis retailer would be forced to manually enter all of the details of all of the POS transactions into the track-and-trace system daily. Hundreds of daily sales without an API integration mean many hours of data entry and countless opportunities for human errors in the track-and-trace system. Opportunities abound for inaccurate reporting in the track-and-trace systems with manual entry.
Regulators rely on the track-and-trace system they selected to ensure compliance and consumer safety, although operators are essentially utilizing third-party software to communicate with the track-and-trace system. This is exactly why the cannabis industry must have an open and operating track-and-trace system API at all times. Any time the track-and-trace API malfunctions (limited in communication pathways, delayed in responding to POS requests for information, or just completely down), the cannabis retailer operations are severely impacted, if not altogether halted.
In current situations where the state has mandated a specific software provider, the vendor approves specific POS and other software vendors, but the agreements the vendor has with the state do not allow for direct support to the approved vendors. This causes challenges as a licensee’s POS vendor cannot talk directly to the vendor to get API issues resolved.
There is also no direct line of communication to the approved vendors about changes happening in the state-mandated software provider’s system that affect the API. These types of issues can cause the licensee (cannabis operator) to be out of compliance without even knowing it.
Cannabis Operator’s Perspective
Imagine that you are a Dispensary Technician trained in your employer’s Point-of-Sale (POS) software, compliance, and track-and-trace requirements. Very rarely will you access the statewide system directly because the POS is fully integrated with the track-and-trace API that it is using?
You are working during your daily shift processing retail transactions through the POS, but unfortunately, the track-and-trace API is experiencing high call volumes from all of the other retailers in the state, and the API is not responding to your POS requests.
You cannot complete the transaction in the POS, as usual, so you are forced to complete and track the transaction manually. Later on, you have to spend hours manually entering which unit of product came from which box in the back storeroom, along with all of the customer’s information and time stamps. This takes hours of labor and could lead to mistakes (hey, we’re human!).
As we stated, manual records and entries invite human error. Now the inventory listed in your POS software does not match the statewide track-and-trace system. You spend many more hours trying to find and correct this mistake. The circle of conducting sales transactions, recording and tracking them manually, and fixing errors, widens, all putting your cannabis business at risk.
Because cannabis businesses at every point of the supply chain (ex. cultivation, manufacturing, distribution, and retail) rely on third-party software to manage their operations effectively and efficiently, a hiccup in the track-and-trace API has ramifications for an entire statewide industry at once.
While this sounds like a “perfect storm” scenario that only happens every once in a long while, in reality, track-and-trace API performance issues happen regularly. In California, a group of third-party software integrators reviewed track-and-trace API performance over six months (April 2020 through October 2020) and found that the API was generally up and fully responsive approximately 91 to 98 percent of the time.
While an API performance ranking in the high nineties may seem acceptable, the technology industry considers 99.999% uptime as the standard for high availability. An availability of 94 – 98% means 2 – 6% downtime, which is effectively 3 – 8 hours of downtime per week.
More recently, the California METRC API experienced consistent outages for approximately seventeen (17) consecutive days (February 16, 2021 – March 5, 2021). This extensive outage caused all third-party software integrators serious METRC-sync issues for packages, transfers, and more.
Operators were forced to keep their staff on extensive overtime for more than two weeks to manually enter and/or correct information that was entered into the system while sync issues were occurring. As a result, cannabis businesses suffered as operations were interrupted, additional labor was required, and additional costs were incurred that had to be absorbed by the business.
Government Regulators’ Perspective
Cannabis is a highly regulated industry and regulators are very concerned about the path from cannabis seed to final sale (to a consumer).
The perceived public safety concerns are immense, which is what prompted the implementation of, and requirements, around track-and-trace. Put simply, regulators rely on the “Seed-to-Sale” track-and-trace system they selected and the system is only as good as its uptime. Many regulators focus on the track-and-trace server uptime reporting from their technology providers as an indication of how well things are running.
If the server is up, then an operator can still access and update the track-and-trace system manually, and that is where most regulators stop in their understanding of the issues. API connectivity and performance are just as critical as track-and-trace server uptime to ensure business continuity and accurate data, and accurate data is the entire intent of the state’s mandated technology platforms.
Regulators must assign key technical leads with the sole responsibility of reviewing track-and-trace API limitations and performance issues for their regulated industry. Without skilled technical staff on the state’s side, when the track-and-trace API has issues, no one is aware of the problem (besides technical teams at third-party software providers).
The onus is on the software providers to notify all operators and inform the regulators. This leads to a delayed and fragmented flow of information to operators who are scrambling because their third-party business platforms are shut down. The responsibility of transparent notification around API performance should be on the state-mandated system provider, and no one else.
The current lack of transparency on API performance and downtimes also leads to complete blind spots for the regulators, having not been timely notified that cannabis operations in their state have halted (due to API connectivity). The operators and the state should know the health of their track-and-trace systems at all times so that they can attempt to mitigate the amount of damage an outage inflicts on businesses.
As with many other online platforms with APIs (ex. SAP, Twitter, Intercom, etc.), this is typically done through the establishment of an API status page. At this time, there are no current API status pages for key track and trace vendors and, as stated above, performance issues are largely tracked and reported to regulators by the operators.
In California, there are currently no performance reports required of METRC for their system’s API availability (not including general server/equipment uptime).
Conclusion
The performance deficiencies of track-and-trace APIs are burdensome to the entire legal cannabis industry because they can cause 3rd-party inventory management applications to collapse.
Then operators are forced to duplicate and/or correct entries directly in the track-and-trace system. This amounts to countless hours lost and perpetuates inaccuracies in the data being entered into the system.
Ultimately, the effectiveness of the track-and-trace system diminishes with any amount of downtime. Unfortunately, downtime and interruptions are all too common and the cannabis industry’s needs as a highly regulated industry demand a much higher success rate for its systems.
Let us know what you think.
Responses