The state has started its search for multimillion-dollar software that will form the spine of its medical cannabis program, serving as the repository for sensitive patient information and logging the movements of each marijuana plant.

The choice of one or more vendors for the task will be among the biggest decisions confronting officials as they ramp up the marijuana program created by Utah lawmakers in December. Glitchy systems in some other cannabis states have slowed and occasionally stalled marijuana sales with a quagmire of technical hiccups, delays and security issues, and Utah hopes to avoid a similar fate.

"A lot of the problems we've seen in the past have been for larger programs and earlier on in this wave of medicinal programs," said Andrew Rigby, cannabis program manager for the Utah Department of Agriculture and Food. "I don't anticipate that we're going to have any big problems, but we'll just have to do our due diligence as best as possible."

Developing seed-to-sale software and a user platform for patients and medical providers is also a critical piece of launching the state’s cannabis program on time; officials hope to have the companies picked out by May so they can move on to selecting cannabis cultivators in the second half of this year.

The “drop-dead” date for beginning to accept cannabis patient applications is March 1, 2020, but Rigby said state officials are trying to beat the mandatory deadline.

Why does this decision matter?

By following each plant from the time it’s 8 inches tall to the point of sale, the cannabis-tracking technology should act as a safeguard against diversion into the black market and as a quality-control measure. The other half of the cannabis software will deal with patient and caregiver registration, marijuana recommendations, dosing and sales.

“This system essentially runs the entire program,” said Tom Hudachko, spokesman for the Utah Department of Health.

One piece of the system, the inventory control part, will essentially bar-code each cannabis plant and trace each step of its journey from a cultivation site to the hands of a patient. It’ll record where the raw flower is converted into a tincture, oil or other product and follow it to the local health department or cannabis pharmacy where it’s distributed.

The electronic verification system, on the other hand, will act as a portal for patients, caregivers, pharmacists, physicians and police officers. The patients will be able to apply for a cannabis card across the system, and doctors will have the ability to issue a cannabis recommendation and list a specific dosage on the platform. The system should allow patients to check available cannabis products online and will make sure people aren’t exceeding legal purchasing limits, according to state documents outlining the scope of work for would-be vendors.

The two sides of the system — plant tracking and the patient and physician interface — could be developed and managed by the same vendor or separate companies but must be seamlessly integrated, officials say. The state’s bid solicitation says the system should have capacity for 45,000 users, including patients, medical providers, pharmacists, pharmacy agents, cultivators and processors, among others.

How much access will law enforcement have to patient information?

Police officers will have a portal into the system so they can verify someone’s status as a medical cannabis patient, and giving law enforcement this capability is something of a concern to Connor Boyack, a libertarian who helped design Utah’s new medical marijuana law.

“Providing law enforcement the ability to just get a thumbs-up or thumbs-down as to whether the patient is legitimate and the card is active is the best solution for now, but this is absolutely something we’ll be monitoring and make sure it’s set up narrowly and not subject to abuse,” said Boyack, founder of the Libertas Institute.

The platform will store individual medical profiles and keep track of how much cannabis a patient has purchased over time. But Hudachko said police officers will not be able to see what medical condition has qualified a patient for cannabis treatments and can validate only that the person is authorized to possess the substance. Access to the database will be tightly controlled, he said, with penalties for inappropriately pulling up information.

Boyack said patient groups will be watching the new system for some of the problems that have cropped up with the state’s prescription drug database. A state audit earlier this year found that the database is susceptible to hacking, and a federal judge in 2017 ordered that the state open up the prescription drug information to the Drug Enforcement Administration for warrantless searches.

Proposition 2, the voter-approved initiative on medical cannabis, would have called for the periodic destruction of patient records to assuage fears about what would happen during a federal search, Boyack said. But this provision was left out of the medical cannabis law that Utah legislators approved as a replacement for Prop 2.

While federal law enforcement doesn’t seem inclined to crack down on medical cannabis patients, Boyack said he and others will keep an eye out in any case.

“If we discover the feds are rummaging through the database improperly," he said, “that’s something we would address.”

How will the state pick a winning software developer?

Applications from various vendors will be ranked based on cost and using a weighted scoring system for a company’s technical capability. About half the technical points will be awarded based on the company’s information technology and work implementation plans. The company’s experience, training plan and list of pending lawsuits account for some of the remaining points.

The deadline for turning in an application is April 8 at 2 p.m.

What can go wrong?

Bugs and data breaches, in short. Cannabis business has ground to a halt in Pennsylvania because of hacks and problems with its software, which has been described as “chronically glitchy” by the Philadelphia Inquirer. Washington state, which contracted with the same software vendor as Pennsylvania, has also dealt with a series of problems, including the theft of shipping information in a hack soon after the system’s launch.

Nevada’s system went offline for several weeks in 2017 because of a cyberattack, and, in Maryland, overburdened software lugged along so slowly at first that some frustrated patients left dispensaries empty-handed.

How much will it cost?

The state expects to spend between $2 million and $5 million to build and operate the system for the first five years, Hudachko said.

That’s far less than Pennsylvania, which signed a five-year, $10.4 million contract for its software. On the other hand, Nevada’s four-year contract for the cannabis traceability software (just half of the system Utah is looking for) totaled an estimated $816,000.