View source for LIMS Buyer’s Guide for Cannabis Testing Laboratories/LIMS, informatics, and cannabis testing/Data privacy and management

===3.4 Data privacy and management===
Though "strong data security and confidentiality" was listed in Table 2 as a cannabis testing LIMS consideration, more should be said about that consideration. The security of data housed in the LIMS is paramount. Standards like ISO/IEC 17025 require it, as do laws and regulations in many U.S. states. But data security goes beyond complying with standards and regulations; it's an element found in broad areas of the cannabis industry itself.

====3.4.1 Across the broad cannabis industry====
{{Past, Present, and Future of Cannabis Laboratory Testing and Regulation in the United States/Overview of the cannabis industry in the United States/Other areas of concern/Data management}}

====3.4.2 What this means for the lab====
[[File:Logo der ISO.svg|right|200px]]While many cannabis testing laboratories won't be handling medical marijuana patient information, let alone dispensary sales information, lab managers must consider the data privacy issues of those realms and relate them to the data and workflows of the cannabis testing lab. What data must be protected? What standards must be followed to ensure that data's protection? 

Take for example ISO/IEC 17025:2017, item 8.4.2, which requires a lab to have "controls" in place "for the identification, storage, protection, back-up, archive, retrieval, retention time, and disposal of its records."<ref name="KramerISOIEC20">{{cite web |url=https://www.pjlabs.com/downloads/webinar_slides/4.20.2020_Doc-Control-Records.pdf |format=PDF |title=ISO/IEC 17025:2017 Requirements Concerning Document Control and Control of Records |author=Kramer, M. |publisher=Perry Johnson Laboratory Accreditation, Inc |date=20 April 2020 |accessdate=07 July 2021}}</ref> The long-term implication here is that data should be clearly identified, ''securely'' stored, backed up and archived, and have clear information about their retention and disposal. The data should be thoughtfully "controlled" so it doesn't get lost or fall into the wrong people's hands. This is further evidenced by ISO/IEC 17025:2017, item 7.11.3, which calls for the data to be "protected from unauthorized access" and "safeguarded against tampering and loss."<ref name="ShimadzuISOIEC">{{cite web |url=https://www.shimadzu.eu/sites/shimadzu.seg/files/SEG/Landingpages/DataIntegrity/SEG_4547_Whitepaper_ISO_v7_OK.pdf |format=PDF |title=ISO/IEC 17025:2017: General requirements for the competence of testing and calibration laboratories |publisher=Shimadzu Europa |accessdate=07 July 2021}}</ref>

As such, it's obvious that cannabis testing labs, at a minimum, have to take data privacy and management seriously to stay in step with the ISO/IEC 17025 standard. That of course doesn't take into consideration any regulatory requirements for chain of custody and certificates of authority to be preserved by the lab for a specific period of time, nor does it account for any proprietary methods and business details that could potentially harm a lab in the wrong hands. Just like the personal health information of medical marijuana patients, and like the customer information of dispensaries, cannabis testing labs are charged with ensuring the security and privacy of the data they collect and manage.

To meet those requirements and more, a LIMS that includes functionality that helps labs support ISO/IEC 17025:2017, NELAC, ELAP, and Patient Focused Certification (PFC) requirements makes for a wise investment. Cannabis testing workflows can be difficult, as is the management of associated analytical instruments and their data. Throw in the complication of a semi-fractured regulatory atmosphere, and the cannabis testing lab is forced to operate with tight, enforced procedures to ensure not only the quality of tested cannabis substances but also the chain of custody of samples that come into the lab's possession. A LIMS that can carefully and automatically collect, manage, track, retain, and archive operational data—as well as the audit trails associated with those activities—is required to better maintain the security and privacy of that data, as well as the long-term viability of the lab.<ref name="AudinoManag18" />