Could the Oregon Health Authority hand local law enforcement a complete list of every medical marijuana grow site address in their jurisdiction?
Plain-English summary
The Oregon Medical Marijuana Act creates a registration system for medical marijuana patients, designated caregivers, and grow site operators. The Oregon Health Authority (OHA) collects names and addresses to make that registration work. Two competing demands sit on top of that data. Patients want it confidential, because their participation in the program is medical and personal. Law enforcement wants access for a range of legitimate purposes, like verifying that a particular property is a registered grow site or investigating diversion of medical product into the illicit market.
Local law enforcement asked OHA two related questions in 2018. First, could OHA just hand over a complete list of medical marijuana grow site addresses for the agency's jurisdiction? Second, could law enforcement provide its own list of all addresses in a jurisdiction and have OHA flag the ones that are registered grow sites?
Attorney General Ellen F. Rosenblum's office said no to both.
The reasoning: ORS 475B.882(1)(b) makes patient names, caregiver names, and grow site addresses confidential by default. ORS 475B.882(2)(b) carves out a law-enforcement disclosure exception, but the carve-out is "only as necessary to verify" that an address is a grow site or that a person is a patient or caregiver. The text reads as an investigation-by-investigation exception, not a bulk-data-sharing arrangement. Verifying every address in a jurisdiction is functionally equivalent to handing over the full list, which the more general law-enforcement disclosure provision (ORS 475B.879(2), allowing OHA to share tracking-database information with law enforcement) does not override; the more specific confidentiality provision controls.
Currency note
This opinion was issued in 2018. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.
Historical summary
Why this came up
Local law enforcement agencies in marijuana-producing parts of Oregon were investigating widespread diversion: marijuana grown under the medical program leaving the state for sale on illicit markets. To investigate, agencies asked OHA for grow site address data they could compare against tips, vehicle registrations, and other inputs. OHA, holding the registry, faced a confidentiality framework that did not obviously authorize bulk transfer.
How the AG resolved the tension
The Medical Marijuana Act has a layered confidentiality scheme. The general rule under ORS 475B.882(1)(b) is that patient names, caregiver names, and grow site addresses are confidential. There are several enumerated disclosure pathways:
- ORS 475B.882(2)(b) lets OHA disclose to law enforcement "but only as necessary to verify" registration status of a specific person or address.
- ORS 475B.882(4) lets OHA share the "minimum amount of information necessary" to enable law enforcement to determine compliance.
- ORS 475B.882(5) covers disclosures arising from OHA's own investigations.
- ORS 475B.888 requires OHA to share disciplinary actions with law enforcement.
- ORS 475B.876 requires a verification hotline for cities, counties, water districts, and the Water Resources Department.
- ORS 475B.879(2) more broadly lets OHA disclose tracking-database information to law enforcement.
The AG read the structure as making confidentiality the default and the disclosure exceptions narrow. The "only as necessary to verify" language in subsection (2)(b) draws the line: case-by-case verification yes, bulk disclosure no. The "minimum amount of information necessary" language in subsection (4) reinforces the case-by-case posture. ORS 475B.879(2)'s broader allowance for tracking-database disclosures was read not to override the more specific confidentiality protection of grow site addresses.
The reverse-direction question, where law enforcement provides a list of all addresses and OHA marks the grow sites, was treated as functionally equivalent to bulk disclosure and rejected on the same basis.
Practical effect
OHA's policy after this opinion: respond to specific verification requests connected to actual investigations, but do not provide aggregate lists of grow site addresses or perform mass cross-referencing. The opinion did not bar all law-enforcement collaboration; it required that collaboration be structured around specific investigative needs.
Common questions
Q: Why are grow site addresses confidential at all?
A: Because the Medical Marijuana Act treats participation in the medical program as protected health-related information. Patients face stigma, theft risk, and privacy concerns; grow site addresses can identify both the grower and the patient.
Q: When can law enforcement get a specific grow site address?
A: Under ORS 475B.882(2)(b), when there is a legitimate law-enforcement need to verify that a particular address is a registered grow site, in connection with an investigation. The verification is one-at-a-time, not en masse.
Q: Can OHA confirm or deny that a tipped address is a grow site?
A: Yes, when there is a legitimate law-enforcement need. The hotline at ORS 475B.876 also allows certain government users (cities, counties, water districts) to verify a specific address.
Q: Can OHA share aggregate program data?
A: Aggregate non-personally-identifiable data (counts of patients, total plant counts, etc.) is generally fine. The opinion is concerned with personally-identifying data linked to specific people or addresses.
Q: Has this rule changed since 2018?
A: The opinion was about the legal framework as of 2018. Subsequent legislation and rulemaking may have adjusted disclosure pathways. Current practice should be verified with OHA's privacy and disclosure policies.
Background and statutory framework
The Oregon Medical Marijuana Act is codified at ORS 475B.785-949 (post-recodification). It establishes registration for patients, caregivers, and grow sites, with monthly tracking-data reporting from grow sites, processing sites, and dispensaries (other than patient self-grow). Confidentiality is the default; specific exceptions exist for law enforcement, regulators, and certain government users.
The opinion's interpretive principle, that a more specific confidentiality provision controls over a more general disclosure provision, is standard Oregon statutory construction. Where the Legislature drew a precise line ("only as necessary to verify"), the AG read that line as binding even when a broader provision could be read to allow more.
Citations and references
Statutes:
- ORS 475B.882(1)(b) (confidentiality of grow site addresses)
- ORS 475B.882(2)(b) (limited law-enforcement disclosure)
- ORS 475B.879(2) (tracking-database disclosure)
- ORS 475B.876 (verification hotline)
Source
- Index page: https://www.doj.state.or.us/oregon-department-of-justice/office-of-the-attorney-general/attorney-general-opinions/
- Original PDF: https://www.doj.state.or.us/wp-content/uploads/2018/08/Op8293.pdf
Original opinion text
Best-effort transcription from a scanned PDF. Minor errors may remain — the linked PDF is authoritative.
FREDERICK M. BOSS
DEPUTY ATTORNEY GENERAL
ELLEN F. ROSENBLUM
ATTORNEY GENERAL
DEPARTMENT OF JUSTICE
Justice Building
1162 Court Street NE
Salem, OR 97301-4096
Telephone: (503) 378-4400
August 21, 2018
No. 8293
This opinion responds to questions from the Oregon Health Authority (OHA) about
disclosing medical marijuana grow site addresses in bulk to local law enforcement.
QUESTIONS AND SHORT ANSWERS
QUESTION 1
Can OHA provide a complete list of medical marijuana grow site addresses to a local law
enforcement agency?
SHORT ANSWER
No. ORS 475B.882(1)(b) makes grow site addresses, patient cardholder names, and
primary caregiver names confidential. ORS 475B.882(2)(b) permits disclosure of this
information to state and local law enforcement, but only as necessary to verify that an address is
a registered grow site, or that a person is a registered patient cardholder or caregiver. This
limitation suggests that disclosure is permitted when there is a legitimate law enforcement need
for the information in the course of a particular investigation. Bulk disclosure of all the grow site
addresses in a particular jurisdiction is inconsistent with this limitation.
Because ORS 475B.882(1)(b) specifically makes grow site addresses confidential and
spells out a specific procedure for disclosing these addresses in certain circumstances, this
confidentiality controls over the more general ORS 475B.879(2), which permits OHA to disclose
information in its tracking database to law enforcement.
QUESTION 2
If a local law enforcement agency provides a list of all addresses within its jurisdiction, is
OHA permitted to verify which addresses are registered grow sites?
SHORT ANSWER
No. OHA may disclose grow site addresses to law enforcement only when there is a
legitimate law enforcement need. Verifying which addresses in a jurisdiction are grow sites
would in effect provide law enforcement with a list of all grow site addresses. Absent a
legitimate and specific law enforcement need, this violates ORS 475B.882(1)(b).
DISCUSSION
OHA administers and enforces the Oregon Medical Marijuana Act, ORS 475B.785 to
475B.949. The Act permits the legal production, processing, transfer, and use of marijuana for
medical purposes.! Personally identifiable information about patients,” their designated primary
caregivers, and the persons they designate to produce marijuana at grow sites, is submitted to
OHA as part of the registration process.’ In addition, registered grow sites, processing sites, and
dispensaries submit monthly reports to OHA tracking the production and transfer of marijuana
plants and products, and usable marijuana.’ OHA is required to maintain a database of this
tracking information,’ which helps OHA to ensure that grow sites comply with possession limits
and that marijuana is transferred only between registered entities and individuals.
Strong confidentiality provisions in the Act protect personally identifiable information.
For example, ORS 475B.882(1)(b) makes patient names, caregiver names, and grow site
addresses confidential. ORS 475B.885(1) makes confidential any personally identifiable
information collected in registering grow sites, processing sites, or dispensaries, with an
exception for names and addresses associated with processing sites and dispensaries. And
ORS 475B.885(2) protects any personally identifiable information submitted with the monthly
tracking data.
' See ORS 475B.907 (providing, with some exceptions, that persons engaged in or assisting in the
medical use of marijuana are exempt from criminal laws for the possession, delivery, and manufacture of
marijuana, as long as they comply with the Act).
- The Act refers to patients who are registered for the medical use of marijuana as “registry
identification cardholders.” We refer to patient cardholders as “patients,” to distinguish them from
caregiver cardholders and grow site cardholders. See OAR 333-008-0010(47) (“patient” has same
meaning as “registry identification cardholder”).
See ORS 475B.797(2)(b) (requiring a patient applying for registration to submit name, address, and
date of birth); ORS 475B.797(2)(e) (requiring a patient who is designating a primary caregiver to provide
the caregiver’s name and address); ORS 475B.810(2) (requiring a patient who produces marijuana or has
designated another person to produce marijuana to provide the address of the grow site and the name of
the person responsible for the grow site).
“ See ORS 475B.816 (grow sites); ORS 475B.846 (processing sites); ORS 475B.867 (dispensaries).
For grow sites, the tracking requirement does not apply to patients who grow for their own use. See
ORS 475B.816 (requiring monthly reports from only “[a] person designated to produce marijuana by a
* * * cardholder”).
ORS 475B.879(1).
However, OHA is permitted or required in certain circumstances to disclose information
to state and local law enforcement, cities and counties, and state agencies. For example,
ORS 475B.882(2)(b) permits OHA to disclose patient names, caregiver names, and grow site
addresses to law enforcement, “but only as necessary to verify that” a person is a registered
patient or caregiver, or that an address is a registered grow site. ORS 475B.882(4) permits OHA
to disclose to state or local law enforcement “the minimum amount of information necessary to
enable [law enforcement] to determine whether an individual or location is in compliance with
[the Act].” ORS 475B.882(5) permits OHA to disclose information it obtains from an
investigation or complaint of an alleged violation of the Act to state or local law enforcement, or
to any other state or local government agency with jurisdiction over the matter. ORS 475B.888
requires OHA to provide information on disciplinary action taken against a grow site, processing
site, or dispensary to law enforcement. ORS 475B.876 requires OHA to maintain a telephone
hotline for verifying to cities, counties, water districts, and the Water Resources Department that
an address is the location of a registered grow site, processing site, or dispensary. And finally,
ORS 475B.879(2) permits OHA to disclose information stored in its tracking database to law
enforcement and city or county regulatory agencies, with some exceptions.
These provisions plainly allow disclosures to law enforcement in specific circumstances or
in the course of a particular investigation. But law enforcement may prefer to receive a bulk list of
patient names, caregiver names, or, in particular, grow site addresses. Two provisions potentially
allow bulk disclosure of grow site addresses: ORS 475B.882(2)(b), which does not expressly
address whether bulk disclosure is permitted; and ORS 475B.879(2), which does not expressly
mention disclosing grow site addresses, whether in individual circumstances or in bulk.
To determine whether either of these provisions permits bulk disclosure of grow site
addresses, we examine the legislature’s intent by considering the statutory text in context, with
reference to pertinent legislative history.’ Context includes “other provisions of the same statute
and other related statutes,”® and statements of statutory policy.” For provisions of the Act that
were enacted by the voters in Ballot Measure 67 in 1998, the same interpretive principles apply.'°
I. ORS 475B.882
ORS 475B.882(1) requires OHA to maintain a confidential list of patient names,
caregiver names, and grow site addresses. ORS 475B.882(2)(b) permits disclosure of
information from the list to state and local law enforcement, “but only as necessary to verify
that” a person is a registered patient or caregiver, or that a location is a registered grow site.
ORS 475B.882(1)(c) complements that provision by requiring OHA to develop a system so that
law enforcement can verify this information.
° We understand OHA to be asking not whether bulk disclosure is permitted under its current rules,
but whether OHA can adopt rules permitting bulk disclosure.
” State v. Gaines, 346 Or 160, 171—72, 206 P3d 1042 (2009).
8 PGE v. Bureau of Labor & Industries, 317 Or 606, 611, 859 P2d 1143 (1993).
° Havi Group LP vy. Fyock, 204 Or App 558, 564, 131 P3d 793 (2006).
'° PGE, 317 Or at 612 n 4, 859 P2d 1143.
The narrow language used in ORS 475B.882(2)(b) indicates an intent to restrict
disclosures to law enforcement to circumstances involving a legitimate law enforcement need in
the course of a particular investigation. That is, it is only “necessary to verify that” a location is
a registered grow site when law enforcement already has some reason to believe that marijuana
is present at that location. The use of “verify” supports this conclusion because the word
presumes that the verifier already has some initial data that needs to be checked or tested.
Specifically, “verify” means “to check or test the accuracy or exactness of: confirm the truth or
truthfulness of by or as if by comparison with known data or a recognized standard of authority”
and “to confirm or establish the authenticity or existence of by examination, investigation, or
competent evidence.”"! In this context, “verify” logically implies that law enforcement already
possesses information about whether a certain location is or is not a grow site. The words “only”
and “necessary” further emphasize that disclosures to law enforcement are restricted.
This conclusion finds contextual support in the surrounding statutory provisions. First,
registration as a patient, caregiver, or grow site “does not constitute probable cause to search the
person or property of the registrant.” ! This indicates that merely registering under the Act
should not warrant law enforcement scrutiny, and suggests that law enforcement does not have a
legitimate need for a bulk list of patients, caregivers, and grow site addresses. Second, the Act
was designed to allow patients with debilitating medical conditions to access marijuana for
medical benefit “without fear of civil or criminal penalties.”'* Bulk disclosure of patient and
caregiver names to law enforcement could stoke fears that the Act expressly seeks to avoid.
Based on this review of text and context, we conclude that ORS 475B.882(1)(b) and
(2)(b) do not allow the bulk disclosure of grow site addresses to law enforcement. Nor may
OHA verify in bulk which addresses in a particular jurisdiction are registered grow sites. M4
I. ORS 475B.879
As of 2015, the Act requires grow sites, processing sites, and dispensaries to submit
monthly reports to OHA tracking the possession and transfer of marijuana plants and products
and usable marijuana.> OHA is required by ORS 475B.879(1) to maintain a database compiling
this tracking information. Under ORS 475B.879(2), OHA may disclose information stored in
this database to law enforcement and city or county regulatory agencies. However, significant
amounts of information are excepted from this permitted disclosure: ORS 475B.882(2)(c) does
not permit the disclosure of “[a]ny information related to the amount and type of usable
" Webster’s Third New Int'l Dictionary 2543 (unabridged ed 2002); see State v. Briney, 345 Or 505,
511, 200 P3d 550 (2008) (courts give words of common usage their plain, ordinary meaning).
2 ORS 475B.922(1).
'S ORS 475B.785(2).
‘4 The pertinent legislative and ballot measure history does not provide any reason to believe that the
voters or legislature intended for the bulk disclosure of patient names, caregiver names, or grow site
addresses.
'S See ORS 475B.816 (grow sites); ORS 475B.846 (processing sites); ORS 475B.867 (dispensaries).
While patients growing their own marijuana do not report tracking data, for brevity’s sake we refer to all
grow sites.
marijuana, medical cannabinoid products, cannabinoid concentrates, and cannabinoid extracts”
transferred to or from grow sites, processing sites, and dispensaries. Because those transfers are
the primary information reported by processing sites and dispensaries, '° these provisions appear
to contemplate disclosures mainly about grow sites’ possession of marijuana plants and usable
marijuana.’
ORS 475B.879 does not expressly require the database to include grow site addresses, or
any other personal identifying information associated with grow sites, processing sites, and
dispensaries. However, context and legislative history suggest that the database would include
such information. First, for the database to be useful to OHA, the tracking data would need to be
associated with the particular grow sites, processing sites, and dispensaries the data was received
from. Second, ORS 475B.885(2) expressly makes confidential any personally identifiable
information submitted to OHA under the tracking statutes (or pursuant to ORS 475B.879), while
ORS 475B.879(2)(c)(A) prohibits OHA from disclosing any personally identifiable information
related to a patient or caregiver from the database. If the database were not to include personally
identifiable information, there would be no reason to make that information confidential. Third,
during a committee work session discussing the database, Representative Peter Buckley
explained that a grow site’s reporting “could be as simple as a * * * one-page document * * *
that says name of grower, location of grow site, number of patients, [and] number of plants.”'®
Because ORS 475B.879(2) permits the disclosure of information stored in the database to
law enforcement, and information stored in the database could include grow sites addresses, it
could be argued that OHA is permitted to disclose these addresses to law enforcement in bulk.
The difficulty with this interpretation is that bulk disclosure conflicts with several other statutes.
First, it conflicts with ORS 475B.882(1) and (2), which, as discussed above, make grow site
addresses confidential and allow disclosure only in specific circumstances. Second, to the extent
the grow site addresses stored in the database come from information collected during
registration, bulk disclosure would conflict with ORS 475B.885(1), which provides that any
personally identifiable information obtained in registering a grow site is confidential. And third,
to the extent the grow site addresses stored in the database come from the monthly reports on
tracking data, bulk disclosure would conflict with ORS 475B.885(2), which provides that any
personally identifiable information submitted to OHA under the tracking statutes or pursuant to
ORS 475B.879 is confidential.
'© See ORS 475B.846 (requiring processing sites to submit information on the transfer of usable
marijuana, and cannabinoid products, concentrates, and extracts); ORS 475B.867 (primarily requiring
dispensaries to submit information on the transfer of usable marijuana, and cannabinoid products,
concentrates, and extracts).
'7 See ORS 475B.816(1) (requiring grow sites to submit possession information on marijuana plants,
usable marijuana, and marijuana leaves and flowers being dried).
'8 Audio Recording, Joint Committee on Implementing Measure 91, SB 844, Apr 27, 2015, at
1:20:15, http://oregon.granicus.com/MediaPlayer.php?clip_id=9435 (emphasis added).
To resolve this conflict, we begin and end with ORS 475B.882(1)(b), which specifically
provides that grow site addresses are confidential. We note that “[w]hen a general provision and
a particular provision are inconsistent, * * * a particular intent controls a general intent.” ° Here,
ORS 475B.882(1) and (2) specifically make grow site addresses confidential, and permit their
disclosure to state and local enforcement only in specific circumstances. ORS 475B.879 refers
more generally to any information stored in OHA’s tracking database, without expressly
providing for the disclosure of grow site addresses.
Statutory context supports this conclusion. At the same time the legislature enacted
ORS 475B.879, it required that OHA provide certain information to law enforcement i in the
event of disciplinary action against a grow site, processing site, or dispensary.”” The legislature
made clear that this disclosure applies “notwithstanding ORS 475B.885,” that is, the disclosure
overrides any confidentiality provided for in ORS 475B.885. 71 However, the legislature did not
provide that ORS 475B.879(2) applies “notwithstanding ORS 475B.882(1)(c).” Because the
legislature was aware of the potential conflict between disclosure and confidentiality provisions
and knew how to resolve this conflict, the lack of “notwithstanding” in ORS 475B.879 suggests
that the legislature did not intend that the disclosure of information from the database overrides
the confidentiality of grow site addresses.
In addition, interpreting ORS 475B.879(2) to allow the bulk disclosure of grow site
addresses is inconsistent with the surrounding statutes that permit disclosure only in certain
circumstances. In addition to ORS 475B.882(2) (allowing the disclosure of patient and
caregiver names and grow site addresses only when there is a legitimate law enforcement need),
ORS 475B.882(4) permits OHA to disclose “the minimum amount of information necessary to
enable [state or local law enforcement] to determine whether an individual or location is in
compliance with [the Act].” The disclosures contemplated by ORS 475B.879(2) fit the statutory
scheme best if interpreted to authorize disclosing data on individual grow sites when there is
already a specific need for such information.
Some legislative history weighs against this conclusion. In describing the amendments
that permitted disclosure of database information, Deputy Legislative Counsel Mark Mayer
explained that, in the context of express restrictions on what could be disclosed to law
enforcement, “I would assume what that would mean would be that information related to actual
license holder and that type of information that’s on the license—address, person who owns,
person responsible for—that would be primarily what would be able to be shared with law
'? ORS 174.020(2).
*° See Or Laws 2015, ch 614, § 85e(2) (permitting disclosures from database); § 88e (requiring
disclosure of disciplinary information notwithstanding other confidentiality provisions). Section 88e was
codified as ORS 475B.464, and subsequently renumbered as ORS 475B.888.
*I See O’mara v. Douglas County, 318 Or 72, 76, 862 P2d 499 (1993) (“The function of a
‘notwithstanding’ clause in the statute is to except the remainder of the sentence containing the clause
from other provisions of a law that is referenced in that particular notwithstanding clause.”).
enforcement * * * .”?? While Mr. Mayer did not explicitly mention the bulk disclosure of grow
site addresses, his comment could be read to suggest that grow site addresses stored in the
database could be disclosed to law enforcement without limitation.
However, in interpreting statutes, “text and context remain primary, and must be given
primary weight in the analysis.”~> To the extent that Mr. Mayer interpreted the wording to
permit bulk disclosure of grow site addresses, his assumption is inconsistent with the express
confidentiality of grow site addresses, and with the surrounding statutory context authorizing
certain disclosures to law enforcement only in specific circumstances. If the legislature intended
ORS 475B.879(2) to primarily serve as a mechanism for the bulk disclosure of personally
identifying information from grow sites, it could have accomplished that end unambiguously.”
In fact, the joint committee considering this legislation had opportunities to adopt amendments
proposing exactly that.”° In particular, the -11 amendments specifically allowed the disclosure of
grow site addresses from the database. They were rejected in light of concerns about the past
attitude of law enforcement towards the legalization of medical marijuana. For example, in
discussing access to the database, Senator Ginny Burdick explained that “not all law enforcement
agencies are supportive of the program, and the issue is where do you draw the line between
effective law enforcement and harassment or just mining for information inappropriately.””°
And Senator Floyd Prozanski noted that “we have seen in previous years where there’s been
documentation where it appears that access to that information has been misused or
misappropriated. 27 At most, the relevant legislative history is ambiguous. It does not persuade
us that we should revise our earlier analysis based upon text and context.”8
Audio Recording, Joint Committee on Implementing Measure 91, SB 844, May 11, 2015, at 26:40,
http://oregon.granicus.com/MediaPlayer.php?clip_id=9617 (discussing the -19 amendments, dated
May 7, 2015). The legislation on database disclosures from Senate Bill 844 was later incorporated into
Senate Bill 964, and then finally enacted as part of House Bill 3400.
3 Gaines, 346 Or at 171, 206 P3d 1042.
*4 We emphasize the disclosure of grow site information, because there is-no prohibition under the
Act for disclosing in bulk the names and addresses associated with processing sites and dispensaries.
See ORS 475B.885(1) (making confidential any personally identifiable information obtained in
registering grow sites, processing sites, and dispensaries, but excepting names and address associated
with processing sites and dispensaries).
> SB 844 (2015), -11 amendments (Apr 29, 2015) (“Except for the address where a marijuana grow
site, marijuana processing site or medical marijuana dispensary is located, the authority may not provide
to a law enforcement agency any personally identifiable information stored in the database * * .);
SB 844, -13 amendments (Apr 30, 2015) (“Upon request, the authority may provide the address of a
marijuana processing site or a medical marijuana dispensary that is stored in the database * * * to a law
enforcement agency.”).
6 Audio Recording, Joint Committee on Implementing Measure 91, SB 844, Apr 29, 2015, at
1:19:42, http://oregon.granicus.com/MediaPlayer.php?clip_id=9486.
*7 Td. at 1:23:30.
°8 See State v. Walker, 192 Or App 535, 545-46, 86 P3d 690 (2004) (legislative history was
inconclusive where single statement of committee counsel was contradicted by legislator’s comments);
see also State v. Stamper, 197 Or App 413, 424-25, 106 P3d 172 (2005) (“[W]e are hesitant to ascribe to
the Legislative Assembly as a whole the single remark of a nonlegislator at a committee hearing.”’).
CONCLUSION
The Oregon Medical Marijuana Act does not allow OHA to disclose grow site addresses
to law enforcement in bulk, or to examine a list of all addresses in a jurisdiction and verify which
are grow sites. Bulk disclosure is inconsistent with the limited disclosures contemplated by
ORS 475B.882(2) and with the surrounding statutory scheme, which allows OHA to provide
information to law enforcement in specific circumstances. Interpreting ORS 475B.882(2) to
allow bulk disclosure of grow site addresses to law enforcement would also allow the bulk
disclosure of patient and caregiver names. That result would conflict with the goal of the
Act to encourage persons with debilitating conditions to take advantage of the medical marijuana
law. And while ORS 475B.879(2) generally allows OHA to disclose information from its
tracking database, the more specific confidentiality of grow site addresses in
ORS 475B.882(1)(b) controls.
Er
EN F. ROSENBL
_ Attorney General
ERI :nog/DM8962466