VA 25-027 January 14, 2026

Can the Virginia Cannabis Control Authority require medical cannabis certifications to be electronic only, or do qualified practitioners still have to be allowed to issue paper certifications?

Short answer: Paper certifications must still be allowed. Attorney General Miyares concluded that the Cannabis Control Authority cannot adopt a digital-only policy because Virginia's general definition of 'written' includes both paper and electronic formats, and the Cannabis Control Act gives the Authority no power to override that definition.

Disclaimer: This is an official Virginia Attorney General opinion. AG opinions are persuasive authority but not binding precedent. This summary is for informational purposes only and is not legal advice. Consult a licensed Virginia attorney for advice on your specific situation.

Plain-English summary

The Virginia Cannabis Control Authority (the Authority) administers the state's medical cannabis program. To buy medical cannabis from a licensed dispensary, a patient needs a "written certification" from a qualified practitioner. The Authority asked the AG whether it could require all such certifications to be electronic or digital, eliminating paper forms.

Attorney General Jason Miyares said no. His reasoning, in plain terms:

The General Assembly chose the word "written" in the cannabis statute, but did not define it specifically for that statute.
Virginia Code § 1-257 defines "written" generally as "any representation of words, letters, symbols, numbers, or figures, whether (i) printed or inscribed on a tangible medium or (ii) stored in an electronic or other medium and retrievable in a perceivable form."
That general definition applies "unless the construction would be inconsistent with the manifest intention of the General Assembly."
The Cannabis Control Act gives the Authority broad regulatory authority but does not include the power to redefine "written" or to exclude paper certifications.
Other parts of the Act (the requirement to keep "a paper or electronic copy" of certifications, the reference to "the signature or authentic electronic signature") show the General Assembly contemplated both formats.

The bottom line: practitioners can still issue paper certifications, and dispensaries must still accept them.

What this means for you

If you are a Virginia medical cannabis patient

Your existing paper certification, if you have one, remains valid. If your practitioner uses a paper certification, dispensaries cannot reject it. If you have not yet seen a registered practitioner, you will be able to receive your certification on either paper or in digital form, depending on what your practitioner uses.

If you are a qualified practitioner issuing certifications

You can continue to use the paper "static PDF" form (or a paper version of any form the Authority provides), or use any electronic system the Authority offers. The Authority cannot force you off paper. The Authority can require you to use an official, uniform form (since the Act says "the written certification shall be on a form provided by the Authority"), but the form can be made available online for you to print, complete, and submit on paper.

If you operate a cannabis dispensary or pharmaceutical processor

Continue accepting both paper and electronic certifications. The opinion is explicit: a digital-only policy by the Authority would not be enforceable against either patients or dispensaries. The dispenser recordkeeping rule (§ 4.1-1603(A)) already requires you to keep "a paper or electronic copy" of the written certification for two years; this opinion confirms that paper remains a permissible original format.

If you are a Virginia legislator

If the policy goal really is to migrate the program to digital-only certifications, this opinion identifies what would have to change. The General Assembly would need to either (a) define "written" specifically for the medical cannabis context to exclude paper, or (b) expressly grant the Authority power to require electronic-only certifications. Without statutory change, the Authority cannot do this on its own.

If you advise the Authority on regulations

The Authority retains broad health, safety, and security regulatory authority over the medical cannabis program (§ 4.1-1602(C)). What it cannot do is exclude paper as a "written" format. If the Authority wants to standardize content (required fields, signature blocks, contact information) it can do so through the official form. It just cannot make the form digital-only.

Common questions

Q: Does this mean the Authority can never modernize the certification process?
A: No. The Authority can develop a digital system, encourage its use, and make it the recommended path, but it cannot ban paper certifications without legislative change.

Q: What does "written certification" actually have to contain?
A: Va. Code § 4.1-1601(B) requires specific information including contact information for the practitioner and patient and the date of certification. The certification must include "the signature or authentic electronic signature" of the practitioner. Other content requirements appear in the implementing regulations at 3 Va. Admin. Code § 10-30-10 et seq.

Q: Can the Authority refuse to print and mail paper forms to practitioners?
A: Footnote 29 of the opinion expressly addresses this. The Authority does not have to print and mail forms. It is enough to make the form available online so that the practitioner can print and complete it.

Q: Why is this even a question? Doesn't every agency get to set its own paperwork rules?
A: Virginia is a Dillon's Rule state. Administrative agencies "may validly act only within the authority conferred upon them by statutes vesting power in them" (Sydnor Pump & Well Co. v. Taylor, 201 Va. 311 (1959)). When the legislature uses a general term like "written" without limiting it, the Code's general definition applies, and the agency cannot narrow it.

Q: Is medical cannabis still illegal under federal law?
A: Yes. Marijuana remains a Schedule I controlled substance under 21 U.S.C. § 841. The opinion notes this at the start as background. Virginia's medical cannabis program operates within the state's authority but does not protect participants from theoretical federal enforcement.

Q: Did this involve recreational marijuana too?
A: No. The opinion is limited to the medical cannabis program administered under Chapter 16 of the Cannabis Control Act, not the broader retail marijuana provisions also created by 2021 Va. Acts ch. 550.

Background and statutory framework

Virginia first authorized limited medical cannabis use in 2015 (2015 Va. Acts ch. 7), allowing written certifications for the use of cannabidiol oil or THC-A oil to treat intractable epilepsy. The 2017 General Assembly expanded the program (2017 Va. Acts ch. 613), and the Board of Pharmacy created a licensing program for dispensing cannabis products.

In 2021, the General Assembly passed the Cannabis Control Act (2021 Va. Acts ch. 550), which created the Virginia Cannabis Control Authority. The Act addressed both adult-use marijuana and medical cannabis. The Board of Pharmacy retained day-to-day oversight of the medical program until January 1, 2024, when the Authority took over (see 2023 Va. Acts ch. 740).

To purchase medical cannabis, a patient must be a "qualifying patient" under § 4.1-1600 and must have a written certification from a qualified practitioner under § 4.1-1601. Section 54.1-3408.3 corresponds, allowing practitioners to issue written certifications "in the course of [their] professional practice." Section 4.1-1601 prescribes the certification's required content and provides that it "shall be on a form provided by the Authority."

The General Assembly did not define "written" in the cannabis-specific provisions. Virginia's general definitions chapter (§ 1-257) defines "written" to include both paper and electronic forms. Under § 1-202, that general definition applies to the Code unless the construction would be "inconsistent with the manifest intention of the General Assembly." The opinion finds no such inconsistent intent in the cannabis statute, and points to other Act provisions (the recordkeeping requirement for "a paper or electronic copy" of certifications under § 4.1-1603(A); the alternative "signature or authentic electronic signature" formulation in § 4.1-1601(B)) as confirming that the General Assembly contemplated both formats.

The opinion sits in a long line of Virginia administrative-law decisions emphasizing that agencies cannot extend their authority beyond what the General Assembly has granted (Cochran v. Fairfax Cnty. Bd. of Zoning Appeals, 267 Va. 756 (2004); Sydnor Pump & Well Co., 201 Va. 311 (1959)). The Authority can carry out its statutorily-granted powers, but cannot expand them by regulatory fiat.

Citations and references

Virginia statutes:
- Va. Code Ann. § 2.2-505 (Official advisory opinions)
- Va. Code Ann. § 1-257 (Definition of "written")
- Va. Code Ann. § 1-202 (Effect of definitions)
- Va. Code Ann. § 1-248 (Supremacy of Constitution and laws)
- Va. Code Ann. § 4.1-1601 (Written certification)
- Va. Code Ann. § 4.1-1603 (Pharmaceutical processors and cannabis dispensing facilities)
- Va. Code Ann. § 54.1-3408.3 (Certification for use of cannabis products)

Federal:
- 21 U.S.C. § 841 (Controlled Substances Act)

Cases:
- Cochran v. Fairfax Cnty. Bd. of Zoning Appeals, 267 Va. 756 (2004)
- Sydnor Pump & Well Co. v. Taylor, 201 Va. 311 (1959)
- City of Va. Beach v. ESG Enters., Inc., 243 Va. 149 (1992)

Source

Landing page: https://www.oag.state.va.us/annual-reports-opinions/official-opinions
Original PDF: https://www.oag.state.va.us/files/Opinions/2026/25-027-Patten-Issued.pdf

Original opinion text

Best-effort transcription from a scanned PDF. Minor errors may remain; the linked PDF is authoritative.

COMMONWEALTH of VIRGINIA
Office of the Attorney General

Jason S. Miyares
Attorney General

January 14, 2026

202 North Ninth Street
Richmond, Virginia 23219
804-786-2071
Fax 804-786-1991
Virginia Relay Services
800-828-1120
7-1-1

Ms. Jamie Patten
Acting Head & Chief Administrative Officer
Virginia Cannabis Control Authority
9954 Mayland Drive, Suite 3100
Richmond, Virginia 23233

Dear Ms. Patten:

I am responding to your request for an official advisory opinion in accordance with § 2.2-505 of the Code of Virginia.

Issue Presented

You inquire regarding the written certification required for the use of cannabis products for medical purposes. You specifically ask whether the Virginia Cannabis Control Authority (the Authority) may require that the certification be in an electronic or digital format, rather than also accepting paper certifications.

Response

It is my opinion that the Authority may not limit written certifications to electronic or digital certifications.

Background

Although marijuana is still an illegal substance under federal law, the General Assembly amended state law in 2015 to authorize, in limited fashion, the use of cannabis for specified medical purposes. In 2017, the General Assembly enacted additional legislation to regulate the distribution and use of cannabis products for such purposes. Among other provisions, the law conditioned medical use upon a patient and his practitioner registering with the Board of Pharmacy, and the Board of Pharmacy (the Board) was charged with promulgating regulations to implement the legislation. The Board created a licensing program for dispensing cannabis products (the Program).

In 2021, the General Assembly passed sweeping marijuana reforms, which included the enactment of the Cannabis Control Act (the Act). The Act created the Virginia Cannabis Control Authority to address the public "need to control the possession, sale, transportation, distribution, and delivery of retail marijuana and retail marijuana products in the Commonwealth," while the Board of Pharmacy continued to have regulatory oversight over medical uses under the Program. On January 1, 2024, the Authority assumed the duty to administer the Program, which is governed by the Act.

Under the Program, qualifying patients can purchase lawful medical cannabis products from pharmaceutical processors or cannabis dispensing facilities that are licensed by the Authority. To be a "qualifying patient" under the Program, the individual must have a written certification from a qualified practitioner, as required by statute. You advise that, under Board oversight, qualified practitioners used a paper form on which to provide the patients with the required certification. The paper form was a "static PDF" that was printed and filled out by the practitioner and given to the patient, who then used it to purchase medical cannabis. You indicate that, prior to the transfer of regulatory oversight to the Authority, the Board was developing a digital system that was intended to replace the paper forms. You present your inquiry because the Authority is considering a policy that would complete the full transition to digital certifications.

Applicable Law and Discussion

Under the Act, the Authority is vested with broad regulatory powers over the sale, distribution, and delivery of cannabis products. The Authority more specifically is charged with "adopting regulations establishing health, safety, and security requirements for pharmaceutical processors and cannabis dispensing facilities" as part of its permitting of such entities. Because any action taken by the Authority must comport with state law, however, the Authority is "empowered to act only in accordance with standards prescribed by the legislative branch of government," as established by statute.

Per Code § 4.1-1603, permitted pharmaceutical processors and cannabis dispensing facilities may provide cannabis products only to those patients who "ha[ve] been issued a valid written certification." Code § 54.1-3408.3 correspondingly establishes that "[a] practitioner in the course of his professional practice may issue a written certification for the use of cannabis products ... " The issuance of the certification is subject to "the provisions of § 4.1-1601." Code § 4.1-1601 prescribes, among other things, that the certification contain certain information, e.g., contact information for the practitioner and patient and the date of certification. In the same subsection, Code § 4.1-1601 further provides that "[t]he written certification shall be on a form provided by the Authority."

The General Assembly has not defined "written" specifically for purposes of the certification requirement. The Code, however, does otherwise define "written" as "any representation of words, letters, symbols, numbers, or figures, whether (i) printed or inscribed on a tangible medium or (ii) stored in an electronic or other medium and retrievable in a perceivable form ... ." This definition applies "unless the construction would be inconsistent with the manifest intention of the General Assembly." Accordingly, absent clear intent to the contrary, both printed, tangible certifications and electronic or digital certification qualify as "written" under Virginia law.

I find no contrary intent here. The General Assembly was aware of the generally applicable definition of "written" when it enacted the Act and created the Authority, but it chose not to provide a different definition nor to confer express power upon the Authority to determine its meaning. That the written certification must be "on a form provided by the Authority" does not establish contrary intent. This simply charges the Authority with the duty to provide an official, uniform form that practitioners must use to ensure that written certifications contain the statutorily required information. It authorizes the Authority neither to define "written" or otherwise direct that the form be electronic only nor to refuse to recognize paper certifications.

Moreover, other provisions of the Act evince that the General Assembly intended "written" to encompass more than just digital documentation. For instance, the certification must include either "the signature or authentic electronic signature"; and dispensers of cannabis products are required to keep "for two years a paper or electronic copy of the written certification"; and when an electronic version is required, the Act expressly so states. These provisions demonstrate that the General Assembly contemplated that both paper and electronic certifications are acceptable means of satisfying the "written certification" requirement. Had the General Assembly intended to allow the Authority to exclude paper certifications as a permissible certification format, it certainly could have done so.

Conclusion

Accordingly, it is my opinion that the Virginia Cannabis Control Authority may not adopt a policy that recognizes only digital or electronic certifications as an acceptable "written certification" and thus excludes paper certifications.

With kindest regards, I am,

Very truly yours,

Jason S. Miyares
Attorney General