Can the Virginia Cannabis Control Authority require medical cannabis certifications to be electronic only, or do qualified practitioners still have to be allowed to issue paper certifications?

Plain-English summary

The Virginia Cannabis Control Authority (the Authority) administers the state's medical cannabis program. To buy medical cannabis from a licensed dispensary, a patient needs a "written certification" from a qualified practitioner. The Authority asked the AG whether it could require all such certifications to be electronic or digital, eliminating paper forms.

Attorney General Jason Miyares said no. His reasoning, in plain terms:

• The General Assembly chose the word "written" in the cannabis statute, but did not define it specifically for that statute.
• Virginia law defines "written" generally as "any representation of words, letters, symbols, numbers, or figures, whether (i) printed or inscribed on a tangible medium or (ii) stored in an electronic or other medium and retrievable in a perceivable form."
• That general definition applies "unless the construction would be inconsistent with the manifest intention of the General Assembly."
• The Cannabis Control Act gives the Authority broad regulatory authority but does not include the power to redefine "written" or to exclude paper certifications.
• Other parts of the Act (the requirement to keep "a paper or electronic copy" of certifications, the reference to "the signature or authentic electronic signature") show the General Assembly contemplated both formats.

The opinion concluded that the Authority could not adopt a policy recognizing only digital or electronic certifications and excluding paper certifications.

What this means for you

If you are a Virginia medical cannabis patient

The opinion addressed the Authority's proposed format restriction. It concluded that paper certifications could not be excluded solely because they are on paper. It did not decide whether any particular patient's certification is valid.

If you are a qualified practitioner issuing certifications

The opinion concluded that the Authority could not require electronic or digital certification to the exclusion of paper. The statute still requires a certification to be on a form provided by the Authority; the opinion did not prescribe how that form must be distributed.

If you operate a cannabis dispensary or pharmaceutical processor

The opinion concluded that the Authority could not exclude paper certifications through a digital-only policy. It cited the dispenser recordkeeping rule, which permits a "paper or electronic copy" of the written certification for two years, as evidence that the General Assembly contemplated both formats.

If you are a Virginia legislator

The opinion noted that the General Assembly did not give "written" a different definition in the Act or expressly empower the Authority to define it. The AG said the Legislature could have allowed the Authority to exclude paper but had not done so.

If you advise the Authority on regulations

The opinion recognized the Authority's regulatory powers and its duty to provide an official, uniform certification form containing the statutorily required information. It concluded that those powers did not authorize an electronic-only form policy.

Common questions

Q: Does this mean the Authority can never modernize the certification process?
A: The opinion did not object to digital certifications. It concluded that Virginia's definition of "written" includes both paper and electronic forms, so the Authority could not exclude paper under the statute it analyzed.

Q: What does "written certification" actually have to contain?
A: The opinion says the certification must include information such as the practitioner’s and patient’s contact information and the date. It also quotes the statutory choice between a "signature or authentic electronic signature."

Q: Does the opinion say how the Authority must distribute its certification form?
A: No. It said the Authority must provide an official, uniform form for the required information and cannot require that form to be electronic only. It did not address printing, mailing, or online distribution.

Q: Can the Authority define "written" to exclude paper certifications?
A: The AG concluded that the Authority could not do so. The general definition of "written" includes both tangible and electronic forms, and the Act gave the Authority no power to narrow that definition.

Q: Did this opinion address all cannabis products?
A: No. The request concerned written certifications for the medical use of cannabis products under the program administered by the Authority.

Background and statutory framework

The opinion describes the medical cannabis program that began with limited legislation in 2015, expanded in 2017, and came under the Authority's administration in 2024. Under the program, a qualifying patient needs a written certification from a qualified practitioner to buy medical cannabis products from a licensed processor or dispensing facility.

The opinion quotes Code § 54.1-3408.3 as allowing a practitioner to issue a written certification, subject to § 4.1-1601. That provision requires specified information and says the certification must be "on a form provided by the Authority." The AG read this as requiring an official, uniform form, while leaving paper certifications within the meaning of "written."

The AG also pointed to the Act's allowance of either a "signature or authentic electronic signature" and its requirement that dispensers keep a "paper or electronic copy" of the certification. Those alternatives supported his conclusion that the Legislature contemplated both formats.

Citations and references

• Code § 2.2-505, official advisory opinions
• Code § 4.1-1601, written certification and Authority form
• Code § 4.1-1603, dispensing to holders of a valid written certification
• Code § 54.1-3408.3, practitioner certification

Source

• Landing page: https://www.oag.state.va.us/annual-reports-opinions/official-opinions
• Original PDF: https://www.oag.state.va.us/files/Opinions/2026/25-027-Patten-Issued.pdf

Original opinion text

Best-effort transcription from a scanned PDF. Minor errors may remain; the linked PDF is authoritative.

COMMONWEALTH of VIRGINIA
Office of the Attorney General

Jason S. Miyares
Attorney General

January 14, 2026

202 North Ninth Street
Richmond, Virginia 23219
804-786-2071
Fax 804-786-1991
Virginia Relay Services
800-828-1120
7-1-1

Ms. Jamie Patten
Acting Head & Chief Administrative Officer
Virginia Cannabis Control Authority
9954 Mayland Drive, Suite 3100
Richmond, Virginia 23233

Dear Ms. Patten:

I am responding to your request for an official advisory opinion in accordance with § 2.2-505 of the Code of Virginia.

Issue Presented

You inquire regarding the written certification required for the use of cannabis products for medical purposes. You specifically ask whether the Virginia Cannabis Control Authority (the Authority) may require that the certification be in an electronic or digital format, rather than also accepting paper certifications.

Response

It is my opinion that the Authority may not limit written certifications to electronic or digital certifications.

Background

Although marijuana is still an illegal substance under federal law, the General Assembly amended state law in 2015 to authorize, in limited fashion, the use of cannabis for specified medical purposes. In 2017, the General Assembly enacted additional legislation to regulate the distribution and use of cannabis products for such purposes. Among other provisions, the law conditioned medical use upon a patient and his practitioner registering with the Board of Pharmacy, and the Board of Pharmacy (the Board) was charged with promulgating regulations to implement the legislation. The Board created a licensing program for dispensing cannabis products (the Program).

In 2021, the General Assembly passed sweeping marijuana reforms, which included the enactment of the Cannabis Control Act (the Act). The Act created the Virginia Cannabis Control Authority to address the public "need to control the possession, sale, transportation, distribution, and delivery of retail marijuana and retail marijuana products in the Commonwealth," while the Board of Pharmacy continued to have regulatory oversight over medical uses under the Program. On January 1, 2024, the Authority assumed the duty to administer the Program, which is governed by the Act.

Under the Program, qualifying patients can purchase lawful medical cannabis products from pharmaceutical processors or cannabis dispensing facilities that are licensed by the Authority. To be a "qualifying patient" under the Program, the individual must have a written certification from a qualified practitioner, as required by statute. You advise that, under Board oversight, qualified practitioners used a paper form on which to provide the patients with the required certification. The paper form was a "static PDF" that was printed and filled out by the practitioner and given to the patient, who then used it to purchase medical cannabis. You indicate that, prior to the transfer of regulatory oversight to the Authority, the Board was developing a digital system that was intended to replace the paper forms. You present your inquiry because the Authority is considering a policy that would complete the full transition to digital certifications.

Applicable Law and Discussion

Under the Act, the Authority is vested with broad regulatory powers over the sale, distribution, and delivery of cannabis products. The Authority more specifically is charged with "adopting regulations establishing health, safety, and security requirements for pharmaceutical processors and cannabis dispensing facilities" as part of its permitting of such entities. Because any action taken by the Authority must comport with state law, however, the Authority is "empowered to act only in accordance with standards prescribed by the legislative branch of government," as established by statute.

Per Code § 4.1-1603, permitted pharmaceutical processors and cannabis dispensing facilities may provide cannabis products only to those patients who "ha[ve] been issued a valid written certification." Code § 54.1-3408.3 correspondingly establishes that "[a] practitioner in the course of his professional practice may issue a written certification for the use of cannabis products ... " The issuance of the certification is subject to "the provisions of § 4.1-1601." Code § 4.1-1601 prescribes, among other things, that the certification contain certain information, e.g., contact information for the practitioner and patient and the date of certification. In the same subsection, Code § 4.1-1601 further provides that "[t]he written certification shall be on a form provided by the Authority."

The General Assembly has not defined "written" specifically for purposes of the certification requirement. The Code, however, does otherwise define "written" as "any representation of words, letters, symbols, numbers, or figures, whether (i) printed or inscribed on a tangible medium or (ii) stored in an electronic or other medium and retrievable in a perceivable form ... ." This definition applies "unless the construction would be inconsistent with the manifest intention of the General Assembly." Accordingly, absent clear intent to the contrary, both printed, tangible certifications and electronic or digital certification qualify as "written" under Virginia law.

I find no contrary intent here. The General Assembly did not provide a different definition of "written" or expressly empower the Authority to determine its meaning. That the written certification must be "on a form provided by the Authority" does not establish contrary intent. This simply charges the Authority with the duty to provide an official, uniform form that practitioners must use to ensure that written certifications contain the statutorily required information. It authorizes the Authority neither to define "written" or otherwise direct that the form be electronic only nor to refuse to recognize paper certifications.

Moreover, other provisions of the Act evince that the General Assembly intended "written" to encompass more than just digital documentation. For instance, the certification must include either "the signature or authentic electronic signature"; and dispensers of cannabis products are required to keep "for two years a paper or electronic copy of the written certification"; and when an electronic version is required, the Act expressly so states. These provisions demonstrate that the General Assembly contemplated that both paper and electronic certifications are acceptable means of satisfying the "written certification" requirement. Had the General Assembly intended to allow the Authority to exclude paper certifications as a permissible certification format, it certainly could have done so.

Conclusion

Accordingly, it is my opinion that the Virginia Cannabis Control Authority may not adopt a policy that recognizes only digital or electronic certifications as an acceptable "written certification" and thus excludes paper certifications.

With kindest regards, I am,

Very truly yours,

Jason S. Miyares
Attorney General