N.Y.
Cannabis Law Section 32
Registry identification cards
1.
Upon approval of the certification, the office shall issue registry identification cards for certified patients and designated caregivers. A registry identification card shall expire as provided in this article or as otherwise provided in this section. The office shall begin issuing registry identification cards as soon as practicable after the certifications required by this chapter are granted. The office may specify a form for a registry application, in which case the office shall provide the form on request, reproductions of the form may be used, and the form shall be available for downloading from the board’s or office’s website.2.
To obtain, amend or renew a registry identification card, a certified patient or designated caregiver shall file a registry application with the office, unless otherwise exempted by the board in regulation. The registry application or renewal application shall include:(a)
in the case of a certified patient:(i)
the patient’s certification, a new written certification shall be provided with a renewal application if required by the office;(ii)
the name, address, and date of birth of the patient;(iii)
the date of the certification;(iv)
if the patient has a registry identification card based on a current valid certification, the registry identification number and expiration date of that registry identification card;(v)
the specified date until which the patient would benefit from medical cannabis, if the certification states such a date;(vi)
the name, address, and telephone number of the certifying practitioner;(vii)
any recommendation or limitation by the practitioner as to the form or forms of medical cannabis or dosage for the certified patient;(viii)
if the certified patient designates a designated caregiver, the name, address, and date of birth of the designated caregiver, and other individual identifying information required by the board;(ix)
if the designated caregiver is a cannabis research license holder under this chapter, the name of the organization conducting the research, the address, phone number, name of the individual leading the research or appropriate designee, and other identifying information required by the board; and(x)
other individual identifying information required by the office;(b)
in the case of a designated caregiver:(i)
the name, address, and date of birth of the designated caregiver;(ii)
if the designated caregiver has a registry identification card, the registry identification number and expiration date of that registry identification card; and(iii)
other individual identifying information required by the office;(c)
a statement that a false statement made in the application is punishable under section 210.45 of the penal law;(d)
the date of the application and the signature of the certified patient or designated caregiver, as the case may be;(e)
any other requirements determined by the board.3.
Where a certified patient is under the age of eighteen or otherwise incapable of consent:(a)
The application for a registry identification card shall be made by the person responsible for making health care decisions for the patient.(b)
The designated caregiver shall be:(i)
a parent or legal guardian of the certified patient;(ii)
a person designated by a parent or legal guardian;(iii)
an employee of a designated caregiver facility, including a cannabis research license holder; or(iv)
an appropriate person approved by the office upon a sufficient showing that no parent or legal guardian is appropriate or available.4.
No person may be a designated caregiver if the person is under twenty-one years of age unless a sufficient showing is made to the office that the person should be permitted to serve as a designated caregiver. The requirements for such a showing shall be determined by the board.5.
No person may be a designated caregiver for more than four certified patients at one time; provided, however, that this limitation shall not apply to a designated caregiver facility, or cannabis research license holder as defined by this chapter.6.
If a certified patient wishes to change or terminate his or her designated caregiver, for whatever reason, the certified patient shall notify the office as soon as practicable. The office shall issue a notification to the designated caregiver that their registration card is invalid and must be promptly destroyed. The newly designated caregiver must comply with all requirements set forth in this section.7.
If the certification so provides, the registry identification card shall contain any recommendation or limitation by the practitioner as to the form or forms of medical cannabis or dosage for the certified patient.8.
The office shall issue separate registry identification cards for certified patients and designated caregivers as soon as reasonably practicable after receiving a complete application under this section, unless it determines that the application is incomplete or factually inaccurate, in which case it shall promptly notify the applicant.9.
If the application of a certified patient designates an individual as a designated caregiver who is not authorized to be a designated caregiver, that portion of the application shall be denied by the office but that shall not affect the approval of the balance of the application.10.
A registry identification card shall:(a)
contain the name of the certified patient or the designated caregiver as the case may be;(b)
contain the date of issuance and expiration date of the registry identification card;(c)
contain a registry identification number for the certified patient or designated caregiver, as the case may be and a registry identification number;(d)
contain a photograph of the individual to whom the registry identification card is being issued, which shall be obtained by the office in a manner specified by the board in regulations; provided, however, that if the office requires certified patients to submit photographs for this purpose, there shall be a reasonable accommodation of certified patients who are confined to their homes due to their medical conditions and may therefore have difficulty procuring photographs;(e)
be a secure document as determined by the board;(f)
plainly state any recommendation or limitation by the practitioner as to the form or forms of medical cannabis or dosage for the certified patient; and(g)
any other requirements determined by the board.11.
A certified patient or designated caregiver who has been issued a registry identification card shall notify the office of any change in his or her name or address or, with respect to the patient, if he or she ceases to have the condition noted on the certification within ten days of such change. The certified patient’s or designated caregiver’s registry identification card shall be deemed invalid and shall be promptly destroyed.12.
If a certified patient or designated caregiver loses his or her registry identification card, he or she shall notify the office within ten days of losing the card. The office shall issue a new registry identification card as soon as practicable, which may contain a new registry identification number, to the certified patient or designated caregiver, as the case may be.13.
The office shall maintain a confidential list of the persons to whom it has issued registry identification cards. Individual identifying information obtained by the office under this article shall be confidential and exempt from disclosure under article six of the public officers law.14.
The board shall verify to law enforcement personnel in an appropriate case whether a registry identification card is valid and any other relevant information necessary to protect patients’ rights to medical cannabis by confirming compliance with this article.15.
If a certified patient or designated caregiver willfully violates any provision of this article as determined by the board, his or her certification and registry identification card may be suspended or revoked. This is in addition to any other penalty that may apply.16.
The board shall make regulations for special certifications, which shall include expedited procedures and which may require the applicant to submit additional documentation establishing the clinical basis for the special certification. If the board has not established and made available a form for a registry application or renewal application, then in the case of a special certification, a registry application or renewal application that otherwise conforms with the requirements of this section shall not require the use of a form. * NB Effective until February 19, 2026 * § 32. Validating medical cannabis certifications.1.
When presented with a certification from a practitioner, registered organizations shall confirm certifications and government-issued photo identifications, pursuant to subdivision four of § 30 (Certification of patients)section thirty of this article, of certified patients and designated caregivers upon the production of such documentation by the certified patient or designated caregiver as determined by the board in regulation.2.
Registered organizations shall validate patient certifications and designated caregiver registrations in a manner determined by the office. The authorized representative of a registered organization shall designate and authorize specific employees to conduct the validation.(a)
When dispensing medical cannabis, authorized registered organization employees shall not dispense any medical cannabis to a certified patient or a designated caregiver unless the certified patient or designated caregiver presents to the authorized registered organization employee a valid certification from a practitioner and a valid government-issued photo identification, which the authorized registered organization employee shall use to validate that such person is eighteen years of age or older and capable of consent as documented on the certification, provided that such valid government-issued photo identification is issued by the commissioner of motor vehicles, a local government agency within the state, the federal government, any United States territory, commonwealth or possession, the District of Columbia, a state government within the United States, or is a valid passport issued by the United States government or any other country, or is an identification card issued by the armed forces of the United States.(b)
The authorized representative of the registered organization shall promptly notify the office if at any time any unauthorized person accesses patient certification or designated caregiver data, if there is evidence of tampering or fraud, or any other circumstances as determined by the board in regulation. 2-a. A certified patient may designate a caregiver. The designation of the caregiver and registration of the caregiver shall be determined by the board in regulation. The designated caregiver application or renewal application shall include:(a)
the name, address, and date of birth of the designated caregiver, and other individual identifying information required by the board;(b)
the name and date of birth for each certified patient the designated caregiver is designated to care for;(c)
if the designated caregiver is a cannabis research license holder under this chapter, the name of the organization conducting the research, the address, phone number, name of the individual leading the research or appropriate designee, and other identifying information required by the board;(d)
a statement that a false statement made in the application is punishable under section 210.45 of the penal law;(e)
the date of the application and the signature, which may be electronic, of the designated caregiver; and(f)
upon approval of the designated caregiver application, the office shall provide the designated caregiver with a code, including but not limited to a quick response (QR) code, that the designated caregiver must present to the registered organization when obtaining medical cannabis product or products.3.
Where a certified patient is under the age of eighteen or otherwise incapable of consent:(a)
The certifying practitioner must obtain consent from the person legally authorized to make health care decisions on behalf of the patient for the use of medical cannabis product or products and any device used for its administration.(b)
At least one designated caregiver is required to be provided upon certification of the patient. The designated caregiver shall be:(i)
a parent or legal guardian of the certified patient;(ii)
a person designated by a parent or legal guardian;(iii)
an employee of a designated caregiver facility, including a cannabis research license holder; or(iv)
an appropriate person approved by the office upon a sufficient showing that no parent or legal guardian is appropriate or available.4.
No person may be a designated caregiver if the person is under eighteen years of age unless a sufficient showing is made to the office that the person should be permitted to serve as a designated caregiver. The requirements for such a showing shall be determined by the board.5.
No person may be a designated caregiver for more than four certified patients at one time; provided, however, that this limitation shall not apply to a designated caregiver facility, or cannabis research license holder as defined by this chapter.6.
If a certified patient wishes to change or terminate their designated caregiver, for whatever reason, the certified patient shall notify the office as soon as practicable. The office shall issue a notification in a manner determined by the office to the designated caregiver that their registration is invalid and shall promptly remove such designated caregiver’s registration from the registry. The newly designated caregiver must comply with all requirements set forth in this section.7.
A certified patient shall notify their practitioner of any change in their name or address and the practitioner shall update the certification accordingly.8.
A designated caregiver who has been issued a registration shall notify the office of any change in their name or address in a manner determined by the office.9.
If a certified patient or designated caregiver willfully violates any provision of this article as determined by the board, their certification, and in the case of the designated caregiver, their registration may be suspended or revoked. This may be in addition to any other penalty that would apply.10.
The maintenance and access of records pertaining to certifications, registrations, certified patients and designated caregivers shall be in compliance with the federal health insurance portability and accountability act of 1996, and with all privacy and confidentiality protections afforded to individuals under the law. Information obtained by the office under this article shall be confidential and exempt from disclosure under article six of the public officers law.11.
Any practitioner or registered organization authorized representative or employee who is found to have knowingly and fraudulently manipulated certified patient or designated caregiver information, or whose knowing and negligent behavior or knowing actions directly related to their duties pursuant to this section results in a serious threat to the health and safety of a certified patient or patients, is guilty of a class A misdemeanor. In the case that this misdemeanor complaint has been filed against a practitioner, the board or office may additionally refer any relevant internal findings to the department of health or the state education department if the board or office concludes the violation may warrant professional disciplinary intervention. * NB Effective February 19, 2026
Source:
Section 32 — Registry identification cards, https://www.nysenate.gov/legislation/laws/CAN/32 (updated Nov. 28, 2025; accessed Dec. 6, 2025).
