On October 1, Connecticut started letting medical marijuana patients registered in other states buy from its licensed dispensaries. Four days later, the state's Department of Consumer Protection had to issue emergency guidance because dispensaries couldn't figure out how to report those purchases correctly.
The problem wasn't fraud or bad actors. It was data. Connecticut's Prescription Monitoring and Reporting System, CPMRS, expects a prescriber's name and DEA registration number along with each transaction. Plenty of out-of-state medical marijuana programs don't require a traditional prescribing physician at all, so that field often arrives empty. Some visiting patients also don't carry the kind of registration number CPMRS was built to log.
Four Days In, the Data Didn't Match
A Connecticut Department of Consumer Protection notice issued October 5 laid out what dispensaries should do about it: document why the prescriber information is missing, explain what steps were taken to get it, and if a patient has no registration number, assign one internally and record it.
The Marijuana Herald was first to report on the guidance, and it's worth reading in full. The underlying law, Public Act 26-8, lets qualifying out-of-state patients buy up to five ounces of flower or its equivalent per month, the same allowance given to Connecticut's own registered patients.
That's a generous policy. It's also one that assumes a reporting system built to receive clean, complete records from a single source can absorb records from fifty different sources overnight.
A system built to receive records from one source doesn't automatically know what to do with records from fifty.
The Fix Is a Workaround, Not a Pipeline
Look closely at what the state actually told dispensaries to do. Write a note explaining the missing field. Make up an internal number when the real one doesn't exist. Keep the paperwork on file for three years.
That's not a data standard. It's a manual patch applied at the counter, by budtenders, at the exact moment a transaction is happening. It works, in the sense that the dispensary stays compliant on paper. But it pushes the burden of reconciling fifty states' worth of registry formats onto the business least equipped to do it, one transaction at a time.
This isn't a Connecticut problem specifically. It's what happens whenever an agency opens a system designed around one data shape to inputs from many. A patient registration number format that works for New York doesn't necessarily mean anything to Oklahoma. A prescriber field that's required in one state's program is blank by design in another. None of that is a defect in Connecticut's system. It's just what reciprocity actually looks like once you build it.
Capture, Transform, Deliver, Observe
This is the exact shape of problem AIRLIFT Connect is built around. Instead of leaving format mismatches to be resolved by whoever happens to be at the counter, a governed pipeline handles them as a defined step.
Capture pulls in the verification data regardless of which state's format it arrived in. Transform applies rules for what to do when a field is missing, assign the internal identifier, flag the record, route it for review, consistently, the same way every time, instead of however the individual filling out the form that day decided to handle it. Deliver sends the normalized record to CPMRS or whatever system of record the agency uses, and if that delivery fails, it's isolated and retried rather than quietly dropped. Observe means every one of those records has a full timeline: when it came in, what was missing, how it was resolved, where it went.
South Dakota's statewide medical cannabis registry runs on exactly this kind of governed pipeline, handling patient and provider data that has to stay both accurate and auditable. The lesson from Connecticut's rollout is what happens without one: workable, but fragile, and dependent on humans catching what the system should have caught.
This Gets Bigger, Not Smaller
Cannabis reciprocity is a small, visible example of a pattern that's showing up across government IT. Professional licensing compacts, interstate benefits verification, vital records sharing: all of them ask a system built for one jurisdiction's data to suddenly make sense of several. Connecticut just happens to be the one working through it in public this month, four days after launch.
More states will pass reciprocity laws like Public Act 26-8. Each one will create the same choice: build the normalization and audit trail in up front, or let frontline staff absorb the gap with sticky notes and internal numbering schemes until someone notices the risk.
If your agency is heading toward that choice, talk to cloudPWR before the workaround becomes the permanent process.