Who Can See That I Have a Medical Cannabis Card?

Updated October 4, 2026. If you have a medical cannabis card, the answer to “who can see it?” depends on who holds the information. A clinician’s chart, a state program registry, a dispensary transaction, and an employer’s file can be governed by different rules. This guide explains the questions to ask before you assume a record is private or visible.

Does HIPAA protect a medical cannabis card?

Sometimes HIPAA protects information connected with a medical cannabis recommendation, but it does not automatically cover every copy of a card or every organization that handles card data. The HIPAA Privacy Rule applies to covered health plans, health care clearinghouses, certain health care providers, and their business associates. A provider’s medical record may be protected if the provider is covered. A state registry, dispensary, or employer must be assessed under the rules that apply to that organization. See the U.S. Department of Health and Human Services’ explanation of covered entities.

Even when HIPAA applies, it does not mean information can never be shared. The Privacy Rule permits or requires some uses and disclosures and allows others with the person’s authorization. The HHS Privacy Rule summary explains those categories. State medical-cannabis programs may have separate confidentiality rules.

Which organization holds the record?

• Health care provider: Ask whether the provider is HIPAA-covered, what appears in your chart, and how you can obtain a copy of the record.
• State medical-cannabis program: Read the program’s current privacy notice and law. Ask who may verify a card, what information that verification returns, and whether the registry shares data with other agencies.
• Dispensary: Ask what identification and transaction details it records, who can access them, and how long it keeps them. Do not assume that every dispensary sees only a valid/invalid card response.
• Employer or screening company: Ask what records a specific check includes and what authorization you are asked to sign. HIPAA protection for a provider’s record does not describe every employer or screening record.

Considering a medical card? Review the process in your state.

Will a medical cannabis card appear in a background check?

There is no reliable nationwide yes-or-no answer for every background check. Checks use different sources and serve different purposes. A state registry’s disclosure rules, the type of screening, and any authorization matter. Ask the state program what it discloses and ask the screening provider what sources it checks. A criminal record, if one exists, is a separate record from a medical-cannabis card.

What about a federal background investigation?

Do not treat registry confidentiality as a promise about a federal investigation. For example, the Office of Personnel Management’s SF 85P public-trust questionnaire asks about drug activity and requires complete, truthful answers. Follow the instructions on the form you are actually given. If a question is unclear, ask the responsible agency or a qualified attorney rather than assuming your state card removes a disclosure requirement.

Can an employer find out?

An employer cannot simply obtain protected information from a HIPAA-covered provider whenever it wants. In many circumstances the provider needs your authorization or another legal basis to disclose it. But HIPAA generally does not protect an employer’s own employment records, even when they contain health information. Employers may also ask workers for information in certain settings. See HHS guidance on employers and health information.

Employment protections, testing policies, and permitted disclosures vary by state, employer, and job. Review a request or authorization before signing it. If the question could affect your employment, ask a qualified professional about the rules that apply to your situation.

Do state laws protect medical cannabis patients at work?

Some states provide employment protections for qualifying patients, but the protections and exceptions differ. A card does not establish one nationwide rule for hiring, drug testing, accommodations or workplace impairment. The National Conference of State Legislatures’ employment-policy overview is a starting point; confirm the current law and your employer’s policy for your particular job.

How can you check your own privacy situation?

1. Identify which record you mean: provider chart, state registry, dispensary purchase, workplace file, or screening report.
2. Read that organization’s privacy notice and the current rules for your state program.
3. Ask who may access the record, what they can see, what can be shared without your authorization, and how to request a copy or correct an error.
4. Keep copies of any disclosure or screening authorization you sign.

This article explains general U.S. privacy rules. State registry, dispensary, screening, and employment rules vary; check the current rules where you live.