MJ Freeway, a Denver-based software company that suffered a major hack in January, was awarded a $10.4 million contract Thursday to track all of Pennsylvania’s medical cannabis commerce from “seed-to-sale.”

The contract is “an important step forward in ensuring that we can get medical marijuana to patients who desperately need it,” Karen Murphy, the secretary of health, said in a statement announcing the award. “This contract serves two important functions for the program: tracking medical marijuana from seed-to-sale; and creating a registry for patients, caregivers, and practitioners to participate in the program.”

 Pa. department of health
Schematic diagram of how information will flow through the Pennsylvania's "seed-to-sale" marijuana tracking system.

Gov. Wolf signed the state's medical marijuana program into law on April 17, 2016. Cannabis has been approved to treat 17 medical conditions including cancer, chronic pain, HIV/AIDS, epilepsy, autism, ALS, and PTSD.

There initially were five bidders but three were disqualified for not meeting basic requirements, according to state documents.

MJ Freeway scored lower on technical merits than its Fort Lauderdale, Fla.-based rival, BioTrackTHC, which earned a perfect score. MJ Freeway, however, undercut the competition on price, according to a state scoring document. 

In January, MJ Freeway was the target of a hack that caused the cannabis businesses to lose data and disrupted medical marijuana commerce at dispensaries. 

"The attack was not an accident," MJ Freeway CEO Amy Poinsett said in an interview Thursday. Though there were business interruptions, "no data was decrypted or extracted from the system"  and patient information remained secure, she said.

An unrelated glitch two months earlier disrupted business for many of the 1,000 customers the company serves, according to Marijuana Business Daily.

The state Health Department was assured that any security issues at the company had been "resolved," a spokeswoman said. 

"MJ Freeway submitted the strongest proposal and was selected on those merits,"  spokeswoman April Hutcheson said.

Marijuana, still considered an illegal drug by the federal government, is tracked like no other consumable commodity.

“No other product gets this level scrutiny. Not liquor, not other agricultural products or pharmaceuticals,” said MJ Freeway’s Poinsett.

Everything that happens in each plant’s life is recorded. Each seedling is assigned an identifying number. As it grows, the cannabis plant’s weight and location are tracked through flowering and eventual harvest. Then it is followed as it moves from processing to packaging and retail sale. The record it leaves behind is akin to a baby’s scrapbook.

“Only with cannabis they would be pink-covered scrapbooks. That’s because we only bring the female plants to harvest,” Poinsett said. “You can see the entire lifecycle from inception to the time its purchased.”

Pennsylvania's tracking system is an adaptation of software — "essentially an off-the-shelf system," Poinsett said — that was prepared for Nevada's marijuana industry. MJ Freeway is working with two Pennsylvania subcontractors, TreCom Systems Group of Havertown and Premier Personal Healthcare of Bethel Park.

There are two reasons for monitoring marijuana so closely. Safety, Poinsett said, is a major concern.

“There have been cases of bad batches,” Poinsett said. If a lab discovers something contaminating a batch of marijuana — a fungus or high concentration of a pesticide, for example —  every plant in the batch must be recalled and destroyed.

“If you need a recall in the case of spinach, we can only put a story out on the news and hope people toss it,” Poinsett said. “Marijuana, of course, is different.”

The system also is designed to prevent any marijuana theft or other diversion.

“We want to make sure that it remains in the legal supply chain,” Poinsett said. “Additionally, we want to keep black market product from being introduced into the supply chain.”