Recent State Law Developments Regarding Medical Cannabis Create New Compliance Considerations for Health Care Facilities

In the 2025-2026 legislative sessions, several states have introduced and enacted legislation addressing the use of medical cannabis in health care facilities. These state bills, which are modeled on a few state laws already in place—most notably, Ryan’s Law in California—seek to address longstanding legal and operational barriers arising from federal law that make it difficult for patients to access state-authorized medical cannabis products in health care facilities like hospitals, SNFs, and hospices.

Given this growing wave of state legislation addressing medical cannabis in health care facilities, providers would be well advised to begin considering and adopting compliance strategies for patient use of medical cannabis.   

Federal Treatment of Medical Cannabis

As a condition of participating in Medicare, Medicaid, and other Federal health care programs (FHCPs), FHCP-enrolled hospitals and other health care facilities are required to comply with applicable federal and state laws relating to the health and safety of patients,¹ including laws governing controlled substances. Since the federal Controlled Substances Act (CSA) was enacted in 1970, cannabis has been classified as a Schedule I controlled substance, meaning that federal law considers cannabis to have “no currently accepted medical use” and prohibits (among other things) the manufacture, possession, and use of cannabis for any reason. Despite the federal prohibition, forty states, the District of Columbia, and several US territories have legalized some form of cannabis cultivation, processing, distribution, sale, and use. Today, almost three-quarters of Americans live in a state that has legalized some form of cannabis. 

Since December 2014, Congress has sought to address this tension between federal and state laws by including a provision in annual spending bills preventing federal prosecutors from using federal funds to impede the implementation of medical cannabis laws enacted at the state level.² Courts have interpreted the provision to bar DOJ from prosecuting any person or entity operating in strict compliance with state medical cannabis laws.³

The last several years have also seen major changes to federal cannabis policy. Most recently, in December 2025, President Trump issued an Executive Order (EO) requiring DOJ to “take all necessary steps” to reschedule cannabis from Schedule I of the CSA to Schedule III “in the most expeditious manner.” While rescheduling will not legalize the existing state cannabis programs—even those limited to medical use—the EO recognizes that cannabis has currently accepted medical uses in the US and potentially reduces any perceived federal enforcement risk of state legal cannabis programs.⁴

Current State Laws Regarding Medical Cannabis in Health Care Facilities

In connection with the establishment of state cannabis programs, a number of states enacted legislation addressing patients’ use of medical cannabis in health care facilities. To date, most of these laws have been permissive in nature, permitting (but not requiring) certain health care facilities to allow qualifying patients to use medical cannabis onsite or protecting employees from prosecution. New York, for example, permits hospitals to authorize patients to bring in their own medications, including medical cannabis.⁵ Virginia protects employees of SNFs, hospices, and assisted living facilities from prosecution for possessing or distributing cannabis oil to patients with valid certifications.⁶ 

Some states have gone even further, mandating that certain health care providers permit qualifying patients to use medical cannabis onsite. In 2021, California became the first state to enact such a law—commonly referred to as “Ryan’s Law”—requiring certain types of health care facilities to (i) permit the use of medical cannabis on their premises by qualifying patients, (ii) incorporate cannabis use into the patient’s medical record, and (iii) implement written policies for the use, storage, and disposal of medical cannabis.⁷ The California law applies to acute care hospitals, special hospitals, SNFs, congregate living health facilities, hospice facilities, and home health agencies. Qualifying patients, which include terminally ill patients and certain chronically ill patients,⁸ must provide evidence of a valid medical cannabis card or physician recommendation.

Recognizing that the use of cannabis is illegal under federal law and that many of these facilities receive federal funding—through Medicare, Medi-Cal, and other FHCPs and grants—California’s law includes a safe harbor provision. Health care facilities in California may “suspend” permitting qualifying patients to use medical cannabis on the premises if:

• DOJ or another federal agency “initiates enforcement action, including a notice to suspend funding, against a health care facility related to the facility’s compliance with a state-regulated medical [cannabis] program,” or

• DOJ, CMS, or another federal agency “issues a rule, guidance, or otherwise provides notification to the health care facility that expressly prohibits the use of medical [cannabis] in health care facilities or otherwise prohibits compliance with a state-regulated medical [cannabis] program.”

Notably, this safe harbor “does not permit a health care facility to prohibit patient use of medicinal cannabis due solely to the fact that cannabis is a Schedule I drug” or because of “other federal constraints on the use of medicinal cannabis” that were in existence prior to the enactment of Ryan’s Law.

Perhaps also due to its tension with federal law, California’s law does not include strict enforcement mechanisms. The law provides for enforcement by the California Department of Health, but does not specify any particular penalties or explicitly provide for a private right of action. Under the law, compliance with its provisions “shall not be a condition for obtaining, retaining, or renewing a license as a health care facility.”

New State Initiatives

In the 2025-2026 legislative sessions, state legislatures have introduced a wave of bills styled on Ryan’s Law, with varying obligations and scope. The table below presents a list of recently enacted state legislation, as well as state bills currently under consideration.

In addition to varying based on the types of health care facilities covered and whether onsite use of medical cannabis is permitted or required, the state bills described above also vary in terms of (i) which patients qualify to use medical cannabis onsite and (ii) the scope of the facility’s obligations (e.g., implementing medical cannabis policies).

As with Ryan’s Law in California, these proposed and enacted state laws do not include strict enforcement mechanisms. The laws are silent on private rights of action for patients and do not specify penalties for non-compliance. Moreover, most of these bills explicitly provide that compliance with the medical cannabis provisions shall not be a condition for obtaining, retaining, or renewing a license as a health care facility.

Implications

As reflected above, even in the absence of federal rescheduling, several states have enacted or are considering laws that would permit or require health care facilities to allow certain patients to use medical cannabis onsite. Rescheduling may encourage even more states to consider similar legislation.

Given the uptick in state bills similar to Ryan’s Law, hospitals and other health care facilities would be well advised to begin considering and adopting compliance strategies for patient use of medical cannabis onsite.

For example, health care facilities may wish to consider the following:

• State Variation: Health care facilities operating in multiple states should be aware that laws modeled on Ryan’s Law requirements vary by jurisdiction. Some states require facilities to permit medical cannabis use, while others merely permit hospitals to allow use onsite. Multi-state providers would be well advised to conduct a state-by-state analysis of applicable requirements and tailor their policies accordingly. Given how quickly this area of law evolves, providers also may wish to regularly review state laws addressing the use of medical cannabis in health care facilities to ensure that any state law updates are timely identified and addressed.

• Internal Policy Development: Facilities located in states that currently have or are considering “permissive” laws for medical cannabis use onsite at health care facilities may want to consider whether they intend to permit patients to use medical cannabis onsite and, if not, should ensure that their policy rationale is clearly documented and communicated to patients and staff. Facilities that currently have or are considering “mandatory” laws should evaluate their current policies on medical cannabis to ensure alignment with state law requirements. For example, facilities may wish to develop comprehensive written guidelines addressing storage, administration, designated caregivers, and permissible forms of cannabis, as several bills require such policies as a condition for compliance.

• Options for Mitigating FHCP Participation Risks: Although DOJ has not enforced the CSA against cannabis companies complying with state laws for more than eleven years, cannabis use is still prohibited in most circumstances under federal law and even once rescheduled, would require a valid prescription to be legally dispensed under the CSA. At the same time, health care facilities located in states mandating providers permit medical cannabis use onsite remain legally obligated to follow state law. Accordingly, in states that have or are considering mandatory laws, health care facilities participating in Medicare, Medicaid, or other FHCPs may wish to confirm whether the state law includes a safe harbor provision that allows suspension of compliance if federal enforcement action is initiated. Those facilities also may wish to stay up-to-date on federal enforcement actions that may require them to invoke the safe harbor.

1. See, e.g., 42 C.F.R. § 482.11(a) (requiring hospitals participating in Medicare to comply with “applicable Federal laws related to the health and safety of patients”) and § 482.25(b) (requiring hospitals participating in Medicare to “provide patient safety” by ensuring that drugs and biologicals are “controlled and distributed in accordance with applicable standards of practice, consistent with Federal and State law”). ↩︎
2. The current rider was included in the Commerce, Justice, Science; Energy and Water Development; and Interior and Environment Appropriations Act, 2026. Pub. L. No. 119-74, Div. A, § 531, https://www.congress.gov/bill/119th-congress/house-bill/6938/text#idbcb051de1fbe4aa1b10848e639136b61. ↩︎
3. See, e.g., United States v. McIntosh, 833 F.3d 1163 (9th Cir. 2016). ↩︎
4. The EO also directed the HHS Secretary, FDA Commissioner, CMS Administrator, and NIH Director to “develop research methods and models utilizing real-world evidence to improve access to hemp-derived cannabinoid products in accordance with Federal law and to inform standards of care.” Consistent with that directive, CMS launched a new Substance Access Beneficiary Engagement Incentive (Substance Access BEI), effective April 1, 2026 that allows providers participating in certain CMS Innovation Center Models “to consult with eligible beneficiaries about the possible use of eligible hemp products to improve symptom control.” Providers that choose to implement this optional benefit are permitted to furnish up to $500 worth of eligible hemp products per year to an eligible beneficiary, subject to the relevant Innovation Center Model’s requirements and safeguards. Like rescheduling, the Substance Access BEI signals further entrenchment of cannabinoid therapies in legitimate medical environments. ↩︎
5. N.Y. Comp. Codes R. & Regs. Tit. 10 § 405.5(c)(5). ↩︎
6. Va. Code § 18.2-251.1:2. ↩︎
7. Cal. Health & Safety Code §§ 1649 et seq. ↩︎
8. Under Ryan’s Law, a qualifying patient is an individual who is (i) terminally ill or (ii) is over 65 years of age with a chronic disease for which the patient has received a physician’s assessment declaring that the patient has a “serious medical condition” (as defined under California’s medical marijuana program) and that the use of medicinal cannabis is appropriate. ↩︎