Who's Responsible for Cannabis Safety in Pennsylvania?

Pennsylvania runs one of the largest medical cannabis programs in the country: 438,727 active patient certifications, 196 dispensaries, 9.6 billion dollars in sales since 2018. It also refuses to accept a sample the grower pulled itself. When a batch needs testing, the laboratory does not wait for a courier. It sends its own employee to the farm to cut the sample. Then, once that sample has been through a ten-cannabinoid panel and a full terpene profile, the state declines to show you the report. Here is who keeps Pennsylvania cannabis safe, and where the chain stops short of your hands.

One law, one department

The Medical Marijuana Act, Act 16 of 2016, was signed on 17 April 2016 and has been amended three times, most recently in December 2023. It hands the whole program to a single agency: under Section 301(a) the program "shall be implemented and administered by the department," and the Department of Health holds "regulatory and enforcement authority over the growing, processing, sale and use of medical marijuana." Inside the department the unit is the Bureau of Medical Marijuana. The Department of Agriculture has exactly one job here, publishing the annual list of pesticides a grower may use. No other agency touches the testing or the label.

The detailed rules live in 28 Pa. Code Part IXa, eight chapters that all carry an "a" suffix. Chapter 1151a covers growers and processors, 1161a covers dispensaries and 1171a covers laboratories. They took effect on 4 March 2023, and a date worth holding onto: that is also the day a court first blocked part of them.

Two things set Pennsylvania apart before you reach any laboratory. Smoking is unlawful, so dry leaf is sold only as a vaporization form. And a licensed company may not make an edible at all. The permitted forms are pill, oil, topical, vaporization, tincture and liquid, full stop; a patient may legally cook with their own medicine at home, but no dispensary may sell a gummy. The lozenges and troches the department approves as pill or topical forms arrived under separate departmental guidance that is emphatic on the point: companies "should not refer to the product as edibles."

The laboratory comes to the farm

This is the part Pennsylvania gets right, and it is worth being precise about. Under 28 Pa. Code 1171a.28, "an employee of an approved laboratory may enter a grower/processor facility for the purpose of identifying and collecting samples," and while there that employee "shall identify and collect" samples at harvest, samples of finished product before it goes to a dispensary, samples for stability testing, and anything else the department asks for.

The rule has teeth because of what sits next to it. Section 1171a.31(a) says only results from samples "identified and collected by an employee of an approved laboratory" satisfy the testing requirements. A sample a grower pulls and ships is not a failed test. It is not a test at all.

That was a deliberate choice. In the 2023 final rulemaking the department struck the words "either an employee of a grower/processor or" out of its own draft, explaining that the change "emphasizes that only the laboratory employee should be selecting samples for testing." In a lot of states the company being tested decides which flower goes in the jar. In Pennsylvania it does not.

Six laboratory locations across five companies are approved to do this work: ACT Laboratories at Harrisburg and Trafford, Keystone State Testing in Swoyersville, Steep Hill Pennsylvania in Harrisburg, US Cannalytics in Bethlehem and Coral Reef Labs in Jonestown. Approval runs two years and is tied to the specific address. Two firewalls keep them honest: a laboratory may not "advertise, market or otherwise promote its medical marijuana testing services to the general public," and no principal, owner, financial backer or employee of a cannabis company, and no practitioner, may hold a management, financial or ownership interest in one.

What gets tested, and the one real gap

Eight categories are mandatory: pesticides, solvents, water activity and moisture, THC and CBD, microbiological contaminants, terpenes, heavy metals and mycotoxins. Terpenes being on that list matters, because most states treat them as a marketing extra. In Pennsylvania the laboratory must measure them and the package must print them.

The certificate itself carries ten cannabinoids, four heavy metals, a microbial panel running from total aerobic count through Salmonella, aflatoxins and ochratoxin A, a check for foreign material "such as hair, insects," and a judgment on whether the batch matches its strain specification for odor, appearance, fineness and moisture. One method is banned outright: "PCR testing is not an approved methodology." Samples get plated and counted the slow way.

The numbers behind those categories are not in the regulation. Pennsylvania adopts them by reference, requiring laboratories to "meet or exceed the minimum standards" of the American Herbal Pharmacopeia's Cannabis Inflorescence monograph, 2014 revision. The actual action levels, lead at 1.0 ppm, mercury at 0.2, aflatoxin B1 at 5 ppb, water activity at 0.65, sit in a departmental guidance document from 2018.

And here is the gap. That same guidance says "Testing for pesticides will be randomly done by an approved laboratory on harvest batches or harvest lots." Not every batch, and only at harvest, never on the finished product. It is the one place where practice is narrower than the rule it implements.

Failing is expensive. The original laboratory may retest once. If that fails, the batch is destroyed, with a single exception: flower that failed only for yeast or mold may be extracted into a topical, and the label must then say "remediated." If the retest passes, a second laboratory has to confirm it, and the department can still refuse, demanding a root cause analysis, chain of custody records, a third laboratory's opinion and a sworn statement that the sample "was not subjected to any form of decontamination or remediation." The department noted drily that these requests "sometimes result in a grower/processor abandoning its request."

The part you can check yourself: the label

Pennsylvania prints more on a package than almost anywhere. The department pre-approves every label design, and the required fields run to eighteen items. Some are unusual: the employee identification number of the person who packaged it, and the number of the person who shipped it. The batch identifier. The packaging date, the expiration date, storage instructions, three separate warnings. THC has to be listed first whenever THC and CBD appear as a ratio. A state seal is banned outright, along with cartoons and anything resembling a food brand.

The cannabinoid rule is strict and specific. THC and CBD print even when they are 0.0%, and THCA, THCV, CBDA, CBDV, CBN, CBG, CBC and delta-8 print whenever they clear zero. The cannabinoid concentrations the regulation asks for are percentages, not milligrams.

Which produces the single most confusing thing on a Pennsylvania jar. On a real 3.5-gram flower label, the line reading "THC" says 0.000% and the line under it reading "THCA" says 16.703%. Nothing is wrong with that flower. Raw cannabis is almost entirely THCA, which only becomes THC when heat converts it. The number a patient scans for is the one that means nothing until the vaporizer warms up. The same label listed three terpenes, terpinolene at 0.699%, beta-myrcene at 0.230% and limonene at 0.103%, and it noted the dispensary, the batch and both employee numbers.

What the dispensary adds at the counter is a patient identification number rather than a name, the clerk's number, the process lot number, and a safety insert written and approved by the department covering dosing, dangers, side effects, how to recognize problem use and how to keep it away from anyone under 18.

The report you are not allowed to see

Now the part that makes Pennsylvania an outlier in this series. Under 28 Pa. Code 1171a.31(b), test results "shall be entered into the electronic tracking system and shall only be accessible to the grower/processor submitting the sample and to the Department." The laboratory issues its certificate of analysis "to a grower/processor." Not to the dispensary. Not to you.

There is no route around it. Searching the grower rules, the dispensary rules and the Act itself for "QR," "barcode," "scan code" and "certificate of analysis" returns nothing label-related in any of the three. The label list and the dispensary checklist are exhaustive, and neither contains a lab report, a link or a code. The department's own patient FAQ never mentions the subject.

So Pennsylvania patients get a genuinely rich summary, ten cannabinoids and every terpene above zero, all of it drawn from the process lot test. They simply have no right to the document behind it. Any Pennsylvania brand that publishes a COA is doing it voluntarily.

The two checks that courts blocked

The department designed one more safeguard, and has never once been allowed to use it. The rule at 1171a.29(c) requires that the laboratory testing the finished product be a different laboratory from the one that tested the harvest, so no single lab can walk a batch from field to shelf. The department was candid about why, writing that it "frequently hears allegations from patients that lab results are inflated to reflect higher THC percentages than the product actually contains," while conceding in the same breath that Pennsylvania "has not seen wide-spread corruption in the testing of medical marijuana." It was building a fence before anything got out.

The industry sued, laboratories and growers together, and won an injunction on 4 March 2023, the very day the rules took effect. The Pennsylvania Supreme Court sided with the department on 25 September 2025, holding that the two-lab requirement "does not exceed the regulatory authority granted to the Department by the Act," but sent the case back to decide whether the rule is reasonable. As of today the department's own website says it plainly: "The stay of 1171a.29(c)(1)-(2) remains in place during these proceedings." Three and a half years on, the cross-check has never operated.

Nor is it the only one. In March 2026 a court enjoined the bureau from applying its vape additive rule to botanically derived terpenes. And the mass recall of vaporizer products the department ordered in February 2022, over added ingredients never approved for inhalation, was permanently overturned in 2024 on the ground that it rested on a rule the department had never formally made.

One more data point, offered as a juxtaposition rather than a proven link. In March 2026 a grower recalled oral tinctures labeled 300 mg that actually contained 600 mg, double the dose a patient would have measured. It surfaced through the company, not a public notice, because Pennsylvania publishes no recall register at all.

What it means for you

Reading a Pennsylvania label: add THC and THCA together for a rough sense of strength, rather than reading the THC line alone. Check the packaging date and the expiration date; the grower sets the expiry itself and has to hold stability data behind it.

Wanting the lab report: there is no legal route to it. Asking a dispensary costs nothing, and some brands publish voluntarily, but nothing obliges anyone to hand it over.

Buying over a state line: every neighbor except West Virginia now sells adult-use cannabis, and a New Jersey shop will lawfully sell to a Pennsylvania adult. Carrying it home is still unlawful in Pennsylvania and is federal trafficking besides. Pennsylvania honors no out-of-state card.

Buying delta-8 at a gas station: Pennsylvania has no state law regulating intoxicating hemp, so nothing above guarantees any of it. That is a market with no sampling rule, no panel and no label review.

Expecting recreational sales: not yet. One bill died in committee in May 2025, another has sat in the Senate since July 2025, and legalization was left out of the budget signed in July 2026.

Questions people ask

Who tests cannabis in Pennsylvania? One of six laboratory locations approved by the Department of Health, across five companies. An employee of that laboratory travels to the grower and collects the sample in person, then tests for pesticides, solvents, water activity and moisture, THC and CBD, microbial contaminants, terpenes, heavy metals and mycotoxins, to standards set by the American Herbal Pharmacopeia's 2014 monograph.

Can I get the COA for my Pennsylvania cannabis? Not as of right. The regulation restricts test results to the grower or processor that submitted the sample and to the Department of Health, and no rule requires a QR code, a link or a copy at the counter. What you do get is the summary printed on the label: ten cannabinoids by percentage and every terpene above 0.0%, taken from the process lot test.

Why does my Pennsylvania label say THC 0.000%? Because raw flower is almost entirely THCA, the acidic form, which converts to THC only when heated. A label can honestly read THC 0.000% and THCA 16.703% on the same jar. Pennsylvania requires both lines, and requires THC and CBD to be printed even when they are zero, which is why the confusing pair appears together.

Want to see the whole chain, from the grower to the sealed package, step by step? Play the interactive walkthrough at weed-central.com/learn/coa/usa-pennsylvania (https://weed-central.com/learn/coa/usa-pennsylvania?utm_source=newsletter.weed-central.com&utm_medium=newsletter&utm_campaign=who-s-responsible-for-cannabis-safety-in-pennsylvania), and compare it with how other states and countries do it at weed-central.com/learn/coa (https://weed-central.com/learn/coa?utm_source=newsletter.weed-central.com&utm_medium=newsletter&utm_campaign=who-s-responsible-for-cannabis-safety-in-pennsylvania).

This article is general information, not legal or medical advice. Pennsylvania cannabis rules change; verify current requirements with the Department of Health before relying on any detail.