Every legal cannabis market has to answer one question before it answers any other: who holds the list of patients? Most states put it inside a health department. Texas put it inside the Department of Public Safety.

The Compassionate Use Registry of Texas — CURT — is operated by DPS. DPS licenses the dispensing organizations. DPS is also the state police. And under HB 46, the 2025 expansion now working through its selection phases, the number of licensed dispensing organizations goes from three to fifteen, with twelve new operators entering the program.

That’s twelve new data custodians, most of them building a cannabis compliance stack for the first time, plugging into a registry housed at a law enforcement agency — two weeks after Texas reclassified delta-8, delta-10, THCP, and most other manufactured non-delta-9 cannabinoids as Schedule I on July 31, 2026.

The individual pieces are all defensible. The combination is a privacy architecture worth understanding before you operate inside it.

What CURT Actually Is

CURT is the state’s secure online registry of qualified physicians who prescribe low-THC cannabis and the patients they prescribe to. Dispensing organizations query it to confirm that a person presenting for product has a valid entry. It is the gating mechanism for the entire program — no CURT entry, no dispensing.

It is also, per DPS’s own description, accessible to state and local law enforcement agencies, which can call the department during business hours to verify a patient’s status or a dispensary employee’s status.

Read that again in the context of a state that just criminalized a category of products its residents were buying legally in July. The registry that proves you are a lawful patient is maintained by, and queryable by, the agency that would investigate you if you were not.

Why This Matters More Than It Did Last Month

Three things changed the risk calculus in 2026.

The hemp ban created a population in transition. Texans who were purchasing hemp-derived THC legally through July 31 now have three options: stop, buy illicitly, or enter the medical program. The third option converts an anonymous retail customer into a named entry in a state police database with a documented qualifying condition. That is a genuine privacy decision, and patients are largely making it without anyone explaining the trade-off.

The surveillance layer got denser. Texas operates the country’s largest plate-reader footprint, with 206 local and county agencies now sharing ALPR data with DPS — the same agency that runs CURT. We covered what cross-border plate surveillance does to cannabis privacy earlier this month. A registry and a movement database inside the same organization are, functionally, correlatable even if no one has correlated them.

Qualifying conditions expanded dramatically. HB 46 added chronic pain, PTSD-adjacent categories, traumatic brain injury, Crohn’s disease, terminal illness, hospice and palliative care to a list already including cancer, epilepsy, MS, ALS, and autism. Every one of those is a diagnosis. A registry entry is no longer “this person may buy cannabis” — it is increasingly “this person has this condition,” which is health data under any reasonable reading, and which we’ve argued is health data almost everywhere in the world regardless of what the local statute calls it.

The Federal Wrinkle: Guns, Employment, and Immigration

Registry participation has collateral consequences that operators are not obligated to explain but should not pretend don’t exist.

Federal law still bars unlawful users of a controlled substance from possessing firearms, and the ATF’s Form 4473 question has generated litigation in multiple states. Federal employment, security clearances, commercial driver licensing, and immigration proceedings all treat cannabis use as disqualifying to varying degrees. In a state where the registry lives at a police agency, patients reasonably ask what a registry entry can be used for later.

The honest operator answer is not reassurance. It’s: here is what we collect, here is what we’re required to transmit, here is what we keep, and here is how long. Patients can make their own decisions with accurate information. They cannot make them with a privacy policy that says “we take your privacy seriously.”

What the Twelve New Licensees Should Build First

New TCUP operators are in the most dangerous phase of a cannabis business’s security life: pre-revenue, capital-constrained, hiring fast, and standing up a technology stack chosen on demo quality rather than security review. The failure modes are well documented. Every major cannabis breach of the last two years has come through the same handful of doors.

Query, don’t copy. CURT is a verification service. The correct pattern is to query it at the point of sale, record that verification occurred with a timestamp and a staff ID, and store nothing else. Local caching of registry data — “so we don’t have to look it up every time” — creates a shadow patient database with none of the state’s controls and all of the liability. This is the same verify-don’t-store discipline that age gates require, applied to clinical status.

Segment medical data from everything else. Patient status, prescribing physician, and condition-adjacent fields belong in a system with its own access controls, its own audit log, and its own retention clock — not in the general POS customer profile, and never in the marketing platform. The HIPAA gap means the law may not force you to do this. Litigation and breach exposure will.

Assume your POS vendor is your biggest risk. The industry’s largest customer-data exposures have run through point-of-sale and vendor integrations rather than direct attacks on dispensaries. Run a real vendor security assessment before signing, and understand that a breach of your POS provider is effectively a breach of your compliance data too — the structural weakness in seed-to-sale and integrated platforms generally.

Put phishing-resistant MFA on registry and compliance logins from day one. Credentials to a state system that returns patient status are among the most sensitive your staff will hold. Hardware keys cost less than one incident-response retainer hour; the case for them in METRC, patient data, and payment logins applies directly to CURT access.

Write the law-enforcement request policy before you open. In Texas specifically, you will get informal verification calls. Decide now who takes them, what you confirm versus what you decline to volunteer, whether you require process for anything beyond statutory verification, and what you log about every disclosure. Operators without a written policy over-disclose in the first ten minutes of the first call. Attach it to your incident response plan so it lives where people look.

What Patients Should Be Told

A short, factual notice at enrollment does more good than any amount of policy language:

  • The state maintains a registry of program participants, operated by the Department of Public Safety.
  • Law enforcement can verify status through that registry.
  • Here is exactly what this dispensary retains about you and for how long.
  • Here is what we do not retain: your ID image, your diagnosis, your prescribing physician’s notes.
  • Your parking lot may be covered by cameras and plate readers we do not control.

None of that is legal advice. All of it is true, and in a market where patients are arriving directly from a criminalized hemp channel, it is the difference between informed participation and a surprise three years from now.

Bottom Line

Texas built a medical cannabis program that works — and lodged its patient registry with the state police. That was a political compromise in 2015 and it is a privacy architecture in 2026, at a moment when the state has criminalized an adjacent product category, expanded qualifying conditions into real diagnoses, and pointed the country’s densest plate-reader network at its own roads.

Twelve new operators are about to start feeding that system. The ones that treat CURT as a verification service to query rather than a dataset to copy, that segment clinical data from retail data, and that tell patients the truth about the architecture will be the ones still standing when the first Texas cannabis privacy suit gets filed.

The registry is the state’s design decision. What your store keeps is yours.

Program structure and registry details from the Texas DPS Compassionate Use Program and its CURT FAQ; HB 46 expansion terms and the July 31 hemp reclassification from contemporaneous Texas coverage.