From the blog

Florida's Medical Marijuana Registry Login Changes September 28. How Many of Your Regulars Will Find Out at the Counter?

September 7, 2026

The Office of Medical Marijuana Use put a notice at the top of its homepage: beginning September 28, 2026, users of the Medical Marijuana Use Registry will be required to use multifactor authentication "via an authenticator application or email notification" to access the Registry. OMMU cites Rule 60GG-2, the State of Florida Cybersecurity Standards, which OMMU says requires agencies to use MFA for business-to-citizen users.

That's the whole announcement. Two sentences, no press release, no FAQ yet. For a state IT change, it's routine. For a dispensary, it's the second time in nine weeks that the state has added a step between a patient and a renewed card — and this one lands at the login, before the patient gets anywhere near the application.

What actually changes on September 28

Today a patient signs into the Registry with a username and password. From September 28, accessing the Registry will also require multifactor authentication — through an authenticator application or an email notification, in OMMU's words. That is the full extent of what OMMU has published. The notice doesn't say how the email option works, whether MFA is required on every login or only on new devices, whether existing users can enroll ahead of time or will be walked through setup on their first login after the 28th, or whether physician, law-enforcement, and MMTC accounts are included alongside patients. The rule it cites is a business-to-citizen standard, which points at patients and caregivers, but the notice says "users." As of this writing, OMMU's Registry page offers its existing account and login guides but no MFA guide, and the live login is still username and password.

What doesn't change: the card is still annual, the state fee is still $75, the renewal window still opens 45 days before the card expires, and OMMU's current estimate is five business days to process a complete application plus five to print the card, with the approval email usable at a dispensary while the physical card is in the mail. The requirements are the same. The door is getting a second lock.

Who logs into the Registry, and when

The Registry is the program's operating system, not a website patients visit for fun. According to OMMU, patients and caregivers use it to submit ID card applications, check application status, and review their orders and dispensations — including the "amount available" page that shows how much of a physician's order is left to fill. The card application itself lives inside the Registry on the "Your Card" page, and so does the payment step.

Here's the pattern that matters: a lot of patients only log in when they have to. They see the doctor, the doctor enters the certification, the patient shows up at your counter with a card and never touches the Registry again — until renewal. That's the login that meets MFA cold. A patient whose card expires in mid-October opens the Registry in early October to renew, meets a step they've never seen, and either works through it or closes the tab. And because one of OMMU's two options runs through email, a patient whose Registry email is an address they stopped checking two years ago has a second problem — OMMU's guide for Registry emails that don't arrive is about spam folders, not dead addresses.

Then there's your side of the counter. OMMU's own weekly report states that all orders are recorded and dispensed via the Registry, which is accessible in real time to MMTC staff, and its instructional guides include dispensing product in person and via delivery for MMTC users. If MMTC accounts are included on the 28th, MFA could affect staff access to the Registry's dispensing workflows. OMMU hasn't said whether they are, or how often a second factor would be asked for. You should find out before we do — your Registry executive or manager user is the account that would hear from OMMU first.

Why this is a retention problem, not an IT problem

Back in July we wrote about the certification-first renewal rule: since July 27, the Registry won't let a patient complete a card application unless a current or scheduled physician certification with open orders is on file. The argument was simple. A lapsed card isn't a smaller basket, it's revenue zero, and the patient who lapses doesn't complain — they just stop appearing in your POS. The fix was a sentence delivered at the right moment, in-store.

September 28 is the same argument with a second trigger. Two friction points now sit in front of a renewal: one at the login, one in the application. A patient who clears the first can still hit the second. A patient who can't clear the first never finds out about the second. And both are things the state added this year, on a patient base that OMMU counted at 941,509 active cards as of September 4 — every one of which comes up for renewal within twelve months.

We won't guess at how many patients struggle with an authenticator app, and neither should you. The honest framing is about timing: a patient who hears about the change in your lobby, with a budtender who can point them to OMMU's guidance, has weeks to sort it out. A patient who meets it alone, at home, in the 45-day window, with the card expiring, is the one who ends up in a win-back campaign — yours or someone else's.

The three-week plan

This week: brief the counter. Budtenders see the card at every transaction and are the first people positioned to say "heads up, the Registry is adding multifactor authentication on the 28th." Give them a two-line script and the one fact that matters: make sure you can get into your Registry account and the email that goes with it. Add the question every staff member will get after the 28th — "I can't get into the Registry" — and the answer: OMMU's Registry page has account and login guides, OMMU is the place for Registry account help, and staff should never handle a patient's credentials.

This week: settle the MMTC question. Have whoever holds your Registry executive-user account ask OMMU whether MMTC user logins are covered. If they are, the questions to settle now are how a shared register terminal handles a second factor and whether the answer involves employees' personal phones — a policy decision, not a morning-of-the-28th decision. If they aren't, you've spent one email finding out.

Now through September 28: put it on the screen. A standing slide in the rotation — "Florida's Registry adds multifactor authentication September 28. Make sure you can access your Registry account and its email, and watch OMMU for setup instructions." — with a QR code to the OMMU Registry page. Waiting-room screen first, where patients are sitting with their phones out; menu boards second. This is the same play as the July slide, and if that one is still in your rotation, this is the moment to refresh it into a two-item "renewal checklist": certification current, Registry access confirmed. When OMMU publishes setup instructions, swap the QR to point at them.

After September 28: swap the slide. "Trouble getting into the Registry? OMMU's guides can help — ask us where to find them." The message changes from prevention to recovery, and it stays up through the end of the year, because the patients who log in once a year will keep arriving at the new login one renewal at a time.

One compliance note, because it shapes the creative: this is patient-education content in a medical-program frame, but Florida's advertising rules — we've covered them in detail — prohibit MMTC marketing visible from a street, sidewalk, park, or other public place. Keep the slide interior-facing and run it through the same compliance review as anything else that goes on your screens.

Where screens fit

This is our lane, so here's the honest version. Email reaches whoever opens it, SMS reaches whoever opted in, and a notice on OMMU's homepage reaches patients who visit OMMU's homepage. The in-store screen can repeatedly reach the active patients who visit your store — a large share of exactly the population that has to clear the new login before their next renewal — and it can do so during the three weeks that matter.

The operational difference is speed. With centrally managed, POS-synced signage, the "make sure you can get in" slide is one edit scheduled across every screen in every location, the swap to recovery messaging on the 28th is a second edit, the QR update when OMMU posts instructions is a third, and none of them involves a printer or a thumb drive. The same screens that merchandise the menu carry the message that keeps the cardholder base the menu depends on — which, in a medical-only state, is the only customer base there is.

The takeaway

September 28 doesn't change what a patient can buy or what you can sell. It changes whether a patient who hasn't logged into the Registry since last year's renewal gets through the door to renew again — and, possibly, whether your own staff's dispensing access picks up a second factor the same morning. The change is three weeks away. You can give your patients those three weeks on a screen they're already looking at.

If getting one slide onto every screen in the store by tomorrow sounds harder than it should be, that's the problem we build for. See how GreenScreens works or get a demo — we'll show you a live store.

Frequently asked questions

What changes in Florida's Medical Marijuana Use Registry on September 28, 2026? Per OMMU, Registry users will be required to use multifactor authentication — via an authenticator application or email notification — to access the Registry, in line with Florida's state cybersecurity standards (Rule 60GG-2, F.A.C.). OMMU has not yet published setup details.

Does this affect dispensary (MMTC) staff logins? OMMU's notice says "users" and cites a business-to-citizen standard; it does not specify whether MMTC, physician, or law-enforcement accounts are included. MMTC staff do use the Registry to record dispensations, so operators should confirm scope with OMMU through their Registry executive or manager user before the 28th.

Did anything change about card renewals or buying at a dispensary? No. Cards still renew annually, the state fee is still $75, the renewal window still opens 45 days before expiration, and purchasing still requires an active card and valid physician orders. The July 27 rule requiring a current or scheduled certification before a card application can be completed also remains in effect.

What should a patient do before September 28? Make sure they can sign into their Registry account today and that the email address associated with it is one they still check, since one of OMMU's two MFA options runs through email — then watch OMMU for setup instructions. OMMU's Registry page has account and login guides for patients and caregivers; an MFA-specific guide hadn't been published as of this writing.

Can a dispensary help a patient who is locked out of the Registry? Staff can explain what changed and direct patients to OMMU's official guidance, but Registry account issues are handled by OMMU, certification questions go to the patient's qualified physician, and staff should never handle a patient's login credentials.

This article is general information for dispensary operators, not legal advice. OMMU had not published setup instructions or scope details for the September 28 change as of September 7, 2026 — confirm current requirements with the OMMU before acting.