As far as I understand, data can be treated the same as any other organizations. The medical marijuana licenses will have restrictions on what data is stored, I would imagine that HIPAA laws would apply in that situation, but would need to confirm.
The financial situation (not being able to use banks) is a different issue. Many cannabis companies have to transact in cash and will move money through armored vehicles and third party banking replacements.
