Pharmacy Security in Hospitals: A Practical Guide for Australia

Locked medicines cabinet inside hospital pharmacy

A hospital pharmacy is secure when four things work together: locked, fixed storage that meets your state’s poisons rules, access limited to people with a duty-based need, monitored detection that matches the value of the stock, and a written risk plan that someone actually reviews every year. Locks alone do not get you there. This guide sets out what the Australian standards and regulations expect, where hospitals most often slip, and how to build a layered system that holds up at 3 am as well as at 3 pm.

Abcosecurity

Strengthen Hospital Pharmacy Security

ABCO Security combines tailored security solutions, licensed professionals and 24/7 monitoring for healthcare environments.

Explore ABCO Security

TL;DR

Security is part of clinical governance under the national medication safety standard, not just a facilities job. Pharmacy, nursing and executive leaders should share the risk assessment.
Drugs of addiction need fixed, locked storage kept apart from other goods. Rules differ by state, so check your own legislation.
Review the security risk plan and audit against it at least every 12 months, and after any incident.
Layer your controls: access control, CCTV linked to monitoring, key and code discipline, and trained people on site or on patrol after hours.
Pick measures that match the risk of the stock, not the most expensive kit on the market.

Why the hospital pharmacy is a different security problem
What the rules actually require
A layered approach to securing pharmacy areas
Key and code discipline: the unglamorous part
Running the risk assessment
Where hospitals commonly go wrong
Our perspective
How ABCO can help
FAQ
Sources

Why the hospital pharmacy is a different security problem

A community pharmacy worries mostly about the till, the front counter and the back door. A hospital pharmacy has a wider footprint. Stock sits in the central pharmacy, in ward cupboards, in theatre suites, in emergency departments, in automated cabinets and in transit on trolleys and lifts. Staff, contractors, patients and visitors move through the same corridors around the clock.

That spread is why security failures in hospitals tend to be process failures. The Australian Commission on Safety and Quality in Health Care frames medication safety as everyone’s business, and its approach implies a missing key log or an unlocked cupboard is usually a symptom of a broken handover, not a single faulty lock. Fixing the hardware without fixing the routine only moves the weak point.

The threats are also mixed:

Theft by insiders or outsiders of drugs of addiction and other drugs prone to misuse.
After-hours intrusion through loading docks, staff entries and poorly monitored corridors.
Aggression and drug-seeking at emergency department and outpatient pharmacy counters.
Cyber and data risk, because dispensing and prescribing systems hold patient information.
Diversion inside the building, where stock leaves through documentation gaps rather than a door.

What the rules actually require

No single national law covers every state, so the sensible approach is to treat the national standards as the baseline and your state or territory poisons legislation as the detail.

National standards and codes

The Medication Safety Standard expects health services to use systematic, evidence-based approaches to the secure storage, distribution and disposal of medicines. Climate-sensitive stock also needs continuous temperature monitoring, which matters for security because a fridge alarm and a door alarm often share the same monitoring path.

For wholesale-level operations, the TGA’s Australian Code of Good Wholesaling Practice sets a useful benchmark even where it does not strictly apply to your ward stores. It expects a security risk management plan, regular audits against that plan at least once every 12 months, and detection systems, such as surveillance linked to 24/7 monitoring, that are commensurate with the identified level of risk. A plan that sits in a drawer does not meet that expectation.

The safe storage of medicines more broadly is covered in the Commission’s principles for safe selection and storage of medicines, which also includes a survey tool you can use for ward audits.

State and territory poisons law

Using New South Wales as the worked example, the Poisons and Therapeutic Goods Regulation 2008 says drugs of addiction kept in a hospital ward must be stored in a separate room, safe or cupboard that is securely attached to the premises and locked whenever it is not in immediate use. The unit must be kept apart from other goods, with limited exceptions such as prescribed restricted substances or propofol.

The same regulation sets out who is answerable. The chief pharmacist holds overall responsibility for the hospital outside the wards, while the nurse or midwife in charge of a ward is responsible for the restricted substances and drugs of addiction stored in that ward. Keys to a drugs-of-addiction safe or cupboard must either be carried by the nurse or midwife on duty, or be held in a separately locked safe that only nursing or midwifery staff can open, and codes or combinations must not be shared with unauthorised people.

Refrigerated Schedule 8 stock has its own rule. NSW Health explains that such a medicine may be kept in a refrigerator rather than a safe in hospital pharmacies, provided the fridge is in a room the public cannot enter, is securely attached to the premises and is locked when not in immediate use.

Victoria, Queensland, South Australia, Western Australia and Tasmania each have their own legislation and wording. If you operate in more than one state, build your plan on the strictest requirement and then document the differences by site. Confirm current text with your state health department before you finalise anything.

The Poisons Control Plan trap

In Victoria, health services must maintain an up-to-date Poisons Control Plan as a condition of their health services permit, according to a Department of Health evaluation report. That report also points to a common weakness: loosely calling a stock room a pharmacy when it does not meet the standard. Naming matters. If a space is a ward store, treat and secure it as one, and do not let the label promise protections the room cannot deliver.

A layered approach to securing pharmacy areas

Think of it as concentric rings. Each ring slows or exposes an intruder, and each is tied to a person who is responsible for it.

Ring 1: the building perimeter and the approach

Start where the pharmacy meets the rest of the hospital. Loading docks, delivery bays, plant rooms and staff entries are the usual after-hours routes in. Lighting, camera coverage and controlled entry at these points cost far less than dealing with a break-in. Our guide to hospital security systems walks through how these layers fit across a whole facility.

Ring 2: access control to the pharmacy itself

The pharmacy door should open only for people whose duties require it. That is also the principle in the national electronic prescriptions security and access policy, which calls for unique user identification, prompt deactivation of accounts when staff leave or credentials are compromised, and physical access restricted by duty-based authorisation.

In practice that means:

Individual credentials, never shared cards or a door code everyone knows.
Access groups tied to roles, so a ward clerk cannot walk into the dispensary.
Same-day removal of access when staff leave, change roles or lose a card.
Audit logs that someone reads, ideally monthly, looking for odd hours and repeated denied entries.
Anti-tailgating measures at busy doors, such as door-held-open alarms.

For detail on choosing readers, controllers and integration, see our hospital access control systems guide.

Ring 3: storage inside the room

The regulation requires fixed, locked storage, but how you apply it matters. Safes and cabinets should be anchored as the law describes, kept free of non-medication goods, and placed where cameras see the door but not the keypad. Our pharmacy security guidelines cover safe specifications and auditable controls in more detail.

Where stock is issued to many users, automated and role-based dispensing cabinets add a layer of traceability, because every removal is tied to a person. If you are weighing options, role-based dispensing cabinets show how access rights and withdrawal records can be linked to individual users.

Ring 4: detection and monitoring

Cameras that nobody watches record a theft rather than prevent it. The TGA code’s idea of detection commensurate with risk points to alarms and surveillance that someone is actually looking at. That might be a control room on site, or a monitoring centre that verifies an alarm and dispatches a response. We explain the practical differences in our articles on alarm system monitoring and camera monitoring services.

Ring 5: people

Technology narrows the gap, but a trained person closes it. Licensed guards on reception and at after-hours entries, patrols that check pharmacy doors and external areas, and clear escalation to the duty manager all matter. Quality here is about accountability: post orders, incident reports and patrol records that show who checked what and when.

Key and code discipline: the unglamorous part

Most diversion cases do not involve a forced door. They involve a key left in a drawer, a code written inside a cupboard, or a handover that skipped a count. A few habits remove most of that risk:

Keep a key register for every pharmacy and ward store, with the holder named at all times.
Change combinations when anyone with knowledge of them leaves.
Count drugs of addiction at every shift change and record it.
Investigate every discrepancy the same day, however small.
Separate duties where you can, so the person who orders, receives and reconciles stock is not always the same one.

The Pharmacy Board of Australia’s guidelines on the safe provision of pharmacy services add that responsibility remains with the individual pharmacist even as technology such as remote dispensing and automated supply evolves. They also expect pharmacists to keep abreast of emerging cyber-security risks that could breach patient confidentiality, and they note that premises design must protect patient privacy.

Running the risk assessment

The national standard and the TGA code agree on the core point: a formal security risk assessment and management plan, reviewed at least every 12 months. Here is a workable sequence.

Map the stock. List where medicines are held, by schedule and by value. Include ward stores, theatre, ED and transit routes.
Map the people. Who has access, why, and how is that verified?
Identify threats and past incidents. Include near misses and discrepancies, not only reported thefts.
Rate the risk for each location, using likelihood and consequence.
Choose controls in proportion to the rating, and name an owner and a date for each.
Test them. Walk the after-hours route, trial an alarm, check the camera angle.
Review at least annually, and after any event, a building change or a change in the stock you hold.

Bring pharmacy, nursing and executive leadership into the same room. The Commission’s standard stresses a multidisciplinary approach, and a Victorian review found drugs and therapeutics committees help validate plans and audit practice. For templates, see our healthcare security risk assessment guide and the general security risk assessment checklist.

Where hospitals commonly go wrong

Weak point	What it looks like	Better practice
Shared codes	A keypad code known to a whole team	Individual credentials and role-based groups
Stale access	Departed staff cards still active	Same-day deactivation tied to HR exits
Unwatched cameras	Footage reviewed only after a loss	Alarms and cameras linked to live monitoring
Static plan	Risk assessment written once	Annual review and audit against the plan
Wrong label	Ward store treated as a pharmacy	Secure the room to the standard it actually meets
No response plan	Alarm sounds, nobody knows who attends	Defined response targets and escalation

The last row deserves attention. Detection only helps if someone arrives. Our guide to physical security incident response shows how to set response expectations and test them.

Our perspective

We have spent more than 15 years working with sites where the stakes are high, including healthcare facilities, and the pattern repeats. Clients often ask us for more cameras when the real gap is that nobody owns the response. Our view is that security for a hospital pharmacy should be proactive: anticipate how stock could be taken or misused, then build controls that make that hard, visible and quickly answered.

That is why we start with a risk assessment before recommending equipment. We work to ISO 9001 and ISO 30000 quality and risk management standards, and we combine licensed guards, mobile patrols, CCTV and alarm monitoring, and access control so each layer covers the weakness of another. Technology without people is easy to ignore. People without technology cannot be everywhere. Pharmacy and nursing leaders know their stock best, and the best outcomes come when they sit at the table with security from the first day.

— Abco

How ABCO can help

If you manage a hospital or health facility and want a second set of eyes on your pharmacy security, we can start with an assessment and build a plan around licensed guarding, mobile patrols, CCTV and alarm monitoring and electronic security solutions. For after-hours cover, our Night Owl service is listed from $5.45 per day. See our healthcare security services page for how we protect patients, staff and data across Australian facilities.

FAQ

Who is responsible for drug security in a hospital ward?

Under the NSW regulation, the nurse or midwife in charge of a ward is responsible for restricted substances and drugs of addiction stored there, and the chief pharmacist holds overall responsibility for the hospital outside the wards. Other states set out responsibilities in their own legislation, so check yours. Security staff support these people but do not replace their legal duties.

How often should a hospital review its pharmacy security plan?

At least every 12 months, according to the national medication safety standard and the TGA wholesaling code, which both expect a risk assessment and plan that is reviewed and audited. Review sooner after an incident, a refit or a change in the medicines you hold. Record the findings and the actions taken.

Can Schedule 8 medicines be kept in a fridge instead of a safe?

In NSW, yes, in hospital pharmacies, if the fridge is in a room the public cannot access, is securely attached to the premises, is locked when not in use and is accessed only by a pharmacist. Check the NSW Health page and your own state’s rules before relying on this. Other jurisdictions may differ.

Do we need guards if we already have CCTV and access control?

Usually the answer depends on your risk rating. Cameras and card readers detect and record, but someone has to verify alarms and attend. Many hospitals pair electronic systems with on-site guards or patrols, particularly after hours and at entries to pharmacy and ward stores.