Australian Pharmacy Security Guidelines: 9mm Safes, Auditable Controls

Steel medicine safe secured in pharmacy storeroom

Pharmacies must secure Schedule 8 medicines in a compliant safe or strongroom, restrict access to pharmacists and authorised staff, and run a 24/7 monitored alarm linked to CCTV and audit logs. These three controls form the backbone of every state pharmacy authority’s security expectations. The sections below map each requirement to the practical steps needed to meet it and keep the evidence to prove it.

TL;DR:
A standalone safe needs mild steel plate at least 9mm thick, continuous welding, and structural fixation; higher storage volumes may require a graded strongroom.
Reserve S8 keys and codes for pharmacists, log each issue, compare the register with current staffing monthly, and revoke departing employees’ access immediately.
Place discreet duress alarms at dispensing and public service points, and cover entrances, storage, counters, and loading docks with CCTV retained long enough for investigations.
Run a full risk assessment annually and after any incident; audit access logs, footage, stock records, and keys quarterly, including each access made after closing.
Secure dispensing systems with multifactor authentication, prompt account deactivation when staff leave, regular patches, tested backups, and computers restricted to dispensing tasks.

Abcosecurity

Plan Security Around Pharmacy Risks

ABCO Security provides tailored security solutions for healthcare settings, combining licensed professionals, advanced technology and 24/7 monitoring.

Explore security solutions

Storage and safes for controlled medicines
How should the premises be designed to limit access?
Access control, keys and code management
Alarms, CCTV and monitoring requirements
Staff supervision, vetting and operational policy
Cybersecurity basics for dispensing and e-prescribing systems
Risk assessment, audits and after-hours supply
What a security risk assessment shows in practice
A pharmacy manager’s prioritisation approach
How we help pharmacies put this into practice
FAQ
Sources

Storage and safes for controlled medicines

Schedule 8 medicines carry the strictest storage duty of anything on a pharmacy shelf, and regulators are specific about what “secure” actually means. Medicine storage standards set out that S8 stock must sit in a steel safe or strongroom built from mild steel plate at least 9mm thick, continuously welded rather than bolted, and fixed to the building structure so it cannot be removed or levered open. Door clearances are tightly limited, and a strongroom grading applies where storage volumes are higher.

The construction detail matters because forced-entry and ram-raid attempts target the weakest point. A safe that meets the 9mm steel specification with continuous welding resists prying and cutting tools far longer than a bolted cabinet, buying time for an alarm response.

Refrigerated S8 stock and automated dispensing cabinets (ADCs) carry their own conditions: units need unique identifiers, individual access logs, tamper alerts, and either physical tethering to the building or placement under direct supervision. Record keeping sits alongside the hardware:

Maintain a drug register that records every receipt, supply and disposal of S8 stock.
Keep delivery records with signatures from both the courier and the receiving pharmacist.
Retain registers and delivery dockets for the period your state authority specifies.
Reconcile physical stock against the register on a fixed schedule, not just at stocktake.

When checking an existing safe, ask the supplier or locksmith for written confirmation of steel thickness, welding method and fixation point, and request the same documentation from any locksmith servicing the lock mechanism. A safe without that paperwork is hard to defend in an audit.

How should the premises be designed to limit access?

Layout does as much work as hardware. Two-door entry systems, where a visitor passes through an outer door before reaching a second, separately secured door to the dispensary, stop casual access and give staff a buffer to assess anyone entering after hours. Dispensary and S8 storage areas should never be visible from the public shop floor or through unobstructed windows.

Construction and hardware choices reinforce that layout:

Fit reinforced doors with internalised hinges so hinge pins cannot be removed from outside.
Install self-closing devices on all dispensary and storage doors.
Apply security film to ground-floor windows and glazed panels near storage areas.
Use roller shutters on external openings in higher-risk locations.
Keep perimeter and loading areas well lit, with no dark approach paths to delivery doors.

Loading docks deserve particular attention because they’re a routine point of entry for people outside the pharmacist’s direct control. A two-door system on the loading dock, CCTV coverage of the delivery area, and closed voids above dropped ceilings (a common ram-raid and roof-breach route) all reduce the exposure. Where vehicle access sits close to the storefront, bollards or similar barriers limit ram-raid risk.

These choices follow Crime Prevention Through Environmental Design principles: natural surveillance (clear sightlines so staff can see what’s happening), territorial definition (making it obvious where public space ends and controlled space begins), and controlled access points (limiting entry to places you can monitor).

Pro Tip: Walk your own premises as a stranger would, at closing time and again before opening, and note every point where someone could linger unseen.

Access control, keys and code management

Keys and codes are only as secure as the system managing them. A restricted keying system, where blanks can’t be cut by a regular locksmith and duplication requires authorisation from a registered holder, closes the most common gap in pharmacy access control: unauthorised copies circulating among former staff or contractors.

Tasmanian Pharmacy Authority guidelines encourage restricted keying and documented key registers as standard practice, and the broader regulator expectation is that keys or codes granting access to S8 storage are held by pharmacists, not delegated to junior or casual staff. Locum and after-hours access is typically managed through a secured lock box released by on-call authorisation, or a pharmacist-on-call procedure that logs each access event.

A workable access workflow looks like this:

Issue keys or codes only to pharmacists and nominated senior staff, never as a shared or generic credential.
Log every key and code issue in a register, noting holder, date and purpose.
Audit the register monthly against who’s actually employed and rostered.
Revoke access immediately on staff exit, same day wherever possible.

Contractors and maintenance visits need the same discipline: confirm identity before granting access, supervise anyone working near S8 storage, and record the visit in the same register used for staff.

Alarms, CCTV and monitoring requirements

A functional, 24/7 monitored intrusion detection alarm covering every medicine storage and dispensary area isn’t optional. Victorian Pharmacy Authority standard 2.3.3 requires it explicitly, and recommends the monitoring centre be graded to the relevant Australian Standard rather than an informal or unverified provider. Treat this as the baseline, not an upgrade.

Duress and silent hold-up alarms belong at the dispensing counter and anywhere staff deal directly with the public, wired so activation is discreet and doesn’t escalate a confrontation. Staff need clear protocols for when to use them, not just where the button is.

For CCTV:

Position cameras to cover entry points, the dispensary counter, storage areas and the loading dock.
Set retention periods long enough to support a police investigation weeks after an incident.
Label camera feeds clearly in any footage export so investigators and auditors can identify the location instantly.
Review footage samples as part of routine audits, not only after an incident.

Monitoring works best layered: alarm verification before dispatch, a mobile patrol response for physical follow-up, and a monitoring service level agreement that specifies response times in writing. A graded CCTV and alarm monitoring setup gives you the documentation a regulator or insurer will ask for.

Staff supervision, vetting and operational policy

A pharmacist-in-charge carries specific responsibility under most state frameworks, and the operating rule is simple: a pharmacist must be present whenever the pharmacy is dispensing. That single rule shapes rostering, locum cover and after-hours arrangements more than any other policy.

Build the supporting policies around it:

Run pre-employment checks for every staff member with access to S8 stock or dispensing systems.
Set role-based access so casual and junior staff can’t reach controlled medicines or sensitive systems unsupervised.
Document security procedures as part of induction, including what to do during an attempted theft or robbery.
Train staff in duress response specifically, including locums who may only work occasional shifts.
Define incident handling steps in advance: internal review, notification to the regulator and police, and preservation of CCTV footage and registers as evidence.

Pro Tip: Run a short duress drill with new locums on their first shift rather than relying on a handbook they’ll read later.

Cybersecurity basics for dispensing and e-prescribing systems

Physical security means little if the dispensing system itself is left open. The national electronic prescriptions security and access policy requires healthcare provider organisations to run security and access policies covering user authentication, prompt account deactivation and measures that preserve the integrity of electronic prescriptions.

In practice that means:

Apply multi-factor authentication to dispensing and prescribing system logins.
Deactivate staff accounts the day they leave, not at the next review cycle.
Keep systems patched and run endpoint anti-malware on every dispensing terminal.
Test backup restores periodically rather than assuming the backup works.
Restrict dispensary computers to dispensing activities only, cutting exposure from general web browsing or email.

One policy requirement worth flagging directly: account deactivation and authentication rules sit alongside physical access controls as a named compliance expectation, not a side issue for the IT provider to handle alone.

Risk assessment, audits and after-hours supply

A pharmacy-specific risk assessment follows a straightforward sequence, and running it annually (or after any incident) keeps controls aligned with actual exposure rather than assumption.

Identify assets: S8 stock, cash, patient data, dispensing systems.
Identify threats: break-in, armed robbery, insider theft, cyber intrusion.
Assess vulnerabilities in current storage, access and monitoring arrangements.
Rate each risk’s acceptability against existing controls.
Set a monitoring and review schedule for anything rated unacceptable.

Audits should sample access logs, review a cross-section of CCTV footage, reconcile the drug register against physical stock, and check the key register against current staff. After-hours supply, when it happens, should go through an on-call pharmacist or a tightly limited imprest stock, with every access event logged and reviewed at the next audit cycle. Quarterly review is a reasonable baseline, with escalation to the pharmacist-in-charge and, where relevant, the regulator for anything that falls outside normal patterns.

What a security risk assessment shows in practice

A structured risk assessment built on AS 4485 healthcare security principles maps directly onto the controls above: storage construction, access points, alarm coverage and staff procedures all get scored against the same framework regulators use to judge compliance. In facilities where this kind of assessment has informed layout and access changes, anonymised outcome data has shown reductions in incidents tied to uncontrolled wandering and unauthorised access in adjoining clinical areas.

When procuring a security provider, ask for:

A written risk assessment report referencing a recognised standard.
Confirmation of the monitoring centre’s grading.
Licensing details for installers and monitoring staff, verifiable against the state regulator.

A pharmacy manager’s prioritisation approach

If I were sequencing this work, staff safety and legal compliance come first: a compliant S8 safe isn’t negotiable, and neither is pharmacist-held access. Visible deterrents and auditability follow close behind, because an alarm nobody can prove was monitored is worse than no alarm at all on paper.

Structural strongroom work usually needs a specialist and a lead time most owners underestimate; CCTV and alarm upgrades can often happen in weeks. Stage it: fix policy gaps immediately, add monitored alarms and CCTV next, then schedule strongroom or structural work once the quick wins are locked in.

— Abco

How we help pharmacies put this into practice

We work with pharmacy owners and managers to turn the controls above into an auditable system rather than a one-off fix. Our security risk assessments identify gaps against the standards pharmacies are measured on, and our A1 CCTV & Alarm Monitoring service provides the 24/7 graded monitoring regulators expect.

Where premises need a physical presence, our security guarding and mobile patrol services add response capacity, and our electronic security solutions team installs alarms and access control to the specifications your regulator requires. Every engagement comes with the necessary documentation procurement teams require.

To see where your pharmacy stands against these controls, get in touch for a site assessment.

This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.

FAQ

What safe is required for storing Schedule 8 medicines?

Schedule 8 medicines must be stored in a steel safe or strongroom built from mild steel plate at least 9mm thick with continuous welding, fixed to the building structure. Larger storage volumes may require a graded strongroom instead of a standalone safe.

Who is allowed to hold keys to the pharmacy’s S8 storage?

Keys and codes for Schedule 8 storage should be held by pharmacists rather than junior or casual staff, under most state pharmacy authority guidelines. Locum or after-hours access is typically managed through a secured lock box or an on-call pharmacist procedure, with each access logged.

Does a pharmacy need a monitored alarm system?

Yes. Victorian Pharmacy Authority standard 2.3.3 requires a functional, 24-hour monitored intrusion detection alarm covering all areas where medicines are kept, monitored by a centre graded to the relevant Australian Standard.

What cybersecurity steps apply to e-prescribing systems?

Pharmacy dispensing and e-prescribing systems need user authentication, multi-factor authentication where appropriate, and prompt account deactivation when staff leave, under the national electronic prescriptions security and access policy. Dispensary computers should also be restricted to dispensing tasks to limit exposure.

How often should a pharmacy review its security controls?

A full risk assessment covering storage, access, alarms and staff procedures is best run annually and immediately after any incident. Routine audits of access logs, CCTV samples and drug register reconciliation should happen more frequently, with quarterly review a reasonable baseline.