Pharmacy Security in Melbourne: The Rules Require an Alarm, Not an Answer

Most people assume the Schedule 8 rules are about the safe. They are more demanding than that.

The Victorian Pharmacy Authority guidelines, effective 5 September 2024, require a 24 hour monitored intrusion detector alarm covering the areas where medicines and poisons are kept, including the drug safe itself. That is clause G2.3.3, and it is a requirement rather than a recommendation. Safe keys must not be left on the premises overnight unless they are held in a separate safe of at least equivalent security, which in practice means a combination or keypad safe with codes limited to pharmacists.

So the regulatory floor already includes detection. Read the guidelines again, though, and notice two things they do not say.

They do not say what has to happen when that alarm activates at 2am. And they do not mention CCTV at all.

Source: Victorian Pharmacy Authority Guidelines, effective 5 September 2024.

The short answer

Compliance gets you a monitored alarm and a compliant safe. It does not get you a response, and it does not get you evidence.

A pharmacy or medical practice still has to decide three things the guidelines leave open: who acts on an activation and how fast, whether anyone can tell a genuine break-in from a false trigger before a decision is made, and what footage exists afterwards.

Those are commercial decisions, not compliance ones, and they are where the real difference between two sites shows up.

Why healthcare sites are targeted differently

Most commercial break-ins are opportunistic and quick. Healthcare sites attract a different pattern for three reasons.

The contents are specific and known. An offender does not need to guess what is inside a pharmacy. The sign on the front says so.

Access is predictable. Consulting hours are published. The building is reliably empty at known times, usually for long stretches.

The target is small and portable. Unlike a warehouse, where removing value takes a vehicle and time, what is worth taking from a pharmacy or a practice fits in a bag.

There is a fourth factor that applies during opening hours rather than after them. Front-of-house staff in pharmacies and practices deal with distressed and occasionally aggressive people, and that is a staff safety question rather than a theft question. It needs duress provision, not a better lock.

The four layers that actually matter

Securing a healthcare site is a sequence, and skipping a layer makes the others work harder.

1. Physical delay

The S8 cabinet is one element. The building envelope is the other, and it is more often the weak point. Roller shutters, laminated glazing and reinforced door hardware buy time, and time is the only thing that makes detection useful.

On the Emeline Medical Centre project in Malvern, roller shutters were layered with upgraded CCTV, a modern alarm and access control precisely because the practice needed protection most when nobody was there. The detail is in the Emeline Medical Centre case study.

2. Detection

For a pharmacy this layer is not optional. The guidelines require 24 hour monitored intrusion detection across the areas where medicines and poisons are held, including the safe.

The question is therefore not whether to have it. It is whether the coverage actually matches the areas that matter, and whether the alarm detects entry early enough that the physical delay from layer one still counts for something. A compliant alarm with a sensor in the wrong room is compliant and useless.

3. Response

This is where most healthcare sites are weakest, because detection without response is a record rather than a defence.

The practical questions: who receives the activation at 2am, what do they do, and how is a genuine break-in distinguished from a cleaner who entered the wrong code. Video verification resolves that in seconds rather than through a sequence of phone calls. How the dispatch chain works is explained in what has to happen before police are dispatched.

4. Evidence and accountability

Cameras covering the dispensary, the entry points and the storage area, with enough image quality to identify rather than merely observe.

Access records matter as much as footage in healthcare. Access control on the dispensary, the consulting rooms and any storage area gives you a record of who entered and when, which is useful for investigations and uncomfortable questions alike.

The multi-site problem

Healthcare businesses grow by adding locations, and security usually grows by accident.

Each site gets whatever system the local installer recommended, on whatever platform was convenient, with its own monitoring arrangement and its own set of codes. Three years later nobody can answer a simple question like which sites are armed right now.

That is the position the Heathershaw pharmacy group was in. Three pharmacies plus an office and a warehouse, each previously secured in isolation. The fix was standardisation: one Elite alarm platform, CCTV and 24/7 monitoring across all four Melbourne sites, so the group is managed as one estate rather than four unrelated buildings. The detail is in the Heathershaw case study.

The argument for standardising is practical rather than aesthetic:

• One app, one set of procedures, one place to check status.
• Staff who move between sites do not need to relearn anything.
• Adding a site is a configuration change rather than a new project.
• One provider is accountable when something fails.

Opening hours are a different problem

Everything above addresses the empty building. The risks during trading hours need different answers.

Duress. A discreet way for a staff member to summon help without escalating a situation in front of a patient. Two things decide whether it is useful: where the device sits, and what actually happens when it is pressed. A duress signal that reaches the same unverified call list as the burglar alarm is slower than it needs to be.

Front-of-house visibility. A camera positioned to identify someone at the counter, at counter height, not a ceiling dome looking at the top of a head.

Controlled areas. Dispensary and consulting rooms on access control rather than a key that eleven people have.

Audio. Where it is used, be deliberate about it. Recording conversations engages obligations that video alone does not, and in a healthcare setting those conversations are sensitive by definition. Treat audio as a decision requiring documentation, not a default setting.

Common mistakes

Treating the S8 cabinet as the security system. It is a storage requirement. It assumes somebody has already got into the building.

Cameras that observe rather than identify. A wide view of the dispensary tells you a theft happened. It does not tell you who.

No separation between staff and clinical areas. If a single credential opens everything, the access record proves nothing.

Alarm codes that never change. Staff turnover in healthcare is steady. Shared codes outlive the people who were given them.

Assuming the landlord’s building security covers the tenancy. In a medical suite within a larger building, base building security and tenancy security are different responsibilities, and the gap between them is rarely documented.

What to check this week

1. Walk the site at the time it is emptiest and ask how you would get in.
2. Pull footage of your own dispensary from last month at night. Can you identify a face?
3. List everyone who holds a key or code, then remove the ones who have left.
4. Confirm who is on the monitoring call list and whether they would actually attend.
5. If you operate more than one site, try to establish which are armed right now. Time how long it takes.

That last test is usually the most revealing.

Frequently asked questions

Does a monitored alarm satisfy the Schedule 8 storage requirements? No. These are separate obligations. The storage facility must meet the minimum standards under the Drugs and Poisons legislation, and the premises separately require 24 hour monitored intrusion detection covering the areas where medicines are kept. One does not substitute for the other. Check the current guidelines for your own obligations.

Do we need cameras in consulting rooms? Generally no, and in most circumstances you should not. Clinical areas carry privacy expectations that make camera coverage inappropriate. Secure the access to those rooms rather than the inside of them.

How long should footage be retained in a healthcare setting? Long enough to be useful and no longer than you can justify. Footage of patients is sensitive personal information. Set a deliberate retention period and document the reasoning. The documentation obligations are covered in AI cameras and the 2026 privacy rules.

We lease a suite in a medical centre. Whose responsibility is security? Usually shared and often unclear. Base building security covers common areas. Your tenancy is typically yours. Get the boundary in writing before assuming either way.

Can multiple sites be monitored under one arrangement? Yes, and for a group it is usually both cheaper and more manageable than separate arrangements per site.

Where to start

The guidelines tell you to have a monitored alarm. They do not tell you who answers it, how quickly, or whether that person can see what triggered it. They say nothing at all about cameras.

Forever Secure has delivered security across pharmacy and medical sites in Melbourne, including a four-site pharmacy group standardised onto one platform and a medical centre layered with shutters, CCTV, alarm and access control. The on-site assessment is free, the report is yours, and there is no obligation attached to it.

Book a free on-site security assessment or call 1300 232 152.