12.3 Security & Non-Pharmacist Access: Keys, Double Set-Ups, Institutional Night Access & DEA Controls

Why this matters

Area 4.2 includes "allowing non-pharmacist personnel access to drugs," and security runs through the whole blueprint. Oregon's core rule is simple. When no pharmacist is present, the pharmacy is locked and only pharmacists have access, with narrow exceptions for institutional nurse supervisors and Board-approved systems. Federal DEA rules add controlled-substance security standards.

Security of the prescription area (OAR 855-041-1020)

1. The area where legend drugs and controlled substances are kept must be restricted in access to keep them secure.
2. The PIC and every pharmacist on duty are responsible for security, including adequate safeguards against theft or diversion of drugs and records.
3. When no pharmacist is present, the pharmacy must be secured to prevent entry. All doors are locked, and keys stay with the PIC or authorized employee pharmacists. Non-pharmacist employees who need access follow the double set-up rules of OAR 855-041-2100.
4. Prescription drugs, devices and nonprescription Schedule V controlled substances must be stored within the prescription area or a secured storage area.

Related duties:

• Each pharmacist must ensure that only a pharmacist has access to the pharmacy when it is closed, except as OAR 855-041-6310 allows (OAR 855-115-0130(1)(b)).
• Technicians may enter the pharmacy area only when a pharmacist is physically present (OAR 855-125-0105).
• When no pharmacist is present, computers, records and medications must be secured against access by non-pharmacists. Prescriptions may not be processed or records accessed before the pharmacist arrives or after they leave (Board self-inspection form; OAR 855-041-1020(3)).

Double set-up pharmacies (OAR 855-041-2100)

A double set-up holds both a retail drug outlet registration (the pharmacy) and a nonprescription drug outlet registration (the store).

• The pharmacy must be a separate operation, fully enclosed by a barrier from floor to ceiling, or at least ten feet high, and easy for the public to distinguish.
• When no pharmacist is present, a closed sign with the pharmacy's hours is posted at the entrances. All entrances are closed off and securely locked, and keys stay with the PIC.
• Any system that departs from these requirements needs prior Board approval, and a written description of the approved system is kept in the pharmacy. The institutional exception in OAR 855-041-6310 is separate.

Institutional after-hours access (ORS 689.605; OAR 855-041-6310)

In a hospital without a pharmacist in attendance:

• Only one registered nurse supervisor per shift may access the pharmacy and remove drugs. That nurse must be designated in writing by the appropriate hospital committee and trained beforehand.
• A practitioner's order must be documented in the patient's medical record before the drug is removed.
• A copy of the order is left with the container the drug came from, or with an identical unit dose, placed conspicuously for a pharmacist to verify.
• For each removal, the record shows: the patient's name and location; the drug name and strength; the number of units; the date and time; the nurse supervisor's initials; and the date and initials of the pharmacist who confirmed the transaction was accurate.

Statute lets the Board grant a special permit allowing a nurse supervisor to act on an oral prescriber order (ORS 689.605(1)). In facilities with a drug room rather than a pharmacy, a pharmacist supervises the drug room. Authorized persons may withdraw drugs on a written order, recording each withdrawal in the responsible pharmacist's records.

Federal controlled-substance security (21 CFR 1301.71–.76)

• Registrants must provide effective controls and procedures against theft and diversion.
• Pharmacies may store Schedule II–V controlled substances in a securely locked, substantially constructed cabinet, or disperse them throughout the stock of non-controlled drugs to deter theft (21 CFR 1301.75(b)).
• A registrant may not employ, in a position with access to controlled substances, a person convicted of a felony related to controlled substances, or one whose DEA registration was denied or revoked, without a DEA waiver (21 CFR 1301.76(a)).
• Theft or significant loss is reported to DEA within one business day (section 11.4).

Practical security controls

• Keys, badges and alarm codes are issued only to pharmacists. Codes change when staff leave.
• Camera coverage of the controlled-substance storage areas and will-call. Remote dispensing sites must keep video 6 months (OAR 855-139).
• Automated dispensing systems with user-specific access and audit trails. Overrides are reviewed under the PIC's diversion-prevention policy.
• Quarantined controlled substances stay secured until disposal (self-inspection form).

Exam scenario

At 2 a.m. in a hospital with no overnight pharmacist, a patient needs IV vancomycin. The designated, trained nurse supervisor enters the pharmacy after the physician's order is in the chart. They remove the vial, leave a copy of the order with the source container for pharmacist verification, and record the patient, location, drug, strength, quantity, date and time with their initials. In the morning, the pharmacist reviews the transaction, initials and dates the record to confirm accuracy, and resolves any discrepancy. A second nurse could not enter that same shift. Only one nurse supervisor per shift may have access.