Hospital security: preventing theft of controlled drugs and medical equipment
How healthcare security teams protect controlled drugs and valuable medical equipment through access control, asset tracking, patrols and insider-risk awareness.
This article is general guidance and is not legal advice. Always follow your employer’s policy and your site’s assignment instructions.
Hospitals, clinics, GP surgeries, care homes and pharmacies are busy, open places. They have to welcome patients and visitors around the clock. That openness makes them attractive to thieves looking for portable, high-value equipment and for controlled drugs that can be sold or misused.
Theft in healthcare is not just a financial problem. A missing defibrillator or infusion pump can delay treatment. Stolen controlled drugs can cause overdoses and fuel crime in the community. This guide explains how security officers and healthcare managers can reduce the risk.
This guide is based on the law and NHS arrangements in England. Scotland, Wales and Northern Ireland have their own rules, so check local guidance if you work there.
Key Takeaways
- Controlled drugs are tightly regulated, and security teams support those controls.
- Small, portable, high-value equipment is the most common target.
- Access control, asset tagging, CCTV and unpredictable patrols work best together.
- Insider theft is real, so report concerns through proper channels rather than confronting staff.
- Fast, factual reporting helps investigations and prevents repeat losses.
The legal framework for controlled drugs
Under the Controlled Drugs (Supervision of Management and Use) Regulations 2013, NHS trusts and other designated bodies must appoint a Controlled Drugs Accountable Officer (CDAO), who is responsible for the safe management and use of controlled drugs. The Misuse of Drugs (Safe Custody) Regulations 1973 set minimum storage standards for certain drugs, such as locked cabinets that meet specific requirements.
Records such as controlled drug registers track every movement. Security officers do not usually handle medicines. Your role is to support these controls by protecting the areas where drugs are stored, received and moved, and by responding quickly when something looks wrong.
In NHS organisations, security is usually led by a Local Security Management Specialist (LSMS) or security manager, working alongside the CDAO, the pharmacy team and the counter fraud specialist. Know who these people are on your site and how to contact them out of hours.
What thieves target in healthcare
| Category | Examples | Why it is targeted |
|---|---|---|
| Controlled drugs | Opioids such as morphine and fentanyl, benzodiazepines, ketamine | High street value and potential for misuse |
| Portable medical devices | Handheld ultrasound, pulse oximeters, blood pressure monitors, defibrillators | Easy to carry and resell online |
| IT equipment | Laptops, tablets, phones, computers on wheels | Resale value, plus the data they may hold |
| Specialist equipment | Endoscopes, surgical instruments, infusion pumps | Very high value, sometimes stolen to order |
| Consumables | Needles, syringes, dressings, prescription pads | Used or sold for illicit purposes |
| Personal property | Patients’ and staff’s belongings | Opportunistic theft |
Layered security: the approach that works
No single measure stops theft. The most effective approach combines several layers, so that if one fails, another still protects the asset.
Layer 1: Deter
- Visible, uniformed security presence in high-risk areas.
- Clear signage for CCTV and restricted areas.
- Good lighting in corridors, car parks and delivery areas.
Layer 2: Control access
- Pharmacy, drug rooms and equipment libraries limited to authorised staff by swipe card or PIN.
- Regular review of who has access, with leavers removed promptly.
- Audit trails checked for unusual access, such as out-of-hours entries.
- Doors kept closed and never propped open.
Layer 3: Detect
- CCTV covering pharmacy entrances, drug rooms, loading bays and main exits.
- Asset tags with serial numbers, UV marking or RFID.
- Real-time location tracking that alerts staff when equipment leaves a defined zone.
- Intruder alarms on pharmacies and stores when unstaffed.
Layer 4: Respond
- Clear procedures for suspected theft.
- Fast communication between wards, pharmacy and security.
- Good relationships with local police.
Practical patrol and access control tips
- Vary your patrol times and routes so they cannot be predicted.
- Check doors, windows and cabinets on every patrol, especially at night.
- Challenge politely. Thieves often pose as porters, contractors, engineers or visitors. Ask anyone without visible ID who they are and where they are going.
- Watch exits. Pay attention to people leaving with equipment, large bags or trolleys, especially out of hours.
- Know the vulnerable points, such as rear doors, fire exits, loading bays and lifts to car parks.
You cannot search a person or their bag without consent. A search is only possible where the organisation has a clear written policy, the person agrees, and the search is carried out in line with that policy, ideally on camera and with a witness. If someone refuses, do not detain them for a search. Note their description, record the time and direction of travel, secure the CCTV and report to your supervisor and, where a theft is suspected, the police.
Want to work in a hospital control room?
The SIA CCTV course covers surveillance law, evidence handling and control room procedures. Courses start from £250.
Centres include Bethnal Green, Canary Wharf and Forest Gate.
Securing deliveries and drug movements
Deliveries are a high-risk moment. Good practice includes:
- controlled drug deliveries received only by authorised, named staff;
- deliveries never left in corridors or unattended rooms;
- checks that packaging is intact on arrival;
- secure, covered transport of drugs between pharmacy and wards;
- delivery bays monitored by CCTV and, where possible, security staff.
Understanding insider risk
Some drug and equipment losses involve people who work in the organisation. This is sensitive, and it must be handled carefully and fairly. Warning signs can include:
- repeated discrepancies in stock checks or registers;
- frequent “breakages”, spillages or wasted doses without a clear reason;
- altered or incomplete records;
- staff in restricted areas outside their normal duties or shifts;
- equipment regularly going missing from one area.
Do not confront or accuse a colleague yourself. Report your concerns factually to your security manager, who will involve the CDAO, HR and police as appropriate. Many organisations also have confidential speak-up routes.
Protecting data as well as devices
A stolen laptop or tablet can contain patient information. As well as reporting the theft, make sure the IT and information governance teams are told straight away. They may need to lock the device remotely and assess whether a data breach has happened. Speed matters because a serious personal data breach must be reported to the Information Commissioner’s Office within 72 hours of being discovered, so the time you record the theft is part of that evidence.
Start in hospital security
The SIA Door Supervisor course covers patrolling, access control, conflict management and physical intervention, and lets you work as a security guard too.
What to do when a theft is discovered
- Tell your supervisor and the area manager immediately.
- Secure the area and avoid touching anything that might hold evidence.
- Save CCTV footage and access control logs for the relevant period.
- Record serial numbers, asset tags and descriptions of missing items.
- Report to the police and support their investigation.
- For controlled drugs, make sure the pharmacy lead and CDAO are informed.
- Write a factual statement while details are fresh.
Security in smaller settings
GP surgeries, dental practices, care homes and community pharmacies often have no dedicated security team. Simple measures still make a big difference: locked storage, key control logs, alarms, CCTV, careful stock checks and staff who feel confident to ask visitors who they are. Running a practice or care home without a security team? Ask us about group bookings for first aid training for your staff.
How to become a hospital security officer
Hospital security offers shift work and a path to supervisor and LSMS roles. Employers usually ask for:
- an SIA licence. Contracted officers must hold one. In-house NHS security staff are not always required to, but check the job advert, as employers may still ask for it
- a Door Supervisor licence rather than Security Guard, because it includes physical intervention training, which A&E and mental health units often require
- an Emergency First Aid certificate, which the SIA requires for Door Supervisor and Security Guard training (our courses include it)
- a CCTV licence for control room roles
You can book all of these courses with us at our partner centres, and the Door Supervisor and Security Guard courses include Emergency First Aid on day one.
Build a career in healthcare security
Learn access control, patrolling, CCTV operation and incident reporting on our SIA courses in London.