Storing Controlled Substances: Security Requirements for Pharmacies

The Controlled Substances Regulations, in force since October 1, 2026, set the security outcome for a community pharmacy in two short sections and leave the method to the pharmacy. Health Canada's guidance for community pharmacists and pharmacy technicians (CS-GD-022, September 29, 2026) fills in what it expects to see, and provincial regulators add their own storage rules. This page lays out all three layers, with Ontario's time-delayed safe policy as the provincial example.

What the regulation requires

Four duties apply in every province:

• Every controlled substance is stored in a secure location at the place where the pharmacist practises (Controlled Substances Regulations s. 105).
• Only people the pharmacist has authorized have access to that location (Controlled Substances Regulations s. 105).
• A pharmacist or pharmacy technician takes all reasonable measures to keep secure any controlled substance in their possession (Controlled Substances Regulations s. 108); Health Canada's guidance includes returns awaiting destruction.
• A patient's return is kept in a marked collection container in a secure location that only authorized people can reach (Controlled Substances Regulations s. 104).

Who controls access

Health Canada's guidance makes access a pharmacist's responsibility that cannot pass to a technician, and every pharmacist working in the pharmacy shares responsibility for the secure storage where they practise. The regulation does not say who may be given access: the pharmacist may grant it on operational need and stays answerable for what happens. Two limits are firm. A pharmacist is on site whenever activities with controlled substances take place, so a technician does not have access when no pharmacist is present. And cleaning or maintenance staff who enter an area where controlled substances are stored are supervised by a pharmacist.

What Health Canada's guidance recommends

The guidance does not prescribe a storage method. Controlled substances may sit in a safe or be dispersed on shelves, as long as the method protects them against loss or theft and respects provincial requirements. Its recommendations:

• Put the dispensary on its own alarm zone when the pharmacy is part of a retail space.
• Use one or more physical measures: window protection, locked doors, locked cabinets and drawers, video surveillance, a controlled substances safe, or a time-delayed safe.
• Do not share or post ordering codes, PINs or keys.
• Order quantities that align with prescription volume, so surplus stock is not sitting where it can be lost or stolen.
• Count every controlled substance against the perpetual inventory regularly, in full at least twice a year, and again after any event that compromised security, such as a break-in or suspected internal theft.

Ontario: narcotics in a time-delayed safe

Provincial rules can go further than the federal ones. In Ontario, the Ontario College of Pharmacists' Time-Delayed Safes Policy has all narcotics in a community pharmacy securely locked in a time-delayed safe within the dispensary. The College's security and reconciliation fact sheet adds that controlled drugs and targeted substances may also be stored in a time-delayed safe, in a safe without a time-delay mechanism, or at a minimum in the dispensary area where only authorized pharmacy personnel have access. A pharmacy in another province confirms its own college's storage requirements.

Security measures at a glance

The table separates what the regulation requires from what Health Canada's guidance requires or recommends, with Ontario's policy as one provincial layer.

Where NarcCount fits

Storage keeps stock from going missing; reconciliation is how a pharmacy finds out whether any did. NarcCount compares each physical count with the expected on-hand figure built from the pharmacy's own records and lists every variance for the pharmacist to investigate and explain, so a weakness in storage shows up as a pattern of shortages rather than staying invisible. It does not monitor safes, cameras or alarms.