Medical Centre Security Systems Brisbane

What Queensland law requires a practice to secure, and the narrow part equipment plays

2006 Trusted
since
24/7 Alarm
Monitoring

After the last patient leaves, a Brisbane practice still holds what the law names. Schedule 8 medicines sit in a store the medicines regulation calls an S8 safe, established under a departmental standard by a named person. Patient records are sensitive information, and a health service provider is covered by the Privacy Act whatever its turnover. Staff come back to an empty building. Each duty sits with the practice, not a supplier. Access Alarms installs ordinary commercial security – alarms, CCTV, access control and monitoring – from an Eagle Farm office trading since 2006. Book a technician.

Take an inventory of your own practice at 7pm, once the last patient has gone and the door is locked. There are Schedule 8 medicines in a store the Medicines and Poisons (Medicines) Regulation 2021 calls an S8 safe. There is a medicine register that has to be kept with it, or as close as practicable to it, and reconciled monthly. There are patient files, a server or backup drive, and a scanner queue. There may also be one person still in the building alone. Each of those things carries a duty, every one of them sits with the practice, and equipment plays a narrow part in only some of them.

Why Medical Centre Security Systems Matter in Brisbane

Nothing on that list is unusual, and that is the point.

The Medicines and Poisons (Medicines) Regulation 2021 defines an S8 safe as a lockable medicine store, and section 197 requires the person who establishes it to comply with Queensland Health's departmental standard, 'Secure storage of S8 medicines'. A shared clinic must appoint that person in writing, and a manager for the safe as well. Access Alarms does not supply, install, specify or certify safes or drug storage; Queensland Health publishes the standard, and that is what to read rather than a vendor's summary.
The regulation also decides who may reach the safe. Access may be a key, swipe card, code or biometric, may be given only to an authorised user, and the controls it contemplates include a key that carries no marking identifying what it opens, and a code connected to a system that records when it is used. Ordinary medicines are governed separately: section 198 requires a medicine store establisher to establish and maintain a medicine store for S2, S3 and S4 medicines, and section 199 requires each medicine store for the place to be put where the establisher reasonably believes a member of the public could not access it without being seen by a worker. Both are questions about the room, not the safe.
Records sit under a different rule. The small business exemption for an operator with an annual turnover of $3,000,000 or less does not reach an entity that provides a health service and holds health information other than in an employee record - the OAIC states such an entity is treated as an organisation under section 6D(4)(b), whatever its turnover.
So what can equipment honestly do? Restrict who reaches a room, notice entry out of hours, and record when a door opened - which matters because a suspected S8 loss must be reported to Queensland Health and police by the end of the next business day. Access Alarms installs that ordinary commercial equipment at commercial premises. It makes no practice compliant with anything: the duty-holder in each of those provisions is the establisher, the manager or the APP entity.
Access Alarms technician working on a commercial security system in Brisbane

Since 2006

Why Brisbane Businesses Choose Access Alarms

Access Alarms opened in December 2006 and works from an office at 2/789 Kingsford Smith Drive, Eagle Farm - a Brisbane address a practice manager can drive to. It installs and maintains alarms, CCTV, access control and intercoms, services and upgrades existing systems, and offers 24/7 alarm monitoring through a monitoring centre. Where a business has taken over premises with another company's alarm already in them, it states that in most cases it can service, repair and upgrade that system rather than replace it. That is general commercial trading history and a general commercial service line, and Access Alarms claims nothing more of it. The business describes itself as licensed and insured but publishes no licence number. Ask for the number and the licence class, and check them on the Queensland Office of Fair Trading register yourself.

Before you engage anyone, ask for a Queensland security provider licence number and check it - Access Alarms describes itself as licensed and insured but publishes no number, so ask it of them too. Then take four questions to your own premises, before your next monthly reconciliation rather than after it. Can you name, in writing, the person appointed to establish and maintain your S8 safe and the person appointed to manage it? Can you list everyone who currently holds access to it? Is the medicine register kept with the safe, or as close as practicable to it, as section 206 requires? Is there a fixed way for someone working alone to call for help? Where an answer points to a door, a detector or a record, Access Alarms installs ordinary commercial security from an Eagle Farm office. Where it points to the safe, the register or a privacy decision, it points to Queensland Health, the OAIC and your own adviser.

Common Security Problems We Solve

Nobody can produce a current list of who holds access to the S8 safe

Why it happens

Access is something the regulation lets the establisher give to a person - a key, a swipe card, a code, a password or a biometric enrolment. Whether your own practice can produce a current list of who holds each one is a question only the practice can answer.

Why it matters

The regulation permits access to be given only to an authorised user, and lists keys, swipe cards, codes, passwords and biometric entries as the ways access is given. It also requires the user to keep that device or information secure and to lock the safe when they have finished. A list that has drifted no longer matches the regulation's own condition.

What we do

This is a records exercise before it is an equipment one, and it costs nothing: write down every person who can currently open the safe, check each is still an authorised user, and decide what happens to access when someone leaves. The equipment question is the adjacent one - who can reach the room the safe is in, and whether anyone would know if they did. Access Alarms installs access control and alarm detection at commercial premises; it does not touch the safe.

The medicine store has ended up on a route patients walk unaccompanied

Why it happens

Section 199 turns on the establisher's own reasonable belief about where a medicine store is put, which is a judgement about a particular place at a particular time. Whether it still holds in your own premises is for the practice to revisit.

Why it matters

Section 199 requires the medicine store establisher to put each store where they reasonably believe a member of the public could not access it without being seen by a worker, with a stricter out-of-sight rule again where pseudoephedrine or therapeutic nicotine are held. The section turns on the establisher's own reasonable belief, so the judgement - and the job of revisiting it after every change - belongs to the practice.

What we do

Walk the route a patient can take on their own and ask whether any medicine store on it can be reached unobserved. Where the answer is uncomfortable, the fix is often a controlled door rather than a camera, and Access Alarms installs access control and intercoms at commercial premises. Whether a particular layout satisfies section 199 is not a question for an installer to answer.

The record store, the server and the backup drive sit behind a door anyone in the building can open

Why it happens

That is a question about your own building rather than about any rule: walk to where the records, the server and the backup drive actually sit, and note which doors on the way anyone in the building can open.

Why it matters

Health information is sensitive information, which the OAIC says is generally afforded a higher level of privacy protection than other personal information. Health service providers were also the most commonly affected sector under the Notifiable Data Breaches scheme in 2025, at 225 of 1,205 notifications, and across all sectors the OAIC attributed the majority of the year's notifications - 716 of them - to malicious or criminal activity. No installation addresses that total. What it can bear on is narrower: on the OAIC's own description of the scheme, a data breach happens when personal information is accessed or disclosed without authorisation or is lost, which a stolen server, laptop or box of files can be as surely as a leaked password.

What we do

Treat the record store and the comms cupboard as their own doors rather than as part of the back office, and decide who can open them after hours. Access control and alarm detection are ordinary commercial equipment and Access Alarms installs both. Whether your practice is covered, and what the Act requires of it, is a question for the OAIC or your own adviser.

A clinician finishes notes alone at 7pm and nobody counts that as isolated work

Why it happens

'Remote or isolated' is a defined term in the Work Health and Safety Regulation rather than a description of distance.

Why it matters

The Work Health and Safety Regulation 2011 (Qld) defines remote or isolated work as work isolated from the assistance of other persons because of location, time or the nature of the work, and requires a system of work that includes effective communication with the worker. Section 19 of the WHS Act puts the duty on the practice as the person conducting a business or undertaking, and section 19(5) catches a self-employed practitioner in respect of their own safety. The RACGP Standards for general practices ask, under Criterion C3.5, whether a duress alarm is required, particularly for staff working outside normal hours.

What we do

The RACGP's own practice guidance recommends duress alarms in consulting rooms and at reception, alongside a layout patients must pass reception to get through, locks on medication storage and strong lighting. Access Alarms installs and maintains commercial alarm systems and offers 24/7 monitoring through a monitoring centre. Ask any installer to quote a duress point specifically and to show what happens when it is pressed. The system of work around it - who responds, and when - stays with the practice, and Workplace Health and Safety Queensland is where that question belongs.

What We Design, Install and Support

Commercial Alarm Systems

Intruder alarm systems installed, serviced and upgraded for commercial premises.

Commercial alarms

Commercial CCTV

Camera systems installed and maintained for commercial premises, including analogue-to-digital upgrades.

Commercial CCTV

Access Control

Electronic door control for commercial premises, so entry to individual rooms and areas can be restricted and logged.

Access control

24/7 Alarm Monitoring

Alarm monitoring available 24/7 through a monitoring centre.

Alarm monitoring

Servicing, Upgrades and System Takeover

Servicing, repair and upgrade of existing systems, including systems originally installed by another company.

Security system servicing

Commercial security specialist since 2006

We design, install, monitor and service commercial security across Brisbane, and we take over systems other companies installed.

See commercial security

Need a security assessment for your commercial property? We'll recommend the right system.

Frequently Asked Questions

Does Access Alarms supply or install S8 drug safes?
No. The published service line is alarms, CCTV, access control, intercoms, monitoring, servicing and upgrades. Safes and drug storage are not part of it, and Access Alarms makes no offer to supply, specify, certify or service one. What governs the safe is section 197 of the Medicines and Poisons (Medicines) Regulation 2021, which requires the S8 safe establisher to establish it in a way that complies with a departmental standard called 'Secure storage of S8 medicines'. Queensland Health publishes that standard, along with guidance on storage and record-keeping for S8 medicines. Read those rather than a security company's or a safe manufacturer's summary of them. The adjacent question an installer can help with is the room around the safe: who can reach it, and whether anyone would know if someone was in it at 2am.
Does the Privacy Act apply to a small practice?
Generally yes. Most businesses with an annual turnover of $3,000,000 or less are small business operators sitting outside the Australian Privacy Principles - but the OAIC states that an entity which provides a health service and holds health information other than in an employee record is treated as an organisation and does not get that exemption, under section 6D(4)(b). The rule turns on providing a health service and holding that health information, not on the size of the practice, so turnover settles nothing on its own. Whether it applies to yours, and what the Act then requires of you, is a question for the OAIC or your own adviser.
Can we put a camera in a consulting room or treatment area?
That is a privacy question first and a coverage question second, and Access Alarms takes no position on it. The reasoning worth setting out is this. Health information is sensitive information under the Privacy Act, so a camera capturing a patient in a clinical space is capturing information about that person's health, not merely their image. The OAIC's guidance on APP 3 states that, unless an exception applies, sensitive information may generally be collected only where the individual consents and the collection is reasonably necessary for one or more of the entity's functions or activities - an objective test the OAIC frames as whether a reasonable person who is properly informed would agree the collection is necessary, with proportionality implicit and a data minimisation approach expected. The RACGP's own practice guidance goes no further than using CCTV where appropriate with prominent signage, and does not address cameras in clinical spaces. Settle it with your privacy adviser or indemnity insurer, record the decision, and do it before a quote is drawn rather than on installation day.
Drugs are missing after a break-in. What does Queensland require of us?
Under section 226 of the Medicines and Poisons (Medicines) Regulation 2021, a person who reasonably suspects an S8 medicine has been lost or stolen must, as soon as practicable and no later than the end of the next business day, both give notice about the incident to Queensland Health's chief executive in the approved form and notify the police service. The trigger is reasonable suspicion, not proof, and the clock starts when the practice finds out. Separately, the manager of the safe must reconcile the medicine register against the medicines physically held at least monthly, and record the date of that reconciliation in the register - which is why a practice that first learns of a shortfall at reconciliation can be a month behind the question. Both notifications will ask what happened. Being able to say when the premises were entered, and for how long, is a materially better position than not knowing.
Will a security system make our practice compliant?
No. The answer sits in the wording of the provisions themselves, so read who each one names as the duty-holder. The S8 safe establisher must establish the safe to the departmental standard. The manager must keep the register and reconcile it monthly. The person who reasonably suspects a loss must notify Queensland Health and police. The APP entity holds the privacy obligations. The person conducting a business or undertaking owes the work health and safety duty. Not one of them is a supplier of equipment. What a system contributes is narrower and still worth having: it can restrict who reaches a room, notice entry out of hours, and record when a door was opened. Route the questions themselves to the right place - Queensland Health for medicines, the OAIC for privacy, Workplace Health and Safety Queensland for staff safety, and your own adviser for how any of it applies to your practice.

Protect Your Business

Get a security assessment for your commercial property. Free quote, no obligation.

Call 1300 049 969