Alarm and Video Installation for Oklahoma Independent Pharmacies

DEA security factors under 21 CFR §1301.71(b) explicitly evaluate the adequacy of detection systems, supervision over employees with controlled substance access, and procedures for handling visitors and service personnel. Note the wording of §1301.71(b)(9): it weighs “the adequacy of electric detection and alarm systems, if any.” That “if any” is the whole story. DEA evaluates what you have. It does not tell you to have it.

Oklahoma is the exception that matters: OAC 535:15-3-4(8) makes an electronic alarm and video recording system an explicit requirement. Texas §291.33 mandates the alarm and permits cameras (“may have additional security by video surveillance camera systems”), which is a genuine difference between the two states and worth knowing if you hold licenses in both.

UniFi Protect delivers commercial-grade camera coverage across every operationally relevant zone: controlled substance vault interior and exterior, dispensing counter, compounding areas, will-call shelves, drive-through windows, back-door receiving, and customer-facing retail. AI-based detection identifies people and vehicles. License plate recognition logs every wholesaler delivery and every after-hours visitor.

Recording is continuous to local NVR hardware regardless of internet status, the cameras keep recording whether the internet is up or down. All footage records to storage hardware you own, inside the pharmacy, accessible only by personnel you authorize.

This is the gap in OAC 535:15-3-4(8) that most pharmacies do not notice until it matters: the Board requires a video recording system and never says for how long. There is no DEA number either. So the number is yours to choose and yours to defend.

We choose it against how investigations actually run. DEA Diversion Investigators routinely reference incidents from sixty, ninety, or more days back. Robbery follow-up runs for weeks. Internal diversion usually surfaces in a cycle count that flags a discrepancy traceable to a shift weeks earlier. UniFi Protect is configured with retention sized for those timelines, typically 90 to 180 days, longer where risk profile or carrier requirements warrant it, and documented so you can show the Board a deliberate decision rather than a default.

Footage is organized and searchable by date, time, camera, and event, so when the Board or law enforcement asks for a specific date or shift, you produce it from your own storage in minutes. (Texas’s 72-hour production rule at §291.34 covers pharmacy records rather than video, but the same principle applies: a deadline you cannot meet from your own hardware is a deadline you do not control.)

21 CFR §1301.75 requires controlled substances to be stored in securely locked, substantially constructed cabinets, and the §1301.71(b) security factors require accountability measures around employee access. Texas §291.33 requires pharmacist-in-charge documentation of every individual authorized to enter the prescription department, with written records of any non-employee who accessed the area while a pharmacist was off-site. Oklahoma applies analogous restrictions through OAC Title 535.

UniFi Access enforces and documents every one of those requirements at the physical layer. Every door to the vault, the prescription department, the compounding area, and the after-hours staff entry is logged with timestamp, credential, and a camera-linked video record. Time-based permissions automatically restrict access outside authorized hours. Credentials revoke from the management console in seconds when an employee separates: no rekeying, no lock changes, no exposure window between termination and access removal.

When DEA asks who accessed the Schedule II vault on a specific date and time, you produce a timestamped, video-confirmed answer in seconds. When an internal diversion investigation begins, you have the credential trail and the footage from the same platform.

Both states put an alarm in your pharmacy. Oklahoma’s OAC 535:15-3-4(8) requires an electronic alarm system, and Texas §291.33 requires “at a minimum, a basic alarm system with off-site monitoring and perimeter and motion sensors.” DEA’s §1301.71(b) then weighs whatever you have.

We are not an alarm company, and we will not pretend to be one. Installing or monitoring alarm systems requires a license from the Oklahoma Department of Labor or Texas DPS. We refer that work to a licensed contractor you engage directly.

Where we help is the part the alarm depends on and nobody quotes: the network and the connectivity that carry the signal off-site. Texas requires off-site monitoring by rule, which means an alarm on a connection that drops is an alarm that does not reach anyone. Cellular failover and a properly segmented network are how that requirement survives an outage.

Consumer and prosumer cloud camera vendors generally will not sign a Business Associate Agreement. (Several enterprise platforms will, so ask yours directly rather than taking our word for it.) A camera at the dispensing counter that captures a patient’s name on a prescription bottle, a label visible during fill, or an identifying conversation is capturing PHI-adjacent imagery.

Being careful about the law here, because vendors on both sides overstate it: HHS has never squarely addressed whether counter or waiting-room video is PHI, so treat this as risk rather than settled fact. What is settled is the OCR cloud guidance: a cloud provider that maintains ePHI is a business associate even if it never looks at the data and the data is encrypted, and using one without a BAA violates §164.308(b)(1). If the footage is PHI, the gap is real. That conditional is the honest shape of the argument.

For Texas pharmacies, Chapter 181 defines covered entity more broadly than HIPAA, reaching nearly any organization that assembles, collects, analyzes, uses, evaluates, stores, or transmits PHI of a Texas resident. Whether that captures your camera vendor is a question for your counsel, not for us.

Every system Red River Integration deploys records and stores locally. Footage lives on Network Video Recorder hardware you own, inside the pharmacy, on a network segment isolated from your dispensing system and your business network. No third-party cloud.

No vendor servers. No BAA gap because there is no third party in the loop.

UniFi enterprise networking provides the foundation (managed switches, enterprise routers, professionally configured wireless coverage) with proper VLAN segmentation that isolates dispensing systems, point-of-sale, surveillance and access control, e-prescribing infrastructure, guest Wi-Fi, and back-office systems from each other. To state it accurately: PCI DSS v4.0.1 does not require segmentation. What it does is put your entire network in scope for assessment if you skip it. Segment the cardholder data environment and the assessment stops at that VLAN. UniFi makes that straightforward to implement and document. Segmentation is also the technical safeguard most overlooked in independent pharmacy IT.

A flat network, where every device sees every other device, means a compromised guest device or a compromised IoT thermostat can reach your dispensing system. Proper segmentation eliminates that path entirely.

UniFi Protect records continuously to local NVR hardware on your network regardless of internet status: that footage is captured and retained on infrastructure inside the pharmacy, not dependent on a cloud connection. What an internet outage does compromise is everything that depends on a working connection: alarm signal transmission to central station monitoring, e-prescribing and PMP submission, point-of-sale and insurance claim adjudication, real-time alert delivery to the pharmacist-in-charge, and the management plane for surveillance and access control. UniFi 5G Max provides automatic dual-SIM cellular failover: the moment your primary connection drops, the system fails over without manual intervention and your alarm signaling, e-prescribing, point-of-sale, and management capabilities stay online without interruption. For pharmacies in rural service areas across Southwest Oklahoma and North Texas where wired internet reliability is inconsistent, 5G Max can also serve as the primary connection, the difference between a continuous compliance posture and an alarm signal that didn’t transmit.