The practitioner standard, the dispersal permission, and the one real exception
A hospital is an institutional practitioner (21 CFR §1300.01). The practitioner storage standard is 21 CFR §1301.75: a securely locked, substantially constructed cabinet. Critically, §1301.75(b) expressly permits pharmacies and institutional practitioners to disperse Schedule II–V substances throughout the stock of noncontrolled substances in a manner that obstructs theft or diversion — which is how most hospital med rooms are actually stocked, and the cleanest proof that the practitioner standard is not a vault specification. The man-minute ratings (30 minutes against surreptitious entry, and so on) come from §1301.72, the non-practitioner standard for manufacturers and distributors. They do not govern a hospital.
There is exactly one narrow exception, and naming it is the credibility move: §1301.75(e) requires a Class V security container for four ultra-potent opioids — thiafentanil, carfentanil, etorphine, and diprenorphine — that general hospitals rarely hold. A pharmacy director knows this exists, so an absolute claim that “no weight or rating is ever specified” is falsifiable on sight. And the regulation reaches past the container to the system around it: §1301.71(b) has the Administrator weigh the overall security system against enumerated factors including the adequacy of key control systems and the procedures for handling visitors, maintenance personnel, and nonemployee service personnel. We read those enumerated factors as the case for access discipline and visitor control — our recommendation, grounded in the criteria the regulation names. Records are kept a federal minimum of two years under 21 CFR §1304.04(a).
“The cabinet is almost never where a hospital falls down in an audit. Attribution is — proving who accessed the stock, and when, and that the log is real.”
Sources: 21 CFR §1300.01; §1301.75(a), (b), (e); §1301.72; §1301.71(b)(8) and (12); §1304.04(a). Where a diversion statistic is cited, prefer the ASHP-fielded 2021 national assessment (AJHP 2024;81(4):137–145) over the 66-respondent, industry-authored 2024 survey.
What would change this: Next DEA rulemaking touching Part 1301; any change to the §1301.75(e) list.
Reviewed July 2026 by the Eagle Systems healthcare practice. The systems referenced are how a facility meets the accountability the regulation creates, not a mandate; the accreditation and compliance determinations belong to the organization and its regulators. Current as of Accreditation 360 (eff. Jan 1 2026).