CCTV at pharmacies: Is surveillance enough to curb unauthorised drug sales?

The Ministry of Health has proposed, through draft G.S.R. 791(E) dated 8 September 2026, mandatory CCTV surveillance at pharmacies for the retail supply of prescription medicines, with recordings retained for at least three months. The proposal aims to strengthen oversight of Schedule H, H1 and X drugs and curb unauthorised sales. It remains a draft, pending stakeholder comments and final notification.

The objective is legitimate. The question is whether the regulatory design is proportionate to the problem. The Drugs Rules, 1945 already prescribe significant controls, and stronger enforcement is a legitimate regulatory objective. But CCTV may strengthen evidentiary oversight; it cannot, by itself, substitute for an effective prescription-control regime.

The draft refers to “any drug”, while the Government’s stated objective is to strengthen oversight of Schedule H, H1 and X drugs. As drafted, Rule 65(2A) could therefore require CCTV surveillance for the retail supply of any prescription drug, not merely drugs falling within those schedules. If the intended scope is limited to higher-risk medicines, the rule should say so expressly. An obligation of this breadth should not be left to interpretation, as ambiguity could result in inconsistent enforcement, compliance exposure and avoidable litigation.

A pharmacist can still sell a prescription drug without a valid prescription in front of a camera. CCTV does not authenticate the prescription, establish that the prescriber actually issued it, determine whether the quantity is appropriate, or verify that the medicine supplied corresponds to the prescription. At best, it creates retrospective evidence of the transaction. If CCTV is to have genuine regulatory value, it should form part of an auditable evidentiary chain linking the prescription to the dispensing record, transaction receipt and CCTV timestamp. The draft does not establish this linkage. CCTV should therefore operate as corroborative evidence, not as a substitute for prescription verification and transaction records.

The draft also leaves fundamental compliance questions unanswered. How many cameras are required? Which areas must they cover? Must the dispensing counter be visible? What resolution is required? Is continuous recording necessary? Must the system have time-stamping, backup and tamper protection? Can cloud storage be used? Does the prescription itself need to be captured? An obligation without objective standards can invite subjective enforcement. If the Government mandates technology, it should also define minimum technical standards for compliance.

The proposed three-month retention period is understandable from an enforcement perspective, but it is not matched by an equivalent framework for access, security and use. Who may access the footage? Can a Drugs Inspector demand the entire archive? What happens after three months? These questions matter because pharmacy CCTV can reveal information about an individual’s treatment and health, including when a person sought a particular medicine.

Privacy should therefore be addressed through design. The final rules should establish purpose limitation, controlled access, security, disclosure protocols and deletion requirements. If the State requires the private sector to create and retain a sensitive surveillance record, it should also prescribe the conditions under which that record may be accessed and used. The interaction with the DPDP Act, the constitutional right to privacy and patient confidentiality merits careful consideration.

Operational failures also require attention. A patient may present a valid prescription while CCTV is temporarily unavailable because of a power interruption or hardware failure. The final framework needs a clear downtime protocol and should distinguish deliberate evasion from bona fide technical failure despite reasonable maintenance.

The compliance burden will not be uniform. Large pharmacy chains may already have sophisticated CCTV systems, while a small independent pharmacy may face significant costs of installation, storage, maintenance and data security. If the regulatory concern is concentrated in particular categories of medicines, a risk-based approach should be considered. Regulation should target risk rather than impose identical technological obligations regardless of the nature, scale or risk profile of the dispensing activity.

Hospitals, institutional pharmacies and e-pharmacies also require express treatment. Dispensing may occur pursuant to inpatient orders or emergency protocols, while online transactions may involve digital prescription verification, warehouses and fulfilment centres. Where does “supply” occur for purposes of the CCTV requirement? The framework should be technologically neutral and clarify how these models are covered.

The more fundamental question is whether CCTV is the right regulatory intervention. Other tools could strengthen compliance: electronic prescription verification, transaction-level digital records, prescription identifiers, stronger Schedule H1 record systems, targeted inspections, risk-based surveillance and supply-chain traceability. CCTV may complement these mechanisms, but it should not become a substitute for them.

A workable framework should therefore define the drugs and premises covered; connect prescription, dispensing, transaction and CCTV records; prescribe minimum technical and data-governance standards; provide a safe harbour or alternative process for bona fide technical failures; and address hospitals, institutional pharmacies, e-pharmacies and fulfilment centres.

The Government’s objective is legitimate, but the instrument must be proportionate, precise and workable. As drafted, the proposal is potentially overbroad, under-specified and insufficiently attentive to the sensitivity of the data captured. A more workable pathway would be to define the drugs and premises covered, prescribe clear technical and data-governance standards, phase in compliance, and begin with risk-based inspections and audits before considering a broader CCTV mandate. The issue is not whether pharmacies need stronger oversight; it is whether a blanket CCTV mandate is the right regulatory tool. A camera can record a transaction; it cannot make the transaction lawful. Regulation must do that

(Disclaimer: The above views are based on a review of the quoted draft rules and are views of the author based on his experience in the sector. The views are not to be considered as legal advice.)

The post CCTV at pharmacies: Is surveillance enough to curb unauthorised drug sales? appeared first on Express Pharma.