Since the PPAEMA final rule took effect on March 9, 2026, every EMS agency has been working the same problem: the storage cabinet has to be substantially constructed and non-removable, access to it has to be controlled, and the records have to show who opened it, when, and for how long. Paper logs do not get you there.
There are three ways agencies are solving it. They cost very different amounts and they are not equally good at the same things.
Option 1: Retrofit access control into the cabinets you already own
Keep the enclosures. Replace the lock.
Electronic cylinders go into the existing narcotics cabinets, and a programmable key carries each user’s permissions. Access is restricted by user, shift, role and time window. Every event is stamped and stored, and the logs upload to an administrative dashboard.
Where it wins. Cost is the obvious one. You are buying cylinders and keys rather than a box for every vehicle and every station, and on a large fleet that difference is not marginal. Installation is the second one. No wiring, no power at the cabinet, no network. On a vehicle, that removes the whole electrical conversation. The cylinders have no keyways, so they cannot be picked. And a lost key is disabled from a desk in seconds rather than triggering a fleet rekey.
Where it does not win. The upload is not live. Events are captured continuously but reach the dashboard when the key is docked, so an administrator is not watching activity in real time. It records access, not medication. You will know who opened the cabinet and for how long. You will not know from the lock what came out of it. And critically: if your existing cabinets are not substantially constructed and non-removable, a better lock does not fix that. The rule has a requirement about the enclosure and a requirement about access, and this addresses the second one.
Who it suits. Agencies with a fleet of cabinets already in place that meet the construction requirement, where the gap is accountability rather than the box itself, and where replacing everything is not budgeted.
Option 2: Replace the cabinets with purpose-built safes
Buy new enclosures with the access control integrated.
Products in this category offer PIN, card and fingerprint access, two-person authentication, configurable schedules, and tamper-evident construction, with logging designed to export in DEA formats.
Where it wins. One vendor, one system, one support number, and the enclosure and the access control are certified together. Biometrics and two-person authentication are available out of the box. Alerting can be configured, including expiration and discrepancy notifications.
Where it does not win. You are buying a safe for every location and every vehicle, which is a capital program rather than a purchase. Installation involves power and mounting. And you are discarding cabinets that may already satisfy the construction requirement.
Who it suits. Agencies standing up new stations or replacing aging enclosures anyway, where the cabinets were going to be replaced regardless and integrating the access control into that cycle makes sense.
Option 3: Full medication-level tracking systems
Track the drug, not just the door.
These systems log medication events rather than access events: what was removed, by whom, when, what was administered, what was wasted and what was returned. Some add temperature monitoring, expiration alerts and mobile reporting.
Where it wins. This is the only one of the three that answers what came out of the box. For diversion investigations and for agencies where the medical director wants medication-level accountability, nothing else in this list is equivalent. Real time reporting and mobile notification are standard.
Where it does not win. It is the most expensive and the most operationally demanding. Staff have to interact with the system correctly on every transaction, and a tracking system with inconsistent user compliance produces records that are worse than useless because they look authoritative and are not. It also requires power and connectivity.
Who it suits. Larger agencies, agencies with a diversion history, and anyone whose medical director or state regulator requires medication-level records.
How to choose
Three questions settle it for most agencies.
1. Do your existing cabinets meet the construction requirement? Securely locked, substantially constructed, and not readily removable. If yes, option 1 is on the table and you may be able to skip a capital program. If no, you are replacing enclosures regardless and the question becomes option 2 or 3.
2. Do you need to know who opened it, or what came out of it? If the requirement is access accountability, options 1 and 2 both satisfy it. If it is medication accountability, only option 3 does.
3. Does anyone need to see it live? If an administrator has to watch activity in real time, that points to options 2 or 3. If periodic audit is sufficient, option 1 works.
There is no answer here that is correct for every agency, and any vendor who tells you otherwise is describing their own catalogue rather than your problem.
For the underlying requirements themselves, see our breakdown of the DEA controlled substance storage requirements for EMS agencies.