Healthcare

Why Shared PINs on Medication Carts Are Still IT’s Problem

Team Kinetic-ID

Oct 28, 2026

4 min read

NHS England's Smartcard guidance says passcodes should never be shared, yet shared PIN codes on medication carts are still standard practice on many wards, and IT teams are the ones dealing with the consequences.

Key takeaways

On many NHS wards the medication cart is still secured by a single PIN code that every nurse knows, often unchanged for months and sometimes still the manufacturer's default.
NHS England's Smartcard guidance says passcodes should never be shared and that Smartcard access is traceable to the cardholder, a standard the medication cart rarely meets.
Jammed locks, forgotten codes and resets after staff changes all become support tickets, and most need someone from IT on the ward, because a mechanical PIN lock can't be reached remotely.
A shared PIN leaves no record of who opened the cart or when, which is an accountability gap when something goes wrong with medication.
Individual authentication by RFID card, NHS Smartcard or personal 2FA credential for every drawer access to a named person and gives IT a view of the whole fleet from a central dashboard.

Ask an IT service delivery manager in an NHS hospital what takes up more of their time than it should, and drug cart PIN codes will usually be somewhere near the top of the list. It isn't a strategic problem and it rarely reaches board level, but it is persistent, time-consuming and quietly expensive.

It keeps coming back because the whole arrangement rests on a flawed premise, that a four-digit code shared across a ward counts as security. In practice it is a convenience that looks like security, and IT teams are left carrying the consequences.

What Happens with Shared PINs on NHS Wards?

On many NHS wards the medication cart is secured with a PIN code that every nurse on the ward knows. Sometimes it is written on a sticky note inside the treatment room, sometimes the same code opens every cart on every ward in the hospital, and it often hasn't been changed in months. In many cases it is still the manufacturer's default.

When a lock jams, IT gets the call. The same happens when someone forgets the code, when a PIN needs resetting after a staff change, and when a lock breaks because someone forced it after entering the wrong code, whether that is at 8am on a Monday, 11pm on a Friday or over a bank holiday weekend.

Each of those calls opens a support ticket with a resolution clock running, and in most cases the fix needs someone from IT to walk to the ward, because a mechanical PIN lock on a metal trolley can't be reached remotely.

NHS England's Smartcard guidance is clear that passcodes should never be shared and should be kept safe and secure. Shared PIN codes on medication carts are still standard practice in many NHS hospitals.

Illustrative flow comparing two support routes: with a shared PIN, the ward calls IT, a ticket is logged, an engineer walks to the ward, fixes the cart and closes the ticket with no access record; with individual authentication, a nurse opens the cart with their own card or passcode, the access is logged to a named person, and IT sees cart status remotely on a fleet dashboard — With a shared PIN and mechanical lock, every access problem becomes a ticket and a walk to the ward. With individual authentication, access is logged to a named person and IT sees cart status remotely.

Why Does IT End Up Owning This Problem?

Mostly because nobody else does. Nursing leadership sees the cart as furniture, pharmacy sees it as a storage unit and estates handles the physical maintenance, which leaves the PIN code, the access control and the audit trail, or the lack of one, with IT by default.

The calls are only part of it. When something goes wrong with medication on a ward, one of the first questions is who accessed the cart, and with a shared PIN there is no answer: no log, no timestamp and no way to trace access back to a named person. IT teams recognise that as a governance problem, but the cart has no intelligence of its own, so they have nothing to fix it with. We look at what that missing data means for a ward in What Should Your Medication Carts Tell You?.

That is the root of the headache. IT is responsible for access control across the hospital, from Smartcards to network logins and system permissions, and the expectation for those is explicit. NHS England's guidance says access to patient data through a Smartcard is auditable and traceable back to the cardholder, and trust policies such as RDaSH's Registration Authority policy tell staff they must not share their PIN codes or passcodes. Almost every other access point in the building has individual authentication, audit logging and traceability, while the medication cart is often still running on a shared code and a mechanical lock.

What Does a Shared PIN Cost a Hospital?

Very few hospitals track it, which is part of the problem, but working back from what IT teams deal with shows how the cost builds up.

Each support call takes time across the call itself, logging the ticket, walking to the ward, diagnosing the fault, fixing it and closing the ticket. As a rough guide, a broken lock can take two to three hours from call to closure and a PIN reset around 30 minutes, and across a fleet of 40 to 100 carts that adds up to hours of IT time every week on a problem that shouldn't exist.

There is also the time nobody logs, which is the nurse waiting for IT to arrive. Until the lock is fixed the cart is out of action and the drug round is delayed, and the usual workaround of borrowing medication from another cart or ward creates governance issues of its own.

Then there is inspection. The CQC's medicines optimisation quality statement covers how medicines are stored and how controlled drugs are managed and overseen, and if an inspector asks how access to the medication cart is controlled, "a shared PIN that everyone knows" is an uncomfortable answer for everyone in the room.

What Changes When You Remove the Shared PIN?

With individual authentication, each member of staff opens the cart with their own identification, whether that is an RFID card, an NHS Smartcard or a personal 2FA credential. The system logs who opened which drawer, when and for how long, and that data goes to a central dashboard where IT can see the whole fleet.

	Shared PIN and mechanical lock	Individual authentication
Who opened the cart	Unknown, because everyone uses the same code	A named member of staff, per drawer
When, and for how long	Not recorded	Timestamped, with the drawer and duration
A member of staff leaves	Code reset on every cart they knew, on site	Their access removed centrally
Forgotten or compromised code	Support call and a visit to the ward	No shared code to forget or pass on
Lock or battery problem	Found when the drug round stops	Visible to IT on the fleet dashboard
Inspection question on cart access	"Everyone on the ward knows the code"	An audit trail of every access

For IT, the first change is in the support queue. PIN resets, jammed mechanical locks and unannounced code changes drop away because access is electronic, and when there is an issue IT can usually see it on the dashboard without walking to the ward.

The second is the audit trail. Every access is attributed to a named person with a timestamp, so when something goes wrong there is a record, and the question of who accessed the cart finally has an answer for IT as well as for governance.

The third is visibility of the fleet. IT can see which carts are in use, which are idle and which have battery issues, and where the hospital runs a real-time location system, where each cart is. That is the difference between managing connected devices and managing metal boxes that go quiet once they leave the loading bay.

Med-Safe is Kinetic-ID's medication cart built around this model. Its PRO and FULL tiers replace the shared code with staff-specific access by username and passcode or NHS Smartcard tap, record every drawer access in a tamper-evident audit trail, and give IT a dashboard showing the real-time status of every cart, with battery status reported through Kinetic Pulse. Lost cards can be frozen and accounts suspended centrally, and a mechanical override key means a ward is never locked out if the electronics fail. Our introduction to Med-Safe covers the three tiers in more detail.

Why Does This Matter for IT Specifically?

IT is measured on ticket resolution times, so every PIN-related call that takes two hours to close drags on the metrics, every walk to a ward for a fault that could have been diagnosed remotely is time lost, and every cart that goes dark after deployment is a support liability.

Intelligent access removes the PIN, and it also brings the medication cart into the same managed estate as everything else IT looks after. Laptops, phones and printers are all managed remotely, and the technology to do the same for medication carts already exists. What decides it is whether the hospital buys carts on specification and price alone, or buys connected devices that IT can support.

The Question for IT and Procurement Leads

Every hospital has medication carts, and many still run on shared PINs and mechanical locks that generate support tickets, leave accountability gaps and give IT no view of the fleet. How those carts are used is also shifting as wards change shape, which we look at in What Happens to the 8-to-1 Ratio When Wards Go Single Room?.

So when a cart is next due for replacement, the decision is whether to buy the same problem again, or a cart that removes the shared PIN, logs every access and gives IT the same remote visibility it has over every other device in the building.

If your medication carts still run on a shared PIN, here's how we help

Med-Safe replaces the shared code with staff-specific access by 2FA or NHS Smartcard, logs every drawer opening to a named person, and gives IT a live view of the fleet, with battery status reported through Kinetic Pulse. It comes in PIN, PRO and FULL tiers, so a hospital can start with centrally managed codes and move to individual access. Our solutions team can walk you through which tier fits your wards and your IT set-up.

Speak with a solutions consultant →

Frequently Asked Questions

Shared PINs leave no individual accountability for medication access, so if something goes wrong there is no way to trace who opened which drawer, or when. NHS England's Smartcard guidance states that passcodes should never be shared, yet shared PIN codes on medication carts remain standard practice on many wards.

Intelligent access replaces a shared PIN code with individual authentication. Each member of staff opens the cart with their own identification, such as an RFID card, an NHS Smartcard or a personal passcode, and every access is logged with a timestamp against a named person, creating a full audit trail.

It cuts support calls, because there are no PIN resets or jammed mechanical locks to deal with, and it lets IT diagnose problems remotely from a central dashboard. It also brings medication carts into the same managed estate as other hospital devices, so IT can see fleet status, battery health and access patterns without walking to the ward.

The CQC's medicines optimisation quality statement covers how medicines are stored and how controlled drugs are managed and overseen. Individual authentication with per-drawer audit logging gives a hospital a digital evidence trail that a shared PIN can't, so when an inspector asks how cart access is controlled, there is a clear answer.

References

1. NHS England. Smartcards and access controls. 'Passcodes should never be shared and should be kept safe and secure.' Available at: england.nhs.uk/long-read/smartcards-and-access-controls

2. Elliott, R. et al. (2018). Prevalence and economic burden of medication errors in the NHS in England. EEPRU.

3. Berdot, S. et al. (2014). A national survey of inpatient medication systems in English NHS hospitals. BMC Health Services Research. PMC3943404.

4. RDaSH NHS Foundation Trust. Registration Authority Smart Cards Policy and Procedure. PIN codes or passcodes must not be shared.

This blog draws on NHS England policy guidance, national survey data, and internal observations from Kinetic-ID deployments across NHS hospitals.

‍

Want to see what medication cart management looks like without shared PINs?

Book a demo with the Kinetic-ID team.