1. Objective Setting:
   • Define the scope and objectives of the penetration test. Focus on systems that store, process, or transmit patient data, including pharmacy management systems, electronic health records, and online prescription services.
2. Compliance Considerations:
   • Ensure the test aligns with NHS and General Pharmaceutical Council (GPhC) guidelines.
   • Understand the requirements of the DSPT and the UK’s General Data Protection Regulation (GDPR).
3. Choosing a Testing Provider:
   • Select a reputable and certified penetration testing provider.
   • Ensure they have experience in healthcare and are aware of the specific needs and regulations of the sector.
4. Pre-Test Preparations:
   • Notify all relevant parties, including staff and possibly the Information Commissioner’s Office (ICO), if required.
   • Back up all systems and ensure that there are contingency plans in place in case of system disruptions.
5. Conducting the Test:
   • Perform the test during off-peak hours to minimize disruption.
   • Include both external (networks, applications, and perimeter defenses) and internal (behind the firewall) aspects.
   • Test for a wide range of threats, including SQL injection, cross-site scripting, and ransomware.
6. Data Handling:
   • Ensure that all data collected during the test is handled securely and in compliance with GDPR.
   • Sensitive data should not leave the premises or be exposed to unauthorized personnel.
7. Post-Test Analysis:
   • Review the test results with the testing provider.
   • Prioritize vulnerabilities based on their potential impact and the likelihood of exploitation.
8. Remediation Plan:
   • Develop a prioritized action plan to address identified vulnerabilities.
   • Consider both technical fixes and changes in processes or staff training.
9. Documentation and Reporting:
   • Document the entire process and results for compliance purposes.
   • Report significant vulnerabilities and incidents to the relevant authorities as required by law.
10. Review and Continuous Improvement:
    • Schedule regular penetration tests (at least annually).
    • Review and update security policies and procedures in light of test findings.

Additional Considerations:

• Staff Awareness and Training: Ensure staff are aware of the test and understand the importance of cybersecurity.
• Legal and Ethical Considerations: The test should be legal, ethical, and not harm patients or their data.
• Budget and Resources: Allocate sufficient budget and resources for both the test and the subsequent remediation actions.

Remember, the specifics of the plan will vary based on the size of the pharmacy, the complexity of its IT systems, and the types of data handled. It’s also important to stay updated with NHS and GPhC guidelines, as they may change over time.

This is the first question the GPhC ask in their GPhC voluntary logo application form. It is of primary importance to them as one of the greatest risks associated with dispensing medicines online is ensuring the Prescription Only Medicine that is dispatched to the patient is received by the patient that needs it.

There have been a few documents considered Best Practices in the UK on this subject, most notably:

• UK Government Good Practice Guide (GPG) 45 – details the different confidence levels (listed below).
• The Royal College of General Practitioners – mainly talks about ID verification online for GP services.
• Patient Online Services in Primary Care – by NHS England details out what is considered Good Practice Guidance on Identity Verification in primary care.

In summary, there are 4 different levels of confidence:

• low confidence
• medium confidence
• high confidence
• very high confidence

If you are a healthcare provider you should be looking to get as close to high confidence as possible, however, this is often weighed against the practicality of the validation process which can take up a lot of the patient’s time and can be frustrating.

Low confidence in someone’s identity

Compared to not doing any identity checks, having low confidence in someone’s identity will lower the risk of you accepting either:

• synthetic identities
• impostors who do not have a relationship with the claimed identity

Medium confidence in someone’s identity

Having medium confidence in someone’s identity will protect you against the same things as low confidence. It will also lower the risk of you accepting impostors who have information about the claimed identity that’s not in the public domain.

For example, it would protect you against someone who works for the claimed identity’s employer’s HR department from using any information they have to impersonate the claimed identity.

High confidence in someone’s identity

Having high confidence in someone’s identity will protect you against the same things as medium confidence. It will also lower the risk of you accepting impostors who:

• know the claimed identity (this includes their close friends or family)
• do not match the claimed identity’s photo or biometric information
• Very high confidence in someone’s identity
• Having very high confidence in someone’s identity will protect you against the same things as high confidence. It will also lower the risk of you accepting impostors who are trying to look like the claimed identity, for example by wearing a mask or make-up.

How to check a patient’s capacity online.

The ethical concept of respecting autonomy and giving informed consent to medical treatment both depend on one’s ability to make their own decisions. Therefore, assessing a person’s capacity to make decisions is a fundamental component of all interactions between a prescriber, dispenser and patient. In the UK, as many interactions online are the first instance that the patient has come across that particular access point to the healthcare system, the only way is to ask the patient directly whether they have capacity. This may be in the form of a statement, such as:

Greetings! Your online consultation is built around the answers to this questionnaire. Please be truthful, and if you have any questions about any of your responses, check with your doctor before utilising the service:

• I am 18 years old or above.
• I am using this service on my own behalf and of my own free will. Any treatment or advice is for my sole use only.

After this initial statement which excludes age capacity and free will a more precise statement should read as follows:

I confirm the above statements are true
We try our best to help our patients, but sometimes our online service is not able to meet all of your needs. If you need help filling out forms, reading, writing or understanding complicated information, or your acne is severely affecting your mood and self-confidence, then please see your GP.

As part of our service, we will need at least two photos which clearly show the acne, so we can give you advice. We may suggest treatments that you can choose to purchase online, or we may refer you back to your GP if we feel treatment online is not the best option for you.

Conclusion

Patient identification mistakes can affect patient care and safety, reimbursement, data sharing, and interoperability, among other things. Worldwide, a variety of patient identification methods, including hybrid models, algorithms, and unique patient identities, have been put into use. However, no patient identification method currently in use has achieved a 100% match rate.

The best way to meet the requirements set out by the different regulators is to use a third party service provider known as a Know your patient (KYP) service provider. This will ensure you meet one of these confidence levels but work towards improving to a higher level. There are a wide range of service providers here is a short list we have found:

• www.veriff.com
• www.onfido.com

Key Points

• Many prescribers are now undertaking duties and procedures that were previously done by doctors.
• If a non-medical prescriber takes on a task that was previously undertaken by a medical practitioner, then their competence to perform that role needs to be at the level of a medical practitioner.
• Prescribers are accountable to the public through criminal law, their patients through civil law, and their employer and their profession through their contract of employment.
• To ensure that they abide by the law, a prescriber needs to keep their knowledge and skill up to date and to work within their competencies.

This article will give a general overview of the English legal system and describe how it operates in England, Wales, and Northern Ireland with respect to medical liability. Additionally, it will look at how the law would see prescribers in relation to their duties as practitioners and assess the legal ramifications for those working in England, Wales, or Northern Ireland.

Online Prescribing in England

There are several tiers to the English legal system, including criminal law and civil law.

• In criminal law, a person is detained by the police and charged with breaching the law. The Crown Prosecution Service brings the case to court, where the person has to be found ‘guilty beyond reasonable doubt’.
  
• In civil law, a person files a lawsuit against another person or business.. The case is heard in a civil court, and the person may be found guilty on a ‘balance of probability‘, rather than absolutely, as is the case in criminal cases. Because no one may be imprisoned in a civil court, it is easier to establish guilt.
  

Accountability

As a non-medical prescriber, you are accountable to:

• The patient, through civil law
• The public, through criminal law
• The profession, through the professional code of conduct.
• Your employer, through your contract of employment.

Accountability to the patient through civil law

A patient may file a civil lawsuit to recover damages if they were harmed or lost something as a result of your activities, especially if they were rendered unable to work.

The plaintiff (patient) would only have to prove on a ‘balance of probability’ that you were to blame. The practitioner’s professional standards would be used to establish liability, in general, there is often clause pertaining to:

You must be confident in your own evaluation of the patient or client before you can write a prescription for them. This assessment must include obtaining a complete history from them and, if at all feasible, viewing their whole clinical file.

Criminal law

• Criminal law is the system for the state punishment of offences.
• Under criminal law, a person can be imprisoned, have sanctions, such as movement restrictions (electronic tags), imposed against them or can incur financial penalties (fines).
• In a criminal case, the Crown usually brings the prosecution, known as the action, against the defendant.
• An individual may bring a private prosecution, but in practice, these are very rare.
• A criminal case is usually referred to as R v Smith, which is the Regina versus Smith.
• Regina is the official title of a reigning Monarch.
• Because the present monarch approved the laws, the person is breaking the laws endorsed by the Queen, hence R v Smith.
• 95% of all criminal cases are tried by a Magistrates’ Court.
• These courts are composed of justices of the peace (JP), who are laymen or women and not lawyers.
• They have limited powers, in as much as they can only give sentences up to 6 months’ imprisonment and/or a £5,000 fine.
• Magistrates try minor criminal offences, such as petty theft and road traffic offences, in a local courtroom.
• In addition, they hear evidence in relation to more serious criminal offences before committing these cases for trial at the Crown Court.
• In the Crown Court, cases are heard by a judge, usually sitting with a jury of 12 laypersons selected at random from the electoral register in the local community.
• Criminal charges in relation to the care of a patient are rare, but when they do arise they attract considerable publicity, such as the prosecution of Dr Harold Shipman in 2000.

Civil law

• In civil law, the action is brought by a person who has suffered harm or loss — known as the plaintiff — against another person or organisation — known as the defendant.
• The plaintiff seeks a remedy, usually in the form of financial compensation (damages). In addition, the plaintiff may claim an ‘injunction’ to stop a particular type of conduct.
• A civil law case is normally referred to as Bloggs v. Smith, and the legal term for a civil wrong is a tort.
• Examples of torts include negligence, trespass (to property, land or person), nuisance, breach of statutory duty and defamation.
• Civil cases, where the claim is for less than £50,000, are tried in a County Court (which is a local court); thus, county courts deal with 75% of all civil litigation.
• A judge will sit alone to settle these cases; however, cases where the claim is over £50,000 are tried in the High Court, and a jury can be called for these.

Public law

• In some situations, a person may want to challenge a decision of a government body, health authority or other public body.
• They may claim that the public body went beyond the powers given to it by statute or that it has wrongly exercised a discretion granted under statute.
• Such claims against public bodies are called ‘judicial reviews’ and the court determines if the public body has acted legally.
• The Royal Brompton Hospital in London is presently seeking a judicial review in an attempt to block the closure of its children’s heart surgery unit as part of plans for major reorganisations of the NHS.

Accountability to the public through criminal law

If you intended to do harm to your patient and knowingly gave them a drug that would cause harm, the police would investigate and could prosecute you for administering a noxious substance so as to endanger life or inflict grievous bodily harm (GBH). The Offences Against the Persons Act 1861 contains two offences of wounding or causing GBH, under Sections 18 and 20. Section 18 is by far the most serious because it carries a maximum sentence of life imprisonment, whereas the maximum sentence under Section 20 is 5 years. The difference is that the prosecution must prove that you intended to cause serious bodily harm under Section 18, whereas they need to only show that you acted recklessly under Section 20.

Under both sections, an assault that causes grievous bodily harm or wounding is defined as follows: ‘To constitute a wound the whole skin must be broken. It must be more than a scratch, but one drop of blood would be sufficient.’ Grievous bodily harm must be ‘really serious harm’, an obvious example of which would be a broken bone. There is no legal definition of grievous bodily harm, however, and it is ‘a question of fact’, for a jury to decide.

Both offences under Section 18 and Section 20 are arrestable under Section 24 of the Police and Criminal Evidence Act 1984. They would be tried at Crown Court because either offence carries the potential for a lengthy jail term.

If it is shown that your carelessness led to the death of your patient, you may be prosecuted for manslaughter. Criminal charges are uncommon but may generate a lot of media attention.

Coroner’s Court

• The coroner must be a barrister, solicitor or registered medical practitioner with at least 5-years standing.
• The main jurisdictions of the coroner are inquests into the death of a person who appears to have died a violent or unnatural death or where death occurred in a prison or psychiatric hospital.
• The purpose of an inquest is to establish the cause of death.
• A coroner may summon a jury of 7–11 people.

You are responsible for your choice to prescribe, and you may only do so in situations when you are adequately informed about the patient’s health and medical background. You would be held accountable if it could be demonstrated that you fell short of the required standard, for example, by failing to determine whether a patient was allergic to penicillin or by prescribing a prescription that interacts negatively with their current treatment.

Accountability to your employer through disciplinary action

Your employer may discipline you if your acts were work-related, especially if you violated your employment contract by failing to follow the right processes and rules.

Accountability to the profession through the professional governing body

Your professional body can remove your name from their register to stop you from practising as a professional if you do not follow their code of conduct. The Council for Healthcare Regulatory Excellence (CHRE) is an independent, non-departmental public body funded by the Department of Health and answerable to Parliament. It scrutinises and oversees the work of nine regulatory bodies, including the NMC, the General Medical Council (GMC), and the Health Professional Council. If the CHRE considers that the decision by a regulatory body has been unduly lenient, it could refer the case to the High Court for a decision.

Professional indemnity insurance

Most professional organisations now insist that practitioners have their own professional indemnity insurance. Whilst employers have vicarious liability for the negligent acts and/ or omissions of their employees, such cover does not normally extend to activities undertaken outside the registrant’s employment. Independent practice would not be covered by vicarious liability. It is the individual registrant’s responsibility to establish their insurance status and take appropriate action.

In situations where an employer does not have vicarious liability, it is recommended that registrants obtain adequate professional indemnity insurance. If unable to secure professional indemnity insurance, a registrant will need to demonstrate that all their clients and patients
are fully informed of this fact and the implications this might have in the event of a claim for professional negligence.

Role expansion

Role expansion is particularly important to prescribers because many are undertaking duties and procedures that were previously done by doctors. In this new role, the prescribers are signing prescriptions, which was a role formerly done by doctors.

Consider the tasks and duties that you undertake. Which of these were previously done by a doctor?

The GMC defines delegation in their Good Medical Practice (GMC, 2006) guide as

‘…asking a colleague to provide treatment or care on your behalf. Although you will not be accountable for the decisions and actions of those to whom you delegate, you will still be responsible for the overall management of the patient, and accountable for your decision to delegate. When you delegate care or treatment, you must be satisfied that the person to whom you delegate has the qualifications, experience, knowledge and skills to provide the care or treatment involved. You must always pass on enough information about the patient and the treatment they need.’

It can, therefore, be argued that the delegating doctor may be negligent if they fail to follow the guidelines listed above. The boundaries between tasks that are undertaken as part of an expanded role and those that follow from delegation are unclear. The law has no mechanism to find a team negligent; rather, it would find particular individuals negligent and usually this is the person in charge.

To bring a successful claim of negligence it is necessary to prove the following:

• The patient (plaintiff) was owed a duty of care by the defendant (prescriber).
• The defendant (prescriber) breached that duty of care by failing to reach the standard required of them by law.
• That the breach caused harm.
• That the harm is of a type that was foreseeable.

Duty of care

The plaintiff (patient) must first establish that the defendant (prescriber) owed him a legal duty of care. In medical negligence, the existence of a duty owed to the patient is usually regarded as automatic, even if the patient has left the hospital. A duty of care appears to be owed as soon as the patient presents for treatment.

This was established by the case Donoghue v Stephenson (1932), in which the House of Lords held, for the first time in this country, that there could be a liability for negligently causing personal injury (Donoghue v Stephenson [1932] AC 562). A decomposing snail was discovered
in a bottle of ginger beer made by the manufacturer, Stephenson, after Mrs Donoghue had drunk some of it.

The basic concept of the law of negligence is: ‘You must take reasonable care to avoid acts or omissions which you can reasonably foresee which would be likely to injure your neighbour. Who then-in-law is my neighbour? The answer seems to be persons who are so closely and directly affected by my act that I ought reasonably to have them in contemplation as being so affected when I am directing my mind to the acts or omissions which are called in question.’
This clearly would show that a duty of care could be established for anyone to whom you issued a prescription.

Breach of standard

The court will have to decide whether a non-medical prescriber or other healthcare professionals or carers have met the standard that the law expects them to meet.
When a non-medical prescriber performs their usual duties, the standard of practice required is that of the ordinary skilled person in his or her speciality. The Bolam test is currently the standard by which the courts in England and Wales assess doctors’ clinical practice (Bolam v Friern Hospital Management Committee [1957] 2 AllER 118; WLR 528). However, the principles of the Bolam test can be applied to examine the actions of any professional person. Similar standards operate in Scotland and Northern Ireland. ‘The test is the standard of the ordinary skilled man exercising and professing to have that special skill. A man need not possess the highest expert skill at the risk of being found negligent…it is sufficient if he exercises the skill of an ordinary competent man exercising that particular art.’

The key words here are professing and exercising.

• Professing is what you say you are — nurse, pharmacist or physiotherapist — and what level you are in your profession.
• Exercising is what you do, i.e. what task were you actually doing?

Doing your job properly is a defence against accusations of negligence. How- ever, if you are performing an expanded role, then the standard is different. The leading case in this area is Wilsher v Essex Area Health Authority (1986) (Wilsher v Essex Area Health Authority [1986] 3 All ER 801). In this case, the plaintiff, Martin Wilsher, was born about 3 months prematurely. He was in a special care baby unit and he was very ill. An inexperienced junior doctor inserted an arterial line into a vein, rather than into an artery. He asked a senior doctor to check the line, but the registrar failed to notice the mistake; furthermore, when the registrar replaced the line himself, hours later, he made the same mistake. The error resulted in a low blood oxygen measurement being recorded, and the infant was given excess oxygen. This caused retrolental fibroplasia, which left Martin Wilsher blind.

A key issue discussed by the Court of Appeal was the standard of legal care to be exercised by the junior doctor in the case. Lord Mustill stated: ‘In a case such as the present, the standard is not just that of the averagely competent and well-informed junior houseman (or whatever the position of the doctor) but of such a person who fills a post in a unit offering a highly specialised service.’
Lord Glidewell stated: ‘In my view, the law requires the trainee or learner to be judged by the same standard as his more experienced colleagues. If it did not, inexperience would frequently be urged as a defence to an action for professional negligence.’ The case was settled for £116,724.40, and the registrar, but not the house officer, was found to be negligent because the junior had done the reasonable thing and asked his superior for supervision. The key point to be taken from the Wilsher case is that a practitioner is liable to be judged by the professional standard of the post that they are holding at the time. This means that, if the practitioner
is performing an expanded role that was previously carried out by a doctor,
the practitioner would be judged by the standard of a reasonably competent doctor performing that role or in that post. If a practitioner undertakes a task for which they have insufficient training, this in itself may constitute negligence.

Of the tasks you undertake that were previously performed by a doctor, do you think you reach the same standard as a doctor? Many new posts have been created, such as transplant clinician’s assistants and cardiac surgeons’ assistants, and many different healthcare professionals can occupy these posts. How would you judge their standard of care?

The courts would have difficulty in assessing the appropriate standard of care for a professional if only one or two posts exist in the country. The court could look at the nature of the tasks performed and determine who normally performs those tasks. If doctors normally undertake these tasks, then a medical standard of care and skill will be expected. Some useful criteria that a court might take into account when determining the standard of care in an expanded role case, could include:

• The nature of the task.
• The way the practitioner ‘holds themself’ to patients.

If the prescriber takes on a task that was previously undertaken by a medical practitioner, then their competence to perform that role needs to be at the level of the medical practitioner. The courts may be looking for the non-medical prescriber to exercise and maintain medical knowledge, and if the non-medical prescriber does not reach the correct standard of competence to do that task, they could be found negligent and in breach of their professional code of conduct.

Inexperience is not a defence to a negligence action. It is very important that prescribers closely adhere to the principles of their professional code of conduct and, in particular, take steps to remedy any deficits in their knowledge. If you are, for example, a physiotherapist performing a task done solely by physiotherapists, and the patient sees you as a physiotherapist and not as another practitioner, you would be judged under the Bolam test. Hence it is important that the patient knows your profession. Alternatively, if the patient had good reason to believe you were a doctor (you were not wearing a uniform or the patient saw you in a GP’s surgery), you might be judged under the standard of care seen in the Wilsher case (i.e. as a doctor).

Causation

The claimant must now demonstrate that the negligent act or omission caused the injury complained of once the duty of care and failure to reach the requisite level of care has been established. The criteria used to determine causality have changed throughout time. If the defendant hadn’t acted or failed to act negligently, would the plaintiff have been injured? That is the first issue the court would require an answer for. This test is known as the “but for” test.

According to civil law, the court must be convinced that the negligent act or omission caused the injury on a balance of probability. It must be demonstrated that there is at least a 50% chance that it was the cause. In complicated medical situations, this is especially challenging.

Foreseeability

Only those harms that are foreseeable can be recovered. In Roe v. Ministry of Health and Others, Woolley v Same (1954), two patients had operations. Before both operations, a spinal anaesthetic consisting of Nupercaine® was administered to the patients by lumbar puncture. The plaintiffs were permanently paralysed from the waist down. The injuries were caused by the Nupercaine® being contaminated by phenol; the ampoules had been immersed in phenol, which had percolated through the glass. Because it was an unforeseeable occurrence, the defendant was not legally expected to anticipate the danger (Roe v Ministry of Health and Others, Woolley v Same [1954] 2 All ER 131).

Lord Denning stated ‘Every surgical operation is attended by risks. We cannot take the benefits without taking the risks. Every advance in technology is also attended by risks. Doctors, like the rest of us, have to learn by experience, and experience often teaches the hard way. Something goes wrong and shows up as a weakness, and then it is put right.

Summary

To bring a successful negligence claim it is necessary to prove the following:

• The plaintiff (patient) was owed a duty of care by the defendant (prescriber).
• The defendant (prescriber) breached that duty of care by failing to reach the standard required of them by law.
• That the breach caused harm.
• That the harm is of a type that was foreseeable.

The defence for a prescriber against negligence is that the prescriber is aware of the standard of care expected for the position they hold and that they have the necessary competencies to maintain that standard of care. To ensure defence, a registered prescriber needs to keep up to date in the knowledge and skills required for the position and work within their competencies. They must also ensure that any deficiencies in their knowledge or skills are corrected before they start prescribing in a particular area.

Many studies have found that people who use psychedelics are more likely to have pro-environmental behavior and ecology beliefs when compared to other people. A recent study by the University of Oregon found that people who took psychedelics were more likely to recycle, donate money to environmental organisations, buy products with less plastic packaging, or use public transportation. The results were not just because of the drugs themselves but also because of the spiritual experiences they create.

Over the last two decades, there has been a gradual political shift, towards a resurgence of psychedelic research, culminating in the first experimental study involving LSD administration in 40 years. First and foremost, many of these new research programs focus on clinical applications of psychedelic substances in the treatment of anxiety and mood disorders. Although oftentimes limited to small sample sizes, preliminary results of these studies indicate that administration of psychedelics can considerably benefit psychotherapeutic interventions, revealing a marked reduction of anxiety in patients who suffer from various life-threatening conditions.

One common experience encountered by many during the neuroplastic state induced by psychedelics is a profound feeling of connectedness or unity—a presumed consequence of a loss of self-awareness or ego-dissolution. This manifests in a sense of connectedness with all living beings, certain plants and animals, or nature as a whole.

References

1.  Manifesting Minds: A Review of Psychedelics in Science, Medicine, Sex, and Spirituality. Doblin, Rick; Brad Burge (2014) North Atlantic Books. ISBN 1583947272.
2. ↑ Lifetime experience with (classic) psychedelics predicts pro-environmental behavior through an increase in nature relatedness. Matthias Forstmann and Christina Sagioglou Journal of Psychopharmacology 2017. DOI: 10.1177/0269881117714049
3. ↑ From Egoism to Ecoism: Psychedelics Increase Nature Relatedness in a State-Mediated and Context-Dependent Manner. Hannes Kettner, Sam Gandy, Eline C. H. M. Haijen and Robin L. Carhart-Harris Centre for Psychedelic Research, Department of Brain Sciences, Faculty of Medicine, Imperial College London. International Journal of Environmental Research and Public Health. Published: December 2019 DOI: 10.3390/ijerph16245147

Recently cybersecurity has become a hot topic within the pharmacy sector. As such, as we intend to be responsive to any new emerging threat to pharmacy technological or otherwise we have created a Standard Operating Procedure to manage Pharmacy Cybersecurity.

Standard Operating Procedure for Pharmacy Cybersecurity

Purpose 

To allow for safe and secure transactions over the internet, applying the utmost care to patient safety and data security.

Scope

Our organisation is committed to and is responsible for ensuring the confidentiality, integrity, and availability of the data and information stored on its systems.The main scope of this SOP covers data security of pharmacy systems. 

General Cybersecurity Measures

1. Vulnerability testing.

Before training can be given to staff about data security, management must first understand the key risks to their organisation in respects to cybersecurity. A vulnerability assessment should be produced to evaluate information system vulnerabilities and the management of associated risk. A vulnerability assessment should include the following:

• servers used for internal hosting and supporting Infrastructure
• servers which will be accessed through a reverse proxy
• desktops and workstations
• perimeter network devices exposed to the internet
• all external-facing servers and services
• network appliances, streaming devices and essential IP assets that are internet facing.
• public-facing applications and devices (wifi connected blood pressure machines, weight scales, BMI calculators etc)
• cloud-based services 

2. Ensure that all staff understand the main cybersecurity threats, more specific detail can be seen below.

Either create your own course for your staff or use a reputable provider like Voyager Medical (courses can be found within the hubnet.io). Within a high-quality cybersecurity, course staff will learn about the importance of using two-factor authentication, enabling automatic updates and the use of anti-virus software / ad-blocking browser plugins.

Specific cybersecurity measures

3. Protection from Malware.

• Detection, prevention and recovery controls – supported by user awareness procedures – must be implemented to protect against malware. Key methods to avoid malware include:
  • installing, updating and using software designed to scan, detect, isolate and delete malicious code.
  • preventing unauthorised Users from disabling installed security controls.
  • prohibiting the use of unauthorised software.
  • checking files, email attachments and file downloads for malicious code before use.
  • maintaining business continuity plans to recover from malicious code incidents.
  • maintain a critical incident management plan to identify and respond to malicious code incidents.
  • maintaining a register of specific malicious code countermeasures (e.g. blocked websites, blocked file extensions, blocked network ports) including a description, rationale, approval authority and the date applied.
  • developing user awareness programs for malicious code countermeasures.

4. Limiting Operation Software.

The installation of software on production information systems must be controlled. To protect the general cybersecurity health of the organisation when installing new software responsible persons should ensure:

• updates of production systems are planned, approved, assessed for impacts, tested and logged.
• operations personnel and end-users must be notified of the changes, potential impacts and, if required, given additional training;
• production systems must not contain development code or compilers.
• old software versions must be archived with configuration details and system documentation; and updates to program libraries must be logged.

5. Limiting patient wifi access.

Some pharmacies offer patients free access to their wifi network. The pharmacy should ensure that this wifi network sits separate from the mechanism by which they communicate patient medical records to the central health authority. If the pharmacy offers a separate wifi access point, the password for guest access should be rotated at a minimum of once a month and staff should be trained to spot potential “man in the middle attacks“.

6. Backup.

Backup copies of information, software and system images must be made, secured, and be available for recovery. More specifically:

• Information Owners and System Owners must define and document backup and recovery processes that consider the confidentiality, integrity and availability requirements of information and information systems. Key aspects all processes must address include:
  • use approved encryption;
  • physical security;
  • access controls;
  • methods of transit to and from off-site locations;
  • appropriate environmental conditions while in storage; and
  • off-site locations must be at a sufficient distance to escape damage from an event at the main site.

7. Event logging.

All staff should be appropriately trained to constantly monitor for cybersecurity threats. In the event that an event occurs this should be reported directly to the staff members line manager. This should be done using the hubnet.io error reporting system, an event should be logged and details recorded. This log for every location within an organisation should be monitored by an authorised management team. Once an event has been identified appropriate corrective action should be taken which includes a report which details:

• identification of the event;
• isolation of the event and affected assets;
• identification and isolation of the source;
• corrective action;
• forensic analysis;
• action to prevent recurrence; and
• securing of event logs as evidence

Review Procedure

This SOP will be reviewed in the event that there are any changes to best practice concerning pharmacy cybersecurity or in the event of staff changes. It will also be reviewed in the event of incidents or errors that have been logged. In the absence of any of these events, it will be reviewed yearly from the date of publication.  

Known Risks

• Security gaps.
• Malware.
• Man in the middle attacks.

A Pharmacy Technician could be placed in a hospital, community pharmacy, general practice or care home. Whilst the role of a Pharmacy Technician in each of these settings is similar: reviewing and recording the medication patients should be taking, ensuring sufficient supplies, administering medicines, and educating patients to support their understanding on how to use their medicines safely, some roles may differ depending on where one is are located. In a hospital, for example, they would be involved in the aseptic preparation of medicines, whilst in a community pharmacy, they may offer advice to patients on public health initiatives such as stopping smoking.

Job growth in the sector is expected to increase by 10.7%, leading to 3,737 new jobs by 2027¹.

According to the National Careers Service², the average annual salary of a Pharmacy Technician in the UK starts at £21,892 and can reach £30,615 for experienced Pharmacy Technicians. Taking an average, a mid-career Pharmacy Technician may expect to earn around £26,254. They would work 37 to 40 hours weekly on this salary.

According to another source³, the average salary was reported to be £25,000 annually (around £1710 monthly), which is about £4600 lower (16%) than the national average salary in the UK. A starting average salary is around £19,000 and the highest salaries, for experienced Pharmacy Technicians can exceed £40,000. A mid-career Pharmacy Technician with 4-9 years of experience could earn £23,800, while a Senior Pharmacy Technician with 10-20 years of experience makes, on average, £32,250. Highly experienced Pharmacy Technicians with more than 20 years of expertise earn £35,800 on average. According to this same source, it’s reported that 86% of Pharmacy Technicians are female, and just 18% are male.

Other sources quoted average salaries as £21,259⁴, £26,778⁵, £26,683⁶, £32,573⁷ and £22,855⁸ annually.

Putting this into perspective, here are some related jobs and annual salaries³:

References:

Pharmacy Technician, accessed on 26/07/21 via https://www.healthcareers.nhs.uk/explore-roles/pharmacy/roles-pharmacy/pharmacy-technician

¹ Job group: Pharmaceutical technicians, accessed on 26/07/21 via https://nationalcareers.service.gov.uk/job-groups/3217/pharmacy-technician

The reality of climate change is becoming harder to ignore and pharmacies are often overlooked in being able to make a difference. Below is a list of our Top 10 ways pharmacies can adopt better environmental practice:

1. Conserve energy

Something all businesses can do is use energy-efficient lighting and heating such as automatic light sensors that turn on or off upon entering or leaving a room and manual thermostats to regulate the temperature, especially when your pharmacy closed.

In addition, powering off inactive electronics conserves energy which, ultimately, saves money. Simply unplugging unused devices and using appliances in power-saving mode helps. A great way to do this is to use a WiFi plug which turns on and off on a scheduled basis, setting this up at the beginning of an extension cord and programming it via Google Home (other services are available!) to switch on 10 minutes before opening and off 10 minutes after closing could save you and the planet a packet!

2. Go paperless

An example of paperless success is the NHS Electronic Prescription Service which is predicted to save the NHS £300m by 2021¹ by reducing paper processing and prescribing errors.

Whilst paper receipts are typically made from the lowest quality paper, minimising the production of vast amounts of mostly unnecessary material can be beneficial. Receipts, once printed, are either discarded immediately or clutter one’s wallet. The average paper receipt costs between $0.015 – $0.05² (£0.011 – £0.036) which may not seem monumental, but if a pharmacy prints 100 receipts a day, annually this would cost, on average, $1186.25 (£856.83). E-receipts, which are emails sent to the customer, could be used, this has the added bonus of creating a marketing mailing list if the customer opts in.

Discontinuing payments using paper cheques to both manufacturers and employees by switching to Direct Debits limits paper usage. Making use of this digital incentive, digital timesheets can be used for employees, as opposed to paper.

3. Encourage green logistics

Another thing all businesses can do is encourage ecologically friendlier transportation of goods and staff to and from work. Using battery-powered delivery vehicles can save massively on fuel costs. Encouraging employees to cycle to work by installing a bike rack is also a great idea.

4. Sell eco-friendly products

Selling environmentally friendly products may attract customers and improve your company’s image. Some examples, specific to a pharmacy are:

• Recycled toilet paper,
• Bamboo toothbrushes,
• Toothbrushes with recycled plastic handles,
• Soap bars,
• Eco-friendly cleaning supplies and cosmetics.

Many pharmacies sell other items for instance, reusable bottles and straws, made from metal or silicone, and stationery made from recycled materials.

5. Use recyclable paper bags

Recent data published by the NHS Business Service Authority showed that across the UK, 92,840,309 prescriptions were dispensed in March 2020³. With large numbers of prescriptions being dispensed, using non-recyclable materials would have catastrophic impacts on the environment, therefore pharmacies should endeavour to use recyclable paper bags. For other items, encourage customers to use reusable shopping bags.

6. Order larger bottles

Specific to the pharmaceutical industry, large amounts of packaging waste is generated. Larger bottles of medications can be ordered from manufacturers rather than several smaller bottles to reduce waste. This may only work, however, if the patient is prescribed this amount, else large amounts of waste can still be produced. See 8.

7. Reuse pill containers

Once a pill container is emptied, they are often thrown away or recycled. Alternatively, if a patient requires a repeat prescription, they could bring in their empty pill container and refill this as opposed to using a new container – all that is needed is a new label. For sanitary reasons, the container should only be used for the same patient and same medication. If this is not possible, you can either repurpose the containers or ensure the containers are correctly disposed.

8. Only give patients what they need

One of the biggest issues in the industry is pharmaceutical waste.  If a patient is given an excess of medication, this can lead to disposal problems. Too often, pharmaceuticals are flushed down the toilet where they enter sewage treatment works. As purification isn’t 100% accurate, some quantities of pharmaceuticals can still remain present and enter aquatic ecosystems and drinking water. This can have health and environmental impacts. Some studies have shown concerning effects for small organisms, such as fish which displayed evidence of feminisation⁵ and behavioural changes⁶.  

A factor that exacerbates the problem is poor drug absorptivity in the body. Although the amount varies, between 30 and 90%⁴ of ingredients in pharmaceuticals are excreted unchanged after consumption. Drug redesign, using the ‘benign by design’ approach is a solution being used to combat this, by altering drugs to be better absorbed by the body or more rapidly bio-degrade, thereby making them more environmentally friendly.

Provide patients with the exact amount they require to avoid wastage and clearly label disposal methods on the medication to encourage proper disposal.

9. Educate

Your pharmacy can act as an educating platform, encouraging both employees and patients to become more eco-friendly by teaching them about the impact pharmaceutical waste has on the environment. This will invoke conscious decision making on correct disposal of excess medication and containers. Your pharmacy could display such posters and signs as well as having easily accessible recycling and waste bins.

10. Recycle

Perhaps the simplest of all, but often overlooked, is recycling. Recycling has huge benefits, such as conserving natural resources thereby cutting emissions as there is a lower demand for raw materials, protects ecosystems and saves energy and money.

References

¹ Universal electronic prescriptions could save NHS £300m in next three years, accessed on 06/07/2021 via https://www.nhsbsa.nhs.uk/universal-electronic-prescriptions-could-save-nhs-ps300m-next-three-years

² Everyone wants Digital Receipts, So Why is the Retail Industry Not Adopting It?, accessed on 05/07/2021 via https://hackernoon.com/digital-receipts-in-retail-b415fbdfde3f

³ Press Release: New NHS Data Shows Record 93 Million Prescription Items Dispensed in March, accessed on 05/07/2021 via https://thecca.org.uk/press-release-new-nhs-data-shows-record-93-million-prescription-items-dispensed-in-march/

⁴ Green pharma: the growing demand for environmentally friendly drugs, accessed on 05/07/2021 via https://www.pharmaceutical-technology.com/comment/commentgreen-pharma-the-growing-demand-for-environmentally-friendly-drugs-5937344/

⁵ Assessment of Feminization of Male Fish in English Rivers by the Environment Agency of England and Wales, accessed on 05/07/2021 via https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1874176/

⁶ Dilute Concentrations of a Psychiatric Drug Alter Behavior of Fish from Natural Populations, accessed on 05/07/2021 via https://science.sciencemag.org/content/339/6121/814

How to Make Your Pharmacy Go Green and Wow Patients, accessed on 05/07/2021 via https://www.pbahealth.com/make-pharmacy-go-green-wow-patients/

Sustainable Pharmacies: How to Go Green, accessed on 05/07/2021 via https://alphascrip.com/archives/sustainable-pharmacies-how-to-go-green/

One of the major costs associated with starting a new pharmacy in the UK is the initial cost of stock. It is a requirement of the NHS Pharmacy contract, that licensed pharmacies are required to dispense all medicines presented by patients on NHS prescriptions in a timely manner. If the pharmacy does not have the item, contingency arrangements need to be in place to source supply where stock is unobtainable from regular wholesalers, this may include having reciprocal arrangements with neighbouring pharmacies when required to meet urgent patient needs, and the use of manufacturers’ contingency order arrangements.

The good news for new licensees is that 90% of medicines prescribed via the NHS are regularly available to pharmacies, in this article we will look at how best to predict which lines should be initially prioritised to ensure patients rarely run out of medicines.

Fast mover / ‘next patient’ stock

Fast movers is the term associated with medicines that are dispensed most by pharmacies. What is included in a specific pharmacy’s as a fast mover category differs in regards to the local demographic served, however, if the pharmacy has a Distance Selling Pharmacy license where the remit is to serve patients nationally the following Top 10 most nationally prescribed medicines in primary care will be of relevance…

Figure 1. Top 10 most prescribed medicines in NHS primary care¹.

Dependent on the predicted prescription volumes, staffing levels and available space within the pharmacy the Top 10 fast movers might be the Top 20 or even Top 30. The size of the fast mover catergory is dependent on the ergonomic layout of the pharmacy, fast movers should be easily physically reached by staff or in a prime location within an automatic dispensing machine. The next level of stock catergory are the Medium Movers…

Medium Movers

Figure 2. Top prescribed medicines UK²

Figure 3. How we got here: Prescribing Trends³.

Medium movers, in traditional pharmacies, are often positioned a little further out from the centre of the dispensary as they are used relatively less than fast movers.

Whilst the medicines discussed thus far are a requirement of the NHS Pharmacy License there are some recommendations made by local authorities for minimum stock of “emergency medicines“. Whilst this list is not a requirement of the NHS contract it is worthy of attention as local authorities can commission Enhanced services that can provide additional revenues to the business.

Local emergency medicine expectations

Figure 4. Local emergency medicine expectation.

Pharmacy staff should advise patients to request their prescription in good time. This is particularly important for patients taking medicines with a significant clinical consequence where missing any doses (e.g. anti-psychotics, anti-epileptics, anti-cancer, etc) can cause harm.

Initial Volume

So, we know what percentage of stock should be proportioned to each medicine, however, what overall volume should be stocked? The answer to this is dependent on what the initial predicted prescription volumes will be. To get a ballpark of this figure keep in mind that the average amount of items dispensed monthly by UK pharmacies in 2019/20 was 6.6 thousand, however over 2,400 pharmacies dispensed an average of over ten thousand items a month.

References

¹https://www.thedatalab.org/blog/123/what-are-the-most-commonly-prescribed-medicines-top-10-prescribed-medicines-in-nhs-england-primary-care-for-2019/

² Audi, S., Burrage, D. R., Lonsdale, D. O., Pontefract, S., Coleman, J. J., Hitchings, A. W., and Baker, E. H. (2018) The ‘top 100’ drugs and classes in England: an updated ‘starter formulary’ for trainee prescribers. Br J Clin Pharmacol, 84: 2562– 2571. https://doi.org/10.1111/bcp.13709.

³ https://openprescribing.net/

So what can we do to avoid slipping into melancholy during this crisis? Techniques with the most robust evidence to reduce potential depressive symptoms have been shown to primarily be non-pharmacological:

• Exercise – 3+ times a week get heart rate above resting and maintain.
• Adequate sleep – by exposing yourself to sunlight you can reset your Circadian Rhythm whilst exercise will help you sleep.
• Reduce Overstimulation – anti rumination, reduce caffeine intake do more mindfulness and meditation.
• Social interaction – self-therapy, counselling, increase social contact.
• Sunlight – running outside as below can bolster Vitamin D3 as above.
• Healthy diet – supplementation of Vitamin D3 / Omega, ↓ intake of alcohol.

After the above have been exhausted, it is usual that the next step is an antidepressant medicine. Antidepressant usage is skyrocketing year-on-year in every single country³, a handful of people criticize the use of psychotropic drugs which produce mild-to-severe side-effects, cause overdependence or resistance, and are self-limiting. For some, meditation retreats are no more than expensive trips for which vacating time out of a busy life and responsibilities gets difficult while for others, traditional forms of psychotherapy take longer to show results, produce negative patient outcomes, aren’t available throughout and are expensive. Although, depression and other mental diseases can be treated by various strategies, between 76% and 85% of people in low- and middle-income countries do not seek or receive treatment⁴.

But could iPhone / Android (mHealth) apps have enough evidence behind them to be added to this list? We all now create shoppings list apps to aid our poor memory and play the latest version of Candy Crush to cure our boredom so why not an app for curing depression?

Smartphone-based mental health apps represent a unique opportunity to expand the availability and quality of mental health treatment. The number of mobile health (mHealth) apps focused on mental health has rapidly increased; a 2015 World Health Organization (WHO) survey of 15,000 mHealth apps revealed that 29% focus on mental health diagnosis, treatment, or support. Unfortunately, a meta-analysis review published in late 2019 has shown that “mHealth apps cannot be recommended based on the current level of evidence.” However, can some new apps buck this trend? In this article, we will look at three new mHealth apps, Tetr, Misu and Wuju and see if any of their therapeutic claims stand up to scrutiny.

Misu

A recent study of mobile usage and depression found that:

“Participants with depression were found to have fewer saved contacts on their devices, spend more time on their mobile devices to make and receive fewer and shorter calls, and send more text messages than participants without depression.”

Depression screening using mobile phone usage metadata⁷.

There is definitely a link between the use of technology and depression scores, Misu sets out to address this with some clever technology. Misu installs on your computer and works in the background tracking short-lived emotions via facial micro-expressions and organizes an emotional history alongside which apps are used. The intention is to reveal to users how various apps influence their mind and helps a person become aware of his/her mood patterns and preferences. I have been using it for a number of weeks and here is how my happiness rates alongside the various OSX programs I use.

Misu claims the app has an 86% accuracy rate of being able to predict someone’s mood, this came from calibrating the AI with 1⁄4 million people volunteers having their photos captured.

Wuju

Wuju is the brainchild of Eli Finer. Built from Eli’s long, struggle with depression, this app comprises diversified moods with his narration and music in the background which produces a less AI-based visual healing experience and simulates in-person therapy but with a setting of the patient’s choice.

Wuju intends to halt extraordinary runaway thoughts but also uncovers the most mundane and ordinary sensations to heal the uncontrolled minds. While this app can heal transient emotional injuries in a short time, it collects data to evaluate the progress in people’s behaviour which allows for the app’s further improvement. In Eli’s latest tweet, he provided stats as evidence for the app’s effectiveness. Remarkably, there was a maximum drop in anger by 89%, resistance by 74% from 138 samples, shame by 85% and other emotions also showed a significant decrease⁵. It is claimed that For 50% of its users, it worked extremely well and moderately well for a further 25%⁶.

Tethr

Due to an overused idea that men are strong-minded goliaths devoid of sentimental thoughts, they do not disclose their mental health problems nor seek support. In England, 1 in 8 men suffer from mental health problems that are left untreated⁸. To break this conventional image, Tethr , a mhealth app turns to the needs and wellness of the marginalized gender and helps men replenish their internal peace. It engages male peers to share their hollow experiences and consists of mhealth hotlines, coaching and articles for men which make it an effective tool.

Beyond the effectiveness of these apps, the questions get trickier. How do these apps manage users’ privacy and data? MHealth Apps are not only effective in their use but also address their users’ privacy by explaining how this app uses their data and has led to the satisfaction of their users. Do these apps provide the best treatment out of all the mental illness methods? While different techniques work for different patients, mHealth apps are devoid of almost every problem relating to drug treatments and traditional psychotherapies. With increasing consumption of antidepressants in children and older adults along with people who do not receive traditional treatment either because of stigmatization or inaccessible conventional treatments, mhealth apps provide a promising solution and strategy to overcome these barriers. Presently, the smartphone usage is ubiquitous and current covid-19 dynamics have led to an increase in the use of these digital interventions which are easily accessible and inexpensive, have a time-saving user-friendly interface, and are becoming a day-to-day custom for their avid users. Furthermore, they provide supplementary treatment to traditional therapy and are used in combination with these techniques to explore the entire spectrum of mind.

are antidepressant medicines, all of which have been carefully scrutinized in randomised controlled trials before they can be sold to the public as the majority of drugs can cause both harm and good. In the app world, Google and Apple tend to think little harm can occur by using an unproven depression app and do not to delve into medical claims. The NHS on the other hand (the UK national health service) has done a great job of making a list of “Approved Apps” we intend to do the same.

Mobile apps have significant potential to deliver high-efficacy mental health interventions. Given the global shortage of psychiatrists and the lack of mental health care access in rural regions, apps have emerged as a viable tool to bridge the mental health treatment gap. However, the majority of the apps that are currently available lack clinically validated evidence of their efficacy and as such cannot be fully recommended by health care practitioners. Given the number and pace at which mobile Health (mHealth) apps are being released, further robust research is warranted to develop and test evidence-based programs. It has been mentioned elsewhere in the scientific literature⁸, but to reiterate, we implore mHealth organizations, and others, come together to set universal standards for mental health app quality control, and that those standards include at a minimum the review of data security, app effectiveness, usability, and data integration.

References

1. Global Burden of Disease Study 2019 (GBD 2019) Results. Global Burden of Disease Collaborative Network. [Online] Seattle, United States: Institute for Health Metrics and Evaluation (IHME), 2020, October 2020. [Cited: November 7, 2020.] http://ghdx.healthdata.org/gbd-results-tool..
2. Antidepressant Drugs Market to Reach $15.98 Bn by 2023, Globally at 2.1% CAGR, Says Allied Market Research. https://www.prnewswire.com/. [Online] PR Newswire, 11 21, 2018. [Cited: 11 7, 2020.] https://www.prnewswire.com/news-releases/antidepressant-drugs-market-to-reach-15-98-bn-by-2023-globally-at -2-1-cagr-says-allied-market-research-873540700.html.
3. Something startling is going on with antidepressant use around the world. https://www.businessinsider.com/. [Online] Business Insider, 2 4, 2016. [Cited: 11 7, 2020.] https://www.businessinsider.com/countries-largest-antidepressant-drug-users-2016-2.
4. Use of mental health services for anxiety, mood, and substance disorders in 17 countries in the WHO world mental health surveys. The Lancet. [ Online] 9 8, 2007. [Cited: 11 2, 2020.] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2847360/.
5. Finer, Eli. [Online] 10 9, 2020. [Cited: 11 7, 2020.] https://twitter.com/finereli/status/1314784540703899648. 6. Wuju App. Wuju. [Online] [Cited: 11 7, 2020.] http://wujuapp.com/#:~:text=Unlimited%20trial,moderately%20well%20for%20further%2025%25. 7. How Misu Works. Misu. [Online] [Cited: 11 7, 2020.] https://www.misu.app/how-misu-works.
6. Survey of people with lived experience of mental health problems reveals men less likely to seek medical support. www.mentalhealth.org.uk/. [Online] 2016. [Cited: 11 7, 2020.] https://webarchive.nationalarchives.gov.uk/20180328130852tf_/http://content.digital.nhs.uk/catalogue/PUB2174 8/apms-2014-full-rpt.pdf/.
7. Rouzbeh Razavi, Amin Gharipour, Mojgan Gharipour, Depression screening using mobile phone usage metadata: a machine learning approach, Journal of the American Medical Informatics Association, Volume 27, Issue 4, April 2020, Pages 522–530, https://doi.org/10.1093/jamia/ocz221
8. Torous J, Andersson G, Bertagnoli A, Christensen H, Cuijpers P, Firth J, et al. Towards a consensus around standards for smartphone apps and digital mental health. World Psychiatry 2019 Feb;18(1):97-98