1. Objective Setting:
   • Define the scope and objectives of the penetration test. Focus on systems that store, process, or transmit patient data, including pharmacy management systems, electronic health records, and online prescription services.
2. Compliance Considerations:
   • Ensure the test aligns with NHS and General Pharmaceutical Council (GPhC) guidelines.
   • Understand the requirements of the DSPT and the UK’s General Data Protection Regulation (GDPR).
3. Choosing a Testing Provider:
   • Select a reputable and certified penetration testing provider.
   • Ensure they have experience in healthcare and are aware of the specific needs and regulations of the sector.
4. Pre-Test Preparations:
   • Notify all relevant parties, including staff and possibly the Information Commissioner’s Office (ICO), if required.
   • Back up all systems and ensure that there are contingency plans in place in case of system disruptions.
5. Conducting the Test:
   • Perform the test during off-peak hours to minimize disruption.
   • Include both external (networks, applications, and perimeter defenses) and internal (behind the firewall) aspects.
   • Test for a wide range of threats, including SQL injection, cross-site scripting, and ransomware.
6. Data Handling:
   • Ensure that all data collected during the test is handled securely and in compliance with GDPR.
   • Sensitive data should not leave the premises or be exposed to unauthorized personnel.
7. Post-Test Analysis:
   • Review the test results with the testing provider.
   • Prioritize vulnerabilities based on their potential impact and the likelihood of exploitation.
8. Remediation Plan:
   • Develop a prioritized action plan to address identified vulnerabilities.
   • Consider both technical fixes and changes in processes or staff training.
9. Documentation and Reporting:
   • Document the entire process and results for compliance purposes.
   • Report significant vulnerabilities and incidents to the relevant authorities as required by law.
10. Review and Continuous Improvement:
    • Schedule regular penetration tests (at least annually).
    • Review and update security policies and procedures in light of test findings.

Additional Considerations:

• Staff Awareness and Training: Ensure staff are aware of the test and understand the importance of cybersecurity.
• Legal and Ethical Considerations: The test should be legal, ethical, and not harm patients or their data.
• Budget and Resources: Allocate sufficient budget and resources for both the test and the subsequent remediation actions.

Remember, the specifics of the plan will vary based on the size of the pharmacy, the complexity of its IT systems, and the types of data handled. It’s also important to stay updated with NHS and GPhC guidelines, as they may change over time.

i. What their key operational services are,

ii. What technologies and services their operational services rely on to remain available and secure,

iii. What other dependencies the operational services have (power, cooling, data, people etc.),

iv. The impact of loss of availability of the service.

Understanding Health and Care Services Provided by [Organization Name]

I. Key Operational Services:

[Provide a comprehensive list of the key operational services offered by the organization. These services are at the core of the organization’s mission and activities. For example:]

1. Patient Care: Delivering medical care, diagnosis, and treatment to patients.
2. Prescription Management: Ensuring the accurate dispensing of medications to patients.
3. Medical Records Management: Maintaining and safeguarding patient health records.
4. Appointment Scheduling: Facilitating patient appointments with healthcare professionals.

II. Technologies and Services Dependencies:

[Detail the technologies and services that are crucial for the availability and security of the key operational services. For example:]

1. Electronic Health Records (EHR) System: A secure EHR system is essential for managing patient data and ensuring its availability to healthcare providers.
2. Pharmacy Management Software: Reliable software for prescription management, inventory control, and patient interactions.
3. Telecommunication Infrastructure: Ensuring a stable network for telehealth services and communication between healthcare providers.
4. Cybersecurity Solutions: Implementing robust cybersecurity measures to protect patient data and maintain service availability.

III. Other Dependencies:

[Identify other dependencies beyond technology that are critical for operational services. These may include power, cooling, personnel, and more. For example:]

1. Power Supply: Reliable and uninterrupted power is necessary to run medical equipment, computers, and communication systems.
2. Cooling and Environmental Controls: Maintaining suitable environmental conditions for sensitive equipment and medication storage.
3. Qualified Healthcare Staff: Having a skilled and adequately staffed healthcare team to deliver patient care and manage operations.
4. Supply Chain Management: Ensuring a steady supply of medications, medical equipment, and other essential materials.

IV. Impact of Loss of Availability of the Service:

[Describe the potential consequences and impact on patients, staff, and the organization if the key operational services become unavailable. This may include:]

1. Patient Safety: Disruption in healthcare services may jeopardize patient safety and well-being.
2. Data Security: A loss of availability can lead to data breaches and compromise patient privacy.
3. Reputation Damage: Service unavailability can harm the organization’s reputation and trust among patients and stakeholders.
4. Financial Implications: Loss of revenue, fines, and legal liabilities resulting from service unavailability.
5. Operational Disruption: Delays in patient care, appointment cancellations, and increased workload on staff.

[Include any additional information specific to your organization’s services and dependencies.]

This document serves as a foundational understanding of the critical elements related to health and care services provided by [Organization Name]. It highlights the importance of safeguarding these services, their dependencies, and the potential impact of service unavailability on patient care and the organization’s overall performance.

• Pharmacy Name: [Your Pharmacy Name]
• Date of Analysis: [Date]

2. Objectives:

• To assess the current knowledge and skills of pharmacy staff regarding data security and protection.
• To identify gaps in knowledge and skills.
• To determine the specific training needs required to enhance data security and protection.

3. Data Collection:

A. Staff Roles and Responsibilities:

• List all job roles within the pharmacy.
• Describe the responsibilities of each role regarding data security and protection.

B. Skill Assessment:

• Conduct an initial assessment of each employee’s knowledge and skills related to data security and protection.

4. Identify Training Needs:

A. Training Objectives:

• Define clear training objectives for data security and protection. These objectives should align with the pharmacy’s compliance requirements and best practices.

B. Training Topics:

• List the key areas of data security and protection that are relevant to the pharmacy setting, such as patient data protection, secure handling of prescriptions, and cybersecurity.

C. Training Gaps:

• Based on the skill assessment, identify the gaps in knowledge and skills of employees in each of the training topics.

D. Prioritize Training Needs:

• Prioritize the identified training needs based on the level of risk and importance to the pharmacy’s operations and compliance.

5. Training Methods:

• Identify the most suitable training methods for each topic and audience. These may include:
  • In-person training sessions
  • Online courses or modules
  • Workshops or seminars
  • On-the-job training
  • Self-paced learning materials

6. Training Plan:

A. Training Schedule:

• Create a training schedule that outlines when and how often each training session will be conducted.

B. Training Materials:

• Develop or source training materials, including presentations, handouts, and digital resources, for each training topic.

C. Trainers or Facilitators:

• Identify who will deliver the training sessions, whether it’s internal trainers, external experts, or a combination.

7. Evaluation:

A. Pre-Training Assessment:

• Conduct a pre-training assessment to measure participants’ baseline knowledge before the training.

B. Training Delivery:

• Ensure that training sessions are delivered as planned and that participants actively engage in the learning process.

C. Post-Training Assessment:

• Conduct post-training assessments to evaluate the effectiveness of the training in addressing identified gaps.

D. Feedback and Improvement:

• Gather feedback from participants and trainers to make improvements to the training program for future sessions.

8. Monitoring and Continuous Improvement:

• Establish a system for ongoing monitoring of data security and protection practices in the pharmacy.
• Regularly review and update the training program to adapt to evolving threats and regulatory changes.

9. Conclusion:

• Summarize the key findings from the TNA and the proposed training plan to enhance data security and protection within the pharmacy.

10. Approval and Implementation:

• Seek approval from pharmacy management or relevant authorities to implement the training plan.

In today’s dynamic healthcare landscape, pharmacies play a pivotal role in providing essential medical services to communities. With the advent of technology and changing consumer preferences, the concept of distance selling pharmacies has gained significant traction. If you’re considering entering this thriving market or expanding your existing pharmacy business, a distance selling pharmacy for sale could be a golden opportunity. In this article, we’ll explore the ins and outs of distance selling pharmacies and how to make the most of this lucrative venture while keeping your SEO strategy on point.

The Rise of Distance Selling Pharmacies

Distance selling pharmacies, also known as online pharmacies or mail-order pharmacies, have witnessed remarkable growth in recent years. These pharmacies offer a convenient way for consumers to access prescription and over-the-counter medications, health products, and wellness advice without leaving their homes. This trend has been accelerated by various factors, including:

1. Digital Transformation: The increasing adoption of e-commerce and digital technology has made it easier for pharmacies to reach a broader customer base.
2. Convenience: Distance selling pharmacies offer 24/7 accessibility, doorstep delivery, and the ability to order medications from the comfort of one’s home.
3. COVID-19 Pandemic: The pandemic accelerated the shift towards online healthcare services, including pharmacy services, as consumers sought safer and more convenient options.

Benefits of Owning a Distance Selling Pharmacy

Investing in a distance selling pharmacy for sale can be a wise business move, offering numerous advantages:

1. Wider Reach: With an online platform, you can reach customers beyond your local area, potentially tapping into a larger market.
2. Lower Overheads: Operating online can result in lower operational costs compared to brick-and-mortar stores.
3. Convenience for Customers: Meeting the evolving needs of busy consumers by providing a convenient shopping experience.
4. Diversified Product Offerings: Expand your product range to include not only medications but also health and wellness products, supplements, and more.

How to find a distance selling pharmacy for sale

If you’re in the market to purchase a DSP, you will first need to ensure it’s licensed by the General Pharmaceutical Council (GPhC). You can do this by visiting the GPhC’s official website where they maintain a list of registered online pharmacies. This provides a reliable initial filter. Next, get in contact with us as we act as broker in closed access specialized business sale platforms which often list licensed distance selling pharmacies up for sale.

Here are the recommended steps as per NHS guidance (pg.129 NHS Pharmacy Manual) to relocate a Distance Selling Pharmacy that also has an NHS contract.

1. Finding a new location: If this location is less than 500 metres away from your present location “as the crow flies” you only have to get approval from your local NHS England Team.
2. Obtaining NHS approval: Your neighbourhood NHS England Team, who will then request “representations” (this is when other local pharmacies might have objections to the move). The pharmacy must move within six months of the suggested date after the 45-day consultation time is over.
3. NHS Business Services Authority (BSA) approval – You need to submit a formal notification letter to the NHS Business Services Authority (BSA) and provide them with details of the new location and your proposed relocation date.
4. Communicate with patients: It’s essential to communicate with your patients about your pharmacy’s relocation. You should provide information about the new location, opening hours, and any changes to services or staff. You can do this by posting notices in the current pharmacy, sending letters to patients, and updating your website and social media channels.
5. Arrange the move: Once you have obtained all necessary approvals and licenses, you can start planning your move. This may involve arranging for the transfer of stock and equipment to the new premises, as well as setting up the new pharmacy.

1. Use a third-party age verification service: There are companies that specialize in age verification for online transactions. These services typically use databases of government-issued identification documents (such as driver’s licenses or passports) to verify the age of the customer. For more information on this have a look at our article on internet pharmacy id verification.
2. Require the customer to provide proof of age: Some online pharmacies may require the customer to upload a copy of a government-issued ID or other documentation as proof of their age.
3. Use age gates: An age gate is a page on the website that requires the visitor to confirm that they are of legal age to purchase the products being offered. This can be done by requiring the visitor to enter their date of birth or by using a third-party age verification service.
4. Use machine learning algorithms: Some online pharmacies use machine learning algorithms to analyze the customer’s behavior on the website and determine their age based on their actions.

It is important to note that each country has its own laws and regulations regarding age verification for online transactions, and online pharmacies should ensure that they are complying with all applicable laws.

Pharmacy near Edgware rd (1^st inspection)

Summary of GPhC findings:

• The pharmacy cannot clearly demonstrate how it manages the risks associated with the prescribing services it operates.
• It does not have comprehensive procedures explaining how this service operates and there is no evidence that it has been properly risk assessed.
• Its system for handling complaints is unclear
• The pharmacy’s record keeping does not always comply with the law and there is a lack of documentation supporting the pharmacist prescribing service.
• The team members keep people’s personal information secure and they understand the principles of safeguarding and how to support vulnerable people.
• The pharmacy SOPs had been recently updated but they did not cover some aspects of the pharmacy’s services, such as the private doctor and pharmacist prescriber consultation, so it was not totally clear how these operated or what the parameters for offering these services were.
• It was unclear if the private doctors’ service was registered with the Care Quality Commission.
• The superintendent explained he did use a prescribing framework and he would only prescribe for adult patients who were mainly from overseas and requested medication they had used before or for treating minor acute conditions.
• And some SOPs lacked detail; for example, the SOP for record-keeping did not explain how records were maintained.
• Some team members had signed SOPs to show they had read and agreed them, but others had not, so some they might not always fully understand their roles and responsibilities.
• A privacy notice was not displayed in accordance with the General Data Protection Regulation.
• Records relating to pharmacist prescriber consultations were not available although the superintendent said he did document all consultations.

Improvement action plan:

• Complete comprehensive procedures explaining how the prescribing services operate including SOPS and prescribing clinical framework
• Practice good risk management by providing staff training protocols for proper assessment triage and signposting for the prescribing service and other related medical services
• Review record keeping procedures to ensure full record keeping is maintained including new electronic patient records and review of complaints procedures.

2^nd inspection

• Prescribing framework reflecting therapeutic areas covered by the prescribing service included but not limited to high-risk drugs.
• Risk assessment does not identify all therapeutic areas covered by prescribing service, classes of meds included or key risks involved and a plan explaining how these are mitigated. Also does not routinely assess safety and quality of its prescribing service, does not hold consultation notes which means can not demonstrate that prescribing decisions are appropriate.
• Does not have appropriate safeguards in place to prescribe some higher risk categories of meds i.e. CDs.
• Prescribing framework that includes all conditions that medication is prescribed for i.e. mental health, weight loss.
• Pharmacy had a risk assessment which identified some areas of risks in prescribing service and how to mitigate them but not individual risk assessments.
• Not completed any clinical audits of prescribing to determine whether it was safe and appropriate.
• People asked to complete consultation form, ID was checked then consultation carried out by prescriber and any additional notes were added to form? IP were usually not initiating treatments, patients usually presenting with old medication packs or documentation which was double checked were possible and if necessary with their practitioner? If any CDs prescribed which they rarely are, a maximum of 30 days supply given? (Needs to be mentioned on prescribing SOPs)

Improvement action plan:

1. Create a risk mitigation plan for each therapeutic area. Develop risk assessments specifying each therapeutic areas the prescriber(s) will be prescribing within and the classes of medication included for each, and identify the likelihood of key risks for each, the likely impact and a written plan on how these risks are mitigated.
2. Consultation records will be updated, at minimum every week, using the digital patient management software. All clinic records will be available upon inspection.
   Clinical audits will be made on a regular basis, starting with high-risk therapeutic areas.
3. The prescribing framework will be updated to reflect the therapeutic areas covered by the prescribing service including but not limited to high-risk categories. Prescribing of CDs will follow UK guidelines. Prescribers will have access to the patient’s medical records or contact the person’s usual doctor before prescribing CDs. And no more than the recommended 30 days’ supply of CDs will be issued unless in exceptional circumstances.

All patients that are to receive medication from the pharmacy’s independent prescriber or private doctor will be consulted on the important maintenance of an up-to-date medical record with their regular doctor. Consent will be requested from the patient to inform their regular doctor of any medication prescribed on their behalf. In the instance that consent is not given for any reason from the patient, the patient should be asked if they wish to be provided with a copy of a letter that would otherwise be given directly to their regular doctor in order for the patient keep their doctor up to date with medication being prescribed.  From previous visit the year before, seems this has been ongoing issue hence led to the above improvement action plans.

The pharmacy would be expected to tell us within 5 days of the action they intend to take to meet the standards and improve practice in the pharmacy. We will consider some flexibility in this timescale if there are exceptional reasons why this deadline cannot be met.

We require improvement action plans to be filled in by the owner and superintendent pharmacist and returned to us. The inspector will already have identified whether the improvement action in relation to each standard, must be completed within 10, 20 or 60 working days

Then schedule another visit at 6 months after to make sure all changes have been sustained and inspector is happy, at which point new report is generated.

Pharmacy No.2

• Audited each others prescribing, however, audit was lacking number of prescriptions audited, which guidance they were working in line with, parameters they were auditing against, which guidance was used for people from abroad?
• Risk of this service, identify specific risks i.e. following up, monitoring, ensuring no interactions or contraindications, how would practitioners abroad be aware of what has been prescribed to patient etc.
• Which medications does the pharmacy consider as high risk give examples.
• SOP covering independent prescribing was reviewed and updated.
• Prescribing policy not comprehensive, state which guidance is being complied with, maximum supplies within any given time frame and monitoring required.
• Near misses need to be formally reviewed.
• Records for unlicensed specials dispensed were not always completed in line with MHRA guidance. Some certificates of conformity could not be found whilst others were not filled in.
• One dispenser was responsible for reviewing notes and prescriptions every month to check for missing items or information.
• Both prescribers were reviewing each other’s prescriptions every quarter, they checked each other’s notes were complete, monitoring parameters had been noted, counselling was provided and references used such as published guidance.
• A complaints procedure was in place. Members of the team said that they would refer people to the pharmacist if they wished to raise a complaint.
• All staff had completed online training and MCQs on GDPR. Staff briefed on safeguarding and told to raise any concerns directly to pharmacists
• Systems it uses to verify authenticity of overseas? Consultations were still conducted by the pharmacists even when a prescription from a doctor was seen. High-risk medications were never initiated, only prescribed if prescription from patient’s doctor was provided.
• IP did not routinely share information with the patient’s doctors as most were abroad. Example of refusing to supply Lithium to patient in Kuwait, then patient came back with up to date bloods which were documented at the pharmacy, before supply was made, how can you be sure it was there bloods done etc?
• Labelling and counselling points regarding sodium valproate
• Patients asked to do urine dipstick test before prescribing antibiotics for UTIs, example were they prescribed only three days worth of Nitrofurantoin to patient with recurring UTI (example to show that they know some stuff) spoke to her regular pharmacist to confirm previous supplies and referred her back to her GP (again example he knows hes doing diligence and also signposting back).

Improvement action plan:

1. Have proper insurance for prescribing
2. Revised Prescribing Policy
   – Revised Prescribing Audit template

Pharmacy 3

Below is a summary of the inspection report from the primary visit by the GPhC.

• Did not have proper SOPs.
• Pharmacy cannot demonstrate that the private Dr service that it works with is meeting the regulatory requirements.
• Pharmacy’s information governance and safeguarding procedures lack formality.
• Most SOPs overdue review and out of date might not reflect current legal requirements or best practice, some duplicated or not relevant to Pharmacy’s current activities
• No policies or procedures explaining how they work with private Dr or the scope of pharmacist prescribing services.
• Pharmacy currently working with a private Dr but he was not working for the pharmacies CQC registered service.
• Pharmacy did not have any record of dispensing incidents, the last entry in near-miss log in 2018.
• Dispensing labels not always signed by pharmacist.
• Complaints procedures not always promoted in pharmacy or on website, so people may not know how to raise concern,
• Pharmacy did not always use mechanisms to actively seek feedback about pharmacy’s services, so it might miss opportunities to make improvements. Also give examples of what we have done as a result, this can be used to kill time.
• Unlicensed medicines were sometimes supplied on prescription and the pharmacy maintained appropriate records.
• Team members briefed on principles of data protection and confidentiality
• There were no formal information governance policies so risk as staff may not fully understand their responsibilities.
• SI stated they had completed safeguarding training some years ago but had no evidence of this.
• Pharmacy’s website did not include GPhC no. or superintendent’s details, promoted clinic with GMC Drs but did not provide any details, absence of information did not support people to make informed decisions when opting to access the pharmacy’s services.

Improvement action plan

1. The pharmacy cannot demonstrate that its pharmacist prescribing service is operating safely. It does not have SOPs or a prescribing framework covering this activity. And it hasn’t completed risk assessments for this service identifying the therapeutic areas and classes of medication included, or the key risks involved, with a plan explaining how these risks are mitigated.
2. The consultation records for the pharmacist prescribing service do not contain enough information to support prescribing decisions.
3. The pharmacy’s prescribing service does not have sufficient safeguards in place to provide assurance that medicines are always prescribed safely. It cannot demonstrate how it verifies information about the patient and their existing health conditions or communicates with their usual doctor to ensure the continuity of their care. And it cannot show that prescribing of CDs in line with UK guidelines.

Action taken by pharmacy – Pharmacist prescribing service suspended

This regulation quoted from The National Health Service (Pharmaceutical and Local Pharmaceutical Services) Regulations 2013 is often cited as a reason for the rejection of a distance-selling pharmacy application in the UK by the NHS / PSCE.

A good reply to this reason for rejection would be to address the following key points:
1 – Premises and Equipment
2 – Accountability
3 – Storage / management of records
4 – Pharmacy Website
5 – Consent
6 – Medicines safety management
7 – Supplying Medicines Safely

8 – Risk Assessment
9 – Standard Operating Procedures
10 – Audit
11 – Reactive Review

“the uninterrupted provision of essential services, during the opening hours of the premises, to persons anywhere in England who request those services, and”

A good reply to this comment would be…

We confirm that we shall comply with the above referenced regulation:

We further confirm that as a distance-selling pharmacy, we will provide uninterrupted service throughout the opening hours of the pharmacy. For this reason, the responsible pharmacist (RP) is not allowed to leave the premises in the same way as an RP at a Non-Distance Selling pharmacy is allowed (for up to 2 hours per day) unless another pharmacist is present. The pharmacy will have a second pharmacist available during the core and any additional hours that it operates. Any breaks in working time taken by the RP will be covered by a second pharmacist who will then assume the responsibility of the RP. NHS Essential services will be provided to any patient living in England who requests services. Nothing in our practice leaflet, publicity material, in the material published on our behalf, any communication is written or oral or from our members of staff to any person seeking the provision of essential services will represent, either expressly or impliedly, that:

a) the essential services provided at or from the premises are only available to persons in
particular areas of England, or
b) we are likely to refuse, for reasons other than those provided for in our terms of service,
to provide drugs or appliances ordered on prescription forms or repeatable prescription
forms which are presented by particular categories of patients (for example, because the
availability of essential services from us is limited to other categories of patients.)

If you need further help in replying to an NHS rejection letter get in contact with one of our representatives here.

A clinical governance framework is a structured approach to clinical governance that outlines the roles, responsibilities, and processes that are involved in ensuring the quality of healthcare services. The framework may include:

• Standard Operating Procedures and procedures for the delivery of healthcare
• Standards for the training and competency of healthcare professionals
• Quality improvement processes to identify and address problems with the delivery of care
• Risk management processes to identify and mitigate potential risks to patient safety
• Mechanisms for gathering and analyzing data on the quality of care
• Communication and collaboration among healthcare professionals and organizations to ensure the coordination of care

The purpose of a clinical governance framework is to ensure that patients receive safe, high-quality care, and that healthcare professionals are held accountable for the care they provide. It is an important part of the overall system of healthcare regulation and oversight.

We provide a wide range of off-the-shelf and custom solutions, if you need help just contact us.