1. Objective Setting:
   • Define the scope and objectives of the penetration test. Focus on systems that store, process, or transmit patient data, including pharmacy management systems, electronic health records, and online prescription services.
2. Compliance Considerations:
   • Ensure the test aligns with NHS and General Pharmaceutical Council (GPhC) guidelines.
   • Understand the requirements of the DSPT and the UK’s General Data Protection Regulation (GDPR).
3. Choosing a Testing Provider:
   • Select a reputable and certified penetration testing provider.
   • Ensure they have experience in healthcare and are aware of the specific needs and regulations of the sector.
4. Pre-Test Preparations:
   • Notify all relevant parties, including staff and possibly the Information Commissioner’s Office (ICO), if required.
   • Back up all systems and ensure that there are contingency plans in place in case of system disruptions.
5. Conducting the Test:
   • Perform the test during off-peak hours to minimize disruption.
   • Include both external (networks, applications, and perimeter defenses) and internal (behind the firewall) aspects.
   • Test for a wide range of threats, including SQL injection, cross-site scripting, and ransomware.
6. Data Handling:
   • Ensure that all data collected during the test is handled securely and in compliance with GDPR.
   • Sensitive data should not leave the premises or be exposed to unauthorized personnel.
7. Post-Test Analysis:
   • Review the test results with the testing provider.
   • Prioritize vulnerabilities based on their potential impact and the likelihood of exploitation.
8. Remediation Plan:
   • Develop a prioritized action plan to address identified vulnerabilities.
   • Consider both technical fixes and changes in processes or staff training.
9. Documentation and Reporting:
   • Document the entire process and results for compliance purposes.
   • Report significant vulnerabilities and incidents to the relevant authorities as required by law.
10. Review and Continuous Improvement:
    • Schedule regular penetration tests (at least annually).
    • Review and update security policies and procedures in light of test findings.

Additional Considerations:

• Staff Awareness and Training: Ensure staff are aware of the test and understand the importance of cybersecurity.
• Legal and Ethical Considerations: The test should be legal, ethical, and not harm patients or their data.
• Budget and Resources: Allocate sufficient budget and resources for both the test and the subsequent remediation actions.

Remember, the specifics of the plan will vary based on the size of the pharmacy, the complexity of its IT systems, and the types of data handled. It’s also important to stay updated with NHS and GPhC guidelines, as they may change over time.

Pharmacy near Edgware rd (1^st inspection)

Summary of GPhC findings:

• The pharmacy cannot clearly demonstrate how it manages the risks associated with the prescribing services it operates.
• It does not have comprehensive procedures explaining how this service operates and there is no evidence that it has been properly risk assessed.
• Its system for handling complaints is unclear
• The pharmacy’s record keeping does not always comply with the law and there is a lack of documentation supporting the pharmacist prescribing service.
• The team members keep people’s personal information secure and they understand the principles of safeguarding and how to support vulnerable people.
• The pharmacy SOPs had been recently updated but they did not cover some aspects of the pharmacy’s services, such as the private doctor and pharmacist prescriber consultation, so it was not totally clear how these operated or what the parameters for offering these services were.
• It was unclear if the private doctors’ service was registered with the Care Quality Commission.
• The superintendent explained he did use a prescribing framework and he would only prescribe for adult patients who were mainly from overseas and requested medication they had used before or for treating minor acute conditions.
• And some SOPs lacked detail; for example, the SOP for record-keeping did not explain how records were maintained.
• Some team members had signed SOPs to show they had read and agreed them, but others had not, so some they might not always fully understand their roles and responsibilities.
• A privacy notice was not displayed in accordance with the General Data Protection Regulation.
• Records relating to pharmacist prescriber consultations were not available although the superintendent said he did document all consultations.

Improvement action plan:

• Complete comprehensive procedures explaining how the prescribing services operate including SOPS and prescribing clinical framework
• Practice good risk management by providing staff training protocols for proper assessment triage and signposting for the prescribing service and other related medical services
• Review record keeping procedures to ensure full record keeping is maintained including new electronic patient records and review of complaints procedures.

2^nd inspection

• Prescribing framework reflecting therapeutic areas covered by the prescribing service included but not limited to high-risk drugs.
• Risk assessment does not identify all therapeutic areas covered by prescribing service, classes of meds included or key risks involved and a plan explaining how these are mitigated. Also does not routinely assess safety and quality of its prescribing service, does not hold consultation notes which means can not demonstrate that prescribing decisions are appropriate.
• Does not have appropriate safeguards in place to prescribe some higher risk categories of meds i.e. CDs.
• Prescribing framework that includes all conditions that medication is prescribed for i.e. mental health, weight loss.
• Pharmacy had a risk assessment which identified some areas of risks in prescribing service and how to mitigate them but not individual risk assessments.
• Not completed any clinical audits of prescribing to determine whether it was safe and appropriate.
• People asked to complete consultation form, ID was checked then consultation carried out by prescriber and any additional notes were added to form? IP were usually not initiating treatments, patients usually presenting with old medication packs or documentation which was double checked were possible and if necessary with their practitioner? If any CDs prescribed which they rarely are, a maximum of 30 days supply given? (Needs to be mentioned on prescribing SOPs)

Improvement action plan:

1. Create a risk mitigation plan for each therapeutic area. Develop risk assessments specifying each therapeutic areas the prescriber(s) will be prescribing within and the classes of medication included for each, and identify the likelihood of key risks for each, the likely impact and a written plan on how these risks are mitigated.
2. Consultation records will be updated, at minimum every week, using the digital patient management software. All clinic records will be available upon inspection.
   Clinical audits will be made on a regular basis, starting with high-risk therapeutic areas.
3. The prescribing framework will be updated to reflect the therapeutic areas covered by the prescribing service including but not limited to high-risk categories. Prescribing of CDs will follow UK guidelines. Prescribers will have access to the patient’s medical records or contact the person’s usual doctor before prescribing CDs. And no more than the recommended 30 days’ supply of CDs will be issued unless in exceptional circumstances.

All patients that are to receive medication from the pharmacy’s independent prescriber or private doctor will be consulted on the important maintenance of an up-to-date medical record with their regular doctor. Consent will be requested from the patient to inform their regular doctor of any medication prescribed on their behalf. In the instance that consent is not given for any reason from the patient, the patient should be asked if they wish to be provided with a copy of a letter that would otherwise be given directly to their regular doctor in order for the patient keep their doctor up to date with medication being prescribed.  From previous visit the year before, seems this has been ongoing issue hence led to the above improvement action plans.

The pharmacy would be expected to tell us within 5 days of the action they intend to take to meet the standards and improve practice in the pharmacy. We will consider some flexibility in this timescale if there are exceptional reasons why this deadline cannot be met.

We require improvement action plans to be filled in by the owner and superintendent pharmacist and returned to us. The inspector will already have identified whether the improvement action in relation to each standard, must be completed within 10, 20 or 60 working days

Then schedule another visit at 6 months after to make sure all changes have been sustained and inspector is happy, at which point new report is generated.

Pharmacy No.2

• Audited each others prescribing, however, audit was lacking number of prescriptions audited, which guidance they were working in line with, parameters they were auditing against, which guidance was used for people from abroad?
• Risk of this service, identify specific risks i.e. following up, monitoring, ensuring no interactions or contraindications, how would practitioners abroad be aware of what has been prescribed to patient etc.
• Which medications does the pharmacy consider as high risk give examples.
• SOP covering independent prescribing was reviewed and updated.
• Prescribing policy not comprehensive, state which guidance is being complied with, maximum supplies within any given time frame and monitoring required.
• Near misses need to be formally reviewed.
• Records for unlicensed specials dispensed were not always completed in line with MHRA guidance. Some certificates of conformity could not be found whilst others were not filled in.
• One dispenser was responsible for reviewing notes and prescriptions every month to check for missing items or information.
• Both prescribers were reviewing each other’s prescriptions every quarter, they checked each other’s notes were complete, monitoring parameters had been noted, counselling was provided and references used such as published guidance.
• A complaints procedure was in place. Members of the team said that they would refer people to the pharmacist if they wished to raise a complaint.
• All staff had completed online training and MCQs on GDPR. Staff briefed on safeguarding and told to raise any concerns directly to pharmacists
• Systems it uses to verify authenticity of overseas? Consultations were still conducted by the pharmacists even when a prescription from a doctor was seen. High-risk medications were never initiated, only prescribed if prescription from patient’s doctor was provided.
• IP did not routinely share information with the patient’s doctors as most were abroad. Example of refusing to supply Lithium to patient in Kuwait, then patient came back with up to date bloods which were documented at the pharmacy, before supply was made, how can you be sure it was there bloods done etc?
• Labelling and counselling points regarding sodium valproate
• Patients asked to do urine dipstick test before prescribing antibiotics for UTIs, example were they prescribed only three days worth of Nitrofurantoin to patient with recurring UTI (example to show that they know some stuff) spoke to her regular pharmacist to confirm previous supplies and referred her back to her GP (again example he knows hes doing diligence and also signposting back).

Improvement action plan:

1. Have proper insurance for prescribing
2. Revised Prescribing Policy
   – Revised Prescribing Audit template

Pharmacy 3

Below is a summary of the inspection report from the primary visit by the GPhC.

• Did not have proper SOPs.
• Pharmacy cannot demonstrate that the private Dr service that it works with is meeting the regulatory requirements.
• Pharmacy’s information governance and safeguarding procedures lack formality.
• Most SOPs overdue review and out of date might not reflect current legal requirements or best practice, some duplicated or not relevant to Pharmacy’s current activities
• No policies or procedures explaining how they work with private Dr or the scope of pharmacist prescribing services.
• Pharmacy currently working with a private Dr but he was not working for the pharmacies CQC registered service.
• Pharmacy did not have any record of dispensing incidents, the last entry in near-miss log in 2018.
• Dispensing labels not always signed by pharmacist.
• Complaints procedures not always promoted in pharmacy or on website, so people may not know how to raise concern,
• Pharmacy did not always use mechanisms to actively seek feedback about pharmacy’s services, so it might miss opportunities to make improvements. Also give examples of what we have done as a result, this can be used to kill time.
• Unlicensed medicines were sometimes supplied on prescription and the pharmacy maintained appropriate records.
• Team members briefed on principles of data protection and confidentiality
• There were no formal information governance policies so risk as staff may not fully understand their responsibilities.
• SI stated they had completed safeguarding training some years ago but had no evidence of this.
• Pharmacy’s website did not include GPhC no. or superintendent’s details, promoted clinic with GMC Drs but did not provide any details, absence of information did not support people to make informed decisions when opting to access the pharmacy’s services.

Improvement action plan

1. The pharmacy cannot demonstrate that its pharmacist prescribing service is operating safely. It does not have SOPs or a prescribing framework covering this activity. And it hasn’t completed risk assessments for this service identifying the therapeutic areas and classes of medication included, or the key risks involved, with a plan explaining how these risks are mitigated.
2. The consultation records for the pharmacist prescribing service do not contain enough information to support prescribing decisions.
3. The pharmacy’s prescribing service does not have sufficient safeguards in place to provide assurance that medicines are always prescribed safely. It cannot demonstrate how it verifies information about the patient and their existing health conditions or communicates with their usual doctor to ensure the continuity of their care. And it cannot show that prescribing of CDs in line with UK guidelines.

Action taken by pharmacy – Pharmacist prescribing service suspended

In the UK, a couple more seasons with even more intense A(H3N2) activity associated with substantial morbidity followed, culminating in a peak over the turn of the Millenium (See figure 1). In mid-2000, this led to the creation of a universal influenza vaccine programme for those aged 65 years and older². The plan was created in order to reach herd immunity targets set by the World Health Organization (WHO) at 75% of at-risk patients.

With a limited capacity of doctors resulting in a vaccination rate hovering around 36.7%³, the UK government increased supply capacity by proactively amending to the Medicines Act in late 2000 to allow specific classes of healthcare professionals to supply and administer the vaccine (via Patient Group Direction). Over the next few years, there was a steady increase in vaccine rates until 2005/06, when the majority of healthcare professionals were suitably trained England hit its 75% target. Year on year the UK has been consistently seated at the top of the table relative to all European countries, furthermore, the top 4 countries all offer non-doctor vaccinations.

Now amid the COVID-19 pandemic, it is estimated that the level of flu vaccines required by the public will triple⁴. The beginning of this has already been shown in the UK which started its flu vaccination season last month. Community pharmacists have already vaccinated more than 650,000 NHS patients in the first four weeks, which is four times average rates from 2018-19⁵.

So why have pharmacy-based flu vaccines proven to be so successful?

One key factor is Pharmacists have consistently proven clinical excellence, ease of use and availability around the world. One of the most substantial pieces of evidence comes from a peer-reviewed meta-analysis from the College of Pharmacy Canada which reviewed thirty-six studies assessing the role of pharmacists in immunization. It is noted that “increased vaccination rates for influenza vaccines were observed with the addition of pharmacists as immunizers” and concludes that:

Pharmacists should be involved with immunization in whatever ways their legislation allows and however they are competent and comfortable. Those pharmacists without legislative authority or who are not comfortable injecting can play an important role in providing immunization education and facilitating immunization, as these roles have also been shown in this systematic review and meta-analysis to increase vaccine coverage.

Canadian Pharmacists Journal, 2018⁶

In fact, the success of pharmacist-led influenza clinics has led to the UK government to consult on the possibility that pharmacy technicians will be able to administer the vaccine…⁷

An expanded workforce eligible for administering the flu vaccine may be required, given the recent announcement of an expanded flu vaccination programme this winter. Millions more could receive the flu vaccine than received it last year, so there is a need to ensure the workforce comprises enough people to deliver these additional vaccinations.

Department of Health & Social Care⁸

So what’s next for pharmacists?

As convenient healthcare demand sores and pharmacists competence is no longer questioned, where next? The key to these new capabilities is clinical governance, to make ensure new services are contained within a framework to avoid medico-legal complications. On top of this data collection is needed to prove to health commissioners and the public the safety and efficacy of the pharmacist workforce. Voyager medical provides such a service via its hubnet.io platform.

References

1. History and evolution of influenza control through vaccination: from the first monovalent vaccine to universal vaccines. Journal of preventive medicine and hygiene. Published Sep 2016, accessed Oct 2020.
2. Uptake and effectiveness of influenza vaccine in those aged 65 years and older in the United Kingdom, influenza seasons 2010/11 to 2016/17. Journal of preventive medicine and hygiene. doi: 10.2807/1560-7917.ES.2018.23.39.1800092. Published Sep 2018, accessed Oct 2020.
3. Influenza vaccine uptake and distribution in England and Wales using data from the General Practice Research Database, 1989/90–2003/04. Journal of Public Health. Published October 2005, accessed Oct 2020.
4. Community pharmacists vaccinated more than 650,000 NHS patients in the first four weeks of the flu vaccination service. Pharmaceutical Journal, published Oct 2020, accessed Oct 2020.
5. Influenza vaccine data 2018-19. Pharmaceutical Services Negotiating Committee. Published Sep 2019, accessed Oct 2020.
6. Canadian Pharmacists Journal [doi 10.1177_1715163518783000] Isenor, Jennifer E.; Bowles, Susan K. — Evidence for pharmacist vaccination. Published Jun 2018, accessed Oct 2020.
7. Pharmaceutical Journal: Government consults on allowing pharmacy technicians to administer COVID-19 and flu vaccines. Published 28 Aug 2020, accessed Oct 2020.
8. Changes to Human Medicine Regulations to support the rollout of COVID-19 vaccines: Department of Health & Social Care. Published 28 Aug 2020, accessed Oct 2020.

The independent community pharmacy sector is fast evolving into a more service-based model. With the impending acquisition of Pharmacy2U by Amazon and the meteoric rise of internet pharmacies such as Well and Boots… (see image below) We don’t have much choice.

Our representative associations have promised more commissioned services to compensate for this loss, but where are they? We are now on equal par with GPs abilities i.e. we have the means to supply medicines and care via PGD or Independent Prescribing but why does the NHS not look at community pharmacy as a low priced alternative to commissioning in primary care? To date we have seen the withdrawal of MUR and Minor Ailments, but where are the new services that will keep us financially viable?

Unfortunately, it seems a round table for commissioning doesn’t exist. The NHS is at the top commissioning services, the money for which flows its traditional course, roaring down to the CCGs and GPs and then lastly trickling to pharmacies.

How can we independent pharmacies keep up?

One way is to address a need of your commissioner, find where there is an issue in the system and create a solution. But where can you find an established need? One place is going direct and searching for local NHS tendering websites and procurement requirements. However, competition here is fierce from larger chains and medical agencies.

A fascinating place to find an issue which needs resolving is the Courts Tribunals Judiciary website. This site publishes a list of preventable deaths attributed to alcohol, drug and medication. Here is a quick summary of the latest entries… (Or make an entry yourself by clicking this link…

Many of the issues listed relate to overdoses with tramadol, even though the medicine was reclassified as Schedule 3 in June 2014. As a pre-reg tutor why not get your Pre-Registration student to go through this list, get them to pick one issue that a pharmacy could potentially resolve and design a solution. In the case of tramadol, why could there not be a specialised MUR-like service which audits patients who may be at risk of overdose?