If you are a distance-selling pharmacy attached to a private high street-based, pharmacy, the GPhC may want to inspect your premises to ensure that you are not offering face-to-face NHS essential services to the public. In this case, a risk assessment of P medicine sales would be essential. Creating one requires a deep understanding of the local regulations, pharmacy operations, and the specific risks associated with the sale of Pharmacy Only (P) medicines. Here’s a simplified outline to guide you:

1. Identification of Risks:
   • Expiry date check
   • Incorrect Dispensing
   • Pharmacist Sale Approval
   • Miscommunication about medicine usage
   • Adverse reactions or interactions
2. Analysis of Risks:
   • Likelihood of occurrence
   • Potential impact
3. Evaluation of Risks:
   • Tolerability
   • Priority for addressing
4. Mitigation Strategies:
   • Staff training and certification
   • Clear procedures for the sale of P medicines
   • Patient counseling
   • Proper signage and information
   • Systems for verifying patient details and medicine details
5. Monitoring and Review:
   • Regular audits
   • Feedback collection from staff and patients
   • Review of adverse incidents
6. Documentation:
   • Recording all identified risks, analysis, mitigation strategies, and reviews
7. Compliance with GPhC Standards:
   • Ensuring all processes comply with the General Pharmaceutical Council (GPhC) standards and other relevant regulations.

This outline is quite general and should be tailored to the specific circumstances of the pharmacy in question. Consulting with a legal professional or a pharmacy consultant with experience in UK regulations is advisable for a thorough risk assessment. If you would like to get in contact with one please drop us a line.

Examples of tasks that may be covered by SOPs in a pharmacy include:

• Receiving and processing prescriptions
• Dispensing medications
• Providing patient counselling
• Handling and disposing of hazardous materials
• Processing insurance claims
• Maintaining accurate records
• Managing inventory
• Training new staff

SOPs are typically developed by the pharmacy management or by a designated SOP committee, and they may be reviewed and updated on a regular basis to reflect changes in laws, regulations, or best practices. SOPs are important because they help to ensure that tasks are performed consistently and accurately, and they can also serve as a reference for staff when they are performing unfamiliar tasks or procedures.

Overall there is a wide range of SOPs, below is a list of the most important ones used in healthcare:

COVID Vaccine Clinic Standard Operating Procedures including:

• COVID-19 Pharmacy Vaccination Services
• COVID-19 Social Distancing and Infection Control Risk

Prescribing Specific Standard Operating Procedures including:

• Referral Criteria Policy
• Chaperoning Policy
• Safeguarding and protecting people from abuse policy (adult protection/child protection)
• Privacy, dignity and respect of service users
• Medication policy (dispensing process)
• Information management policy
• Infection prevention and control
• Participation policy
• Complaints policy
• Duty of Candour policy
• Recruitment and induction policy
• Staff training and development policy
• Bullying and harassment policy
• Whistleblowing policy
• Equality and Diversity Policy
• Clinical governance policy
• Staff Handbook

Pharmacy and Medical Standard Operating Procedures including:

• Fire Risk Assessment
• Arrangements for dealing with emergencies including resuscitation
• Care Quality Commission Governance (CQC Care Providers only)
• Statement of Purpose
• Patient Guide
• British Code of Advertising
• Patient Disclaimer
• Disability and the Equality Act 2010
• Seeking Clients’ Consent
• Complaints Procedure
• Whistle Blowing Policy
• Confidentiality Policy
• Clinical Governance
• Clinical Audit
• Safeguarding Policy
• Stress Management
• Sickness and Absence Policy
• RIDDOR Procedure
• Policy on violent or abusive patients
• Mental Capacity
• Medicine Incident Reporting Policy
• Medication Review Policy
• Protocol for the Identification of Patients with Learning Disabilities
• Electronic Transfer of Patient Data Policy
• Medicines Safety Alerts Policy
• Disciplinary Policy
• Disclosure and Barring Policy
• Computer Misuse Policy
• Computer and Data Security Procedure
• Caldicott Protocol
• Business Continuity Plan
• Repeat Prescription Rationalisation (‘Tidy-Up’) by Medicines Management Team in Primary Care
• Pre-Agreed Practice Specific Medication Switches to the Health Board Preferred Generic, Brand or Branded Generic by Medicines Management Team in Primary Care
• Updating Repeat Medication from Community Pharmacy Medication Use Review by Medicines Management Team in Primary Care
• Adding the Medication of a Newly Registered Patient onto the Repeat Prescription by Medicines Management Team in Primary Care
• Medicines Reconciliation from Hospital Outpatient Documentation by Medicines Management Team in Primary Care
• Medicines Reconciliation from a Hospital Discharge Notification by Medicines Management Team in Primary Care
• Domiciliary Medication Adherence Assessment by Medicines Management Team in Primary Care
• Level 2 Medication Review (including repeat medication reauthorisation) by Medicines Management Team in Primary care
• Level 3 Medication Review (including repeat medication reauthorisation) by Medicines Management Team in Primary Care
• Memorandum of Understanding with the Medicines Management Team
• Wholesale Dealers Licence Overidding Single Pharmacy
• Supplying Specific Products (GPhC Registration Holders only)
• Supply of Insulin
• Supply of Lithium
• Supply of Methotrexate
• Supply of Oral Anticoagulant Medication
• Supply of Paraffin Based Skin Products
• Sale and Supply of Veterinary Medicines
• Supplying Oral Anti-Cancer Medicines
• Information Governance (All Healthcare Providers)
• Summary Care Records Privacy Officer
• Staff Confidentiality Agreement
• IG Policy
• Code of Conduct for Employees in Respect of Confidentiality
• Data Handling Procedures
• Mobile Computing Guidelines
• Information Security Incident Management
• Access Control and Password Management Procedure
• Ensuring Staff Compliance with RA01 Terms Template SOP
• GDPR Privacy notice for employees workers and contractors UK
• Privacy Statement for GDPR
• Add New File
• Staff Induction (All Healthcare Providers)
• Locum Induction
• Staff Induction
• Signposting (GPhC Registration Holders only)
• Signposting
• Private Services (GPhC Registration Holders only)
• Salbutamol Supply to Schools
• Blood Diagnostics via Finger Prick
• Dispensing Private Prescriptions
• Operational (All Healthcare Providers)
• Cleaning
• Cold Chain Maintenance
• Equipment Maintenance
• Health and Safety – Risk Assessment
• Internet Pharmacy (GPhC Distance Selling Registration Holders only)
• Dispatching an Internet Order
• Final Checking an Internet Order
• Providing Services via an Internet Pharmacy
• Overarching Internet Pharmacy
• Preparing an Internet Order
• Receiving and Internet Order
• Setting up an internet pharmacy in the UK
• Pharmacy Social Media
• Cold Chain Delivery
• Selling OTC or P Medicines Online
• Pharmacy Cybersecurity
• Checking NHS Exemptions (GPhC + NHS License Holders only)
• Taking an NHS Prescription Charge (GPhC + NHS License Holders only)
• Remote Appliance Fitting
• Remote Compliance Aid Need Assessment
• Remote Patient Assessment of Repeat Dispensing Need (GPhC + NHS License Holders only)
• Remote Promotion of Healthy Lifestyle and Public Health Campaigns (GPhC + NHS License Holders only)
• Remote Signposting (GPhC + NHS License Holders only)
• Remote Disposal of Medicines
• Remote Support for Self-Care
• Essential Services
• Accuracy Check by an Accredited Checking Technician
• Accuracy Checking
• Assembling and labelling prescriptions
• Chaperoning
• Date Checking
• Delivery of Medicines
• Dispensing Medicines with a Compliance Aid
• Dispensing of Prescriptions
• Disposal of Unwanted or Waste Medicines
• Electronic Prescription Service Release 2
• Emergency Supply
• End of Month Procedures
• Owing Medication Supply
• Prescription Collection Service
• Promotion of Healthy Lifestyle
• Receiving Stock into the Pharmacy
• Roles and Responsibilities of Pharmacy Staff
• Support For People With Disabilities (Disability Act 2010)
• Support for Self Care
• Uncollected Prescriptions
• Responsible Pharmacist
• Sale of Medicines
• Repeat Dispensing
• Add New File
• Errors, Interventions and Complaints (All Healthcare Providers)
• Complaints, Concerns, Enquiries and Compliments Procedure
• Dealing with Dispensing Errors
• Interventions and Problem Solving
• Near Miss Audit
• Pharmacy Patient Safety Incident Report and Follow Up
• Preventing errors and recording near misses
• Enhanced Services (GPhC Registration Holders only)
• Blood Glucose Monitoring
• Monitoring Blood Pressure
• Cardiovascular Screening
• Chlamydia Testing
• Cholesterol, Glucose, Hemoglobin Point of Care Testing
• Emergency Hormonal Contraception
• Hosiery Fitting
• Minor Ailments Scheme
• Monitored Dose Systems
• Needle and Exchange Service Scheme
• Palliative Care Enhanced Service
• Pharmacy Urgent Repeat Medicine Service
• Smoking Cessation
• Controlled Drugs
• Balance Check and Record-Keeping
• Delivering Controlled Drugs Standard Operating Procedure
• Destruction of Controlled Drugs
• Dispensing Codeine And Dihydrocodeine
• Dispensing of Controlled Drugs
• Dispensing Supervised Methadone
• Extemporaneous preparation of methadone
• Instalment dispensing of Controlled Drugs
• Recording Concerns over CD management
• Security and Storage of Controlled Drugs
• Supervised Controlled Drugs
• Supply of Sativex
• Business Continuity
• Operating in the Absence of a Responsible Pharmacist
• Pandemic Protocol
• Business Continuity Plan
• COVID Social Distancing and Infection Control Risk Assessment Tool
• Advanced Services (GPhC Registration Holders only)
• Appliance Use Reviews
• Medicine Use Reviews
• New Medicine Service
• Stoma Appliance Customisation Service
• DMIRs
• Seasonal Vaccine Clinics
• Infection Control
• Influenza Vaccination
• Needlestick Injuries and Contamination
• Travel Clinic
• Malaria Chemoprophylaxis
• MMR Vaccination
• Shingles Vaccination
• Travel Core
• Yellow Fever Centre

There are a wide range of pharmacy-only products, unlike prescription-only medicines this restricted category of medicines does not need a doctor’s prescription, but the class can only be served from a pharmacy.

The list is extremely lengthy (some of the 300+ medicines are listed below) and each has its only abuse potential which can be highlighted by inspectors. If you would like access to the full list, please access the Online Prescribing Formulary.

• Paracetamol / acetaminophen – a common medicine used in suicide.
• Psudoephedrine – methamphetamine conversion risk.
• Dextromethorphan – opioid abuse potential.
• Pholcodine – opioid abuse potential.
• Promethazine – sedative abuse.
• Laxatives – weight loss.

In the UK, a business which can dispense Prescription Only Medicines (POMs) against a prescription is termed a ‘Pharmacy‘ and must be registered with the General Pharmaceutical Council (GPhC), the UK pharmacy regulator. “Pharmacy” is considered a protected title by the UK government, meaning using the title in regards to a business without registration can result in prosecution by the GPhC for “risk to public safety“. It is often prohibitively expensive to purchase an existing pharmacy as prices can range between £50,000 and £1,000,000+, entrepreneurs often find it easier to start one from scratch with the guidance of experienced veterans in the industry. This article has been created for business people looking to start an online pharmacy and acquire the ability to dispense POMs against a legal prescription.

How to set up an online pharmacy?

On average (we have dealt with over 1,000 applications), it takes 3 months to start an online pharmacy. The most important thing to understand is that there are two kinds of pharmacies in the UK, one which has been awarded a contract to serve the NHS and one which has not. Put simply:

An NHS-contracted pharmacy must abide by stipulations of both the Regulator, the GPhC (via the 5 principles) and the NHS via the Community Pharmacy Contractual Framework. Whereas a private online pharmacy, only needs to meet the requirements of the GPhC.

The next stage after deciding whether to pursue an NHS or Private Pharmacy is that you will then need to choose whether you want to have a presence on the high street or not. The following decision matrix can help you make this decision:

• NHS contracted pharmacy – this is the most common type of pharmacy you find in the UK. and includes the common high street pharmacies such as Boots, Llyods or Well. These pharmacies are contracted by the NHS to enable the UK public to hand the pharmacist a standard green FP10 prescription which was obtained from their NHS GP and receive the dispensed medicine at the standard NHS prescription charge which currently is £9.15.
• Private Pharmacy – are less common in the UK as the majority of healthcare provision is by an NHS-commissioned GP and Pharmacist. However, in recent years due to the lack of funding of the NHS, there has been an increase in the number of private prescribers and private pharmacies offering services to patients who are willing to pay for more convenient medicine.
• Easiest route – is to follow the right-hand path of the image to the left. i.e. dispense only private prescriptions via a distance-selling pharmacy.

Stage 1: Create or use an existing Companies House registered entity.

You do not need to be a pharmacist to start an online pharmacy (termed Distance Selling Pharmacy by the GPhC) in the UK. The essentials of the GPhC application process entail that you simply require to be a director of a Limited company / NHS trust / sole trader / partnership and be associated with a pharmacist who will represent your business as a “Superintendent“. By far the easiest mechanism to achieve this is to register a new limited company and contract the use of a remote Superintendent. A Superintendent is a special class of pharmacist who has at least 3 years of pharmacy experience and is not a superintendent of any other organisation.

Stage 2: Find a suitable location.

Once the fundamentals of the Companies House entity have been established, the next stage is finding a suitable location, this can be broken down into four distinct stages:

A great way to get a head start would be to open a pharmacy within a GPs centre, i.e. make a jeweller next to a gold mine, however, this has been explicitly excluded by GPhC stipulation. The site should not be next door or in the vicinity of any other Primary Care setting (GP Surgery, another pharmacy).

Stage 3: Making the GPhC application.

If you are making an application for an NHS Distance Selling Pharmacy this is initially done on a local level, you will need to find what local health authority your pharmacy will be under by consulting a list of local Clinical Commissioning Groups (CCG). Once you know which CCG you will be applying to you will need to contact NHS England to get their contact details via their website.

If you intend to register a private distance-selling pharmacy, you can bypass this first step and make an application directly to the GPhC using this form. Filling out this application form is simple up until section 5 where you have to give examples of how you intend to meet the GPhC’s five principles, we have created an automatic distance-selling pharmacy compliance tool you can use to check these points. Applicants often get stuck when they are asked for the following:

• Feedback and your complaints systems – the GPhC require all pharmacies to have a system in place which allows patients using the service to complain about the service.
• Standard Operating Procedures – this is usually required by the GPhC for submission ensuring that the pharmacy has sufficient clinical safeguards to ensure the safe dispensing of medicines.
• Online prescribing – this is a relatively new development in online pharmacy service provision. Because pharmacies in the UK are CQC-exempt, they may employ prescribers to prescribe medicines online. However, specific clinical governance requirements first must be met. These must include systems to ensure the safe management of:
  • Antimicrobial or antibiotic medicines
  • Medicines that are liable to abuse, overuse or misuse
  • Medicines that need to be monitored or managed

Stage 4: Making the MHRA Application

Due to Brexit in the UK, the Medicines and Healthcare products Regulatory Agency (MHRA) has temporarily decided to not make this step mandatory, you can read their full release here. We have included some information about what the requirements were previous to 2021 as it is likely that they will be reinstated at some point in a different form. Pre-2021 a new DSP would have had to pay the MHRA ≈£200 to ask them permission to use your GPhC license to offer medicines online. Once the application was complete the MHRA would have given the online pharmacy an additional logo with a hyperlink to their verified online pharmacy register.

Optional Stage 5: NHS Contract Application

Before a registered pharmacy can dispense prescriptions issued under the National Health Service, it must be included in the pharmaceutical list relating to a Health and Wellbeing Board Area, maintained by NHS England (administered by the local team). Applications to join this list can be submitted to NHS England via their Primary Care Support England (PSCE) website.

Within the NHS Distance Selling Application, you will be required to submit the following details:

• Opening hours – you will need to specify within what hours the service will be provided.
• What Advanced & Enhanced Services you will offer – will you offer smoking cessation? Needle exchange?
• Health and Wellbeing Board needs assessment – is there a need in the area?
• Pharmacist Declarations – you will need a pharmacist on board.

Online Pharmacy Issues

Once you have set up correctly and are up and running there are a few other attributes to your business you should consider. One is how does an online pharmacy check a patient’s identity will you do this in-house or use a third party, another is how to mitigate the medico-legal risks of online prescribing. For further information, we have made a list of the most common online pharmacy issues.

Conclusion

Overall, each application to the GPhC costs ≈£750. We provide a wide range of consultancy services to help you get online prescribing and dispensing to Best Practice in no time, get in contact with one of our consultants today.

“Maybe there’s something to the Hollywood adage of not negotiating with terrorists?!?”

This emerging risk is being reflected in pharmacy regulatory inspections around the world, for instance, a key inspection point of the pharmacy regulator in the UK, the GPhC, specifies in Standard 5.3” of its 5 Principles that “Equipment and facilities are used in a way that protects the privacy and dignity of the patients and the public who receive pharmacy services“. As inspections in the UK can now be fully unannounced, the GPhC expects that at any time, a pharmacy organisation needs to prove that patient data access is fully secure. The question here is what exactly will they be looking for?

In reference to the GPhC, they mainly focus on whether NHS Smartcards have been shared or not but also whether other third-party services which handle data on behalf of the pharmacy are compliant. This may relate to:

• PMR access – every PMR used in the UK for NHS services are required to have a smartcard as above, however, if the pharmacy is private this may not be the case. Private Patient Medical records may only have password protection, in this case, each staff member should have their own login and password which may be compromised.
• Digital Controlled Drugs Registers – some pharmacies use digital controlled drugs registers to record their CD balances. In this case, again, each user should have a unique username and password.
• Online repeat services – these services take patient information and relay prescription requests to the pharmacy.

“Access sharing” is one of the main causes of data breaches from organisations, this is where one email address is shared between multiple users. It is highly recommended that each pharmacy team member needs to have their own unique login for each website that the pharmacy uses. This is contrary to some pharmacy operations where “shop emails” are used and shared between the teams. To add to the weight of access issues, there are also a myriad of malware systems used by “black hat” hackers to circumvent even secure passwords:

How to perform a quick pharmacy cybersecurity check…

The first action point to consider is to get a list of your organisations email addresses (which can be found in the HubNet.io Team Builder) and use a service like Have I Been Pwnd? The service will tell you whether that specific email address has been compromised. As password sharing between sites is so common (users often find it difficult to remember multiple secure passwords and often use one across multiple sites), it is highly recommended if the email has been “Pwned” that it should be changed across all sites.

The issue with cybersecurity in pharmacy is because organisations often employ multiple people there will be multiple points of failure, i.e. not only could your password get hacked but everyone else’s can as well. So as a business owner, you are not only responsible for your personal cybersecurity but also for the people that work for you. In this regards sharing to your staff members via Social media. can be a great way to keep them on their toes. This password word cloud is a great example of an easily digestible cybersecurity reminder.

How to protect your organisation from an ongoing potential threat…

There are three ways:

• Education and training – get your staff to take a cybersecurity course, they will learn things like the importance of using two-factor authentication, enabling automatic updates and the use of anti-virus software / ad-blocking browser plugins.
• Protection and inoculation – use a vulnerability scanner to identify unpatched software or other insecure computer settings.
• Cyber protection insurance (CPI) – this may already be included within your existing insurance, however, CPI could be purchased as a standalone. CPI is a relatively new form of cover, it’s designed to help protect your business from the financial impact of computer hacking or a data breach.

Digital Amalgamation

Lastly, one great way to protect against cybersecurity threats is a digital amalgamation service. For instance, if you use multiple third-party providers for services as listed above this opens multiple avenues for hackers to penetrate into your organisation, however, if you had one port of call which amalgamated a Controlled Digital Drugs Register, a PMR and a repeat service into one this will reduce your orgnisations exposure to threats. For more information have a look at our Pharmacy Cyber Security SOP.

One common answer to this question is that Pharmacists are inherently technophobic. The reasoning behind this is as their job is sp intensely micro-transactional and requires an unbelievable 100% accuracy rate any new tool which could add a rate-limiting step or bring uncertainty into the process is avoided. The problem with this, in this day and age, is technology is getting more and more efficient and if a pharmacists head is in the proverbial sand other companies will overtake as they are adopting these efficiencies from their inception.

At the start of the creation of the hubnet, we made a deviation of our main logo.

Thankfully, today’s pharmacists are past the quil stage, they have been firmly in the second to last micro-transactional for the past 20 years. Computers have come in and have been widely adopted, creating efficiencies (would you believe it was standard practice in pharmacy 40 years ago to “save” patient data in a card system). It would be unimaginable today, to go to a modern pharmacy and see the same card system in use. For one, it would be massively inefficient, to retrieve a patient’s past history and then to add to the system would take allow for only a few transactions in a day. In a world where the average pharmacy does between 200-400 prescriptions a day an electronic PMR system is a necessity not a luxury.

It is arguable, that the same can be said for the bureaucracy behind the dispensing of prescriptions, to name a few traditionally paper based processes which are mandatory under an NHS licensed pharmacy:

• NHS Prescriptions – this is now reducing because of ETP!
• Private Prescriptions
• NHS Repeats
• Community Pharmacy Patient Satisfaction Survey
• Standard Operating Procedures
• Staff training
• Human Resources
• Controlled Drugs registers
• Risk Assessment Forms
• Minor Ailments Forms

The list is almost endless and will get larger as more legislation and services are developed for pharmacy. But what can you do?

Obviously, we have a bias, a solution for Paperless Pharmacy, however we believe it is the best option available for three distinct reasons.

1. It puts everything in one place. You can have a CD register on one website, your CPPQ on another and your Risk Assessment Forms somewhere else. What happens when a locum comes in? Will your services have continuity?
2. It is being used everyday by our Managing Director in his pharmacy. The HubNet.io is a dynamic system, meaning as new requirements are developed they are coded directly into the system as they are required to operate our pilot pharmacy.
3. It costs less than a third of all the others combined. As it is all in one place we essentially become a buying group for new digitally enabled services.

If you are interested in the system have a look at the Paperless Pharmacy here.