Providing services online

We expect all online pharmacies to have systems in place to carry out an identity check appropriate for the medicine being supplied.

During a risk assessment, the pharmacy owner should gather evidence about the risks for each individual service, medicine and medical device before providing that service. Through this careful and thorough look at the individual medicine, they should determine what level of identity checking will be appropriate.

We don’t specify a particular technical solution for checking a person's identity. Instead, online pharmacy owners should have a robust process in place to carry out checks appropriate to the medication they’re supplying.

There are several different ways to check a person's identity. This can include using an external credit reference database or a specific identity-checking service using photo ID verification.

If pharmacy owners work with an online prescribing service or prescriber, they should also have evidence to assure themselves that the prescriber has robust processes to check the identity of the person, to make sure the medicines prescribed go to the right person.

For example, the pharmacy owner may check that the online prescribing service or prescriber is keeping to the Identity Verification and Authentication Standard for Digital Health and Care Services, which provides a consistent approach to identity checking across online digital health and care services.

We know from our own regulatory tools and from external sources that this is a key risk for patients.

As set out in our guidance, we expect pharmacy owners to make sure that their website and the websites of companies they work with are arranged so that a person can’t choose a prescription-only medicine (POM) before there has been an appropriate consultation with a prescriber. 

Our guidance reflects what is set out by the MHRA’s Blue Guide on the advertising and promotion of medicines. However, it also sets an additional requirement for online pharmacies to carry out an appropriate consultation before a POM can be chosen. It also stipulates that online pharmacies should make clear that the decisions about treatment are for both the prescriber and the person to consider together during the consultation, in line with the MHRA’s guidance.

We have published a joint statement with the MHRA on our approach to our respective roles in regulating the advertising and supply of medicines from online pharmacies.

We are clear in the guidance that pharmacy owners must make sure that there are robust processes in place within the online pharmacy to:

• carry out identity checks on people obtaining medicines, appropriate for the medicines being supplied
• identify requests for medicines that are inappropriate, including multiple orders to the same address, a person using multiple accounts to make orders or orders using the same payment details.

Working with prescribers who aren’t appropriately registered with the relevant UK professional regulator, and with prescribing services not based in the UK, could create significant extra risks for patients and the public.

If pharmacy owners do decide to work with prescribers or prescribing services operating outside the UK, they need to make sure that:

• they successfully manage the extra risks, and that the prescriber is working within national prescribing guidelines for the UK
• the prescriber is registered in their home country where the prescription is issued and can lawfully issue prescriptions online to people in the UK
• they have sufficient indemnity in place to cover their service that uses prescribers or prescribing services based outside the UK, and pharmacy staff supplying medicines against prescriptions issued by these prescribers or prescribing services
• the prescriber is working within national prescribing guidelines for the UK

Our inspectors will be looking in detail at how the pharmacy is managing potential risks during inspections and we will act where necessary.

Pharmacy owners are expected to always follow the guidance, including when supplying to people outside the UK.

If pharmacies sell or supply medicines to people in other countries, they must keep to any other laws that apply. Countries have different restrictions, and some don’t allow the online supply of medicines at all.

It’s the owner’s responsibility to make sure the medicine they supply has the marketing authorisation needed for it in the country of destination. 

Not following our guidance or not taking the appropriate steps to achieve a desired outcome under our standards, could mean that the pharmacy fails to meet one or more of the standards for registered pharmacies. This could result in our taking enforcement action.

It’s vital to have appropriate safeguards in place for certain categories of medicines to make sure they are clinically appropriate before being supplied.

Our guidance requires pharmacy owners to ensure the person seeking care has provided the contact details of their regular prescriber such as a GP, and their consent to contact them about the prescription.

In the case of medicines liable to abuse, overuse or misuse, or where risk of addiction and ongoing monitoring is important, the pharmacy owner should confirm before supplying. This would involve contacting the person's regular prescriber to confirm that the prescription is appropriate, and that monitoring is in place.

If there are circumstances where the person doesn’t have a regular prescriber such as a GP, or if there is no consent to share information, the prescriber must then decide whether to prescribe. They will need to think about the person's best interests and make a risk-based assessment about whether they can prescribe safely, considering whether the person would be at risk of death or serious harm if they are getting medicines from other sources.

The prescriber must make a clear record setting out their justification for prescribing or not prescribing.

We may take enforcement action  against pharmacies for not following this guidance.