Online prescribing: opportunities to improve patient safety

Independent online prescribing has expanded rapidly in recent years, driven by increased patient demand for convenience, long NHS waiting times for some services, and a broader shift toward digitally enabled models of care.

This investigation focuses on challenges for independent prescribing organisations in accessing clinical information held by the NHS to inform safe prescribing decisions for the patients who use their services. It also explores how gaps in NHS patient information about medication prescribed by independent prescribing organisations creates risks for the delivery of safe care.

For both NHS and independent prescribing organisations, having limited information about a patient’s medical history and the medications they are being prescribed creates a challenge to making safe decisions about ongoing care and treatment.

The investigation also explores the complex regulatory landscape within which independent prescribing organisations sit. In this regulatory framework, regulators may have jurisdiction over different aspects of a single independent prescribing organisations. The investigation explored the challenges this posed and the impact it had on these organisations’ ability to provide safe care.

The findings of this investigation are offered to support the safe delivery of care for patients who use independent prescribing organisations and NHS services.

• Independent prescribing organisations without an NHS contract do not typically have access to a patient’s NHS medical records. This can affect their ability to verify patient information.
• Some independent prescribing organisations use photos or videos of a patient’s NHS App to verify information about the patient’s medical history. This is beyond the purpose of the NHS App and creates patient safety risks as the app is not designed to hold a verified complete picture.
• Independent prescribing organisations have systems to identify multiple requests for medication from the same patient, address or payment method, but this information is not currently shared outside of their organisation.
• No independent prescribing organisations currently have ‘write access’ to patients’ NHS medical records – that is, the ability to enter information directly into a record. This creates the potential for gaps in medical records which can impact on the identification of potential contraindications (factors in an individual's condition or medical history that make it unwise to pursue a particular line of treatment) and complications.
• NHS GPs are being relied upon to provide clinical information to independent prescribing organisations but have limited capacity to provide this. The different approaches to such information requests also create uncertainty among GPs around whether the requests are legitimate and whether they should respond.
• Lack of access to patients’ NHS medical records is a barrier to independent prescribing organisations providing safe care in line with standards, regulations, and best practice.
• A large amount of data is gathered by independent prescribing organisations which could inform patient care, but there is no way to feed this back into the NHS. This data often relates to medications more commonly prescribed by independent prescribing organisations, such as those for weight loss, and has implications for understanding the safety of these medications.
• The Care Quality Commission and General Pharmaceutical Council have arrangements to work together in relation to organisations registered with both regulators, but these arrangements could be made clearer to providers.

HSSIB makes the following safety recommendations

HSSIB makes the following safety observations

1.1.1 In addition to doctors (medical prescribers), a range of non-medical practitioners who have undertaken suitable training and accreditation can prescribe medications within their scope of practice, including:

• Nurse independent prescribers (formerly known as extended formulary nurse prescribers), who can prescribe any medicine for any medical condition.
• Pharmacist independent prescribers, who can prescribe any medicine for any medical condition. This includes unlicensed medicines, subject to accepted clinical good practice.
• Physiotherapist independent prescribers, who can prescribe any medicine for any medical condition.
• Therapeutic radiographer independent prescribers, who can prescribe any medicine for any medical condition.
• Optometrist independent prescribers, who can prescribe any licensed medicine for conditions affecting the eye and the tissues surrounding the eye, except drugs controlled under misuse of drugs legislation, or medicines for parenteral administration (that is, administered directly into a person’s body tissue or bloodstream).
• Podiatrist independent prescribers, who can prescribe any medicine for any medical condition.
• Paramedic independent prescribers, who can prescribe any medicine for any medical condition. (National Institute for Health and Care Excellence, n.d.)

1.1.2 The Royal Pharmaceutical Society has developed a competency framework for use by all prescribers (Royal Pharmaceutical Society, 2021).

1.2.1 Independent prescribing organisations are regulated by the same mechanisms as NHS services, including through statute and professional regulators. Part of this regulation has a safety component, which in turn requires risk management processes to be in place to identify new safety concerns, not only in the general business of online prescribing, but at an individual patient level.

1.2.2 Some of these individual safety risks relate to understanding what medications can be prescribed safely, using information about the patient’s history, interactions with other medications, medication side effects, whether a patient can be monitored after the medications have been taken, and how toxic a medication can be if used other than as intended (for example, opioid-based medications).

1.2.3 The Care Quality Commission and the General Pharmaceutical Council both operate in the independent prescribing organisation space, albeit with different remits and statutory frameworks. They collaborate by sharing information, including inspection plans and outcomes for regulators who registered by both regulators. Further details of the regulators in this sector, their roles and remits can be found in appendix 2.

1.3.1 Every patient in the NHS has records relating to their care and treatment. These may be held in different formats (for example electronic and paper) and by separate organisations, such as NHS trusts, NHS GPs, and voluntary and independent sector organisations, some of which may provide NHS care.

1.3.2 Most prescribers who work within the NHS in England can access a summary of a patient’s records or information, commonly known as a Summary Care Record (SCR), through the National Care Records Service (NCRS). The SCR is a condensed version of a patient’s GP record which includes some medical history, current medication, allergies and details of any previous adverse reactions to medications (NHS England, 2025b). The NCRS enables web-based access for staff with an NHS access cards, pass and security keys and other authenticator mechanisms to identify patients and view their SCR. The NCRS currently enables access to ‘over 63 million patient records’ (NHS England, 2025a).

1.3.3 Consent from the patient is required in order to have a SCR, which is then shared through the NCRS. The patient’s permission should be sought to access the SCR, although it can be accessed in the patient’s best interests, for example where the patient is unconscious.

1.3.4 The Single Patient Record is an NHS England work programme to develop a record that can be shared across the healthcare system to provide a ‘single version of the truth across care settings’. It is currently in testing and is planned to be in place in 2028 (NHS England, n.d.b).

3.1.1 It has been recognised that ‘prescribers need full information [about patients] to be able to prescribe safely’ (Department of Health and Social Care, 2025a). However, national stakeholders told the investigation that such information was not available to independent prescribing organisations due to an “information gap between independent providers and NHS providers”. Independent prescribing organisations described this information gap as their “biggest concern”, as they were trying to make safe prescribing decisions but with only limited information about the patients they were providing care for.

Access to NHS patient information

3.1.2 The investigation heard that most independent prescribing organisations did not have access to NHS patient information. This was because NHS systems designed to share information required NHS logins, which are only available to organisations with NHS contracts (see 3.1.14). Not having access meant independent prescribing organisations may only have a limited understanding of the medical and medication history of the patient they are making a prescribing decision about.

3.1.3 The lack of information created the risk of patients being prescribed medications contraindicated or otherwise unsuitable for their specific situations. For example, it has been identified that glucagon-like peptide-1 agonists, commonly known as GLP-1s or weight loss medications, have been found to increase the effect of anticoagulant medication (medication that reduces the ability of the patient’s blood to clot) (National Institute for Health and Care Excellence, 2026). This created a risk of potential harm if an organisation considering prescribing GLP-1s was unaware of a patient being on an anticoagulant. This is just one example which reflects the wider risk of lack of visibility of medical records.

Access to the National Care Records Service

3.1.4 The investigation learned that some independent prescribing organisations had access to the National Care Records Service (NCRS), which enabled them to view a patient’s Summary Care Record (SCR). An example described to the investigation was where independent prescribing organisations held NHS contracts which enabled NCRS access. These organisations explained that while their NCRS access was facilitated by their NHS contracts, they would also use it to view the records of their private patients, with consent.

3.1.5 This meant independent prescribing organisations that held an NHS contract had the ability to use the NCRS for all of their patient groups. The ability to access the NHS records of private patients through this mechanism created a risk of independent prescribing organisations providing only limited NHS services to benefit from access to the NCRS system. In addition, it created a potential inequity for patients seeking private care, as they may not be aware of which providers would be able to access their records and which would not.

3.1.6 Staff within NHS England were aware some independent prescribing organisations that had NCRS access were also using this to access records of private patients. They explained that while this practice was not officially authorised, these organisations should use the access they already had in place, because of the safety risk associated with providing care to patients without accessing NHS records.

3.1.7 Another example shared with the investigation of how NCRS access had been gained was where an independent prescribing organisation had a partnership with another independent healthcare provider which had NCRS access through its NHS contract. This partnership enabled the independent prescribing organisation to use the NCRS for its patients, with their consent. The investigation was told that a number of independent prescribing organisations used this method to gain NCRS access.

3.1.8 The Coalition for Responsible Digital Health, a membership group of regulated digital-first healthcare providers, stated these methods of accessing records ‘reflect attempts by safety-conscious providers to operate within existing governance structures while meeting clinical obligations in the absence of a consistent national access framework’.

3.1.9 An independent prescribing organisation that also held an NHS contract told the investigation: “… we do have access to that primary care record, which is incredibly useful because … it really comes together when you have … the questionnaires, the Summary Care Record and collateral information.” Some organisations that provided attention deficit hyperactivity disorder (ADHD) services told the investigation they would not provide treatment unless a patient consented to access to their records. They explained this was due to the potential for drug interactions and side effects, which may be identified through the use of the NCRS, and highlighted the importance of independent prescribing organisations having this access.

3.1.10 Independent prescribing organisations which did not hold NHS contracts, or were not using the methods described above, were unable to use the NCRS to help inform prescribing decisions. Some stated there was “zero [information] flow” between NHS services and their organisation. They explained that to have access they would need an NHS account, including an NHS email address, which were only given to organisations that provided NHS services. Many independent prescribing organisations described not providing NHS services because of their business models, or in some cases because they did not have the expertise or capacity to provide the broad range of services that would be required.

3.1.11 The investigation heard differing views from independent prescribing organisations about whether access to NHS records was necessary to provide safe care. Organisations that had NCRS access described having gone to lengths to gain it because of the safety risk. Organisations without access said that “everything that we’re providing is safe to provide with the understanding that we don’t have access to those NHS services” and therefore did not see it as necessary. However, these organisations acknowledged that NCRS access would enable them to cross-reference information provided by patients and would be helpful in better understanding their patients. The investigation was told that in some situations, lack of access had led to increased vigilance from independent prescribing organisations, to the point of asking for more information from patients than would typically be required to make a prescribing decision. This had led to patients being denied medications which could be safely prescribed, because the organisation had no records to check information against.

3.1.12 Independent prescribing organisations told the investigation that, in addition to the safety aspects of being able to access NHS patient information, the current regulatory expectations were that information could be verified through access to the person’s medical records. The relevant guidance states:

‘Make sure the pharmacist or pharmacy staff get all the information needed so they can check that the supply is safe and appropriate. This may be from the person receiving pharmacy services and from access to a person’s medical records, for example their NHS national care record. However, access may not be possible or may be limited, and there are potential risks in supplying without these records.’ (General Pharmaceutical Council, 2025)

3.1.13 Independent prescribing organisations told the investigation that when they had been inspected by the General Pharmaceutical Council (GPhC), this guidance had been interpreted into a single question about whether the organisation had NCRS access. In some cases, there was an expectation that the organisations had access to NCRS, when in reality this was not currently always possible. Some staff at GPhC told the investigation they were aware it’s the guidance had caused difficulties for some independent prescribing organisations because there was variation in organisations’ access to patient data.

The GPhC told the investigation their inspectors follow their inspection decision making framework (General Pharmaceutical Council, 2026) and that reviewing medical records through NCRS was one way of independently verifying information, but others were available. Other options referred to in GPhC guidance were ‘timely two-way communication with the person……or contacting the person’s GP, their regular prescriber, or a third-party provider’ (General Pharmaceutical Council, 2025).

3.1.14 The GPhC was aware of current barriers to access, such as the NHS not currently enabling this, but some staff within GPhC understood enabling access for independent prescribing organisations was “in hand”. Similarly, stakeholders engaged with by the investigation, including some staff working within NHS England, expressed surprise that non-NHS organisations could not access the NCRS to assist in clinical decision making and felt this was a gap in care. This is explored further at 3.1.47.

3.1.15 In addition to the NCRS, independent prescribing organisations described using other sources to gather patient information. These are explored below.

Referrals from GPs

3.1.16 The investigation learned that NHS GPs only referred to independent prescribing organisations that had an NHS contract in place. One example was organisations that provided diagnosis and treatment of ADHD. Independent prescribing organisations who provided ADHD services and ADHD patient group representatives described that referrals from GPs for diagnosis and treatment services were common due to the long waiting lists for NHS services. Some organisations said that 90% of their patients were referred in this way.

3.1.17 This meant that most Independent prescribing organisations who provided ADHD services received information about patients from their NHS GP. This included a referral letter or form completed by the GP, which detailed information about the referral, including why it was being made, the patient’s history, medication, any other health conditions they may have, and any risk factors associated with the patient.

3.1.18 GPs told the investigation that such referrals were not always straightforward as each independent prescribing organisation had developed its own process for referrals. This meant the format and information required in the referral was different for different organisations, leading to frustration for GPs who had to learn these different requirements. Some GPs told the investigation they would write a referral letter and then be asked to complete a referral form as well, which duplicated the information already provided and caused frustration.

3.1.19 Independent prescribing organisations that held NHS contracts would receive information in the form of a GP referral but also had access to the NCRS system (see 3.1.4). This was in contrast to other services, such as those for weight loss or erectile dysfunction, for which there were no NHS contracts in place. This meant that there was no opportunity for prescribers of these types of medications to receive information about a patient’s medical history in a referral from their GP, and compounded the lack of access to the NCRS.

Verifying information with the patient’s NHS GP

3.1.20 Independent prescribing organisations told the investigation that one way of verifying information about a patient was to contact their NHS GP practice. They explained this was not an everyday method of gaining information, but was used when the prescriber considered that additional information was required which the GP may be able to provide. Contact with the NHS GP was only made with the patient’s consent.

3.1.21 The Medical Defence Union (MDU) has issued advice on how GPs should respond to requests from independent prescribing organisations to disclose information (Medical Defence Union, 2025). This advice highlights that ‘GPs have an ethical duty to share accurate and up-to-date information with those providing patient care’.

3.1.22 GPs told the investigation that requests for patient information from independent prescribing organisations presented a conflict for them. They wanted patients to “get the best out of their private provider”, but NHS GPs were “not paid” to provide information to such organisations.

3.1.23 GPs also described the steps required to provide information in response to a request from an independent prescribing organisation. These included reviewing the patient’s records to check for any information which was appropriate to share and redacting information that was not. Some GPs also reported being asked to provide an opinion on whether a particular medication was appropriate for a patient. GPs said that they did not usually give such opinions, as it was for the individual prescriber to make this decision.

3.1.24 Some GPs described being uncomfortable undertaking this level of work on behalf of independent prescribing organisations, especially in the context of the current strain on GP resources. They described needing to enable the delivery of safe care, while working within the contract and available resources, which led to them needing to “draw lines” around their work.

3.1.25 Reflecting this, independent prescribing organisations said providing patients’ medical information was not a role the NHS GP was “designed” to do, and they recognised it layered additional work onto these already busy services. However, some independent prescribing organisations told the investigation that “NHS GPs believe it is their right to withhold information from private providers” and that this impacted on patient safety.

3.1.26 The MDU’s guidance recognises the burden these requests place on NHS GPs, but that there is a balance between the burden and the potential risk of harm to patients. However, the investigation heard that some NHS GPs were overwhelmed by the number of requests for information they received; this was compounded by the increase in requests associated with the prescription of weight loss medications.

3.1.27 NHS GPs likened providing information to independent prescribing organisations to a request from an insurance company, or information required for the issuing of a firearms licence. It had been well established that these types of requests fell outside of NHS care provision and therefore financial payment was made for the GP to undertake these additional services. It was felt that the provision of information to independent prescribing organisations was similarly outside of their NHS role, but because it related to direct care provision this had become complicated.

3.1.28 In addition, such requests may be made by email or phone call to NHS GPs from independent prescribing organisations they may not be familiar with, leading them to question the authenticity of the request. This was in contrast to requests from NHS organisations, where the use of recognised systems, such as NHS mail, provided reassurance about the legitimacy of the request. Independent prescribing organisations’ requests may also come without clear written consent from the patient confirming that the GP can share the information.

3.1.29 Independent prescribing organisations described often being unable to speak with a GP or gain the information they were seeking. As a result some organisations had stopped attempting to contact GPs to gain patient information.

3.1.30 GPs told the investigation that there were already mechanisms in place to give patients their own information, which they described as “easier” than engaging with individual independent prescribing organisations. They felt these established processes, which could provide more timely access, should be used and the information then passed on by the patient. Alternatively, they questioned whether information within the NHS App could be shared by the patient with the independent prescribing organisation. This method of sharing information is explored below.

Information provided by patients

3.1.31 Independent prescribing organisations described systems for gathering information from patients. Commonly initially done through an online form or set of online questions which the patient worked through followed by direct contact where required. The independent prescribing organisations described and demonstrated to the investigation various systems they had developed to try and gather sufficient information to be able to prescribe safely. These included using specific pathways or sets of questions depending upon patients’ answers or information provided. The systems included questions targeting medical conditions and medications known to be relevant to the treatment being sought. Independent prescribing organisations demonstrated various safeguards built into these systems to highlight concerns or anomalies to the prescriber. These are explored further at section 3.4.

3.1.32 A number of independent prescribing organisations stated that it was important to trust patients, with one saying “the patient has got the right and has got the autonomy … to be able to answer questions about their own health”. However, independent prescribing organisations recognised the risk of taking what the patient told them as “gospel”, as patients may not have a full understanding of their medical and prescribing history, which could affect their ability to pass on all information which may be safety critical. Reflecting this, the Royal College of Pharmacy highlighted the need to balance patient-centred care with appropriate clinical safeguards to support prescribing decisions.

Use of the NHS App

3.1.33 The investigation was told by some national organisations that patients could authorise healthcare organisations to access their NHS App to support decision making. When explored with NHS England App team, it was made clear that the App does not have this functionality. The App team stated that the NHS App had been developed as a means of giving patients access to their information. It was designed for individual use, not for healthcare professionals to verify information. Therefore there was some misunderstanding across the healthcare landscape around the availability of such functions.

3.1.34 Several independent prescribing organisations mentioned requesting video footage or screenshots of patient records held in the NHS App in order to verify patient information. They recognised that these methods had some limitations and that, especially in the case of screenshots, there was a risk the full history had not been captured accurately, with a patient’s details often appearing on a separate screenshot from their medical history. This gave rise to a risk that the information shared from the NHS App may not relate to the patient requesting the medication.

3.1.35 The NHS England App team was not aware that independent prescribing organisations were using the NHS App as a source of patient information and raised concerns about this practice. The team stated that the App was “not a source of prescriber level information” and referred the investigation to the terms and conditions of the App, which state:

‘If you are sharing information on your NHS App with a healthcare professional, you should make them aware that the information accessible (including any professional reference material) may not show your complete medical records and is intended to support, not replace, the healthcare professional’s knowledge, experience and judgement.’ (NHS England, 2025c)

3.1.36 The investigation also noted that the terms and conditions as written did not give the same impression of risk, and expectations around the use of the App, as was described by the NHS App team.

3.1.37 Representatives from the NHS England App team said that the App was designed to give a current picture, which meant that historical information, while present on the App, was not front and centre. The investigation was also told that some patient information may not be present in the App, such as information on mental health treatment or sexual health.

3.1.38 NHS England told the investigation that such redacted information was potentially relevant when prescribing some medications, for example weight loss medications, and described risks in any independent prescribing organisations relying on information in the NHS App when making prescribing decisions. The NHS England App team also described an instance when reliance on information held in the NHS App had led to a patient safety incident. The example provided to the investigation involved a patient who had received a diagnosis several years ago, but the diagnosis, while present in the NHS App, was not surfaced (presented in such a way that it came to the fore). The patient was prescribed a medication which was contraindicated because of their history.

3.1.39 The Coalition for Responsible Digital Health told the investigation use of the NHS App was in response to ‘the absence of any consistent, scalable route to Summary Care Record (SCR) access for providers without NHS contracts’. They explained it was used cautiously, for example to corroborate patient-reported information, and to support safe prescribing decisions.

3.1.40 The use of the NHS App to help inform prescribing decisions creates a risk as this is not its purpose. National organisations, NHS GPs and independent prescribing organisations were not aware of the limitations of the information within the App and the associated risks of it being used to inform clinical care. The investigation was also informed that the NHS App is used in a similar way in some NHS settings, such as emergency departments, and therefore the learning from this section may be more widely applicable.

HSSIB makes the following safety observation

Barriers to information flow

3.1.41 Staff within NHS England told the investigation that independent prescribing organisations “are of benefit to a struggling and overstretched NHS”. However, from discussions across national organisations, within the NHS and with independent organisations, there were clear lines drawn between NHS and independent care, with a reluctance to align them in terms of access to information.

3.1.42 This was partly due to perceptions that independent organisations were solely money-making operations, setting them apart from the ethos of the NHS providing care that is free at the point of delivery. This created a barrier to willingness to share information, and also to seeing integration of these services as a priority. The investigation found that there were different views within NHS England on this issue and that this could create a barrier to development.

3.1.43 The current burden on the NHS was well recognised by independent prescribing organisations. They felt they could do more to assist with this, and access to NHS records could potentially enable them to prescribe a wider variety of medications.

3.1.44 Staff within NHS England highlighted the need to address the question of “who pays” for the infrastructure and for making access available to independent prescribing organisations. They, and other stakeholders, questioned whether it would be an appropriate use of public funds to enable independent prescribing organisations to increase their business capability.

3.1.45 Some challenges were also raised about the practicalities of independent prescribing organisations accessing NHS patient information, such as where responsibility would sit for ensuring the patient had consented to such transfer of information. Asking patients for consent to share their information across NHS systems, such as the NCRS, is typically part of the process when patients register with a GP surgery. However, some GPs and national organisations explained that sharing information across private organisations was a different matter and processes would need to be carefully developed to ensure patients were giving informed consent for their information to be shared in these circumstances.

3.1.46 In addition to consent various stakeholders highlighted that any changes to NHS medical record access required the development of clearly defined information governance processes to ensure the security and appropriate management of the data in line with regulations. The investigation acknowledges that the governance around such access would be complex.

3.1.47 The investigation identified a disconnect between the acknowledgement of the patient safety impact of restricting information sharing between independent prescribing organisations and the NHS, versus the public policy perspectives.

3.1.48 There was also a perception among several national organisations that the issue of independent prescribing organisations not having access to NHS records was “well known”, with some describing it as “currently being sorted”. These perceptions seem to have led to limited movement on the issue as it was understood “this was in hand”, whereas evidence gathered by the investigation indicated this was not the case.

Information flow developments

3.1.49 During discussions with independent prescribing organisations it was mentioned numerous times that NHS England process pilots had been completed or were ongoing which enabled NCRS access for independent prescribing organisations. Some of the independent prescribing organisations engaged with had asked to be part of these pilots, but at the time of discussions none had been selected to be part of the pilot.

3.1.50 The investigation learned from NHS England that since the COVID-19 pandemic, a number of independent prescribing organisations, both online and “bricks and mortar”, had been enrolled onto pilots which enabled NCRS access. These pilots were described as being developed to create “use cases” for independent prescribing organisations being able to access patient records. NHS England recognised the risks associated with independent prescribing organisations not having such access and said that it was keen to get the “fully private provider access problem sorted”.

3.1.51 NHS England explained that “from a technology point of view, sharing out for us is really easy”, and that the “NCRS is … the safest, most technically easy deployment to [the] independent private sector”. Some NHS England staff said that the main issue, from a technical perspective was the lack of a policy to enable wider roll out. They said that if such a policy was developed, the technical issues could be worked on and were not insurmountable, but would require the relevant governance framework as discussed at 3.1.46 above.

3.1.52 Stakeholders highlighted that using the NCRS as an information source would work better for some patients than others. For example, older patients or those who have chronic conditions are likely to have more up-to-date records because they have more regular contact with NHS services. The investigation acknowledges that access to the NCRS is just one potential solution to this information gap and there may be other options which can be explored.

3.1.53 However, the investigation found no evidence to suggest that, aside from some access through the NHS England pilot, there was any substantive mechanism for information sharing in development. Both regulators and independent prescribing organisations told the investigation this gap needed to be closed so that sufficient information could be provided to enable safer prescribing decisions.

3.1.54 The issue of access to records between providers is not one that impacts just NHS/independent care interactions, but is also a well recognised issue between NHS organisations also.

3.1.55 The Single Patient Record is a project designed to:

‘… provide a single version of the truth across care settings. It will unify patient information from across the NHS, giving both patients and professionals secure access to a single, accurate and up-to-date record – wherever and whenever it’s needed.’ (NHS England n.d.b)

3.1.56 There is no reference to the independent sector as part of this project, and the investigation received differing accounts from NHS England and Department of Health and Social Care staff involved in the project around whether the independent sector was being considered, consulted with or included in this project. None of the independent prescribing organisations engaged with during the investigation were involved in the project.

3.1.57 With the imminent merger of NHS England with the Department of Health and Social Care (DHSC), the following safety recommendation has been directed to DHSC as the future lead organisation.

HSSIB makes the following safety recommendation

3.1.58 National bodies, independent prescribing organisations and regulators described that not having access to NHS information was an issue for all independent healthcare providers, not just online prescribing organisations. In addition, it was highlighted to the investigation that some patient’s may routinely use private healthcare and their “regular healthcare provider” may not be within the NHS, but will similarly “out of loop”. While the in-person nature of interactions with some independent healthcare providers will mitigate some risks, the investigation recognises the findings of this section may be relevant to independent healthcare providers more widely.

Information flow back to the NHS

3.1.59 The investigation heard that the flow of information back into the NHS from independent online prescribers was impacted by a number of factors which could affect whether and/or when records were updated. This created two risk areas: the patient’s records not reflecting current treatment, and a gap in time between treatment and this appearing on the patient’s NHS record. The impact for patients was a temporary or lasting gap in their records, which could lead to them being given a contraindicated treatment because the GP [or clinician] does not have the full picture of their current care'. These two risks are explored below.

3.1.60 The investigation was told by independent prescribing organisations that even where they had NCRS access, this was on a ‘read only’ basis. This meant that if the provider made a diagnosis, started treatment or prescribed medication for a patient, they could not enter the details into the patient’s records. To be able to do this, independent prescribing organisations would need ‘write access’ to the patient’s NHS medical record.

3.1.61 These details would usually be communicated in writing to the GP via letter or email. The information would then need to be received, coded and added to the patient’s record, all by the GP practice. HSSIB has previously carried out observations in GP surgeries as part of work on workforce and patient safety. This identified variability in the length of time it took for information to arrive from other providers; in some cases it was very quick, for example where providers used email. In other cases information took up to several weeks to arrive through the post, and several days to be uploaded. The upload time depended on the capacity of the GP surgery to review incoming information and update the record. This varied between GP surgeries and was impacted by a multitude of factors, including the volume and clarity of information sent to the GP practice. Carrying out these processes required resources within the GP practice, and it was reported that there was variability in the coding of information received, as this was commonly undertaken by non-clinical staff. GPs recognised that there were significant inefficiencies in these processes, which included duplication of information and multiple handovers; the latter has been identified as a factor that increases the risk of errors being made (Sujan et al, 2014).

3.1.62 These issues meant there was an information gap in the period of time between care being provided and patients’ records being updated. This created a risk of patients receiving contraindicated treatment or medications because their records did not yet provide a full clinical picture GPs said this information gap also reduced continuity of care (in terms of informational continuity) as the records did not reflect patients’ current care and treatment.

3.1.63 The same principle applies to secondary NHS care, which has to pass information to the GP in order for it to be included in the patient record, and in turn be available through NCRS. This issue was explored in the investigation ‘Electronic prescribing and medicines administration systems and safe discharge’ (Health Services Safety Investigations Body, 2019) where a delay was noted.

3.1.64 The reason that in both of these scenarios the GP must be involved is because the GP is regarded as the data controller of patients’ NHS records. Data controllers ‘exercise overall control of the personal data being processed and are ultimately in charge of and responsible for the processing’ (Information Commissioner’s Office, n.d.). GPs described a liability issue for them if other healthcare providers were able to add information to a record for which the GP is responsible.

3.1.65 The investigation was told by some independent prescribing organisations that on writing to a patient’s GP, they had received a response indicating that the information about the prescription would not be included on the patient’s record. The reason given was that it was a private prescription and therefore should not form part of the NHS record. It was explained that this was not a common response from NHS GPs, but was another reason why a patient’s record may not reflect their current care and treatment. Stakeholders the investigation engaged with disagreed with this practice on the grounds of patient safety.

3.1.66 Independent prescribing organisations told the investigation that hearing back from GPs about medications they had prescribed was rare. This was because there was no requirement for such communication, as this information exchange was not a closed loop system (which would require confirmation of whether the information had been received and added to the patient’s record). This created uncertainty for some independent prescribing organisations about whether medications they had prescribed were added to a patient’s record.

3.1.67 In addition to these challenges, the investigation learned that patients must give consent for an independent prescribing organisation to contact their GP and pass on information about care provided, including prescriptions made. Independent prescribing organisations and national stakeholders highlighted the importance of patient choice in this space. They noted that many patients were sensitive about some medications which may be prescribed independently, such as those relating to weight loss, and may not want their NHS GP to be informed about them.

3.1.68 Independent prescribing organisations described different regulatory requirements in relation to whether a GP needed to be informed of a prescription, depending on the medication prescribed. Prescriptions for conditions such as hair loss or erectile disfunction were categorised as low risk, and independent prescribing organisations told the investigation that for these sorts of medications, the GPhC allowed patients to opt out of their GP being informed. The independent prescribing organisations explained that often patients would not want their GP to know they had sought such medications, with some organisations stating their data showed that only “5-15%” requested that their GP be informed of such prescriptions.

3.1.69 The GPhC told the investigation that rather than patients being able to opt out of informing their GP about certain prescriptions, independent prescribing organisations are required to carry out risk assessments for the services they provide, to include the method of consultation required where consent to sharing with their GP, or regular prescriber had not been given.

3.1.70 Some GPs raised concerns about consent in these circumstances being simply a “tick box” exercise, and said that patients needed to be informed of the risks associated with not sharing information about their prescriptions with their GP. The investigation reviewed some systems used by independent prescribing organisations to gather patient information and how consent to sharing information with the NHS GP was framed. It was noted that approaches varied, and that while independent prescribing organisations recommended or encouraged sharing with the GP, there was not always an explanation of why to help patients make an informed choice.

3.1.71 Under GPhC guidance, some medications, such as those for long-term conditions like asthma, require the GP to be informed (General Pharmaceutical Council, 2025). Independent prescribing organisations told the investigation that in the case of such medications, consent to contact the GP to inform them of a prescription was a prerequisite for the prescription to be made. Similarly, independent prescribing organisations who provided ADHD services described updating the GP with the outcome once a patient assessment had been completed, as well as providing updates on any treatment commenced.

3.1.72 While most of the independent prescribing organisations the investigation engaged with indicated they would inform the patient’s GP about medications prescribed if the patient consented, others indicated a reliance on the patient informing their GP. Reflecting this, the investigation was told there was variability in whether GPs received information from independent prescribing organisations, including in relation to medications which required notification. Some GPs described learning that a patient was on weight loss medications when they saw the patient in person and noted a significant change in their weight, or when the patient saw the GP because they were experiencing side effects.

3.1.73 It was evident to the investigation that lines of communication between independent prescribing organisations and GPs were not always effective and this caused concern to GPs, independent prescribing organisations and patients. For example, GPs told the investigation that some weight loss medications can interact with other medications, such as contraceptives, and some commonly used anticoagulants and cardiovascular (heart and blood vessel) medications may need to be reduced as a patient’s weight reduces, and therefore such information is vital to safe ongoing care. From the other perspective, independent prescribing organisations told the investigation they had patients who were on weight loss medications whose blood pressure and cholesterol medications needed to be reduced, but these remained at pre-treatment levels despite having informed the GP the patient was on weight loss medication through their usual method.

3.1.74 Patient representative groups told the investigation that patients had concerns about records of private and NHS care being kept separately and how much their GP did or did not know about all the care and treatment they were receiving.

3.1.75 The investigation heard that in the absence of effective sharing of patient data, there was a reliance on GP–patient relationships and the patient themselves to ensure their care was safe.

HSSIB makes the following safety recommendation

3.2.1 Numerous stakeholders described the regulatory landscape of online prescribing as “complex”. It was explained that this complexity gave rise to gaps in regulation as well as differences of approach to assurance. They considered that these gaps and differences in approach created potential safety risks for patients using online prescribing services; these are explored further below.

Regulatory approach

3.2.2 Some healthcare organisations provide both Care Quality Commission (CQC) registerable and non-registerable activities, meaning some parts of a service may be regulated by the CQC and others not. For example, where a service offers an online GP consultation and there is a subsequent prescription and dispensing of medication, only the GP consultation and prescription elements are regulated by the CQC. The dispensing of the medication is within the remit of the General Pharmaceutical Council (GPhC) as the regulator of registered pharmacies, pharmacists, and pharmacy technicians. This means that there are two different routes for regulation at this level for a single organisation.

3.2.3 Not all independent prescribing organisations are required to be CQC registered. For example, pharmacist prescribers providing a prescribing service from a registered pharmacy will be regulated by the GPhC. However, if a service is run only by pharmacist prescribers from somewhere other than a registered pharmacy neither the CQC nor the GPhC currently have powers to regulate the prescribing service.

3.2.4 The CQC told the investigation that while its remit was distinct from the GPhC’s, there were areas where both bodies would be regulating separate parts of the same organisation and exploring similar aspects. Similarly, the GPhC told the investigation that the separate remits of the GPhC and CQC were clear. However, it acknowledged that this clarity mainly existed within the regulators and may not have been clearly communicated to organisations.

3.2.5 Independent prescribing organisations told the investigation that when similar aspects were being reviewed by the two regulators, there was no uniform approach between them, with “a lot of misalignment of expectations between the regulators”. This led to confusion for the independent prescribing organisation. The CQC acknowledged that the level of assurance required between the regulators could be different and that this could cause confusion.

3.2.6 One example shared with the investigation was where an independent prescribing organisation had been told by the GPhC that to comply with GPhC guidance, it needed the CQC parts of the organisation to be assured to the same standards as the GPhC parts. The independent prescribing organisation described this as feeling as though GPhC was regulating CQC elements of the organisation “through the back door”. It was described by another independent prescribing organisation as “overreaching”. Another independent prescribing organisation described needing to provide assurance over and above what was required by one regulator, to fulfil the requirements of the other, regardless of whose remit that part of the business was in. On consultation, the GPhC told the investigation their expectations were clearly stated in their guidance, including when parts of the service are the responsibility of ‘several different pharmacies and staff – or the responsibility of a third party, agent or contractor’ (General Pharmaceutical Council, 2025).

3.2.7 There were also concerns from independent prescribing organisations that restrictions were being placed on all digital providers in response to “black market issues” and that these should be viewed differently to avoid overregulation of legitimate independent prescribing organisations.

3.2.8 Some independent prescribing organisations told the investigation they were aware of some organisations changing their organisational structure so that they came under one regulator rather than the other, because there was a perception that one regulator had a more “pragmatic” view than the other.

3.2.9 The investigation was told that the online prescribing landscape was continually evolving, complex and difficult to provide dynamic regulation for. The investigation was told that because of the ever-evolving business models being used by independent prescribing organisations, some fell outside the remit of either the CQC or GPhC. Some stakeholders indicated this situation could occur through design or by chance, with some business models not fitting neatly within the regulatory framework.

3.2.10 The investigation did not see any evidence that regulatory gaps or overlaps within the scope of this investigation had led directly to patient safety issues. Most of the concerns it heard about regulation related to illicit activities or medications, which are outside of the remit of HSSIB. However, independent prescribing organisations said that they were self-regulating their activities to improve patient safety as described in section 3.4.

3.2.11 Independent prescribing organisations commented that the lack of alignment between regulators did create a potential patient safety risk. This was because it could affect their ability to “operate effectively”, which could potentially drive patients towards using unregulated prescribers if there is instability among regulated independent prescribing organisations. The investigation acknowledges that while there could be efficiency benefits for coordinated regulator visits, and additional clarity around roles and remits may avoid confusion for providers, this did not constitute a significant safety risk.

3.3.1 Data is collected throughout NHS services on many aspects of patient care. This data is used to identify trends, develop policy and improve patient care, as well as adding to the safety profile of specific treatments. The investigation was told by many independent prescribing organisations that they held a significant amount of data on the care and treatment of various patient groups which could be helpful to the NHS for pathway development, commissioning and safety.

3.3.2 They explained that this data went beyond incidents which they submitted to the Medicines and Healthcare products Regulatory Agency through the Yellow Card scheme (Medicines and Healthcare products Regulatory Agency, n.d.). They told the investigation that the data they held “could help demonstrate the safety profile” of medications and also help inform NHS care. For some conditions, such as ADHD and weight loss, independent prescribing organisations maintained that they had significantly more data than the NHS due to the number of patients they provided care for.

3.3.3 One independent prescribing organisation told the investigation they “track data daily on outcomes but there is no ability to share”. An independent prescribing organisation even explained they had built their internal systems using SNOMED, the coding system used by the NHS, meaning the data would be directly applicable to the NHS. Many independent prescribing organisations expressed a wish to share data they held, and described discussions taking place through independent care membership groups about how they could proactively share more information. These discussions were in their infancy but demonstrated a willingness to engage with the NHS; efforts were hindered by the current lack of a mechanism to enable such sharing to occur.

3.3.4 The investigation engaged with NHS England and explored the potential for independent prescribing organisations to feed data into the NHS. The Federated Data Platform team (a project being run by NHS England to support digital systems exchanging information) explained that in order for the Federated Data Platform to be used in this way it would need to be interoperable with all the systems used by independent prescribing organisations, and achieving this would be complex.

3.3.5 The issue of data not being captured from the independent sector means that as use of independent prescribing organisations increases they will hold more patient data which could help to improve and inform services. For example, the Department of Health and Social Care has highlighted that 6.15 million tests and operations were delivered by independent providers in 2025 (Department of Health and Social Care, 2025b). If a mechanism existed to share this data with the NHS it may offer the opportunity to inform and improve patient safety.

HSSIB makes the following safety observation

3.4.1 Some independent prescribing organisations told the investigation that they have restricted the prescribing of some medications because they believe they are too “risky” to prescribe. They said that in many cases they have no way of comprehensively checking a patient’s history or carrying out follow-up checks. They also said that there was a significant reputation and liability risk in prescribing high-risk medicines, and as private businesses many were not prepared to hold this level of risk. For example, some independent prescribing organisations told the investigation that they had previously prescribed medications such as inhalers for asthma, but now only did so on a “one-off” basis. This enabled patients to order a medication in an emergency, but recognised the fact that independent prescribing organisations could not undertake the monitoring required for regular prescription of such medications.

3.4.2 The investigation was told that some of the patient safety risks that exist involving independent prescribing relate to requests for inappropriate medicines. The GPhC guidance states:

‘Use automated systems to warn staff about requests for medicines that are inappropriate. For example, the systems should be able to identify and flag up:

• multiple orders to the same address
• a person using multiple accounts to make orders
• orders that seem to be from different people but are using the same payment details
• inappropriate combinations of medicines
• repeated requests for medicines to manage infection symptoms, or
• requests that are too large or made too often’. (General Pharmaceutical Council, 2025)

3.4.3 The GPhC told the investigation that patients who request medications from multiple providers are at risk of being prescribed too much medication, or contraindicated medications. They said that this is a significant patient safety concern and that the guidance referred to in paragraph 3.4.2 was written to help address this concern.

3.4.4 Independent prescribing organisations told the investigation that they were supported by robust systems which enabled the identification of some of the risks identified above. Examples demonstrated to the investigation included systems which identified repeated requests or inquiries from the same postal address, regardless of whether the same name was provided, and the same payment details being used by different patients.

3.4.5 Independent prescribing organisations also told the investigation of the systems they had developed to gather as much information as possible when patients contacted them through their website. These included specific questions tailored to identify medications or conditions the patient may have which could interact with the treatment they were seeking. Some independent prescribing organisations had invested heavily in these electronic systems, many of which were dynamic, changing subsequent questions depending on the answers provided, and some which alerted the prescriber to answers which had been changed or revisited. The independent prescribing organisations explained that such alerts helped to inform subsequent interactions with the patient to try and understand the reasons for changing answers, and identify any risks associated with this.

3.4.6 However, the Independent Healthcare Provider Network and several independent prescribing organisations told the investigation that an information gap existed between prescribing organisations. An organisation’s internal systems may flag when a particular patient has made multiple requests, but these flags did not go beyond the organisation. This meant that overprescribing by multiple independent prescribing organisations could occur. This issue was identified in a prevention of future deaths report (HM Area Coroner for Greater Manchester North, 2023) where a patient with a history of self-harm and suicide attempts obtained medication from four different online providers. A ‘lack of integrated system or records which could be accessed by multiple pharmacies’ was one of the concerns raised in the report.

3.4.7 Independent prescribing organisations told the investigation that the online prescribing landscape was changing quickly to keep up with technology and demand, so the static regulations in place did not always address emerging patient safety risks. They said that this meant that their organisational tolerance for patient safety risk was influenced by the changing online environment and the level of reputational and liability risk they were prepared to hold. In many cases this meant independent prescribing organisations were taking a less risky approach to prescribing than suggested by guidance; they were self-limiting and regulating based on patient risk factors, limited information flow, fast-changing technology and regulatory landscape, and risk to business. The investigation acknowledges that there are many independent prescribing organisations, and their compliance with guidance and attitude to risk will differ. However, the lack of information sharing and collaborative working between the NHS and independent prescribing organisations are current barriers to safety, which are particularly relevant as patients increasingly choose to access independent prescribing organisations via online routes.

HSSIB makes the following safety recommendation

The investigation engaged with nine independent prescribing organisations, which varied in size and treatment provision. Some were medically led and others were pharmacy led. The investigation explored their methods of gathering patient information to enable them to make decisions about diagnosis, and the prescribing of medication as one potential treatment. The independent prescribing organisations provided details about a variety of sources of information which they used to assist in decision making.

The investigation reviewed multiple sources of evidence to help identify risks that may be posed to patient safety in relation to the prescribing of medications online by providers outside of the NHS. These included:

• national incident reporting systems
• academic literature
• prevention of future death reports
• national and international publications.

The investigation also engaged with a wide range of stakeholders (see below) to learn more about the issues surrounding online prescribing and identify areas on which an investigation could focus to help improve patient safety. From the evidence gathered, the investigation identified two main areas of focus:

• Concerns around the complex regulatory landscape of this sector and the gaps within this which may give rise to patient safety risks.
• Challenges with sharing patient information between the NHS and independent prescribing organisations.

Evidence gathering

Within the independent prescribing organisations it engaged with, the investigation spoke with prescribers and those involved in governance. The investigation also engaged with NHS GPs, who provided insights about their experiences of engaging with independent prescribing organisations.

Analysis of findings

The investigation approach was informed by the Systems Engineering Initiative for Patient Safety (SEIPS) framework. SEIPS provides a human factors framework for understanding the work system (that is, the external environment, organisation, internal environment, tools and technology, tasks, and people), work processes (including physical, cognitive and social/behavioural aspects) and the relationship between these and the resulting outcomes in healthcare (Carayon et al, 2006).

Stakeholder engagement and consultation

The investigation engaged with many stakeholders to gather evidence during the course of the investigation. This also enabled checking for factual accuracy and overall sense-checking. The stakeholders contributed to the development of the safety recommendations based on the evidence gathered. 

6.1.1 The CQC is an arm’s length body of the Department of Health and Social Care and regulates providers who carry out regulated healthcare activities. Specified healthcare professionals are listed within the governing legislation as carrying out regulated activities; these include doctors and nurses ‘and providers prescribing medicines in response to online forms’. (Care Quality Commission, 2021)

6.1.2 Some healthcare organisations provide both CQC registerable and non-registerable activities, meaning some parts of a service may be CQC regulated and others not. For example, where an online GP consultation forms part of the service offered and there is subsequent prescription and dispensing, only the GP consultation element is regulated by the CQC.

6.1.3 Primary care is defined in the NHS as including general practice, community pharmacy, dental, and optometry (eye health) services (NHS England, n.d.a).

6.1.4 The Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 provides an exhaustive list of roles which are recognised as being a healthcare professional, for the purposes of the Regulations. This list does not include pharmacists, who are regulated separately by the General Pharmaceutical Council (GPhC).

6.2.1 The GMC is the professional regulator for doctors, physician associates and anaesthesia associates. It sets standards for patient care and professional behaviours, checks eligibility, provides guidance, investigates concerns and takes regulatory action where required. Registration with the GMC is required for all doctors, physician associates and anaesthesia associates.

6.3.1 The NMC is the professional regulator for nurses and midwives. It sets standards for patient care and professional behaviours, checks eligibility, provides guidance, investigates concerns and takes regulatory action where required. Registration with the NMC is required for all nurses and midwives.

6.4.1 The GPhC is the professional regulator for registered pharmacists and pharmacy technicians, as well as the pharmacy premises regulator. This means that it sets standards, checks eligibility, provides guidance and investigates concerns raised about pharmacists, and regulates providers of pharmacy services.

6.5.1 The MHRA is an arm’s length body of the Department of Health and Social Care and regulates medicines, medical devices and blood components for transfusion in the UK. Medicines must be licenced by the MHRA before they can be prescribed or sold within the UK.

6.6.1 The HCPC is the professional regulator for health and care professionals in the UK. It sets standards for the safe and effective practice of registered professionals, investigates concerns and takes regulatory action when indicated. They regulate 15 professions, including paramedics, physiotherapists and radiographers.