Does an online prescribing clinic need CQC registration?
Yes, if it treats patients through doctors, nurses or other listed professionals in England. Section 10 of the Health and Social Care Act 2008 is blunt. "Any person who carries on a regulated activity without being registered under this Chapter in respect of the carrying on of that activity is guilty of an offence". The regulated activities are listed in Schedule 1 to the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936). Being online changes nothing. The Act asks what the service does and who does it, not where the patient sits.
The activity that catches most online clinics is paragraph 4, "treatment of disease, disorder or injury". It covers "the provision of treatment for a disease, disorder or injury by or under the supervision of a health care professional, or a team which includes a health care professional". Prescribing is treatment. A GMC-registered doctor reviewing a questionnaire and issuing a prescription for finasteride, sildenafil or an antibiotic is carrying on that activity. The company employing or contracting the doctor is the provider that must register. The CQC is England's regulator; Healthcare Improvement Scotland, Healthcare Inspectorate Wales and the RQIA in Northern Ireland play the equivalent role for services based there.
One recent clarification narrows the edge rather than the centre. On 26 March 2026 the CQC updated its scope-of-registration guidance to confirm that a service offering only diagnosis of ADHD or autism, with no treatment, need not register. Our analysis of the scrutiny on online ADHD services covers it. A clinic that prescribes or titrates was in scope before that update and remains in scope after it.
Which regulated activities apply to online clinics?
Usually one, sometimes two, from a list of fourteen. Schedule 1 to the 2014 Regulations sets out fourteen regulated activities, from personal care to family planning. Four are relevant to remote prescribing models, and the table summarises them from the Schedule as in force.
| Regulated activity | What it covers | Online clinic example |
|---|---|---|
| Treatment of disease, disorder or injury (para 4) | Treatment by or under the supervision of a listed health care professional. | Doctor- or nurse-led prescribing for hair loss, erectile dysfunction, ADHD titration, TRT or acne. |
| Services in slimming clinics (para 12) | Advice or treatment by or under a medical practitioner, "including the prescribing of medicines for the purposes of weight reduction". | Doctor-led online weight-loss service prescribing GLP-1 medicines. Excepted from paragraph 4, so registered under this heading. |
| Diagnostic and screening procedures (para 7) | Procedures using X-rays and similar methods, or instruments inserted into the body, plus analysis and reporting of the results. Pin-prick blood sampling and blood pressure checks are excepted. | A clinic running its own imaging or invasive testing. Ordering a venous blood test from a partner laboratory usually does not make the clinic the provider of this activity. |
| Transport services, triage and medical advice provided remotely (para 9) | Urgent medical advice, or triage, "over the telephone or by electronic mail by a body established for that purpose". | NHS 111-type services. A clinic's intake questionnaire is not this activity unless the body exists to provide remote triage. |
The slimming clinic heading deserves attention, because weight loss is where online volume sits. Paragraph 4(3)(d) excepts "services in slimming clinics" from treatment of disease, disorder or injury. Paragraph 12 defines them as advice or treatment "by, or under the supervision of, a medical practitioner". A doctor-led weight-loss service therefore registers under paragraph 12, not paragraph 4. Our guide to the remote prescribing rules for high-risk medicines covers what the prescribers inside these activities must do.
Why do pharmacist-led clinics sit outside the CQC?
Because pharmacists are not on the list. Paragraph 4(4) of Schedule 1 defines "health care professional" for the purposes of treatment of disease, disorder or injury. The list runs: medical practitioner, dental practitioner, five dental care professions, nurse, midwife, biomedical scientist, clinical scientist, operating department practitioner, paramedic and radiographer. Anaesthesia and physician associates were added on 13 December 2024. Pharmacists and pharmacy technicians are absent. Treatment provided by a pharmacist independent prescriber, with no listed professional in the team, is not the regulated activity at all.
Paragraph 12 works the same way for weight loss. It requires a medical practitioner. A pharmacist prescriber issuing GLP-1 prescriptions from a registered pharmacy is not carrying on services in a slimming clinic. That is why a large share of online weight-loss supply in England runs on pharmacist prescribers under the GPhC alone, with no CQC registration and none required. The moment a doctor or nurse joins the prescribing team, or supervises it, paragraph 4 or 12 applies and the whole service must register.
The GPhC has spent 2025 and early 2026 filling that space. Its February 2025 guidance for pharmacies providing services at a distance requires written service-level agreements with any prescribing service. It requires checks that prescribers are "registered with the relevant UK professional regulator", plus risk assessments and appropriate indemnity. Its guidance for pharmacist prescribers, updated April 2025, bars prescribing high-risk medicines from online questionnaires alone. Its updated inspection framework, published 13 January 2026, added guidance on websites and weight-loss services. So a pharmacist-only clinic is not unregulated. It is regulated through the pharmacy and the pharmacist, which is a different inspection with a different evidence base, as our guide to the superintendent's responsibilities online explains.
What does registration involve?
Registering a provider, naming a registered manager and proving the people behind it are fit. The 2014 Regulations set the conditions. Regulation 5 requires directors of a corporate provider to be fit and proper persons. Regulation 7 requires a registered manager where the provider is not itself managing day to day. Regulation 19 requires fit and proper persons to be employed, with recruitment checks. The Care Quality Commission (Registration) Regulations 2009 add two more. Regulation 12 requires a statement of purpose describing the service, its locations and the regulated activities. Regulation 18 requires the CQC to be notified of specified incidents.
Expect the process to test the model, not just the paperwork. For an online clinic the CQC will want to see the consultation pathway and how identity is verified. It will ask how prescribers are recruited and overseen, which medicines are excluded, and how records are kept and shared with GPs. It will ask how the service handles safeguarding when the patient is never in the room. Timing matters too. Dr Penny Dash's October 2024 review of the CQC found that at the end of 2023-24 "54% of applications pending completion were more than 10 weeks old". Build the registration timeline into the launch plan rather than around it.
How does the CQC assess an online clinic?
Against five key questions, through the single assessment framework the CQC rolled out from November 2023. The Dash review describes it as "34 areas of care quality (called 'quality statements')" grouped under safe, effective, caring, responsive and well-led. Each is assessed through "6 'evidence categories': people experience, staff experience, partner experience, observations, processes and outcomes". Ratings run from outstanding to inadequate. Beneath the framework sit the fundamental standards in regulations 9 to 20 of the 2014 Regulations. The CQC's own guidance on meeting the regulations describes them as "the standards below which care must never fall". The table shows where an online prescriber's evidence lands.
| Regulation (2014 Regulations) | Fundamental standard | What an online clinic must evidence |
|---|---|---|
| Regulation 11 | Need for consent. | Informed consent recorded in the consultation, including consent to contact the GP. |
| Regulation 12 | Safe care and treatment. | Identity verification, medicines governance, exclusion criteria, monitoring plans for high-risk medicines. |
| Regulation 13 | Safeguarding service users. | Age and vulnerability checks that work without a face-to-face meeting. |
| Regulation 17 | Good governance. | Prescribing audits, incident logs, complaints analysis, retrievable records. |
| Regulation 18 | Staffing. | Enough prescribers, with supervision and appraisal, for the volume. |
| Regulation 19 | Fit and proper persons employed. | Registration checks, references and DBS checks for every prescriber. |
| Regulation 20 | Duty of candour. | Open disclosure when a remote prescribing decision causes harm. |
The clinical content of "safe" comes from the prescribers' own regulator. Paragraph 61 of the GMC's guidance on good practice in prescribing says a doctor prescribing remotely "must also be satisfied that appropriate safeguards are in place to support safe prescribing". It names identity checks "to make sure medicines are prescribed to the right person" and consent to contact the patient's regular prescriber. It also names "making sure all relevant information about the prescription is shared with the patient's GP or added to the primary care record". A CQC inspector reads a sample of consultations against exactly those points. A record that shows a questionnaire and a prescription, with no identity check and no GP notification, fails regulation 12 and paragraph 61 at the same time.
What is changing from 2026?
The regulator, more than the rules. The Dash review of 15 October 2024 found a CQC that had lost capacity. It carried out "just 6,700 inspections and assessments" in 2023 against "almost 15,800 in 2019", "around 19%" of locations had never been rated, and the average rating was 3.9 years old. It criticised the single assessment framework for vague language and for "insufficient attention paid to the effectiveness of care and a lack of focus on outcomes". Its recommendations included rebuilding expertise and relationships with providers, reviewing the framework "to make it fit for purpose with clear descriptors", and clarifying how ratings are calculated.
Two 2025 documents set the direction of the rebuild. Dr Dash's July 2025 review of patient safety bodies recommended that the government "continue to rebuild the Care Quality Commission with a clear remit and responsibility". It said the CQC should "adopt tailored approaches to assessments by sector and within sectors". The 10 Year Health Plan, published the same month, committed to "reform CQC towards a more data-led regulatory model". It added that "when concerns are identified, CQC will rapidly assemble inspection teams of highly qualified staff to assess service quality in greater detail". The table lists the dated commitments.
| Date | Document | What it changes for online clinics |
|---|---|---|
| November 2023 | Single assessment framework rolled out. | Five key questions, 34 quality statements, six evidence categories, scored assessment. |
| 15 October 2024 | Dash review of the CQC's operational effectiveness. | Seven recommendations, including a review of the framework and clearer ratings. |
| 7 July 2025 | Dash review of patient safety bodies. | Rebuild the CQC; tailor assessment by sector. |
| July 2025 | 10 Year Health Plan for England. | Data-led regulation; rapid inspection teams where concerns are identified. |
| 26 March 2026 | CQC scope-of-registration update. | Diagnosis-only ADHD and autism services need not register; treatment services remain in scope. |
Read together, those commitments mean fewer routine visits and more targeted ones. A data-led regulator finds online clinics through what flows into it: complaints, coroners' reports, GPhC and MHRA referrals, notifications under the 2009 Regulations and press coverage. A clinic prescribing stimulants, opioids or weight-loss injections at volume is exactly the profile a rapid inspection team is built for. Tailored assessment by sector, which the July 2025 review recommended, is likely to bring sharper expectations for remote prescribing than the generic quality statements. Prepare by evidencing outcomes, not just processes: follow-up rates, monitoring completed, and what happened to the patients you declined.
Can a pharmacy and a clinic share one registration?
Only when they are one legal person, and even then the two registrations do different jobs. The CQC registers a provider, which is a company, partnership or individual, for named regulated activities at named locations. The GPhC registers pharmacy premises under the Medicines Act 1968. A pharmacy company that employs doctors to prescribe can register with the CQC for treatment of disease, disorder or injury. Its premises stay on the GPhC register. That is one entity with two registrations, not a shared one.
Where the clinic and the pharmacy are separate companies, which is the dominant structure, each registers with its own regulator and neither can borrow the other's. The GPhC's February 2025 distance-selling guidance requires "clear, written, service-level agreements" between the pharmacy and any third-party prescribing service. It also keeps the pharmacy owner and superintendent "still responsible for providing the pharmacy service safely and effectively even if there are arrangements with a third party". Our guide to how online clinics legally work with dispensing pharmacies sets out the structures and the intercompany agreements.
Before you dispense for any clinic, establish which regulator it answers to and check the register. If doctors or nurses prescribe, ask for the CQC provider ID, the registered activities and the location, and look them up on the CQC's website. If only pharmacist prescribers are involved, there is no CQC entry to find. Your service-level agreement, the prescribers' GPhC annotations and your own audit of their decisions are then the whole assurance. Record what you checked and when. A GPhC inspector will ask.
What happens if an online clinic is unregistered?
It is committing a criminal offence every day it operates. Section 10 of the 2008 Act makes carrying on a regulated activity without registration an offence. On summary conviction the penalty is "a fine, or to imprisonment for a term not exceeding the general limit in a magistrates' court, or to both". On conviction on indictment it is "a fine, or to imprisonment for a term not exceeding 12 months, or to both". The CQC prosecutes, and it can also refuse or cancel registration and impose conditions on providers already on its register.
The pharmacy that dispenses for an unregistered clinic has its own problem. The GPhC's distance-selling guidance is explicit. "Do not work with online providers who avoid, or try to avoid, keeping to the regulatory system put in place within the UK to ensure patient safety throughout the healthcare system". A pharmacy that took prescriptions from a doctor-led clinic with no CQC registration has breached that guidance and its own standards on managing risk. The prescribers face their own regulators too. Our guide to the GPhC's standards for online pharmacies covers what the pharmacy side must show.
- Identify who prescribes: doctors, nurses, other listed professionals, or pharmacists only.
- If a listed professional prescribes or supervises, confirm the clinic's CQC registration, its regulated activities and its registered location.
- For weight-loss services led by a doctor, check the registration covers services in slimming clinics.
- Check every prescriber's registration and prescribing rights with the GMC, NMC or GPhC.
- Hold a written service-level agreement, the clinic's risk assessments and evidence of indemnity, as the GPhC requires.
- Audit a sample of prescriptions for identity checks, GP notification and exclusion of higher-risk medicines from questionnaire-only prescribing.
- Record the checks, date them and repeat them at least yearly or when the clinic changes its model.
Key takeaways
- An online clinic in England must register with the CQC if doctors, nurses or other listed professionals treat or prescribe. Section 10 of the Health and Social Care Act 2008 makes operating unregistered an offence.
- The usual activities are treatment of disease, disorder or injury (paragraph 4 of Schedule 1) and, for doctor-led weight loss, services in slimming clinics (paragraph 12).
- Pharmacists are not "health care professionals" under paragraph 4(4), so pharmacist-only prescribing falls outside the CQC and is regulated through the GPhC.
- The single assessment framework uses five key questions, 34 quality statements and six evidence categories, over the fundamental standards in regulations 9 to 20.
- The Dash review of 15 October 2024 found 6,700 inspections in 2023 against 15,800 in 2019 and 19% of locations never rated; the rebuild points to data-led, sector-tailored, targeted inspection.
- A pharmacy and a clinic share a CQC registration only if they are one legal entity, and the GPhC still requires a written service-level agreement for any third-party prescriber.
- Unregistered operation carries a fine or up to 12 months' imprisonment on indictment, and the GPhC bars pharmacies from working with providers that avoid UK regulation.
Sources and further reading
- Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Schedule 1: regulated activities (legislation.gov.uk)
- Health and Social Care Act 2008, section 10: requirement to register as a service provider (legislation.gov.uk)
- Regulations for service providers and managers (CQC)
- Care Quality Commission
- Review into the operational effectiveness of the Care Quality Commission: full report (Dr Penny Dash, DHSC, 15 October 2024)
- Good practice in prescribing and managing medicines (GMC)
- Guidance for registered pharmacies providing services at a distance (GPhC, February 2025)
FAQs
Evidence the inspector can actually read.
Dataforge PMR keeps the consultation, the prescriber's decision, the identity check and the GP notification in one patient timeline, so a clinic and its pharmacy can show the same record to two regulators. Whatever system you use, make sure the prescribing evidence is retrievable by patient, not by email search.
See Dataforge PMR