The GPhC online pharmacy standards, explained properly

Is there a separate set of GPhC standards for online pharmacies?

No, and the misunderstanding matters. The General Pharmaceutical Council (GPhC) sets one set of standards for registered pharmacies, organised under five principles, and they apply identically to a village dispensary and a national distance selling operation. What online pharmacies have in addition is guidance: the guidance for registered pharmacies providing pharmacy services at a distance, including on the internet, updated in February 2025 in response to concerns about unsafe online prescribing and supply. Guidance is not a second rulebook; it is the regulator's published interpretation of how the existing standards apply to a particular way of working.

The distinction is practical, not academic. At inspection and in enforcement, the guidance is how inspectors read the standards against an online operation: a pharmacy that departs from the guidance will be expected to show how it still meets the standards, and in practice the enforcement record shows departures being evidenced as standards failures. The GPhC wrote to owners, superintendent pharmacists, pharmacists and technicians when the 2025 update landed, asking them to review it and follow it, and its inspectors have been doing exactly that since: the regulator's April 2026 review of weight management services found online pharmacies failing inspections at roughly three times the rate of community premises, with the failures concentrated under principles one and four. So the honest summary of "the online pharmacy standards" is: the same five principles as everyone else, read through a document that tells you precisely what they demand at a distance, with an enforcement programme attached.

The five principles, read through an online lens

The five principles cover governance, staff, premises, services and equipment, and each acquires specific meaning online. The table below is the map; the sections after it take the heaviest areas in turn.

The regulator is not failing online pharmacies on exotic grounds. It is failing them on principle one and principle four, which is worth remembering when deciding where compliance effort goes first.

What must an online pharmacy's website display?

The guidance sets out information that must be prominently displayed on the digital platform, and the list is specific. For the pharmacy: the GPhC registration number, the name of the owner, and the name and physical address of the registered pharmacy or pharmacies that supply the medicines, with relevant phone numbers and email addresses. Where a person is prescribed medicines following an online consultation, the platform must also prominently display the prescriber's name, the address and contact details of the prescribing service, the prescriber's registration number and the country they are registered in, whether the prescriber is a doctor or a non-medical independent prescriber such as a pharmacist or nurse, and information on how to check the registration status of the prescriber and, where regulated, the service. The platform must also have secure facilities for collecting, using and storing users' details and a secure link for processing card details.

Two pieces of context complete the picture for Great Britain in 2026. The GPhC's voluntary internet pharmacy logo scheme closed on 31 December 2025, and the distance selling logo has applied only to Northern Ireland sellers since January 2021, so the GPhC register is now the public's verification anchor, which makes the display list above the entirety of a GB pharmacy's visible trust infrastructure. And as our analysis of why pharmacy websites fail argues, these requirements convert: in a market where the MHRA disrupted more than 1,500 illegal selling sites in a year, a pharmacy that displays its registration prominently and links it to the register is doing marketing and compliance in the same pixels.

The high-risk medicines regime

The centre of the 2025 update is a simple rule with demanding consequences: some medicines must not be prescribed on the basis of an online questionnaire alone. The guidance maintains a list of categories requiring extra safeguards, and the February 2025 update added medicines used for weight management and medicines requiring a physical examination before a prescribing decision, alongside the existing categories such as medicines liable to misuse, medicines requiring ongoing monitoring and other high-risk groups. For these, the prescriber must independently verify the information the person provides before prescribing.

The guidance defines "independently" precisely, and the definition is where services go wrong. Independent verification means the prescriber uses a different route to confirm what the person declared: a video consultation, an in-person assessment, the person's clinical records, or contact with their GP, regular prescriber or a relevant third-party provider. A telephone conversation is not considered adequate, and the GPhC's accompanying FAQs state that photographs and pre-recorded video are not appropriate either, because weight is hard to assess from them and they can be digitally edited, a failure the regulator has since watched play out in an investigation where manipulated images obtained weight loss injections. For weight management specifically, the prescriber must independently verify the person's weight, height and body mass index, and the April 2026 review shows inspectors asking for that verification on individual patient records. The design consequence for any online service is structural: the verification step must be built into the journey, evidenced on the record, and proportionate, since the review also criticised methods that humiliated or excluded patients, such as demanding photographs in tight clothing or rejecting hoist-scale readings from wheelchair users.

Working with third-party prescribers

The guidance permits pharmacies to work with third-party prescribing services and attaches conditions that amount to a due diligence regime. Where a third party is involved, the GPhC expects clear written service-level agreements making the roles and responsibilities of each organisation explicit, ensuring the pharmacy team can contact the relevant people at the prescribing service when needed, and making sure patients know who to contact. Beyond the agreement itself, the pharmacy must consider how the systems will work together, including information flow between organisations, whether the provider is assured and holds risk assessments covering its whole service, how consent is obtained, how follow-up and monitoring will happen, and whether the provider has appropriate indemnity arrangements.

That is the settled principle underneath the checklist, the one our enforcement analysis documented: the pharmacy remains accountable for the supplies it makes, prescribers are expected to follow their own regulator's remote prescribing guidance, and the GPhC has taken statutory action against pharmacies that worked with prescribing services, particularly those based outside the UK, without risk assessment. The practical artefact this demands is a due diligence file per prescribing partner: the agreement, the registration checks, the governance evidence and the review dates, producible on the day an inspector asks.

Consultations, supply and delivery

Principle four's online reading runs from the consultation to the doorstep. On consultations, the guidance expects owners and superintendents to decide the appropriate mode, video, phone or in person, for each service and medicine, with two-way communication available when needed and the questionnaire-only model reserved for medicines where it is genuinely sufficient. On supply, patients must have the opportunity to ask questions and give feedback, which operationally means a staffed clinical query channel rather than an unmonitored inbox, a failure the April 2026 review found generating a quarter of all complaints. And on delivery, safe and effective methods must be in place, which the enforcement record translates into specifics: delivery risk assessments, cold chain integrity, tracking and a process for failed deliveries, since the regulator received more concerns about deliveries than about dispensing errors. The full operational chain, with the record each step should generate, is the subject of our private prescription workflow guide.

Who is responsible for all this?

Since February 2025, pharmacy owners and superintendent pharmacists are jointly responsible for making sure the guidance is followed, a structural change from the previous owner-focused framing and arguably the most consequential sentence in the update. For superintendents, it converts the guidance from something the business should follow into something they personally answer for, at a registrant level, alongside the premises-level enforcement the owner faces. Individual accountability continues underneath: pharmacists remain responsible for the supplies they make, prescribers for their prescribing under General Medical Council or equivalent guidance, and pharmacist independent prescribers for practising within the competency framework, with fitness to practise determinations confirming that working through a platform dilutes none of it.

The self-audit that follows from all of the above is short and worth running quarterly: pick three patient journeys at random and check each one against the list below. That is the inspection, performed by you first.

Key takeaways

FAQs