What the GPhC's hub and spoke review tells you about inspection

Why does this review matter?

Regulators seldom disclose in advance what they intend to examine. In October 2025 the GPhC did so, publishing a thematic review of hub and spoke dispensing timed to coincide with the entry into force of the legislation opening the model to pharmacies under separate ownership. The review's stated purpose is to support pharmacies already operating the model and those considering it, and its structure, comprising five themes each concluding in recommendations, corresponds closely to what it is in substance, namely the inspection agenda for a model the regulator anticipates will grow. The legal framework itself is examined in the companion article, whilst this analysis concerns the evidence, on the basis that the underlying data supports firmer conclusions than the summary language conveys.

The regulator's own one-line characterisation is that many pharmacies demonstrated strong practices, particularly in automation and business continuity, whilst standard operating procedure development, risk assessments, error reporting, responsible pharmacist compliance and training required further improvement. Each element of that is accurate, and each becomes considerably more useful once the underlying figures are examined.

What did fifty-five inspections cover?

The evidence base comprises three parts. The first is a retrospective review of inspection reports from July 2023 to June 2025, during which 37 premises were registered as dispensing hubs, 32 in England and five in Scotland, with 27 inspections taking place among them. The second is a targeted data capture during August 2025, in which inspectors applied a structured questionnaire across 28 sites, comprising 11 hubs and 17 spokes, spanning differing sizes and volumes and both original-pack and compliance-aid models. The third is a facilitated survey of the inspectors assigned to pharmacies known to operate hub and spoke. Fifty-five inspection reports covering both ends of the model inform the review in total. Homecare premises were excluded, having been the subject of a separate themed review earlier in 2025.

Two limitations warrant retention, and the review is candid about each. The population is small, since cross-entity hubbing became lawful only as the review published, with the consequence that the pharmacies studied operated same-entity models, being groups hubbing within their own estates. Models also vary considerably, from heavily automated original-pack hubs to manual compliance-aid operations, such that the findings are necessarily generalised. Neither limitation diminishes the review's value. Both indicate, however, that the cross-entity arrangements now being executed will be tested against these findings with considerably less organisational cohesion holding the two ends together than the studied cohort enjoyed, which is a reason to attend more closely rather than less.

What are the headline numbers?

Across the two-year retrospective period, 20 of the 27 hub inspections met the standards, being 74 per cent. The comparison the review itself offers is that 84 per cent of all premises types inspected in the first quarter of 2025/26 met standards. Hubs were therefore failing at a meaningfully higher rate than pharmacies generally.

The texture of that gap matters as much as its magnitude. Six of the seven failures were newly registered pharmacies, which echoes the regulator's wider finding that newly registered premises meet standards at only 68 per cent. The failure profile of hub and spoke is accordingly, to a substantial degree, the failure profile of new operations commencing before their governance is ready.

The August 2025 capture introduces the asymmetry which recurs throughout the review, in that 94 per cent of spoke premises met standards against 71 per cent of hubs. Read alongside the theme-level findings below, a consistent picture emerges, and it constitutes this analysis's central observation. The model's weaknesses concentrate at the hub and within the interface between the organisations, whilst the patient-facing spoke end appears comparatively healthy. For an owner, that inverts the intuitive approach to due diligence, since the premises warranting the closest scrutiny is the one patients never see.

Theme 1, what did it find on governance and risk?

Governance is where every historical failure occurred. All seven hubs failing to meet standards failed against principle 1, and each had inadequate standard operating procedures, variously outdated, generic, missing key processes, unsigned by the teams expected to follow them, or unaccompanied by any record of associated training. Certain pharmacies were operating on procedures issued by their PMR supplier which had never been adapted to the model actually in use, a finding which should prompt any operator relying on vendor templates to examine both the date and the specificity of their own. Readers of our SOP guide will recognise each of these failure modes, to which hub and spoke simply adds a second premises in which they may occur.

The risk assessment finding constitutes the review's quietest alarm. In the August capture, 45 per cent of hub teams and 24 per cent of spoke teams were aware of a completed written risk assessment for the arrangement, and even where one existed, most personnel present at inspection could not refer to it. A risk assessment which nobody can locate is governance in appearance only, and the review's recommendation is correspondingly pointed, requiring assessment before operation commences, regular review, and coverage of medicine suitability, removal from original packs, infrastructure reliability, delay risk and data transfer, with the document made available to both teams.

The audit finding follows a similar trajectory. Only 36 per cent of pharmacies audited the model at all, comprising 64 per cent of hubs against 18 per cent of spokes, and several had audited at go-live, including one strong example checking 100 per cent of prescriptions during a new spoke's first week, before discontinuing. Assurance which ceases once the arrangement begins to feel routine ceases precisely when drift commences.

Error culture displayed the widest divergence between past and present. Historically, six failed hubs had inadequate near-miss documentation, with automation's low error rates functioning, implicitly, as a reason not to record. Sharing of errors between hub and spoke was inconsistent, and hubs were frequently unaware of incidents altogether. By August 2025, 93 per cent reported sharing dispensing errors across the interface, through channels ranging from established incident systems to messaging, which the review acknowledges as genuine improvement.

Business continuity was a relative strength throughout, encompassing backup generators, redundant connectivity, service contracts, and hubs working ahead of need to establish a buffer, with 86 per cent having considered continuity arrangements. The review's caveat warrants emphasis for anyone executing a cross-entity agreement, namely that reverting work to other branches of one's own group does not constitute a continuity plan where the hub belongs to another business. Exit and failure planning must be constructed for the arms-length position.

Theme 2, what did it find on legal and regulatory compliance?

The responsible pharmacist findings are the review's bluntest. Five hubs in the retrospective period failed responsible pharmacist requirements, with notices not displayed, records incomplete or absent, pharmacists signing in retrospectively, and, most tellingly, one hub maintaining neither notice nor records because the team believed a closed hub required neither. It does. A hub without a public counter remains a registered pharmacy, and the review's first legal recommendation states as much, requiring that responsible pharmacist regulations be applied at all registered premises including hubs closed to the public, with accurate notices and contemporaneous records. By the August capture every hub inspected displayed a notice, which demonstrates how rapidly this resolves once identified.

On data, most pharmacies transmitted prescription information through integrated PMR systems or secure platforms, though the retrospective review identified premises using shared or default logins installed by an IT supplier and, in one instance, an essentially paper-based flow. Individual restricted logins constitute the difference between an audit trail and a rota, a point developed at length in our data security briefing, and the cross-entity framework raises the stakes further, since the legislation creates a statutory information gateway for patient data moving between hub and spoke as separate controllers. Eighty-six per cent of August-capture pharmacies had considered secure sharing, whilst the remaining 14 per cent are one subject access request from establishing why it matters.

Indemnity closes the theme with a forward-looking observation. Every premises reviewed held appropriate cover, but all were insured within a single company, and the review is explicit that arrangements across different legal entities require insurance to be revisited, such that each organisation understands what is covered when the other errs.

Theme 3, what did it find on operational processes?

Automation constitutes the model's principal strength and its subtlest risk. In the August capture 82 per cent of hubs used automation, comprising robots, barcode and photographic verification and conveyor systems, and the review credits it with low error rates. The failure modes documented occur at automation's edges. Stock held outside the robot went unchecked because teams relied upon the robot's expiry housekeeping, with one hub failing standards when an inspector identified out-of-date items in precisely that blind spot. Expired stock ejected by the system was destroyed without record. Automated labelling covered manufacturer warning text, including on medicines such as sodium valproate where the warning constitutes the point of the label. The lesson generalises, in that automation relocates risk to wherever automation stops, which is accordingly where checking effort should concentrate.

On higher-risk medicines, 73 per cent of hubs dispensed them, with methotrexate, valproate, finasteride and lithium among the examples cited, whilst most had risk-assessed themselves out of cold chain and Schedule 2 and 3 controlled drugs, leaving those at the spoke. Two findings warrant particular attention. Counselling responsibility for higher-risk items was frequently assumed to rest with the spoke rather than documented anywhere, which is precisely the ambiguity a written arrangement exists to eliminate. And removal of medicines from original packs, principally for compliance aids, improved markedly between the two periods, in that earlier inspections identified missing batch numbers and expiry dates on de-blistered stock, thereby undermining recall capability, whilst in the August capture the 55 per cent of hubs storing medicines outside original packs did so with proper labelling in every case. As to recalls themselves, 91 per cent of operational hubs maintained a process, though the review found compliance with those processes unclear, and three historical hubs could not evidence recall actions at all.

One finding belongs in every written arrangement. Twenty-seven per cent of hubs stated that they would make changes to the prescription request sent by the spoke, whilst only 18 per cent of spokes concurred that this occurred. That is a nine-point disagreement between two ends of the same process concerning who amends what, on the most consequential document in the workflow. The changes themselves were largely benign, comprising expansion of abbreviations, flagging of unfillable items and offers of part-fills, but a model in which the hub believes it edits and the spoke believes it does not is a model awaiting its first serious mismatch. The review recommends a documented change-communication process agreed before go-live, and our clause map allocates it a row for the same reason.

Theme 4, what did it find on staffing?

The training figures frame the theme. Eighty-two per cent of hub team members were trained for their duties, 100 per cent of spoke teams had received hub-and-spoke-specific training, yet only 53 per cent of spoke team members knew what automation the hub employed. That final figure is not incidental. The spoke is the premises answering patient questions concerning where their medicine went and how it was prepared, and a counter team unable to describe the journey cannot deliver the transparency the framework requires.

The strong examples the review records are the evident remedies, comprising hub staff visiting spokes and the converse, resource packs distributed weeks before go-live, and training which includes the engineers. The historical failures instruct equally, in that two hubs had team members dispensing without the required qualifications because nobody had appreciated that stepping in required them, whilst protected learning time was inconsistent and induction records frequently informal.

Two smaller findings complete the theme. Safeguarding training thinned where patient contact was limited, and the review pushes back, holding that tailored safeguarding training belongs at the hub notwithstanding limited contact. And 24 per cent of spokes operated incentives, non-financial and framed around freeing time, for moving patients to hub dispensing, with the review noting that performance emphasis remained on safety rather than productivity in the pharmacies observed. This warrants monitoring as the model commercialises across entities, since an item fee creates sharper incentives than an internal efficiency programme ever did.

Theme 5, what did it find on patient information and experience?

This theme contains the review's most immediately actionable finding. In the August capture, 57 per cent of medicine labels included both hub and spoke details in various formats, and none used hub-only details. Under the cross-entity framework that practice is now incorrect in a specific direction, since the legal requirements place the spoke's name and address on labels together with the date of supply from the hub. The review's recommendation states it plainly, requiring only the spoke address on medicine labels when operating across different legal entities. Every arrangement drafted this year should accordingly include a label specimen in the schedule reflecting that position, and every operator migrating a same-entity model across entities should treat relabelling as a go-live task.

The remainder of the theme is steadier. Urgent requests, being the model's everyday stress test, were well handled, with 100 per cent of spokes and 91 per cent of hubs maintaining procedures for prescriptions already transmitted, mostly comprising electronic recall with barcode safeguards against duplicate supply.

Patient choice was formally healthy and practically thin. Ninety-four per cent of spokes offered an opt-out, yet only 59 per cent actively informed patients, consent was frequently verbal and undocumented, and no pharmacy displayed signage indicating hub dispensing, which the cross-entity notice requirement, applying in the pharmacy and on the website or application of a distance service, now renders mandatory. Service expectations were maturing unevenly, in that 64 per cent of hubs maintained a dispensing-time SLA, with quoted turnarounds ranging from 24 hours to nine days and certain agreements informal, a range sufficiently wide that a spoke's patients could be living with a fortnight's repeat cycle which their pharmacy never consciously selected.

How does the review convert into a self-audit?

The review concludes each theme with recommendations, which an operator should run in reverse, as questions posed before signing or renewing, with evidence required for each affirmative answer.

From governance. Does a written risk assessment exist, dated before go-live, covering medicine suitability, de-blistering, infrastructure and data, and can the person at the bench locate it? Are the procedures specific to this model, current, signed and held at both premises? Does an audit programme exist which survived its first quarter, alongside error reporting with root-cause review which automation has not lulled into abeyance?

From legal compliance. Responsible pharmacist notice and contemporaneous records at the hub, whether or not closed to the public. Individual logins. Indemnity confirmed in writing across both entities.

From operations. The higher-risk medicines list with counselling responsibility documented. Expiry checking for stock held outside the automation. Recall actions evidenced rather than described. The prescription-change process agreed and understood identically at both ends.

From staffing. Qualifications verified before anyone steps in, cross-site training in both directions, and safeguarding training at the hub.

From patient experience. Spoke-only labels, the notice displayed and published online, opt-out recorded, complaints routed to the premises able to resolve them, and a service level agreement containing a number.

A prospective hub satisfying that list is ahead of most of the cohort the GPhC inspected, whilst one which objects to being asked has answered a different question. Taken together with our general inspection guide and the written arrangement clause map, this due diligence amounts to the regulator's agenda conducted in advance.

Key takeaways

FAQs