What did the GPhC's hub and spoke review actually find?

Why does this review matter?

Regulators seldom disclose in advance what they intend to examine. In October 2025 the GPhC did so. It published a thematic review of hub and spoke dispensing, timed to coincide with the entry into force of the legislation opening the model to pharmacies under separate ownership. The review's stated purpose is to support pharmacies already operating the model and those considering it. Its structure — five themes, each concluding in recommendations — matches what it is in substance: the inspection agenda for a model the regulator expects to grow. The legal framework itself is examined in the companion article. This analysis concerns the evidence, because the underlying data supports firmer conclusions than the summary language conveys.

The regulator's own one-line summary: many pharmacies demonstrated strong practices, particularly in automation and business continuity, while standard operating procedure development, risk assessments, error reporting, responsible pharmacist compliance and training required further improvement. Each element of that is accurate. Each becomes considerably more useful once the underlying figures are examined.

What did fifty-five inspections cover?

The evidence base has three parts. The first is a retrospective review of inspection reports from July 2023 to June 2025. During that period 37 premises were registered as dispensing hubs — 32 in England and five in Scotland — and 27 inspections took place among them. The second is a targeted data capture during August 2025. Inspectors applied a structured questionnaire across 28 sites: 11 hubs and 17 spokes, spanning differing sizes and volumes and both original-pack and compliance-aid models. The third is a facilitated survey of the inspectors assigned to pharmacies known to operate hub and spoke. Fifty-five inspection reports covering both ends of the model inform the review in total. Homecare premises were excluded, having been the subject of a separate themed review earlier in 2025.

Two limitations are worth keeping in mind, and the review is candid about each. The population is small. Cross-entity hubbing became lawful only as the review published, so the pharmacies studied operated same-entity models — groups hubbing within their own estates. Models also vary considerably, from heavily automated original-pack hubs to manual compliance-aid operations, so the findings are necessarily generalised. Neither limitation diminishes the review's value. But both mean the cross-entity arrangements now being put in place will be tested against these findings with far less organisational cohesion holding the two ends together than the studied cohort enjoyed. That is a reason to attend more closely, not less.

What are the headline numbers?

Across the two-year retrospective period, 20 of the 27 hub inspections met the standards — 74 per cent. The review's own comparison: 84 per cent of all premises types inspected in the first quarter of 2025/26 met standards. Hubs were failing at a meaningfully higher rate than pharmacies generally.

The texture of that gap matters as much as its size. Six of the seven failures were newly registered pharmacies. That echoes the regulator's wider finding that newly registered premises meet standards at only 68 per cent. To a substantial degree, the failure profile of hub and spoke is the failure profile of new operations starting before their governance is ready.

The August 2025 capture introduces the asymmetry that recurs throughout the review: 94 per cent of spoke premises met standards against 71 per cent of hubs. Read alongside the theme-level findings below, a consistent picture emerges, and it is this analysis's central observation. The model's weaknesses concentrate at the hub and in the interface between the organisations, while the patient-facing spoke end appears comparatively healthy. For an owner, that inverts the intuitive approach to due diligence. The premises deserving the closest scrutiny is the one patients never see.

Theme 1, what did it find on governance and risk?

Governance is where every historical failure occurred. All seven hubs that failed to meet standards failed against principle 1, and each had inadequate standard operating procedures. The SOPs were variously outdated, generic, missing key processes, unsigned by the teams expected to follow them, or unaccompanied by any record of associated training. Some pharmacies were operating on procedures issued by their PMR supplier that had never been adapted to the model actually in use. Any operator relying on vendor templates should check both the date and the specificity of their own. Readers of our SOP guide will recognise each of these failure modes. Hub and spoke simply adds a second premises in which they may occur.

The risk assessment finding is the review's quietest alarm. In the August capture, 45 per cent of hub teams and 24 per cent of spoke teams were aware of a completed written risk assessment for the arrangement. Even where one existed, most staff present at inspection could not refer to it. A risk assessment nobody can locate is governance in appearance only. The review's recommendation is correspondingly pointed. It requires assessment before operation starts, regular review, and coverage of medicine suitability, removal from original packs, infrastructure reliability, delay risk and data transfer — with the document made available to both teams.

The audit finding follows a similar path. Only 36 per cent of pharmacies audited the model at all — 64 per cent of hubs against 18 per cent of spokes. Several had audited at go-live and then stopped, including one strong example that checked 100 per cent of prescriptions during a new spoke's first week before discontinuing. Assurance that stops once the arrangement starts to feel routine stops precisely when drift begins.

Error culture showed the widest gap between past and present. Historically, six failed hubs had inadequate near-miss documentation, with automation's low error rates functioning, implicitly, as a reason not to record. Sharing of errors between hub and spoke was inconsistent, and hubs were often unaware of incidents altogether. By August 2025, 93 per cent reported sharing dispensing errors across the interface, through channels ranging from established incident systems to messaging. The review acknowledges that as genuine improvement.

Business continuity was a relative strength throughout, with 86 per cent having considered continuity arrangements. Examples included backup generators, redundant connectivity, service contracts, and hubs working ahead of need to build a buffer. The review's caveat deserves emphasis for anyone signing a cross-entity agreement. Reverting work to other branches of your own group is not a continuity plan when the hub belongs to another business. Exit and failure planning must be built for the arms-length position.

Theme 2, what did it find on legal and regulatory compliance?

The responsible pharmacist findings are the review's bluntest. Five hubs in the retrospective period failed responsible pharmacist requirements. Notices were not displayed, records were incomplete or absent, and pharmacists signed in retrospectively. Most tellingly, one hub kept neither notice nor records because the team believed a closed hub required neither. It does. A hub without a public counter remains a registered pharmacy, and the review's first legal recommendation says as much. It requires responsible pharmacist regulations to be applied at all registered premises, including hubs closed to the public, with accurate notices and contemporaneous records. By the August capture every hub inspected displayed a notice — proof of how quickly this resolves once identified.

On data, most pharmacies sent prescription information through integrated PMR systems or secure platforms. The retrospective review still identified premises using shared or default logins installed by an IT supplier and, in one instance, an essentially paper-based flow. Individual restricted logins are the difference between an audit trail and a rota — a point developed at length in our data security briefing. The cross-entity framework raises the stakes further. The legislation creates a statutory information gateway for patient data moving between hub and spoke as separate controllers. Eighty-six per cent of August-capture pharmacies had considered secure sharing. The remaining 14 per cent are one subject access request from learning why it matters.

Indemnity closes the theme with a forward-looking observation. Every premises reviewed held appropriate cover, but all were insured within a single company. The review is explicit that arrangements across different legal entities require insurance to be revisited. Each organisation must understand what is covered when the other errs.

Theme 3, what did it find on operational processes?

Automation is the model's principal strength and its subtlest risk. In the August capture 82 per cent of hubs used automation — robots, barcode and photographic verification, conveyor systems — and the review credits it with low error rates. The documented failure modes occur at automation's edges. Stock held outside the robot went unchecked because teams relied on the robot's expiry housekeeping. One hub failed standards when an inspector found out-of-date items in precisely that blind spot. Expired stock ejected by the system was destroyed without record. Automated labelling covered manufacturer warning text, including on medicines such as sodium valproate, where the warning is the point of the label. The lesson generalises. Automation relocates risk to wherever automation stops, and that is where checking effort should concentrate.

On higher-risk medicines: 73 per cent of hubs dispensed them, with methotrexate, valproate, finasteride and lithium among the examples cited. Most had risk-assessed themselves out of cold chain and Schedule 2 and 3 controlled drugs, leaving those at the spoke. Two findings deserve particular attention. Counselling responsibility for higher-risk items was frequently assumed to rest with the spoke rather than documented anywhere. That is precisely the ambiguity a written arrangement exists to eliminate. And removal of medicines from original packs, principally for compliance aids, improved markedly between the two periods. Earlier inspections identified missing batch numbers and expiry dates on de-blistered stock, undermining recall capability. In the August capture, the 55 per cent of hubs storing medicines outside original packs did so with proper labelling in every case. As to recalls themselves, 91 per cent of operational hubs maintained a process. But the review found compliance with those processes unclear, and three historical hubs could not evidence recall actions at all.

One finding belongs in every written arrangement. Twenty-seven per cent of hubs said they would make changes to the prescription request sent by the spoke. Only 18 per cent of spokes agreed that this occurred. That is a nine-point disagreement between two ends of the same process about who amends what, on the most consequential document in the workflow. The changes themselves were largely benign: expanding abbreviations, flagging unfillable items, offering part-fills. But a model in which the hub believes it edits and the spoke believes it does not is a model awaiting its first serious mismatch. The review recommends a documented change-communication process agreed before go-live. Our clause map gives it a row for the same reason.

Theme 4, what did it find on staffing?

The training figures frame the theme. Eighty-two per cent of hub team members were trained for their duties. All spoke teams — 100 per cent — had received hub-and-spoke-specific training. Yet only 53 per cent of spoke team members knew what automation the hub employed. That final figure is not incidental. The spoke is the premises answering patient questions about where their medicine went and how it was prepared. A counter team that cannot describe the journey cannot deliver the transparency the framework requires.

The strong examples the review records are the obvious remedies: hub staff visiting spokes and the reverse, resource packs distributed weeks before go-live, and training that includes the engineers. The historical failures teach just as much. Two hubs had team members dispensing without the required qualifications, because nobody had realised that stepping in required them. Protected learning time was inconsistent and induction records frequently informal.

Two smaller findings complete the theme. Safeguarding training thinned where patient contact was limited. The review pushes back: tailored safeguarding training belongs at the hub despite limited contact. And 24 per cent of spokes operated incentives — non-financial, framed around freeing time — for moving patients to hub dispensing. The review notes that performance emphasis remained on safety rather than productivity in the pharmacies observed. This deserves monitoring as the model commercialises across entities. An item fee creates sharper incentives than an internal efficiency programme ever did.

Theme 5, what did it find on patient information and experience?

This theme contains the review's most immediately actionable finding. In the August capture, 57 per cent of medicine labels included both hub and spoke details in various formats, and none used hub-only details. Under the cross-entity framework that practice is now incorrect in a specific direction. The legal requirements place the spoke's name and address on labels, together with the date of supply from the hub. The review's recommendation states it plainly: only the spoke address on medicine labels when operating across different legal entities. Every arrangement drafted this year should include a label specimen in the schedule reflecting that position. And every operator migrating a same-entity model across entities should treat relabelling as a go-live task.

The remainder of the theme is steadier. Urgent requests are the model's everyday stress test, and they were well handled. All spokes — 100 per cent — and 91 per cent of hubs maintained procedures for prescriptions already transmitted, mostly electronic recall with barcode safeguards against duplicate supply.

Patient choice was formally healthy and practically thin. Ninety-four per cent of spokes offered an opt-out, yet only 59 per cent actively informed patients. Consent was frequently verbal and undocumented. No pharmacy displayed signage indicating hub dispensing — which the cross-entity notice requirement, applying in the pharmacy and on the website or application of a distance service, now makes mandatory. Service expectations were maturing unevenly. Sixty-four per cent of hubs maintained a dispensing-time SLA, with quoted turnarounds ranging from 24 hours to nine days and certain agreements informal. That range is wide enough that a spoke's patients could be living with a fortnight's repeat cycle their pharmacy never consciously selected.

How does the review convert into a self-audit?

The review concludes each theme with recommendations. An operator should run them in reverse: as questions posed before signing or renewing, with evidence required for each yes.

From governance. Does a written risk assessment exist, dated before go-live, covering medicine suitability, de-blistering, infrastructure and data? Can the person at the bench locate it? Are the procedures specific to this model, current, signed and held at both premises? Does an audit programme exist that survived its first quarter? And is there error reporting with root-cause review that automation has not lulled into disuse?

From legal compliance. Responsible pharmacist notice and contemporaneous records at the hub, whether or not closed to the public. Individual logins. Indemnity confirmed in writing across both entities.

From operations. The higher-risk medicines list with counselling responsibility documented. Expiry checking for stock held outside the automation. Recall actions evidenced rather than described. The prescription-change process agreed and understood identically at both ends.

From staffing. Qualifications verified before anyone steps in, cross-site training in both directions, and safeguarding training at the hub.

From patient experience. Spoke-only labels, the notice displayed and published online, opt-out recorded, complaints routed to the premises able to resolve them, and a service level agreement containing a number.

A prospective hub satisfying that list is ahead of most of the cohort the GPhC inspected. One that objects to being asked has answered a different question. Taken together with our general inspection guide and the written arrangement clause map, this due diligence amounts to the regulator's agenda run in advance.

Key takeaways

FAQs