What insurance does a pharmacy actually need?

Is professional indemnity compulsory?

Yes, for every registrant. Article 32 of the Pharmacy Order 2010 says a registrant who practises as a pharmacist or pharmacy technician must have an indemnity arrangement in force. The Order allows three forms: a policy of insurance, an arrangement made for the purpose of indemnifying a person, or a combination of the two. If a registrant has no cover, the Registrar may remove them from the register, or treat the breach as misconduct and refer it for fitness to practise proceedings.

The GPhC's indemnity requirements page turns that into practice. Cover must be appropriate to the nature and extent of the risks of your practice. You confirm on registration and at each renewal that you understand you cannot practise without it. You also undertake to tell the GPhC within seven days if the cover runs out. Without those declarations, the GPhC will not register you.

An employer's policy can satisfy the requirement, but the responsibility stays with the registrant. The GPhC says being covered by an employer's arrangements does not exempt you from having appropriate cover; it may mean you do not need to buy more. If you work for more than one employer, or do locum or self-employed work, you need cover for each part of your practice. For a pharmacy owner, that means two checks. Your business policy must cover every registrant and every service. And each pharmacist and technician on the rota must be able to show they are inside it.

Does the NHS indemnify NHS pharmacy services?

Not for community pharmacy. NHS Resolution runs the Clinical Negligence Scheme for General Practice (CNSGP), which covers clinical negligence liabilities arising on or after 1 April 2019. The scope is set by the NHS (Clinical Negligence Scheme for General Practice) Regulations 2019. Eligible persons are Part 4 contractors under the NHS Act 2006, meaning GP practices holding GMS, PMS or APMS contracts. Their sub-contractors and people providing ancillary health services for them are included. The liabilities covered are those in connection with primary medical services under section 83 of the 2006 Act.

NHS pharmaceutical services sit in Part 7 of the same Act, and the 2019 Regulations do not mention them. A pharmacist employed by a GP practice to deliver primary medical services is covered by CNSGP through the practice. A community pharmacy dispensing NHS prescriptions, delivering Pharmacy First or vaccinating under the CPCF is not. The Pharmacy First service specification of November 2023 says nothing about indemnity at all. Cover for NHS pharmacy services comes from the policy you buy.

Insurers have kept up, but you must check the wording. The National Pharmacy Association says it agreed to indemnify Pharmacy First as part of its standard professional indemnity and legal defence policy, and that its cover extends to vaccinations and prescribing. Other insurers make their own decisions. Ask for written confirmation naming each NHS service you provide, including the hypertension case-finding service, the contraception service and seasonal vaccinations.

Does indemnity cover prescribing and private services?

Only when the policy names the activity, and this is the gap owners find after the event. The GPhC's In practice guidance for pharmacist prescribers, updated in April 2025, is explicit. Prescribers must check they are covered by their professional indemnity insurer for any new or different prescribing role they take on, and must review their cover regularly. Its section on online prescribing says prescribers must assess and manage the risks of their prescribing and make sure they have sufficient indemnity in place. Its section on non-surgical cosmetic products says the same.

Three situations need a specific conversation with the insurer. The first is independent prescribing of any kind, including the NHS prescribing service due to start in autumn 2026 with its £500 set-up and £525 monthly payments. The second is remote consultation and supply, where the GPhC's February 2025 distance-selling guidance sets the standard of care a claim will be judged against. The third is high-risk private services: weight management, hormone therapy, medicinal cannabis and aesthetics. Each carries its own assessment, monitoring and verification duties, and an insurer will want to know they are in your procedures.

If you run a hybrid model, the private half needs its own line in the schedule. Our guide to whether the hybrid clinic is the future of community pharmacy explains why NHS and private records must be labelled separately; your indemnity schedule should follow the same split. If you partner with an online clinic, the clinic's prescribers carry their own cover and the clinic carries its own CQC registration. Your policy still has to cover your dispensing, your verification checks and your delivery, as set out in how online clinics legally work with dispensing pharmacies.

What does employer's liability cover?

Your liability for injury or disease that employees suffer because of their work. Section 1 of the Employers' Liability (Compulsory Insurance) Act 1969 requires every employer carrying on business in Great Britain to insure with an authorised insurer. The cover is against liability for bodily injury or disease sustained by employees, arising out of and in the course of their employment. Regulation 3 of the 1998 Regulations sets the minimum at £5 million for any one occurrence, including costs.

The pharmacy-specific risks are ordinary ones. Needlestick injuries in the vaccination room, back injuries from tote boxes, slips in the dispensary and stress claims after violence at the counter all fall under this policy. Two questions are worth asking. Does the policy treat locums, delivery drivers and apprentices as employees? And does the limit reflect the size of your team? GOV.UK sets £5 million as the legal minimum, not a recommendation, so ask what limit the policy actually carries.

Public, product, premises and stock cover

None of these is required by statute, and none is optional in practice. Public liability covers injury to customers and visitors and damage to their property: a fall on a wet floor, a display that topples, a delivery driver's collision. Your lease will almost always require it.

Product liability matters more in pharmacy than in most retail. Under section 2 of the Consumer Protection Act 1987, liability for a defective product falls on the producer, on anyone who puts their own name on it, and on the importer. A supplier becomes liable too if, when asked, it fails within a reasonable period to identify the producer or its own supplier. So your dispensing records and your invoices are part of your product liability defence. Where you make a product yourself, from an extemporaneous preparation to a repackaged pack under your own label, you are the producer.

Premises and stock cover is the largest single sum most pharmacies insure. Medicines stock is high in value, easy to steal and quick to spoil. Ask for three specific inclusions. The first is deterioration of refrigerated stock after a fridge failure or power cut. The second is theft of controlled drugs and cash, with forcible-entry conditions you can meet. The third is glass and shopfront damage. Business interruption cover pays for lost income and extra costs while you cannot trade. Set the indemnity period against how long a refit would take, not how long you hope it would take. Your business continuity plan says how you would keep dispensing; the policy is how you pay for it.

Do pharmacies need cyber insurance?

No statute requires it, and most small businesses do not hold it, which is exactly the problem. The Department for Science, Innovation and Technology published the Cyber Security Breaches Survey 2025/26 on 30 April 2026. It found 43% of businesses identified a breach or attack in the previous 12 months. Among small businesses the figure was 46%. Only 25% of businesses had a formal incident response plan. Almost half, 47%, had some form of insurance that covered cyber risks, but only 10% held a specific cyber policy.

A pharmacy is a small business holding health records for thousands of people, connected to the NHS Spine, and dependent on a PMR it does not host. The National Cyber Security Centre's guidance describes what a cyber policy typically buys. That means IT forensic services, legal assistance and public relations support after an incident. It also means cover for business interruption, and defence and settlement of third-party claims. The guidance is equally clear about the limits. Cyber insurance "will not prevent a cyber breach/attack", and a policy can be undermined if the security measures you described to the insurer were not in place.

That last point ties the policy to the Data Security and Protection Toolkit. Every pharmacy with access to NHS patient data completes the DSPT each year, declaring controls such as multi-factor authentication, tested backups and staff training. Insurers ask the same questions. Answer the DSPT truthfully and the cyber proposal form answers itself. Our guides to pharmacy cyber resilience after the NHS supplier attacks and completing the DSPT as a small pharmacy cover the controls. This section is only about who pays when they fail.

Does insurance cover a GPhC investigation?

Professional indemnity alone usually does not, and the distinction matters more each year. Indemnity responds to a claim for compensation by a patient. A GPhC fitness to practise investigation is a regulatory process with no claimant, and representation through it is a legal expense. Policies that include a legal defence section, and membership organisations that provide representation, are where that cost is met. Check the wording for the words "regulatory proceedings" and "fitness to practise", and check whether the cover starts at the Investigating Committee stage or only at a hearing.

The GPhC's annual report for 2024/25 shows the scale. Concerns received rose 13% on the previous year, and 93% were closed at initial assessment. The Fitness to Practise Committee held 69 hearings, against 68 the year before. Nineteen registrants were removed from the register, up from 13 in 2023/24, and 22 were suspended. Most registrants who face an investigation are cleared early. The cost of getting there, in legal time and lost work, is the reason to hold the cover. Our analysis of what gets pharmacists struck off in 2026 looks at the conduct behind those numbers.

Three things are never insured: fines, criminal penalties and the consequences of dishonesty. A policy will also usually exclude claims you knew about before you bought it. If a concern has been raised, tell the insurer at once. Late notification is the most common reason a legitimate claim is refused.

How do you put the policy set together?

Start from the services you provide, not from the policy the previous owner held. Write down every NHS and private service, every registrant, every site and every supplier who touches patient data. Then match each line to a policy and a limit. The structure of the business matters too. A company holds the policies, but article 32 binds each registrant personally. Our guide to how a pharmacy business should be structured is worth reading beside this one.

Key takeaways

FAQs