Setting up a private prescription workflow from order to dispatch

What does a compliant private prescription workflow look like end to end?

A compliant private prescription workflow moves a patient through eight steps, each generating a record: the pharmacy verifies who the patient is, assesses them clinically, obtains a lawful prescription through a governed prescribing arrangement, validates that prescription against the legal requirements, dispenses with the same clinical rigour as NHS work, records the supply in the POM register, handles payment and communication in a way that survives complaints, and dispatches with the medicine's integrity protected, closing with aftercare. Run properly, the audit trail is a by-product of the chain rather than a separate compliance task.

The design principle behind everything in this guide is that each step should capture structured information at the moment it happens, because the General Pharmaceutical Council's (GPhC) inspection findings concentrate on records that cannot evidence decisions after the fact. The regulator's February 2025 guidance for pharmacies providing services at a distance sets the expectations for online models, and its April 2026 review of weight management services documents the failure points: verification skipped at intake, prescriber assurance missing in the middle, consultation records too thin to show a safe decision and deliveries that ended in warm parcels and bins. The eight steps below are the same chain with each of those links reinforced.

Steps one and two: intake, identity and clinical assessment

The workflow starts with knowing who you are treating, and for distance services the February 2025 guidance makes identity verification a design requirement rather than a preference. The pharmacy needs a documented method for confirming the patient is who they claim to be, appropriate to the risk of the medicine involved, with the evidence captured on the patient record. For weight management specifically, the guidance goes further: the prescriber must independently verify weight, height and body mass index rather than accept self-declared figures, through means such as video consultation or clinical records, and inspectors now ask to see how that verification happened on individual records.

The assessment itself should be structured data from the first click: a clinical questionnaire whose answers land in a consultation record, not a PDF in an inbox. Two design lessons come straight from the GPhC's April 2026 review. First, never display disqualifying criteria to the applicant; the regulator documented questionnaires that showed contraindication lists, effectively coaching people to game their answers, and treated the design itself as a governance failure. Second, build the refusal path properly: safeguarding concerns, eating disorder indicators, pregnancy and age checks all need decline routes that record the refusal and the reason, because a service that cannot evidence who it turned away cannot evidence that its gateway works.

Step three: the prescribing arrangement

Every private supply needs a lawful prescription from a governed prescribing arrangement, and the governance is yours to evidence whichever model you choose. An in-house pharmacist independent prescriber gives the tightest control: the consultation, prescribing decision and rationale all live in your own records, with prescribing scope, monitoring intervals and escalation criteria defined in the service's procedures. A third-party prescribing service is lawful and common, but the GPhC's position is settled: you can outsource prescribing, not assurance. The pharmacy needs a due diligence file on the partner, confirming UK registration of its prescribers, evidence that its clinical governance is real and current and confirmation that it follows UK prescribing guidance, and the regulator has taken enforcement action against pharmacies working with overseas prescribing services without risk assessment.

Whatever the model, each supply needs individual clinical review. The review documented automatic dose titration without a prescriber looking at the patient as a recurring failure, so the workflow must place a named clinician's decision, recorded with its rationale, between every order and every supply, including repeats and dose changes. That decision log is the heart of the audit trail.

Step four: is the prescription legally valid?

Before anything is dispensed, the prescription itself must meet the requirements of the Human Medicines Regulations 2012, and the check takes seconds when it is systematised. A private prescription must carry: the patient's name and address, the patient's age if under 12, the prescriber's signature in indelible ink or an advanced electronic signature, an appropriate date, the particulars indicating the type of prescriber and the prescriber's address. The appropriate date is the later of the signing date or a date the prescriber indicates as the earliest dispensing date, and the prescription is valid for six months from it. For controlled drugs in Schedules 2, 3 and 4, validity is 28 days.

Private prescriptions can be repeatable, which NHS forms cannot. Where a prescription says repeat without a number, it may be dispensed twice in total; an oral contraceptive marked repeat may be dispensed six times; and where a number is stated, that number governs. The first dispensing must fall within the validity window, after which the remaining repeats have no statutory time limit and professional judgement applies. Prescriptions for Schedule 2 and 3 controlled drugs are never repeatable, and private prescriptions for them must be written on the standardised FP10PCD form carrying the prescriber's private prescriber code; a service dispensing them also takes on the full safe custody and controlled drugs register regime, which sits beyond this article's scope but must not be discovered after launch.

Step five: clinical check, dispensing and labelling

Private dispensing carries exactly the same clinical and legal standard as NHS dispensing, and the April 2026 review exists partly because some services behaved otherwise, with wrong-strength supplies causing hospital admission and items despatched without dispensing labels among the documented concerns. The clinical check considers the patient's assessment record alongside the prescription: interactions, contraindications, dose appropriateness and consistency with what the consultation actually found. The dispensing label carries the standard requirements, the patient's name, the product, directions, the date, the pharmacy's details and the keep-out-of-reach warning, and the accuracy check is recorded with the identity of who performed it.

Interventions belong on the record too. Where the pharmacist queries the prescriber, adjusts an owing or declines to supply, the intervention and outcome are captured, because these records are simultaneously the safety mechanism and the proof it operated. Owings on private prescriptions follow the same discipline as NHS ones: the balance must be supplied within the prescription's validity, and the record shows what remains outstanding.

Step six: the records layer

Private supplies generate legal record-keeping duties that NHS dispensing does not, and this is the step most often done badly. Every private prescription supply of a prescription-only medicine must be entered in the POM register, either a bound book or an electronic register, with the entry made on the day of supply or the following day. The entry records the date of supply, the date on the prescription, the name and address of the prescriber, the name and address of the patient, the name, quantity and, where not apparent from the name, the formulation and strength of the medicine, and a reference number linking to the prescription. For repeatable prescriptions, subsequent supplies are recorded with reference to the first entry.

Retention is fixed and short enough to get right: the private prescription itself is retained at the pharmacy for two years from the date of supply, or from the last supply for a repeatable prescription, and the POM register for two years from its final entry. Private prescriptions for Schedule 2 and 3 controlled drugs follow their own route: the original FP10PCD is submitted to the NHS Business Services Authority at month end under the pharmacy's private controlled drugs account code, which the pharmacy must obtain before its first such supply. Alongside the statutory records sits the consultation record, which the February 2025 guidance expects to be detailed enough to demonstrate a safe, clinically appropriate decision on its own, because that is precisely the document an inspector samples.

Step seven: payment, communication and refunds

Payment handling is part of the clinical service's governance, not an administrative afterthought, and the evidence is the September 2025 price shock: when list prices for a leading weight management medicine rose, 78% of two years' worth of pricing complaints to the GPhC arrived within two months, driven by held orders, release fees, substituted doses and refunds that never came. Every one of those began as a business decision under margin pressure and ended as a regulatory concern. The workflow therefore needs order states designed in advance: what happens to a paid order when cost changes, when stock fails, when the prescriber declines, and in each case who tells the patient, by when, and how the refund executes without requiring a chargeback.

The same review found unreachable pharmacies among the most common complaints, so the service needs a staffed clinical query channel with a response standard, separate from marketing contact forms. A patient mid-titration with side effects is a clinical event; if the only route to you is an unmonitored inbox, the workflow has a safety gap the regulator has already named.

Step eight: dispatch and aftercare

The supply is not complete until the medicine reaches the patient in a usable state, and the GPhC received more concerns about deliveries than about dispensing errors. The dispatch step needs its own risk assessment covering packaging, tracking and handover: validated insulated packaging for cold chain lines with transit-time limits, tracked services with signature or safe-place rules appropriate to the medicine, and a documented process for failed deliveries and returns, because the review's catalogue of melted cool packs, parcels in bins and confusion over stability windows is a description of dispatch steps nobody designed.

Aftercare closes the loop. Follow-up appropriate to the medicine, side effect reporting routed to the clinician and onward to the Yellow Card scheme where appropriate, and scheduled reviews before repeats are what distinguish a clinical service from a fulfilment operation, and they generate the final records in the chain: evidence that treatment remained appropriate over time, which the February 2025 guidance expects for exactly the high-risk medicines private services are built on.

Building it so the evidence assembles itself

The difference between a workflow that survives inspection and one that collapses under its first busy month is structural: whether each step writes into one patient journey record or scatters across inboxes, spreadsheets and platform dashboards. The email-and-spreadsheet version fails in predictable ways: assessments arrive as attachments nobody can query, prescriber decisions live in a partner's system you cannot produce on demand, POM register entries queue up for Friday, and the refund log is someone's memory. Every one of those gaps is an April 2026 review finding wearing operational clothes.

Key takeaways

FAQs