Remote prescribing of high-risk medicines: consultation, verification and monitoring standards for online clinics

Which medicines count as high-risk for remote prescribing?

More than most services assume, because the February 2025 guidance both restated the established categories and added four. The established list from the earlier guidance: antimicrobials; medicines liable to abuse, overuse or misuse, or where there is a risk of addiction and ongoing monitoring is important; and medicines requiring ongoing monitoring or management. The February 2025 additions: medicines with a higher risk of fatality or serious harm in overdose; medicines requiring a physical examination before a prescribing decision; medicines used for weight management; and black triangle medicines under additional safety monitoring. The GMC's standards, cross-referring to the GPhC's guidance, give working examples of the liable-to-misuse category: opiates, sedatives, laxatives, gabapentinoids, stimulants and nootropics, a list explicitly not exhaustive.

Read that framework against the verticals this series covers and the conclusion is immediate: everything we have written about is inside it. ADHD stimulants are controlled drugs, liable to misuse and monitoring-dependent, three categories at once. Testosterone is a controlled drug requiring ongoing monitoring. Cannabis-based products are Schedule 2 controlled drugs. Weight-management medicines are now named in the guidance by category. And ADHD treatment initiation carries a physical examination requirement under NICE, which the new physical-examination category captures directly. A service in any of these verticals that has not read its pathway against this guidance is running on assumptions the regulator has already superseded.

What does the consultation standard now require?

Two-way communication, a consultation medium adequate to the clinical task, and no prescribing decision for a high-risk medicine based on questionnaire information alone. The February 2025 guidance is specific: for the high-risk categories the prescriber must be able to verify what the patient has told them, through timely two-way communication where both sides can ask questions, through access to the person's clinical records, or by contacting their GP, regular prescriber or a relevant third-party provider.

The GMC's remote prescribing principles supply the medium test that sits underneath: the healthcare professional must be able to carry out an adequate assessment through the chosen medium, and where the assessment the medicine demands cannot be done that way, the medium changes rather than the standard. Applied across the verticals: a physical examination requirement means the pathway builds a physical leg, by in-person provision or verified local arrangement, exactly the point the ADHD sector learned publicly in 2026 as covered in our scrutiny analysis; a diagnosis resting on blood chemistry, as in TRT, means proper sampling and repeat testing rather than a single low-friction result, per the TRT market analysis; and specialist-only categories such as cannabis-based products mean the consultation happens with the specialist the law requires, per the CBPM rules.

One design consequence the guidance makes explicit and websites routinely violate: the service, and any associated company's website, must be arranged so the person has an appropriate consultation before any prescription-only medicine is supplied, which kills the pick-your-medicine-then-answer-questions funnel. A high-risk service's website starts with the condition and the consultation, never with a product page and an add-to-basket button, a rule that conveniently coincides with the advertising prohibition on promoting POMs to the public that every article in this series repeats.

What must be verified, and how?

Three distinct things, each with its own method: who the patient is, whether what they have told the prescriber is true, and what their wider clinical picture holds. Services that treat these as one checkbox fail all three.

Identity. Robust identity checks so medicines are prescribed and supplied to the right person, using secure verification methods proportionate to the risk of the medicine, which for controlled drug services means genuine identity verification at onboarding, not an unchecked name on a form, carried through to the delivery leg's signature-and-identity assurance covered in the CBPM workflow guide.

The information itself. Independent verification of clinically decisive claims, with the guidance's own worked example being weight-management medicines, where the prescriber must independently verify the person's weight, height or body mass index rather than accepting typed numbers whose misstatement is the known abuse pattern. Each vertical has its equivalent decisive datum: cardiovascular history before stimulants, morning bloods behind a testosterone diagnosis, prior treatment history behind a specialist medicinal cannabis prescription, and the pathway should name what it independently verifies and how.

The records picture. The GMC position with teeth: without access to relevant information from the patient's medical records, a doctor must not prescribe controlled drugs or medicines liable to misuse where monitoring matters, with exceptions confined to situations where no prescriber with access is available without unsafe delay, and then only in limited quantity to bridge to proper care. Operationally that makes records access, GP contact with the patient's consent, or a summary care record route a core pathway component for every vertical in this series, and it makes "the patient declined GP contact" a decision point with documented consequences, not a checkbox that waves the prescription through. The guidance also expects services to actively manage the added risk where prescribers sit outside UK regulation, and the cleanest management of that risk remains not building on it.

What does the monitoring duty look like in practice?

Like a designed cadence with records to match, because for monitoring-dependent medicines the prescription and the monitoring are one clinical act split across time, and a service that can evidence the first but not the second has evidenced half a pathway. The components that recur across every well-run vertical: baseline established and recorded before initiation, the review and re-testing cadence defined per medicine and actually driven by recalls rather than patient memory, results recorded against the patient longitudinally so cycle three sits comparably beside cycle one, dose decisions attributed and dated, and a defined response when monitoring is missed, because a patient who stops attending reviews while repeat supplies continue is the exact pattern the framework exists to prevent.

This is also where the two halves of a service meet in practice: prescription duration should track the monitoring cadence, the dispensing side should be able to see that the cadence is alive, and the record architecture should let either half answer "show me this patient's monitoring history" as a query. The systems that make that cheap are the subject of the IT gap article, and the record itself is the substance behind shared care acceptance, inspection answers and, in the worst case, the coroner's questions.

What governance failures has the regulator already named?

The GPhC has published its own casework patterns, and they read as a checklist of what not to be: transactional prescribing with high volumes issued by a prescriber in short periods, prescribing outside the prescriber's scope of practice, inadequate informed consent, high-risk medicines prescribed without safeguards, and services built on overseas prescribers outside UK regulatory oversight. The enforcement was not theoretical: interim orders against pharmacists who worked with online prescribing services, ongoing investigations and disqualification proceedings against pharmacy owners whose governance did not improve.

Invert the list and the governance standard writes itself, and it maps precisely onto the model in the clinic-plus-pharmacy structural guide: prescribing volumes per prescriber monitored and explicable, scope of practice defined and matched to the service, consent that is informed rather than performed, the high-risk safeguards of this guide evidenced per patient, UK-regulated prescribers, prescriber pay decoupled from volume, a declinature rate that proves the assessment is real, and a superintendent whose authority to question, refuse and escalate is contractually untouchable. The February 2025 guidance's move to make the pharmacy owner and superintendent jointly responsible was aimed exactly at structures where commercial pressure could lean on professional judgement, and any service designing itself in 2026 should treat that joint responsibility as the architecture's load-bearing assumption.

How does each vertical map onto the framework?

The table is the series in miniature, and its lesson is the one worth ending on: the verticals differ in their drug law, their economics and their scrutiny timing, but the remote prescribing framework underneath them is one framework, published, current and inspectable. Build the pathway to it once, properly, and every vertical you enter afterwards inherits the discipline.

Key takeaways

FAQs