Online pharmacy compliance goes beyond GPhC

Evidence reviewed: 28 July 2026. Review due: 26 October 2026.

The short answer to online pharmacy UK compliance requirements is that registration starts the evidence chain; it does not finish it. In Great Britain, the General Pharmaceutical Council (GPhC) regulates registered pharmacies and pharmacy professionals, while its standards make the pharmacy owner responsible for the safe and effective provision of pharmacy services. When a service operates remotely, the GPhC's distance-services guidance explains how those standards apply to the different risks created by providing care online.

An online pharmacy can therefore appear on a register and still have serious weaknesses in patient assessment, risk management or the supply of higher-risk medicines. That is not a theoretical attack on online care. It is the narrower conclusion supported by the GPhC's April 2026 review of weight-management inspections and concerns, which recorded weaknesses in risk assessment, consultation documentation, third-party assurance, independent BMI verification and clinical follow-up.

1. Registration is the start

Three identities can sit behind one website: the business operating the digital service, the professional making a prescribing decision and the pharmacy dispensing and supplying the medicine. They may belong to one organisation or to separate organisations. The GPhC's distance guidance expects arrangements with third-party providers to define responsibilities and information flows, so a reader should not assume that one name or badge identifies every responsible party.

Start by finding the registered pharmacy and the pharmacy professionals through the GPhC's official registers. An entry can establish published registration details. It cannot demonstrate what happened in a particular consultation, whether the prescriber had adequate information, whether a pack followed the correct supply chain or whether an advertisement is lawful.

The service should also make responsibility intelligible. The GPhC guidance says people should know who is responsible for supplying their medicines, have enough information to make an informed decision and be able to raise concerns about service quality. Those expectations turn transparency from a decorative footer into part of safe service design.

2. The five-part online pharmacy compliance framework

The durable framework is already set out in the GPhC's Standards for registered pharmacies. The standards are grouped under five equally important principles, and the detailed standards beneath them are requirements that must be met when operating a registered pharmacy.

1. Governance and risk management. Risks must be identified and managed; service safety and quality must be monitored; roles and accountability must be clear; necessary records must be maintained; information must be protected; and children and vulnerable adults must be safeguarded.
2. Competent and empowered staff. The pharmacy needs enough suitably qualified and skilled staff. Staff must be able to meet professional and legal obligations, use professional judgement and raise concerns. Incentives or targets must not compromise safety or judgement.
3. Safe premises and service environment. Registered and associated premises must be safe and suitable for the services provided, protect privacy and confidentiality, remain secure and provide an environment appropriate for healthcare.
4. Safe and effective services. Pharmacy services must be managed and delivered safely and effectively. Medicines must come from a reputable source, be safe and fit for purpose, be stored securely and be supplied safely.
5. Suitable equipment and facilities. Necessary equipment and facilities must be available, fit for purpose, secure, maintained appropriately and used in a way that protects privacy and dignity.

This is an outcome-based framework, not a single website checklist. A pharmacy owner must apply it to the actual operating model: the medicines offered, the people using the service, the consultation channels, third parties, fulfilment, delivery and aftercare. Displaying a registration number addresses identity; it does not evidence all five principles.

3. Distance changes the evidence needed

Online provision changes how a service obtains and tests information. The GPhC's February 2025 guidance expects a comprehensive risk assessment for each service, medicine and medical device provided at a distance. It covers the whole service, including consultation methods, prescribing and dispensing arrangements, records, data security, business continuity, communication and third-party relationships.

A website questionnaire is one mechanism for collecting information. It is not proof that the assessment is adequate. According to the same guidance, the chosen consultation method should let the professional obtain the information needed for a proper assessment, give the person an opportunity to ask questions, support consent and capacity decisions, preserve confidentiality and allow timely two-way communication where that is needed.

Identity is another risk-based safeguard. For pharmacy and prescription-only medicines, the guidance says staff should carry out an identity check appropriate to the medicine supplied. It also expects systems to identify potentially inappropriate requests, such as repeated orders, multiple accounts, unusually frequent requests or inappropriate medicine combinations.

Continuity matters before and after supply. The guidance tells pharmacy teams to consider access to records, communication with the person's usual prescriber where appropriate and consented, monitoring needs, advice, referral and how people can ask questions or provide feedback. A polished ordering journey without a usable clinical-contact route is therefore incomplete evidence.

4. Prescribing and dispensing are separate

Prescribing is a clinical decision; dispensing and supply are pharmacy functions. The GPhC guidance requires pharmacy owners to assure themselves that associated prescribers follow the remote-consultation, assessment and prescribing guidance issued by the prescriber's regulator. It also says arrangements with prescribing services should be transparent and should not create conflicts such as incentives to issue prescriptions.

For any online prescription service, identify four things:

• The prescriber: who assesses the patient and accepts responsibility for the prescription, and which professional regulator holds their registration.
• The pharmacy: which registered premises dispenses and supplies the medicine.
• The information path: how relevant history, current medicines, records, consent and clinical decisions move between the person, prescriber and pharmacy.
• The continuity path: who handles questions, adverse effects, monitoring, repeat supplies, treatment refusal, discontinuation and complaints.

No single business model applies to every service. The relevant evidence depends on whether prescribing is in-house or commissioned, whether the prescriber is a pharmacist or another registered professional, and how the pharmacy tests the safety of the prescription before supply. The governing point is accountability: a third-party relationship does not erase the pharmacy owner's obligations under the registered-pharmacy standards.

5. Higher-risk medicines need stronger safeguards

The distance-services guidance expressly says some medicines are not suitable to be prescribed through a questionnaire model alone, while others should not be supplied unless extra safeguards are in place. Its examples include medicines liable to misuse, medicines requiring ongoing monitoring, medicines with a higher risk of serious harm in overdose, pregnancy-prevention medicines, medicines requiring physical examination, black-triangle medicines and medicines used for weight management.

Weight management is a useful worked example because the GPhC has published recent primary evidence. Its April 2026 review examined inspection reports and concerns from January 2024 to December 2025. One in twenty inspection reports referenced weight-management medicines or services. Across those inspections, 106 standards were recorded as “not met” or “requiring improvement”.

The review's inspection themes included absent, partial or outdated risk assessments; insufficient assurance over third-party prescribers; weak documentation of consultations and decisions; missing independent weight or BMI verification; and inadequate follow-up. It also recorded 1,307 concerns referencing weight-management services or medicines during the review period. These figures describe one medicine category and one dataset; they should not be generalised to every online pharmacy.

The practical lesson is about evidence, not a prescribed clinical protocol. For this category, the GPhC told prescribers to independently verify medical history, weight and height rather than rely solely on self-reported questionnaires, document consultations and decisions, and review each supply for ongoing appropriateness. Our Enforcement Watch analysis of the GPhC review examines those findings, while the Scientific Digest on online weight-loss prescribing provides research context.

6. Advertising is a separate test

Registration and lawful operation do not make every advertisement compliant. Regulation 284 of the Human Medicines Regulations 2012 says a person may not publish an advertisement likely to lead to the use of a prescription-only medicine, subject to the limited exceptions identified in the regulation.

The pharmacy can communicate the availability of a service, but the naming, imagery, claims, calls to action, prices and surrounding context determine whether the execution promotes a prescription-only medicine. The ASA's official CAP Code medicines section reflects the public-advertising restriction and adds rules for health-related marketing communications. See our separate guide to prescription-only medicine advertising for the enforcement pattern; the legislation and regulator material remain the primary authorities.

7. Illegal seller versus regulated service

These points come from the MHRA's 24 July 2026 public-safety warning on weight-loss medicines. The agency says GLP-1 medicines require a prescription, should not be bought from unregulated websites or social-media sellers and should be obtained from a registered pharmacy. It also states that retatrutide is not authorised for use in the UK.

The warning does not mean registration alone authenticates an individual product or validates a particular consultation. Nor does an unfamiliar website prove illegality. The evidence chain still matters: regulator entry, identifiable prescriber, prescription requirement, supplying pharmacy, appropriate assessment and a traceable supply route.

8. Great Britain is not the whole UK

The territorial distinction is explicit in the GPhC standards. For a pharmacy or pharmacist in Northern Ireland, use the PSNI's official register search, not the GPhC route as a universal UK check. Cross-border websites should make it possible to identify which pharmacy supplies the medicine and which regulator's register applies.

9. Evidence checklist

The checklist is intentionally limited. It helps separate claims and roles; it does not produce a compliance verdict. For pharmacy owners and compliance teams, the deeper task is to retain evidence that the operating system meets the standards in practice: current risk assessments, clear accountabilities, appropriate consultation methods, reliable records, staff competence, supply controls, monitoring, complaints routes and advertising review.

10. Frequently asked questions