Pharmacy Appointment Scheduling: Systems That Actually Work
Transform your pharmacy appointment scheduling from chaos to clarity. Learn best practices for booking systems that reduce no-shows…
CQC Compliance Guide
CQC Registration for Online GP Clinics
Everything you need to know about registering an online GP clinic with the Care Quality Commission in England, and exactly how RxSure helps you meet every requirement, pass your first inspection, and maintain ongoing compliance.
67CQC Requirements Mapped
53Addressed by RxSure
14Client Governance
5CQC Key Questions Covered
Last updated: June 2026 · Based on published CQC guidance
Important: This page is an informational guide prepared by RxSure (QASTCO Limited). It does not constitute legal or regulatory advice and does not guarantee CQC registration approval or any particular inspection rating. Registration decisions and inspection ratings are made solely by the Care Quality Commission based on their own assessment. Requirements may change; this guide reflects published CQC guidance current as of June 2026, including the transition from the Single Assessment Framework towards sector-specific frameworks expected in late 2026. We recommend verifying all requirements directly with the CQC and seeking independent legal and regulatory advice.
What Is CQC Registration?
Under the Health and Social Care Act 2008, any person or organisation that carries on a regulated activity in England must be registered with the Care Quality Commission (CQC). Operating without registration is a criminal offence.
Whether your online GP clinic provides remote consultations, prescribing, diagnostic screening, or triage, CQC registration is mandatory. New online providers are typically inspected within 3 months of registration and will receive their initial CQC rating at that inspection.
Critical: CQC's inspection programme found that 86% of online primary care providers initially failed to provide ‘safe’ care. Patient safety, prescribing standards, and identity verification are the areas where online providers most frequently fail. Thorough preparation before registration is essential.
Which Regulated Activities Apply?
An online GP clinic will typically need to register for one or more of these regulated activities.
PRIMARY
Treatment of Disease, Disorder or Injury
Covers all clinical consultations (video, phone, text), prescribing, and ongoing treatment. This is the core regulated activity for any GP service.
MAY BE REQUIRED
Diagnostic & Screening Procedures
Required if you offer diagnostic testing, health screening, pathology, or use medical devices for remote diagnostics.
MAY BE REQUIRED
Transport, Triage & Remote Medical Advice
Applies to services providing clinical triage or medical advice remotely by phone, video, or digital platform.
How CQC Compliance Works
CQC compliance requires three components working together. RxSure provides the first two.
RxSure Clinical Platform
Certified clinical operations infrastructure
- SmPC-guided consultation workflows
- Video consultation + AI transcription
- AI clinical decision support
- Contraindication blocking (hard stops)
- dm+d prescribing + SNOMED CT coding
- Patient portal + ID verification
- Immutable audit trail system
- Compliance dashboard (6 categories)
- Incident management + analytics
- Staff training + CPD tracking
- GP notification system
- GDPR consent module
RxSure Website Service
CQC-guided, client-branded public website
- About Us + CQC registration display
- Our Team (GMC/NMC numbers)
- How It Works (patient journey)
- Service pages per treatment area
- Complaints procedure + CQC escalation
- Privacy Policy (GDPR compliant)
- Terms, Cookie Policy (PECR)
- Contact details + operating hours
- CQC rating widget (Reg 20A)
- Accessibility statement
- Emergency signposting (999/A&E)
Your Governance
Only you can provide this
- CQC Registered Manager
- Nominated Individual
- Qualified GPs / clinicians
- Safeguarding Lead (Level 3)
- Professional indemnity insurance
- DBS checks (CQC-countersigned)
- Statement of Purpose
- Customised policies (we give templates)
- ICO registration
- Physical operational base
The 5 Key CQC Questions
CQC inspectors assess every service against five key questions. RxSure provides evidence for all five.
Safe
Are people protected from abuse and avoidable harm?
Effective
Does care achieve good outcomes and is it evidence-based?
Caring
Are people treated with compassion and dignity?
Responsive
Are services organised to meet people’s needs?
Well-Led
Does leadership assure high-quality care?
Every Requirement, Mapped
Click any category to see CQC requirements and exactly which RxSure feature addresses each one.
Risk assessment processes
Structured risk assessment integrated into every consultation. Automatic red flag identification from patient data. Risk scores logged in audit trail.
PlatformConsultation Engine
Reg 12 — assess risks to health and safety. Systematic risk scoring provides direct evidence for CQC inspectors.
Safe prescribing and medicines management
dm+d formulary with SNOMED CT coding. Automated drug interaction alerts. Hard safety blocks for absolute contraindications, so the prescriber cannot override them. All prescribing decisions audited.
Reg 12 — proper and safe management of medicines. Safety block logs provide direct evidence of systematic medicines safety.
Safeguarding policies and processes
Dedicated incident types for safeguarding concerns. Full lifecycle tracking from reporting to resolution. Automated GP notification letters for escalation. Trend analytics identify patterns.
Platform + YouIncident Management + GP Notifications
Reg 13 — protect from abuse. You appoint a Safeguarding Lead; the platform provides the tracking infrastructure.
Safety incident reporting and learning
Incident types: Near Miss, Medication Error, Patient Safety, Clinical. Severity levels: Low/Medium/High/Critical. Investigation workflow with corrective actions. Trend analytics for learning.
PlatformIncident Management + Analytics
CQC expects evidence of learning from incidents, not just reporting. Full lifecycle provides this systematically.
Staff recruitment and fitness checks
Tracks DBS, GMC/NMC registration, indemnity, training, and right to work for every staff member. Automated expiry alerts at 90, 60, and 30 days. Non-compliant staff automatically blocked from consultations.
PlatformCompliance Dashboard
Reg 18/19 — fit and proper persons. Platform-enforced compliance, not manual checking.
Patient identity verification
Photo ID (passport/driving licence) and proof of address verification at registration. Clinician cannot consult without completed ID check. Video consultation allows live verification for high-risk services.
PlatformID Verification Module
CQC found some providers had no identity checks at all. RxSure enforces this at system level.
Emergency signposting and safety-netting
Website footer: “If you need urgent help, call 999 or attend A&E.” Consultation engine includes safety-netting workflows. RAG triage routes high-risk patients to emergency pathways.
Website + PlatformFooter + RAG Triage Engine
CQC specifically checks online services for emergency signposting and safety-netting protocols.
Evidence-based care pathways
Consultation workflows built from Summary of Product Characteristics (SmPC) data. 50+ pre-built, clinically-validated service templates covering weight management, travel health, sexual health, ear care, vaccinations, and more.
Templates ensure consistent, evidence-based care delivery across all clinicians.
Clinical audit and quality monitoring
5 analytics dashboards tracking consultations, appointments, incidents, training, and compliance. Full audit trail enables clinical audit, with every decision recorded alongside reasoning.
CQC inspectors want to see data-driven quality monitoring, not just policies but evidence of action.
Staff training and competence
Course tracking with completion status. Certificate upload and storage. CPD records management. Mandatory training compliance tracking with analytics.
PlatformTraining & Competency Module
Reg 18 — suitably qualified and competent staff. Training analytics show completion rates and expiring certifications.
Coordinated care and GP notifications
Auto-generated GP notification letters from consultation data. Referral workflows with clinical justification. Delivery tracking (sent/delivered/failed). Ensures patient’s NHS GP is always informed.
PlatformGP Notification System
Critical CQC requirement. Many online services fail here. CQC repeatedly flags providers that don’t inform the patient’s registered GP.
Valid consent obtained and recorded
Multi-layer consent: GDPR consent at registration, clinical consent before consultation, prescribing consent before Rx. All consent timestamped and stored in immutable audit trail.
PlatformGDPR Consent Module
Reg 11 — consent must be obtained before treatment. Clinician cannot proceed without recorded consent.
Comprehensive clinical records
AI-powered real-time transcription captures every consultation. AI clinical summary auto-populates 6 clinical fields. Version history with amendment tracking. All records timestamped and immutable.
Reg 17(2)(c) — accurate, complete, contemporaneous records. AI means no consultation goes undocumented.
Patient involvement in care decisions
Patients have full access to their records, consultation notes, prescriptions, and care plans via the portal. Consultation engine captures patient preferences and goals.
PlatformPatient Portal + Consultation Engine
Shared decision-making is central to CQC’s Caring assessment. The portal empowers patients as active partners.
Privacy and confidentiality
25+ granular permissions ensure staff only access relevant data. All video consultations encrypted. Patient data encrypted at rest (AES-256) and in transit (TLS). UK-based data centres.
PlatformRBAC Module + Encryption
Reg 10 — dignity and respect. Systemic privacy protection, not just policy statements.
Emotional support and face-to-face interaction
Video consultations enable face-to-face interaction, not just text. Secure messaging for ongoing patient-clinician communication. AI clinical summary includes counselling advice documentation.
PlatformVideo Consultation + Secure Messaging
CQC assesses whether online services maintain human connection and emotional support in digital interactions.
Patient feedback mechanisms
5-star rating system with comments and screenshot uploads. Patient support ticket system for raising concerns. Feedback data feeds into analytics for service improvement.
PlatformFeedback System + Support Tickets
Evidence that you listen to patients and act on feedback is essential for a Good or Outstanding rating.
Accessible communication
Mobile-optimised patient portal. Website with accessibility controls and skip links. Multiple communication channels: video, messaging, phone, email.
Website + PlatformPatient Portal + Accessibility Features
CQC checks that digital services are accessible for people with disabilities, limited digital literacy, or language barriers.
Timely access to care
24/7 online appointment booking with auto-confirmation. Walk-in management with queue systems. Three calendar views (month/week/day + list). Real-time availability.
PlatformAppointment Management
Patients can book appointments anytime. Guest booking available without requiring account creation.
Services designed around individual needs
Configurable service pathways per treatment area. Pre-screening questionnaires with conditional logic and scoring. Delivery choice (collection, delivery, digital prescription).
PlatformService Management + Pre-Screening
Each service pathway can be tailored to patient needs, including mandatory video for high-risk services.
Effective complaint handling
Published complaints procedure with CQC escalation information. Patient ticket system tracks complaints from submission to resolution. Incident management for formal investigation. Analytics track complaint trends.
Website + PlatformComplaints Page + Support Tickets
Reg 16 — complaints must be investigated with proportionate action. End-to-end audit trail for every complaint.
Vulnerable and digitally excluded patients
Platform supports video and phone consultations, so patients who cannot use video can consult by phone. Direct phone number on website. Pre-screening can be completed with phone assistance.
Website + PlatformMulti-Channel Access
CQC specifically checks how online providers identify and accommodate digitally excluded patients.
Appointment reminders and follow-up
Automated email/SMS reminders. Colour-coded status indicators. Reschedule and cancel workflows with mandatory reason capture. Follow-up scheduling with instructions.
PlatformAppointment System + Follow-Up Management
Structured follow-up management enables longitudinal care monitoring in an online setting.
Effective governance and oversight
Organisation-wide compliance score at a glance. 6-category compliance tracking. 5 analytics dashboards for data-driven governance. Immutable audit trail for every platform action.
PlatformCompliance Dashboard + Analytics
Reg 17 — systems to assess, monitor and improve quality. This is often the key differentiator between Good and Outstanding.
Risk identification and management
Incident management with severity levels, harm tracking, and trend analytics. Contraindication blocking as active risk mitigation. Overdue action tracking ensures risks are addressed.
PlatformIncident Management + Safety Blocking
Proactive risk management: not just identifying risks, but systematically preventing them.
Quality improvement and learning
Incident trend analytics identify patterns. Consultation analytics track service quality. Investigation workflow from root cause through corrective actions to closure.
PlatformIncident Analytics + Training Module
CQC wants evidence of a learning culture, not just a reporting one.
Policy management and review
Centralised policy library with version control. Automated review date tracking. Staff acknowledgement tracking. Review completion monitoring.
PlatformDocument & Policy Management
Stale policies are a common CQC finding. Automated review tracking prevents this.
Information governance and data security
Role-based access with 5 user roles and 25+ permissions. GDPR compliance with all 6 data subject rights. DSPT “Standards Met”. AES-256 encryption. UK data centres.
PlatformRBAC + GDPR Module + Infrastructure
CQC assesses information governance under Well-led. Platform certifications demonstrate systematic data protection.
Transparency and patient engagement
Patient feedback with ratings and comments. CQC rating displayed on website (Reg 20A). Published complaints procedure. Duty of candour supported by incident management.
Website + PlatformFeedback System + CQC Rating Widget
Reg 20 — duty of candour. Reg 20A — mandatory rating display. Both handled automatically.
Staff management and development
Team overview with role assignments. 25+ granular permissions. Training compliance rates per staff member. CPD record management. Certificate tracking with automated alerts.
PlatformStaff Management + Training Module
CQC expects leadership to have clear oversight of staff competence and development.
Reg 9 — Person-centred care
SmPC-guided workflows capture individual patient history, preferences, allergies. Pre-screening questionnaires collect patient-specific information. Patient portal gives full records access.
PlatformConsultation Engine + Patient Portal
Care must be appropriate, meet needs, and reflect preferences. Audit trail shows individualised care plans per patient.
Reg 10 — Dignity and respect
Private, encrypted video consultations. Secure in-portal messaging. RBAC ensures only authorised staff see patient data.
Platform + WebsiteVideo Consultation + Privacy Policy
Encrypted communications and access controls demonstrate systemic privacy protection.
Reg 11 — Need for consent
Explicit consent collected and recorded at registration, before consultations, and before prescribing. Consent records timestamped and immutable.
PlatformGDPR Consent Module
Clinician cannot proceed without consent recorded. Auditable consent records for every clinical interaction.
Reg 12 — Safe care and treatment
AI clinical decision support. Contraindication blocking. dm+d prescribing with SNOMED CT. Red flag detection. All prescribing decisions audited.
PlatformPrescribing Workflow + AI Decision Support
The most critical regulation for online GP services. Hard safety blocks are the strongest evidence of systematic medicines safety.
Reg 13 — Safeguarding from abuse
Incident management for safeguarding concerns. Consultation flags for vulnerable patients. GP notification for escalation. Full audit trail of actions taken.
Platform + YouIncident Management + Safeguarding Lead
You appoint a Safeguarding Lead and create policies. RxSure provides the tracking and escalation infrastructure.
Reg 15 — Premises and equipment
For online services, “premises” includes the technology platform. UK-based data centres, AES-256 encryption, TLS, 99.9% uptime SLA. Medical imaging integration for remote examination.
Platform + YouPlatform Infrastructure
Platform certifications (DSPT, Cyber Essentials) demonstrate equipment suitability. You must provide a physical operational base.
Reg 16 — Complaints
Dedicated complaints page with CQC escalation. Support ticket system for tracking. Incident management for investigation. Complaint trend analytics.
Website + PlatformComplaints Page + Support Tickets
End-to-end complaint audit trail from submission to resolution and learning.
Reg 17 — Good governance
Audit trails, compliance dashboard, incident management, 5 analytics dashboards, policy management. Every clinical decision logged with timestamps.
Platform + YouAll Governance Modules
RxSure provides the infrastructure; you provide the governance framework and leadership oversight.
Reg 18 — Staffing
Staff management with 25+ granular permissions. Training compliance tracking. Compliance dashboard with automated expiry alerts. Service blocking for non-compliant staff.
Platform + YouStaff Management + Compliance Dashboard
You recruit and deploy staff. The platform ensures no unqualified person can operate.
Reg 19 — Fit and proper persons employed
Platform stores and tracks: GMC/NMC registration, DBS dates, indemnity insurance, revalidation status. Dashboard flags expired documents and blocks staff until resolved.
Platform + YouCompliance Dashboard + Profiles
You conduct recruitment checks. The platform provides systematic ongoing verification.
Reg 20 — Duty of candour
Incident management for notifiable safety incidents. Secure messaging for patient communication. GP notifications. Audit trail documenting when patients were informed.
Platform + YouIncident Management + Secure Messaging
You implement the policy. The platform provides the communication and documentation infrastructure.
Reg 20A — Display of CQC rating
CQC rating badge displayed prominently on website, linked directly to the clinic’s CQC report page. Updated after each inspection.
WebsiteCQC Rating Widget
Legal requirement. Failure to display is a fixed penalty notice offence. Built into every RxSure website.
Reg 14 — Meeting nutritional and hydration needs
Not typically applicable to online GP clinics.
N/ANot applicable
Regulation 14 applies primarily to residential and inpatient services, not remote consultation services.
Reg 17(2)(c) — Accurate, complete records
AI-powered transcription with auto-generated clinical summaries. Immutable audit trail. Version history. All records timestamped.
PlatformAI Transcription + Audit Trail
Contemporaneous records are a fundamental requirement. AI ensures completeness automatically.
Statement of Purpose
Describes services, regulated activities, location, nominated individual, registered manager, and how the service meets fundamental standards.
Template + YouTemplate provided
RxSure provides template pre-populated with platform capabilities. You customise with your specific service description and clinical scope.
Governance & Quality Assurance Policy
Clinical governance framework, quality improvement processes, risk management, peer review.
Template + PlatformTemplate + Governance Modules
Template provided. Platform provides operational evidence: compliance dashboards, incident management, audit trails, analytics.
Safeguarding Policy (Adults & Children)
Must cover Children Act 2004, Care Act 2014, Working Together 2018, Prevent duties. Types of abuse, reporting processes, remote identification.
Template + YouTemplate provided
Template provided. You appoint Safeguarding Lead, complete training, and adapt to local safeguarding board procedures.
Complaints Policy
Clear procedure, timely investigation, response timeframes, learning from complaints, CQC escalation.
Template + Website + PlatformTemplate + Complaints Page + Tickets
Template + website complaints page + platform ticket system. You set response timeframes and named complaints handler.
Consent Policy
Informed consent for remote consultations, including consent to limitations of digital assessment, data processing, and information sharing.
Template + PlatformTemplate + GDPR Consent Module
Platform enforces consent collection, so clinicians cannot proceed without it. Template provided for the written policy.
Medicines Management & Prescribing Policy
SOPs for all prescribing aspects: controlled drugs, repeat prescribing, medication reviews, high-risk medicines, storage, disposal, recording.
Template + PlatformTemplate + Prescribing Workflow
Platform enforces safe prescribing. Template covers the written SOP requirements. All SOPs must have review dates.
Information Governance / Data Protection Policy
UK GDPR compliance, Caldicott principles, data sharing agreements, Subject Access Request procedures, breach notification protocols.
Template + PlatformTemplate + GDPR Module + RBAC
Platform is GDPR compliant with DPIA. DSPT “Standards Met”. All 6 data subject rights built into patient portal.
Clinical Safety Policy (DCB0129/DCB0160)
Clinical risk management throughout the lifecycle of health IT systems. Clinical Safety Officer appointment.
PlatformDCB0129 Certification
RxSure platform is DCB0129 certified. Clinical Safety Officer appointed. Safety case report maintained.
Recruitment Policy
DBS check procedures, professional registration verification, references, identity checks, right to work, induction.
Template + PlatformTemplate + Compliance Dashboard
Platform tracks all fitness documents with automated alerts and service blocking. Template covers written procedures.
Business Continuity Plan
Covers IT failures, loss of connectivity, staff absence, premises unavailability. Disaster recovery for clinical data.
Template + YouTemplate provided
Template covers technology resilience (RxSure: 99.9% uptime, UK data centres, backups). You document staffing and alternative contact.
Duty of Candour Policy
Open and transparent with patients when things go wrong. Statutory requirement to inform, apologise, and provide support.
Template + PlatformTemplate + Incident Management
Platform supports with incident tracking, patient messaging, GP notifications, and audit trail.
Remote Consultation & Prescribing Protocol
Video/phone consultation protocols, remote prescribing guidelines, patient identity verification procedures.
Template + PlatformTemplate + Consultation Engine
Platform provides the infrastructure: video consultation, AI transcription, ID verification, prescribing workflow.
Equality, Diversity & Human Rights Policy
Equality Act 2010 compliance. Reasonable adjustments for disabled service users. Accessibility of digital services.
Template + YouTemplate provided
Platform supports with accessibility features. You customise for your workforce and service delivery model.
Infection Prevention & Control Policy
Required even for online-only services. Covers any physical premises, equipment, and digital security.
Template + YouTemplate provided
For online services, IPC focuses on digital security (platform provides this) and physical operational base.
Clinical system fit for purpose
Purpose-built clinical platform for online healthcare. DCB0129 certified. 50+ service templates. Complete consultation-to-prescription workflow. Used by 50+ UK practitioners.
PlatformRxSure Clinical Platform
Not a repurposed generic system. Built specifically for regulated healthcare delivery.
NHS DSPT compliance
DSPT “Standards Met” status. Covers 10 data security standards across organisational security, personal confidentiality, data quality, and data security.
PlatformDSPT Certification
Mandatory for any organisation processing NHS data or connecting to NHS systems.
Cyber security measures
Cyber Essentials certification. AES-256 encryption at rest. TLS in transit. Two-factor authentication. 25+ permissions. Session management. UK data centres.
PlatformCyber Essentials + Infrastructure
NCSC Cyber Essentials certification demonstrates systematic security, not ad-hoc measures.
UK GDPR and Caldicott compliance
Full UK GDPR compliance with all 6 data subject rights. DPIA completed. Privacy Policy page. Cookie consent banner (PECR).
Platform + WebsiteGDPR Module + Privacy Policy
Data controller details, legal basis, sharing, retention, rights, and ICO information all documented.
AI governance (if applicable)
AI used as support tool, not replacement for human judgement. Clinical Safety Officer oversight. Human review of all AI outputs. AI features clearly labelled “For Practitioner Review Only”.
PlatformAI Clinical Features
CQC Mythbuster 109: responsible AI use requires appropriate human oversight, monitoring, and evaluation.
Website accessibility
Mobile-responsive design. Skip links for screen readers. Semantic HTML. Schema markup. High-contrast colour scheme. WCAG 2.1 guidance.
WebsiteResponsive Design + Accessibility
Equality Act 2010 and WCAG 2.1 requirements for digital service accessibility.
Common CQC Pitfalls & How RxSure Prevents Them
Based on CQC inspection findings for online GP services. These issues most commonly lead to “Inadequate” or “Requires Improvement” ratings.
1. Failure to Share Information with Patient’s NHS GP
CQC repeatedly flags online services that don’t inform the patient’s registered GP about consultations and prescriptions. This is one of the most common failures.
✓ RxSure Fix: GP Notification System auto-generates professional letters from consultation data with delivery tracking. Every consultation can trigger a GP notification, so there is no manual process to forget.
2. Incomplete or Inadequate Clinical Records
Poor record keeping is a consistent CQC finding: incomplete consultation notes, missing clinical reasoning, and lack of contemporaneous documentation.
✓ RxSure Fix: AI Transcription captures every consultation word-for-word. AI Clinical Summary auto-populates 6 clinical fields. All records timestamped and immutable.
3. Lack of Visible and Effective Leadership
CQC identifies this as the most common theme in practices rated “Inadequate”: no clear governance structure, poor oversight, and reactive management.
✓ RxSure Fix: Compliance Dashboard with real-time organisation-wide scores. Analytics Dashboards for data-driven oversight. Incident trend analytics for proactive risk identification.
4. Unsafe Medicines Management
Prescribing without adequate clinical assessment, not checking drug interactions, missing safety checks.
✓ RxSure Fix: Contraindication blocking with hard safety blocks that cannot be overridden. Automated drug interaction alerts. dm+d formulary. SmPC-guided consultation workflows.
5. No or Minimal Patient Identity Checks
CQC found some providers had no identity verification, creating risk of incorrect treatment and drug diversion.
✓ RxSure Fix: Photo ID and proof of address verification mandatory at registration. System blocks consultation without completed ID check. Video verification for high-risk services.
6. Template Policies Not Tailored to the Service
From February 2026, CQC rejects applications with generic, untailored policies. “Copy-paste” governance documents are the fastest route to rejection.
✓ RxSure Fix: Policy templates pre-populated with the platform’s specific capabilities, not generic healthcare templates. Guidance included on what to customise for your service.
Platform Certifications
When you operate on RxSure, your clinic runs on certified infrastructure from day one.
DCB0129
Clinical Risk Management for Health IT Systems
DSPT
NHS Data Security & Protection Toolkit: Standards Met
Cyber Essentials
Government-backed cyber security certification
GDPR / DPIA
UK GDPR compliant with Data Protection Impact Assessment
PCI-DSS
Level 1 payment compliance via Stripe
AES-256
Military-grade encryption at rest. UK data centres.
Your Checklist
RxSure provides the platform, website, and 14 policy templates. These items must come from you as the clinic owner.
Registration blocker
CQC Registered Manager
Named individual registered with CQC. Must pass fit person interview. CQC-countersigned DBS check required.
Registration blocker
Nominated Individual
Senior company figure (director, manager, or secretary) with authority to supervise regulated activity.
Registration blocker
Professional Indemnity Insurance
Must explicitly cover online/remote healthcare delivery. Must be in place before registration.
Registration blocker
Physical Operational Base
An address from which activities are directed. CQC requires this even for online-only services.
Qualified GPs / Clinicians
GMC-registered doctors and/or appropriately qualified clinicians. Professional registration verified on platform.
Safeguarding Lead
Named, trained (Level 3) safeguarding lead for adults and children. Contact details in safeguarding policy.
Customised Policies & SOPs
RxSure provides 14 templates. You customise for your service, staffing, and clinical scope. Generic policies rejected from Feb 2026.
Statement of Purpose
Describes services, regulated activities, and how you meet standards. Template provided. You customise it for your service.
ICO Registration
Data protection registration with Information Commissioner’s Office before processing personal data.
DBS Checks for All Staff
CQC-countersigned DBS for registered manager. Provider-conducted DBS for all other staff. Updated every 3 years.
Financial Viability Statement
Signed by qualified accountant, bank, or FCA-regulated firm demonstrating sufficient resources.
Branding Assets
Logo, colours, fonts for your client-branded website and white-label platform configuration.
Typical Timeline
From first conversation to CQC registration. Here is what to expect.
1
Discovery Call
Week 1We understand your clinic model, services, and goals. You tell us what you want to offer, whether that is GP consultations, specialist referrals, chronic condition management, or other clinical services.
2
Website Build & Platform Configuration
Weeks 2–5We build your CQC-compliant website and configure the platform: service pathways, consultation templates, clinician accounts, branding, and appointment scheduling.
3
Governance & Policy Setup
Weeks 2–5 (parallel)You appoint your Registered Manager and Nominated Individual, arrange DBS checks (4–8 weeks), indemnity insurance, and customise policy templates.
4
Compliance Review
Week 6We walk through every CQC requirement together, covering platform, website, and governance, to make sure nothing is missing before you apply.
5
CQC Application Submission
Week 7You submit via CQC Provider Portal with all supporting documents, fees, and DBS certificates. Incomplete applications are rejected from Feb 2026.
6
CQC Assessment & Fit Person Interview
Weeks 8–18CQC validates, assesses, and interviews the Registered Manager. Processing takes 10–12 weeks once validated. Your live platform demonstrates operational readiness.
7
Registration & First Inspection
Within 3 months of registrationCQC grants registration. You begin operating. First inspection typically within 3 months, and RxSure’s audit trails and compliance dashboards provide ready-made evidence.
Common Questions
Yes, if you provide any regulated healthcare activity in England, including online GP consultations, remote prescribing, or clinical triage, you must be registered with the Care Quality Commission (CQC) under the Health and Social Care Act 2008. Operating without registration is a criminal offence.
The one-off registration fee is £1,522 – £1,867, varying by service type and size. Annual fees for GP services are £509 + (patient list ÷ 1.7545) per location. For example, 5,000 patients is approximately £3,300/year. Fees have remained the same for 7 consecutive years.
The preparation phase (website, platform, governance, DBS checks) typically takes 5–7 weeks with RxSure. CQC processing takes 10–12 weeks once validated. DBS checks add 4–8 weeks. Total from start to registration: typically 14–20 weeks. First inspection is within 3 months of registration.
Yes, a Registered Manager is a statutory requirement. They are responsible for the day-to-day running of the regulated activity, must pass a CQC fit person interview, and must have a CQC-countersigned DBS check. CQC will not process your application without one. In partnerships, one partner is usually the registered manager.
Yes. CQC requires a main office or operational base from which activities are directed. This is the registered location where CQC will conduct inspections. This applies even if all patient-facing services are delivered online.
RxSure addresses 53 of the 67 mapped CQC requirements through our platform and website service, covering clinical workflows, prescribing safety, audit trails, compliance dashboards, incident management, AI transcription, video consultation, and GP notifications. You provide 14 items that only a clinic owner can: Registered Manager, Nominated Individual, qualified clinicians, safeguarding lead, indemnity insurance, DBS checks, customised policies, and the application itself. We provide 14 policy templates to help.
With RxSure, your inspection evidence is being collected continuously from day one. The audit trail, compliance dashboard, incident management, analytics, and policy management provide always-on inspection readiness. When CQC inspects (typically within 3 months), your evidence for Safe (safety blocks, audit trails), Effective (clinical workflows, GP notifications), and Well-led (compliance dashboards, analytics) is already there. No retrospective documentation needed.
It depends on your model. GPhC registration covers pharmacy services (dispensing and supplying medicines). CQC registration is needed if you provide treatment, diagnosis, or clinical consultation services. If your online GP clinic prescribes and treats patients (not just dispenses), you need CQC registration. Many providers need both. Talk to us and we can help you understand which registrations your model requires.
Yes. RxSure holds DCB0129 clinical safety certification, DSPT “Standards Met” status, Cyber Essentials, and PCI-DSS Level 1 compliance via Stripe. These certifications demonstrate that the platform meets NHS-grade clinical safety and data protection standards.
The Single Assessment Framework (SAF) was introduced in March 2024, replacing the former KLOEs with 34 quality statements. As of 2026, following the “Better regulation, better care” consultation, CQC is transitioning to separate, sector-specific assessment frameworks. Final frameworks are expected in summer 2026. The 5 key questions (Safe, Effective, Caring, Responsive, Well-led) remain constant throughout all framework changes.
Compliance
GPhC Registration Guide
Registering as a distance selling pharmacy? See our GPhC compliance guide.
View guide → PlatformFull Feature List
Patient Portal, Prescribing Workflow, Video Consultation, AI, and more.
See features → Online PharmaciesRxSure for Online Pharmacies
See how RxSure is built specifically for online pharmacy operations.
Learn more → PrescribingElectronic Private Prescriptions
Digital prescribing workflow with dm+d formulary and clinical safety checks.
Learn more →
Disclaimer: This page is published by RxSure, a trading name of QASTCO Limited (Company No. registered in England & Wales). The information provided is for general informational purposes only and does not constitute legal, regulatory, or professional advice. While we make every effort to ensure accuracy, we make no warranties or representations about the completeness or reliability of this content. CQC registration decisions and inspection ratings are made solely by the Care Quality Commission based on their own assessment and inspection. Requirements are subject to change. Always verify directly with the CQC. CQC is transitioning to new sector-specific assessment frameworks expected in late 2026, which may affect specific inspection criteria. RxSure is a technology platform provider and does not provide medical services, clinical consultations, or healthcare advice. All regulatory sources referenced in this guide were current as of June 2026.
