Sample policy · GP

GP safe prescribing and high-risk medicines policy template

Statutory anchor: Regulation 12 (safe care and treatment), Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936), in particular the proper and safe management of medicines. This policy also engages Regulation 17 (good governance) and Regulation 20 (duty of candour). The wider medicines and controlled-drugs framework is set by the Human Medicines Regulations 2012, the Misuse of Drugs Regulations 2001 and the Controlled Drugs (Supervision of Management and Use) Regulations 2013. · primary source

1. What the regulation says

Care and treatment must be provided in a safe way for service users. (Reg 12(1) (the headline duty))

where equipment or medicines are supplied by the service provider, ensuring that there are sufficient quantities of these to ensure the safety of service users and to meet their needs, (Reg 12(2)(f) (sufficient equipment + medicines supply))

the proper and safe management of medicines, (Reg 12(2)(g) (medicines management))

where responsibility for the care and treatment of service users is shared with, or transferred to, other persons, working with such other persons, service users and other appropriate persons to ensure that timely care planning takes place to ensure the health, safety and welfare of the service users. (Reg 12(2)(i) (shared / transferred responsibility))

The full text of the regulation is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/12. Where this policy and the regulation diverge, the regulation wins.

2. Plain-English summary

Care and treatment must be provided in a safe way. The regulation lists the areas a provider must address, including risk assessment, risk mitigation, staff competence, safe premises, safe equipment, sufficient equipment and medicines, medicines safety, infection prevention and shared-care planning. Regulation 12 is central to CQC's safety expectations.

3. Purpose

This policy sets out how the Practice prescribes safely, monitors high-risk medicines, reviews repeat prescribing and responds to prescribing errors or controlled-drug discrepancies.

It applies to private GP and NHS-contracted prescribing activity.

This is the GP and primary-care policy page for prescribing and monitoring. For a broader cross-sector starting point, use the CQC medication policy template. For the 2025 CQC controlled-drugs report angle, read CQC controlled drugs 2025: evidence for providers. For the matching audit tool, use the primary care prescribing and medicines audit checklist.

4. Sources to verify before adoption

5. Scope

This policy applies to:

The Practice verifies each prescriber's professional scope and system access before they prescribe.

Before adoption, the Practice names its medicines lead, high-risk medicine list, monitoring protocols, urgent clinical route, shared-care acceptance route, prescribing systems, external reporting contacts and records locations. It records who may authorise, change and remove each level of prescribing-system access.

6. Prescribing process

The Practice follows a documented prescribing process for every prescription.

6.1 Patient and medicine check

Before issuing a prescription, the prescriber checks:

The prescriber records the clinical reason where the record does not already make it clear.

6.2 Repeat prescribing

The Practice keeps a repeat-prescribing protocol.

The protocol covers:

Staff do not issue a repeat prescription where the review status, monitoring status or prescriber instruction makes it unsafe to do so.

6.3 Acute and urgent prescribing

The prescriber records why acute or urgent prescribing is needed.

Where prescribing happens without full routine information, the prescriber records:

The Practice does not use urgent prescribing to bypass monitoring requirements for convenience.

6.4 Prescribing error response

Where staff identify wrong drug, wrong dose, contraindicated drug, allergy conflict or repeat prescription issued without review, staff:

The Practice reviews prescribing errors through the SEA process.

7. High-risk drug monitoring

The Practice keeps a high-risk drug register.

The register includes medicines or medicine groups that need defined monitoring, such as:

For each medicine group, the local protocol records:

The Practice sets exact monitoring schedules from current prescribing guidance, shared-care agreements, specialist advice and GMC source material. This template does not restate medicine-specific monitoring intervals.

8. Controlled drugs and prescribing review

The Practice treats controlled-drug prescribing discrepancies as high-risk incidents.

Where staff identify a discrepancy, the Clinical Lead:

The Practice reviews prescribing data at least quarterly as a Verivius default from the GP sector pack. The review covers controlled drugs, antibiotics, opioids, high-risk medicines and repeat prescribing without review.

9. Responsibilities

10. Training, competence and system access

Training, registration, scope, access approval, review and reassessment must be recorded in the training matrix and staff access-control record.

11. Records and evidence fields

For each prescription or high-risk monitoring decision, the clinical or governance record includes, as applicable:

The high-risk drug register, prescribing-review minutes, staff competence and access records, audit findings and improvement actions form the wider evidence set. Records are cross-linked rather than copied where possible and are retained under the Practice's records-management procedure.

12. Audit cadence

The Practice uses the following Verivius default audit rhythm unless current source material requires more frequent review:

Audit findings are recorded as improvement actions with an owner and review date.

13. Version control and review date

The Practice keeps a controlled copy of this policy. The footer or document-control table records:

14. Related records

Review cadence: annual or on regulatory change, whichever sooner. Owner: Registered Manager.

15. Related reading

16. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

17. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

18. Document control

Version Date Author Changes
v1 2026-06-10 Verivius (sample) Conformed to the Verivius policy standard; statutory anchor, verbatim regulation text, plain-English summary, sources and document control added. Original operational sections preserved.
v1.1 2026-07-19 Verivius (sample) Added prescriber competence and access controls, local adoption decisions, shared-care acceptance evidence and a complete prescription and monitoring record set.

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the provider's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

What good looks like here

Written from an ex-CQC inspector's chair, but the point is safe, well-led care your team can stand behind. Each row shows what strong evidence looks like, what thin evidence looks like, and where the expectation comes from.

High-risk medicines in general practice do their damage silently. A patient on methotrexate, lithium or amiodarone usually feels perfectly well while marrow suppression, lithium toxicity or thyroid and liver derangement builds in the background, which is precisely why the blood result, not the consultation, is the safety net. Repeat prescribing is designed to be frictionless so that people with long-term conditions are not pushed back through the front door every month, and that same frictionlessness is what lets an overdue monitoring result become invisible: reception processes the request, the system reauthorises, and nobody is ever made to stop. The high-risk drug register and its prescribing-stop rule are the one place a practice deliberately puts the friction back, with the monitoring test and interval taken from current prescribing guidance and the shared-care agreement rather than from a template. A stop rule that never once bites is not a well-run register, it is an unread one. Getting this right means the patient hears from the practice before harm arrives rather than after, and the practice can say with evidence which of its patients are safe on their medicines today.

  1. The high-risk drug register defines, for each medicine, the monitoring test, the staff role responsible for checking status and the prescribing-stop or escalation rule when monitoring is missing, and that rule actually bites. The harm sits in methotrexate, lithium, warfarin, a disease-modifying anti-rheumatic drug or amiodarone still being issued while the required monitoring bloods are overdue.

    Strong evidence: The high-risk drug register (monitoring test required, source of the requirement, responsible staff role, prescribing stop or escalation rule where monitoring is missing) and the monthly check of overdue high-risk monitoring (sections 7 and 12).

    Weak evidence: The register is a list of drug names with a tick beside each one: no named monitoring test, no source for the requirement, no responsible staff role and no prescribing-stop rule, or a monitoring column filled in as "per shared care" without saying which test, from which shared-care agreement, or how recent a result has to be before a further issue is allowed. The give-away is a stop rule that exists on paper while a search shows methotrexate, lithium or amiodarone issued twice more since the last blood result, and the Practice's own monthly overdue-monitoring check appearing as a recurring diary entry with no findings, no owner and no action recorded against it.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  2. Repeats are held when a review or monitoring is overdue rather than issued automatically on protocol. The risk to the patient is a repeat prescription issued without review because reception processed it as routine, against the rule that staff do not issue where review, monitoring or prescriber instruction makes it unsafe.

    Strong evidence: The repeat-prescribing protocol (maximum issues before review, overdue-review escalation) and the review outcome, stop or escalation decision recorded per prescription (sections 6.2 and 11), tested in the quarterly review of repeat prescribing without review (section 8).

    Weak evidence: The repeat-prescribing protocol names no maximum number of issues before review, so review dates drift and the system reauthorises quietly. Records show batches of repeats approved in a single sitting, rejected or held requests leaving no trace at all, and the prescription record showing only that the script was issued, with no review outcome, stop decision or escalation to a prescriber written down. Weakest of all is a practice where reception can describe the clinical escalation route in conversation but no request has ever been logged as held.

    The recognised standard from a professional or clinical body, such as NICE or a royal college. Not a legal duty, but the accepted mark of safe practice, and a departure needs a documented reason.

  3. A prescribing error (wrong drug or dose, contraindicated drug, allergy conflict, or a repeat issued without review) is recorded as an incident, run through significant event analysis (SEA), and duty of candour considered, with the duty owed to the patient discharged where the harm meets the defined Regulation 20 threshold. What costs the patient is an error corrected quietly, with no incident record and candour never considered.

    Strong evidence: The incident record and SEA meeting minutes, the immediate safety action and preserved prescribing and communication records, and the duty-of-candour consideration held in the record (section 6.4 and records and evidence fields, section 11).

    Weak evidence: The error appears as one line in a near-miss spreadsheet, "wrong dose, corrected, no harm", with no incident record, no significant event analysis (SEA) minutes and no immediate safety action described. The duty-of-candour field is blank or marked not applicable with no reasoning recorded, so nothing shows that anyone tested the harm against the Regulation 20 threshold that applies to this provider type, which for an ordinary GP partnership or company is the all-other-providers threshold rather than the health-service-body one. The call to the patient or to the community pharmacy exists only in someone's memory rather than in the clinical record.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 20(2)-(3) and reg 20(9) (all-other-providers notifiable safety incident threshold)

  4. A controlled-drug prescribing discrepancy is investigated as a high-risk incident (clerical, clinical, diversion-related or unexplained), with the patient made safe and the Registered Manager informed, rather than filed as a clerical slip. The risk is a discrepancy closed without that determination and, where the Practice is NHS-contracted, with no consideration of a notification to the NHS England Controlled Drugs Accountable Officer (CDAO).

    Strong evidence: The controlled-drug discrepancy log recording the check of prescribing and stock or issue records, the determination of cause, the safety action taken, and the CDAO or Home Office or police reporting decision where current source material or CDAO advice requires it (sections 8 and 11).

    Weak evidence: The controlled-drug discrepancy log reads "clerical error, resolved" with no statement of whether the cause was clerical, clinical, diversion-related or unexplained, and no record that the prescribing record and the stock or issue records were both checked. Nothing shows the patient was made safe or the Registered Manager informed. Where the Practice is NHS-contracted there is no recorded decision either way about notifying the NHS England Controlled Drugs Accountable Officer (CDAO), or about the Home Office or police route, and where a CDAO referral was made it is logged as if it discharged the separate CQC statutory notification question, so a possible diversion has been closed on an assumption.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  5. Each prescriber's professional registration, any required prescribing annotation, indemnity and competence are verified before system access is granted, and competence is reassessed after a prescribing incident. The patient carries the risk when a locum prescribes with unverified scope or access, or a prescriber continues at full scope after an incident with no reassessment.

    Strong evidence: The training matrix and staff access-control record showing registration, scope, access approval, review and reassessment, and the recorded restriction or supervision held until competence is restored (section 10).

    Weak evidence: The training matrix holds a General Medical Council (GMC) or pharmacist registration number with no date on which it was checked against the register, no note of prescribing annotation or indemnity, and no statement of the medicines and patient groups within that prescriber's scope. A locum has full prescribing access from the first session on the strength of an agency email, with no record that the Clinical Lead verified identity, registration and scope before access was approved. After a prescribing incident the same prescriber continues at full scope with only "discussed at appraisal" recorded: no reassessment, no restriction, no supervision arrangement and no record of when competence was judged restored.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

Related

Last verified 20 July 2026

Spotted something to improve?

These are sample templates, not the last word. If you would change a wording, or want to help us confirm a detail, tell us and we will look at it.

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 19 July 2026