Regulation 12 says care and treatment must be provided in a safe way. In general practice that sentence is mostly about medicines, and the Safe key question it maps to has more lines of enquiry, and more recorded breaches, than anything else CQC assesses.

Fail it and you are rated Requires Improvement or Inadequate, possibly with a breach notification. Practice Index commentary goes further: Safe connects to effectively every GP service ever rated RI or Inadequate. No CQC figure says so, though it matches what practices read in their own reports.

This article stays in the medicines cluster: what Regulation 12 asks, the five places findings recur, and what a defensible system looks like. The recovery journey itself is in CQC ‘Requires Improvement’: how GP practices get back to Good.

What Regulation 12 is actually asking

CQC’s monitoring question is: “How does the provider ensure the proper and safe use of medicines, where the service is responsible?”

Read the verb. Ensure makes this a question about your system: what mechanism delivers safe use, and where is it written down? You can run a clinically excellent practice and breach Regulation 12, because assurance is a different thing from good care.

The Single Assessment Framework is in force, and a new primary care framework arrives summer 2026 for implementation from the end of that year. None of the medicines evidence below moves.

Where the findings recur

Recorded findings are repetitive. They fall into five groups.

Monitoring high-risk drugs

This one appears in the most reports: missing bloods, intervals quietly extended past protocol, incomplete Ardens searches, and, most often, patients reviewed with nothing in the record documenting the discussion. Drug-specific monitoring is looked at directly: ACE inhibitors and ARBs, levothyroxine, amiodarone, lithium, DOACs and anticoagulation, and the DMARDs (azathioprine, leflunomide, methotrexate).

The cause is structural. Monitoring is nobody’s whole job, and deferring it today costs nothing today. The register grows quietly, so by the time somebody counts, the gap is months of drift.

What survives an assessment is an owned, scheduled cycle: a named clinician, a fixed interval, a recorded output per patient. The search someone runs when the letter lands does a different job. Mechanics are in high-risk drug monitoring in primary care, and a managed high-risk drug monitoring service earns its place here.

Safety alerts and significant events

MHRA and CAS alerts arrive in one inbox. Someone reads them. That is where it ends, and the work leaves no artefact: nothing records who searched the affected cohort, or shows the alert was discussed and closed.

So the findings read: alerts not properly managed or discussed, significant events never disseminated to staff, Significant Event Audits recording what happened with no assessment of how likely it is to recur.

An alert log fixes it, four columns wide: received, assessed, action taken (including cohort searched and patients contacted), closed by whom and when. An alert needing no action still gets a line saying so, with reasoning. That line is the evidence, and discrete work you can hand to drug alerts and recalls.

Prescriber oversight and PGDs

Everyone knows the prescriber is competent. Nobody has written the supervision down. CQC records that as no process for monitoring non-medical prescriber competency.

PGDs decay the same way, signed at induction and never re-signed as the rota changes, so an assessor finds one out of date, unsigned by someone operating under it, or mismatched to the person working to it.

The remedy is administrative: a scheduled prescribing audit with a documented sample, a named supervising clinician, a recorded scope of practice per prescriber, and a PGD register with named signatories and expiry dates.

Prescription stationery, controlled drugs and storage

Almost always the branch. The main site has a serial-number log and a locked cabinet; the branch has the same policy on paper and a different reality on the day. Findings: blank prescriptions not logged or tracked at branch sites, controlled drugs gaps, failure to stock recommended emergency medicines, vaccine storage and cold chain.

The fix is the boring one: serial-number tracking end to end at every site, a CD register with recorded checks, cold chain logs recording excursions and your response, a dated emergency medicines list with a named checker. Emergency stock fails through expiry drift and lists nobody reconciles. Where you have decided against stocking something recommended, record the reasoning. Our view is that a reasoned, recorded decision gives an assessor something to weigh, and a silent gap gives nothing.

Repeat prescribing and eRD

Repeat prescribing is high volume and mostly invisible, and eRD amplifies it: twelve months of medicine on one authorisation decision nobody has assured. CQC finds it running without a documented policy, or with a policy nobody follows, and reauthorisation at the point of request instead of as a review. Documented policies covering prescribing, high-risk drugs, controlled drugs and repeat dispensing are artefacts CQC looks for by name. Reauthorisation should leave a record, which is how repeat prescription management should run.

The documentation trap

A patient on methotrexate had their bloods reviewed. The GP looked, was satisfied, moved on. There is a result in the record, no consultation entry, no coded review, no note of a discussion. To an assessor that is a monitoring gap: from outside, a safe review looks identical to a blood test nobody opened. Most Regulation 12 findings therefore have a coding and workflow answer, often the same clinical care recorded differently.

CQC’s guidance is explicit that practices should run their own governance and treat the clinical searches as a check on it. Built with Ardens, they cover safe prescribing, high-risk drug monitoring, long-term condition management and missed diagnoses. Detail is in CQC clinical searches; running them before an assessment is CQC searches and preparation.

What a defensible medicines system looks like

Four properties, nothing more sophisticated.

• Named ownership. Every cluster above has one person’s name against it. A role is not a name.
• A scheduled cycle. Monitoring, alert review, prescribing audit and PGD or CD checks run on a calendar.
• An artefact per event. Every decision leaves a coded, dated, attributable record, including decisions that led to no action.
• Someone who checks the checkers. A quarterly look at whether the cycle ran.

Structured medication reviews do a lot of this work: a good SMR generates the documented, coded review discussion the monitoring cluster is missing, and applies STOPP/START thinking to the polypharmacy driving most of the risk. See structured medication reviews or clinical medication reviews.

When the problem is capacity

Most practices that fail the medicines cluster know what the cycle should look like. What they lack is anyone with protected time to run it, so it runs in the gaps, which is to say it does not run.

Virtual Pharmacist delivers a fully managed clinical pharmacy service across this cluster: high-risk drug monitoring (antipsychotics, DMARDs, lithium, amiodarone), SMRs on IIF criteria, discharge reconciliation, repeat reauthorisation, eRD setup, and CQC searches and preparation. The service is remote, delivered under Virtual Pharmacist’s own clinical governance and monitored through clinical activity KPIs, and aligned to your practice’s agreed workflow and documentation standards. You set the clinical priorities for your patients. We are responsible for how the service is delivered against them. Scope is defined in writing: DOAC initiation and opioid or gabapentinoid deprescribing are excluded without prior agreement.

We are an award-winning service (Pharmacy Solutions Provider of the Year, General Practice Awards) with 375+ UK partnerships and 88+ PCNs served, and every pharmacist is verified on the GPhC register. Our work covers the medicines cluster inside Regulation 12. Fire safety, premises and DBS checks stay with you, and no clinical pharmacy service can promise you a rating.

A self-test worth doing this week

Pick one high-risk drug. Methotrexate is the usual choice. Ask for a list of every patient on it with two dates against each name: their last full blood count, and their last recorded review discussion. That second date means the day someone wrote down a clinical judgement. A result arriving does not count.

If you cannot produce that list this week, or the second column is materially emptier than the first, you have found the shape of your Regulation 12 finding before an assessor does.

It is also the most useful thing to put in front of a pharmacist. If it comes back thin, our clinical pharmacists can usually tell you quickly whether it is a coding problem or a capacity one.

Frequently asked questions

Does Regulation 12 only apply to medicines we initiate ourselves?

No. It applies wherever the service is responsible. Shared care and hospital-initiated therapy divide that responsibility by agreement, and where nothing is written down an assessor treats the monitoring as yours.

Will passing the CQC clinical searches keep us out of a Regulation 12 finding?

Not on its own. The searches have deliberate tolerance in their intervals, so a patient can pass one and still be outside your protocol. CQC expects your own governance underneath them.

Our clinical care is good. Can we still be rated Requires Improvement on medicines?

Yes, and it is the most common version of the problem. Regulation 12 is assessed on the evidence your system produces, so care recorded thinly reads, from outside, like care never delivered.

How far back do we need to fix records before an assessment?

You cannot backfill a clinical judgement nobody made. Get the current cohort reviewed and coded properly, and start the scheduled cycle now, so an assessor sees a cycle that is running.

Who should own the monitoring cycle in a practice our size?

One named person, whatever the size. Ownership attached to a role gets dropped when the rota moves, so attach it to a person with protected time.

If any of the five clusters above sounds like your practice, the useful next step is a conversation with someone who has worked through it before. Contact Virtual Pharmacist to discuss what your practice needs and how a remote, managed service could fit.