GP mythbuster 23: Security of blank prescription forms

In our inspections of GP practices, we look at how prescription forms are managed under the safe key question.

This relates to key line of enquiry S4: Medicines management. In particular S4.1: 'How medicines and medicines related stationery is managed (that is, ordered, transported, stored, distributed and disposed of safely and securely)?'

National guidance

NHS Counter Fraud Authority has published updated guidance:

NHS Counter Fraud Authority: management and control of prescription forms: A guide for prescribers and health organisations (March 2018)

This guidance:

• supports providers, both NHS and private, authorised by their commissioner to order prescriptions
• helps providers develop local systems to ensure the security of prescription forms against theft and misuse
• applies to blank computer prescription forms and handwritten pads.

Organisations who stock prescription forms are responsible for their management and use by:

• preventing theft and misuse through secure storage
• developing an organisational policy outlining roles and responsibilities
• developing local action protocols outlining what actions to take in the case of loss, theft or missing prescription forms/paper
• controlling and recording prescription form movement, including recording serial numbers.

The guidance discusses a range of measures to prevent and tackle prescription form theft and misuse. It also outlines the recommended actions when an incident occurs. It is for all prescribing staff and those who write or manage the processes.

What is the problem?

A prescription form is an asset that has a financial value. It is in effect a blank cheque open to potential misuse. Theft of prescription forms and their resulting fraudulent misuse is a serious concern. It can lead to loss of valuable NHS resources and potentially result in serious harm. Forms can be used to illegally get controlled drugs (CDs) and other medicines. This can be for illegitimate personal use or to sell on.

Fraud or thefts are not always complex or on a large scale; single forms can be stolen from the prescriber’s bag, car, home or desk.

Methods to obtain blank forms include tactics to distract busy staff with what appear to be genuine patient requests. The offender gains access to, or is left in, a consulting room and steals blank prescription paper from an unattended computer. They scan a genuine prescription and print out copies on the stolen forms. These can be very difficult to detect.

When we inspect

We expect:

• GPs (including locums)
• other prescribers in the practice
• all staff involved in the management of prescription forms

to be able to tell us how the practice manages and secures blank prescription forms and paper. This should be in line with national guidance unless the practice can justify, with risk assessment and mitigation, why this is not the case.

We also expect:

• Clear and unambiguous records of prescription stationery stock received.
• Clear arrangements for the arrival of prescription form stock. This should include a pre-determined date of arrival where possible, so a missed delivery can be followed up quickly within 6 working days from the date of the order being placed.
• Prescription form stock checked on delivery. Bar codes recorded, checked against the delivery note and the stock securely stored as soon as possible.
• Stock stored securely, at least in a locked cabinet within a lockable room or area.
• Access to forms restricted to authorised individuals.
• Record kept of pre-printed prescription form stock distribution within the practice including:
  • the serial numbers
  • where, when (date/time) and to whom prescription forms have been distributed
  • using a computer system helps reconciliation and audit.
• Records kept of prescription forms that are:
  • returned to stock,
  • destroyed, and the reasons for destruction.
• Clear storage system for prescribers using individualised forms:
  • kept in a locked space and not with patients’ notes
  • the serial number of the first remaining form is made at the end of each patient session.
• Measures in place to keep forms secure. For example:
  • only authorised individuals have access to the lockable room or area where prescription form stocks are kept.
  • it is not advisable to leave the forms in printer trays when not in use or overnight. The new guidance says all prescriptions should be removed from printer trays and locked away when not in use or out of hours.

Consider at other times:

• using a lockable printer cover
• storing a printer in a lockable drawer
• storing forms in a lockable drawer and only placing them in a printer when needed.

Where risk assessments undertaken for printers used for computerised prescribing. Consideration should be given to:

• where the printer is located
• who has access to the area
• whether the area is shared with another service
• levels of surveillance
• Protocols define which who has access to the functions that generate prescriptions. Staff with access to the computer system should have an individual password.
• Regular stock checks undertaken on prescription forms. Where possible, separate duties of ordering, receiving and stock checking the prescription forms.
• A system for storing prescription forms when seeing patients outside practice premises. For example, on home visits. It is advisable to take a limited number of forms and record serial numbers.
• Staff know what to do if they suspect that prescription forms have gone missing.

The new guidance also includes information on:

• destroying spoiled or duplicate prescriptions
• sending prescriptions by post
• transferring prescriptions from one site to another (for example to a branch surgery)
• locum access to prescriptions
• alerts, investigations and sanctions
• audit
• security of computer systems
• missing or lost prescription forms
• forged prescriptions
• reporting incidents