Pharmacy Cybersecurity Guide

A pharmacy that cannot reach its dispensing system, its electronic prescriptions or its claims processor cannot safely hand out medicines, and the same systems are a route for prescription fraud, controlled drug diversion and false reimbursement claims. Community and online pharmacies run on a small number of connected services: a patient medication record (PMR) or dispensing system, a national or commercial prescription network, a claims or reimbursement channel, a point-of-sale till and, increasingly, an e-commerce site and patient app. Most are small businesses with no security staff, sharing terminals at a busy counter. This guide covers the regulatory baseline in England and the US, how to secure dispensing systems and shared workstations, how to protect prescription integrity, the main fraud patterns and their controls, and how to keep dispensing going when a supplier fails. It is for pharmacy owners, superintendent pharmacists, IT leads at pharmacy chains and the suppliers who support them.

Key takeaways

Availability is a patient safety issue. When the claims clearinghouse Change Healthcare was disconnected in 2024, pharmacies across the US could not submit claims or check coverage for weeks.
Shared counters need individual identity. Dispensing, controlled drug records and prescription release must be tied to a named person, not a shared login left open at the till.
Prescription records carry legal weight. US electronic prescriptions for controlled substances (EPCS) require a certified pharmacy application with digital signature checks, audit trails and two-year retention under 21 CFR Part 1311.
Most pharmacy fraud is claims fraud. The NHS Counter Fraud Authority estimates the NHS is vulnerable to £135.2m of pharmaceutical fraud each year, much of it fictitious or inflated claims.
Your suppliers hold the keys. PMR vendors, remote support providers and claims switches have privileged access to every site, so their access must be controlled and their outages planned for.

Why pharmacies are different

Small sites, many of them: an independent pharmacy may have three terminals and no IT staff, while a chain runs hundreds of identical sites from a central PMR. Both depend on suppliers for almost all technology.
Busy, shared counters: pharmacists, technicians, dispensers and locums move between terminals. Locums may work at several pharmacies in a week.
Controlled drugs: records of controlled drug supply attract diversion attempts by insiders and forged or altered prescriptions from outside.
Money flows through claims: reimbursement depends on submitting accurate dispensing claims to the NHS or to US payers through intermediaries.
Retail and online exposure: card payments at the till and online pharmacy sites add payment card and customer account risk. See the Point of Sale Security Guide.

The regulatory baseline

Requirement	Applies to	What it means for a pharmacy
Data Security and Protection Toolkit (DSPT)	Community pharmacy owners in England with NHS contracts	Annual self-assessment; the 2026 deadline was 30 June 2026. Community Pharmacy England publishes question-by-question guidance and allows batch submission for owners of three or more pharmacies. See the NHS Data Security and Protection Toolkit.
Electronic Prescription Service (EPS) access rules	Dispensers in England	Healthcare workers must be authenticated and authorised; updating a record requires strong authentication through NHS Care Identity Service 2 (CIS2). See the NHS Spine and Smartcard Security Guide.
UK GDPR and Data Protection Act 2018	UK pharmacies	Health data is special category data; personal data breaches meeting the threshold go to the ICO within 72 hours
HIPAA Security Rule	US pharmacies that transmit health information electronically in standard transactions, and their business associates	Risk analysis, administrative, physical and technical safeguards, business associate agreements. See the HIPAA Security Rule Guide.
DEA EPCS, 21 CFR 1311.200 to 1311.215	US pharmacies processing electronic controlled substance prescriptions	Certified pharmacy application, access controls by user or role, signature verification, daily audit trail analysis, reporting of compromising incidents to DEA within one business day, two-year retention. See the DEA EPCS Rules.
Drug Supply Chain Security Act (DSCSA)	US dispensers and trading partners	Package-level product tracing; notify FDA within 24 hours of determining a product is illegitimate

For other jurisdictions and the wider healthcare picture, see the Healthcare Cyber Regulation Map.

Securing dispensing systems and shared workstations

The PMR or dispensing system is the core asset: it holds patient medication histories, controlled drug registers in many systems, and the queue of prescriptions to dispense.

Named accounts for everyone, including locums: no shared "dispensary" login. Provision locums with their own accounts, time-limited to their booking, and remove them afterwards.
Fast re-authentication: shared counters fail when logging in takes too long, because staff leave sessions open. Use smartcard or tap-to-unlock with short screen lock timers rather than long sessions. In England, EPS access uses NHS CIS2 authentication. See the Kiosk and Shared Device Security Guide.
Role-based permissions: separate the right to label and dispense from the right to amend controlled drug records, override clinical checks or change system settings. EPCS rules require logical access controls by user name or role for annotating, altering or deleting prescription records.
Lock down the terminals: no general web browsing or personal email on dispensing terminals; separate the till and staff Wi-Fi from the dispensing network; patch the operating system and PMR client on the supplier's schedule.
Backups and local fallbacks: cloud PMRs reduce local backup duties, but keep a way to see today's prescriptions and patient records if the connection drops. EPCS pharmacy applications must back up records daily.

Protecting prescription integrity

Prescriptions move electronically from prescriber to dispenser. In England, EPS carries over 95% of primary care prescriptions, about a billion items dispensed in 2022 according to NHS England. In the US, controlled substance prescriptions move through certified applications under Part 1311.

Threat	Example	Control
Forged or altered paper prescription	Stolen prescription pad, altered quantity of a controlled drug	Check prescriber details against the source, contact the prescriber for unusual quantities, prefer electronic routes for controlled drugs
Duplicate dispensing	Paper or oral copy presented for a prescription already sent electronically	Part 1311.200 requires pharmacies to check records to prevent duplicate dispensing; apply the same check in all jurisdictions
Insider alteration	Staff member edits dispensing records to hide diversion	Restrict who can annotate or alter records, audit trails reviewed daily, controlled drug reconciliation
Signature or certificate failure	Invalid or revoked prescriber signing certificate	Pharmacy application verifies the digital signature and checks the certificate revocation list (Part 1311.210)
Compromised prescriber system	Attacker issues prescriptions from a clinic's hijacked account	Watch for unusual prescribing patterns, new prescribers with high controlled drug volumes, and prescriptions outside clinic hours

Fraud patterns and controls

Pharmacy fraud comes from outsiders, from patients and, less often, from staff or owners. NHS Counter Fraud Authority guidance on community pharmaceutical contractor fraud lists falsified or inflated services, services carried out unnecessarily to meet targets, fictitious claims using patients' details, false claims for allowances or reimbursements, and inflated or false out-of-pocket expense claims.

Fraud type	Source	Detection and prevention
Fictitious or inflated claims	Insider or owner	Reconcile claims against stock movements and wholesaler invoices; review outliers by product and patient
Controlled drug diversion	Insider	Named accounts, daily audit trail review, controlled drug register reconciliation, two-person checks on destruction
Prescription forgery	External	Prescriber verification, staff training on red flags, sharing alerts with local networks
Online pharmacy account takeover	External	MFA for patient accounts, notification on address and payment changes, step-up before changing delivery address on repeat orders. See the Account Takeover Prevention Guide.
Impersonation of the pharmacy	External	Monitor for look-alike domains and rogue sellers using your name; report unlawful online medicine sales to the regulator (FDA operates a reporting form in the US)
Supplier and payment fraud	External	Verify any change to wholesaler or landlord bank details by calling a known number. See the Fraud and Cyber Convergence Guide.

Report suspected NHS fraud to the NHS Fraud and Corruption Reporting Line on 0800 028 4060 or online through the NHS Counter Fraud Authority. Report fraud against the business itself to Report Fraud (which replaced Action Fraud on 4 December 2025), or in Scotland to Police Scotland on 101.

Suppliers, remote access and where identity fits

Pharmacies depend on a short supplier list with deep access: the PMR vendor, the remote support provider, the till and payment provider, the claims intermediary and the wholesaler ordering portal. The Change Healthcare breach began with a remote access portal without MFA and left US pharmacies unable to submit claims for weeks.

Remote support: allow vendor remote sessions only on request, through a tool that records sessions, with MFA on the vendor side. Remove standing remote access agents that nobody uses. See the Remote Access Identity Guide.
Machine identities: PMR integrations with EPS or payer networks, wholesaler ordering links, robot dispensing systems and online pharmacy APIs use service accounts, certificates and API keys. EPCS applications rely on a FIPS-validated signing key. Record each one, its owner and expiry. See the Service Account Security Guide.
Contracts: require suppliers to notify you of incidents, state their recovery times, and support offline working.

Keeping dispensing going during an outage

Write a downtime procedure: how to dispense safely without the PMR or EPS (emergency supply rules, paper records, how to reconcile later). See the Clinical Downtime and EHR Downtime Procedures Guide.
Know your claims fallback: how claims will be submitted if your intermediary is offline, and how long the business can carry the cash-flow gap.
Keep key contacts offline: supplier support lines, local NHS or payer contacts and insurer details on paper.
Rehearse once a year: a 30-minute walk-through with the team on a quiet afternoon finds most gaps.

How to implement: a phased approach

Weeks 1 to 4, identity and access: remove shared logins, give every staff member and locum a named account, set screen locks, and review who can amend controlled drug records.
Weeks 4 to 8, suppliers: list suppliers with remote or privileged access, remove unused remote tools, and confirm MFA and incident notification terms.
Weeks 8 to 12, terminals and network: separate till, guest and dispensing networks; restrict browsing on dispensing terminals; confirm patching responsibilities.
Months 3 to 6, fraud controls: start monthly reconciliation of claims against stock and invoices, and daily audit trail review for controlled drugs.
Annually: complete the DSPT (England) or HIPAA risk analysis (US), review EPCS application certification dates, and rehearse the downtime procedure.

Rollback: if faster screen locks slow the counter at peak times, lengthen the timer slightly at the till terminals only and keep named accounts; do not return to shared logins.

Decision guidance

Independent pharmacies: lean on the PMR supplier, use the DSPT or HIPAA risk analysis as the plan, and focus on named accounts, remote access control and downtime procedures.
Chains: central identity and joiner, mover and leaver processes for staff and locums, a security monitoring service for all sites, and standard builds for every terminal. See the Healthcare Identity Security Guide.
Online pharmacies: treat the website and patient app as the main attack surface: customer account protection, payment security and monitoring for impersonation sites.
Cloud PMR versus on-premises: cloud shifts patching and backups to the supplier but makes connectivity critical; plan a backup connection and an offline view.

Detection and measurement

Metric	What it shows
Shared or generic accounts on dispensing systems	Accountability at the counter (target: zero)
Locum accounts removed within one day of booking end	Leaver process for temporary staff
Days with completed controlled drug audit trail review	Diversion detection in practice
Claims-to-stock reconciliation exceptions investigated	Claims fraud control
Suppliers with standing remote access and MFA confirmed	Supplier access risk
Months since the last downtime rehearsal	Readiness for outages

Common failure patterns

The open session: one login left running all day at the counter, so every action is attributed to whoever logged in first.
Locum accounts that never expire: accounts created for a single shift remain active for years.
Forgotten remote tools: an old remote support agent from a previous supplier stays installed and reachable.
No offline plan: the team has never practised dispensing without the PMR or claims connection.
Audit trails nobody reads: the system records changes to controlled drug records, but nobody reviews them.
Browsing at the dispensary: dispensing terminals used for email and web, inviting malware onto the most sensitive machine.

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev. 5
Named accounts and role-based access	PR.AA-01, PR.AA-05	AC-2, AC-3, AC-6
Audit trails and review	PR.PS-04, DE.CM-03	AU-2, AU-6
Supplier and remote access	GV.SC-07	AC-17, SA-9
Backups and downtime	PR.DS-11, RC.RP-01	CP-2, CP-9
Network separation	PR.IR-01	SC-7

Practitioner checklist

Give every pharmacist, technician and locum a named account; remove shared logins.
Use fast re-authentication and short screen locks at shared terminals.
Restrict who can amend controlled drug and dispensing records, and review audit trails daily.
Confirm your EPCS pharmacy application certification is current (US) and complete the DSPT each year (England).
Remove unused remote access tools and require MFA for supplier sessions.
Separate till, guest and dispensing networks.
Reconcile claims against stock and invoices monthly.
Write and rehearse a downtime procedure covering dispensing and claims.
Know where to report: ICO or HHS for breaches, NHS Counter Fraud Authority, Report Fraud, DEA for compromising EPCS incidents.

Standards and references

Related NHI Mgmt Group resources: Cyber Security for Dental and GP Practices Guide · Healthcare Incident Response Guide · Top 10 Healthcare Cyber Threats · Pharma and GxP Cybersecurity Guide. This guide summarises regulatory requirements and is not legal advice.

Pharmacy Cybersecurity Guide: Dispensing Systems, Prescriptions and Fraud