After regulation 222 (sale of medicinal products from automatic machines) insert—
Assembly or part-assembly as part of “hub and spoke” dispensing arrangements between different businesses
(222A)
(1) Paragraph (2) applies where—
(a) an order for the sale or supply of a medicinal product to or for the use of a particular patient (P) is submitted to a person acting in the course of a retail pharmacy business or an NHS dispensing practice;
(b) the person carrying on the retail pharmacy business or the NHS dispensing practice (B1) has entered into written arrangements (whether or not legally binding) with a person carrying on a retail pharmacy business (B2) which—
(i) are for the purpose of B2 supporting B1 with regard to the fulfilment of orders submitted as mentioned in sub-paragraph (a) (but must not allow B2 to fulfil the order directly), and
(ii) include (but are not limited to) a comprehensive statement of the responsibilities of B1 and B2 in relation to those orders;
(c) B1 has conspicuously displayed a notice—
(i) at B1’s registered pharmacy or premises of B1’s NHS dispensing practice, if B1 supplies medicinal products to patients who are present at that pharmacy or those premises, and
(ii) in B1’s dispensing content for patients, if B1 sells or supplies medicinal products by means of an internet service,
containing the names and addresses of any parties with whom they have entered into arrangements of the type mentioned in sub-paragraph (b) and a brief statement of the general effect of the arrangements;
(d) the medicinal product is—
(i) assembled or part-assembled in the course of B2’s business, and
(ii) sold or supplied by B2 to B1,
as part of the written arrangements of the type mentioned in sub-paragraph (b); and
(e) the activities carried out as mentioned in sub-paragraph (d) are carried out with a view to any of the following taking place at or from premises of B1 (following further assembly in the case of part-assembled products)—
(i) the retail sale of the product by B1 to or for the use of P, or
(ii) the supply of the product in circumstances corresponding to retail sale by B1 to or for the use of P.
(2) For the purposes of these Regulations and the Medicines Act 1968, each sale or supply mentioned in paragraph (1)(d)(ii) by B2—
(a) is treated as or as part of a retail sale; and
(b) is treated as being in accordance with a prescription if—
(i) it is for the purpose of fulfilling an order that is a prescription, and
(ii) the final sale or supply is in accordance with the prescription,
notwithstanding that B2 does not have the prescription.
(3) The definitions of “sell” and “supply” in regulation 213(1) do not apply for the purposes of this regulation.
(4) Where both B1 and B2 are retail pharmacy businesses and a pharmacist may, pursuant to regulation 217B, 217BA or 226A, change an order for the sale or supply of a medicinal product, the final decision as regards whether or not that change is to be made for the sale or supply to or for the use of P is for a pharmacist acting on behalf of B1, even if—
(a) an initial decision, in accordance with which a retail sale was made by B2 to B1, was made by a pharmacist acting on behalf of B2; and
(b) the final decision by the pharmacist acting on behalf of B1 is by way of a confirmation of what the pharmacist acting on behalf of B2 initially decided.
Hub and spoke arrangements: sharing of data between different businesses
(222B)
(1) For the purposes of section 8(c) (lawfulness of processing: public interest etc) of, and paragraph 2(2)(a), (c) and (d) of Schedule 1 (special categories of personal data etc) to, the Data Protection Act 2018 , paragraph (2) applies to the processing of any data—
(a) by B1 or B2 (as defined in regulation 222A(1)(b)) which relates to a patient; and
(b) which is necessary for the purposes of—
(i) fulfilling an order submitted as mentioned in regulation 222A(1)(a) under the written arrangements between B1 and B2 of the type mentioned in regulation 222A(1)(b), or
(ii) discharging any related professional obligations to the patient (including obligations relating to the keeping of records).
(2) That processing is—
(a) necessary for the performance of a task carried out in the public interest; and
(b) if the data is personal data concerning health, necessary for the purposes of preventative medicine, medical diagnosis or for the provision of health care or treatment.
(3) Any person (P) who—
(a) is employed or engaged by B1 or B2; and
(b) in the course of being so employed or engaged is required to undertake the processing of data described in paragraph (1),
owes a duty of confidentiality in respect of that data (whether or not they would do so but for this paragraph).
(4) That duty—
(a) is a duty of confidentiality which, if not owed by a health care professional, is owed under an enactment or rule of law for the purposes of section 11(1)(b) of the Data Protection Act 2018 (special categories of personal data etc: supplementary); and
(b) is such that, if the processing is necessary for the purposes described in paragraph (1)(b), P is able, lawfully, to process that data by virtue of this regulation.
(5) For the purposes of paragraph (1)(b)(ii), a professional obligation to a patient is to be regarded as such notwithstanding that discharging the obligation may—
(a) also be an obligation that arises in some other way (for example, arising from a term of service that is part of NHS pharmaceutical services); or
(b) be done by a person who is not a health care professional.
(6) Paragraphs (1) and (2) do not apply where, in reliance or purported reliance on arrangements of the type mentioned in regulation 222A(1)(b), a person processes any data which relates to a patient but, in the course of the doing of anything that relates to the fulfilling of the order to which that data relates, there is a breach of—
(a) the requirements to be fulfilled if what is done is to be treated as or as part of a retail sale in accordance with regulation 222A(2)(a); or
(b) a duty of confidentiality owed in respect of the data by a health care professional or under an enactment or rule of law as mentioned in paragraph (4)(a).
(7) Words and expressions used in both—
(a) paragraphs (1) to (6); and
(b) Parts 1 and 2 (preliminary and general processing) of, and paragraphs 2(2)(a), (c) and (d) of Schedule 1 to, the Data Protection Act 2018,
bear the meanings they bear in those provisions of the Data Protection Act 2018.