Pharmacy Cybersecurity Checklist UK (2026)

Pharmacy cybersecurity means protecting the systems, accounts, devices and data that a pharmacy needs to dispense, provide services and operate safely. For a UK pharmacy owner, that includes more than the PMR. NHSmail, Smartcard-enabled services, consultation records, booking tools, payment accounts, websites, branch networks and supplier access can all become routes into the business or points of failure.

The owner-level job is not to become a security engineer. It is to know which services matter, who can access them, what each supplier is responsible for, how suspicious activity will be detected and how the pharmacy will continue if a system becomes unavailable. This 2026 guide turns those decisions into a pharmacy-specific checklist while recognising that no checklist removes every risk.

In brief

What should a pharmacy cybersecurity plan cover?

A useful pharmacy cyber security plan identifies critical systems and patient data, secures accounts and devices, governs suppliers, maintains restorable backups, trains the team to spot attacks and gives named people a tested incident-response process. Controls should match the pharmacy's services, branches, online activity and real operational risks.

First: map systems, administrators, suppliers and downtime dependencies.
Next: protect email, clinical and privileged accounts with proportionate access controls and multi-factor authentication.
Then: test backups, incident contacts and the pharmacy's business-continuity route before disruption makes the test real.

Why pharmacy cybersecurity needs owner-level attention

A modern community or online pharmacy may depend on email, cloud documents, PMR and clinical systems, NHS services, payment terminals, ecommerce, online consultations, booking platforms, prescribing tools, delivery systems, Wi-Fi, laptops, tablets and third-party support access. The risk sits in the connections between them as much as in each product.

The National Cyber Security Centre's updated small organisations guide to cyber security focuses on securing email and important accounts, protecting devices, backing up data and spotting attacks. Those are sensible first priorities for an independent pharmacy because they address common routes into the wider digital estate.

Responsibility cannot be outsourced completely. A managed IT provider may configure controls, but the pharmacy still decides who has access, which suppliers are trusted, what downtime is tolerable and how staff respond when something looks wrong.

Pharmacy cybersecurity checklist: ten owner priorities

Use this list to set the work programme. A “yes” should mean there is current evidence—such as an access report, restoration record or completed exercise—not only a policy saying the control should exist.

Critical-system register: PMR, EPS and NHS access, business email, booking, prescribing, ecommerce, payments, phones, delivery, payroll and branch systems are listed with named owners.
Named accounts: administrators and everyday users have individual identities wherever the platform supports them; shared and dormant access is being removed.
Multi-factor authentication: it is enabled on email, cloud administration, domain and website accounts, finance and other high-impact services, with recovery methods protected.
Supported devices and software: operating systems, browsers, PMR-connected equipment, website components and security tools receive updates; unsupported technology has a replacement plan.
Supplier controls: contracts and support arrangements identify hosting, remote access, backups, incident notification, data return and exit responsibilities.
Protected backups: the pharmacy knows what it backs up, what each supplier restores and how long recovery actually takes.
Staff readiness: induction and refresher training cover phishing, unexpected login prompts, payment changes, data handling and the pharmacy's reporting route.
Incident contacts: an offline list names the owner, superintendent, IG or data-protection lead, IT support, critical suppliers, insurer and relevant reporting routes.
Downtime procedures: the team can continue priority work safely when a clinical or operational system is unavailable, using the pharmacy's business continuity plan.
Recorded assurance: access reviews, patches, supplier checks, training, backup tests and incident exercises are dated, assigned and followed through.

Map the systems that keep the pharmacy operating

Create a simple register of systems, data and dependencies. It should be understandable to the owner, superintendent pharmacist, information-governance lead and the people expected to respond during an incident. Link material gaps to the pharmacy's wider risk register rather than leaving them in an IT supplier's inbox.

For each system, record:

its business and clinical purpose;
the supplier and contract owner;
the type of data processed and where it is stored;
administrator and everyday users;
connections to other systems;
backup, export and recovery arrangements;
support and incident contact details; and
the maximum tolerable period of disruption.

This exercise often reveals dormant accounts, unsupported devices, unknown plugins and single points of failure. Fixing those basics can reduce risk more effectively than buying another dashboard.

What belongs on a pharmacy system map?

Include the obvious clinical technology and the supporting services that can still stop a pharmacy operating. A practical map normally covers:

PMR, EPS and other NHS-connected access, including Smartcards and CIS2 where used;
NHSmail and business email, shared mailboxes and account-recovery routes;
consultation, vaccination, private-service, prescribing and patient-communication platforms;
the website, domain registrar, hosting, content management, booking forms, analytics and advertising accounts;
ecommerce, payment, refund and finance systems;
branch networking, Wi-Fi, routers, printers, scanners, CCTV, alarms and internet-connected devices;
laptops, tablets and phones used in the pharmacy, at home or while travelling; and
supplier, developer, locum and managed-support access, including how it is withdrawn.

If the PMR estate is being reviewed, use the operational and supplier questions in our UK pharmacy PMR systems guide alongside this security map.

Secure email and important accounts first

Email is frequently used to reset passwords, approve invoices, share documents and communicate with suppliers. If it is compromised, an attacker may gain a route into several other systems.

Require multi-factor authentication for email, administration panels, cloud storage, analytics, advertising accounts, domain management and other important services. Use unique passwords managed through an approved password manager. Remove shared administrator logins where individual accounts and auditable roles are available.

Access should follow least privilege: people get the minimum access needed for their role, and it is reviewed when responsibilities change. Leavers and temporary suppliers need a prompt, documented removal process.

Do not overlook recovery routes. An account can have strong authentication while its recovery email, fallback phone or domain registrar remains weak. Record who controls those routes, protect emergency codes and make sure access does not depend on one person's device.

Protect devices and reduce the attack surface

Keep operating systems, browsers, plugins and business applications supported and patched. Replace software that no longer receives security updates. Use centrally managed protection where practical, encrypt portable devices, lock screens automatically and separate administrative work from everyday browsing.

Review the network as well as the computer. Staff, guest and device connectivity should be designed deliberately. Do not assume every internet-connected printer, camera, terminal or smart device is harmless simply because it has no patient-facing screen.

For websites and digital services, reduce unnecessary plugins, accounts and exposed management routes. Apply updates through a controlled process, monitor for failures and keep a rollback plan. Pharmacy Mentor's managed pharmacy website service can include maintenance, hosting and accountable technical ownership, but every integration still needs a named business owner. Use our pharmacy IT support buyer's guide to test whether a support provider's scope covers branches, cloud services and recovery rather than only the dispensary computer.

Make backups independent and restorable

A backup is valuable only if it contains the right information, is protected from the same incident and can be restored within the time the pharmacy needs.

Define which information the pharmacy itself must back up and which systems are restored by a supplier. Keep at least one protected copy that is not continuously exposed to the same accounts or network. Encrypt sensitive backup data and control who can delete or change it.

Run recovery exercises. The NCSC's response and recovery guidance recommends identifying essential information, maintaining backups and making sure relevant people know how to restore them. Record how long a realistic restoration takes and what work the team performs while systems are unavailable.

Govern suppliers and integrations

Ask suppliers how they authenticate administrators, patch vulnerabilities, encrypt data, log access, test recovery and notify customers about incidents. Confirm where responsibilities change hands. A statement that a platform is “GDPR compliant” is not a substitute for a processing agreement, security evidence and a workable exit plan.

When two systems exchange data, document the fields, direction, authentication method, error handling and support owner. Limit data to what the workflow requires. Disable unused keys and integrations, rotate credentials appropriately and avoid placing secrets in shared documents or source code.

If a supplier is business-critical, understand how the pharmacy exports its data and continues safely during an outage. Commercial convenience should not create an unexamined dependency.

Extra controls for online pharmacies and digital services

An online pharmacy has more internet-facing components and usually more organisations sharing the patient journey. Map the website, prescribing service, clinical questionnaire, identity checks, pharmacy platform, payment service, customer communications and fulfilment workflow as one system, even when several suppliers operate it.

The GPhC's guidance for registered pharmacies providing services at a distance says pharmacy owners and superintendent pharmacists should make sure the digital platform is secure, follows data-protection law and has secure facilities for collecting, using and storing users' details. It also expects secure payment processing and due diligence where third parties are involved.

That means security review should happen when the service model changes—not only at launch. A new questionnaire, analytics script, prescribing partner, delivery integration or customer-support tool can change what data is collected, where it travels and who can reach it. Record the decision, check the lawful and operational basis, and update the relevant data-protection assessment. Our GDPR guide for community pharmacy covers the related information-governance work.

Connect data protection to operational security

The ICO's security outcomes organise the problem around managing risk, protecting personal data, detecting events and minimising impact. That is a useful management structure for pharmacy because it connects technical controls to accountability and recovery.

Community pharmacies providing NHS services should also account for the current Data Security and Protection Toolkit requirements. NHS England states that community pharmacies must comply with the current Toolkit and complete the DSPT assessment each year. Community Pharmacy England's 2026 pharmacy guidance highlighted a new question about multi-factor authentication for clinical IT systems and confirmed that mandatory questions form part of minimum information-governance requirements.

Do not treat the annual declaration as a separate folder exercise. Community Pharmacy England also provides current pharmacy data-security templates for access control, asset registers, training, processor reviews, breach handling and business continuity. Use them to improve the live system register, training, access reviews, incident plan and evidence of completed controls.

Train the team for the attacks they will actually see

Short, repeated exercises are more useful than an annual presentation nobody remembers. Train staff to recognise unexpected login prompts, payment-detail changes, suspicious links, urgent requests, unusual device behaviour and messages apparently sent from a colleague's account.

Give people one simple reporting route. They should know that reporting a mistake quickly is valuable and that they will not be punished for raising a genuine concern. Early escalation can stop an account compromise becoming a wider incident.

Include owners and senior staff. Attackers target authority and payment access, not only inexperienced users.

What should a pharmacy do during a cyber incident?

Protect people and essential pharmacy services, escalate through the agreed route and preserve reliable information about what happened. Do not improvise destructive technical action or use a device you believe may be compromised to seek help. An incident plan should fit on a few practical pages, with named roles, out-of-band contact details and clear decision points.

Recognise and escalate. Record what was observed, when and on which system.
Contain safely. Follow approved advice before disconnecting or wiping anything that may hold useful evidence.
Contact the right suppliers. Use verified contact details, not information from a suspicious message.
Protect continued care. Switch to documented downtime processes and preserve patient safety.
Assess data impact. Involve the responsible data-protection and governance leads.
Communicate accurately. Avoid speculation; record decisions and approved messages.
Recover and learn. Restore from trusted sources, verify systems and close the root cause.

The ICO's ransomware guidance explains that loss of access can itself be a personal data breach and that reportability depends on the risk to people's rights and freedoms. A reportable personal data breach must be notified without undue delay and no later than 72 hours after awareness; even when notification is not required, the breach and risk assessment should be recorded.

The NCSC's Cyber Incident Signposting Service helps UK organisations identify reporting routes, but an NCSC report does not fulfil separate legal or regulatory duties. The pharmacy may also need to contact its IT and clinical-system suppliers, insurer, NHS or commissioning contacts, the ICO, law enforcement and professional advisers depending on the incident. Use current official guidance and obtain specialist advice for the facts in front of you.

A 30-day pharmacy cybersecurity improvement plan

Week 1: know what you depend on

Create the system, supplier and administrator register.
Identify critical services and acceptable downtime.
Remove obvious dormant accounts and unknown access.

Week 2: secure accounts and devices

Enable multi-factor authentication on priority accounts.
Review patching, supported software and device encryption.
Separate everyday and administrative access.

Week 3: verify suppliers and backups

Confirm processing, incident and recovery responsibilities.
Test one critical data export or restoration.
Review website plugins, integrations and secret handling.

Week 4: exercise the incident plan

Run a short phishing or ransomware scenario with named roles.
Check offline contact details and downtime procedures.
Record gaps, owners and completion dates.

At the end of the month, give each unresolved risk an owner, target date and escalation route. Repeat the highest-value checks after supplier changes, new services, acquisitions, staff changes or incidents; a once-a-year review will miss changes in a fast-moving digital estate.

Security should support digital growth, not freeze it. When ownership, access, suppliers and recovery are clear, the pharmacy can adopt automation, online services and new patient journeys with more confidence. Pharmacy Mentor can help review the website, integrations and wider digital architecture as part of a pharmacy digital strategy, develop governed online journeys through WooPW and scope a secure pharmacy website or platform project. Pharmacy Mentor is not a managed security service provider, so specialist cyber, legal or incident-response advice may still be needed.

Frequently asked questions

Who is responsible for pharmacy cybersecurity?

Owners and accountable leaders retain responsibility for understanding and managing risk, even when specialist suppliers implement controls. Named technical, governance and incident roles should be documented.

What should a small pharmacy secure first?

Start with email and important accounts, multi-factor authentication, supported and patched devices, reliable backups, supplier access and a simple incident-reporting route.

Does a cloud supplier handle all pharmacy data-security responsibility?

No. A supplier may operate important controls, but the pharmacy still needs to assess the service, configure access, govern data use, manage staff and plan for incidents and exit.

When must a pharmacy report a personal data breach?

The answer depends on the facts and risk to people. Certain breaches must be reported to the ICO without undue delay and, where applicable, within 72 hours of awareness. Follow the current ICO guidance and obtain appropriate professional advice.

Does a community pharmacy need Cyber Essentials certification?

Community Pharmacy England describes Cyber Essentials as an optional certification that pharmacy owners may choose to purchase; it is not a replacement for the pharmacy's annual Data Security and Protection Toolkit obligations. The certification can provide a structured, independently assessed baseline for common technical controls, but the owner still needs pharmacy-specific governance, supplier oversight, recovery and incident arrangements.

How often should a pharmacy test its backups?

Set the frequency from the system's importance, rate of change and maximum tolerable downtime rather than relying on an arbitrary annual test. Test a real restoration often enough to show that the right data can be recovered within the required time, and repeat the test after material platform, supplier or backup changes.