Online does not mean out of scope. If your platform diagnoses, treats or prescribes for patients in England, CQC regulates you, and it assesses digital providers with the same rigour it applies to a bricks-and-mortar clinic.
Online GP services, private prescribing platforms, remote mental health clinics, weight management apps with prescribers behind them: the digital healthcare sector has grown fast, and so has CQC’s attention to it. The regulator has been inspecting online primary care for years and has shown it will act against platforms whose prescribing or safeguarding falls short.
We support digital-first providers through registration, and the pattern is consistent: the technology is rarely the problem. Applications stall on the same regulatory fundamentals as any other service, plus a set of questions unique to remote care. This guide covers who needs to register, which regulated activities apply, and the issues CQC will press on.
Does your online service need CQC registration?
Registration is triggered by carrying on a regulated activity in England, not by having premises. If your service involves clinicians diagnosing, treating or prescribing for identifiable patients, you are very likely within scope. That includes:
- Video or telephone GP consultations
- Asynchronous questionnaire-based prescribing
- Remote psychiatric assessment and treatment, including ADHD services
- Online weight management involving prescription medicines
- Remote triage and medical advice services
What generally sits outside scope is pure information provision, signposting, or software that never involves a clinician making decisions about an individual patient. The boundary can be genuinely unclear for hybrid models, and CQC publishes scope guidance on remote triage and medical advice. If you are near the line, get a written view before you build your launch plan around an assumption.
Which regulated activities apply
The exact set depends on your clinical model, and this is a decision worth taking carefully because it shapes your entire application. The activities most commonly involved for digital providers are treatment of disease, disorder or injury, which covers consultations and prescribing by doctors and other clinicians, and transport services, triage and medical advice provided remotely, which covers remote triage and advice models. Diagnostic and screening procedures can also apply, for example where you arrange tests and interpret results.
Apply for the activities your model actually needs. Applying for too many invites questions you cannot answer about services you do not run. Applying for too few risks operating outside your registration when the service grows.
The location question for a service with no clinic
Digital providers still register a location: the place the service is managed from, where records are accessible and where CQC can inspect. A registered office that no one works from does not satisfy this. Decide early where your service is genuinely run from, make sure the address can host an inspection, and describe it accurately in your Statement of Purpose.
What CQC presses on with digital providers
- Prescribing safety. This is the area where online providers have been criticised most. Expect scrutiny of how you verify identity, how you guard against patients obtaining repeated or duplicate supplies, which medicines you will not prescribe remotely, and how prescribers evidence their decisions.
- Safeguarding at a distance. How do you spot a safeguarding concern through a screen or a questionnaire? Your policies need remote-specific answers: recognising coercion off camera, verifying the age of the patient, and escalation routes that work when the patient could be anywhere in the country.
- Information sharing with the patient’s NHS GP. CQC expects you to seek consent to share consultation and prescribing information with the patient’s GP, and to have a considered position on what happens when the patient refuses.
- Continuity and follow-up. What happens to abnormal results, failed contacts and deteriorating patients? A service built only for the happy path will struggle at assessment.
- Clinical oversight. Who audits consultations and prescribing? How are remote clinicians recruited, checked, inducted and supervised? Distributed workforces still need real governance.
- Data security alongside care quality. Clinical records systems, access controls and data protection compliance sit close to the surface in any digital inspection.
Building an application that reflects all this
Your Statement of Purpose, policies and interview answers need to describe a digital service, not a physical clinic with the word online inserted. Generic policy packs are the most common failure here: a medicines policy that talks about stock cupboards and controlled drugs registers, but says nothing about remote prescribing decisions, signals immediately that the provider has not thought the model through. Every core policy, consent, safeguarding, medicines, clinical governance and records among them, should answer the remote-specific questions above.
Sequencing a digital registration: what to build when
Digital founders usually come to registration with a product timeline already in motion, and the regulatory work goes better when it is sequenced against the build rather than bolted on at the end.
Before you apply, three things need to genuinely exist: the clinical model, documented as the patient journey with named decision points; the leadership, meaning a registered manager candidate and a clinical lead who can each survive an interview about the model; and the governance paperwork, policies, prescribing formulary decisions, safeguarding pathways and record-keeping arrangements written for remote care. CQC assesses what exists, not what the pitch deck promises, so applying before the clinical governance is real wastes the application.
During the application window, expect written questions and interviews that drill into the model. This is the period to resist product drift: every change to the clinical scope while the application is under assessment, adding a new condition pathway, a new prescriber type, a new patient group, risks making your submitted documents inaccurate. Freeze the regulated scope until the certificate arrives, and version-control the documents you submitted so everyone answers questions from the same text.
After registration, the discipline inverts: now the certificate constrains the product. New services need checking against your registered activities before launch, not after, and material changes to the model may need a variation application. Digital teams iterate weekly; registrations do not. The providers who stay out of trouble give someone explicit ownership of the question “does this release change what we are registered to do?”, and make that person hard to overrule in a sprint planning meeting.
What to do now
- Write down your patient journey from first contact to discharge, including every point where a clinician makes a decision. That map tells you your regulated activities.
- Check CQC’s scope guidance for remote and digital services against your model, and record the reasoning behind your conclusions.
- Choose your registered location on the basis of where the service is really managed.
- Commission or adapt policies written for remote care, and be ready to show how prescribing safety and remote safeguarding work in practice.
- Prepare your registered manager and clinical lead for interview questions about oversight of a workforce they may never meet in person.
How Cura Compliance can help
We prepare digital healthcare registrations through our CQC registration support service, including clinics that came to us after a refusal. Our CuraFlow policy libraries include a library written specifically for online GP and digital healthcare providers, covering remote prescribing, remote safeguarding and digital clinical governance. If you are choosing between service models, our guide on becoming a CQC registered clinic is a useful companion read.
One caution on the market itself. Investors and founders often plan national scale from day one, and nothing in registration prevents a digital service treating patients across England. But scale amplifies every clinical governance weakness: a flawed prescribing pathway used two hundred times a day generates harm, complaints and regulatory attention at a pace no physical clinic can match. Register the model you can govern today, and grow the governance ahead of the patient volume rather than behind it.
Frequently asked questions
Do online GP services need to be registered with CQC?
Yes, if they carry on a regulated activity in England. Diagnosing, treating and prescribing for patients remotely falls within regulated activity, so almost all genuine online GP and prescribing services need registration before they treat their first patient.
What regulated activities does an online clinic apply for?
Most commonly treatment of disease, disorder or injury, often alongside transport services, triage and medical advice provided remotely, and sometimes diagnostic and screening procedures. The right set depends on your clinical model, so map the patient journey before you apply.
What location does a digital healthcare service register?
The place the service is managed from: where governance happens, records are accessible and an inspection can take place. It does not need to be a clinic, but it does need to be real.
Will CQC inspect an online service?
Yes. CQC assesses and inspects digital providers, with particular attention to prescribing safety, safeguarding in remote consultations, information sharing with NHS GPs and clinical oversight of remote staff.
Can CQC take action against an online provider?
Yes. Online providers have faced enforcement including conditions, suspension and cancellation where prescribing or safeguarding was unsafe. Operating a regulated service without registration at all is a criminal offence.
Do prescribing pharmacists and nurses change what we register for?
The regulated activities attach to what the service does, not to which profession does it. A service where non-medical prescribers consult and prescribe is still providing treatment of disease, disorder or injury. What changes is the evidence: expect scrutiny of scope of practice, prescribing governance and clinical supervision arrangements for each prescriber type you use.
Sources
- The Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Schedule 1 (legislation.gov.uk, accessed September 2026)
- CQC guidance on the scope of registration, including remote triage and medical advice (cqc.org.uk, accessed September 2026)