Clinic governance self-check.

This is the web version of my clinic governance self-check, for registered managers, clinical leads and anyone else responsible for governance in a clinic that offers cannabis-based medicines. If you'd rather work on paper, download the printable version (PDF, 4 pages). It has the same fifteen areas, with tick boxes, a score for each area and a summary table to keep.

How should you use this self-check?

Together, and honestly. Sit down with the registered manager, the clinical lead, a prescriber and a nurse, and for each statement ask two things: is it in place, and could we show an inspector? “Partly” is a useful answer, and “not sure” is a finding in itself.

Each statement is marked with what kind of expectation it is:

• Law: a legal requirement in at least one UK nation. “What good looks like” names the law, and says where Scotland and England differ.
• Standard: a professional regulator’s standard, such as the GMC’s. Not law, but your clinicians are held to it.
• Guidance: good practice from government guidance, professional bodies or my own experience. Not law, but inspectors look for it.

It covers services registered with Healthcare Improvement Scotland (HIS) and the Care Quality Commission (CQC). The right regulator is the one for the nation your service is run from, not where your patients live. Wales and Northern Ireland have their own regulators, Healthcare Inspectorate Wales and the Regulation and Quality Improvement Authority, and their own rules, which this doesn’t cover. I’ve used short names for the law in the text; the sources at the end give the full titles and links.

Is your registration right for what you do?

It needs to be with the regulator for the nation you run the service from, and it needs to cover everything you actually do, remote consultations included. Inspectors also check that you tell them about changes, and about certain incidents, on time.

Can you say yes to these?

• Law: The service is registered with the regulator for the nation it is run from, and everything you do, remote consultations included, is within that registration and its conditions.
• Law: A registered manager is in post, and the regulator was told about the appointment and about any change or long absence.
• Law: Notifications and returns reach the regulator on time, and staff know the triggers (in Scotland, for example, controlled drug incidents within 2 working days).
• Law: In Scotland, the HIS certificate is displayed at each premises and the main office. In England, once rated, your latest CQC rating is shown on your premises and website.

What good looks like: you’re registered with the regulator for the nation you run the service from, for exactly what you do, and you can show it on the day.

• Scotland: registration with HIS under the National Health Service (Scotland) Act 1978, sections 10P, 10Q(2) and 10Z9. A new manager is notified to HIS under the HIS Requirements Regulations 2011, regulation 14. HIS sets the records, notifications and annual returns it expects under the HIS Registration Regulations 2011, regulation 5, and its notification guidance. The certificate is displayed under section 10Q(5) of the 1978 Act.
• England: registration with the CQC under the Health and Social Care Act 2008, section 10. The registered manager, absences, changes and notifications are covered by the CQC Registration Regulations 2009, regulations 5 and 14 to 18. Your rating is displayed under the Regulated Activities Regulations 2014, regulation 20A.

Is every prescribing decision made by a doctor on the Specialist Register?

It has to be. By law, an unlicensed cannabis-based medicine can only be prescribed under the prescription or direction of a doctor on the GMC Specialist Register, so check each prescriber’s entry rather than assume it.

Can you say yes to these?

• Law: Every unlicensed cannabis-based medicine is prescribed under the prescription or direction of a doctor on the GMC Specialist Register, checked when they join and every year.
• Guidance: Each specialist decides only within their own area of practice and training.
• Standard: Any later prescriptions by other prescribers follow a written shared care arrangement that sets out the specialist’s direction and when to refer back.
• Law: Private controlled drug prescriptions use the right form and prescriber number (FP10PCD in England, the Health Board’s PPCD(1) in Scotland), and indemnity covers all practice.

What good looks like: every decision to prescribe is made by a doctor on the GMC Specialist Register, working in their own field, and you check that rather than assume it.

• Scotland and England: the Misuse of Drugs Regulations 2001, regulation 16A(1)(a) and (6) for the Specialist Register, and regulation 15(1)(aa) and (ab) for the private prescription form and prescriber number. The GMC’s Good medical practice, paragraph 101, covers indemnity, and its prescribing guidance, paragraphs 73 to 81, covers shared care.
• Scotland: the Scottish CMO letter of 2018 expects a specialist to prescribe only within their own area of practice and training.
• England: NHS England’s guidance expects the same, and advises that prescriptions are initiated and signed by a specialist doctor, so be clear how any shared care fits with that.

Are screening and team review real clinical decisions?

They should be. A questionnaire on its own isn’t screening, and a review meeting that agrees with everything isn’t a review. Inspectors look for the reasoning in the record and the discussion in the minutes, not just the outcome.

Can you say yes to these?

• Guidance: A clinician, usually a nurse, screens every referral before a consultation is booked, uses the same validated tools each time and records the reasoning.
• Standard: The prescriber has the patient’s relevant records (a GP summary or equivalent) before prescribing.
• Guidance: A multidisciplinary team (MDT) of more than two clinicians agrees every new prescription before it is issued, and the minutes record the discussion, not just the outcome.
• Guidance: Higher-risk cases (a history of psychosis, substance use, complex medicines, high-THC plans) get closer MDT scrutiny and contact with the patient’s other specialists.

What good looks like: screening is a clinical judgement rather than a form, and your MDT records real discussion and sometimes says no, or not yet.

• Scotland and England: the GMC’s prescribing guidance, paragraph 59, says a doctor must not prescribe controlled drugs without access to relevant information from the patient’s records, apart from the exceptions it sets out.
• Scotland: the CMO letter of 2018 says the decision to prescribe should be agreed by the multidisciplinary team, and expects clinicians outside the NHS to follow equivalent processes.
• England: NHS England’s guidance says decisions to prescribe should be based on a multidisciplinary team discussion, with equivalent processes expected outside the NHS.

Do patients know what they’re agreeing to?

They need to, before anything is prescribed. Consent to an unlicensed medicine has to cover the material risks, the alternatives and the limits of the evidence, and patients need the practical information too.

Can you say yes to these?

• Law: Consent covers material risks, alternatives, the unlicensed status, the limits of the evidence, and a time-limited trial with agreed outcome measures.
• Guidance: Written information on driving, workplace testing, travel, storage at home, stock shortages and stopping is given before treatment starts, and you record it.
• Law: Staff know which capacity law applies and follow it: the Adults with Incapacity (Scotland) Act 2000, or the Mental Capacity Act 2005 in England and Wales.
• Standard: Patients get named contacts and the full costs before they commit, and know they can use any pharmacy able to dispense.

What good looks like: patients understand what they’re agreeing to before treatment starts, including the awkward bits, and you can show they had the information.

• Scotland and England: Montgomery v Lanarkshire Health Board [2015] UKSC 11, a Scottish case decided by the UK Supreme Court, sets the test for material risks. The GMC’s prescribing guidance, paragraphs 105 to 108, covers information about unlicensed medicines, and paragraph 62 the names and contact details of the people involved in a patient’s care.
• Scotland: the Adults with Incapacity (Scotland) Act 2000, Part 5, including the certificate of incapacity under section 47.
• England: the Mental Capacity Act 2005, which extends to England and Wales only (section 68(4)).

Do you meet the rules on unlicensed medicines and controlled drugs?

Both sets of rules apply, because unlicensed cannabis-based medicines are specials and Schedule 2 controlled drugs. You should be able to show why each product was chosen for that patient, and name the accountable officer who oversees your prescribing.

Can you say yes to these?

• Law: Each prescription meets a named patient’s special needs, records why a licensed medicine won’t do, and meets the Schedule 2 prescription rules.
• Law: You know which controlled drugs accountable officer (CDAO) oversees your prescribers, answer their requests and report concerns to them.
• Law: If you hold any stock (remote clinics often don’t), you keep a controlled drugs register and follow the storage and destruction rules. In Scotland, HIS needs a month’s notice before a service introduces controlled drugs, and that includes prescribing them for supply by a community pharmacy.
• Standard: No commercial interest affects the choice of product or pharmacy, interests are declared, and nobody is steered to one pharmacy without a clinical reason.

What good looks like: you can show why each unlicensed product was chosen for that patient, and you know who oversees your controlled drug prescribing.

• Scotland and England: the Human Medicines Regulations 2012, regulation 167 (specials), and the Misuse of Drugs Regulations 2001, regulations 15 and 19. The GMC’s prescribing guidance, paragraphs 103 to 105, covers unlicensed medicines, and Good medical practice, paragraphs 94 to 96, covers interests.
• Accountable officers: the Controlled Drugs Regulations 2013, regulations 3 to 8, apply in England and Scotland only. Independent hospitals with 10 or more people working there appoint their own CDAO. Prescribers in other clinics come under NHS England in England, or the Health Board for the area they work in, in Scotland.
• Scotland: the HIS notification guidance asks for a month’s notice before a service introduces controlled drugs.

Is follow-up planned, or does it depend on the patient chasing?

It should be planned from the start. A named follow-up booked before the patient leaves, and a nurse-led review service doing the routine work, means problems are spotted early and outcomes actually get recorded.

Can you say yes to these?

• Guidance: A follow-up date and a named contact are booked before the patient leaves, and the specialist sees them at least at the initial follow-up.
• Guidance: Reviews come every 2 to 4 weeks while the dose is adjusted, then about every 3 months once stable, using the same outcome measures each time.
• Guidance: Nurse-led reviews follow a written protocol with escalation to a prescriber and written criteria for reducing or stopping, and missed reviews are chased.
• Standard: The GP is told what was prescribed, why, for how long and who is monitoring it.

What good looks like: every patient leaves the initial consultation with a named follow-up already booked, and a nurse-led review service does the routine work so consultants see the patients who need them.

• Scotland and England: the GMC’s prescribing guidance, paragraph 55, on telling the GP about new medicines, the reasons, the length of treatment and who will monitor it. The review intervals are good practice from professional guidance and my own experience, not law.
• Scotland: the CMO letter of 2018 expects prescribers to keep a detailed record of clinical and patient outcome measures.

Would everyone know what to do with a safeguarding concern?

They should, on the day it arises: who to tell, how to refer and how to record it. Referral routes and vetting schemes differ between Scotland and England, so your policy needs to follow your nation’s law.

Can you say yes to these?

• Law: A safeguarding policy names a lead and the local referral routes for adults and children under your nation’s law, and concerns reach the regulator on time.
• Law: In Scotland, PVG membership for regulated roles (membership lasts five years for anyone joining since 1 April 2026), and nobody barred works in the service. In England, DBS checks suited to the role.
• Guidance: Assessment asks about children or vulnerable adults at home and about safe storage, and staff are trained to the level their role needs.

What good looks like: everyone knows what to do with a concern on the day it arises, who to tell, and how to record it.

• Scotland: the Adult Support and Protection (Scotland) Act 2007, the National Guidance for Child Protection in Scotland 2021 (updated 2023), and the HIS Requirements Regulations 2011, regulations 3, 8 and 9. PVG scheme membership comes under the Protection of Vulnerable Groups (Scotland) Act 2007. HIS asks to be told about public protection concerns within 24 hours.
• England: the Regulated Activities Regulations 2014, regulation 13 (safeguarding) and regulation 19 (fit and proper persons employed).

Are all suspected side effects reported?

For cannabis-based medicines, the MHRA asks for all of them, serious or not, including lack of effect. Patients should know they can report too.

Can you say yes to these?

• Guidance: All suspected reactions, serious or not and including lack of effect, go to Yellow Card, naming the manufacturer and stating that the product is unlicensed.
• Standard: Patients are told how to report side effects themselves, and reactions are shared with the GP, the pharmacy and, where relevant, the CDAO.
• Guidance: A side effect log, with Yellow Card references, is reviewed every month for patterns.

What good looks like: every suspected side effect is reported, not only the serious ones, and patients know they can report too.

• Scotland and England: the MHRA’s guidance on unlicensed cannabis-based products asks for all suspected adverse reactions to be reported through the Yellow Card scheme, including failure of efficacy. The GMC’s prescribing guidance, paragraphs 86, 88 and 90, covers reporting, telling patients how to report, and sharing reactions with others.
• Scotland: the CMO letter of 2018 also asks for all suspected adverse reactions to be reported to Yellow Card.

Do incidents get reported, and do you follow the duty of candour?

Both are legal duties. An incident system only works if people use it, so make reporting safe and look at the log every month. The statutory duty of candour works differently in Scotland and England.

Can you say yes to these?

• Law: Staff use an incident and near miss system that is reviewed monthly, with actions followed through.
• Law: Duty of candour is followed. In Scotland, it applies to providers that are not individuals, with an annual report published and HIS told. In England, regulation 20 applies.
• Guidance: Controlled drug incidents and medication errors are investigated, shared with the CDAO and notified to the regulator where required.

What good looks like: incidents get reported because nothing bad happens to the person who reports them, and someone looks at the log every month.

• Scotland: the HIS Requirements Regulations 2011, regulation 13(2)(a), requires a system to manage risk. The duty of candour comes from the Health (Tobacco, Nicotine etc. and Care) (Scotland) Act 2016, sections 21 to 25, and the Duty of Candour Procedure (Scotland) Regulations 2018. The statutory duty applies to a provider that is not an individual, so a sole trader is outside it, but the professional duty of candour still applies to every registered clinician. HIS asks to be told about controlled drug incidents, and certain drug errors, within 2 working days.
• England: the Regulated Activities Regulations 2014, regulation 17(2)(b) (managing risk) and regulation 20 (duty of candour).
• Scotland and England: the GMC’s prescribing guidance, paragraph 90, on reporting to the local CDAO where appropriate.

Does your complaints process meet the rules?

It needs a clear owner, a deadline and an escalation route. In Scotland the regulations set the deadline and what the written procedure must say.

Can you say yes to these?

• Law: Every patient gets the written complaints procedure. In Scotland it includes HIS’s name and address and how to complain to HIS.
• Law: Complaints are fully investigated, action is confirmed within 20 working days in Scotland, and a 12-month summary is ready if the regulator asks.
• Guidance: Complaints are reviewed for themes, learning is shared, and patients are told their next step (in England, ISCAS if you subscribe).

What good looks like: a complaints process with a clear owner, a deadline and an escalation route, not one person’s inbox.

• Scotland: the HIS Requirements Regulations 2011, regulation 15: a written procedure that names HIS, full investigation, action confirmed within 20 working days, and a 12-month summary for HIS on request.
• England: the Regulated Activities Regulations 2014, regulation 16, including a summary for the CQC on request. The CQC says patients of a private provider that subscribes to the Independent Sector Complaints Adjudication Service (ISCAS) can take an unresolved complaint there.

Are your records complete, and is patient data handled lawfully?

Every patient needs a record made at the time, and health data has extra protection under data protection law. You should know where every copy of a patient’s data goes.

Can you say yes to these?

• Law: Each patient has a record, made at the time, of every consultation, its outcome, treatment and medicine.
• Law: A lawful basis and an Article 9 condition for health data, a record of processing, impact assessments where risk is high, a current privacy notice, and the fee paid.
• Law: Requests for records are answered free and usually within a month, and data protection complaints are acknowledged within 30 days.
• Guidance: Retention follows your nation’s records code, and sharing with pharmacies, registries and researchers is covered by agreements.

What good looks like: records are complete, made at the time and easy to find, and you know where every copy of a patient’s data goes.

• Scotland: the HIS Requirements Regulations 2011, regulation 4 (the Patient Care Record), and the Scottish Government’s Records Management Code of Practice for Health and Social Care, version 4.0 (2024).
• England: the Regulated Activities Regulations 2014, regulation 17(2)(c), and NHS England’s Records Management Code of Practice.
• Scotland and England: UK GDPR Articles 6, 9, 12, 13, 15, 30 and 35, with the one-month time limit in Article 12A. The Data Protection Act 2018, section 164A, sets the 30 days for acknowledging complaints, and the Data Protection (Charges and Information) Regulations 2018, regulation 2, the fee, now paid to the Information Commission.

Can you show that everyone is registered, trained and supervised?

You need to be able to show it for everyone who works in the service, including people you don’t employ directly.

Can you say yes to these?

• Law: Registration (GMC, NMC, GPhC) and indemnity are checked at appointment and every year, and each person’s skills and experience fit the role.
• Law: Everyone has an induction, appraisal and training for their work, and people you don’t employ directly are supervised.
• Guidance: Prescribers complete recognised training before initiating and take part in peer review, and nurses are signed off as competent for screening and review.

What good looks like: you can show that everyone is registered, trained for the role they actually do, and supervised.

• Scotland: the HIS Requirements Regulations 2011, regulation 8 (fitness of employees) and regulation 12 (staffing, appraisal, training and supervision).
• England: the Regulated Activities Regulations 2014, regulation 18 (staffing) and regulation 19 (fit and proper persons employed).
• Scotland and England: the GMC’s Good medical practice, paragraph 101, on indemnity that covers the full scope of a doctor’s practice.

Do your policies describe what you actually do?

They should, and each one needs an owner and a review date. The law in both nations expects written systems and procedures, and a policy nobody follows won’t satisfy an inspector.

Can you say yes to these?

• Law: Written procedures cover medicines and controlled drugs, safeguarding, consent, complaints, incidents, records, eligibility and MDT, and follow-up.
• Guidance: Every policy has an owner, a version, a date and a review date, and none is overdue.
• Guidance: A change in law or guidance triggers a review, and staff confirm they’ve read the policies that apply to them.

What good looks like: policies describe what you actually do, each has an owner and a review date, and staff can find them.

• Scotland: the HIS Requirements Regulations 2011, regulation 3(d), on systems, processes and procedures, including the management of medication.
• England: the Regulated Activities Regulations 2014, regulation 17 (good governance).
• Where you have your own CDAO: the Controlled Drugs Regulations 2013, regulation 11(3)(c), on up to date standard operating procedures for controlled drugs.

Do you check your own work?

You should, on a cycle people actually complete. In both nations the law expects you to review the quality of your service, with patients’ input, and keep a record of it.

Can you say yes to these?

• Law: You review the quality of the service with patients’ input and keep a written record (in Scotland, available to HIS and to patients).
• Guidance: An annual audit programme with named leads covers consent, screening, prescribing, MDT decisions, follow-up and outcomes.
• Guidance: Every audit ends with an action plan, and a re-audit shows whether it worked.

What good looks like: a short annual audit cycle that people actually complete: consent, screening, prescribing against criteria, follow-up attendance and outcomes.

• Scotland: the HIS Requirements Regulations 2011, regulation 13(2)(b) and (c).
• England: the Regulated Activities Regulations 2014, regulation 17(2)(a) and (e).

Does your website promote a service, not a medicine?

It has to. Unlicensed medicines can’t be advertised at all, and prescription only medicines can’t be advertised to the public. You can describe your consultation service, your regulator and how your process works.

Can you say yes to these?

• Law: No public material names a product, brand, strain, THC percentage or medicine price, or invites people to “get a prescription”.
• Law: It’s clear that a consultation may or may not lead to a prescription, with no claims that treatment works, is safe, natural or guaranteed, and no outcome stories.
• Guidance: Your website names your regulator, links to your register entry, explains how to complain, and lists only services you’re registered for.
• Guidance: Someone trained checks new pages, adverts and social posts against these rules before they go out, and keeps a record.

What good looks like: your website and social media promote a consultation service, never a medicine, and a patient can find your regulator and complaints route in two clicks.

• Scotland and England: the Human Medicines Regulations 2012, regulations 167(3), 279 and 284 to 288, and the MHRA’s Blue Guide, Appendix 6, which says it should be clear that a consultation may or may not lead to a prescription.
• Scotland: your conditions of registration under the 1978 Act, section 10Q(2).
• England: the Regulated Activities Regulations 2014, regulation 20A, once you have a CQC rating to show.

What should you do with the gaps?

Start with the law, then give every other gap an owner and a date.

• Begin with any statement marked Law that you answered no or not sure, whatever the rest of the area looks like. Those are the gaps that can lead to a requirement from HIS or action by the CQC.
• Then work on the areas where you found several gaps.
• Turn each gap into an action with an owner and a date. Keep a record of what you found: it helps with the self-evaluation HIS asks for, and it shows the CQC you know where you stand.
• Do it again in six months, or sooner if the law, your registration or your service changes. It doesn’t replace your regulator’s own framework.

Regulators don’t expect perfection. They expect you to know where you’re weak and to be doing something about it.

The printable version (PDF, 4 pages) puts all fifteen areas on four sides of A4, with tick boxes, a score for each area and a summary table to keep with your governance records. If you’d like a second pair of eyes, get in touch.