FOI release
Data governance for CBPM specialist pharmacies and ‘specials’ manufacturers
Some or all of the information requested was not provided because we didn't hold it.
Case reference FOI2025/01333
Received 28 December 2025
Published 5 February 2026
Request
Please treat this as a request for recorded information under the Freedom of Information Act 2000. This request concerns regulatory expectations around record keeping, data protection and privacy notices for pharmacies, clinics and manufacturers supplying unlicensed medicines under the “specials” framework, with particular reference to cannabis-based products for medicinal use in humans (CBPMs). I am not requesting any patient-level data. I am interested only in policies, guidance, statistics and correspondence. Guidance and expectations for “specials” licence holders and CBPM suppliers 1.1 Please provide copies of any current internal guidance, SOPs, inspector training materials or policy documents which set out MHRA’s expectations regarding: a) Record keeping and data retention for the manufacture, supply and distribution of unlicensed medicinal products (“specials”), including unlicensed CBPMs. b) How holders of Manufacturing “Specials” (MS) licences and other suppliers using patient-facing portals or online forms are expected to describe their data processing in privacy notices or patient information, particularly where health data and controlled drug information is collected directly from patients. If no such documents exist, please confirm this. Risk assessments and internal discussion of CBPM clinic and pharmacy data risks 2.1 Since 1 January 2018, please provide copies of any internal MHRA briefing notes, risk assessments, or policy papers that: a) Discuss data protection, record keeping or information governance risks associated with specialist CBPM clinics or distance-selling pharmacies in the private sector, and b) Refer specifically to unlicensed CBPMs supplied under the “specials” framework. Liaison with other regulators about data protection at CBPM suppliers 3.1 Since 1 January 2018, please confirm whether MHRA holds records of any referrals, notifications or correspondence with: a) The Information Commissioner’s Office (ICO), b) The General Pharmaceutical Council (GPhC), or c) NHS England or its predecessor bodies, where the subject matter includes concerns about data protection, privacy notices, record keeping or patient-facing portals operated by manufacturers, pharmacies or clinics involved in supplying unlicensed CBPMs. 3.2 For each regulator listed above, please provide, by calendar year, the number of such referrals or items of correspondence held, and copies of any documents you are able to disclose, redacted as necessary to remove personal data. Inspection findings: records, IT systems and privacy notices 4.1 For each calendar year from 2018 to 2025, please provide: a) The number of MHRA inspections of Manufacturing “Specials” licence holders where the scope included the manufacture, importation or supply of unlicensed CBPMs. b) For those inspections, the number which recorded deficiencies or observations (of any grading) in relation to: i. Record keeping or traceability of supply, ii. IT systems or data security, iii. The accuracy or adequacy of patient-facing privacy information or consent processes. If you do not hold these statistics in a pre-compiled form, please confirm whether any internal summaries, dashboards or reports exist that aggregate inspection findings in a way that would answer this question. Records specifically mentioning IPS Pharma 5.1 IPS Pharma publicly states that it is a manufacturer and supplier of unlicensed medicines and “specials” and operates patient-facing services via its website and portal. Its published privacy notice, as accessed in 2025, still carries 2018 implementation wording and transitional GDPR language, despite the later launch of a patient portal that collects detailed medical and payment information. Without requesting any patient data, please provide: a) Copies of any inspection reports, deficiency letters, warning letters, or other enforcement correspondence issued by MHRA to IPS Pharma Limited (or associated entities trading as IPS) since 1 January 2018 where data governance, record keeping, privacy notices, portals or information provided to patients are mentioned. b) Copies of any internal MHRA emails, memos or briefing notes since 1 January 2018 in which IPS Pharma is discussed in the context of information governance, privacy notices or patient portals, redacted as required to remove personal data or legally privileged content. If you consider that any of the requested information is exempt from disclosure, please: Specify which exemptions you are relying on for each withheld item, and Explain, where applicable, how the public interest test has been considered.
Response
See attached
Documents
This is Medicines and Healthcare products Regulatory Agency's response to a freedom of information (FOI) or environmental information regulations (EIR) request.
You can browse our other responses or make a new FOI request.