Regulatory governance for care delivered at a distance.
Oxara supports providers of online and hybrid primary care to test whether their clinical model, patient pathway and governance arrangements remain safe, coherent and defensible when care is delivered remotely.
Online care is not a lighter version of clinical care
Online primary care changes where and how information is obtained, not the provider's responsibility for the care delivered.
A clinician may be working from a video consultation, telephone call, secure message or structured online questionnaire rather than a consulting room. That changes what can be observed, what can be examined and how deterioration, safeguarding concerns and uncertainty must be managed.
For the provider, the regulatory question is therefore wider than whether the platform works or the clinician is registered. It is whether the service model itself has been designed and governed for remote care: who the service is suitable for, what it will not manage, when remote assessment must stop, how patients are escalated, how information is shared and how leaders know the system is working.
CQC operates a specific online primary care service category for independent-sector providers delivering primary medical care purely as a standalone online service, distinct from wider regulated services that incorporate remote or hybrid care, and its current registration requirements specifically require evidence of online-service inclusion and exclusion criteria, medical-emergency arrangements and indemnity covering online services.
The medium changes. The standard of care does not.
Professional standards apply equally to remote and face-to-face consultations. Where safe care cannot be delivered remotely, the mode of consultation must change.
For providers whose clinical pathway begins, continues or ends remotely.
Oxara's work may apply to:
- standalone online primary care services;
- virtual GP and primary medical services;
- hybrid clinics combining remote and face-to-face assessment;
- services using structured questionnaires or asynchronous clinical review;
- services extending an existing clinical model into remote delivery;
- providers changing their scope, regulated activities, patient cohort or consultation model.
The key issue is not whether a provider describes itself as a “digital health company”. It is whether regulated care is being organised or delivered remotely and whether the provider's governance reflects that reality.
A safe digital service has to work from first contact to final follow-up.
| Stage | What the service must be able to demonstrate |
|---|---|
| 1 — Access & Identity | Who is accessing the service, where are they located, what information is obtained before consultation, and how is identity verified? |
| 2 — Selection & Triage | Is this patient, presentation and clinical need appropriate for the service and for the chosen consultation method? |
| 3 — Clinical Assessment | Can the clinician obtain enough reliable information remotely to make a safe decision, or is examination, investigation or face-to-face review required? |
| 4 — Escalation & Treatment | What happens when the patient falls outside the service's criteria, deteriorates, needs emergency care, requires onward referral or cannot safely be managed remotely? |
| 5 — Record, Follow-up & Continuity | What is recorded, what is communicated to the patient and their usual clinician, what follow-up is required, and who remains responsible for outstanding actions? |
Remote models fail when the written pathway and the clinical reality separate.
The service must define who it can safely treat remotely and who it cannot. Inclusion and exclusion criteria should reflect the actual patient groups, presentations and conditions the service will and will not manage, and what happens when the service is not appropriate for a person's needs.
Remote care must remain clinically appropriate for the individual patient and presentation. Where physical examination or another form of assessment is required to provide safe care, the patient must be moved into an appropriate pathway.
A remote clinician may not know the patient's exact location or have anyone physically present to assist. The provider needs a workable escalation process, not a medical-emergency policy copied from a physical clinic.
Remote consultation can remove environmental and non-verbal cues. Providers need arrangements for identifying and responding to safeguarding concerns, vulnerability, capacity issues and consultations where another person may be influencing the interaction.
Remote services can create fragmented records. Where the clinician is not the patient's usual doctor, the provider needs arrangements for obtaining and sharing relevant information, documenting decisions and maintaining safe continuity of care.
Leaders must be able to show how they know clinicians are working within the service model: audit, record review, incidents, complaints, deviations from criteria, supervision and action taken when the system does not work as intended.
We test whether the governance survives contact with the clinical record.
Policies matter, but digital-service assurance cannot stop at policy review. Oxara compares the documented model with the evidence generated by actual care.
- registration and regulated-activity scope;
- statement of purpose;
- model of care;
- inclusion and exclusion criteria;
- triage and escalation protocols;
- medical-emergency arrangements;
- safeguarding;
- consent and capacity arrangements;
- indemnity;
- clinician recruitment, competence and oversight;
- complaints, incidents, audits and governance minutes.
- consultation records;
- application of inclusion/exclusion criteria;
- documented clinical reasoning;
- decisions to continue remotely or escalate;
- safety-netting and follow-up;
- communication with usual clinicians;
- handling of safeguarding concerns;
- exceptions, overrides and deviations;
- evidence that identified problems resulted in action.
Online primary care now carries service-specific registration evidence requirements.
For online primary care applications submitted from 22 June 2026, CQC requires, in addition to the documents required of all providers:
- Inclusion and exclusion criteria policy
- Medical emergency policy
- Medical indemnity insurance quote or policy covering online services
- Additional form for online primary care providers
Oxara's role is not merely to check that these documents exist. The more important question is whether they accurately describe the proposed service and are capable of being implemented in practice.
Planning a new online service or changing an existing model? We can review the regulatory position, patient pathway and governance before you proceed.
Discuss Your Online Primary Care ModelStart with the service model. Then follow the evidence.
1. Establish the model
We map what the provider says it delivers: patient cohort, consultation channels, regulated activities, clinical workforce, exclusions, escalation routes and third-party dependencies.
2. Follow the patient pathway
We examine how a patient moves through the service from access and triage to assessment, treatment, escalation and follow-up.
3. Test governance against records
Policies, protocols and leadership assurance are compared with clinical records, incidents, complaints, audits and staff practice.
4. Identify regulatory exposure
Findings distinguish between documentary weakness, operational drift, clinical-governance risk and matters requiring immediate correction.
5. Build defensible remediation
Where improvement is required, actions are prioritised around what needs to change in practice, what evidence must demonstrate that change and how leaders will know it has been sustained.
Support can begin before registration or after regulatory concern has emerged.
Regulated-activity and service-model alignment, registration evidence, governance framework and operational readiness.
Review before introducing a new consultation channel, patient cohort, clinical pathway or remote-delivery model.
Independent testing of whether records, governance and practice support the provider's stated model.
Targeted review after a significant event, complaint, safeguarding concern or evidence of pathway failure.
Evidence review and corrective governance following CQC findings or enforcement activity.
Outputs may include: regulatory gap analysis, evidence-mapped findings, patient-pathway review, governance and record review, prioritised remediation plan, registration/readiness assessment and follow-up assurance.
Regulatory and governance advisory, with clear professional boundaries.
Oxara does not provide medical care to patients, make prescribing decisions on behalf of clinicians, provide legal advice, certify software platforms or provide cybersecurity certification.
Where an instruction requires legal advice, specialist information-security assurance, medical-device advice or another regulated professional input, that dependency is identified and can be incorporated into the wider workstream where appropriate.
Provider and clinician responsibilities remain with the organisation and the relevant registered professionals.
Where this work connects.
Strengthening governance systems and the evidence that demonstrates leadership oversight of a regulated service.
Independent testing of whether a provider's evidence, governance and practice would withstand inspection.
Online primary care and regulation.
Does every online medical service require CQC registration?
Not necessarily. Registration depends on who is providing the service, what regulated activities are being carried on and how the service is structured. CQC operates a specific online primary care service category in England for independent-sector providers delivering primary medical care purely as a standalone online service; wider regulated services that incorporate remote or hybrid care fall outside that category. The correct regulated-activity and location position needs to be established for the actual model.
What should inclusion and exclusion criteria cover?
They should define the assessment process, conditions and patient groups the service will and will not manage, and what happens when the service is not appropriate for the person's needs. CQC specifically requires this policy from online primary care applicants.
When should a remote consultation become face to face?
When the clinician cannot meet the required standard of safe care remotely—for example where examination is required, the patient's needs cannot adequately be assessed through the chosen medium or the information available is insufficient.
What should a remote medical-emergency pathway address?
It should reflect the realities of remote delivery: identifying the patient's location, recognising deterioration, obtaining urgent assistance, directing the patient to emergency services, documenting the event and learning from it.
Does an online provider need to communicate with the patient's usual GP?
Continuity of care is a significant consideration. Where the clinician is not the patient's usual GP, relevant information may need to be obtained and treatment information shared where appropriate and with the necessary consent. Where information cannot be obtained or shared, the clinician must consider whether treatment remains safe and document the decision.
Can Oxara prepare a provider for CQC registration or inspection?
Yes, where that is the agreed scope, but the work goes beyond document preparation. Oxara tests whether registration, governance, clinical records and operational practice describe the same service and whether the provider can evidence that the model is operating safely.
Discuss your online primary care model with Oxara.
Whether you are preparing a new service, changing an existing model or responding to regulatory concern, speak directly with Oxara about the clinical pathway, governance position and evidence required.