Know Your Patient Process Explained [Under the GPhC’s guidance]

How do you make sure that a patient qualifies to buy a restricted medicine? Or that someone requesting the results of a blood test online is who they claim to be?

Know Your Patient (KYP) is the process that verifies the identity of patients. This article covers how your business can carry it out, and the use cases that may apply to your healthcare business.

What is Know Your Patient (KYP)?

Ever wondered why doctors and medical offices ask patients to show identification?

Know Your Patient is identity verification applied to healthcare, confirming that the person ordering a restricted medicine or requesting a test result is who they claim to be. This also makes sure that only the right person has access to sensitive medical records and avoids unauthorized personnel from knowing about vulnerabilities of a person.

Medical staff need to know who they are treating, much as a bank runs know your customer checks when someone applies for a loan or opens an account.

Hospitals require credentials from patients for several reasons, including securing medical data, preventing health insurance fraud and protecting the patient’s identity.

Digital identity verification in healthcare does real work here.

The General Pharmaceutical Council (GPhC) of the UK publishes guidance for registered pharmacies providing pharmacy services at a distance, including on the internet. The current version was issued in February 2025, replacing the 2019 edition. It was updated in response to concerns about inappropriate supplies of medicines, including those used for weight management.

The 2025 update focuses on the consultation rather than on the checkout. Pharmacies are expected to verify the information a person provides in an initial questionnaire rather than accept it at face value, and to enable two-way communication between that person and the prescriber. Identity is part of that picture, because verifying what someone has told you is difficult if you cannot establish who they are.

So how do you confirm that an online order for diabetes medicine was placed by someone holding an authentic prescription from a qualified doctor? Online identity verification addresses that problem. KYP looks like a restriction on drug stores, but it also benefits healthcare providers by protecting patient data.

KYP protects both patients and healthcare providers. It is not only patients who need to demonstrate credentials before buying. ID verification for pharmaceutical businesses is also required. Identity theft is not confined to financial services and ecommerce. Healthcare is a primary target too.

Requirements for ID verification in pharmaceuticals are getting stricter worldwide as a result.

KYC, KYP and Age Assurance are not the Same Check

The three get used interchangeably, and they answer different questions. Confusing them is how a pharmacy ends up with a check that satisfies nobody.

One point on the third column. The standard the UK now expects of an age check has moved. Ofcom’s highly effective age assurance duties came into force on 25 July 2025 under the Online Safety Act, with penalties reaching £18 million or 10 per cent of global turnover. Those duties apply to services carrying pornographic and other harmful content, not to online pharmacies, so they are not what obliges a pharmacy to check age. What they have done is settle the question of whether a self-declared date of birth counts as an age check. It does not.

Digital ID Verification for Pharmaceuticals in the United Kingdom

Pharmaceutical services hold extremely personal and sensitive data, which is what makes identity verification necessary rather than optional.

Pharmacy services need to confirm patient identity before supplying medicines that health regulators have restricted.

Verifying customers can look like a burden on a hospital dispensary. In practice a digital check returns in under three seconds, though not every provider delivers the same quality.

Healthcare providers need trusted identity data for real-time verification.

How to Verify Patient Identity?

Patient identifiers support the KYP process. With tools such as face verification or document verification, pharmacies can capture unique features and patient data. That confirms the person is who they claim to be, and establishes a legitimate request for medicine or for test results.

Verifying patient identity also prevents fraud and the misuse of stolen medical data.

ID verification for Pharmacies

Pharmacists need a licence to operate and sell medicine, so this runs in both directions. A genuine patient who arrives at an unlicensed pharmacy can have their data misused. Age verification is often the first step.

Verifying patient age works much like the age verification used by online gaming and other age-sensitive sectors. Depending on the region, there are several ways patient verification helps pharmacies meet their compliance requirements.

Use Cases

KYP has several use cases that protect patient identity and help healthcare businesses confirm they are releasing medical test results to the rightful owner of that information.

Age Verification for Online Prescriptions

How do you establish the age of a person standing in a pharmacy, or ordering online? The GPhC guidance expects pharmacies supplying at a distance to satisfy themselves about who they are dealing with and to verify what that person has told them, rather than relying on the answers alone. Where a medicine carries an age restriction, checking age against a government-issued identity document is the practical way to do that.

Preventing Insurance Fraud

When a patient’s data is compromised, an identity thief can claim falsely using the health insurance ID. The fraudster takes the benefit, and the real claimant is left trying to prove they did not.

What are the Procedures to Verify Patient Identity?

The Know Your Patient process resembles standard identity verification. Businesses use it to open an account or to confirm the identity of someone who has ordered medicine online.

The KYP steps are:

1. The patient uploads a picture of a government-issued identity document such as a driving licence, passport or national ID card, using a smartphone or webcam.
2. They then capture a live selfie. Liveness checks confirm a real person is present rather than a photograph, a replayed video or a generated face, which is what makes the rest of the check meaningful.
3. Verify that the ID document is real, valid and unaltered, and match the person in the selfie against the picture on the document.
4. Confirm the patient meets the minimum age requirement. A background check on the document can also show whether it has been involved in fraudulent activity.
5. Using the results of the four steps above, hospitals, pharmacies and medical offices accept or reject the request for a new online account and any supply order.

Everything collected in those five steps is health-adjacent personal data, so UK GDPR applies to all of it. Lawful basis, retention period and processing location are part of the same design decision as the check itself, and a verification flow that keeps document images indefinitely creates a new liability while closing an old one.

Ongoing KYP with Biometric Authentication

After the initial screening, pharmacies and clinics can accept or reject future requests for online purchases from a selfie alone.

The process is straightforward. At account creation, a biometric template of the person’s face is captured through face verification.

Every time the patient requests an online purchase or a set of test results, they send a live selfie.

That selfie is matched against the template captured at enrolment, with liveness and presentation attack detection running on the new capture. The match is what identifies the patient. The liveness check is what stops a photograph or a generated face from standing in for them, and it is the part worth asking any vendor about, along with the independent testing they have been through.

Regulation for medical facilities and pharmacies continues to tighten, and remote supply is where the scrutiny concentrates. Getting identity right is what lets a pharmacy operate at a distance without lowering the standard of care it would apply across a counter.