Can my employer see my prescription?

Only authorised healthcare providers can access your eScript data. Therefore, Employers do not have access to prescription data unless you choose to disclose information directly. Online Medical Certificates are considered the only documents that you might share with your employer; however, medical certificates typically confirm capacity for work or absence without disclosing prescription history.

Do I have control over who views my prescription?

You certainly have significant control over who sees your presentation. The fact that you receive a token or sign up for an Active Script List only means that a pharmacy can access your data; which pharmacy sees which script is yours is up to you.

Can I change my mind after sharing a token?

Your doctor can always cancel or modify the script if you get in touch with them. Another option is to request that a pharmacy cancel or reissue the prescription through the prescribing system so it can be dispensed elsewhere, which is essentially the same as resetting the consent for that particular dispense.

Is my consent required for every repeat?

The initial consent you gave for that script extends to any authorised repeats that accompany it. But every time you produce a new repeat token at the pharmacy, you are effectively authorising the pharmacist to proceed with dispensing in accordance with pharmacy protocols.

Consent & Data Sharing for eScripts Australia

Key Takeaways

Consent is required for the creation and sharing of digital prescriptions.
Patients have defined rights regarding the sharing of prescription data.
Sharing tokens with carers should be done securely.
Pharmacies access only the relevant prescription data required for dispensing.
Tokens can be cancelled by the prescriber if necessary.
Employers do not have automatic access to prescription information.

As digital technologies are integrated into Australia's healthcare system, your medical records, by nature highly sensitive, are safeguarded by strict laws and regulations. These protections empower you to make informed choices about sharing your personal data. The eScript & Prescription Access Hub operates in accordance with Australian privacy and healthcare legislation, which requires appropriate consent before prescription data is created, uploaded, or accessed.

Understanding consent in the digital era centres on who controls your health data and under what terms. When you remain at the heart of the process, sharing becomes more transparent. Whether lending a token to a relative or authorising pharmacy access, you have defined rights and controls over how your prescription information is shared, in accordance with privacy law.

What Is Consent in Digital Prescriptions?

Consent in digital prescribing refers to your informed, voluntary permission for a doctor's office, or other authorised entities, to collect, use, disclose, or manage your personal health information (PHI) for reasonable, necessary purposes you've agreed to.

Under the Privacy Act 1988 and the Office of the Australian Information Commissioner (OAIC) guidelines, this goes beyond simple agreement; it's a transparent process that lets you understand exactly what data is shared and why, supporting transparency between patients and healthcare providers.

Explicit vs. Implied Consent

Explicit Consent: During a Prime Medic telehealth consultation, your doctor will also seek your consent to generate an eScript that will be delivered directly to your mobile device. This confirms your approval for routing prescription data to the national Prescription Delivery Service.
Lawful Purpose: Data sharing is limited to the safe, accurate administration of your medication. The use of prescription data for secondary purposes is subject to privacy legislation and requires appropriate consent.

For more on the legal safeguards, see our article on privacy rules for storing prescription data.

Who Can Receive Prescription Information?

As digital prescriptions respect patients' authority over their own data, they enable patients to determine where the data should go and who is the most suitable recipient, according to their personal preferences.

Authorised Recipients

Patient: In most cases, you, the patient, are the primary recipient of an eScript Token.
Pharmacies: You decide when to grant your pharmacy access to your information, either by handing over your token or being added to an Active Script List.
Family and Carers: If you choose to share your token with a trusted person, they may present it on your behalf, and the pharmacist may request confirmation of consent where appropriate. This is a common feature for eScripts for seniors and carers.

As always, you must ensure the safe handling of eScript tokens as a measure to avoid unauthorised sharing of your private health data.

Limiting Access to Trusted Contacts Only

You may choose to share your token with trusted individuals; however, you remain responsible for ensuring it is handled securely. If you share your token with relatives and friends, you still need to take responsibility for implementing secure sharing at the next stage. A digital token may be copied if shared through unsecured channels, unlike a physical paper prescription.

Best Practices for Restricted Sharing

Drawing a boundary around the set of people who will be able to see or forward your token:

Secure Messaging: When sharing a token with your carer, instead of using a public social media platform, try an encrypted one.
Verify Recipient Details: Check the phone number or email address once again before sending the message.
Disposal: As soon as your trusted contact has picked up your medication, you should ask them to remove the token from their device to reduce the risk of future unintended access.

Consent for Pharmacy Dispensing

Presenting your eScript token at a pharmacy acts as Point-of-Service Consent. Scanning the token allows the pharmacy system to request access to the relevant prescription record from a PDS pharmacy verification system, where your prescription details are stored.

What the Pharmacist Sees

Upon scanning your consented token, they can view:

The doctor's authorisation to dispense a specific medication.
Your identifiers: name, date of birth, and Individual Healthcare Identifier (IHI).
Any remaining authorised repeats are to ensure the safety of multi-medication.
Access is limited to the relevant prescription information required for dispensing, unless broader access has been authorised through an Active Script List (ASL).

How to Withdraw Consent

One feature of electronic prescribing systems is that patients can regain control at any time. Let us say you have given your token to someone else, but then you decide you should have the right to revoke your consent for that single record. And that is also the case if you suspect that someone else has already obtained your token.

Revocation Options

Cancel a token: Contact Prime Medic without delay. A prescriber may cancel the active token within the prescribing system. Once cancelled, the token is marked as invalid for dispensing.
Opt-Out of Digital Services: At any stage of your consultation, you may request a paper prescription instead of an eScript.
Manage ASL Access: Through the My Health Record portal or by notifying the pharmacy directly, you can withdraw the access of that particular pharmacy to your Active Script List.

Once you've completed the revocation, to resume, refer to the lost escript recovery guide and follow the step-by-step instructions. For a detailed look at how your rights are protected under federal law, you can refer to the OAIC Health Privacy Basics.