Secure SMS Delivery and Verification Codes for eScripts and Prescription Requests

Key Takeaways

• SMS is the most common method for eScript delivery, offering a quick and secure way to receive prescriptions.
• The link in the SMS is encrypted, ensuring secure access to prescription details.
• Patients can securely forward tokens to trusted individuals, but they should avoid sharing via unencrypted channels.
• If the token is lost or deleted, patients can request a reissue through Prime Medic or access their Active Script List at a pharmacy.
• Pharmacists verify identity before dispensing and deactivate tokens after use.

Sending e-prescriptions via SMS is the most common way to receive an eScript in Australia. The National Prescription Delivery Service (NPDS) governs this process. It ensures that your medication token is transmitted through encrypted channels, even though it appears as a standard text message on your phone. Behind the scenes, a sophisticated multi-layer security framework protects your health information from unauthorised access.

Through the eScript & Prescription Access Hub, this SMS-based workflow seamlessly integrates with your broader digital prescription management, enabling you to store, access, and recover eScript tokens securely. You can also learn more about the authentication steps and how to verify your digital prescription, with the verification process explained in detail.

Why SMS Is Common for eScripts

Most Australians prefer SMS as a communication channel because of its speed and ease of use. To get your medication credentials, you don't need a special app or a high-speed Internet connection.

Benefits of SMS Tokens

• Immediate delivery: SMS tokens are typically delivered shortly after prescription authorisation, after your online GP consultation, enabling the pharmacy to process your request.
• Works everywhere: SMS tokens can be received on a variety of mobile devices.
• Personalised Security: SMS tokens are linked to individual mobile numbers, providing a secure way to transmit prescription information.

If you want to know more about how the tokens are created, check out how escripts are created and sent securely.

How Verification Codes Protect Access

The eScript SMS you receive contains a secure link. However, some health applications or high-security setups may impose restrictions such as requiring a verification code or password before granting you access to the link.

Security layers

• Unique link authentication: The SMS includes a unique, hard-to-guess URL.
• Encryption: When you click the link, the browser establishes a TLS (Transport Layer Security) connection, a protocol used for secure data transfer and a core part of digital prescription access security.
• Three-step verification: When using a digital script wallet, the app may send you a 6-digit verification code via a separate channel to verify your identity before displaying the QR code.
• Identity matching: Only basic prescription details, such as patient initials and medication information, are visible on-screen. Complete medical details are accessible only during the pharmacy verification check.

What happens if the SMS doesn't arrive?

Sometimes, a technical delay can be caused by network overload, or incorrect contact details can cause identity verification to fail before the eScript process.

Troubleshooting Steps

• Give it some time; the PDS upload may be experiencing a minor delay.
• Scan the Spam/Blocked directory: Smartphones can automatically trap messages from unknown short-code senders into Spam folders.
• Ensure your contact details are correct; contact Prime Medic to verify if needed.
• Refill Request: The doctor can re-send the token if the message gets lost, actually. This is a quick administrative task because the Lost eScript Recovery process is digital.

Best Practices for Safe Storage

Safe Handling of eScript Tokens requires properly managing your inbox, since SMS essentially holds the key to your medicine.

• Remember the sender's number: Add the number you received the eScripts from to your contacts and label it accordingly to make it easier for you in the future.
• Only share tokens with trusted individuals: Only write the name of a trusted carer or family member who will be collecting your medication if you want to forward the SMS to someone else. This is essential for eScripts for seniors and carers.
• Avoid Screenshots in Public Clouds: If you decide to take a screenshot of the QR code, keep it only in a secure, password-protected folder on your device.
• Dispose of the little box when empty: After receiving your medication, remove the SMS for future reference to avoid cluttering your medication tracking privacy history.

Can Someone Misuse My Token?

One such concern is that phones allow anyone to use the eScript, undermining the entire process. In fact, the system is protected by the safeguards described below, which prevent misuse.

Why a Token Alone Isn't Enough

• Identity check by the pharmacist: The pharmacist will not dispense your medication if they cannot verify your identity. If a stranger attempts to deceive the pharmacist by showing your token, they will not perform the identity check at the counter.
• Real-Time Deactivation: Once the token is scanned and the medication is dispensed, the link is deactivated and cannot be used again.
• Remote prescription cancellation: If your phone is stolen, contact your doctor, who can immediately cancel the existing prescriptions and reissue new active scripts to your new number.

For more information on secure messaging standards, visit the Australian Digital Health Agency's Security and Privacy for ePrescribing.