Secure Archiving of Old eScript Data Managing eScripts and Prescriptions Safely

Key Takeaways

• Archived eScript data is retained under Australian privacy and health records legislation.
• Retention periods generally extend 7 years for adults and until age 25 for minors.
• Access to archived data is governed by consent and privacy laws.
• Corrections are made through documented addenda rather than deletion.
• Telehealth consultations may assist in requesting archived prescription summaries when appropriate.

In Australia's rapidly evolving digital healthcare landscape, managing electronic prescriptions (eScripts) does not end when a medicine is dispensed. The law, along with safety and audit requirements, necessitate the secure archiving of every digital "token" and clinical data associated with it. For the patient's benefit, the archives serve as a safety net, ensuring that their medication history remains available for clinical use even after treatment is long over. Explore eScript and the Prescription Access hub for more details on managing your online scripts in Australia.

Healthcare providers must ensure that eScript data is preserved as carefully as physical health records, in accordance with the Privacy Act 1988 and state health records legislation. Here, we explain how your stored information is secure and how you can use your rights to request a prescription summary.

Why (Old) Prescription Data Is Archived

Archived data is encrypted and stored in data centres that meet the digital prescription security standards set by the Australian Digital Health Agency. It helps ensure that prescription records are securely maintained and available for verification in accordance with regulatory requirements.

Secure Archiving Purpose

• Clinical Continuity: With the help of archives, a doctor treating you for the first time may access relevant medication records, subject to system availability and consent settings, which, among other things, helps to recognise patterns in the management of chronic ailments.
• Accuracy and Auditing: Archives serve as a documented reference containing recorded details of dispensed medications, whose records can be checked against the actual medications if necessary to clarify a point or during a Pharmacy Board of Australia audit.
• Safety Verification: In the event of a medication recall, regulators use archived data to identify and communicate with affected individuals via medication safety systems without compromising privacy.

The Storage Duration of Old eScripts

Retention periods for health records in Australia are regulated under legislation and must be followed by healthcare providers. Although there are slight differences across states (e.g., NSW, Victoria, and the ACT), the national norms serve as a solid reference.

Retention Periods

• General Record Keeping: For adults, health providers, including GPs and pharmacies, must retain eScript and dispensing records for 7 years from the date of the last service.
• Records for Children: For minors, records must be retained until the individual turns 25.
• Controlled Substances: For Schedule 8 (controlled) drugs, some states have more stringent archiving requirements, under which cabinets and digital logs must be maintained for a minimum of 2 to 5 years for direct inspection while remaining part of the broader 7-year medical file.
• My Health Record Archive: Your My Health Record integration may contain a cumulative archive of uploaded medication records, depending on provider participation and consent settings.

See "How Long eScripts Remain Valid Across States" for more information on these retention periods.

Who Has the Right to See Archived Medications?

Your access rights to the archive are limited by the Australian Privacy Principles (APPs). The data is not freely available; only authorised personnel may access it under very limited circumstances.

Consent and Permission to Access

• The Patient: Since your medication history has been documented in these archives, you have the right to request access to your health records, subject to applicable privacy laws. You can review some of it in the 1800MEDICARE app; otherwise, the formal way is to request it from your provider.
• Healthcare Providers: The attending doctor or pharmacist may be granted permission to conduct a retrospective review of your archived records and access the medication summary if it is considered clinically relevant to your current treatment.
• Legal and Regulatory Access: Exceptions may be made for officials investigating a matter, e.g. during a coronial inquest or an AHPRA investigation, when the public interest is at stake.
• Revoking Consent: By accessing your My Health Record app online, you can manage access settings in accordance with health record controls.

Dealing with Mistakes in Archived Records

Because an archive is a historical document, any amendments must be made and checked properly. You cannot delete an archived record; instead, corrections are made by adding a superseding entry.

How to Correct Mistakes

You should contact the original creators of the records if you notice that there are inaccuracies in your archived medication history, for instance, when the record shows that you have been given a drug which you have never actually received:

• Contacting the healthcare provider who created the record is the first step.
• The health care professional will verify your identity and review your records during the Verification step.
• Audit Note: Under the Privacy Act, the provider will add a correction or addendum if it agrees that the record is inaccurate. They do not delete the original record (to keep the audit trail intact), but they mark it as replaced by the new, correct information.
• The updated information will be synchronised via the National Prescription Delivery Service (NPDS) to reflect it within participating systems.

Telehealth Support for Accessing Old Health Information

Platforms that deliver telehealth services, such as Prime Medic, can help you access your archived records, especially when you are changing your medical team or need to repeat a prescription.

• Continuity of Documentation: If your usual GP is unavailable, a telehealth GP may, with your consent, review your authorised history and assist in maintaining continuity of care, subject to appropriate clinical assessment.
• Archival Access on Short Notice: When a trip or specialist visit requires you to provide documentation of long-term medication use, a telehealth session may help you request a prescription summary in accordance with privacy and identity verification requirements.
• Identity Protection: Each time your archival data is accessed, the event is recorded, with access recorded in accordance with regulatory and privacy requirements.

If you want a thorough review of your archived medication history by a professional or a secure summary for your records, you may book an online GP consultation if clinically appropriate.