Can my employer verify the authenticity of a medical certificate without my permission?

If that is what you mean, yes, employers may take reasonable steps to confirm the authenticity of a medical certificate, provided this is done in a way that respects privacy obligations and does not involve access to clinical information without consent. What they cannot do, however, is to request a medical diagnosis or any other private health information if you have not given them your written consent.

What are the ways of checking whether a real doctor issues a medical certificate?

Usually, institutions of higher learning rely primarily on the verification link or QR code included with the digital medical certificate and displayed on its face. They may, however, also contact the medical service in question and verify that the number on the document matches the number in their records.

Would digital medical certificates be obsolete someday?

A medical certificate is a document that evidences the period during which a person has been ill; therefore, it is incorrect to say that it "expires". On the other hand, the doctor's order is always tied to a specific timeframe (documented). It is not permitted to use a doctor's certificate that has been lying around for quite some time for a new case of absenteeism, for instance, one later in the year.

What if there is no wet-ink signature on the certificate? Can it still be considered valid?

Indeed. Under the Australian Electronic Transactions Act, a digital signature made by a verified medical practitioner is generally recognised, provided the legal and technical requirements are met.

Validity of an Online Medical Certificate in Australia

Introduction

Today, medical certificates are less reliant on handwritten signatures on prescription pads than in the past. With telehealth's continued growth, it is natural that patients and employers alike are wondering: Who can legally issue and validate an online medical certificate in Australia?

Medical certificates in Australia are generally issued by registered medical practitioners and, occasionally, by nurse practitioners within their authorised scope of practice. Employers, universities, and schools typically rely on authentication to verify a medical certificate's authenticity before accepting it.

Here, we first discuss the legal framework governing digital doctor notes, then AHPRA's role in confirming a doctor's authority, and finally, how technology not only enables verification but also ensures privacy.

If you are still unsure about the authenticity of these documents, review our initial discussion of online medical certificates in Australia first.

The Ways the Online Medical Certificates Are Confirmed in Australia

Verification, in this context, means confirming that the doctor whose name appears on the certificate issued the document and that it has not been altered.

Previously, a manager might have contacted the clinic receptionist and asked, "Are you sure Dr X gave this note?" Today, verifying a digital certificate is faster and safer, eliminating the need to store patients' personal information.

The Verification Workflow

Issuance: An AHPRA-registered doctor conducts a telehealth consultation and, where clinically appropriate, issues a digitally signed medical certificate.
Submission: The patient emails the certificate to their employer or school.
Digital Check: Using a unique QR code or Verification ID on the certificate, employers can access the clinic's portal to verify it instantly.

Where verification tools are used, they may confirm the following details:

The name of the doctor who issued the certificate.
The date on which the certificate was issued.
The period during which the doctor has advised that the patient may be unfit for work, based on the consultation.

The confidentiality of the illness information is respected. For more information on the technical details, see our article on the digital certificate verification process.

Who is Lawfully Entitled to Validate a Medical Certificate?

There are restrictions on who can issue a medical certificate. Under the Fair Work Act 2009, a valid medical certificate must be issued by a registered health practitioner.

The Function of AHPRA

The Australian Health Practitioner Regulation Agency (AHPRA) is the national body responsible for maintaining the list of all registered health practitioners in Australia.

Doctors: Must be registered either generally or as specialists.
Nurse Practitioners: Must be licensed to issue certificates if they have an endorsement.

In general, a medical certificate is expected to be issued by a health practitioner who holds current AHPRA registration to be recognised by employers or institutions. Prime Medic verifies practitioner registration against the AHPRA public register as part of its onboarding and ongoing compliance processes.

Please check the doctor's registration status yourself. Here is how you can do it in our AHPRA registration check guide.

How to Confirm the Authenticity of Medical Certificates by Employers and Institutions

Employees may be asked by their employers to produce, below the rules of privacy, reasonable evidence justifying that the employee is indeed sick and not working. That said, they are not authorised to request the employee's medical history.

Valid Verification Methods:

Verification via QR Codes: Many telehealth certificates now include a QR code for verification. By scanning it, the employer is redirected to a secure webpage hosted by the telehealth provider (E.g., Prime Medic) that displays the certificate details.
Direct Verification Links: A unique URL on the document that does the same as the QR code.
Doctor's Provider Number: This 6-8-digit code is unique to the doctor's location and serves as a key identifier for Medicare and private payers.

Invalid Verification Methods:

Asking for the entire medical record.
Trying to get the receptionist to reveal the diagnosis.

The employer must adhere to strict privacy rules when conducting this procedure. More information is available in our medical certificate privacy guidelines.

How to Identify a Valid or Invalid Online Certificate

The broad availability of the internet can be a double-edged sword. There are "fake certificate" websites that issue medical documents without the customer ever seeing a real doctor. Certificates issued without a genuine consultation with a registered health practitioner may not meet legal or workplace requirements and are generally not accepted.

The Indicators of Faked Medical Certificates

No Provider Number: The doctor's Medicare Provider Number was omitted.
Generic Doctor Names: Names that do not appear on the AHPRA register.
No Consultation: You received the certificate instantly after a quiz, with no human review or interaction.
Static Images: The signature appears to be a low-resolution paste.

Each workplace has different rules, and presenting a non-genuine medical certificate may have serious consequences under workplace policies or applicable laws, depending on the circumstances.

If you want to be on the safe side, ensure you use telehealth services that comply with all applicable regulations and conduct authentic clinical assessments.

We implement a series of strict clinical governance measures to prevent fraud. Take a look at our quality compliance standards.

The Measures Taken by Prime Medic to Ensure the Security of Certificates

When it comes to validating online medical certificates, we at Prime Medic make this our top priority. Our system is a triple barrier against tampering and a trust-building tool for patients and employers.

Industry-standard encryption measures: The practice management software used to generate certificates is highly secure.
Unique Identifiers: Each piece of paper is assigned a globally unique document ID to reduce the risk of unauthorised alteration or duplication.
Audit Trails: We maintain a record of who signed the certificate and when, providing clear evidence for those who want to scrutinise it.

Privacy and security are intertwined. Go through our privacy policy if you want to be know more about the security of your data.