How to get the token if the SMS does not arrive?

Occasionally, delivery delays may occur due to technical factors. If the token does not arrive within a few minutes, please contact Prime Medic. We can recover a lost eScript token by resending the valid link to your device without requiring a new consultation.

Is it safe to send a prescription as an email attachment?

A prescription sent on a conformant clinical software platform is considered secure. The recipient's email contains a hyperlink that directs them to the highly secure token stored on a protected server; the clinical data is not included in the email itself.

If I forward my token, will other people be able to see it?

You can send this SMS or email to a trusted person, such as your carer, so they can scan the QR code and pick up your medication. However, you should only share these kinds of messages with people whom you definitely trust.

Can the pharmacist who gets the token view my comprehensive medical history?

No. The token provides access only to the specific prescription and limited identifying information required for dispensing. For a broader view of your health data, My Health Record provides a more comprehensive summary.

How eScripts Are Created Securely in Australia

Key Takeaways

eScripts are issued only after clinical assessment and identity verification.
Electronic prescriptions are created using compliant Australian digital health systems.
The token acts as a secure access key, not the prescription itself.
Prescription data is stored within regulated Prescription Delivery Services.
SMS and email messages contain secure links rather than clinical details.
Tokens are single-use and logged for audit purposes.
Any reissue or resend of a token is subject to review.

The digital transformation of healthcare in Australia has introduced a complex, multi-layered security workflow for medication management. It is crucial for patients who value both convenience and data integrity to understand how eScripts are created and delivered. Prime Medic's eScript & Prescription Access Hub has operated under strict Australian Digital Health Agency (ADHA) standards, ensuring that electronic prescriptions are issued in accordance with Australian regulatory requirements and are designed to support secure transmission and record keeping for prescribers.

This secure digital workflow results from a well-coordinated exchange among AHPRA-registered prescribers, encrypted national databases, and your personal device.

Identity Verification Before Issuing an eScript

Before any prescription data is created, a clinical consultation and identity verification process takes place. Australian telehealth guidance requires appropriate identity verification before prescribing to their patients. The main idea is to ensure that the person matched to a medication is the owner of the medical record.

Patient Authentication

Prime Medic GPs work with a range of identifiers to check and confirm your identity: full name, date of birth, and your Individual Healthcare Identifier (IHI). This process is intended to reduce the risk of identity misuse and ensure prescriptions are linked to the correct record, following the same medical certificate eligibility criteria used for other secure documents. If you're interested in learning more about these security measures, check out our Data Storage Laws page.

The Creation of the eScript

Following clinical assessment, the GP may, where appropriate, issue an electronic prescription using compliant clinical software. Unlike paper-based documents, eScripts are encrypted digital records.

Token Generation Workflow

Prescription recording: The doctor records medication details in the electronic health record (EHR).
Encryption: The software uses recognised international standards to encode the clinical instructions (dosage, quantity, repeats).
Generation of a unique key: The system generates a token, a one-of-a-kind QR code or alphanumeric key.
Proof of prescription: Remember, the token itself is not the official prescription; it is the key that allows the pharmacist to unlock the legal record.

Technical protections and other eScript-related topics are available in the eScript Privacy & Security section.

Immediacy of Data Transfer to Prescription Delivery Service

The moment the GP presses the send button, encrypted prescription information is published to a Prescription Delivery Service (PDS), for example, eRx or MediSecure. The purpose of this repository is to serve as a secure national broker between doctors and pharmacies.

National Prescription Repository

The prescription is stored within the Prescription Delivery Service (PDS) using secure infrastructure designed to protect data integrity. Since this service provider operates in real-time, participating pharmacies may access a script shortly after it is uploaded, subject to system availability. This eliminates the waiting time that sometimes occurs when faxes or paper scripts are mailed. For more information on the regulatory framework for such systems, please refer to the eScript Regulation updates section.

Secure SMS or Email Token Delivery

After securely depositing data in the PDS, the system sends the token to the patient via SMS or email. Prime Medic applies advanced security protocols to ensure only the intended recipient receives these messages, much as we do when sharing medical certificates securely.

Modes of Secure Messaging

Delivery via text message: A communication with a hyperlink is received. Upon clicking, the QR code is presented.
Via Email: An encrypted, secure email is sent to your designated inbox.
Privacy is embedded by design: To safeguard users' privacy, the contents of these messages typically do not reveal the drug's name. For further details, check the official Australian Government prescription regulations.

Check out the Data Privacy & Patient Document Access page to learn how we secure this type of communication.

Safe Handling to Prevent Tampering

The electronic form of the script (eScript) includes several security features that enhance tamper resistance, supporting prescription integrity. Creating a new clinical record would be necessary if anyone wanted to change the prescription after the token was issued, without detection.

Tamper-Resistant Features

Single-Use: After the token is scanned and the prescription is dispensed, it is deactivated immediately in the national database. This means that no one can use the same script at more than one pharmacy.
Electronic Signatures: Every eScript is digitally signed by an AHPRA-registered prescriber. The pharmacy'ssoftware automatically verifies the document's digital signature.
Audit Trail: Each access request is logged to record who has viewed or dispensed the medication.

However, all these measures and more to stop medical fraud can be found under the topics of Fraud Prevention & Data Protection.

Need Medical Advice?

Consult with our experienced doctors from the comfort of your home. Available 24/7 for your convenience.

Book Appointment

1300 090 252

Access eScripts via Online Doctor Consultation

Speak with an Australian-registered doctor. If clinically appropriate, an eScript may be issued following a clinical assessment.

Request to Access eScripts

How eScripts are Created and Delivered to Patients in a Secure Way