New Zealand ePrescription Service (NZePS)

A practice can scan and email a prescription (barcoded or not) to a pharmacy if:   

• Non-barcoded prescriptions must be physically signed by the authorised prescriber AND
• all secure messaging criteria are met by the sender.

The same rules apply as they do now for requiring the original to be sent to pharmacy for faxed prescriptions.

The original prescription is NOT REQUIRED by the pharmacy:

• If the emailed prescription has a NZePS barcode AND
• is downloaded from NZePS at the pharmacy

The original signed prescription IS REQUIRED by the pharmacy:

• If the barcode (SCID) is not used on an emailed, signed NZePS prescription, at the point of dispensing. OR
• If the emailed prescription is signed and does not have a barcode.

Pharmacies may have the capability can receive analogue faxes as emails as long as their telecommunications provider has met the standard for email security set out by the Ministry (click here to access the guidance).

TLS (Transport Layer Security) and SSL (Secure Socket Layer) are both technology protocols that are used for encryption.  TLS 1.2 or higher is the minimum-security standard requirement as SSL by itself is not adequate.  You can find guidance on how to set up TLS online or through your IT service provider.

Gmail, Yahoo Mail, Hotmail, G Suite mail services and Microsoft 365 / Office 365 email services DO use the required email security standard (TLS) by default.

If you use another email system e.g. Xtra, you will need to contact your provider, e.g. Spark, to confirm if your email system meets the requirements

There are several online tools that enable you to check if your email or that of the practice or pharmacy that you intend to communicate with is secure.  One such tool is CheckTLS (https://www.checktls.com/TestReceiver) which allows you to put in your email address or that of a practice or pharmacy to get an instant security assessment. A confidence factor score of 90 or better on CheckTLS that shows “OK” under the TLS column is an indication that adequate security is in place to protect the Email during transmission to the destination. 

If you find that the practice or pharmacy you’d like to send your patient’s prescription or information to gets a score of less than 90, or if you have any doubts at all, you can still:

• Encrypt or password protect your scanned prescription before emailing it. Don’t forget to share the password to the file with the receiving practice or pharmacy using another method, such as text message or phone call, OR
• Post the prescription or give a copy of the prescription to the patient to take to the pharmacy.

There are several tools that allow you to encrypt your scanned files.  Some versions of Acrobat provide you with the ability to set a password for your file.  There is also a free tool called 7-zip that allows you to compress and password protect your file so that it can be sent securely, even if the practice or pharmacy you’re communicating with has not turned on required security.

Instructions on how to use tools like 7-zip can be found online including

https://fredonia-edu.atlassian.net/wiki/spaces/AN/pages/1111949535/How+to+Password+Protect+and+Encrypt+Files+using+7-Zip+for+Windows?src=search

If you’re a prescriber who has emailed a prescription to a pharmacy you should ensure that you have a record, or note of that prescription being sent, in your Practice Management System and then fully delete the email, including any locations such as Sent items, Inbox, and permanently delete from Trash.

If you’re a pharmacy that has received an emailed prescription you should delete the email as soon as you have printed the prescription and dispensed the medications.

Email services should NOT be used to store prescription information.

Here, email is just replacing fax. Where we currently fax prescriptions, we're allowing prescribers to securely email them. For NZePS barcoded prescriptions these can only be dispensed once. So, the risk of fraud/duplication is managed. For prescriptions that are not barcoded (non NZePS), the original signed prescription still needs to be sent to the pharmacy (just as it is today with faxed non-barcoded prescriptions).

Yes, so long as all conditions are met:

• For NZePS prescriptions the prescribing system used must have role-based access and meet all other requirements for NZePS prescribing. It is the responsibility of the prescriber to ensure this condition is met.
• The pharmacy must use the NZePS barcode (SCID) to dispense the prescription.
• For non-NZePS barcoded prescriptions, the prescription must meet all the requirements of the “Director-General authorisation of an alternative form of prescription pursuant to regulation 43 of the Medicines Regulations 1984”, which will expire on the 31 October 2024.

There is nothing that physically stops a prescription from being scanned and emailed by a patient to a pharmacy. However, pharmacies are advised not to dispense medicines off prescriptions emailed to a pharmacy from anywhere other than the email address related to the authorised prescriber who has generated the prescription.

Whilst some assurance of the authenticity would be provided if the prescription was downloaded from NZePS the original prescription would be required to be obtained in all cases before releasing the dispensed medicine(s).

Where the prescription is a non-NZePS prescription, and no download of the barcode is possible, then there is the potential for the prescription to be emailed to multiple pharmacies and dispensed more than once.

Yes. This will make it easier for your pharmacy or practice to trust prescriptions that have been received from you. In some regions, the Districts would also like to be notified if or when you’re using a secure email system. Your local District will be contacting you if this is a requirement in your district.

No. A physical (ink, wet) signature is still required if the prescription does not meet the requirements for signature exempt prescribing:

• For NZePS prescriptions the prescribing system used must have role-based access and meet all other NZePS requirements. It is the responsibility of the prescriber to ensure this condition is met.
• The pharmacy must use the NZePS barcode (SCID) to dispense the prescription.

For non-NZePS barcoded prescriptions, the prescription must meet all the requirements of the “Director-General authorisation of an alternative form of prescription pursuant to regulation 43 of the Medicines Regulations 1984”, which will expire on the 31 October 2024.

Your email had to meet the security requirements by January 2020. 

You will need to stop using analogue faxes by December 2020 at the latest. 

You will also need to confirm that you’re no longer using faxes by emailing Te Whatu Ora at itsecurity@health.govt.nz.

Yes, pharmacy do need to print the emailed prescription as they are still required to annotate on the paper prescription and file in the batch. Note: The original prescription is required for ALL scripts (barcoded or not) that are emailed from a patient.