Electronic Prescription Service (EPS) in England: GDPR information

The Electronic Prescription Service (EPS) securely transmits prescription information between prescribing systems (for example GP systems) and dispensing systems (for example pharmacy systems) in England. 

When a prescription is issued, the prescribing system sends the following information to the NHS Spine: 

• patient’s demographic data (e.g. NHS number, name, date of birth, address)
• patient’s nominated pharmacy
• the GP practice the patient is registered at
• the medication or appliance prescribed
• instructions given to the patient and dispenser by the prescriber
• details of the prescriber issuing the prescription
• the system and user generating the prescription
• the advanced electronic signature attached to the prescription

The electronic prescription is then made available for the dispensing system to download from the NHS Spine. 

In order to connect to the NHS Spine users of prescribing and dispensing systems need the appropriate NHS Smartcard permissions.

Authorised staff at prescribing and dispensing sites, can also check the status and location of a prescription using the EPS Prescription Tracker. 

The patient’s choice of nominated pharmacy is recorded in the Personal Demographic Service (PDS).  At the request of a patient, prescribing and dispensing system users can add, update and remove their nominated pharmacy.

The EPS is used across Primary care (for example GP practices and pharmacies) and urgent care settings (such as walk-in centres and minor injury units) in England.

Electronic prescription data known as a ‘digital prescription’ will also be available to patients who have the  NHS App and have high-level identity verification through NHS login. The digital prescription has a barcode, which can be presented to the dispenser on the patient’s smartphone so that their prescription can be processed.

For more information on how we process personal data to provide the Electronic Prescription Service to NHS organisations and services in Wales, see the Electronic Prescriptions Service for Wales Transparency Notice. 

This data is held on the cloud to enable better integration with health and care organisations and their systems

NHS England share EPS data (electronic claims messages) with the NHS Business Services Authority (BSA) so that NHSBSA can reimburse the dispenser and charge the prescriber for the items dispensed.

• Be informed
  
• Get access to it
  
• Rectify or change it
  
• Erase or remove it
  
• Restrict or stop processing it
  
• Move, copy or transfer it
  
• Object to it being processed or used
  
• Know if a decision was made by a computer rather than a person
  

Consent is not the basis for processing.

GDPR:
Article 6(1)(c) - Legal Obligation (Spine Services (no) 2014 Direction 
Article 9(2)(h) - Management of health or social care systems and services

DPA 2018:
Schedule 1, Part 1, paragraph 2 - Health or social care purpose