Electronic Prescription Service in Wales: Transparency notice

This transparency notice explains for the Electronic Prescription Service (EPS) in Wales:

• why we collect information about you (we call this 'personal data')
• what we do with it, including who we share it with
• how long we keep it for and where we store it
• our legal basis for using it
• what your data protection rights are

To read more about how NHS England uses personal data to improve health and care, see Transparency Notice: how we use your personal data.

The Electronic Prescription Service also operates in England. For more information, see the Electronic Prescription Service in England Transparency Notice.

The Electronic Prescription Service (EPS) securely transmits prescription information between prescribing systems (such as GP systems) and dispensing systems (such as pharmacy systems) in Wales.

EPS makes the prescribing and dispensing process more efficient and convenient for patients and staff. EPS allows prescribers to send prescriptions electronically to a dispenser of the patient’s choice (a nominated pharmacy). 

EPS is used across primary care (such as GP practices and pharmacies) and urgent care settings (such as walk-in centres and minor injury units).

Read more information about electronic prescriptions on the NHS.UK website.

Under data protection law, NHS England is a ‘joint controller’ with Digital Health and Care Wales (DHCW) in providing EPS to NHS organisations and services in Wales. This means that we jointly make decisions about what personal data we need to collect and how we will use your data to provide EPS to Wales.

When a prescription is issued, the prescribing system sends the following information to the NHS Spine.

This includes:

• the patient’s demographic data (such as NHS number, name, date of birth, address)
• the patient’s nominated pharmacy
• the GP practice the patient is registered at
• the medication or appliance prescribed
• instructions given to the patient and dispenser by the prescriber
• details of the prescriber issuing the prescription
• the system and user generating the prescription
• the advanced electronic signature attached to the prescription

The electronic prescription is then made available for the dispensing system to download from the NHS Spine.

When a prescription is downloaded by the pharmacy, the dispensing system sends information to NHS Spine.

This includes:

• the organisation code of the pharmacy dispensing the prescription
• the patient’s NHS number
• a prescription ID and prescription item ID
• prescription item status updates (such as ready to collect or collected)
• the time of the action that triggered the status update

In order to connect to NHS Spine, users of prescribing and dispensing systems need the appropriate NHS smartcard permissions.

Authorised staff at prescribing and dispensing sites, can also check the status and location of a prescription using the EPS Prescription Tracker. 

When you are prescribed a medication or appliance, the prescribing system (for example, a GP practice or urgent care setting) sends your information to NHS Spine. Subsequently, when the pharmacy downloads your prescription to dispense, it will send information about your prescription and its status back to NHS Spine.

EPS processes your data to:

• securely transmit your prescription data between prescribing and dispensing systems so that you can be issued with your prescription
• enable authorised staff at prescribing and dispensing sites to check the status and location of your prescription
• keep a record of your nominated pharmacy in the Personal Demographic Service (PDS) so that your electronic prescriptions are sent to the pharmacy of your choice (you can change or cancel your choice of dispenser at any time by speaking to your GP or pharmacist before you order your next prescription)
• verify the digital signature attached to the prescription
• send reimbursement electronic claim messages to the NHS Wales Shared Services Partnership (NWSSP) so that NWSSP can reimburse the dispenser and charge the prescriber for the items dispensed
• answer enquiries from prescribers and dispensers and investigate issues with the service
• investigate complaints about nominated pharmacies from patients, prescribers and dispensers
• publish anonymous statistical reports and dashboards to monitor the service so that we can improve it.

Data protection law requires NHS England to have a legal basis before we can use your personal data.

Our legal basis is:

Public task

Article 6(1)(e) of UK GDPR. This is because Digital Health and Care Wales (DHCW) has requested NHS England to provide EPS to NHS organisations and services in Wales. This Request is called the Section 255 Health and Social Care Act 2012: Electronic Prescription Service for NHS Wales 2022

We also need an additional legal basis in the UK GDPR and the Data Protection Act 2018 (DPA 2018) to use data which is extra sensitive. This is known as ‘special categories of personal data’. Our legal basis to use data relating to your health is:

Health or social care

Article 9(2)(h) of UK GDPR, plus Schedule 1, Part 1, Paragraph 2 “Health or social care purposes” of DPA 2018

We share electronic claim messages with the NHS Wales Shared Services Partnership (NWSSP) so that NWSSP can reimburse the dispenser and charge the prescriber for the items dispensed.

We keep EPS data in our live system for up to 12 months after a prescription has been dispensed, or after a prescription has been prescribed but not dispensed by the pharmacy. It is then archived for 6 years before secure deletion.

We keep your data in accordance with the Records Management Code of Practice 2021.

We securely store your data on our servers in the United Kingdom (UK).

Under data protection law, you have the following rights over your data for this service:

To make a rights request, email us at [email protected].

We take our responsibility to look after your data very seriously. If you have any questions or concerns about how NHS England uses your data, please contact our Data Protection Officer at [email protected].

If you are not happy with our response, you have the right to make a complaint about how we are using your data to the Information Commissioner’s Office by calling 0303 123 1113 or through their website: https://ico.org.uk/make-a-complaint/.

We may make changes to this notice. If we do, the 'last edited' date on this page will also change. Any changes to this notice will apply immediately from the date of any change.