Electronic Prescription Service (EPS) for Wales: GDPR information

The Electronic Prescription Service (EPS) securely transmits prescription information between prescribing systems (such as GP systems) and dispensing systems (such as pharmacy systems) in Wales.

When a prescription is issued, the prescribing system sends the following information to the NHS Spine:

• Patient’s demographic data (such as NHS number, name, date of birth, address)
• Patient’s nominated pharmacy
• The GP practice the patient is registered at
• The medication or appliance prescribed
• Instructions given to the patient and dispenser by the prescriber
• Details of the prescriber issuing the prescription
• The system and user generating the prescription
• The advanced electronic signature attached to the prescription

The electronic prescription is then made available for the dispensing system to download from the NHS Spine.

To connect to the NHS Spine, users of prescribing and dispensing systems need the appropriate NHS smartcard permissions.

Authorised staff at prescribing and dispensing sites, can also check the status and location of a prescription using the EPS Prescription Tracker.

The patient’s choice of nominated pharmacy is recorded in the Personal Demographic Service (PDS). At the request of a patient, prescribing and dispensing system users can add, update and remove their nominated pharmacy.

The EPS is used across primary care (GP practices and pharmacies for example) and urgent care settings (such as walk-in centres and minor injury units). 

The Electronic Prescription Service also operates in England. For more information, see the Electronic Prescription Service in England Transparency Notice. 

NHS England share EPS data (electronic claims messages) with the NHS Wales Shared Services Partnership (NWSSP) so that NWSSP can reimburse the dispenser and charge the prescriber for the items dispensed.

• Be informed
  
• Get access to it
  
• Rectify or change it
  
• Erase or remove it
  
• Restrict or stop processing it
  
• Move, copy or transfer it
  
• Object to it being processed or used
  
• Know if a decision was made by a computer rather than a person
  

Consent is not the basis for processing.

UK GDPR:

Article 6(1)(e) - Public task (Section 255 Health and Social Care Act 2012: Electronic Prescription Service for NHS Wales 2022)

Article 9(2)(h) - Management of health or social care systems and services

DPA 2018: Schedule 1, Part 1, paragraph 2 - Health or social care purposes