How to Share Your eScript Securely with a Carer or Family Member in Australia

In Australia, you can securely share an eScript with a carer or family member by forwarding the eScript token link directly; the carer presents it at the pharmacy just as you would. For ongoing or repeated scripts, a better approach is using an app like OpenPharmacy, which lets a carer add the patient's eScript token to their own wallet. The app automatically organises scripts by patient name, so each person's medications are clearly separated, with QR codes stored on the device, encrypted, and accessible offline.

Information verified March 2026. Prescribing rules and app features are subject to change. Check with your prescriber or pharmacist for advice specific to your situation.

Two approaches to sharing an eScript with a carer

Whether you are a patient delegating a one-off pharmacy collection or a carer managing ongoing medications, the right approach depends on what you actually need.

• Direct token sharing: for one-off collections

  Each Australian eScript arrives as a unique token link, via SMS or email. You can forward that link to your carer exactly as you received it. The carer opens the link on their phone and the QR code appears. They present it at any Australian pharmacy, the pharmacist scans it, and the script is dispensed. That token is then used and archived. This approach requires no app on either end, and it is perfectly legitimate. The carer does not need to be the named patient; they just need to be present with the QR code at the time of dispensing. It works best for a single, straightforward collection: one script, collected once.

• App-based family management: for ongoing care

  If a carer regularly manages someone's prescriptions (for a child on an ongoing medication, an elderly parent with chronic conditions, or a partner), the token-forwarding approach quickly becomes unwieldy. Every new script or repeat means another forwarded message. OpenPharmacy solves this by letting the carer add the patient's eScript token directly to their own OpenPharmacy wallet. The app automatically organises scripts by patient name, so each person's medications are clearly separated and easy to find. The QR code is stored on the carer's device, encrypted, and accessible offline. At the pharmacy, the carer opens the app, finds the right person's scripts, and presents the QR code directly. No forwarding required for each visit.

The security risks of common shortcut methods

When time is short, it is tempting to share a prescription QR code the quickest way available. The three most common shortcuts each carry risks that are easy to overlook.

• –

  Screenshots

  Taking a screenshot of the QR code feels like a reliable backup. The problem is that the screenshot is a live, valid QR code that can be used by anyone who sees it, not just the intended carer. Screenshots are stored in your camera roll without any health-data access control. On most phones, photo backup services such as iCloud or Google Photos upload the camera roll automatically, storing your prescription QR code on overseas servers outside Australian jurisdiction. Any app with photo permissions on your phone can read the camera roll. And if the screenshot is shared, you have no visibility over where it ends up.

• –

  Forwarding via WhatsApp or social messaging

  Messaging apps like WhatsApp, Facebook Messenger, and Instagram DMs are convenient but store data on overseas servers operated by US-based companies. Australian privacy law only governs data held within Australia. Sending prescription information through overseas messaging platforms means your health data is subject to the data laws of wherever those servers are located, including the US CLOUD Act, which allows US authorities to compel US cloud providers to produce data stored anywhere in the world. For many medications this may feel like an academic risk. For sensitive prescriptions, it is a real one.

• –

  Printing the QR code

  A printed prescription is convenient until it is not. Paper can be lost, left behind, or picked up by the wrong person. Unlike a digital token that archives itself after dispensing, a paper copy can be presented multiple times or handed to someone other than the intended carer. There is also no record of where the paper ended up if the prescription is sensitive.

None of these shortcuts are catastrophic for every prescription. The risk calculation is different for an antibiotic than it is for an ADHD medication or an opioid analgesic. The key question is: does the sensitivity of this prescription warrant more care about who can access the QR code and where it is stored?

For a full breakdown of what makes an eScript app genuinely secure, see: How to Keep Your eScripts Secure: A Privacy Guide for Australian Patients.

How OpenPharmacy handles secure carer sharing

OpenPharmacy is an Australian eScript wallet developed by Easy As Health Pty Ltd, registered with the Australian Digital Health Agency (ADHA) and conformant with the national electronic prescribing standards. The app is free on iOS and Android.

For carer use, the workflow is practical and built into the app's core design. A carer adds the patient's eScript token directly to their own OpenPharmacy wallet. The app automatically organises scripts by patient name, keeping each person's medications clearly separated. The token is stored using end-to-end ASD-approved encryption on the carer's device. All data is held on Australian servers and is never shared with third parties.

At the pharmacy, the carer opens the app, finds the correct person's scripts by name, and displays the QR code. Because scripts are stored on the device rather than retrieved from a server, the QR code is fully accessible without an internet connection. There is no live server call at the pharmacy counter that could fail, slow down, or be logged.

The 4-digit PIN that protects the app secures all scripts within the wallet. If the carer's phone is lost or accessed by someone else, the prescription data for every family member in the wallet is protected by that PIN.

Step-by-step: how to set up a carer's OpenPharmacy wallet for a family member

This takes about two minutes to set up. After that, each new script takes seconds to add.

1. 1

   Download OpenPharmacy

   The carer downloads OpenPharmacy free from the App Store (iOS) or Google Play (Android). No pharmacy activation code is required: create an account directly in the app.

2. 2

   Receive the eScript token

   The patient's GP issues the eScript via the national electronic prescribing system. The token arrives by SMS or email — to the patient's phone, or directly to the carer's phone if the carer's contact details are registered with the GP.

3. 3

   Open OpenPharmacy and find the family member's scripts

   In the app, find the correct person's scripts. OpenPharmacy automatically groups and sorts scripts by patient name, so each person's medications are clearly separated and easy to locate.

4. 4

   Add the token

   Tap to add the eScript token. If the carer received the SMS directly, tapping the link opens OpenPharmacy with the token pre-populated and ready to save. If the patient forwarded the token, the carer copies the token link and adds it manually. The script is now stored on the device, encrypted, and accessible offline.

5. 5

   Present the QR code at any pharmacy

   At the pharmacy, the carer opens the app, finds the family member's scripts by name, and displays their QR code. The pharmacist scans it directly from the screen. No internet connection is needed at this step.

Going forward, add each new token as it arrives. After each dispense, the script is automatically archived and any repeat token issued by the pharmacy appears as a new active script.

When direct token forwarding is the right choice

Not every situation calls for an app. If a family member is collecting a prescription on your behalf once, forwarding the token directly is perfectly reasonable. Here is how to do it cleanly.

Forward the eScript token link — via SMS to the carer's phone — as soon as you receive it. Confirm the carer has received it before they leave for the pharmacy. Remind them that each token can only be used once per dispense: if the pharmacist scans it and the script is dispensed, the token is consumed. If the carer's phone runs out of battery or the message is accidentally deleted, the backup is the Active Script List (ASL) at the pharmacy — if you or your GP has enrolled in ASL, the pharmacist can retrieve the script from the national registry directly.

One important practical note: an eScript token can only be presented at one pharmacy per dispense. If the carer has the token on their phone, you should not also try to fill it at a different pharmacy at the same time. The first dispense consumes the token.

A note on privacy before you forward a token

When you forward an eScript token to someone, you are granting them the practical ability to present that prescription at any Australian pharmacy. The token does not check identity — the person who presents the QR code is the person who receives the medication.

For most prescriptions, this is straightforward: you trust the carer, the medication is routine, and the risk is minimal. For prescriptions with higher sensitivity, the question is worth a moment's thought. Consider whether the medication is one you would be comfortable having on someone else's phone, backed up to their cloud, or visible to others who use their device.

Adding scripts to OpenPharmacy avoids this issue entirely: the carer's wallet is PIN-protected, encrypted, and the script is not forwarded to any external messaging platform. The app automatically organises scripts by patient name within the wallet, so each person's medications stay clearly separated. The data stays within a purpose-built, ADHA-conformant app.

Managing prescriptions for multiple family members on an ongoing basis? See: Managing Family eScripts in Australia: A Practical Guide for Parents and Carers.

New to eScripts? Start here: What Is an eScript Wallet? A Plain-English Guide for Australians.

Frequently Asked Questions