Industries · · 6 min read · By Alexander
Request a prescription online: a safe workflow for medical practices
Allowing patients to request a prescription online can remove unnecessary phone calls for both patients and practice staff. The service only works well when the practice defines eligible requests, keeps the medical decision with the doctor and protects sensitive health data.
Which prescriptions may patients request online?
An online request is most suitable for known patients and repeat medication that has already been prescribed. The form does not replace a diagnosis and does not create an automatic right to a prescription. The treating doctor still decides whether medication can be issued again or whether a consultation is required.
State the limits above the form. Repeat prescriptions may be requested, while new medication, acute symptoms, dose changes and conditions requiring monitoring need a personal or suitable telemedical consultation. Emergency information should clearly point to 112 or the German medical on-call service 116117.
A clear message is: “Your request will be reviewed by a doctor. Submission is not yet a prescription.” This prevents false expectations and reduces avoidable enquiries.
- Suitable: known long-term medication and documented treatment
- Review required: dose changes, long breaks or unusual developments
- Not for the form: new symptoms, emergencies or unclear medication
- Define processing time, follow-up questions and consultation rules
How should an online prescription request be processed?
Keep the workflow short but not automatic. The request should enter a clearly assigned inbox or suitable practice software. A medical assistant checks identity, required fields and plausibility. Medical approval remains a separate step. Only then is the e-prescription signed or a follow-up question sent.
Since 1 January 2024, e-prescriptions have generally been mandatory for prescription medicines covered by Germany’s statutory health insurance. Patients can redeem them using their electronic health card, the official e-prescription app or a printed token. Source: Federal Ministry of Health and gematik, e-prescription information, accessed 4 November 2026.
The website form therefore records a request only. The prescription is created in the practice management system and signed using the electronic health professional card. KBV guidance confirms that the doctor remains responsible for the prescription. Source: KBV, e-prescription guidance for practices, accessed 4 November 2026.
- Route the request to an assigned inbox
- Check patient details, medication and open questions
- Doctor makes the prescribing decision
- Create and sign the e-prescription in practice software
- Send a clear confirmation or request for contact
Which fields belong in the prescription request form?
Collect only what is genuinely needed. This will usually be the patient’s name, date of birth, a reliable contact route, medication name, strength, dosage form and confirmation that it is established repeat medication. Keep free-text fields short to discourage lengthy medical histories or image uploads.
Insurance number, diagnosis, full address or an identity document are not automatically necessary. Check with the software provider and data protection adviser which information is already held securely. Data minimisation also reduces typing errors and staff workload.
Avoid a basic contact form that forwards every request as an unencrypted email to several recipients. A protected inbox with personal accounts, roles, logs and deletion rules is preferable. Confirmation emails should not repeat medication or diagnosis data in the subject or body.
How can the form comply with GDPR?
Medication requests, diagnoses and treatment information are health data and therefore special categories of personal data under Article 9 GDPR. Article 5 includes purpose limitation, data minimisation, accuracy and storage limitation, while Article 32 requires appropriate technical and organisational protection. Source: GDPR via EUR-Lex, Articles 5, 9 and 32, accessed 4 November 2026.
In practice this means HTTPS, no transfer of sensitive form data to analytics or advertising tools, restricted access, current systems, documented retention periods and data processing agreements where providers process data on behalf of the practice. Tracking on the form page deserves particularly strict review.
The privacy notice should explain the purpose, recipients and retention period. A generic “I accept GDPR” checkbox does not create compliance. The decisive points are an appropriate legal basis, transparent information and a genuinely secure process. The practice should obtain legal and data protection review for its specific setup.
- HTTPS and a protected inbox with restricted access
- No health data in analytics, ad networks or email subject lines
- Personal accounts instead of shared passwords
- Document deletion, cover, outages and incident handling
- Review providers and processing agreements regularly
What should patients know about the German e-prescription?
A request submitted online is not necessarily ready at the pharmacy immediately. Give a realistic processing time and never promise availability before medical review. Explain how patients will be told that the prescription is ready without sending confidential details in open email.
For redemption by electronic health card, the pharmacy reads the card and retrieves available prescriptions from the central service. Gematik states that no PIN is needed for this route. The official app and a paper printout with a prescription code are alternatives. Source: gematik, e-prescriptions for insured patients, accessed 4 November 2026.
KBV lists exceptions and fallback procedures for technical problems and prescription types not yet covered by the system. The internal process therefore needs a plan B covering patient communication, documentation and the permitted alternative route. Source: KBV, e-prescription exceptions and technical guidance, accessed 4 November 2026.
How should a practice introduce the online service?
Start with a process map rather than software. Define eligible medication, who checks requests, when doctor contact is needed and how completion is recorded. Then test typical cases: correct request, wrong strength, unknown patient, invalid card details, follow-up question and technical outage.
The service needs its own mobile-friendly page with short explanations, few required fields, understandable error messages and a confirmation screen. A button labelled “Request repeat prescription” is more accurate than “Order prescription” because the medical decision is still pending.
Review the first four weeks: calls avoided, incomplete requests, consultations required and processing time. Adjust the form based on real work. A managed website subscription can cover hosting, updates and technical maintenance, while all medical rules and approvals remain with the practice.
- Document responsibilities and eligible requests
- Review the form and privacy information
- Test realistic cases with staff and doctors
- Communicate processing time and follow-up clearly
- Evaluate errors and workload after four weeks
Frequently asked questions about online prescription requests
Can every patient request a prescription online?
The practice defines eligibility. The service is most suitable for known patients and established repeat medication, and medical review is always required.
Is the online request already a valid prescription?
No. It first sends a request. A redeemable prescription only exists after the doctor’s decision, creation and signature.
Does the patient need an app for the e-prescription?
No. Statutory health insurance patients can generally use their electronic health card or a printed token as alternatives.
Can the practice receive requests by ordinary email?
Health data requires strong protection. A controlled secure inbox is generally more suitable than forwarding complete form content through ordinary email.
How quickly must a practice process the request?
There is no universal instant deadline. Publish a realistic timeframe and direct urgent or unclear cases to a call, appointment or emergency route.