The Schleswig-Holstein data protection authority ('ULD') issued, on 23 August 2022, a press release concerning the e-prescription procedure for pharmacy-only medicines, introduced at federal level for all Germany. In particular, the ULD explained that it had received, in July 2022, an enquiry from the Association of Statutory Health Insurance Physicians of Schleswig-Holstein ('KVSH') regarding whether it would be permissible, under data protection law, for doctors' practices to use emails or text messages, instead of the nationally planned e-prescription app, to hand out electronic prescriptions to patients. Further to this, the ULD noted that, according to the KVSH, if the data matrix code, which is similar to a QR code, is sent unencrypted via email or SMS, there would be no risks for data subjects as the code does not contain any sensitive data.

However, the ULD clarified that an examination carried out in consultation with other data protection authorities revealed that anyone in possession of the matrix code could use the same to view the centrally-stored complete medical prescriptions containing the name of the patient, the date of birth, the doctor's contact details, the date of the prescription, and the type of medicine. As such, the ULD advised that medical practices must ensure that patients receive their prescriptions in a secure manner and that they should not resort to insecure procedures that create the risk of personal data, including sensitive data, being intercepted or copied.

In light of the above, the ULD suggested several possible solutions, such as sending prescriptions via email with additional end-to-end encryption.

You can read the press release, only available in German, here.