IE Medication Events Implementation Guide - Local Development build (v0.1.0) built by the FHIR (HL7® FHIR® Standard) Build Tools. See the Directory of published versions

Cross-Border ePrescription (reference examples)

Cross-Border ePrescription (MyHealth@EU)

Illustrative. The actors, flows and payloads in this section describe how a cross-border exchange could work. They are not a description of any live HSE, NePS or National Contact Point system. For the conformant HIQA-aligned cross-border example, see scenario 6 on the HIQA 2026 Alignment page.

This section covers Ireland's participation in the EU cross-border ePrescription and eDispensation infrastructure under MyHealth@EU and the European Health Data Space (EHDS) Regulation 2025/327.

IE MPD provides dedicated FHIR R4 profiles for the full ePrescription lifecycle — from prescription creation in Ireland through cross-border transmission and foreign dispensation, to the eDispensation response returned to the Irish National Contact Point for eHealth (NCPeH).

What This Section Covers

Scope

Outbound (Ireland → EU)

An Irish GP issues a prescription using IE MPD ePrescription profiles. The prescription is transmitted via the Irish NCPeH (HSE eHealth) through the MyHealth@EU Central Hub to the destination country's NCPeH, where a foreign pharmacy can retrieve and dispense it.

Nine destination countries are illustrated in this guide:

Inbound (EU → Ireland via NePS)

EU citizens visiting Ireland can have their foreign prescriptions dispensed at Irish pharmacies through the National ePrescription Service (NePS). Foreign drug codes are mapped to Irish NMPC codes, with SNOMED CT Irish Edition carried as secondary coding where available.

Technical Infrastructure

The following sequence diagram shows the full cross-border ePrescription workflow from prescription creation in Ireland through dispensation in an EU member state and return of the eDispensation record.

sequenceDiagram
    autonumber
    participant GP as 🏥 Irish GP<br/>(HSE eHealth)
    participant NCPeH_IE as 🇮🇪 NCPeH Ireland<br/>(HSE)
    participant Hub as 🌐 MyHealth@EU<br/>Central Hub
    participant NCPeH_EU as 🇪�� EU NCPeH<br/>(Dispensing Country)
    participant Pharmacy as 🏪 EU Pharmacy
    participant Patient as 👤 Patient<br/>(EUDI Wallet)

    GP->>NCPeH_IE: Issue ePrescription<br/>(FHIR MedicationRequest Bundle)
    NCPeH_IE->>NCPeH_IE: Validate & sign<br/>(qualified e-signature, IHE ATNA audit)
    NCPeH_IE-->>Hub: Register prescription availability<br/>(XCA)

    Patient->>Pharmacy: Present with eIDAS digital ID<br/>(EUDI Wallet, LoA: High)
    Pharmacy->>NCPeH_EU: Request patient ePrescription<br/>(XCPD patient discovery)
    NCPeH_EU->>Hub: Forward request<br/>(cross-border PID: IE/CC/1234567T)
    Hub->>NCPeH_IE: Query prescription<br/>(XCA document retrieve, SOAP/HTTPS)
    NCPeH_IE-->>Hub: Return signed ePrescription Bundle
    Hub-->>NCPeH_EU: Deliver ePrescription<br/>(audit logged, consent verified)
    NCPeH_EU-->>Pharmacy: Provide ePrescription<br/>(translated to local format)

    Pharmacy->>Pharmacy: Verify prescription<br/>Check allergy alerts<br/>Apply generic substitution
    Pharmacy->>Patient: Dispense medication

    Pharmacy->>NCPeH_EU: Create eDispensation<br/>(FHIR MedicationDispense)
    NCPeH_EU->>Hub: Forward eDispensation
    Hub->>NCPeH_IE: Return eDispensation<br/>(prescription marked as used)

Cross-Border Routing Overview

The diagram below shows how Ireland routes outbound ePrescriptions to nine EU destination countries through the MyHealth@EU Central Hub, each using the destination country's national drug code system.

flowchart LR
    IE["🇮🇪 **Ireland**
NCPeH IE / HSE"]
    Hub(["🌐 MyHealth@EU
Central Hub"])

    IE --> Hub

    Hub --> DE["🇩🇪 **Germany**
PZN codes"]
    Hub --> ES["🇪🇸 **Spain**
CIMA codes"]
    Hub --> FR["🇫🇷 **France**
CIP codes"]
    Hub --> NL["🇳🇱 **Netherlands**
G-Standaard GNK"]
    Hub --> LV["🇱🇻 **Latvia**
ZRA codes"]
    Hub --> PT["🇵🇹 **Portugal**
INFARMED codes"]
    Hub --> DK["🇩🇰 **Denmark**
DKMA/VNR codes"]
    Hub --> SE["🇸🇪 **Sweden**
LMV codes"]
    Hub --> AT["🇦🇹 **Austria**
BASG codes"]

    style IE fill:#169b62,color:#fff,stroke:#169b62
    style Hub fill:#003399,color:#fff,stroke:#003399

XT-EHR 1.0.0 ePrescription Model Changes

The XT-EHR EHDSMedicationPrescription logical model was updated in v1.0.0 with the following additions. IE MPD ePrescription profiles have been updated to reflect these changes.

Off-label prescribing note: The IEMpdOffLabelUse extension is added at the MedicationRequest level. IE MPD profiles for ePrescription, eDispensation, and Medication are formally derived from the EU MPD IG (hl7.fhir.eu.mpd@1.0.0 STU, published Jun 2026). The extension contains two sub-extensions: isOffLabelUse (boolean, 1..1) and reason (CodeableConcept or string, 0..*).

R4/R5 note: The XT-EHR logical models are authored in FHIR R5. In FHIR R4, MedicationRequest.statusReason and dispenseRequest.dispenseInterval are both available and map directly to the XT-EHR elements.

IHE Profiles Used

FHIR Profiles Used

Cross-Border Security

This section describes the security requirements that apply specifically to cross-border ePrescription and eDispensation exchange via MyHealth@EU. For domestic security requirements, see the Security page.

eHDSI Security Framework

The eHealth Digital Service Infrastructure (eHDSI) Security Framework governs all cross-border healthcare data exchange. It is based on:

• eHDSI Security and Privacy Architecture (eHDSI-S-EP v2.2+) — defines security zones, trust hierarchies, and access control policies for all MyHealth@EU services
• eIDAS Regulation 2014/910/EU and eIDAS 2.0 (Regulation 2024/1183/EU) — electronic identification and qualified trust services
• GDPR (2016/679/EU) — data protection requirements applying to all cross-border health data exchange
• EHDS Regulation (2025/327) — data governance framework for primary and secondary use of health data

The eHDSI Security Framework defines three security domains:

Prescription Bundle Signing

Two different signatures are involved, and IE MPD only profiles the first:

1. The prescriber's signature (HIQA EP 2.13, a legal requirement for cross-border prescriptions). IE MPD carries it as a Provenance record whose target covers every prescription item, inside an IE MPD cross-border ePG (invariant ie-bnd-xb-2; ADR-003). A Provenance signature survives storage in NePS and re-bundling, which Bundle.signature does not. The signature format and eIDAS assurance level are Requires Clarification (OI-009).
2. A transport or organisational seal that a National Contact Point may apply before sending. It is outside the HIQA drafts. The flow below illustrates it as it was originally drafted for this IG.

The illustrative flow assumes that the Irish NCPeH applies a Qualified Electronic Seal to outbound bundles before transmission to the MyHealth@EU Central Hub.

Signing process:

sequenceDiagram
    autonumber
    participant GP as 🏥 Irish GP
    participant NePS as 🇮🇪 NePS/HSE System
    participant NCPeH_IE as 🇮🇪 NCPeH Ireland
    participant Hub as 🌐 MyHealth@EU Hub

    GP->>NePS: Create ePrescription (FHIR MedicationRequest Bundle)
    NePS->>NCPeH_IE: Submit for cross-border export
    NCPeH_IE->>NCPeH_IE: Validate FHIR bundle against IE MPD profiles
    NCPeH_IE->>NCPeH_IE: Apply QeSeal (JAdES enveloping signature)<br/>using HSE/NCPeH qualified certificate
    NCPeH_IE->>NCPeH_IE: Set Bundle.signature (sigFormat: application/jose)
    NCPeH_IE->>Hub: Transmit signed bundle via mTLS (XCA)
    Hub->>Hub: Verify QeSeal against Irish QTSP Trust List
    Hub-->>NCPeH_IE: Acknowledgement

Signature elements in FHIR Bundle:

mTLS for NCP-to-NCP Communications

All NCP-to-Hub and Hub-to-NCP communications SHALL use mutual TLS (mTLS):

Patient Identity Verification (eIDAS / EUDI Wallet)

When a patient presents at a foreign EU pharmacy to retrieve a cross-border prescription, the pharmacy SHALL verify the patient's identity using an eIDAS-compliant mechanism:

The pharmacy system extracts the personal_identifier from the PID attestation (format: Origin/Destination/NationalID, e.g. IE/DE/1234567T) and submits this to the NCPeH for patient discovery (XCPD).

Cross-Border Consent Verification

Before a foreign NCPeH returns a prescription to the dispensing country, consent SHALL be verified:

1. Implicit consent — The patient presenting their EUDI Wallet / eIDAS identity at a pharmacy constitutes implicit consent for the pharmacy to retrieve their prescription, in accordance with the eHDSI consent model and EHDS Regulation 2025/327
2. Explicit opt-out — Patients may register an opt-out with their home country NCPeH to prevent cross-border data sharing
3. Consent logging — The consent decision (implicit/explicit, timestamp, patient identity, purpose of use) SHALL be logged as a FHIR AuditEvent at both the originating and receiving NCPs

Consent records SHOULD use the following AuditEvent structure:

{
  "resourceType": "AuditEvent",
  "type": { "system": "http://dicom.nema.org/resources/ontology/DCM", "code": "110106", "display": "Export" },
  "action": "R",
  "recorded": "2025-01-20T10:30:00Z",
  "outcome": "0",
  "purposeOfEvent": [{ "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason", "code": "TREAT", "display": "Treatment" }],
  "agent": [
    { "type": { "coding": [{ "code": "110150", "display": "Application" }] }, "who": { "display": "NCPeH Ireland (HSE)" }, "requestor": false },
    { "type": { "coding": [{ "code": "110153", "display": "Source Role ID" }] }, "who": { "identifier": { "system": "urn:oid:1.3.6.1.4.1.12559.11.10.1.3.1.42.1", "value": "IE/DE/1234567T" } }, "requestor": true }
  ],
  "source": { "site": "NCPeH-IE", "observer": { "display": "HSE NCPeH Ireland" } },
  "entity": [{ "what": { "reference": "Bundle/ie-bundle-to-de-eprescription" }, "role": { "code": "4", "display": "Domain Resource" } }]
}

References