A pharmacy app is a request queue with a pharmacist at the end.

Not every prescription can be refilled

Start with the hard stops, because they decide what the app is allowed to offer. Refilling a prescription for a controlled substance listed in Schedule II is prohibited, which is set out in 21 CFR 1306.12. A Schedule II item needs a new prescription, so a refill control on that row teaches people to ask for something nobody can give them.

For Schedule III and IV, two limits run at once. A prescription may not be filled or refilled more than six months after the date it was issued, and one authorized to be refilled may not be refilled more than five times. Either limit can bite first. A prescription with refills printed on the label is still finished if it was written seven months ago.

The same rule says what has to be retrievable by prescription number for each refill: the name and dosage form of the controlled substance, the date filled or refilled, the quantity dispensed, the initials of the dispensing pharmacist, and the total number of refills. Read that as a note about where the record lives. The dispensing system holds it. Your app holds a request and a status, and if it ever becomes the only place something was written down, the design has gone wrong.

Everything else, including whether a prescription that is not a controlled substance can be refilled today, comes from what the prescriber authorized and from state law. The tool below covers the federal limits only.

21 CFR 1306.22, refilling of prescriptions

Prescription data is protected health information

The Privacy Rule protects individually identifiable health information held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper or oral. That covers information about the provision of health care to a person, or payment for it, that identifies them. A filled prescription attached to a name sits squarely inside it, and so does the bare fact that a named patient asked for a refill, before you reach the drug name at all.

The sharp edge is the lock screen. A push notification reading your sertraline is ready can be read by anyone holding the handset, including the person the patient least wants reading it. The version that works says a prescription is ready and keeps the detail behind a sign in. The same goes for email subject lines, badge text and anything that survives in a notification history.

There is a contract question underneath the design. HHS describes a business associate as a person or organization outside the workforce that performs functions or services for a covered entity involving the use or disclosure of this information, and the covered entity has to impose written safeguards through a business associate agreement. So where the data is hosted is decided before the first screen is drawn. The same rule set shapes pickup: the Privacy Rule provision on informal permission is what allows a pharmacist to dispense filled prescriptions to a person acting on behalf of the patient, so an app that assumes the patient always collects is modelling the wrong world.

Two things this page cannot do. It cannot tell you what your state requires, because a contrary state law that gives people greater privacy protection is not displaced by the Privacy Rule, and pharmacy practice itself is licensed state by state. And it is not legal advice. For the obligations themselves, read what HIPAA actually requires, then put the specifics to your board of pharmacy and your own counsel before anything ships.

HHS, summary of the HIPAA Privacy Rule

What a refill request has to carry

A request that says my blood pressure one is a phone call with extra steps. A request that carries the prescription number, the patient, a pickup or delivery choice and when they need it is work the counter can act on. Let the camera read the number off the label where you can, because typing a long number from a small label is where people give up and ring instead.

Then the states. Requested, accepted, waiting on the prescriber, partly filled, ready, collected, and still sitting on the shelf after a week. The one everybody leaves out is waiting on the prescriber, which is where most of the waiting actually happens. Leave it out and the app goes quiet at exactly the moment the patient starts phoning.

Ready is a notification, and notifications are their own design problem: quiet hours, one message instead of three, and an obvious way to stop them. A pharmacy that also runs vaccination clinics or medication reviews needs the same machinery as an appointment reminder app, which is worth knowing before you pay to build it twice.

Pickup deserves its own record rather than a tick on the request. Who collected, when, and whether that was the patient or somebody collecting for them. What identification you ask for at the counter is your pharmacy's policy, but the app should at least be able to write down the answer.

What to build first for one shop

A community pharmacy app that only takes refill requests and says when they are ready is not a small ambition. For most shops it is the whole thing. Count the calls at the counter for a week and the list will be short: is it ready, can I get it early, has the doctor sent it, can my son collect it.

The integration question decides the budget, so ask it before design. Whether your dispensing system will let an app read prescription status or accept a request depends on that vendor, and we have not verified the terms of any specific one. Ask them in writing for the interface, the cost and what you are allowed to store, rather than designing around an answer you assumed. If the answer is no, an app that takes structured requests and prints them at the counter still removes the phone calls, which was the point.

Pharmacies adding clinical services meet the next layer, where booking, consultation notes and sometimes video start to look like telehealth app development. Keep that out of version one. A refill queue that works will earn the argument for the rest.