Build with rxConnect®

Integrate eRx electronic prescribing and the Services Australia Healthcare Identifiers Service into your own PMS, telehealth, clinical or healthcare application.

Environments

Staging and production are separated for both services. Use the exact domains supplied for your organisation.

rxConnect® quickstart

1. Obtain an OAuth token

Use the confidential client credentials supplied for the target environment.

curl -X POST "https://rxconnect-stg.<domain>.com.au/o/token/" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=$RXCONNECT_CLIENT_ID" \
  -d "client_secret=$RXCONNECT_CLIENT_SECRET"

When generating a token for the patient React/iFrame view, also include the patient’s unique PMS identifier as patient_guid. The returned token is passed to the component as the t query parameter.

2. Create an eScript

POST a JSON object containing Patient, Clinician and PrescribedItem. rxConnect® generates the SCID for a new prescription and forwards the correctly formatted request to eRx.

curl -X POST "https://rxconnect-stg.<domain>.com.au/eprescriptions/erx001/" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  --data @prescription.json

Authentication

rxConnect® endpoints use OAuth 2.0 bearer tokens. Read operations require the read scope; create and lifecycle operations require read and write. hiConnect® uses a separate JWT bearer token for each environment. Integration testing may use a provided long-lived token; production systems should generate short-lived server-side tokens, typically valid for 5–15 minutes.

Create-prescription payload

The erx001 request must be populated from your local patient, clinician and medication records.

Optional React and iFrame integration

HITORI supplies a customisable React component for the patient eScript list and post-create actions. Using it is optional: you can embed it directly, wrap it in an iFrame, adapt and style it to your own interface, or omit it entirely and build a fully custom UI against the rxConnect® API.

If you use the supplied component, pass the OAuth access token as t. The token is linked to the patient_guid used during authentication so the component filters prescriptions for that patient.

<iframe
  src="https://<react-app-domain>/?t=<access_token>"
  width="100%"
  height="600"
  style="border:0"
></iframe>

ePrescription workflows

The initial create action is sent from your application. The supplied React component handles cancellation, amendment, cessation and token re-issue for prescriptions in the patient list.

rxConnect® API reference

HI Service

The included HI Service integration is called hiConnect®. It provides the Services Australia connection used to retrieve or verify a patient’s Individual Healthcare Identifier. Store the returned ihiNumber in your system, then populate PatientIHI in the rxConnect® create-prescription payload.

Swagger documentation is available in each deployed environment at /index.html.

IHI lookup requests

Send demographics with one supported search identifier. Medicare lookup uses medicareCardNumber and medicareIRN. You may alternatively verify an existing ihiNumber, or search with a DVA file number, mobile number or email where supported.

curl -X POST "https://hi-stg.<domain>.com.au/api/IHI" \
  -H "Authorization: Bearer $HICONNECT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "medicareCardNumber": "<10-digit number>",
    "medicareIRN": "<IRN>",
    "dateOfBirth": "YYYY-MM-DD",
    "givenName": "<given name>",
    "familyName": "<family name>",
    "sex": "<M|F|I|N>"
  }'

If this information is not already captured in compliant client-side audit logs, include hpii, hpio and LocalUserId in every request. Validate IHI values using the Luhn algorithm and validate Medicare card numbers before calling the service.

Responses and edge cases

A successful response includes ihiNumber, ihiStatus and recordStatus. Handle these documented HI Service outcomes explicitly:

Errors

rxConnect® commonly returns 400 for invalid or missing input, 401 for missing or invalid authentication, 404 when the prescription or operation cannot be found, and 500 for unexpected processing errors. Do not automatically retry validation or identity errors without correcting the request.

Security and deployment

• Store base URLs, OAuth client credentials and JWT material in server-side environment variables.
• Use HTTPS for every application and endpoint.
• Use separate credentials for staging and production.
• Provide HITORI with the staging and production origins that must be allowed by CORS.
• Keep patient payloads and bearer tokens out of logs, browser bundles and support messages.

Contact HITORI

When requesting support, include the environment, timestamp, operation or endpoint, and SCID or HI Service error code where relevant. Do not include access tokens or unnecessary patient information.