Q383 · How should we properly dispose of old…

Q383 · Category H: Licensed operations and routine regulatory oversight (Q351–Q400)

A prescription is not only the legal basis for dispensing; it also contains sensitive personal information protected under the Personal Data (Privacy) Ordinance (Cap. 486). It must therefore be handled with great care. First, under the regulations, prescriptions must be kept for at least two years from the date of dispensing. During this period, they must be stored securely to prevent unauthorised access. Once the retention period has expired, they must never be discarded directly as ordinary waste paper. You must destroy them securely to ensure that patient information cannot be recovered. The most common methods are shredding them or engaging a professional confidential document destruction company, and obtaining a certificate of destruction.

📘 Regulatory basis

The Pharmacy and Poisons Regulations (Cap. 138A) require prescriptions to be retained for two years. Data Protection Principle 4 under the Personal Data (Privacy) Ordinance provides that data users must take all practicable steps to ensure that personal data is protected against unauthorised or accidental access, processing or use.

📗 Drew Tang's recommendations

We recommend that pharmacies establish a clear document retention and destruction policy. Prescriptions that have passed their retention period can be destroyed in batches quarterly or annually. Using a high-security cross-cut shredder is a cost-effective in-house method. If prescription volumes are large, outsourcing to a professional destruction company is more efficient and can provide independent evidence of compliance.

📕 Risk notice

Improper disposal of prescriptions containing patient information, if it results in a data breach, will breach both medicines legislation and privacy legislation. The Office of the Privacy Commissioner for Personal Data has the power to investigate and impose penalties. More seriously, this will severely damage your professional reputation and customer trust, causing irreparable harm to the pharmacy’s reputation.

Plan Your Hong Kong Pharmaceutical Licensing Project with Drew Tang

Business Manager Tang Shangyong (Drew Tang) will review your products, operating model, licence type and preparation requirements with you one-to-one. The precise service scope is confirmed in writing; pharmaceutical duties are carried out by legally qualified personnel, and approvals are determined by the competent authorities.

How should we properly dispose of old prescriptions containing patients’ personal information that are kept by our pharmacy?

Plan Your Hong Kong Pharmaceutical Licensing Project with Drew Tang