Danish pharmacies are tightening identity checks when handing out prescription medicine, after the leak of data from the CPR register on 8.8 million people. Customers can now be asked for a health card, other ID, or control questions.
The pharmacy sector’s trade and employer organisation, Danmarks Apotekerforening, announced the change in a press release sent to the news agency Ritzau. As DR reports, pharmacies are sharpening their attention when dispensing both medicine and health information. The tightening applies in particular to medicines with a risk of misuse.
In practice, it will normally not be enough to state a CPR number when collecting medicine, the organisation said. Customers can instead be asked to show ID, for example a health card in physical or digital form. Pharmacy staff may also ask relevant control questions.
Extra checks when you collect medicine for someone else
Danmarks Apotekerforening told Ritzau that extra checks will also apply when a person picks up medicine for somebody else. The aim is to make sure that medicine and personal health information reach the right person. Berlingske reports the same guidance, adding that customers may need to bring the other person’s health card or other identification.
If that is not possible, the pharmacy will ask a number of relevant control questions, according to the organisation’s follow-up answer to Ritzau. Ritzau has also asked Praktiserende Lægers Organisation, which advises general practices, whether patients can still renew prescriptions by phone using only their CPR number.
Authorities told organisations to stop relying on CPR numbers
The pharmacy announcement followed an authority briefing on the leak earlier on Tuesday. There, the director of Styrelsen for Samfundssikkerhed, Laila Reenberg, was asked how pharmacies should act in future. Her answer was that they must find other ways, for example by having people show their health card.
Reenberg said people must expect that a CPR number can no longer be used to identify them. A CPR number can no longer be relied on to identify a specific citizen, she said, calling it a consequence of the leak. Berlingske and Politiken report the same recommendation to pharmacies and other organisations.
It emerged on Monday that unauthorised parties had harvested information on 8.8 million living, deceased and emigrated people in the CPR system during ten days in September. According to DR, this was done by misusing a private Danish company’s lawful access to search the register. The case has been reported to Datatilsynet, and the National Unit for Special Crime, NSK, is investigating.
It is not yet possible to say who is behind the data theft. Authorities also do not know whether any citizens will need a new CPR number.
What the pharmacy checks mean for internationals in Denmark
Everyone registered as a resident in Denmark receives a CPR number and a yellow health card, the sundhedskort, which also exists as a digital card in an app. The card is the standard identification used across Danish healthcare, including at the pharmacy counter. Danmarks Apotekerforening says the easiest option is to bring the health card or other ID.
For foreign residents, that means a prescription pickup may now require the physical or digital health card, rather than just reciting a CPR number. The same applies when collecting medicine for a partner, child or elderly relative, where the pharmacy may ask for that person’s card or pose control questions. The guidance from Danmarks Apotekerforening does not set out separate rules for people without a Danish health card, and the authorities have not said how long the tightened checks will last.
