Pharmacy refills and lab test scheduling

Refilling a prescription and booking a blood draw are two of the most repeated errands in health care, and both are mostly administrative. A patient’s agent can ask a pharmacy’s agent for a refill, track it, and book a lab slot directly. Clinical decisions, controlled substances and anything a pharmacist needs to judge stay with people, and the prescription channel itself connects prescribers and pharmacies. Consumer agents have no place on it.

How it works today

Refills. Patients request refills through the pharmacy’s app, website or automated phone line. If the prescription has refills left, the pharmacy fills it. If not, the pharmacy asks the prescriber for a renewal. That request travels over NCPDP SCRIPT, the standard that carries prescription data between prescribers, pharmacies and payers: new prescriptions, changes, refill requests, fill status, cancellations and medication history. The renewal pair is RxRenewalRequest and RxRenewalResponse. Claims to the patient’s drug plan use a separate NCPDP standard, the Telecommunication standard.

Medicare Part D rules require these transactions to use a SCRIPT version named in 45 CFR 170.205(b). Under the June 2024 final rule, either SCRIPT 2017071 or 2023011 may be used until the end of 2027, and version 2023011 alone from 1 January 2028.

Controlled substances. In the US, Schedule II prescriptions cannot be refilled (21 CFR 1306.12). Schedule III and IV prescriptions cannot be filled or refilled more than six months after issue, or refilled more than five times (21 CFR 1306.22). In Canada, section 37 of the Narcotic Control Regulations bars a pharmacist from dispensing a narcotic once the quantity on the prescription has been dispensed.

Lab scheduling. Labs book through their own portals and phone lines. HL7 FHIR defines the building blocks: a Slot is time on a schedule available for booking, and an Appointment is the booking itself. SMART Scheduling Links lets a provider publish its locations, schedules and open slots publicly, as static bulk files. Each slot carries a booking deep link, so a finder app sends the person to the provider’s own booking page instead of booking itself.

Access rights. HIPAA lets a patient direct a covered entity to send their health information to a third party, including an app they chose; HHS says a covered entity generally cannot refuse to send readily producible ePHI to such an app. A personal representative, such as a parent or someone holding a health care power of attorney, stands in the patient’s shoes, but only within the scope of that authority.

The agent-to-agent version

Illustrative. A patient’s agent asks the pharmacy’s agent for a refill:

{
  "jsonrpc": "2.0",
  "id": 8,
  "method": "SendMessage",
  "params": {
    "message": {
      "role": "ROLE_USER",
      "messageId": "msg-rx-6604",
      "parts": [
        {"text": "Please refill prescription 4471902 for pickup at the Queen St location."},
        {
          "data": {
            "rxNumber": "4471902",
            "pickupStore": "queen-st",
            "earliestPickup": "2026-09-28",
            "notifyWhenReady": true
          },
          "mediaType": "application/json"
        }
      ]
    }
  }
}

1. The pharmacy’s agent authenticates the request against the patient’s account and finds no refills left.
2. The pharmacy system sends an RxRenewalRequest to the prescriber over SCRIPT. The A2A task stays in TASK_STATE_WORKING, and the pharmacy’s agent tells the patient’s agent why.
3. When the prescriber approves, the pharmacy fills the prescription, runs the claim and completes the task with the pickup time and copay.
4. If the prescriber denies, or the drug is controlled, or the patient asks a clinical question, the task goes to the pharmacist.

Lab booking follows the same pattern. The patient’s agent asks the lab’s agent for early-morning fasting slots near home, and the lab’s agent answers from the same Slot data it already publishes, then books the Appointment.

What has to be true

Identity. The pharmacy must know the request comes from the patient’s authorized agent. In practice that means the patient signs in to the pharmacy’s own system and grants the agent a credential, the way a patient authorizes an app today. A software agent is not a HIPAA personal representative; that role belongs to people with legal authority.

Authority. The grant should be narrow: request refills of existing prescriptions, check status, book lab visits. It should not cover changing the pickup person, reading the full medication history, or controlled substances, which already carry their own refill limits.

Record. The pharmacy’s dispensing record and the SCRIPT messages remain the clinical and legal record. The agent exchange adds a record of what the patient’s agent asked for and when, which helps when a refill is delayed or disputed.

Privacy. Health data that reaches a patient-chosen app or agent is outside HIPAA once it arrives, according to HHS. The agent’s own privacy terms, and state or provincial health privacy law where it applies, govern it from there.

Where Emissar fits

• Front Door (open to design partners) lets a pharmacy or lab accept requests from patients’ agents in front of its existing systems.
• Mandate (spec in progress) is aimed at the narrow grant above: these actions, for this patient, revocable.
• Handoff (in development) routes anything clinical to a pharmacist with the exchange attached.
• Verify (in development) and Ledger (spec in progress) apply as in any exchange where the business needs to know the agent and both sides need a record.

Open questions

• Direct booking. SMART Scheduling Links deliberately sends people to the provider’s booking page. Whether labs will let an agent book directly depends on their identity and consent rules.
• Where A2A meets SCRIPT. The pharmacy’s agent sits beside a regulated prescription network. Keeping the two separate, so no consumer message is treated as a prescription transaction, is a design requirement.
• Early and emergency refills. These involve a pharmacist’s judgment and sometimes the prescriber’s. An agent can ask, but should not be the one deciding.
• Canadian privacy law. Health privacy in Canada is largely provincial, and each province’s rules on agents and apps would need their own review.