Official update · document review
ACQSC alert: unauthorised prescribing on eNRMC
ACQSC's 13 August 2026 alert follows a case in which an unauthorised aged care worker accessed a residential provider's electronic National Residential Medication Chart (eNRMC), created a false prescriber profile, and prescribed or changed medicines and medication charts without valid authority. No significant harm was reported, but the case exposes linked risks to resident safety, system access controls and personal information. The alert reiterates existing obligations and regulatory expectations; it is not new legislation.
Document and workflow checks
Turn the official change into reviewable actions
- If unauthorised access or prescribing is suspected, immediately protect potentially affected older people, arrange urgent review by a medical practitioner, investigate the activity and preserve authorised audit evidence.
- Verify prescriber identity, credentials and authority; use independent approval or second sign-off where appropriate, promptly deactivate access that is no longer required, and monitor unfamiliar profiles, unsupported medicine changes and unusual access patterns.
- Follow the provider's incident management process. Notify police, Ahpra and the Commission where appropriate; separately assess feedback, SIRS and open-disclosure requirements against the circumstances rather than assuming every anomaly follows the same reporting path.
- Keep resident, medication, access-log and investigation records in the provider's authorised systems, not in CaresLink.
Who may need to review this
- Residential aged care provider managers
- Clinical governance and medication-safety teams
- Privacy, cyber security, workforce and incident-response owners
Impact areas
- eNRMC prescriber identity and access control
- Resident safety review and incident response
- Conditional reporting, open disclosure and audit evidence
Team review question
Which prescriber-access control, monitoring check or incident-response handoff needs an owner?
Usage boundary
This is a regulatory safety alert, not prescribing or treatment advice, a cyber-security certification, or a new law. CaresLink does not receive resident, medication or access-log data and does not replace urgent clinical review, authorised eNRMC records, incident management, open disclosure or official reporting.