Thirteen safety engines screen the order before a pharmacist ever sees it
Pharmacy Module
Available nowThe Eruntar Pharmacy Module is closed-loop medication management for hospital and clinic pharmacies: clinical screening and verification, dispensing, batch inventory, procurement, cold chain, controlled substances and recalls.
Every order is screened before a pharmacist sees it, a dose cannot skip a step, and the stock ledger cannot be rewritten.
13
safety engines on every order
4
verification levels, derived from the findings
16
states a dose passes through, none skippable
0
ledger rows anyone can edit or delete
Pharmacy Module
Solutions
Who it is for
Hospital and clinic pharmacy departments
Works with
Our Doctor Module, or orders from the system you already use
Every order
Screened by thirteen engines before a pharmacist sees it
Scrutiny
Four levels, derived from the findings
A dose
Sixteen states, and none can be skipped
Stock
By batch. First expiry, first out
Controlled drugs
A witness who cannot be you
The ledger
Append-only. The database refuses edits
Connects to
FHIR R4, HL7 v2, NCPDP SCRIPT and GS1
Availability
Available now, in any browser
The verification queue, what went near expiry overnight, and whether the fridges stayed in range, on one screen.
Thirteen engines screen it before you see it. The findings set the level of scrutiny, from automated to two signatures.
Each finding shows the rule that produced it and its evidence. Override an advisory with a reason. A critical finding stops the dose.
Scan the GS1 barcode. The batch that expires first is the one offered, and a recalled or expired one will not scan through.
Counselling recorded as an intervention with an outcome. At the end of the day, the controlled register reconciled against the count.
The dispensary floor
That sentence is from the module's own architecture specification. These are the places where the code enforces it, and where a busy afternoon cannot become a dispensing error.
A controlled or high-alert order needs two signatures, and they cannot belong to one person. The dispenser must not be the verifier.
Every witnessed movement on the controlled register, and the daily reconciliation, needs a second user who is not the performer.
It fails closed to a pharmacist, not to the automated level. A dose at level two or above cannot be released without a recorded verifier and a separate accuracy check.
This one is a stop, not a ban. The dose is held until a pharmacist writes the justification and re-authenticates, and an emergency dispense does not bypass it.
It is excluded from first-expiry-first-out selection, and scanning it at the bench fails the batch check rather than being waved through.
A state can never be assigned directly. Every move is checked against the state machine, and a terminal state has no way out.
The cold-chain stock at that location is quarantined in the same transaction as the reading, before anyone has looked at a chart.
Every AI capability is advisory and needs a pharmacist to accept its output. The rule is written as a test, so a violation fails the build rather than a review meeting.
And once the dose goes out
Reserve first, deduct when the medicine actually leaves. On-hand, reserved and the ledger move in one transaction, and the database refuses to update or delete the history.
Schedules II to V on an append-only register with a running balance after every movement, and a daily reconciliation that surfaces variances as a number rather than absorbing them.
A recall quarantines every matching batch at once and names the patients who already received the drug, so they can be contacted the same day.
The advisory layer is deliberately deterministic today. It composes from the dispense record and the safety findings, invents nothing, and says so on screen. We would rather ship a stub we can defend than a claim we cannot.
Counselling points composed from the dispense record and its safety findings, labelled as not patient-ready. A pharmacist reviews and personalises before anything reaches a patient. Premium.
A plain-language account of why a finding fired, generated from the rule and its inputs rather than invented. Premium.
The AI layer cannot change a dispense, release an order or move stock. Every interaction is recorded with its prompt version and outcome, and the safety rules run as tests in the build.
Questions
It is hospital and clinic pharmacy software that runs the medication supply chain and the clinical checks around it: receiving an order, screening and verifying it, picking the right batch, labelling and dispensing it, and keeping stock, controlled substances, cold chain and expiry under control. One governed workflow rather than a billing screen with a stock list attached.
Thirteen screening engines evaluate every order before a pharmacist sees it: allergy and cross-reactivity, drug interactions, dose range, therapeutic duplication, renal and hepatic adjustment, paediatric, geriatric, pregnancy, lactation, high-alert and controlled classification, and pharmacogenomics. The findings decide the level of scrutiny. Level one is automated for an order with no findings, level two is a pharmacist, level three a clinical pharmacist when findings accumulate, and level four is dual authorisation for controlled and high-alert medicines. The level is derived from the findings, never chosen by whoever is on shift.
The engines ship with curated screening tables built into the module, and each finding records its evidence source so a reviewing pharmacist knows what backed it. A commercial drug knowledge base such as First Databank, Lexicomp or Micromedex plugs into the same engine interface as a data change rather than a rebuild. We are explicit about this on screen as well as here: the built-in tables are a screening floor, not a licensed clinical reference.
An advisory finding, yes, with a recorded reason. A critical finding is a hard stop: the dose cannot be released until it is overridden with a written justification and the pharmacist has re-authenticated, and the override is recorded with its actor. An emergency dispense skips the routine checks, but it does not skip a critical finding. Override rate is a standing metric.
By batch, on an append-only ledger. Every movement writes a row with the previous and new balance, the actor and the reason, and database triggers reject any attempt to update or delete ledger history. Batches carry lot, expiry, manufacture date, supplier and unit cost. Picking is first-expiry-first-out, and an expired, quarantined or recalled batch cannot be picked or scanned through.
Yes. Locations are a real hierarchy of pharmacy, zone, cabinet, shelf and bin, and stock transfers between them run through a request and approval workflow that lands in the same ledger. Warehouse put-away and binning flows are on the roadmap rather than available today.
Yes: purchase request, approval, purchase order, confirmation and goods receipt, with receiving handled by the same inventory engine that governs every other movement, so nothing enters stock by a side door. Per-drug reorder points drive replenishment, and ABC, VEN and FSN analytics classify stock by consumption value, clinical criticality and movement frequency. Supplier contracts and price comparison are not available yet.
On an append-only register covering schedules II to V. Every receipt, dispense, return, destruction, adjustment and count is recorded with a running balance and a witness alongside the performing user, and the witness cannot be the same person. Opening a vault and dispensing a controlled drug require re-authentication at the moment of use, daily reconciliation compares the register against the physical count, and configurable thresholds flag diversion patterns for an approval-gated investigation.
Initiating a recall quarantines every matching batch in the same transaction, which removes them from first-expiry-first-out selection immediately, and identifies the patients who already received the drug so they can be contacted. Closing the recall does not release the batches. Quarantined batches and identified patients are counted to closure.
Temperature-controlled batches carry their required range, readings are recorded against them, and a reading outside two to eight degrees quarantines the cold-chain stock at that location in the same transaction as the reading, rather than waiting for someone to notice. Excursions are a standing dashboard metric. Live broker-based sensor ingestion is roadmap; today readings arrive through the device and integration surface.
Yes. Inbound HL7 v2 pharmacy orders and NCPDP SCRIPT electronic prescriptions are translated at the edge into the module's own order shape and never reach business logic raw. Outbound, the module serves FHIR R4 MedicationDispense, Medication, InventoryItem and SupplyRequest resources with a CapabilityStatement. GS1 barcodes are parsed for GTIN, lot and expiry on receipt and at the bench. Outbound HL7 dispense messaging and NCPDP network certification are roadmap items.
Two things today, on Premium: it drafts patient counselling points from the dispense record and its safety findings, and it explains in plain language why a finding fired. Both are composed deterministically from the record, labelled as not patient-ready, and reviewed by a pharmacist before anything reaches a patient. The AI layer cannot change a dispense, release an order or move stock, and that rule is written as a test that fails the build. A licensed clinical model slots in behind the same versioned prompt registry.
By capability rather than by job title: 85 of them, each tied to a stage of the medication journey, assigned through 22 least-privilege role templates from chief pharmacist to regulatory inspector. Eight actions additionally require re-authentication at the moment of use, among them dispensing a controlled drug, opening a vault, overriding a critical finding and emergency dispensing. Every table carries the organisation and branch, and every query is scoped to both.
Yes. Prescriptions are read live from the Doctor Module and never copied, so there is one prescribing record and the pharmacy annotates it. Clinical interventions publish back to the prescriber. If the prescribing module is unreachable the queue says so, rather than showing a reassuring empty list. The Nurse Module administration round-trip and Billing Module charge capture are the next integrations on the roadmap.
Yes. The Pharmacy Module is generally available on two plans. Premium is one monthly price for the whole pharmacy department, with the seat allowance shown at checkout, and Enterprise is quoted for multi-site pharmacy networks, central stores and hospital-wide governance. There is no single-user plan: the module is built around a department with distinct roles rather than one operator. Current prices are in the pricing section on this page, and your admin account is created as soon as payment clears.
Pricing
Closed-loop dispensing is the same job at every size, and what changes is how many sites are doing it. There is no single-user plan: the module is built around a department with distinct roles rather than one operator, and every plan carries the whole safety net.
One pharmacy department
Closed-loop medication management for a hospital or clinic pharmacy, with the seat allowance shown at checkout.
Sites & stores per agreement
Multi-site pharmacy networks, central stores and hospital-wide governance.
Need help choosing, or have multi-site requirements? Talk to our team.
A working session rather than a slide deck: your orders through the screening engines, a controlled dispense with its witness, and a recall traced back to the patient. Tell us how your pharmacy is staffed and we will set one up. Your admin account is created as soon as payment clears, and onboarding comes with it.
Running the wards as well? Explore the Nurse Module.