DEA EPCS
The DEA's Electronic Prescriptions for Controlled Substances rule, 21 CFR Part 1311, sets the conditions under which practitioners may sign and transmit controlled substance prescriptions electronically and pharmacies may receive and store them.
The rule places requirements on three parties: the software applications (which must pass a third-party audit or certification), the prescribers (identity proofing, two-factor authentication credentials, and logical access controls that require two people to grant signing rights), and the pharmacies (application requirements, record retention, and audit logs).
Many states now mandate electronic prescribing of controlled substances, and Medicare Part D requires it, which makes EPCS effectively universal.
In writing, an application provider needs the audit or certification report showing the application meets Part 1311 and must make it available to users, repeated at least every two years or whenever relevant functionality changes.
A prescribing practice or pharmacy needs its identity proofing and credentialing records, the access control setup records signed by the two authorizing individuals, procedures for reporting lost credentials and security incidents to DEA, and retained audit trails and daily incident reports.
help
Who has to comply
Electronic prescribing application providers and pharmacy application providers; DEA-registered practitioners who prescribe controlled substances electronically; pharmacies that receive electronic controlled substance prescriptions. State e-prescribing mandates and the Medicare Part D EPCS requirement drive adoption.
What the assessor asks to see
An auditor or DEA investigator asks for the application's current audit or certification report and the changes since it was issued, identity proofing and credential issuance records, the two-person access control authorization records, two-factor authentication configuration, audit trail and daily internal audit reports, procedures and records for reporting lost credentials and security incidents to DEA within one business day, prescription transmission and archive records, and the pharmacy's record retention and backup practices.
Where the requirement sits: 21 CFR 1311
Who helps with DEA EPCS
EHR and e-prescribing vendors handle most implementation; certification and audit firms serve the vendors. For practices, the work is mostly enrollment through the vendor's identity proofing partner and setting up two-factor credentials and access controls.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Consultants
Be the first DEA EPCS consultant listed here
The people reading this are working out who can help them get there.
Who assesses DEA EPCS
For applications, either a third-party audit by a person qualified to perform SysTrust, WebTrust, or SAS 70 style engagements (now SOC) or by a Certified Information Systems Auditor who performs compliance audits as a regular business, or certification by an organization DEA has approved.
Practitioners and pharmacies are not separately certified but are subject to DEA inspection and enforcement. Accredited by DEA approves certifying organizations for the certification route. Auditors under the audit route are qualified by their professional credentials rather than DEA approval.
Assessors
Be the first DEA EPCS assessor listed here
This page is read by the organizations looking for someone to certify them.
Tools for DEA EPCS
Tools that name this framework in their own material.
Tools
Be the first tool listed for DEA EPCS
Buyers comparing software for this standard land here first.
Related reading
- Electronic Prescribing of Controlled Substances ComplianceSets out the three duties 21 CFR Part 1311 puts on a pharmacy: verifying the identity-proofed credential, two-factor signing, and the internal audit trail.Health Law Alliance
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Sources
eCFR: 21 CFR 1311.300 Application provider requirements, third-party audits or certificationsFederal Register: Electronic Prescriptions for Controlled Substances clarification (2011)Drummond Group: DEA EPCS certification and recertification testingHealth Law Alliance: Electronic prescribing of controlled substances compliance
Need a hand implementing it?
Find a Consultant for DEA EPCS
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Get Help with DEA EPCS
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.