What Is EPCS (Electronic Prescribing of Controlled Substances)?

Electronic Prescribing of Controlled Substances (EPCS) is a system for electronically transmitting controlled substance prescriptions to pharmacies and dispensaries. Most U.S. states require EPCS for controlled substance prescriptions. The Medicare Part D EPCS mandate also requires it for U.S. healthcare organizations that prescribe controlled substances to Medicare users.

State and federal governments introduced controlled substance e-prescription regulations to combat prescription fraud and overprescription, which have contributed to health crises like the opioid epidemic. However, while it brings benefits, EPCS presents technical and compliance challenges, including the need for compliant identity proofing and verification, system integration, and record keeping.

What Is an Electronic Prescription?

An electronic prescription (or e-prescription) is a digital version of a traditional paper prescription. Medical professionals fill in a form on their computer and send the prescription to the pharmacy or dispensary over an encrypted connection. E-prescription solutions reduce errors and prescription fraud risk by helping prescribers communicate accurately and securely with pharmacies.

EPCS rules require stronger identity verification and security measures if your organization prescribes controlled substances. Prescribers have to undergo identity proofing to establish their identity. They have to log in to the ECPS system using secure two-factor authentication. Prescribers must digitally sign prescriptions, linking every prescription to its prescriber.

What Are Controlled Substances?

The government designates medications with a high potential for abuse or dependence as controlled substances, and these substances are heavily regulated. The DEA uses two criteria to categorize controlled substances: whether they have an accepted medical use and their risk of addiction or harm.

Each substance is assigned to one of five schedules:

• Schedule I: Drugs with no accepted medical use and a high potential for abuse (e.g., heroin).
• Schedule II: Drugs with legitimate medical uses but a substantial risk of abuse and dependence (e.g., oxycodone, morphine).
• Schedule III: Drugs with a moderate to low potential for physical or psychological dependence (e.g., anabolic steroids, products with less than 90 milligrams of codeine per dose).
• Schedule IV: Drugs with a low risk of abuse and dependence (e.g., Xanax, Valium).
• Schedule V: Drugs with the lowest risk of abuse, often used as antitussives, antidiarrheals, or analgesics (e.g., cough preparations with limited amounts of codeine).

Schedule I drugs are never legal to prescribe, so only Schedules II through V are subject to EPCS rules.

The History of EPCS Regulations

The Controlled Substances Act (CSA) of 1970, which established the schedule classification system, and other legal frameworks for controlled substances, underlie EPCS requirements. The CSA also made the DEA responsible for enforcement.

A turning point came with the Medicare Prescription Drug, Improvement, and Modernization Act of 2003, which introduced Medicare Part D. It gave Medicare beneficiaries access to prescription drug coverage and substantially increased prescription volumes for controlled substances.

DEA EPCS Interim Final Rule (2010)

In 2010, the DEA issued its Interim Final Rule. The Final Rule legalized nationwide electronic prescribing of controlled substances and established technical and security requirements for electronic prescriptions. It is the initial source of EPCS identity proofing, TFA, and digital signature requirements.

New York’s I-STOP Act (2015)

New York was the first state to mandate EPCS. The Internet System for Tracking Over-Prescribing (I-STOP) Act (2015) requires healthcare providers to send all prescriptions electronically. Following New York’s lead, most US states have enacted EPCS mandates with varying requirements and penalties. States like Maine, Virginia, and Arizona require EPCS for controlled substances.

SUPPORT for Patients and Communities Act (2018)

The opioid epidemic prompted federal action with the Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment (SUPPORT) for Patients and Communities Act in 2018. Section 2003 of the SUPPORT Act requires that controlled substances in Schedules II-V be prescribed electronically for Medicare Part D patients.

EPCS Compliance Deadline for Medicare Part D

In 2023, the Centers for Medicare & Medicaid Services (CMS) began enforcing the EPCS requirement for Medicare Part D prescribers. At least 70% of all Schedule II-V controlled substance prescriptions must be transmitted electronically. Non-compliant prescribers receive notices and can face further actions if they do not meet the EPCS threshold.

EPCS Compliance Challenges

Healthcare providers face several challenges in implementing EPCS systems, including technical, workflow, and regulatory hurdles.

Identity Proofing and Authentication

Implementing identity and authentication systems is technically challenging for organizations without internal expertise. Identity proofing and two-factor authentication can also complicate onboarding and authentication, especially if the system does not integrate well with your existing systems.

User Experience

Medical professionals frequently face time constraints. If e-prescribing systems are difficult or time-consuming to use, they can frustrate practitioners and reduce patient throughput. A badly designed EPCS interface makes compliance harder.

Integration with Existing Workflows

EPCS systems must integrate smoothly with existing electronic health record (EHR) and electronic medical record (EMR) systems. Poor integration complicates prescribing and can require extra training and resources.

Maintaining Audit Trails and Record-Keeping

EPCS regulations require secure, traceable records of all controlled substance prescriptions. Providers must maintain audit trails while complying with privacy laws. Record keeping and secure data management can be technically challenging and resource-intensive, especially for smaller practices.

How Exostar’s EPCS Solution Streamlines EPCS Prescribing

Exostar’s EPCS and identity management solution simplifies EPCS compliance for healthcare providers. Our DEA-compliant platform offers comprehensive identity proofing, digital certificate management, and compliant two-factor authentication.

ProviderPass empowers healthcare providers to meet DEA EPCS requirements without complicating prescribing workflows. An open architecture makes it easy to integrate our ECPS tools into your existing EHR systems, and seamless integration provides a familiar, user-friendly experience.

Ready to streamline EPCS compliance for your healthcare provider? Contact an EPCS specialist today.