History of EPCS
The background for EPCS can be traced back to the passage of the Controlled Substances Act (CSA) in 1970, which established a framework for regulating the manufacture, distribution, and dispensing of controlled substances in the United States. The CSA classified controlled substances into five schedules based on their potential for abuse and medical use, with Schedule I drugs having the highest potential for abuse and no accepted medical use and Schedule V drugs having the lowest potential for abuse and accepted medical use.
In recent years, there has been a growing concern about the misuse and abuse of prescription drugs, particularly opioids. According to the Centers for Disease Control and Prevention (CDC), the United States is currently facing an opioid epidemic, with more than 47,000 opioid overdose deaths in 2018 alone.
The U.S. government took measures in 2010 to address the crisis with greater controls around prescription opioids and the expansion of treatment and recovery options. EPCS began as a proposal by the Drug Enforcement Agency (DEA) to curtail the diversion of controlled substances. It allowed physicians to prescribe controlled substances through a secure and certified electronic system. The regulations also permitted pharmacies to receive, dispense, and archive these electronic prescriptions. They also provided pharmacies, hospitals, and practitioners with the ability to use modern technology for controlled substance prescriptions while maintaining the closed system of controls on controlled substances.
What is EPCS?
Electronic Prescribing for Controlled Substances (EPCS) refers to the process of writing and transmitting prescription orders for drugs that are regulated by the government (such as opioids) using an electronic system instead of a paper prescription. This helps to improve patient safety by reducing errors and preventing prescription fraud, as well as streamlining the prescribing process. To use EPCS, healthcare providers must meet certain security and authentication requirements, and must use software that has been certified to meet federal standards.
Under EPCS, there are certain responsibilities that providers must fulfill to ensure the secure and accurate electronic prescribing of controlled substances.
Some of the key provider responsibilities under EPCS include:
1. Identity proofing:
Providers must undergo identity proofing, which is the process of verifying their identity using a reliable and independent third party. This helps to prevent identity theft and ensure that only authorized individuals can prescribe controlled substances electronically.
2. Two-factor authentication
Providers must use a two-factor authentication process when electronically prescribing controlled substances. This typically involves using a password or other security credential in combination with a physical token, such as a smart card or fingerprint scanner.
3. Use of approved software
Providers must use software that has been approved by the Drug Enforcement Administration (DEA) for EPCS. This software must meet specific technical requirements and security standards to ensure the integrity and confidentiality of electronic prescriptions.
4. Prescription accuracy
Providers must ensure the accuracy of electronic prescriptions for controlled substances, including the drug name, strength, dosage, and quantity. They must also verify the identity of the patient and ensure that the prescription is medically necessary.
5. Record keeping
Providers must maintain accurate and complete records of electronic prescriptions for controlled substances, including the date, time, and content of the prescription, as well as the identity of the prescribing provider and the pharmacy that dispenses the medication.
By fulfilling these responsibilities, providers can help to ensure the safe and secure electronic prescribing of controlled substances, while also complying with federal regulations and protecting the health and safety of their patients.
State Specific Provider Responsibilities
There may be additional responsibilities for providers under EPCS, depending on the specific requirements of the state in which they practice. Here are some additional responsibilities that may apply:
Providers may be required to register with their state's prescription drug monitoring program (PDMP), which is a database that tracks controlled substance prescriptions. Registration may be necessary for providers to access the PDMP and comply with state reporting requirements.
Providers may need to complete training on the use of EPCS software and the regulations governing the electronic prescribing of controlled substances. This training may be required by the DEA or state regulatory agencies.
Providers may be required to monitor their patients for signs of substance abuse or addiction, and to take appropriate action if a patient exhibits such signs. Providers may also need to report suspected cases of abuse or diversion to the appropriate authorities.
Providers may be required to report certain information to the DEA or state regulatory agencies, such as the number of electronic prescriptions they issue for controlled substances, or any suspected cases of fraud or abuse.
Electronic Prescribing of Controlled Substances (EPCS) mandates are requirements set by federal and state regulatory agencies that govern the electronic prescribing of controlled substances. Here are some of the current EPCS mandates:
The Drug Enforcement Administration (DEA) issued a final rule in 2010 that established the requirements for EPCS at the federal level. The rule requires providers who wish to electronically prescribe controlled substances to use certified EPCS software and follow specific procedures to verify their identity and the identity of the patient. Specifically, the rule requires that providers use two-factor authentication to ensure secure access to the EPCS system. This authentication process requires the use of something the provider has (such as a token or phone) and something the provider knows (such as a password or PIN).
Many states have established their own EPCS mandates, which may vary by state. Some states require provider registration with prescription drug monitoring programs (PDMPs), which are databases that track controlled substance prescriptions to prevent abuse and diversion. Other states may require providers to complete training on EPCS regulations or report suspicious activities related to EPCS. Some states also have technical requirements for EPCS, such as requiring providers to use a specific type of EPCS software.
As of January 1, 2021, Medicare Part D plans are required to support EPCS for all Schedule II-V controlled substances. This means that providers who prescribe controlled substances to Medicare beneficiaries must use certified EPCS software to submit electronic prescriptions. The mandate is designed to help prevent fraud and abuse in the Medicare program and ensure the safe and secure electronic prescribing of controlled substances.
Commercial Payer Mandates
Some commercial payers have also implemented EPCS mandates, which may vary by payer. These mandates may include requirements for provider registration with PDMPs, use of certified EPCS software, or reporting of suspicious activities related to EPCS. Commercial payer mandates are designed to help prevent fraud and abuse in the healthcare system and promote the safe and secure electronic prescribing of controlled substances.
Overall, EPCS mandates are designed to help prevent abuse and diversion of controlled substances, while ensuring that providers can still prescribe these medications when necessary. By complying with EPCS mandates, providers can help promote safe and effective care for their patients.
EHR Vendor Responsibilities
The EHR (Electronic Health Record) vendor has some responsibilities under EPCS (Electronic Prescribing of Controlled Substances) to ensure that their EHR software meets the requirements for electronic prescribing of controlled substances. Some of these responsibilities include:
1. DEA Certification
EHR vendors must obtain certification from the Drug Enforcement Administration (DEA) to ensure that their EHR software meets the technical requirements for EPCS.
2. Integration with EPCS Software
EHR vendors must integrate their EHR software with approved EPCS software to enable electronic prescribing of controlled substances. This integration must meet the standards set by the DEA and other regulatory agencies.
3. Implementation of Two-Factor Authentication
EHR vendors must implement two-factor authentication in their EHR software to ensure secure electronic prescribing of controlled substances. This authentication must meet the requirements set by the DEA and other regulatory agencies.
4. Reporting of Suspicious Activities
EHR vendors must have mechanisms in place to report suspicious activities related to EPCS, such as attempts to forge electronic prescriptions or other fraudulent activities.
5. Maintenance of Audit Trails
EHR vendors must maintain accurate and complete audit trails of all EPCS transactions. This includes the date, time, and content of the electronic prescription, as well as the identity of the prescribing provider and the pharmacy that dispenses the medication.
By fulfilling these responsibilities, EHR vendors can ensure that their EHR software is compliant with EPCS regulations and can enable providers to safely and securely prescribe controlled substances electronically. It is important for EHR vendors to stay up-to-date on the requirements for EPCS and to maintain ongoing compliance with these regulations.
How to get started with EPCS?
When getting started with EPCS, the Drug Enforcement Administration (DEA) provides two pathways to regulatory compliance for medical practices. The path that you take depends on how your EHR is setup. Practitioners who are using an EHR system registered to an individual DEA number will usually fit into the 'Small and Solo Group Practices' pathway.
Practitioners who are registered to an institutional or shared DEA number are typically part of a Health System Affiliated Practice pathway.
Smaller and solo practices where practitioners are registered to an individual DEA number must take the following four required steps to be able to transmit electronic prescriptions for controlled substances legally.
1. EHR Software Update
Find out if the EHR software version in use by your practice has already been certified and approved for EPCS.
2. ID Proofing
Proof of ID can be done in-person or online through companies that work directly with your EHR. You may need to answer a security question, and email all scanned copies of government-issued documents alongside your photo and medical license for online ID proofing. Often, a bank statement or electric bill will also be required to confirm your practice address.
3. Two Factor Authentication
This is a double-level process to ensure that only you can sign and send the pharmacy's controlled substance prescriptions. There are various options available such as mobile phone authentication, smart cards, fob tokens, USB thumb drives, and biometrics such as fingerprint scanners.
4. Setting Software Access
- In this final step, you will need two separate people to set secure access controls for your EHR EPCS software. One of these people must be a DEA registrant who has been ID-verified and has their two-factor authentication measure in place.
- The other person must be someone who can confirm your identity, such as a member of your practice, but they do not need to be an employee of your practice.
For practitioners who are registered to a shared DEA number in the Health System Affiliated Practices, there also four required steps that must be taken to allow you to transmit electronic prescriptions for controlled substances legally.
Benefits of EPCS
1. Improved patient safety
EPCS helps reduce the risk of medication errors by ensuring that prescriptions are accurate and up-to-date. Studies have shown that electronic prescribing can reduce medication errors by 50-85% compared to traditional paper-based methods. This improved accuracy can lead to better patient outcomes and reduced healthcare costs associated with adverse events.
2. Prevent prescription fraud
EPCS provides real-time monitoring of prescription data, making it more difficult for individuals to fraudulently obtain controlled substances. This helps to reduce the incidence of prescription drug abuse and diversion, which has been a growing public health concern in recent years.
3. Increased efficiency
EPCS eliminates the need for paper prescriptions, reducing the time and costs associated with manual processes. In a study conducted by the American Medical Association, providers using electronic prescribing reported a 70% reduction in administrative time compared to those using paper-based methods. This increased efficiency can allow healthcare providers to see more patients and improve patient care.
4. Enhanced patient care
EPCS provides healthcare providers with access to a patient's complete medication history, including allergies, current medications, and previous prescriptions. This information can help providers make informed decisions about medication management and treatment plans, leading to improved patient care and outcomes.
5. Better data tracking
EPCS provides comprehensive data tracking and reporting, allowing healthcare providers to monitor prescription trends and identify potential issues. This information can be used to identify patients at risk of abuse or overdose, improve medication utilization, and optimize patient care.
6. Compliance with regulations
EPCS helps healthcare providers comply with federal regulations related to controlled substance prescribing, reducing the risk of penalties. This is especially important given the recent emphasis on reducing prescription drug abuse and improving patient safety. By using EPCS, healthcare providers can ensure that they are adhering to regulations and protecting the health and well-being of their patients.
What are Prescription Drugs?
Prescription drugs are medications that can only be obtained with a prescription from a licensed healthcare professional, such as a doctor, nurse practitioner, or dentist. These drugs are regulated by the government to ensure that they are used safely and appropriately. They are different from over-the-counter (OTC) drugs, which can be purchased without a prescription. OTC drugs are generally considered safe for self-medication when used as directed, but they are not intended to treat serious medical conditions.
Prescription drugs are subject to various regulations to ensure that they are used safely and effectively. These regulations include the requirement that prescriptions be issued only by licensed healthcare professionals, that they be filled by licensed pharmacists, and that they be labeled with specific information, such as the drug name, dosage, and instructions for use.
These are regulated by FDA. Prescription drugs are classified into two categories:
- Non-controlled prescription drugs
- Controlled prescription drugs
Non-controlled drugs are prescribed to treat medical conditions such as high blood pressure, diabetes, and bacterial infections. Such prescriptions are not subject to some of the same limitations as controlled substance prescriptions.
What Is a Controlled Substance?
A controlled substance is a drug or chemical that is regulated by the government to prevent their abuse, trafficking, and illicit use, as well as to ensure that they are used only for legitimate medical purposes. The regulations governing controlled substances are designed to balance the need for access to these drugs for medical purposes with the need to prevent their abuse and diversion.
The use of controlled substances can have serious consequences for the individual, as well as for society. These substances have the potential to cause physical and psychological harm, dependence, addiction, and even death. They can also lead to a range of negative outcomes, including criminal activity, accidents, and social and economic problems.
The regulations governing controlled substances cover a range of activities, including their manufacture, distribution, dispensing, prescribing, and use. These regulations are enforced by law enforcement agencies, such as the DEA, and healthcare professionals, such as doctors and pharmacists, who are required to comply with strict guidelines and record-keeping requirements when handling controlled substances.
Controlled Substance Act (CSA) divides all controlled substances into five categories called schedules. The schedules range from Schedule I (highest level of potential for addiction and use disorder) to Schedule V (lowest potential for addiction/use disorder).
These drugs have no recognized medical use in the United States. They are not safe to use even within a medical environment. They possess the highest potential for use disorder and misuse. Examples of Schedule I drugs include heroin, lysergic acid diethylamide, etc.
These drugs carry a high risk of potential abuse. They also may cause physical or psychological dependence when used. Schedule II drugs are now permitted to be electronically transmitted through Electronic Prescribing of Controlled Substances (or EPCS) and have the tightest regulations when compared to other prescription drugs.
There is less risk of abuse in Schedule III than in the higher tiers. These drugs carry low to moderate risks of physical dependence. Drugs in this category may cause physical dependence but more commonly lead to psychological dependence. Schedule III drugs can be prescribed verbally over the phone, with a paper prescription, or via EPCS.
Schedule IV drugs have have an even lower misuse potential than I, II, or III. They have a limited risk of physical or psychological dependence. Schedule IV drugs can be prescribed verbally over the phone, with a paper prescription, or via EPCS.
Schedule V drugs are the least likely of the controlled substances to be misused. They result in very limited physical or psychological dependence. Pharmacies are responsible for monitoring these drugs in terms of quantities accessed.