In the face of rising opioid abuse that is killing more people every year than motor vehicle crashes, electronic prescribing of controlled substances (EPCS) is finally gaining momentum. The technology has progressed to the point where organizations can improve prescribing workflows, meet legislative requirements and increase patient safety and satisfaction. EPCS can also serve as a key weapon in combating prescription fraud, drug diversion and “doctor shopping” for pills – several of the root causes of our nation’s devastating opioid epidemic.
To enable EPCS, organizations must comply with a specific set of requirements outlined in the Drug Enforcement Agency (DEA) Interim Final Rule (IFR). An accurate understanding of these regulations is crucial to enabling a fully compliant EPCS solution and improving patient care, but the complexity of these requirements has led to some confusion among healthcare professionals on how to employ this technology. The following are five common misconceptions surrounding EPCS and the true facts about the legislation:
Fiction: EPCS is not legal in every state
Since the DEA introduced the IFR legalizing EPCS in 2010, every state in the union has passed legislation to legalize EPCS for schedule II-V controlled substances. New York, Maine, and Virginia were the first to pass mandates for electronic prescribing, including for controlled substances, paving the way for several other states to follow suit. Connecticut, Pennsylvania, New Jersey, North Carolina and Texas are among those states that recently introduced proposed legislation to mandate EPCS.
Fiction: Pharmacies cannot receive electronic prescriptions for controlled substances
According to data from Surescripts, 88 percent of pharmacies in each state are enabled for EPCS. However, in some cases, individual pharmacies and pharmacists may not be aware that they can accept EPCS. As a best practice, organizations should conduct local outreach to ensure pharmacies are properly prepared and ready to receive electronic prescriptions for controlled substances.
Fiction: Logging into the EHR is the first factor of the two-factor authentication process for EPCS
Although physicians often complete an authentication process to access electronic health records (EHRs), the DEA requires a separate two-factor authentication at the time of prescribing controlled substances.
The IFR specifically outlines that in order to sign a controlled substance prescription, the electronic prescription application must require the practitioner authenticate to the application with protocol that uses two of the following three factors:
- Something only the practitioner knows, such as a password
- Something the practitioner is, such as fingerprint biometrics
- Something the practitioner has, such as a one-time password token (which must be separate from the device from which the user is prescribing)
A Deep-dive Into Specialty Pharma
A specialty drug is a class of prescription medications used to treat complex, chronic or rare medical conditions. Although this classification was originally intended to define the treatment of rare, also termed “orphan” diseases, affecting fewer than 200,000 people in the US, more recently, specialty drugs have emerged as the cornerstone of treatment for chronic and complex diseases such as cancer, autoimmune conditions, diabetes, hepatitis C, and HIV/AIDS.
Understanding this requirement is essential to successfully complying with the DEA IFR and ensuring the EPCS workflow is usable and efficient for physicians. Unfortunately, most multifactor authentication solutions can only support the second factor of authentication for EPCS, resulting in user confusion and misuse. Since many health IT vendors only demonstrate the authentication step they facilitate and not the complete workflow, it gives the false impression that EPCS can be completed with just a single factor. Organizations need to understand that two-factor authentication is required at the time of prescribing to complete an EPCS order that is DEA compliant.
Fiction: Physicians are not required to undergo the identity proofing process for EPCS if they are already credentialed at an organization
The DEA requires that all physicians enabled for EPCS undergo the identity proofing process, even if they are already credentialed with an organization. The DEA allows two types of identity proofing: institutional and individual.
In institutional proofing, DEA-registered institutional practitioners (i.e., a hospital or health system) conduct identity proofing to validate the identity of each physician to be enabled for EPCS. The institutional identity proofing must be conducted in-person and is typically managed by the credentialing office. In individual proofing, physicians work with a third-party, DEA-approved credential service provider (CSP) to validate their identity.
Fiction: Physicians have to use an organization’s DEA number when prescribing controlled substances electronically with institutional identity proofing
A physician’s individual DEA number is included on an electronic prescription for a controlled substance, just as it currently appears on paper prescriptions, regardless of how the physician is identity proofed. For interns or other clinicians without an individual DEA number, the organizations’ DEA number plus the individual’s suffix is included on the prescription.
The DEA allows organizations with an institutional DEA number to validate the identity of each physician and grant them EPCS permissions, but this is only for credentialing purposes, not for the prescription process. On the prescriptions, the physician’s individual DEA number will be included in the same way it is currently included on a paper prescription.
EPCS has the power to not only transform the prescribing process for both providers and patients but also contribute to the fight against growing opioid abuse. As organizations increasingly recognize the power and necessity of EPCS technology, it is imperative healthcare professionals have a complete understanding of the DEA requirements to maximize their investment and make a real impact.
