Electronic Prescribing for Controlled Substances

Learn more about EPCS for independent providers

What is EPCS?

EPCS stands for Electronic Prescribing for Controlled Substances. EPCS allows physicians to create e-prescriptions that can be received and acted upon by pharmacies. The actual prescriptions are referred to as eRx. This set of regulations became effective on June 1, 2010 and was passed and rollout out by the DEA.


America is currently in the midst of an opioid crisis. 78 Americans die from drug overdose every day, a number that has nearly quadrupled since 1999. Specifically, prescription opioids account for more than half of the opioid-related deaths. Among other reasons, EPCS was introduced as a way to address these high rates of drug abuse across the country. By making prescriptions harder to forge or steal, it reduces the ease with which teens and other citizens can access prescription drugs.

How does EPCS affect independent physicians?

  1. EHR: Not every EHR system will be automatically compatible with the security updates required for EPCS, so this is       the first thing that needs to be checked. More and more EHR systems are becoming certified for EPCS, such as Elation Health. Elation provides EPCS for our customers in New York and is rolling it out to other states, such as Maine, soon as well!
  2. ID Proofing: Your identity and status as a physician will need to be confirmed before you can write electronic prescriptions. You will need to work with approved credential service providers or certification authorities to make this happen. This process is very similar to how you need to establish your identity with the DMV before you get your driver’s license.
  3. Two Step Authentication: Two step authentication is required to make sure nobody else uses your credentials.
    1. You are required to use two out of the following three ways to authenticate your identity when writing an eRx.
      1. Something you know (knowledge factor)
      2. Something you have (a hard token stored separately from the computer being accessed)
      3. Something you are (biometric)

What else should you know?

Different states might have different regulations for providers to follow. For instance, if you practice in New York, you should make sure to follow I-STOP regulations which includes making yet another account (but worth it!) to be able to refer to the Prescription Monitoring Program (PMP). Make sure to check with your state to see if there are any other regulations you should follow!