EPCS pain management setup: two-factor, identity proofing and DEA requirements
A pain management practice writes controlled substance prescriptions all day, which makes EPCS less of an option than it looks on paper. The requirements are specific and they are not all in the same place.
EPCS pain management setup has three moving parts: identity proofing of each prescriber, two-factor authentication using two of three permitted factors at every signature, and logical access control inside the application. DEA makes EPCS optional, but Medicare Part D and state law both push practices toward it.
Pain management is the specialty where electronic prescribing of controlled substances stops being optional in practice.
The volume is high, the schedules are restricted, and the administrative cost of paper is real. So most practices get there eventually. What surprises people is how much of the setup is regulatory rather than technical.
The requirements come from three separate places that do not reference each other cleanly, and the most common setup failures come from reading one of them and assuming it covers the others.
The rule is still an interim final rule
Worth getting this right at the outset, because a surprising amount of published material describes it incorrectly.
DEA’s electronic prescriptions for controlled substances rule was published on 31 March 2010 as an interim final rule with request for comment, effective 1 June 2010. A 2020 Federal Register document that is often cited alongside it reopened the comment period and did not finalise anything. So the framework governing EPCS today is an interim final rule that has stood for more than fifteen years without being finalised.
That does not make it optional to follow. It does mean the details can change, and it is a reason to build the setup so that a change in the token or credential requirements is a procurement decision rather than a rebuild.
Two-factor authentication: two of three factors
This is the requirement that bites at every signature, and the regulation enumerates the options exactly.
21 CFR 1311.115 requires the electronic prescription application to authenticate the practitioner using two of the following three factors: something only the practitioner knows, such as a password or a response to a challenge question; something the practitioner is, meaning biometric data such as a fingerprint or an iris scan; and something the practitioner has, a device or hard token separate from the computer to which the practitioner is gaining access.
Where a hard token is used, the regulation states it must be separate from the computer to which it is gaining access and must meet at least the criteria of FIPS 140-2 Security Level 1 for cryptographic modules or one-time-password devices. Where a biometric is used, the biometric subsystem has to comply with 21 CFR 1311.116. Note the standard is FIPS 140-2, not 140-3, because that is the version incorporated by reference.
- The regulation says the token must be separate from the computer it is gaining access to. It does not say the token may not live on a phone. Read the actual wording before ruling out a deployment option on the strength of a summary.
Identity proofing and who can do it
Identity proofing happens once per prescriber and is the step that most often stalls a rollout, because it involves parties outside the practice.
Under 21 CFR 1311.105, an individual practitioner obtains an authentication credential either from a credential service provider approved by the relevant federal office that conducts identity proofing at NIST SP 800-63-1 Assurance Level 3 or above, or, for digital certificates, from a certification authority cross-certified with the Federal Bridge certification authority at basic assurance level or above. The credential has to be issued using two separate channels.
There is a different path for institutional settings. Under 21 CFR 1311.110, the entity within a DEA-registered institutional practitioner that grants privileges may conduct the identity proofing and authorise issuance of the credential, verifying government-issued photographic identification against the person presenting it, confirming state authorisation to practise and to prescribe controlled substances is current and in good standing, and confirming a current DEA registration or a qualifying exemption. DEA’s own guidance suggests a real-time, two-way, audio-visual channel where remote proofing is wanted, and it is worth noting that is a DEA suggestion rather than codified text.
Where the Medicare Part D mandate comes from
This is the part practices most often have backwards.
DEA’s EPCS questions and answers is unambiguous: the regulations do not mandate that practitioners prescribe controlled substances using only electronic prescriptions, nor do they require pharmacies to accept them. EPCS is permissive under DEA rules.
The mandates come from elsewhere. Section 2003 of the SUPPORT Act requires electronic prescribing of Schedule II through V controlled substances under Medicare Part D, and CMS’s EPCS programme sets a compliance threshold of at least 70 per cent of qualifying Schedule II to V prescriptions for patients covered under Part D and Medicare Advantage prescription drug plans in the measurement year, which runs from 1 January to 31 December. State law is the other source, and for a New Jersey practice it is usually the binding one.
Three exceptions apply, and only three. A small prescriber exception applies automatically at 100 or fewer qualifying Part D controlled substance prescriptions in the measurement year. A declared disaster exception applies automatically to prescribers in an area CMS has identified. A CMS-approved waiver requires an application explaining an inability to meet the threshold due to circumstances beyond the prescriber’s control. Older material listing a fourth, same-entity exception is out of date and does not appear in the current regulation. Prescriptions written for a beneficiary in a long-term care facility are included in determining compliance no earlier than 1 January 2028.
EPCS rollout stalled somewhere between the software and the tokens?
We work through identity proofing, second factors and access control in the right order, and hand you written findings on what is missing.
Logical access control inside the practice
The last piece is internal, and it is the one that creates the most awkward conversations.
Someone has to authorise which prescribers can sign controlled substance prescriptions in the application, and the application has to record it. In a small practice the people who would naturally do that are often the same people who prescribe, which is exactly the separation the rule is trying to create. It is solvable, but it needs deciding before go-live rather than during it, and it needs writing down.
In our engagements this is where rollouts slip: the software is configured, the tokens have arrived, and nobody has agreed who approves signing access or how a change to it gets recorded. That is a governance question that belongs with the rest of managed IT support and the practice’s access review, not with the vendor.
A practical setup sequence
In the order that avoids the most rework.
- Identity proof the prescribers first. It is the longest lead time.
- Choose the second factor deliberately. Token, biometric or both, per prescriber.
- Decide who approves signing access. Before go-live, in writing.
- Track the 70 per cent threshold. Measurement year is the calendar year.
Qventive provides EPCS pain management setup services in Hackensack NJ, normally as part of IT support for pain management practices rather than as a standalone project.
Where the setup touches how the clinical system is configured, that work runs through pain management EHR and IT support, and the access control decisions belong in your HIPAA risk analysis alongside every other account that can do something consequential.
EPCS setup: common questions
Is EPCS mandatory?
What counts as two-factor authentication for EPCS?
How long does identity proofing take?
What are the HIPAA implications of EPCS?
What happens if we do not meet the Part D threshold?
Let’s meet
Qventive sets up EPCS for New Jersey practices. Thirty years healthcare-exclusive, from our office in Hackensack.
- Published 31 March 2010 as an interim final rule with request for comment, effective 1 June 2010. federalregister.gov
- Two of three factors: something known, something the practitioner is, something the practitioner has; hard token separate from the computer, FIPS 140-2 Security Level 1. ecfr.gov
- Regulations do not mandate that practitioners prescribe controlled substances using only electronic prescriptions, nor require pharmacies to accept them. deadiversion.usdoj.gov
- 70 per cent compliance threshold; three exception categories; LTC prescriptions included no earlier than 1 January 2028. cms.gov
- Credential from a credential service provider at NIST SP 800-63-1 Assurance Level 3 or above, or a certification authority cross-certified with the Federal Bridge. ecfr.gov