EPCS stands for Electronic Prescribing of Controlled Substances. It’s a system that allows doctors, dentists, and other prescribers to send prescriptions for controlled medications (like opioids, stimulants, and sedatives) directly to a pharmacy’s computer system instead of using handwritten paper prescriptions or calling them in by phone. The DEA established EPCS procedures in June 2010, and the practice has since shifted from optional to mandatory in many settings.
Why EPCS Exists
Before EPCS, controlled substance prescriptions were overwhelmingly paper-based. That created specific vulnerabilities: stolen or forged prescription pads, altered prescriptions (changing a “10” to a “40” to get more pills), and fraudulent phone-in prescriptions placed late in the day when pharmacies couldn’t easily call a doctor’s office to verify. EPCS was designed to close those gaps.
With electronic prescribing, only practitioners who have been verified and credentialed through a secure system can issue prescriptions. Every prescription generates a digital record with an audit trail, making it far harder to alter a prescription at any point in the process. If someone changes a prescription after it’s signed, the tampering is visible in the system logs. State prescription monitoring programs can also track electronic prescriptions more efficiently, which helps identify patterns like doctor shopping, where a patient visits multiple prescribers to stockpile medications.
How Prescribers Get Authorized
A doctor can’t simply log in and start writing controlled substance prescriptions electronically. The DEA requires a formal identity-proofing process first. Individual practitioners must apply through a federally approved credential service provider or certification authority, which verifies their identity to a high security standard set by the National Institute of Standards and Technology. This can happen in person or remotely using real-time, two-way video.
Hospitals and clinics have a slightly different path. An institutional practitioner that holds a DEA registration can handle identity proofing internally for its own prescribers. A designated staff member checks each practitioner’s government-issued photo ID, confirms their state medical license, and verifies their DEA registration. The institution then issues the authentication credential directly. Alternatively, the institution can have each practitioner go through the standard external proofing process on their own.
Two-Factor Authentication
Once identity proofing is complete, the prescriber receives a two-factor authentication credential or digital certificate. This means that every time they sign a controlled substance prescription, they must verify their identity using two separate factors. Think of it like online banking: you might enter a password and then confirm with a fingerprint or a code sent to your phone. EPCS works on the same principle, combining something you know, something you have, or something you are (like a biometric) to ensure the person signing the prescription is genuinely the authorized prescriber.
This is the core security layer that separates EPCS from regular e-prescribing of non-controlled medications, which typically requires only a standard login.
Software Certification Requirements
The prescribing software itself must meet DEA standards before it can be used for controlled substances. Every electronic prescribing application and pharmacy application must pass a third-party audit or certification confirming it complies with DEA regulations. This audit must happen before the software is used for any controlled substance prescriptions.
After the initial audit, the software must be re-audited every two years or whenever any functionality related to controlled substance prescribing is changed, whichever comes first. If an audit finds the software doesn’t meet requirements, the application provider must notify all users within five business days and report the failure to the DEA within one business day. The software cannot be used for controlled substance prescriptions until the issues are resolved.
Acceptable audits include those conducted by qualified information system auditors or through a DEA-approved certification organization. For cloud-based applications, the audit must also address physical security of the servers, not just the software’s processing integrity.
Federal and State Mandates
EPCS is no longer optional for many prescribers. The SUPPORT Act, signed into law in October 2018, generally requires that all Schedule II through V controlled substances prescribed under Medicare Part D and Medicare Advantage plans be written electronically. For measurement year 2024, prescribers must have electronically prescribed at least 70% of their qualifying controlled substance prescriptions for Medicare patients to be considered compliant.
The consequences for non-compliance are real. CMS may factor a prescriber’s failure to meet the threshold into assessments for potential fraud, waste, and abuse. That could lead to a referral to law enforcement or revocation of billing privileges if evidence of fraud is found. Prescriptions written for patients in long-term care facilities are currently excluded from compliance calculations, but that exemption expires in 2028.
Many states have gone further than the federal mandate. California, for example, requires all prescriptions to be issued electronically, not just controlled substances. New York was among the first states to mandate EPCS back in 2016. The specific requirements vary by state, with some mandating EPCS only for certain drug schedules and others applying it broadly.
How It Affects Patients
From a patient’s perspective, EPCS means fewer paper prescriptions to carry to the pharmacy. Your prescription for a controlled medication is sent directly to the pharmacy you choose, often before you’ve left the doctor’s office. This reduces the chance of a lost or damaged prescription and eliminates the need for a separate trip to drop off a paper script.
It also adds a layer of protection. Because the prescription is digitally signed and tracked, it’s much harder for someone to forge a prescription in your name or alter one that was legitimately written for you. The electronic trail also makes it easier for your care team to see your full prescribing history, which can help prevent dangerous drug interactions or duplicate prescriptions from different providers.
The main inconvenience patients sometimes encounter is when a prescriber hasn’t yet set up EPCS and needs to provide a paper prescription instead, or when technical issues temporarily prevent electronic transmission. In those cases, the DEA still permits paper prescriptions as a fallback.
Costs for Practices
Setting up EPCS involves several categories of expense. Practitioners pay for identity proofing, which includes the time involved in verification and potentially travel to an in-person proofing session. There are annual fees for digital certificates, typically around $30 per prescriber per year, plus the cost of authentication hardware like a USB security token. Practices also need to budget for ongoing log reviews, which the DEA requires on a regular basis to monitor for irregularities.
The larger costs fall on software vendors, who must invest in development and pass third-party audits that can run $100,000 or more. Those costs are generally passed along to practices through software licensing fees. For most individual prescribers, the direct out-of-pocket costs are modest, but the time required for setup, training, and adapting workflows can be a real burden, especially for smaller practices.