What is EPCS and Who Needs to Comply?

Source: Pharmaceutical Compliance Monitor 

On March 31, 2010 the Drug Enforcement Agency’s (DEA) rule, “Electronic Prescriptions for Controlled Substances” has revised its regulations to give physicians the choice of writing prescriptions for controlled substances the traditional method or through the electronic system. Originally, the regulation restricted physicians and practitioners from writing electronic prescriptions for controlled substances (EPCS).

The EPCS allows pharmacies, practitioners, and hospitals the ability to employ the benefits of information technology to the field of health care while maintaining the necessary controls for the dispensary of controlled substance prescriptions. In addition, this legislation will reduce the amount of necessary paperwork and the occurrences of prescription forgery. This rule came into effect on June 1, 2010.

EPCS Process

The EPCS will allow practitioners to choose whether they want to write a physical prescription or transmit the prescription for controlled substances electronically. In addition, the EPCS will allow pharmacies to receive, dispense, and archive the electronic prescriptions. The pharmacy application requirements can be found in part 1311.205 of the legislation, while the electronic prescription application requirements can be found in part1311.120 of the EPCS rule. In either scenario, both sections highlight the following key areas for concern.

• Logical access controls
• Digital signature functionality
• Time requirements within defined threshold of the NIST time source
• Audit trail of controlled substance prescriptions
• Archiving of audit logs
• Physical security and processing integrity controls

Who Needs It?

While there is not a mandate to implement EPCS, the practitioners and pharmacies that choose to perform EPCS must be in compliance with the DEA rule. In addition, certain e-prescribing networks such as Surescripts mandate that every physician and pharmacy application vendors apply for the eligibility to conduct EPCS transactions on the network. These vendors must be compliant with the DEA EPCS rule and provide documentation of compliance with the particular network.

Application service providers must have a certification or third-party audit to ensure that every electronic prescription and pharmacy application can be used to sign, transmit, or process controlled substances. Practitioners must be in compliance with section 1311.120 and pharmacy applications must be compliant with 1311.205 of the DEA’s EPCS rule.

Phases of the Audits:

Prelimindary Assessment
The preliminary assessments are designed and executed to concisely review the EPCS application’s control environment in advance of the final assessment to achieve the following:

Evaluation of all of the controls in place to meet the DEA requirement

• Identification of the DEA requirements that are determined to be achieved by the existing controls or measures.
• Identification of the DEA requirements that are determined to not have sufficient controls in place to ensure compliance.

Although preliminary services have been selected in 100% of the clients we have worked with, organizations do have the option of directly undergoing a final assessment of their EPCS application environment.

Final Assessment
The purpose of the final assessment is to determine the EPCS application’s compliance with the applicable requirements of the DEA rule, as of the report date. Each final assessment deliverable includes an independent report regarding compliance and a summary of the applicable compliance benchmarks that were assessed. Whether it is the first assessment, or one of the many bi-annual or subsequent assessments, organizations have the option of selecting either the preliminary assessment or final assessment as the application functionality, DEA regulations, or their operating environments change.

The benefits of information technology will undoubtedly alleviate the strenuous paperwork associated with writing prescriptions, but the EPCS also has certain requirements that must be met, which includes a certification or third-party audit.