Key Takeaways
- EPCS software must meet DEA security standards and undergo the required third-party audit or approved certification process.
- Prescribers must verify their identity, use two-factor authentication, and prescribe through an EPCS-compliant system.
- EPCS requirements vary by state, and some prescriptions qualify for exceptions under federal or state law.
Electronic prescribing of controlled substances (EPCS) is subject to a mix of federal regulations, state mandates, and software security standards. For medical practices, understanding these requirements is essential.
The rules go beyond choosing an electronic health record (EHR) with prescribing functionality. Prescribers must know when electronic prescribing is mandatory, which prescriptions are covered, and what prescribers must do before signing them.
State laws may add further obligations. This guide explains the main EPCS requirements, including the federal mandate, prescriber responsibilities, software standards, and circumstances in which exceptions may apply.
What Is EPCS?
Electronic prescribing of controlled substances (EPCS) is the process of creating, digitally signing, and transmitting prescriptions for controlled medications through an electronic prescribing application that meets applicable regulatory requirements.
It is governed by Drug Enforcement Administration (DEA) regulations at 21 CFR Part 1311, and the rules for issuing controlled-substance prescriptions at Part 1306. Unlike ordinary electronic prescribing, EPCS requires additional safeguards for prescriber identity, authentication, access controls, and audit records.
For a deeper look at how EPCS-certified EHRs help practices, see our guide on the critical role of EPCS-certified EHRs.
Who Must Follow EPCS Requirements?
EPCS compliance involves several parties. Prescribers are responsible for issuing valid prescriptions, but they cannot meet the requirements without compliant software and appropriate identity verification.
The entities that must follow EPCS requirements are as follows:
-
Prescribers (DEA-Registered Clinicians).
Practitioners who prescribe controlled substances electronically must comply with DEA requirements, applicable state law, and the rules governing their professional licenses and DEA registrations.
Before issuing an electronic controlled substance prescription, a prescriber must generally:
- Complete the required identity proofing process.
- Obtain and activate an acceptable two-factor authentication credential.
- Use an electronic prescribing application that meets DEA standards.
- Review the prescription and affirmatively indicate that it is ready to be signed.
- Personally complete the required authentication to sign the prescription.
- Keep authentication credentials secure and prevent unauthorized use.
A prescriber cannot delegate the act of signing a controlled substance prescription to an office manager or another staff member. Staff may assist with entering prescription information, but the authorized practitioner must review and sign the prescription.
-
Pharmacies (Receiving and Dispensing)
Pharmacies that accept electronic controlled-substance prescriptions must use an application that complies with applicable DEA requirements. They must also continue to meet the ordinary federal and state rules for dispensing controlled substances.
Their responsibilities include receiving and processing valid electronic prescriptions, maintaining the required records, and ensuring that dispensing activity follows applicable regulations. A pharmacy must not assume that a prescription is valid simply because it arrived electronically.
DEA regulations also address prescription transfers between pharmacies. Under the DEA's 2023 final rule, eligible electronic prescriptions for Schedules II through V may be transferred between pharmacies for initial filling, subject to the rule's conditions.
-
EHR and E-Prescribing Software Vendors
Software vendors must ensure that their applications meet the applicable technical and security standards before they can be used to issue or process electronic controlled substance prescriptions.
The requirements include:
- Controls for user access
- Prescriber identification
- Two-factor authentication
- Digital signatures
- Prescription transmission
- Audit records
The application must also support the relevant prescription information and recordkeeping requirements.
Under DEA regulations, the application provider must arrange for a qualified third-party audit or an approved certification process, as applicable. The provider should also give the practitioners a report documenting the application's compliance and any limitations.
A vendor's general claim that its EHR supports electronic prescribing is not enough to establish that the application meets EPCS requirements.
-
Credential Service Providers (CSPs)
Credential service providers may be involved in verifying a prescriber's identity and issuing authentication credentials. These credentials allow the prescriber to complete the required authentication when signing controlled substance prescriptions.
The DEA framework permits identity proofing to be performed through qualifying external processes or, in certain institutional settings, through an authorized internal process. The specific requirements depend on the method used and the applicable provisions of Part 1311.
Practices should verify that their identity-proofing and credentialing arrangements meet DEA requirements rather than assuming that ordinary EHR login credentials are sufficient.
The Two Rulebooks Behind EPCS (And Why People Mix Them Up)
Most of the confusion around EPCS starts here. There are two separate rulebooks, run by two different agencies, with two very different jobs.
Rulebook 1: The DEA framework
The DEA sets the technical rules for how controlled substances can be prescribed electronically. These rules cover identity proofing, two-factor authentication, digital signatures, and audit trails.
But here’s the key point most people miss: the DEA framework permits electronic prescribing. It doesn’t require it. A paper script for a Schedule II drug is still legal under DEA rules.
Rulebook 2: The CMS mandate
This is the one that actually says “you must e-prescribe.” It comes from Section 2003 of the SUPPORT for Patients and Communities Act of 2018 and applies specifically to Medicare Part D.
So when you hear “the EPCS mandate,” it’s the CMS Medicare Part D rule, not a DEA rule. Both still apply to your practice, but they do different jobs.
The CMS EPCS Mandate: What Section 2003 Actually Requires
If you prescribe for Medicare Part D patients, this is the rulebook that affects you directly.
Here’s what the mandate says:
- The law: Section 2003 of the SUPPORT for Patients and Communities Act of 2018
- The regulation: 42 CFR § 423.160 (Standards for Electronic Prescribing)
- Effective date: January 1, 2021
- Who runs it: CMS, through its EPCS Program
- Who it covers: Prescribers writing controlled-substance prescriptions for Medicare Part D or Medicare Advantage Prescription Drug (MA-PD) patients
- Which drugs: Covered Schedule II, III, IV, and V controlled substances under Part D
One thing worth clearing up. January 1, 2021, is the statutory effective date of the requirement. It is not the day every prescriber immediately faces full enforcement. CMS has rolled out compliance measurement and enforcement in phases, with a separate timeline for long-term care prescriptions.
Also worth remembering: not every Schedule II–V prescription you write is in scope. The mandate applies only when the prescription qualifies as a covered Part D drug. Cash-pay, commercial, or Medicaid prescriptions follow their own rules (state law, payer rules, or DEA baseline requirements).
How CMS Measures Your EPCS Compliance
Here’s the part most prescribers want to know: how do I know if I’m compliant?
CMS uses a measurement system tied to your National Provider Identifier (NPI). Compliance is calculated from your Medicare Part D controlled-substance prescription claims.
The three numbers you need to remember:
- 70% — The compliance threshold. If at least 70% of your qualifying Part D controlled-substance prescriptions are sent electronically (after exceptions are applied), you meet the standard.
- 100 — The small prescriber cutoff. If you write 100 or fewer qualifying Part D controlled-substance prescriptions in the measurement year, CMS automatically exempts you.
- January 1, 2021 — The statutory effective date of the requirement.
What happens if you fall below the threshold?
Right now, CMS enforcement works through non-compliance notices, not fines. The law gives CMS the authority to add penalties later, but as of the current rulemaking cycle, no monetary penalty regime is in place for the SUPPORT Act EPCS mandate itself.
That said, don’t take this lightly. Separate DEA, state medical board, and state EPCS actions can still apply to broader controlled-substance violations.
Who Qualifies for a Waiver or Exception
The CMS mandate isn’t absolute. Section 2003 and the follow-up CMS rules carve out several situations where you may be exempt. But here’s the catch: some exceptions are automatic. Others require you to apply within a designated window. Don’t assume you qualify just because your situation feels like it should fit.
-
Small prescribers (automatic)
If you issued 100 or fewer qualifying Medicare Part D controlled-substance prescriptions during the measurement year, CMS applies this exception for you. No form, no filing.
-
Long-term care prescriptions
LTC prescriptions follow a separate CMS compliance timeline. Always check the current CMS EPCS Program page for the active measurement and enforcement dates for LTC.
-
Same-entity prescriber and pharmacy
If you prescribe at a practice where the dispensing pharmacy is the same legal entity, the statute provides an exception under specified conditions.
-
Prescriptions that can’t be transmitted electronically
When the applicable e-prescribing standard doesn’t support a given prescription, the law allows for an exception in qualifying circumstances.
-
Technical limitations and circumstances beyond your control
System outages, loss of connectivity, and other technical disruptions may qualify for a waiver. These are not automatic. You may need to submit a waiver application within the window CMS designates.
-
Emergency, veterinary, and technology-failure situations
These need careful handling. Whether they count as an exception depends on which rule you’re applying — SUPPORT Act, DEA regulations, or state law. A situation that lets you write a paper script under one rule doesn’t automatically exempt you under another.
For the current list of exceptions and waiver procedures, see the CMS EPCS Program and the SUPPORT Act's electronic-prescribing provision.
Choose an EHR That Supports EPCS Compliance for Your Small Practice
Understanding DEA regulations and CMS e-prescribing requirements is the first step. Your EHR also needs to support the security controls required for electronic prescribing of controlled substances. PracticeEHR is EPCS-certified, helping practices manage electronic prescribing through a system built to meet applicable EPCS standards.
Schedule a free demo to see how PracticeEHR supports your prescribing workflow.
.svg){kind=icon}
