One of the provisions of North Carolina’s 2017 Strengthen Opioid Misuse Prevention (STOP) Act mandates the electronic prescribing of controlled substances (EPCS) by January 2020. Virginia has also passed a similar EPCS law that goes into effect in July 2020. If you practice in these states and prescribe opioids or other controlled substances, it’s not too early to think about transitioning to EPCS.

All 50 states and the District of Columbia now allow for EPCS, but uptake of this technology remains low in most. Although most pharmacies can accept electronic scripts for opioids and other controlled substances, only about one-third of physicians in North Carolina and 11% of physicians in Virginia currently use EPCS.

John Bender, MD, a family physician in Fort Collins, CO, recently made the switch to EPCS voluntarily. One of the reasons EPCS uptake is low, he says, is that many providers see it as yet another expense that doesn’t generate any revenue. “By the time we paid for the software upgrade and the [e-prescribing] license, it ran about $1,000 per physician,” Bender says.

Generally, it should take about 4 weeks for credentialing and setup. The process wasn’t that cumbersome, Bender added, except, in his case, he encountered a few administrative snags with identity proofing that delayed the process. Bender is senior partner and chief executive officer at Miramont Family Medicine, a 15-physician family practice in Fort Collins, CO. He is also a member of the board of directors of the American Academy of Family Physicians.

Bender found value converting to EPCS because, like other e-prescribing frameworks, it improved the overall efficiency of his practice’s workflow. In his practice, only 2 out of the 15 physicians—himself and one other physician—are credentialed to use EPCS. “I’ve taken on the larger portion of pain management for our group as well as the prescribing of suboxone [for managing opioid addiction]. It made sense for me to have that functionality.”

He also noted that EPCS has eliminated attempts to adulterate prescriptions. “With paper scripts, at least 2 to 3 times a year, I’d get a call from a pharmacist where someone’s added an extra zero to the refill number or photocopied a recent script and resubmitted it to a second pharmacy,” Bender says. “We don’t see that anymore.”

Bender adds, however, that adopting EPCS might be a financial and technological burden for physicians who don’t write many scripts for controlled substances and for smaller practices, perhaps in rural areas, that haven’t yet made the transition to electronic health records (EHRs).

If your clinic already has an EHR/e-prescribing system, the process of setting up an EPCS system requires 4 basic steps:

1. Contact your current EHR/e-prescribing software vendor to see if your software version is certified to support EPCS—more than 200 EHR/e-prescribing software versions are now EPCS-capable, but a software upgrade or additional software may be required.

2. Go through an ID-proofing process. ID proofing involves just that—providing your name, address, government ID, and other evidence to prove your identity. This process is somewhat different for individual practitioners than for institutional practitioners; institutions can perform ID proofing through their own credentialing office or through a vendor, whereas individual practitioners must contact an approved certification authority or credential service provider who performs the ID proofing for them. Your EHR or e-prescribing software or network company may provide this service or work in tandem with a credentialing service.

3. Get your 2-factor authentication credentials. Once the ID proofing is completed, the credentialing service provider issues the 2-factor authentication credentials. These credentials must be two of the following three factors to sign for each prescription:

• Something the prescriber knows, such as a password
• Something the prescriber possesses—also called a “hard token”; it could be a USB drive, a smart card, or a device capable of delivering a one-time password such as a PDA or cell phone
• Something the provider is—a biometric measurement such as a fingerprint or a facial or iris pattern For example, each time you e-prescribe a controlled substance, you might insert a special USB stick into a laptop or desktop computer and then type in a one-time password sent to your cell phone

4. Set access controls. This step ensures that only individuals legally authorized to sign controlled-substance prescriptions are allowed to do so. Setting it up requires two people. One person in the practice determines which individuals are authorized to prescribe controlled substances. Then a Drug Enforcement Administration registrant who’s gone through the ID proofing process uses their 2-factor credential to set the access control list.  

Initial setup of EPCS can seem complex, but these online resources can answer common questions and provide guidance:

• The American Academy of Family Physicians: 
• US Drug Enforcement Administration: 
• Surescripts: https://surescripts.com/