How to start prescribing controlled substances electronically

This article was published in the September CDA Update, a special edition focused on the opioid epidemic and dentistry’s leadership role in the crisis.

Electronic data prescribing can reduce opportunities for diversion of controlled substances by eliminating the use of paper forms that can be stolen, lost or left behind and used illegally. E-prescribing also aids in providing timely patient care by, for example, relieving a patient from making a trip to the dental practice to pick up a written prescription for a Schedule II drug.

Use of e-prescribing for controlled substances is growing nationally due to state mandates and prescribers’ increasing comfort with technology. In California, less than 25 percent of prescribers are utilizing EPCS while more than 93 percent of pharmacies are enabled to accept it, according to e-prescription network Surescripts in its 2017 National Progress Report. For the purpose of this article, e-prescribing and EPCS refer only to electronic data prescriptions.

What do I need to know to get started with EPCS?
The U.S. Drug Enforcement Administration in June 2010 adopted the rule establishing the EPCS procedures. These procedures include:

• Third-party certification that prescription software applications meet DEA requirements
• Identify-proofing of prescribers
• Two-factor authentication when signing prescriptions
• Access controls established by software users

Prescribing software is sold with or without EPCS. Software with EPCS costs more because of the additional costs of regulatory compliance.

Dentrix, Eaglesoft, OpenDental, Curve, Carestream and MacPractice allow you to add e-prescribing with or without EPCS. A list of prescribing software applications is available on the Surescripts website, but many are proprietary products associated with a specific practice management software or electronic health record or an entity such as Access Dental. If you have practice management software, check with that company. If you do not have practice management software, refer to the names of some stand-alone prescribing software applications with EPCS at the end of this article.

What factors should I consider when purchasing prescribing software? 

• Stand-alone versus practice management software: The benefit of using a PMS-associated application is that patient demographic information can be flowed with a few keystrokes from PMS to prescription and the prescription entered as part of the treatment record. Stand-alone software requires the prescriber to enter all of the patient’s demographic information for the first prescription but not thereafter. The prescription also must be entered separately in the patient’s treatment record.
• Practice type: If you are an associate or locum tenens working at more than one practice, it may be easier to use stand-alone software because it can be used anywhere in the U.S. and is not tied to a specific PMS. If your practice has multiple locations and you want to use the PMS-associated application, a separate user license for each location may be required. A practice with multiple prescribers on-site will need each prescriber to have their own subscription, identity proofing and hard token, sometimes called an authentication token. If you work at an institution, such as a dental school or hospital, and prescribe using the institution’s DEA registration, you will need to complete steps with the appropriate entity within the institution.
• Basic versus enhanced: Software is offered as a basic version with optional enhanced information or it is offered with everything included in the annual subscription. Enhanced versions include such things as the ability to check for patient drug allergy, drug interactions, drug history and drug formulary.
• Mobility: Some software may be used on mobile platforms such as Android and iOS.
• Cost: The cost range for EPCS is $170 to $650 per user per year. A fee for setup, including identity proofing and provision of a hard token, can vary and may or may not be included in the software subscription rate. Promotions may be available from the stand-alone companies; check with each company.

What are the next steps after I select the software?
The basic steps are the same although each vendor or institution may differ in the details.

1. Identity proofing
2. Two-factor authentication
3. Setting access controls

Follow the software vendor’s instructions to complete identity proofing. You will need to submit your dental license, DEA registration and NPI Type 1 numbers and answer a series of questions. Once a prescriber’s identity is proved, he or she can receive credentials necessary to sign an EPCS. If a prescriber works at multiple locations with different prescribing software, each location’s software vendor will determine if it is necessary for the prescriber to undergo identity proofing more than once.

The DEA requires two-factor authentication for signing EPCS. The factors must be two of the following:

• Something you know (a password, for example)
• Something you have (a hard token, such as a fob or cell phone, to receive a short-term code)
• Something “you are” (a measurement of a human characteristic, such as a fingerprint)

The prescriber may not give any of the factors to another individual; doing so may lead to revocation or suspension of the prescriber’s DEA registration. A staff member may enter information into an e-prescription but only the prescriber may “sign,” that is submit, the two factors to the prescribing system.

Setting access controls requires at least two individuals, one of whom must be a DEA registrant with active EPCS privilege. One or both individuals can be set up as administrators in the system, depending on the software. The non-DEA registrant is responsible for ensuring the DEA registrant’s credentials are current. The administrator also is responsible for regularly reviewing internal audit reports and reporting security incidents as soon as possible to the software vendor and to the DEA.

Additional information on EPCS is available from the DEA and from individual EPCS vendors.