The Ins and Outs of EPCS and DEA Compliance

    August 2019 | Todd Johnson, Manager of Identity Management Solutions

    Expert Insights, Identity & Access Management


    Best practices for implementing EPCS to ensure compliance and drive adoption.

    Electronic prescribing for controlled substances (EPCS) is more important than ever. In fact, 27 states have passed legislation to mandate EPCS and a Medicare Part D program will require EPCS starting January 2021.


    The Magnitude of the Opioid Epidemic

    While controlled substance abuse is certainly not a new topic, many are not fully aware of the magnitude of this crisis. The statistics are staggering and are the driving force behind these new mandates requiring EPCS.  In fact, the National Institute of Drug Abuse estimates that more than 130 people die every day in the United States after overdosing on opioids. Furthermore, the Centers for Disease Control and Prevention estimates the “economic burden” of prescription opioid abuse at approximately $78.5 billion per year in the United States. This includes healthcare costs, lost productivity, addiction treatment, and criminal justice involvement.  

    Consider these additional findings from the National Institute of Drug Abuse:

    •  Roughly 21 to 29 percent of patients prescribed opioids for chronic pain misuse them.
    •  Between 8 and 12 percent develop an opioid use disorder.
    •  An estimated 4 to 6 percent who misuse prescription opioids transition to heroin.
    •  About 80 percent of people who use heroin first misused prescription opioids.
    •  Opioid overdoses increased 30 percent from July 2016 through September 2017 in 52 areas in 45 states.
    •  The Midwestern region saw opioid overdoses increase 70 percent from July 2016 through September 2017.
    •  Opioid overdoses in large cities increase by 54 percent in 16 states.


    States Are Responding

    In 2016, New York became the first state to mandate EPCS. In 2017, the HHS declared the opioid epidemic to be a full-blown public health emergency. Three years later…

    •  11 states currently have an EPCS mandate in place
    •  16 states have future effective dates for EPCS
    •  7 state are pending EPCS legislation


    2020 EPCS State Deadlines

    States are continually passing/adding news laws. This data was updated on Feb 20, 2020


    Where Does This Leave You?

    The DEA’s requirements for EPCS are unique, specific, and highly complex. Examples include:

    •  Providers must complete an identity proofing process to confirm that they are authorized to prescribe controlled             substances and have been assigned the proper credentials to sign an EPCS prescription
    •  A two-step logical access control process must be in place to give EPCS permissions to approved providers
    •  Providers must use two-factor authentication when signing an EPCS prescription
    •  Comprehensive and detailed reporting must be in place to demonstrate compliance and identity auditable events       and security incidents.

    •  A successful EPCS initiative requires a well-though-out, phased approach involving many stakeholders from your       organization. The below chart provides an example of our recommended phases and timeline.  

    Copy of EPCS (3)


    Download our EPCS Planning Guide for a step-by-step walk through of becoming EPCS compliant. You will learn:

    •  The DEA requirements for electronic prescribing for controlled substances
    •  How to break your project into 5 manageable phases
    •  The steps performed in each phase
    •  The suggested departmental owner of each step
    •  Helpful tips to keep the project on track to meet deadlines

    Download the EPCS Planning Guide



    Subscribe to Our Blog

    Stay up-to-date on Forward Advantage News, Customer Success Stories, Industry Trends and Expert Insights.