Version 14.19

EPCS Rules and Requirements

Office Practicum has worked with DrFirst (our EPCS partner) to implement thorough processes and workflows that ensure that we remain compliant with our certification guidelines and to assist EPCS users in maintaining compliance with DEA regulations.

The following list details the rules and requirements associated with setting up and using EPCS:

Setting up EPCS Users

1. EPCS prescribers must go through a form of electronic authentication, otherwise known as Identity-Proofing (IDP).
2. Each provider must be issued "two-factor authentication" credentials. Two-factor authentication is the use of two forms of identification. The first is authentication known only to the EPCS prescriber (such as a password). The second is an external form of authentication such as biometric input or a PIN derived from a hard or soft token. A hard token is a device that generates authentication codes regularly and is associated with the EPCS prescriber's account. A soft token is similar to a hard token but rather than use an external token it is an application that runs on a device (such as a mobile phone or tablet).

Note: In accordance with DEA regulation, soft tokens cannot run on the same device used for EPCS prescribing.

1. In order to electronically prescribe controlled substances the provider must enter the following into the Staff/Provider Directory:

• Provider's Name should be entered exactly as it is in the NPI Directory.
• Valid Federal DEA number.

1. A user with System Administrator permissions activates all providers in that practice with Logical Access Controls (LAC), which is a step required for each provider to use the EPCS functionality within OP. This is a two-step process where the administrator navigates to the LAC through the EPCS Access Control menu under Utilities > Manage Practice. This menu item is visible only to users with System Admin permissions or to individuals with these permissions: AA_AccessSecurity.mi and AA_SystemAdmin.mi. This must be a user other than the provider being activated/deactivated. The provider enters his or her credentials through two-factor authentication. Once entered successfully, the provider is activated.

1. Some states require that providers register their EPCS application with their Bureau of Narcotics Enforcement (or an equivalent agency). It is your responsibility to understand and comply with the laws that apply in your state.

Using EPCS

Controlled substances:

1. Can only be sent electronically to a pharmacy or printed for dispensing once. The only exception to this is if the electronic transmission fails.

• If printed after being sent or previously printed, the printout will be marked as a copy and will instruct the pharmacist not to dispense. Print templates used for EPCS cannot be edited or altered.
• After a provider sends or prints an EPCS prescription, it cannot be edited.

1. Controlled substances can only be sent electronically to EPCS enabled pharmacies. Note: Some pharmacies do not accept controlled substances electronically.
2. Proxy users cannot send controlled substances.
3. No more than one controlled substance can be renewed/refilled at a time.
4. The DEA does not allow for refills when prescribing schedule II drugs, while Schedule III - V drugs may contain up to five (5) refills.
5. Controlled substances created that were never signed using two-factor authentication will sit in a pending status. They can be deleted and re-written.
6. Drugs used for detox treatment or maintenance treatment (for example, Suboxone) require a Narcotics Addiction DEA Number (NADEAN) to be included in the pharmacist notes. OP enforces a nine-character requirement with two alpha and seven numeric characters within the NADEAN field.
7. Drugs that contain GHB (gamm-Hydroxyburtric acid) (for example, Xyrem) must contain a reason for prescribing them in the pharmacist notes. The prescription will not be transmitted without a medical reason.
8. Some states require (or optionally make available) a database for prescribers to view a patient's dispense history of controlled substances. OP has added a quick link you can set up for easy access to the Prescription Monitoring Program (PMP) website in your state along with a free-text field on the Prescription Writer window for documentation purposes should your state provide you with a confirmation number.

Version 14.10

EPCS Rules and Requirements

Office Practicum has worked with DrFirst (our EPCS partner) to implement thorough processes and workflows that ensure that we remain compliant with our certification guidelines and to assist EPCS users in maintaining compliance with DEA regulations.

The following list details the rules and requirements associated with setting up and using EPCS:

Setting up EPCS Users

1. EPCS prescribers must go through a form of electronic authentication, otherwise known as Identity-Proofing (IDP).
2. Each provider must be issued "two-factor authentication" credentials. Two-factor authentication is the use of two forms of identification. The first is authentication known only to the EPCS prescriber (such as a password). The second is an external form of authentication such as biometric input or a PIN derived from a hard or soft token. A hard token is a device that generates authentication codes regularly and is associated with the EPCS prescriber's account. A soft token is similar to a hard token but rather than use an external token it is an application that runs on a device (such as a mobile phone or tablet).

Note: In accordance with DEA regulation, soft tokens cannot run on the same device used for EPCS prescribing.

1. In order to electronically prescribe controlled substances the provider must enter the following into the Staff/Provider Directory:

• Provider's Name should be entered exactly as it is in the NPI Directory.
• Valid Federal DEA number.

1. A user with System Administrator permissions activates all providers in that practice with Logical Access Controls (LAC), which is a step required for each provider to use the EPCS functionality within OP. This is a two-step process where the administrator navigates to the LAC through the EPCS Access Control menu under Utilities > Manage Practice. This menu item is visible only to users with System Admin permissions or to individuals with these permissions: AA_AccessSecurity.mi and AA_SystemAdmin.mi. This must be a user other than the provider being activated/deactivated. The provider enters his or her credentials through two-factor authentication. Once entered successfully, the provider is activated.

The person performing the first step must be a different individual than the person performing the second step. Any person accessing the LAC must do so using their own unique credentials to the system.

1. Some states require that providers register their EPCS application with their Bureau of Narcotics Enforcement (or an equivalent agency). It is your responsibility to understand and comply with the laws that apply in your state.

Using EPCS

Controlled substances:

1. Can only be sent electronically to a pharmacy or printed for dispensing once. The only exception to this is if the electronic transmission fails.

• If printed after being sent or previously printed, the printout will be marked as a copy and will instruct the pharmacist not to dispense. Print templates used for EPCS cannot be edited or altered.
• After a provider sends or prints an EPCS prescription, it cannot be edited.

1. Controlled substances can only be sent electronically to EPCS enabled pharmacies. Note: Some pharmacies do not accept controlled substances electronically.
2. Proxy users cannot send controlled substances.
3. No more than one controlled substance can be renewed/refilled at a time.
4. The DEA does not allow for refills when prescribing schedule II drugs, while Schedule III - V drugs may contain up to five (5) refills.
5. Controlled substances created that were never signed using two-factor authentication will sit in a pending status. They can be deleted and re-written.
6. Drugs used for detox treatment or maintenance treatment (for example, Suboxone) require a Narcotics Addiction DEA Number (NADEAN) to be included in the pharmacist notes. OP enforces a nine-character requirement with two alpha and seven numeric characters within the NADEAN field.
7. Drugs that contain GHB (gamm-Hydroxyburtric acid) (for example, Xyrem) must contain a reason for prescribing them in the pharmacist notes. The prescription will not be transmitted without a medical reason.
8. Some states require (or optionally make available) a database for prescribers to view a patient's dispense history of controlled substances. OP has added a quick link you can set up for easy access to the Prescription Monitoring Program (PMP) web site in your state along with a free-text field on the Prescription Writer window for documentation purposes should your state provide you with a confirmation number.

New York State Only

Before utilizing EPCS functionality, each provider must register Office Practicum as their e­Prescribing application with the Bureau of Narcotic Enforcement. In addition, before a prescription for a controlled substance is written, providers must first query the Prescription Monitoring Program (PMP). Click here for more information about both requirements.