Viewpoints: September/October 2014

Significant advances have occurred in electronic prescribing over the past few years. A substantial increase in volume was mainly due to the meaningful use of e-prescribing in prescriber systems according to the requirements set by CMS. Plus, new rules for electronic prescribing of controlled substances (EPCS), defined by the DEA and the states, eliminated the barrier to prescribing controlled substances electronically.

The majority of pharmacies in the nation have been connected for e-prescribing for some time. According to Surescripts’ 2013 National Progress Report and Safe-Rx Rankings (released in May 2014), 95% of the nation’s community pharmacies were set up to receive e-prescriptions, up from 93% in 2012 and from 91% in 2011. Conversely, the growth in the number of physicians capable of e-prescribing has been more recent. The report states that 73% of office-based physicians e-prescribed in 2013, a 4% increase over 2012 and a 15% increase over 2011. In 2013, 1.04 billion prescriptions, representing 58% of “eligible prescriptions,” were transmitted electronically to pharmacies. This is up 32% from 788 million e-prescriptions in 2012, and an 82% jump from 570 million e-prescriptions in 2011. In the past, “eligible prescriptions” did not include those prescribed for controlled substances. However, with EPCS rules in place, those can now be considered eligible.

Electronic Prescribing of Controlled Substances

The DEA’s final rule for EPCS, which became effective June 1, 2010, is an addition to, not a replacement of, existing rules. Even though the DEA issued rules for EPCS, state laws must allow it. If a state has more stringent laws restricting EPCS, then those laws govern. Some states had to pass new statutes to allow EPCS.

Currently, EPCS is legal in 49 states, with most state legislation specifying that EPCS processes must comply with the DEA requirements. Vermont and Kansas only allow Schedule III, IV, and V medications for EPCS. The other 47 states allow the use of EPCS for Schedule II, in addition to Schedule III, IV, and V medications. Montana is the only state that has not finalized rules allowing EPCS. Montana has proposed legislation that is waiting passage in a future legislative session.

EPCS implementation has been challenging, and less than half of the nation’s pharmacies are enabled for EPCS. For example, EPCS is enabled in less than 10% of the pharmacies in four states, two of which are Montana, for the reasons described above, and Arkansas, because of the recent adoption of EPCS legislation.

In New York State, legislation known as I-STOP will require all prescriptions (including those for controlled substances) issued in New York State to be transmitted electronically (except in emergency situations and other limited circumstances) by no later than March 27, 2015. A prescription generated on an electronic system that is printed out to the official New York State prescription form or faxed is NOT considered an electronic prescription. Laws like the one in New York may become a trend and passed in other “progressive” states, which will help to accelerate the uptake of e-prescribing and EPCS.

Compliance Challenges

Development and implementation of systems for prescribing controlled substances that comply with the DEA and state rules have been slow and resulted in slow uptake of EPCS on the prescriber side. Very few prescriber systems are enabled for EPCS. Some prescribers still do not know EPCS is legal; that lack of knowledge may be a factor interfering with EPCS adoption.

The prescriber cost associated with implementing EPCS may also be slowing implementation. Before EPCS, uptake of e-prescribing with prescribers was slow until CMS created Medicare payment incentives for using e-prescribing, followed by penalties for not using e-prescribing. The meaningful-use incentives helped subsidize prescribers so they could implement e-prescribing software. However, implementation of EPCS is now an additional cost that prescribers must bear.

The development of software allowing e-prescribing, EMR, and EHR systems to manage EPCS requires the following to comply with the DEA rules: 

  • Use an e-prescribing application certified for EPCS and that meets DEA, Surescripts, and identity- proofing requirements.

  • Complete an identity-proofing process to obtain a two-factor authentication credential or digital certificate. continued on next page

  • Use a two-factor authentication process for each prescription issued using EPCS. Two of the following three options must be used to protect the prescriber from misuse of credentials by insiders as well as from external threats:

» “Something you know” — a password or PIN. 

» “Something you have” — a hard token displaying a randomly generated number. 

» “Something you are” — a biometric marker, such as a fingerprint or retina scan.

As more EMR, EHR, and e-prescribing systems become certified and available to prescribers, and the benefits of EPCS become better understood, an increase in EPCS utilization will occur in the coming years.

A pharmacy is able to process electronic controlled- substance prescriptions only when the pharmacy system used to process prescriptions has been certified as complying with the DEA and state requirements. The pharmacy system must be able to: 

  • Import, display, and store the required contents of a controlled-substance prescription accurately and consistently.

  • Digitally sign and archive the controlled-substance prescription or import and archive the record that the last intermediary digitally signed.

  • Electronically accept and store all of the information that DEA requires to be annotated to document the dispensing of a prescription.

  • Allow the pharmacy to limit access for the annotation, alteration (to the extent such alteration is permitted by DEA regulations), or deletion of controlled-substance prescription information to specific individuals or roles.

  • Provide an internal audit trail that documents whenever a prescription is received, altered, annotated, or deleted.

  • Conduct an internal audit that identifies any potential security problems daily, and generate a report for review by the pharmacy if a problem is identified.

Links » For more on references in this column 

National Progress Report and Safe-Rx Ranking 

The Office of Diversion Control

Many of the above functionalities are now standard processes in pharmacy systems. To obtain the required certification, the pharmacy system vendor or prescriber application provider must either:

  • Hire a qualified third party to audit the system or application. 

  • Have it reviewed and certified by an approved certification body initially and every time there is a software upgrade.

Upon successful completion of the certification process, the auditor or certification body will issue a report that states the application complies with DEA’s requirements and if there are any limitations on its use for controlled substances. The software provider must provide a copy of the report to pharmacies that want to use the pharmacy application for EPCS. The report demonstrates the pharmacy system is compliant with the DEA requirements for EPCS.

You can do your part to increase e-prescribing utilization by making sure your patients and prescribers are aware that your pharmacy is ready to receive all prescriptions electronically. If your pharmacy system is not ready for EPCS, contact your software vendor to find out when your system will be ready. CT

David Schuetz, RP.h., has been working in pharmacy for over 30 years. His areas of expertise are pharmacy practice management, electronic ordering systems operations, testing, training, documentation, and deployment. He also specializes in pharmacy database and drug file management, and serves as a subject matter expert in pharmacy data warehousing. He can be reached at