Confidential1
Electronic Prescribing of Controlled Substances (EPCS)
Part 1 of a 3 Part Series
Chuck Klein, Ph.D.GM/Director, Medication Management
Confidential2
Agenda• Defining EPCS• Legal Aspects of EPCS• Pharmacies• Requirements: OrderConnect• Requirements: Prescribers• Two-Factor Authentication• Identity Proofing and Credentialing• Workflow• Audit Reports• NY I-STOP Law• OrderConnect Timeline
Confidential3
What is EPCS?
• EPCS—the Electronic Prescribing of Controlled Substances—allows prescribers who use an EPCS-certified e-prescribing application to send prescriptions for controlled substances electronically to pharmacies.
• Although highly desired, EPCS is not mandatory, except for New York State prescribers (effective 3/27/2015).
Confidential4
Is EPCS Legal?• Yes. On March 31, 2010, DEA's Interim Final Rule with Request for
Comment titled "Electronic Prescriptions for Controlled Substances" [Docket No. DEA-218, RIN 1117-AA61] was published in the Federal Register. The rule became effective June 1, 2010.
• The rule revises DEA regulations to provide practitioners with the option of writing prescriptions for controlled substances electronically. The regulations also permit pharmacies to receive, dispense, and archive these electronic prescriptions. These regulations are an addition to, not a replacement of, the existing rules. The regulations provide pharmacies, hospitals, and practitioners with the ability to use modern technology for controlled substance prescriptions while maintaining the closed system of controls on controlled substances.
Confidential5
So EPCS is Legal in Every State?• State Boards of Pharmacy can enforce stricter rules than the DEA but
not less strict.• All states except Montana currently allow the electronic prescribing of
controlled substances.• Kansas and Vermont do not allow Schedule II medications to be sent
electronically.• Nurse practitioners in Texas may not send Schedule II medications
electronically. • Effective March 27, 2015, all prescribers in New York must send all
prescriptions electronically to pharmacies, including those for controlled substances (NY-ISTOP).
Confidential6
Is EPCS Mandatory?From the DEA’s perspective the new regulations do not mandate that practitioners prescribe controlled substances using only electronic prescriptions. Nor do they require pharmacies to accept electronic prescriptions for controlled substances for dispensing.
Whether a practitioner or pharmacy uses electronic prescriptions for controlled substances is voluntary from DEA’s perspective. Prescribing practitioners are still able to write, and manually sign, prescriptions for schedule II, III, IV, and V controlled substances and pharmacies are still able to dispense controlled substances based on those written prescriptions. Oral prescriptions remain valid for schedule III, IV, and V controlled substances.
Electronic prescriptions for controlled substances are only allowed if the electronic prescription and the pharmacy application meet DEA’s requirements. In addition, electronic prescriptions for controlled substances may be subject to State laws and regulations. If State requirements are more stringent than DEA’s regulations, the State requirements would supersede any less stringent DEA provision.
Confidential7
Will All Pharmacies Accept Electronic Prescriptions for Controlled Substances?
Just as e-prescribing software applications (like OrderConnect) have to go through DEA and Surescripts certifications, so, too, do pharmacy software applications.
When OrderConnect is EPCS enabled, it will automatically know which pharmacies can and cannot accept prescriptions for controlled substances.
It will not allow users to send prescriptions for controlled substances electronically to pharmacies that are not authorized to receive them.
Confidential8
The Pharmacy Landscape for EPCS
Confidential9
What is Required for OrderConnect to do EPCS?
ePrescribing Software Vendors:• ePrescribing software vendors must get certified by a DEA-
approved auditor.• Increased focus and attention is on strict access control and
auditing.• Two factor authentication is required when transmitting EPCS
prescriptions.• Surescripts certification for EPCS is also required.
Confidential10
What is Required for Prescribers to do EPCS?
Prescribers:• The DEA requires prescribers to go through Identity Proofing
and Issuance of Credentials.• Specific processes are outlined by the DEA for ‘activating’
physicians to do EPCS.• Two factor authentication is required by prescribers when
transmitting EPCS prescriptions.
Confidential11
What is Two-Factor Authentication?Two-factor authentication (2FA) adds a second level of authentication to an account log-in. When you have to enter only your username and one password, that's considered a single-factor authentication.
2FA requires the user to have two out of three types of credentials before being able to access an account. The three types are:• Something you know, such as a Personal Identification Number (PIN) or a
password.• Something you have, such as a soft or hard token.• Something you are, such as a biometric like a fingerprint, iris scan, or voice print.
Netsmart is choosing to use the first two and will offer both hard and soft token options.
Confidential12
Identity Proofing and Credentialing
Netsmart has partnered with Verizon who will provide identity proofing and credentialing services. Verizon is a federally approved Certificate Authority and a Credential Services Provider (NIST SP 800-63-1 Assurance Level 3).
Netsmart will offer, through the OrderConnect Admin Tool and Registration Tool, the ability for providers to get identity proofed and credentialed (via Verizon).
[More information about this will be offered in our next webinar on January 22, 2015.]
Confidential13
Setting Access Controls in OrderConnect for EPCS
Once a prescriber has gone through identity proofing and obtained an authentication credential he/she is eligible for EPCS access in OrderConnect.
The OrderConnect Admin Tool will contain the access controls needed to activate prescribers for EPCS according to strict DEA standards. Two separate individuals will be required to grant access for each prescriber.
Confidential14
Prescriber Workflow
Prescribers will be able to order controlled substances and non-controlled substances at the same time. OrderConnect will know which medications require two-factor authentication on the Order Confirmation screen.
Prescribers can apply two factor authentication once for all the controlled substances being ordered at that time for that patient.
Confidential15
Agent Workflow
Prescriber agents (eg, nurses, etc.) will be able to prepare prescriptions for controlled substances on behalf of a prescriber.
Once prepared, the prescriptions will go into a prescriber’s queue.
Once the prescriber reviews the prescriptions and applies his/her two factor authentication, they will be transmitted to the pharmacy.
Confidential16
New Audit ReportsNew audit reports will be available in OrderConnect that will allow a prescriber to see all activities pertaining to his/her EPCS.
The DEA requires that each EPCS prescriber review his/her audit report every week.
OrderConnect will give the ability for prescribers to look at a week’s work of activity or any time range they wish.
It is up to each prescriber to check their report. Reports will not be “pushed” to prescribers nor will OrderConnect track who has accessed their reports and who has not.
Confidential17
What is the New York I-STOP Law and What Does it Have to Do with EPCS?
On March 27, 2015, electronic prescribing of non-controlled as well as controlled substances will be required in New York State under the provisions of the I-STOP law and subsequent regulations. Title 10 NYCRR Part 80 Rules and Regulations on Controlled Substances authorizes a practitioner in New York State to issue an electronic prescription for controlled substances in Schedules II through V.
For electronic prescribing of controlled substances (EPCS), the regulations require a facility to register their certified electronic prescribing computer application with the New York State Department of Health, Bureau of Narcotic Enforcement (BNE).
Confidential18
OrderConnect’s Timeline for EPCS• OrderConnect EPCS will be released for use by our New York
clients on March 16, 2015.• Prior to its release, user documentation will be provided as well
as a recorded training webinar.• Instructions will also be sent that will allow providers to go
through identity proofing and credentialing.• In addition, information will be sent to our NY clients that will
allow them to register their OrderConnect with the NY Bureau of Narcotic Enforcement.
• OrderConnect EPCS will be available for use by all other clients by April 30, 2015.
Confidential19
What Will the Additional Cost be for EPCS?
This is still being determined.
It will be similar to other e-prescribing systems; there will be a per prescriber setup fee and a small monthly increase in each prescriber license.
As soon as the cost is finalized it will be announced.
Confidential20
OrderConnect EPCS Webinars: Part 2 and Part 3
Part 2: January 22, 2015 Will cover identity proofing and credentialing and access controls in OrderConnect.
Part 3: February 19, 2015
Will cover EPCS workflow in OrderConnect for prescribers and agents.
Invitations will be forthcoming.
Confidential21
Questions?