Electronic Prescription of Controlled Substances

The electronic prescription of controlled substances (EPCS) is a topic that has been in my thoughts lately. Next month my hospital and clinic go live with an EHR that has e-prescribing capabilities. During training I was told that electronic prescribing of controlled substances was not allowed. I recalled that an interim final rule (IFR) for prescribing controlled substances had been posted in the Federal Register in 2010. So I spoke up and said that electronic prescription of controlled substances was allowed. That started me on a search for up-to-date information about the subject. It turns out that in March 2012 in Arizona, I was only partly correct but that has changed in April 2012. Let me start by providing some information about EPCS.


EPCS offers a number of advantages over the current state of affairs. For current e-prescribers separate paper and electronic workflows are needed to prescribe the full spectrum of medications. For some specialties such as mine as an orthopedic surgeon, the majority of prescriptions I write are for controlled substances (narcotic pain medication.) Printing prescriptions for controlled substances from many eRx software arrangements requires that special alteration-proof paper be loaded into the printer. That is a disruptive workflow. Finally, EPCS could potentially help reduce the explosion of illegal use of prescription medications currently being experienced in the U.S. by providing better two-way communication of prescription history between prescribers and pharmacies .


Barriers to EPCS include lack of incentives to certify eRx software, need for identity proofing of providers to obtain a digital certificate, the relatively modest cost (less than $100 per year) of obtaining a digital certificate, and the need to modify workflow processes to integrate standard eRx and EPCS.


The IFR for prescribing controlled substances can be found here. A number of succinct summaries have been published to help understand this somewhat complex regulation. I will provide links to some websites that I have found useful. A few of the key points are discussed below. A specially certified electronic prescribing system must be used at both the provider and pharmacy ends of the transaction. (For now, the certification is separate from that for the Medicare and Medicaid EHR incentive programs of CMS.) The IFR did not specify approved certifying agencies so this was problematic. In September of 2011 InfoGard was uniquely approved for this role. It has been hard at work certifying systems since. Next, prescribers must have digital certificates and use two factor authentication to sign and submit prescriptions. The eRx vendor was supposed to provide names of Certificate Authorities (CAs) or Credential Service Providers (CSPs) with whom they work to help providers verify their identity and obtain the necessary digital certificates. The CAs and CSPs should be cross certified with the Federal Bridge. I believe this step presented a barrier because the process is fairly new in the health IT world and participating CAs and CSPs are not easily identified. Continuing, at least two individuals must be involved in setting access controls to the controlled substance eRx software. Also, the software must be able to provide an audit trail of electronic prescriptions submitted. (These two requirements seem straightforward.) Loss of a hard token (a piece of hardware used for two factor identification such as a fob or smart card) must be reported immediately. Finally the workflow specified for preparing and submitting the electronic prescription of the controlled substance is flexible enough to permit a variety of individual prescribing routines.


So almost two years after the IFR was published, what has been the real-world experience with electronic prescription of controlled substances? Remember there are times when state law takes precedence over federal regulations. (This constitutional conflict between federal and state's rights continues all these years later.) Now that a certification body has been approved by the DEA, Surescripts has worked with EHR vendors and pharmacies to offer support for EPCS in CA, TX, and VA. There must be other pilots in states where the law does not prohibit electronic prescribing of controlled substances. I don't offer a comprehensive list. I have looked into electronic prescribing of controlled substances in my state of Arizona. Last week I called a local pharmacy and the representative said the EPCS is illegal in Arizona. I looked at the State Pharmacy Board website. They had a page with resources about EPCS but stated that it was not authorized in Arizona. Then, just this past Friday, the weekly newsletter published by the Arizona Medical Association announced that the governor signed a bill that legalizes electronic prescription of controlled substances on April 4th. Now we will have to wait to see how quickly EPCS is adopted in Arizona.


Coincidently, I was listening in on a meeting of the Health Information Technology Policy Committee Privacy and Security Tiger Team last week. They were discussing the comments they plan to submit to the full committee regarding the NPRM on Meaningful Use stage 2. They decided not to comment on the lack of requirement for EPCS in the proposed regulation. I was surprised because they often talk of aligning regulations and incentives. Contrary to this decision, I think a federal regulation would present vendors with a strong incentive to spend the extra time and money to redesign their eRx software and obtain the separate certification required and move this initiative forward.