The Drug Enforcement Administration (DEA) published its interim final rule (IFR) on electronic prescribing for controlled substances (EPCS) more than two years ago. Between that time and now, electronic prescribing networks (such as Surescripts) have worked with both physician and pharmacy application vendors to ensure that EPCS is properly implemented in the spirit of full compliance with DEA requirements.
In order for a physician electronic health record application vendor or pharmacy practice management application vendor to be able to connect its users to an electronic prescribing network, it must first comply with technical requirements set forth by the DEA's IFR. Thereafter, the vendor must:
Upon complying with these requirements, a physician or pharmacy application vendor is permitted to connect its end users by means of an electronic prescribing network for EPCS purposes.
Several companies are recognized by the DEA in its EPCS IFR as being qualified to perform Part 1311 EPCS audits: SysTrust, WebTrust, SAS 70, and/or certified information system auditors. In addition, the DEA recently specifically approved InfoGard Laboratories as another company capable of conducting Part 1311 EPCS audits. Other companies may become available as well in the future.
To date, several physician or pharmacy application vendors have completed the process of becoming certified and audited to connect to an electronic prescribing network for EPCS purposes.
At present, only a small number of EPCS transactions have been transmitted in those states in which this is currently allowed. Although the DEA has promulgated its IFR, many states still need to align their laws and regulations in order for EPCS transactions to occur.
To date, prescribers registered in eight states have issued DEA-compliant EPCS transactions: California, District of Columbia, Massachusetts, Maryland, Michigan, Texas, Virginia, and Washington. Although electronic prescribing networks such as Surescripts provide services in all fifty states and DC, nationwide deployment of EPCS can only occur once both the state and federal laws are aligned in all jurisdictions.
Vendors are cautioned that in several instances, electronic prescribing networks provide that additional requirements must be met before these pathways can be used to facilitate EPCS. For example, vendors may need to prove that they have completed their Part 1311 EPCS audits as required by the DEA before being activated for EPCS transactions. Additionally, pharmacy directories in prescriber applications are required to indicate which pharmacies are enabled to receive EPCS, and prescribers are able to send EPCS only to those pharmacies, and vice versa.
Finally, in those instances in which an EPCS transaction crosses state lines, both the transmitting prescriber and the receiving pharmacy should be in compliance with both the DEA's EPCS IFR and the controlled substance laws and regulations of the state in which the prescriber or pharmacy is located.