Guide

EPCS: identity proofing, two-factor, and the audit trail

Summary

Setting up electronic prescribing of controlled substances (EPCS) means clearing three DEA requirements before you can send a scheduled prescription: identity proofing that proves you are the prescriber, two-factor authentication for each signing, and an audit trail your certified application maintains. Your EHR or e-prescribing vendor supplies the certified software; you complete the one-time identity proofing and enroll your two-factor credential. Many states now mandate EPCS, so check your state's rule alongside the federal one.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

What EPCS is and whether you need it

Electronic prescribing of controlled substances, or EPCS, is the DEA-authorized way to transmit a scheduled prescription electronically instead of paper. The DEA's rules set what an EPCS system must do: verify the prescriber's identity, require two factors to sign, and keep a tamper-evident audit trail 1Ref 1Drug Enforcement Administration (2026).Diversion Control Division.DEA sets the EPCS requirements — identity proofing, two-factor authentication, a tamper-evident audit trail, and third-party certification of the application before it goes live.. You do not build any of this yourself — your certified application provides it — but you complete the parts that prove the prescriber is you. Whether you must use EPCS depends on federal and state mandates.

Beyond the DEA's technical requirements, whether you are required to prescribe controlled substances electronically is set by federal and state mandates that have expanded in recent years; confirm your own state's current rule rather than assuming a national one. The technical setup is the same regardless of the mandate — the mandate only changes when you must have it working. For a solo prescriber, the practical answer is usually to set it up early, because the identity-proofing step takes outside time you cannot compress on a deadline.

Identity proofing: proving you are the prescriber

Identity proofing is the one-time gate that confirms the person enrolling for EPCS is the licensed prescriber they claim to be, before any controlled-substance prescription can be signed. It is done either in person through your institution's credentialing process or remotely through an approved credential service provider that verifies your identity to a federal assurance level. You complete it once per system, and it is the step most likely to stall an otherwise quick setup.

This verification is separate from payer credentialing tasks like caqh proview from zero — a different check, for a different purpose, even though both prove you are who you say you are. Start identity proofing before you need to send your first electronic scheduled prescription, because it depends on document matching and an outside verifier, neither of which you control. A common failure mode is discovering, on the day a mandate takes effect, that the proofing is still pending.

Two-factor authentication and the signing credential

Two-factor authentication is what turns your click into a legally valid controlled-substance signature. To sign an EPCS prescription you must present two of three factor types — something you know, something you have, and something you are — so a password alone, or a token alone, cannot send a scheduled prescription. This two-factor step is required for every controlled-substance signing, not just at enrollment.

In practice that usually means a passphrase plus a hardware or app-based token, or a biometric. Enroll your factors when you set up the system, and keep a backup factor so a lost token does not halt your prescribing. A solo prescriber has no colleague to borrow a credential from, so the backup is not optional convenience — it is the difference between a smooth day and a queue of unsent scheduled prescriptions when a phone breaks or a token goes missing.

The audit trail and third-party certification

Behind the convenience sits an audit trail, and it is the part regulators care about most. An EPCS application must log every controlled-substance prescription event and every access to the signing function in a record that cannot be quietly altered, and it must be certified by a qualified third party or a certified auditor before it goes live 1Ref 1Drug Enforcement Administration (2026).Diversion Control Division.DEA sets the EPCS requirements — identity proofing, two-factor authentication, a tamper-evident audit trail, and third-party certification of the application before it goes live.. As the prescriber you rarely touch these mechanics directly, but you rely on them: they are what makes an electronic signature defensible.

The reason all of this matters is attribution: an electronic signature is only worth anything if it is provably the act of the identified prescriber. Medicare's own signature rules make the same demand in the documentation context — services must be authenticated by a handwritten or electronic signature attributable to the author 2Ref 2Centers for Medicare & Medicaid Services (2023).Complying with Medicare Signature Requirements.Medicare requires services to be authenticated by a handwritten or electronic signature attributable to the author — the same attribution principle EPCS enforces at signing. — which is the principle EPCS enforces at the moment of signing. When you keep your credential to yourself and never share your token, you are protecting the attribution the whole system rests on.

EPCS for buprenorphine and OUD prescribing

EPCS applies to buprenorphine the same way it applies to any scheduled medication, and it fits office-based opioid use disorder treatment cleanly. Since the X-waiver was eliminated in 2023, any clinician with Schedule III authority and a current DEA registration may prescribe buprenorphine for OUD, and electronic prescribing is simply the transmission method — subject to the same identity proofing, two-factor signing, and audit trail 3Ref 3Substance Abuse and Mental Health Services Administration (2026).Buprenorphine.Since the X-waiver was eliminated in 2023, any clinician with Schedule III authority and a current DEA registration may prescribe buprenorphine for OUD, transmitted electronically like any scheduled medication.. As of July 2026 that is the operative framework.

If you prescribe buprenorphine to patients you see remotely, the rules for controlled substances by telehealth are a separate layer on top of EPCS — EPCS is how you transmit the prescription, not whether telemedicine prescribing is permitted in the first place. And when a patient is in another state, cross-border prescriptions raise licensing and registration questions your e-prescribing system cannot answer for you. Keep those questions distinct: EPCS is the pipe, and the prescribing authority is what flows through it.

Fitting EPCS into your workflow

EPCS earns its keep when it lives inside a prescribing routine rather than beside it. The natural companion is your prescription-database check: most states require a query before a controlled substance is written, and many e-prescribing systems surface that check at the point of prescribing, so you can satisfy both in one flow 4Ref 4PDMP Training and Technical Assistance Center (2026).Prescription Drug Monitoring Program Training and Technical Assistance Center.Most states require a PDMP query before controlled-substance prescribing, a check many e-prescribing systems surface at the point of prescribing, with the mandate varying by state.. Because the query mandate — and any state EPCS mandate — varies by state, set your workflow to your own state's rule and revisit it when the rules change.

A few workflow points a solo prescriber tends to learn the hard way. If you use prescription agreements with your controlled-substance patients, EPCS is where the single-pharmacy term becomes concrete — the electronic prescription routes to the pharmacy you and the patient agreed on. If you hold state csrs in more than one state, confirm your e-prescribing system is configured for each registration and location before you rely on it there. And keep a documented fallback for system downtime, because a certified application that is temporarily unavailable still leaves you needing a lawful way to prescribe.

Common questions

It is increasingly required rather than optional. A federal mandate reaches many controlled substances prescribed under Medicare, and a growing number of states require EPCS more broadly, with details that vary by state. Even where it is not yet required, EPCS cuts paper-prescription fraud and speeds pharmacy fills, so most prescribers adopt it early. Confirm your own state's current rule before assuming you are exempt.

Identity proofing is the one-time verification that you are the licensed prescriber enrolling for EPCS. It happens in person through an institution's process or remotely through an approved credential service provider that checks your identity to a federal assurance level. It stalls setups because it depends on outside verification and document matching, so start it early — before you need to send your first electronic scheduled prescription.

Because a single credential can be stolen or shared, and a controlled-substance signature has to be provably yours. EPCS requires two of three factor types — something you know, something you have, something you are — for each signing, so a password alone cannot transmit a scheduled prescription. Keep a backup factor: as a solo prescriber, a lost token with no fallback can stop your controlled-substance prescribing entirely.

No. Your certified e-prescribing application maintains the audit trail and must be certified by a qualified third party or auditor before it goes live. Your job is to use it correctly: complete identity proofing, guard your two-factor credential, and never share your signing token. The system creates the tamper-evident record; you protect the attribution that makes an electronic signature defensible in a review.

Yes. EPCS transmits buprenorphine like any scheduled medication. Since the X-waiver ended in 2023, any clinician with Schedule III authority and a current DEA registration may prescribe buprenorphine for opioid use disorder, and EPCS is just the transmission method under the same identity proofing, two-factor signing, and audit trail. If you prescribe remotely, telehealth controlled-substance rules apply as a separate layer.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.Drug Enforcement Administration (2026). Diversion Control Division. U.S. Drug Enforcement Administration. link ✓DEA sets the EPCS requirements — identity proofing, two-factor authentication, a tamper-evident audit trail, and third-party certification of the application before it goes live.
2.Centers for Medicare & Medicaid Services (2023). Complying with Medicare Signature Requirements. CMS Medicare Learning Network (MLN905364). link ✓Medicare requires services to be authenticated by a handwritten or electronic signature attributable to the author — the same attribution principle EPCS enforces at signing.
3.Substance Abuse and Mental Health Services Administration (2026). Buprenorphine. SAMHSA. link ✓Since the X-waiver was eliminated in 2023, any clinician with Schedule III authority and a current DEA registration may prescribe buprenorphine for OUD, transmitted electronically like any scheduled medication.
4.PDMP Training and Technical Assistance Center (2026). Prescription Drug Monitoring Program Training and Technical Assistance Center. PDMP TTAC (Brandeis University, BJA-funded). link ✓Most states require a PDMP query before controlled-substance prescribing, a check many e-prescribing systems surface at the point of prescribing, with the mandate varying by state.

https://www.gale.care/for-providers/bhp-epcs-setup · 4 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers