Controlled substances: EPCS access

Before anything else

Nothing you draft or sign in Gale reaches a pharmacy today: Gale is not connected to the pharmacy network yet. A script you draft and sign exists only in this chart. Record it in Gale so the chart and the note are right, then send it by the route your practice already uses.

What prescribing does not do yet is the full list.

The screen, and what it is for

EPCS access opens from the prescribing screen. The only reason to open it is a controlled script that could not be signed.

It lists the designees at a registered location, and it is where a grant is entered, executed and revoked. It writes no prescriptions.

Two people, and neither of them is you

The ceremony is two-person by regulation, and Gale holds it that way rather than approximating it.

One active designee at the registered location enters the grant. They record the credential verification themselves: the date the DEA registration was checked, the date the state authority was checked, the status of each, and their own name against it. Gale fills none of that in on anyone's behalf — it is an attestation by a named human, and the screen says so where you type it.

A second designee, who is a DEA registrant, executes it with their own two-factor credential. Only at that moment does a permission exist.

Each of these is refused on its own:

• You may not request your own grant.
• A designee may not verify their own credentials.
• The person who entered the grant may not be the person who executes it.
• A login session is not a second factor. Presenting one is refused however recently you signed in.
• A grant cannot exist without a prescriber credential on record naming at least one current DEA registration.
• An attestation of good standing over a registration Gale holds as expired is a contradiction, and it is refused rather than quietly resolved either way.

Why a controlled script still refuses

A live grant is one of four checks, and the other three are the same ones every prescription meets: your account marked as a prescriber, the pharmacy connection for your practice, and your licence in the patient's state at the moment the session is opened. Having a grant does not stand any of them down.

The request for a signing session carries no scope, deliberately. Scope is derived from the prescription record — a scope you could choose would let a non-controlled session be requested over a controlled script, and route around everything above.

Revoking, and the clock

Revoke a grant on the same screen, with the reason.

Record when you discovered the problem as well as when you acted. The clock runs from discovery, not from the revocation, and the screen asks for both because only one of them is the one you will be asked about.

Every refusal is written down

Grants, executions, revocations, minted sessions and refusals all append to a hash-chained trail. A refusal is evidence too: it is the record that a control worked, which is the thing that is hardest to produce after the fact.