Study guide
7.3 Electronic Prescriptions for Controlled Substances (EPCS) & Security Requirements
NABP MPJE Multistate Pharmacy Jurisprudence Examination Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Pharmacist Licensure & Reciprocity
1.1 Initial Licensure Requirements & Examinations 1.2 License Renewal, Continuing Education (CE) & Status 1.3 Reciprocity, License Transfer & Multistate Licensure 1.4 Disciplinary Actions, Board Hearings, Sanctions & Reinstatement
2 Chapter 2: Pharmacy Personnel Roles & Supervision Ratios
2.1 Pharmacy Interns: Scope of Practice, Supervision & Preceptor Rules 2.2 Pharmacy Technicians: Registration, Certification & Permitted Duties 2.3 Technician-to-Pharmacist Ratios & Delegated Tasks 2.4 Non-Pharmacist Personnel & Automated Dispensing Technology Roles
3 Chapter 3: Prescriptive Authority & Practitioner Categories
3.1 Physicians, Dentists, Veterinarians & Podiatrists: Prescribing Scope 3.2 Mid-Level Practitioners: APNs, PAs, Optometrists & Independent Authority 3.3 Out-of-State, Foreign & Deceased Practitioner Prescriptions 3.4 Self-Prescribing & Prescribing for Family Members
4 Chapter 4: Patient Counseling & Drug Utilization Review (OBRA '90)
4.1 OBRA '90 Mandates & Prospective Drug Utilization Review (DUR) 4.2 Patient Counseling Requirements, Offer-to-Counsel & Documentation 4.3 Patient Profile Requirements & Retrospective DUR
5 Chapter 5: Advanced Pharmacist Practice & Collaborative Agreements
5.1 Collaborative Practice Agreements (CPAs) & Protocol-Based Care 5.2 Pharmacist Immunization Authority & Vaccine Administration Protocols 5.3 Medication Therapy Management (MTM) & Point-of-Care Testing (POCT) 5.4 Hormonal Contraceptive, Naloxone & Post-Exposure Prophylaxis (PEP/PrEP) Prescribing
6 Chapter 6: Federal Controlled Substances Act (CSA) & Scheduling
6.1 Controlled Substance Schedules (CI through CV) & Classification Criteria 6.2 DEA Registration: Types, Forms (224, 225, 363) & Renewal Cycles 6.3 Scheduled Listed Chemical Products (SLCPs) & Combat Methamphetamine Epidemic Act (CMEA)
7 Chapter 7: Controlled Substance Prescriptions & Legitimate Purpose
7.1 Corresponding Responsibility & Red Flags for Improper Prescribing 7.2 Required Components of Controlled Substance Prescriptions 7.3 Electronic Prescriptions for Controlled Substances (EPCS) & Security Requirements 7.4 Emergency Schedule II Prescriptions & Partial Filling Rules (CARA Act)
8 Chapter 8: Controlled Substance Ordering, Inventory & Recordkeeping
8.1 Ordering Schedule II Substances: CSOS & DEA Form 222 Execution 8.2 Controlled Substance Inventory Requirements (Initial, Biennial, Count Exactness) 8.3 Theft, Significant Loss (DEA Form 106) & Disposal/Destruction (DEA Form 41) 8.4 Prescription Transfers & Prescription Drug Monitoring Programs (PDMPs)
9 Chapter 9: Federal Pure Food, Drug & Cosmetic Act (FD&C Act) & Drug Safety
9.1 Adulteration vs. Misbranding: Statutory Definitions & Legal Violations 9.2 Prescription Labeling Requirements, Expiration Dates & Side Effect Statements 9.3 Poison Prevention Packaging Act (PPPA) & Child-Resistant Container Exemptions 9.4 Drug Recalls (Class I, II, III) & Market Withdrawals 9.5 Drug Product Selection, Generic Substitution & DAW Codes 9.6 Returning & Reusing Dispensed Drugs: Restocking, Redispensing & Repository Programs
10 Chapter 10: Drug Supply Chain Security Act (DSCSA) & Commercial Distribution
10.1 DSCSA Track-and-Trace Requirements: Transaction Information & Statements 10.2 Suspect & Illegitimate Product Verification, Quarantine & Notification 10.3 Prescription Drug Marketing Act (PDMA): Samples, Reimportation & Wholesale Distribution
11 Chapter 11: Compounding Standards: USP <795>, <797> & <800>
11.1 Section 503A vs. 503B Compounding Facilities (DQSA Architecture) 11.2 Non-Sterile Compounding (USP <795>) & Beyond-Use Dating (BUD) 11.3 Sterile Compounding (USP <797>): Air Quality, Cleanrooms & BUD 11.4 Hazardous Drug Handling (USP <800>): Engineering Controls & Personal Protective Equipment
12 Chapter 12: Pharmacy Operational Security, Records & Telepharmacy
12.1 Physical Pharmacy Security, Alarm Systems & Keyholder Rules 12.2 Mandatory Pharmacy Records Retention & Audit Inspection Readiness 12.3 Central Fill, Automated Dispensing Systems (ADS) & Telepharmacy Operations 12.4 HIPAA Privacy Rule, Patient Records & Breach Notification Protocols
7.3 Electronic Prescriptions for Controlled Substances (EPCS) & Security Requirements
Key Takeaways Explain This Topic AI
DEA EPCS regulations (21 CFR Part 1311) mandate two-factor authentication (2FA) for prescribers using two of three factors: something you know, something you have, and something you are.
Identity proofing (IDP) must be performed by a DEA-approved Credential Service Provider at NIST SP 800-63 Assurance Level 3 (AL3) before issuing EPCS signing credentials.
Prescribing and pharmacy e-dispensing software must undergo independent third-party audit or certification to process EPCS orders lawfully.
Electronic controlled substance prescription records must be digitally archived by the pharmacy for a minimum retention period of 2 years federally.
Computer-generated faxes do not meet EPCS criteria; if an EPCS transmission fails, a replacement paper prescription must explicitly state that the electronic transmission failed.
Last updated: July 2026
Electronic Prescriptions for Controlled Substances ( EPCS ) represent the modern standard for controlled substance prescribing in the United States. Promulgated by the DEA under 21 CFR Part 1311 , EPCS regulations permit practitioners to write and electronically transmit controlled substance prescriptions (Schedules II through V) while eliminating paper prescription forgery, alteration, and stolen prescription pads. However, to maintain legal validity, both prescribing systems and pharmacy dispensing systems must strictly adhere to complex technical, cryptographic, and security standards.
Mandatory Two-Factor Authentication (2FA) for Prescribers
Under 21 CFR § 1311.116 , a practitioner is strictly prohibited from signing an electronic controlled substance prescription unless they utilize a compliant Two-Factor Authentication (2FA) protocol. The 2FA requirement mandates the use of two out of three independent credential factors :
Something You Know : Knowledge factor (e.g., a secure password, PIN, or response to a cryptographic challenge).
Something You Have : Hard token factor separate from the computer (e.g., a cryptographic hardware token, USB key, or one-time password [OTP] mobile generator app).
Something You Are : Biometric factor unique to the individual (e.g., fingerprint scan, iris scan, or facial recognition).
Critical Regulatory Rule: Using two instances of the same factor (e.g., two separate passwords) is INVALID . The two factors must belong to distinct categories (e.g., Password + Hardware OTP Token, or Password + Biometric Fingerprint).
Identity Proofing (IDP) Protocols & NIST AL3 Standards
Before a practitioner can be issued EPCS signing credentials or granted logical access to sign EPCS orders, their identity must be conclusively established through formal Identity Proofing (IDP) .
Requirements for Identity Proofing
Conducting Entity : Must be performed by an independent, DEA-approved Credential Service Provider (CSP) or Certification Authority (CA) .
Assurance Standard : IDP must meet NIST SP 800-63 Assurance Level 3 (AL3) standards.
Verification Methods :
In-Person Processing : Practitioner presents government-issued photo identification and state medical license credentials to a qualified CSP agent.
Remote Processing : CSP utilizes financial history verification, credit bureau data, identity checks, and hard-copy credential mailing to confirm practitioner identity.
Once IDP is complete, the CSP issues the practitioner their 2FA credential token and digital certificate.
Logical Access Controls & Institutional Management
At the clinical site or institutional level (e.g., hospital EHR systems), access to the EPCS signing functionality is governed by strict Logical Access Controls (21 CFR § 1311.105):
Access authorization requires two distinct individuals to activate EPCS privileges for a prescriber.
Individual 1 : A DEA-registered practitioner (who checks medical license and DEA status).
Individual 2 : An authorized system administrator (who assigns software access rights).
This dual-control requirement prevents a single rouge administrator or practitioner from fraudulently enabling EPCS signing permissions.
Pharmacy E-Dispensing System Requirements & Record Archival
Pharmacies cannot simply receive electronic orders via standard email or fax. A pharmacy application processing EPCS must meet explicit federal criteria under 21 CFR § 1311.205 :
Mandatory Pharmacy Application Controls
Third-Party Audit & Certification : The pharmacy e-dispensing software must obtain a formal third-party audit or certification report confirming compliance with DEA 21 CFR Part 1311 rules.
Digital Signature Verification : The system must automatically verify the digital signature binding of the prescriber's EPCS file upon receipt.
Automated Flagging : The software must flag and halt processing if required elements (e.g., DEA number, patient address, digital signature hash) are missing or corrupted.
Transmission Medium : Transmission must be direct electronic-to-electronic . Computer-generated faxes of electronic prescriptions are strictly prohibited as EPCS orders (they fail digital signature verification).
Record Archival & Retention : All electronic controlled substance prescription records, audit trails, and dispensing histories must be digitally archived for a minimum of 2 years federally (many state laws require 5 to 10 years). Archives must be readily retrievable and backed up daily.
EPCS vs. Paper vs. Fax Regulatory Comparison
- Regulatory Dimension EPCS (Electronic) Written (Paper) Faxed Prescriptions
- Governing DEA Rule 21 CFR Part 1311 21 CFR § 1306.05 21 CFR § 1306.11
- Authentication Dual-Factor (2FA) + NIST AL3 IDP Manual Wet Ink Signature Manual Wet Ink Signature
Schedules Allowed C-II, C-III, C-IV, C-V C-II, C-III, C-IV, C-V C-III–V (C-II only for LTCF, Hospice, Parenteral Compounding)
System Requirement Certified EPCS Software Audit Security Paper (State specific) Direct Fax Machine Transmission
- Federal Retention 2 Years (Electronic Format) 2 Years (Hardcopy Format) 2 Years (Hardcopy Format)
- Handling EPCS Transmission Failures & Paper Conversions
If a practitioner attempts to transmit an EPCS prescription but the electronic transmission fails (e.g., network outage or system rejection), specific conversion protocols apply under 21 CFR § 1311.102(c) :
Paper Replacement Requirement : The practitioner may print a paper prescription, which must be manually signed in wet ink.
Mandatory Annotation : The paper replacement MUST explicitly state that the prescription was originally attempted via EPCS, noting the specific pharmacy destination, date, time, and confirmation of electronic transmission failure.
Pharmacist Verification Protocol : Upon receipt of such a paper prescription, the pharmacist MUST access the pharmacy electronic system to verify that the EPCS order was not received and dispensed previously. If the EPCS was received, the paper copy must be voided. If the EPCS was not received, the pharmacist may dispense the paper copy and void any late-arriving EPCS order.