Electronic prescribing of controlled substances: what the DEA rule requires, and what it proves

1 A signature, not a judgment

Every electronic prescription for a Schedule II, III, IV or V controlled substance in the United States passes through one federal rule. The Drug Enforcement Administration’s Electronic Prescriptions for Controlled Substances was published as an interim final rule at 75 Fed. Reg. 16236 on March 31, 2010 and took effect June 1, 2010.¹ Codified as subpart C of 21 C.F.R. Part 1311, it tells a prescriber how to prove identity and sign, tells software what it must record and refuse, and tells a pharmacy what it may accept.² It made electronic prescribing an option, not a duty;¹ the mandates came later, from Congress for Medicare Part D and from the states.

This paper sets out what the rule and the mandates require, and what an EPCS signature establishes. The short answer has two halves. An EPCS record is strong evidence of who signed and what was signed: an identity-proofed registrant holding a second factor completed authentication while the prescription and a legal attestation were on screen, and the signed contents could not then change without cancelling the prescription. It is not evidence that the prescription was appropriate. DEA said as much when it wrote the rule, and the regulation leaves the prescriber’s responsibility for a legitimate medical purpose untouched.^1,2

The distinction matters because state mandates were adopted as opioid measures. By 2020 most states had passed EPCS mandates as a tool to reduce opioid prescribing, and the national evaluation found that wider EPCS use was not associated with less of it.³ What follows treats EPCS as what its text makes it: an authentication and non-repudiation control with an audit trail attached.

2 An interim rule, 16 years on

The rule’s comment period closed on the day it took effect, and it has never been finalized.¹ In April 2020 DEA reopened comment at 85 Fed. Reg. 22018, prompted by § 2003(c) of the SUPPORT Act, which directed the Attorney General to update the rule’s biometric requirements within a year of its October 2018 enactment. The notice asked whether alternatives to two-factor authentication could preserve security while encouraging adoption, whether logical access controls could be less burdensome, and whether one-business-day incident reporting had proved difficult.⁴ Comment closed June 22, 2020; no rule followed. The Unified Agenda edition labeled 2026 lists RIN 1117-AA61 among long-term actions and dates its next step, a new proposed rule, “To Be Determined”.⁵

The technical references have aged in place. On the eCFR current to September 24, 2026, § 1311.105 still requires identity proofing at Assurance Level 3 or above of NIST SP 800-63-1, and §§ 1311.115 and 1311.120 still name FIPS 140-2 for cryptographic modules, FIPS 186-3 for digital signatures and FIPS 180-3 for hashing.² NIST withdrew SP 800-63-1 on August 29, 2013;⁶ the current version of the series, SP 800-63-4, was finalized July 31, 2025.⁷ FIPS 186-3 was withdrawn in July 2013 and FIPS 180-3 in March 2012.⁸ NIST’s Cryptographic Module Validation Program scheduled FIPS 140-2 validations to move to its historical list on September 21, 2026, and says it still supports use of modules on that list in existing systems.⁹

DEA has bridged part of the gap by guidance. Its July 2023 practitioner questions and answers, which state that they lack the force of law, describe Identity Assurance Level 2 of SP 800-63-3 as like the rule’s Assurance Level 3; they predate SP 800-63-4.¹⁰ A 2011 clarification told auditors that an EPCS audit must address all of Part 1311, including processing integrity.¹¹ Separately, a final rule effective August 28, 2023 lets a retail pharmacy transfer an electronic Schedule II–V prescription to another pharmacy once for initial filling, at the patient’s request, kept electronic and unaltered.¹²

3 What the prescriber must do

Identity proofing and two factors

An individual practitioner must obtain a two-factor credential from a credential service provider approved by the General Services Administration, or, for digital certificates, from a certification authority cross-certified with the Federal Bridge, issued over two channels such as e-mail, mail or telephone.² Under § 1311.110 a DEA-registered institutional practitioner, such as a hospital, may instead proof the practitioners it privileges itself. Authentication uses two of three factors: something known, a biometric, or a hard token separate from the computer and meeting at least FIPS 140-2 Security Level 1. A biometric subsystem must operate at a false match rate of 0.001 or lower.² DEA’s guidance treats a cryptographic key stored on a cell phone as a hard token.¹⁰

The signing ceremony

Staff may enter prescription data; only the registrant may sign. The application must display the date, the patient’s full name, the drug, strength, form, quantity, directions, refills, any earliest fill date, the prescriber’s name, address and DEA number, and an attestation. Once the prescriber marks the prescription ready, the DEA-required elements cannot change without another review. The prescriber then authenticates with the information still displayed, under a statement that begins: “By completing the two-factor authentication protocol at this time, you are legally signing the prescription(s) and authorizing the transmission of the above information to the pharmacy for dispensing.” Completing the protocol is the signature. Several prescriptions for one patient may be signed with one authentication, and any later alteration of the required information must cancel the prescription.²

Standing duties

Under § 1311.102 the prescriber must keep sole possession of the hard token and share no password or biometric; tell the practice’s designated access-control individuals within one business day of discovering a lost, stolen or compromised token; and tell them and DEA within one business day of discovering prescriptions issued under the prescriber’s registration that the prescriber did not sign. Before first use, the prescriber must confirm that a third-party auditor or certifier found the application records, stores and transmits the required information accurately, and must not sign with it if required functions are disabled or appear to malfunction. The application must supply a log of the prior month’s controlled prescriptions within seven calendar days.²

4 The two-person ceremony

The requirement most specific to EPCS is logical access control. At each registered location, § 1311.125 requires the registrants to designate at least two individuals to manage access to the application, at least one a registrant who holds a two-factor credential. One must verify that the prescriber’s DEA registration and state authorizations are current. When one designated individual enters a grant or revocation of a prescriber’s permission to sign, a second must execute it with a two-factor credential, and that second individual must be a DEA registrant. Access must be revoked on the date the practice discovers a compromised factor, an expired, revoked or suspended registration, or that the prescriber is no longer authorized.² Changing who can sign always takes 2 people.

The 2010 preamble recognized that some solo practitioners may have no other employees, thought it unlikely they lacked at least part-time help, and said the second person need not be an employee, only that two people be involved and that both be designated by the practitioner.¹ Who approves the access of a location’s only registrant is not addressed in the rule text, or in the preamble and guidance passages reviewed here.^1,2,10 This paper reads § 1311.125(c), which requires the executing individual to be a DEA registrant, to mean that such a registrant would ordinarily supply the approving credential, even for his or her own access, once the other designee enters the change. That is an interpretation, not DEA’s statement; on it, the control is two people, not two prescribers.

The daily report somebody has to read

The application must analyze its audit trail at least once every calendar day and generate an incident report identifying each auditable event: attempted or successful unauthorized access, attempted or successful unauthorized modification or destruction of required records, interference with application operations or audit-trail functions, and any setting of or change to logical access controls. The designated individuals must decide whether each event is a security incident and report incidents to the application provider and DEA within one business day.²

These duties fall on the practice; no software audit discharges them. DEA’s 2020 request for comment asked about both: whether logical access controls could be made less burdensome, and whether users had difficulty reporting incidents within one business day.⁴ No study located for this review measures how often practices meet these duties.

5 Certification is of the application, not the practice

Section 1311.120(b) sets 28 numbered requirements for the prescribing application, among them a digital signature over the required information with an archived signed record, refusal to transmit a printed prescription, and an audit trail recording the date, type, actor and outcome of each auditable event. The prescription must be transmitted as soon as possible after signature; its contents must not change in transit, and no intermediary may convert it to facsimile. If delivery fails, the application may print it with a notation of the failed electronic transmission. Pharmacies carry parallel duties, summarized in Table 1.²

The audit, and who it binds

Section 1311.300 places the audit on the application provider, before first use and thereafter whenever controlled-substance functionality changes or every two years, whichever comes first. The auditor must be qualified for SysTrust, WebTrust or SAS 70 audits, or be a Certified Information System Auditor who performs compliance audits regularly; audits of hosted applications must also cover physical security. Certification by an organization whose process DEA has approved is an alternative. The provider must make the report available to any practitioner or pharmacy using the application; if it finds non-compliance, the application must not be used, users must be told within five business days, and DEA within one business day.²

The practitioner’s part is to read that report before first use.^2,10 Nothing in § 1311.300 examines a practice’s designees, its access list or its handling of the daily report. A claim that a product is “EPCS certified” therefore says one bounded thing: an application was found to meet Part 1311 as of a date that lapses on a relevant change or after two years. Whether a practice operates it as the rule requires, no certificate answers.

6 The mandates came from Medicare and the states

Medicare Part D

Section 2003(a) of the SUPPORT Act amended the Part D statute at 42 U.S.C. § 1395w-104(e)(7): a Part D prescription for a Schedule II–V controlled substance must be transmitted electronically, for drugs prescribed on or after January 1, 2021. The statute leaves waivers, including waivers of up to one year for hardship or technological limits, and penalties to rulemaking, and says plan sponsors and pharmacists need not verify that a prescriber holds a waiver.¹³

Under 42 C.F.R. § 423.160(a)(5), a prescriber must prescribe at least 70% of Part D Schedule II–V controlled substance prescriptions electronically. The section’s listed exceptions cover a prescriber who issues 100 or fewer such prescriptions a year, who has an address in a declared emergency or disaster area, or who holds a CMS-approved waiver for circumstances beyond the prescriber’s control.¹⁴ The threshold and the 2023 start of compliance actions came from the CY 2022 physician fee schedule rule.¹⁵ Prescriptions for residents of long-term care facilities are excluded until January 1, 2028, a date the CY 2025 rule moved from January 1, 2025.^14,16

The action CMS has specified is a notice. From measurement year 2023 a non-compliant prescriber receives a notice of non-compliance; CMS adds that final non-compliance may be considered in its fraud, waste and abuse processes, which in some instances could lead to referral to law enforcement or revocation of billing privileges where evidence of fraud, waste or abuse is present. Waiver applications are taken from mid-September to mid-November after the measurement year.¹⁷ The CMS program page, last modified September 16, 2026, reports no program changes for measurement year 2026,¹⁸ and the CMS fact sheet on the CY 2027 proposed rule, issued July 14, 2026, does not mention the program.¹⁹

Tennessee

Tennessee’s mandate is broader. Public Chapter 883 of 2018 added T.C.A. § 63-1-160 and required electronic prescribing of Schedule II drugs from January 1, 2020.²⁰ As amended in 2019, § 63-1-160(c) requires every Schedule II, III, IV or V prescription issued on or after January 1, 2021 to be sent electronically from prescriber to pharmacy, with no percentage threshold and no payer limit. The statute defines an electronic prescription as one transmitted in accordance with 21 C.F.R. Part 1311, so satisfying Tennessee requires satisfying DEA.²¹

Subsection (d) lists eleven exceptions, including technological or electrical failure as set out in rule, dispensing by an out-of-state pharmacy, a prescriber who is also the dispenser, elements current NCPDP standards cannot carry, research protocols, a renewable waiver from the commissioner of health of up to one year, circumstances where the prescriber reasonably judges that the patient could not obtain an electronically prescribed drug in time and that the delay would adversely affect the patient’s condition, and prescribers who issue 50 or fewer Schedule II prescriptions a year.²¹ A pharmacist need not verify that a paper, oral or faxed prescription falls within an exception, a point the Board of Pharmacy repeated in 2021 while noting that the pharmacist remains responsible for every other aspect of validity.^21,22 The commissioner refers violators to their licensing board, and § 63-1-134 authorizes civil penalties of up to $1,000 per violation, each day counted separately.^21,23 DEA’s guidance states that more stringent state requirements supersede its own.¹⁰

For a Tennessee practice the layers stack: the state rule reaches every controlled prescription, the Medicare rule measures Part D prescriptions against a 70% floor, and both depend on a prescription DEA’s rule would accept as validly signed.

7 What the evidence shows the mandates do

On adoption, Surescripts, an e-prescribing network operator and an interested party, reports that 84.4% of e-prescribers and 98.3% of pharmacies are EPCS-enabled, and that 323.2 million electronic controlled substance prescriptions were filled in 2025. The figures reach this paper at second hand, from a Surescripts web page citing its 2025 report, and the denominator is prescribers already e-prescribing.²⁴ The peer-reviewed series is older: the population-weighted share of opioids prescribed electronically was 27% in 2018, 69.4% in states with mandates and 23.6% in states without.³

The strongest effect study is national: Everson and colleagues followed all states and the District of Columbia from 2010 to 2018 in fixed-effects models with policy and demographic covariates.³ Opioid prescriptions fell from 78 to 53 per 100 persons between 2013 and 2018, but a 10 percentage-point increase in EPCS use was associated with an additional 2 prescriptions per 100 persons (95% CI 1.3 to 2.8) and a 0.8% increase in morphine milligram equivalents (95% CI 0.06% to 1.5%): small, and opposite in direction to the mandates’ purpose. The authors concluded that EPCS alone may be insufficient.

The positive findings come from New York and narrower designs. Using Medicare Part D prescriber data for 2014 to 2017, Pylypchuk and colleagues found that opioid prescriptions per prescriber fell by 5.7 per year in the first year of the I-STOP mandate, more for short-acting opioids.²⁵ That mandate, in force from March 27, 2016, covered non-controlled prescriptions too,²⁶ so it tests e-prescribing as much as EPCS. In one emergency department, the number of patients receiving an opioid prescription fell from 1,366 across 22,221 visits in April to July 2015 to 642 across 22,405 visits in the same months of 2016, a 53% fall in an uncontrolled before-and-after comparison.²⁷

Two studies complicate the picture. Across 24,296 visits to 316 emergency departments in the 2016 to 2017 National Hospital Ambulatory Medical Care Survey, EPCS was not associated with less Schedule II prescribing, and in pain-related visits it was associated with higher odds of any controlled substance prescription (OR 1.31; 95% CI 1.08 to 1.59).²⁸ A 2026 county-level quasi-experimental study covering 2010 to 2020 found that a neighboring state’s mandate was associated with a 7.56% increase in opioid dispensing in adjacent counties without one, on average, consistent with displacement; its abstract describes the mandates’ direct effect as positive but gives no figure for it.²⁹

That EPCS prevents forged prescriptions is plausible by mechanism, since a signed record that cannot be altered or faxed onward is harder to counterfeit than a pad. The evidence is thinnest here. DEA’s own 2010 summary said only that the regulations “have the potential to reduce prescription forgery”.¹ The 2026 study names forgery as a rationale and measures dispensing.²⁹ No study located for this review measured forged or fraudulent controlled substance prescriptions before and after an EPCS mandate.

8 What the signature proves, and what would settle the rest

An EPCS record establishes four things well. Identity: the credential was issued after proofing. Presence: two factors were used at the moment of signing. Intent: the contents and an attestation that authentication is a legal signature were on screen. Integrity: the signed contents were digitally signed, archived, and could not be altered without cancelling the prescription. DEA wrote the authentication requirement to ensure, as far as possible, that a practitioner cannot repudiate the prescription.¹

It does not establish legitimacy. A controlled substance prescription is effective only if issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice; responsibility lies with the prescriber, and a corresponding responsibility with the pharmacist who fills it.³⁰ Part 1311 states that nothing in the subpart relieves a practitioner of that responsibility.² The 2010 preamble is blunter: identity proofing will not prevent a registrant from issuing invalid prescriptions or letting a staff member issue prescriptions in the registrant’s name, and is not intended to; its purpose is to limit, as far as possible, the ability of non-registrants to obtain a credential and prescribe in a practitioner’s name.¹ Evidence that a prescription was appropriate lives elsewhere: in the history, the examination, the monitoring-database query and the plan.

Properties that follow

1. The signed record is preserved as signed, apart from later edits, so what was signed has one answer.
2. Access control is a two-person event with its own history. Who may sign, who granted and approved it, and when it was revoked are records in their own right.
3. The daily incident report has an owner. A report generated every calendar day is a control only if a named person dispositions it in time to meet the one-business-day reporting window.
4. A valid signature does not read as clinical clearance. A green EPCS indicator beside a prescription invites an inference the rule does not support; evidence of appropriateness belongs beside the signature, labeled as a separate thing.

Three developments would settle what is open. A DEA proposed or final rule under RIN 1117-AA61 would say whether the identity, cryptographic and biometric references move to current NIST publications. A before-and-after study of forged or fraudulent controlled prescriptions, using pharmacy or enforcement data, would test the mechanism the mandates are defended on. An evaluation that separates EPCS from co-occurring policies and measures harm rather than volume would say whether the mandate does anything clinical. Until then an EPCS signature is a strong answer to who signed and what they signed, and no answer to whether they should have.