Controlled substances: Progress in technology and e-prescribing

Requirements for vendors

In order for a physician electronic health record application vendor or pharmacy practice management application vendor to be able to connect its users to an electronic prescribing network, it must first comply with technical requirements set forth by the DEA's IFR. Thereafter, the vendor must:

Qualified providers

Several companies are recognized by the DEA in its EPCS IFR as being qualified to perform Part 1311 EPCS audits: SysTrust, WebTrust, SAS 70, and/or certified information system auditors. In addition, the DEA recently specifically approved InfoGard Laboratories as another company capable of conducting Part 1311 EPCS audits. Other companies may become available as well in the future.

To date, several physician or pharmacy application vendors have completed the process of becoming certified and audited to connect to an electronic prescribing network for EPCS purposes.

Transactions to date

At present, only a small number of EPCS transactions have been transmitted in those states in which this is currently allowed. Although the DEA has promulgated its IFR, many states still need to align their laws and regulations in order for EPCS transactions to occur.

To date, prescribers registered in eight states have issued DEA-compliant EPCS transactions: California, District of Columbia, Massachusetts, Maryland, Michigan, Texas, Virginia, and Washington. Although electronic prescribing networks such as Surescripts provide services in all fifty states and DC, nationwide deployment of EPCS can only occur once both the state and federal laws are aligned in all jurisdictions.

Additional requirements

Vendors are cautioned that in several instances, electronic prescribing networks provide that additional requirements must be met before these pathways can be used to facilitate EPCS. For example, vendors may need to prove that they have completed their Part 1311 EPCS audits as required by the DEA before being activated for EPCS transactions. Additionally, pharmacy directories in prescriber applications are required to indicate which pharmacies are enabled to receive EPCS, and prescribers are able to send EPCS only to those pharmacies, and vice versa.

Finally, in those instances in which an EPCS transaction crosses state lines, both the transmitting prescriber and the receiving pharmacy should be in compliance with both the DEA's EPCS IFR and the controlled substance laws and regulations of the state in which the prescriber or pharmacy is located.

This article is not intended as legal advice and should not be used as such. When legal questions arise, pharmacists should consult with attorneys familiar with the relevant drug and pharmacy laws.

Ned Milenkovich is a member at McDonald Hopkins, LLC, and chairs its drug and pharmacy practice group. He is also Vice-Chairman of the Illinois State Board of Pharmacy. Contact Ned at 312-642-1480 or at nmilenkovich@mcdonaldhopkins.com
.