TRANXACT.AI Help

Let a prescriber sign controlled-substance prescriptions (EPCS)

A controlled substance is signed only by the prescriber, with two factors, after two other people have approved their EPCS permission.

The DEA rules for electronic prescriptions for controlled substances (21 CFR Part 1311) require logical access control set by two individuals, two-factor authentication at signing, and an audit trail. This product enforces all three.

  1. On the prescriber's provider record, enter the DEA number, the schedules it covers and its expiry, and link their sign-in (User).
  2. The prescriber sets up an authenticator app under their account's two-step verification.
  3. Open EHR > E-Prescribing > EPCS Permissions and press Request a permission.
  4. Two different people approve it. Neither may be the prescriber, and at least one must be a DEA registrant (a provider with a DEA number).
  5. The prescriber can now sign: password again plus the authenticator code, every time.

Production EPCS also requires identity proofing of each prescriber to NIST IAL2 by a credential service provider, a signing credential on FIPS 140-2 certified hardware, and a third-party audit or certification of the application. This product signs every message with a company key sealed in the database; that is not a substitute for certification.