The following highlights the IFR’s key requirements for controlled substance e-prescribing regarding physicians:
· Option of e-prescribing controlled substances as of June 1, 2010, if they comply with specific requirements, as described below
· Must first undergo a verification process (either in person or remotely) in order to receive authorization to e prescribe controlled substances
· Set access controls in their office practice prior to e-prescribing controlled substances
· Must use a two-factor credential to e-prescribe controlled substances
· Can use their own digital certificate to sign e-prescriptions for controlled substances
· Are not required to review their prescription logs
· Must comply with notification requirements if they lose their hard token or if they discover that their security controls have been compromised
· Must use a compliant e-prescribing application in order to e-prescribe controlled
substances
Identity proofing and access controls
Authentication must occur by a third party to verify the physician. They must apply to certain federally approved credential service providers (CSPs) or certification authorities (CA). Logical access controls can be user or role-based. Access control must be handled by at least two people registered with the DEA within a practice. An institutional practitioner (eg. hospital) can conduct identity proofing in-house as part of their credentialing process.
Two-factor authentication
The DEA is allowing the use of a biometric as a substitute for a hard token or a password.
Public key infrastructure (PKI) and digital certificates
The IFR allows a physician to use his or her own digital certificate to sign e-prescriptions for controlled substances.
Signature and transmission requirements
Only the physician may sign the prescription. Signing and transmission does not need to occur at the same time. The e-prescribing application will apply a digital signature to and archive the controlled substance prescription information when the physician completes the two-factor authentication protocol. Some physicians may sign the prescription before office staff add pharmacy and insurance information.
Monthly e-prescribing logs
The IFR requires that the e-prescribing application automatically provide the physician with a monthly log of the physician’s controlled substance e-prescriptions and provide it on request. A physician can specify a time period for log review for a minimum of to two years and display a patent’s drugs or general drugs. This is a tool to help monitor and detect fraud or inappropriate activity.
Two year record keeping requirement
The IFR requires records related to controlled substance e-prescriptions to be retained for two years from the date of their creation or receipt.
E-prescribing controlled substances is an option
E-prescribing a controlled substances is an addition to written and oral prescriptions for controlled substances. Existing e-prescription applications and electronic health record systems that do not comply with the IFR rules can still use the old standards by using paper records.
