DEA EPCS
DEA Electronic Prescriptions for Controlled Substances (21 CFR Part 1311, Subpart C)
DEA's EPCS rules let practitioners issue Schedule II to V controlled substance prescriptions electronically, but only through prescribing and pharmacy applications that meet 21 CFR Part 1311. The interim final rule (75 FR 16236) was published on March 31, 2010 and took effect on June 1, 2010. It is one of the few U.S. rules that prescribes identity proofing and authentication in detail: practitioners must be identity proofed to NIST SP 800-63-1 Assurance Level 3 (or by an institutional credentialing office), sign each prescription with two of three factors where any hard token is a separate FIPS 140-2 Level 1 device, and get signing rights only through a two-person logical access control process. Applications need a third-party audit or certification before use and at least every two years.
Who it applies to
DEA-registered practitioners (and exempt practitioners at institutions) who prescribe controlled substances electronically, institutional practitioners such as hospitals, pharmacies that process electronic controlled substance prescriptions, and the providers of electronic prescription and pharmacy applications.
Identity requirements
- Obtain a two-factor authentication credential from a credential service provider approved by GSA to identity proof at Assurance Level 3 or above under NIST SP 800-63-1, or a digital certificate from a certification authority cross-certified with the Federal Bridge at basic assurance or above; the credential must be issued over two channels (21 CFR 1311.105)
- Institutional practitioners may identity proof their own prescribers through the office that grants privileges, checking government photo ID and current State and DEA authorizations, and must keep records of the proofing (1311.110)
- Authenticate to sign using two of three factors: something only the practitioner knows, a biometric, or a hard token separate from the computer that meets FIPS 140-2 Security Level 1 (1311.115)
- Biometric factors must operate at a false match rate of 0.001 or lower and protect biometric data sent over open networks against replay (1311.116)
- Designate at least two individuals to manage access control, at least one of them a DEA registrant with a two-factor credential; after one enters a grant or revocation of signing rights, a second, who must be a DEA registrant, approves it with their two-factor credential (1311.125 for individual practitioners; 1311.130 sets a parallel process for institutional practitioners)
- Revoke signing rights on the day a hard token or other factor is lost, stolen or compromised, a DEA registration expires or is revoked, or the practitioner is no longer authorized to use the application (1311.125(d))
- Keep an audit trail of prescription actions and of every change to logical access control permissions, analyze it at least once every calendar day, and keep records for two years (1311.120 and 1311.150)
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Identity verification (KYC/proofing) | Remote or institutional identity proofing to a defined assurance level is a precondition for signing, making EPCS a rare U.S. rule that mandates proofing before credential issuance. |
| Authentication & MFA | Two-factor authentication is required for each signing event, with hard tokens separate from the workstation and biometrics held to a 0.001 false match rate. |
| Identity governance (IGA) | Signing permissions require two-person approval and must be revoked the same day a factor is compromised or a registration lapses. |
| Audit, logging & accountability | Applications must log every grant and change of signing permissions, analyze the audit trail daily, and pass third-party audits at least every two years. |
Penalties
A practitioner who does not notify the designated access managers within one business day that a factor was lost, stolen or compromised may be held responsible for prescriptions written with that credential (21 CFR 1311.102(b)). Practitioners keep the same responsibilities for electronic prescriptions as for paper or oral ones, and if the application provider reports that an audit found the application non-compliant, the practitioner must immediately stop issuing electronic controlled substance prescriptions with it (1311.102(g)).
Status and dates last verified against primary sources on 2026-11-05.
DEA EPCS: frequently asked questions
- What authentication does DEA require for EPCS?
- Two of three factors: something only the practitioner knows (such as a password), a biometric, or a hard token separate from the computer being used. A hard token must meet FIPS 140-2 Security Level 1, and a biometric subsystem must operate at a false match rate of 0.001 or lower (21 CFR 1311.115 and 1311.116).
- What identity proofing does EPCS require?
- Individual practitioners must get their credential from a GSA-approved credential service provider that proofs at Assurance Level 3 or above under NIST SP 800-63-1, or from a certification authority cross-certified with the Federal Bridge. Institutional practitioners such as hospitals may proof prescribers through their credentialing office instead (21 CFR 1311.105 and 1311.110).
- How often must an EPCS application be audited?
- The application provider needs a third-party audit or certification before the application is used for controlled substance prescriptions, and again whenever functionality related to those requirements changes or every two years, whichever comes first (21 CFR 1311.300).