DEA EPCS Rules: Identity Proofing and Two Factor for E-Prescribing

A US practitioner can only sign an electronic prescription for a controlled substance after identity proofing and two-factor authentication that meet DEA's rules in 21 CFR Part 1311, and an application that misses them produces prescriptions that are not valid. The DEA rules for Electronic Prescriptions for Controlled Substances (EPCS) set out who must be identity proofed and how, which authentication factors count, who may set signing permissions, and what audit trails, third-party audits and records the software must keep. This guide summarises those obligations, explains the current status of the 2010 interim final rule and its relationship with the CMS EPCS Program for Medicare Part D, and turns the text into compliance steps for clinics, hospitals, pharmacies and EHR vendors. It is written for healthcare IAM leads, compliance officers and application providers. For the wider healthcare identity picture see the Healthcare Identity Security Guide.

Key takeaways

• Proofing comes before the credential. Individual practitioners must get credentials from a GSA-approved credential service provider proofing at NIST SP 800-63-1 Assurance Level 3 or above, or from a CA cross-certified with the Federal Bridge; institutions may proof their own practitioners under 21 CFR 1311.110.
• Two of three factors, with rules on each. Signing needs two of knowledge, biometric and a hard token separate from the computer; a hard token must meet at least FIPS 140-2 Security Level 1 and a biometric must have a false match rate of 0.001 or lower.
• Two people set access. Logical access controls for signing must be set by two individuals, one of them a registrant with a two-factor credential for individual practitioners.
• The software is audited, not just the user. Applications need daily audit trail analysis, incident reporting to DEA within one business day, and a third-party audit or certification before use and at least every two years.
• Watch for a final rule. The rules were issued as an interim final rule in 2010. DEA reopened comment in April 2020, including on NIST SP 800-63-3, "in anticipation of subsequently publishing a final rule". The eCFR text checked on 8 November 2026 still cites SP 800-63-1 and shows no changes to subpart C since 3 January 2017.

Scope: who and what is covered

21 CFR Part 1311, subpart C covers electronic prescriptions for Schedule II to V controlled substances. Electronic prescribing is permitted, not required, by DEA: it supplements paper and oral prescriptions. The obligations fall on four groups.

A practitioner must be registered with DEA or exempt and authorised to dispense, and must use an application that meets the rule. Under 1311.100, a prescription created with a non-compliant application is not a valid prescription.

Key obligations

Identity proofing

• Individual practitioners (1311.105): credentials from a credential service provider approved by GSA to proof at Assurance Level 3 or above under NIST SP 800-63-1, or from a certification authority cross-certified with the Federal Bridge CA. The credential is delivered through two separate channels.
• Institutional practitioners (1311.110): an entity within the institution, such as the credentialing office, can proof practitioners eligible to use the institution's application. It verifies a photo ID, state licensure, DEA registration or institutional authorisation, and VA appointment status where relevant, and keeps records.

DEA's 2020 notice explained that under NIST SP 800-63-3 the equivalent level is Identity Assurance Level 2 and asked for comment on remote proofing, including video review of identification. That was a request for comment, not a rule change. For the current NIST levels see the NIST SP 800-63A-4 Identity Proofing (IAL) Guide.

Two-factor authentication

The practitioner must keep sole possession of the token and must report a lost, stolen or compromised token or authentication protocol to the designated individuals within one business day of discovery (1311.102). For cryptographic module validation see the FIPS 140-3 and Cryptographic Module Validation Guide; the regulation names FIPS 140-2, so confirm with your certifying body how FIPS 140-3 validated modules are assessed.

Logical access control and signing

• Two-person access setting (1311.125, 1311.130): each registered location designates at least two individuals to manage access, one a registrant with a two-factor credential. Institutions have separate personnel enter and approve permissions.
• Revocation triggers: compromised token, DEA registration lapse or revocation, or the practitioner leaving.
• Who signs (1311.135, 1311.140): agents may enter prescription data, but only the registrant may sign. The practitioner reviews the prescriptions for one patient, marks them ready, sees a legal signing statement, and completes two-factor authentication, which counts as signing.
• Application signature (1311.120): the application digitally signs and archives the record using FIPS-validated cryptographic modules, with time stamps from a clock within five minutes of NIST time.
• Private key signing (1311.145): a practitioner with a digital certificate may sign with their own private key after two-factor authentication; the application still signs and archives.
• Transmission (1311.170): send as soon as possible after signing, with no alteration in transit and no conversion to fax by an intermediary.

Audit and records

• Internal audit trail (1311.150, 1311.215): providers define auditable events such as unauthorised access attempts, changes to access controls and interference with the audit trail; the application analyses the trail daily. Security incidents are reported to the provider and DEA within one business day.
• Third-party audit or certification (1311.300): before use, and again whenever controlled substance functionality changes or every two years, whichever comes first. DEA's provider Q&A says the auditor may be a person qualified to conduct WebTrust, SysTrust or SAS 70 audits, a Certified Information System Auditor doing compliance audits as a regular business activity, or a certification organisation whose certification DEA has approved, and the audit must address processing integrity.
• Provider notices (1311.302): users must be notified within five business days of a discovered non-compliance and must install required updates before resuming use.
• Retention (1311.305): records kept electronically for at least two years, readable, retrievable and available to DEA.

Timeline and current status

As checked on 8 November 2026, the eCFR shows Part 1311 still referencing NIST SP 800-63-1 and FIPS 140-2, and DEA's 2020 notice said a final rule would follow review of comments. Treat any update as pending until it appears in the Federal Register. State EPCS mandates are separate and vary by state; check your state board of pharmacy.

Enforcement and penalties

• Invalid prescriptions: under 1311.100, a prescription created with an application that does not meet Part 1311 is not valid, and pharmacies may only process electronic controlled substance prescriptions with a compliant pharmacy application.
• Application withdrawal: under 1311.300 a non-compliant application must not be used for controlled substances, and registrants must be notified within five business days.
• Unsigned prescriptions: practitioners must notify the designated individuals and DEA within one business day if prescriptions were issued that they did not sign (1311.102).
• CMS EPCS Program: prescribers must e-prescribe at least 70% of qualifying Part D Schedule II to V prescriptions. CMS sends non-compliance notices, and non-compliance may be considered in fraud, waste and abuse assessments, which in some cases could lead to referral to law enforcement or revocation of billing privileges where evidence of fraud, waste or abuse exists. Exceptions cover small prescribers (100 or fewer qualifying prescriptions), declared disasters and approved waivers.

Separate HIPAA Security Rule obligations apply to the same systems; see the HIPAA Security Rule Guide.

What it means for AI agents and non-human identities

Part 1311 is written around a human registrant, and that shapes how automation can be used.

• Agents can draft, not sign: 1311.135 lets agents of the registrant enter prescription data, but only the registrant may sign, and signing is the act of completing two-factor authentication. An AI assistant or scribe can prepare a draft; it must never hold or replay the practitioner's factors.
• No shared or automated tokens: sole possession of the hard token (1311.102) rules out token sharing, stored OTP seeds in automation and any "auto-sign" design.
• The application signing key is an NHI: the application's FIPS-validated signing key and the certificates used by pharmacies to verify records are machine identities. Inventory them, protect them in HSMs and track expiry and revocation. See the Enterprise PKI Design and CA Hierarchy Guide.
• Integration accounts: interface engines and intermediaries that route prescriptions must not alter them (1311.170). Give their service accounts least privilege and log their activity.
• Audit trail integrity: interference with the audit trail is an auditable event. Protect log pipelines and the service accounts that write to them.

Compliance steps

1. Confirm the application is certified. Obtain the current third-party audit or certification report from your EHR and pharmacy software providers and diary the two-year renewal.
2. Choose the proofing route. Individual practitioners use an approved credential service provider; institutions decide whether credentialing staff will proof internally under 1311.110 and write the procedure.
3. Select factors. Pick the two factors per site. Our view at NHI Mgmt Group: prefer a personal hard token plus a knowledge factor for shared clinical workstations, and confirm the specific product, including any phone-based token, with your certifying body.
4. Set up two-person access control. Name at least two access administrators per location, one a registrant, and record every grant and revocation.
5. Connect revocation to HR and licensing. Trigger revocation on departure, DEA registration lapse and token loss. See the Joiner-Mover-Leaver Guide.
6. Review audit reports daily. Assign who reviews the daily audit analysis and how incidents reach the provider and DEA within one business day.
7. Pilot before go-live. Run one department first, test lost-token and departure scenarios, and keep paper prescribing available as the rollback.
8. Track CMS compliance. Check the CMS EPCS Prescriber Portal each September and apply for waivers in the window where needed.

Small practice or large system

A small practice usually relies on its EHR vendor's certified workflow and a credential service provider, and its main work is token custody, two-person access setting and keeping records. A hospital system usually proofs internally, integrates revocation with credentialing and HR, and needs a team reviewing daily audit output across many sites.

Common failure patterns

• One administrator sets access alone: the rule needs two individuals. Configure the application to enforce it.
• Tokens left at the nurses' station: sole possession is a practitioner obligation; train staff and treat sharing as a reportable compromise.
• Revocation lag: departed practitioners keep signing rights because credentialing and IT are not connected.
• Daily audit reports nobody reads: the application analyses the trail, but someone must act on it within the one business day window.
• Weak MFA on surrounding systems: EPCS signing may be strong while remote access to the wider environment is not. The Change Healthcare breach began with a remote access portal without MFA and disrupted pharmacy claims nationwide.

Practitioner checklist

• Hold current third-party audit or certification reports for every EPCS application.
• Document the proofing route for each practitioner group and keep the evidence.
• Confirm hard tokens or authenticator modules meet the FIPS requirement and are issued one per practitioner.
• Enforce two-person setting of signing permissions at every location.
• Link revocation to departure, registration lapse and token loss.
• Assign daily audit review and a one business day incident path to the provider and DEA.
• Keep EPCS records for at least two years, retrievable for DEA.
• Prevent AI assistants and integrations from holding or using practitioner factors.
• Review CMS EPCS compliance each September and state mandates yearly.

Standards and references

• eCFR: 21 CFR Part 1311 Subpart C, Electronic Prescriptions
• Federal Register: Electronic Prescriptions for Controlled Substances, interim final rule (2010)
• Federal Register: Electronic Prescriptions for Controlled Substances, reopening of comment period (2020)
• DEA Diversion Control Division: Questions and Answers for Providers of Electronic Prescriptions for Controlled Substances
• CMS: Electronic Prescribing for Controlled Substances (EPCS) Program
• NIST: SP 800-63A-4 Identity Proofing and Enrollment

Related NHI Mgmt Group resources: Healthcare Identity Security Guide · Phishing-Resistant MFA Guide · NIST SP 800-63A-4 Identity Proofing (IAL) Guide · HIPAA Security Rule Guide. This guide summarises the DEA EPCS rules in 21 CFR Part 1311 and the CMS EPCS Program and is not legal advice.