EPCS
EPCS (Electronic Prescribing for Controlled Substances) is the DEA-regulated framework that allows prescribers to send prescriptions for controlled substances electronically, requiring identity-proofed prescribers, two-factor authentication, and certified prescribing software.
- Governed by DEA rule 21 CFR Part 1311
- Requires identity-proofed prescribers with two-factor credentials
- Both prescriber and pharmacy software must be EPCS-certified
- Mandated federally for Medicare Part D and by most states
What does EPCS require?
The DEA’s EPCS rules (21 CFR Part 1311) set a higher bar than ordinary e-prescribing. The prescriber must complete identity proofing, sign each controlled-substance prescription with two-factor authentication, and use software certified for EPCS by a third-party auditor. The pharmacy system on the receiving end must be certified too, and both sides keep auditable records.
Most states now mandate EPCS for some or all controlled-substance prescriptions, and Medicare Part D requires it federally — so for any program touching controlled substances, EPCS is table stakes, not an option.
Why EPCS matters for telehealth programs
Whether a telehealth program can prescribe controlled substances at all is a separate, state-by-state (and DEA) question — but when it can, EPCS is how the prescription must move. Testosterone (Schedule III) is the common case in DTC health: a TRT program is a controlled-substance program, which means identity-proofed prescribers, certified software, and state-specific telehealth prescribing rules from day one.
Building EPCS yourself means certification audits and DEA compliance workflows; this is one of the strongest arguments for running prescribing on infrastructure that already has it.
What standing up EPCS actually involves
For the prescriber: identity proofing to federal assurance standards, two-factor credentials (typically an authenticator app or hardware token), and enrollment in software that has passed a third-party EPCS certification audit. For the platform: access controls, signing workflows, and audit records that match 21 CFR Part 1311 — re-examined whenever the software materially changes.
This is why EPCS capability is a meaningful diligence question when choosing infrastructure: it is not a feature toggle, it is a certified stack plus enrolled, identity-proofed clinicians. If TRT or any controlled-substance vertical is on your roadmap, confirm the whole chain exists before committing to launch timelines.
Compliance handled, so you can build
Lithos runs the clinicians, pharmacies, and 50-state rules behind your care program — one API.
Frequently asked questions
Is EPCS mandatory?
Federally for Medicare Part D prescriptions, and most states mandate it broadly for controlled substances. Practically, any controlled-substance program should assume EPCS is required.
What is identity proofing in EPCS?
A verification process confirming the prescriber is who they claim to be before two-factor credentials are issued — required by DEA rule before a prescriber can sign controlled-substance prescriptions electronically.
Can telehealth prescribe controlled substances?
It depends on the substance, the state, and current DEA telemedicine rules. Where permitted, the prescription itself must flow through EPCS-certified systems.