Identity proofing
Identity proofing is the process of verifying that a person is who they claim to be to a defined assurance level — required for prescribers under EPCS and increasingly standard for patients in telehealth programs.
- NIST IAL2 is the assurance level EPCS effectively requires
- Prescriber proofing gates two-factor signing credentials
- Patient IDV: document check plus liveness, scaled to risk
- Verification rigor trades directly against conversion
Prescriber identity proofing (the EPCS requirement)
DEA rules require prescribers to be identity-proofed to federal assurance standards — in NIST terms, Identity Assurance Level 2 (IAL2) — before receiving the two-factor credentials that sign controlled-substance prescriptions. In practice that means verified government ID plus corroborating evidence, performed by an approved credential service provider or institutional process, with the credential bound to the verified identity. It is a one-time gate per prescriber, redone when credentials change.
Patient identity verification
On the patient side, programs verify identity to prevent fraud, meet state telehealth requirements, and satisfy pharmacy and controlled-substance rules: typically photo-ID capture with automated document checks and a liveness selfie at intake. The design tension mirrors the intake itself — every verification step costs conversion, so programs scale rigor to risk: light verification for routine categories, full IDV where controlled substances or state rules demand it.
Compliance handled, so you can build
Lithos runs the clinicians, pharmacies, and 50-state rules behind your care program — one API.
Frequently asked questions
What is IAL2?
NIST’s Identity Assurance Level 2 — identity verified against strong evidence like a government ID with corroboration, the standard federal processes reference for remote proofing.
Do all telehealth patients need identity verification?
Requirements vary by state and drug class. Controlled-substance programs verify; routine categories often use lighter checks scaled to fraud risk.
Who performs prescriber identity proofing?
Approved credential service providers or qualifying institutional processes, as part of EPCS enrollment — the platform typically orchestrates it.