Common Overlooked Steps and Key Considerations to Enabling e-Prescribing of Controlled Substances

• Project Scope—Organizations should complete an audit of all the orders providers are currently processing, which can be eye-opening. For example, one organization’s audit revealed that it averaged about 7,500 orders per doctor, per month. Reports indicate that about 11 percent of prescriptions are for controlled substances (although some customers tell us it is as high as 18 percent in their organizations). For this particular customer, that conservatively equates to more than 800 controlled substance orders per doctor, per month. In addition, in October 2013, the Food & Drug Administration (FDA) stated that it plans to recommend to the Department of Health and Human Services that hydrocodone-based medication like Vicodin should be reclassified from a Schedule III to a Schedule II drug. When moving to EPCS, these two factors will likely have a huge impact on the right mix of two-factor authentication modalities as well as the backend infrastructure used to handle it.

   
• FIPS Compliant Fingerprint Readers—Many organizations are already using fingerprint biometrics for logins and/or second-factor authentication. Unfortunately, many of these fingerprint readers were deployed before the DEA’s final EPCS rule, which mandates that readers for EPCS be FIPS 201 compliant. Most fingerprint readers deployed before mid-2012 are probably not FIPS-201 compliant and cannot be used for EPCS transactions. Similarly, until very recently, the fingerprint readers that are built into most laptops are also not FIPS 201 compliant. When considering EPCS, organizations should identify if their fingerprint biometric readers meet DEA requirements and if not, implement a plan for deploying readers that are allowed for EPCS.
• Other Authentication Modalities—In addition to fingerprint biometrics, the DEA allows specific types of tokens as an accepted means of second-factor authentication for EPCS. Any one time password (OTP) delivered as a token must be secure (which, for the most part, excludes options like SMS text or phone calls). What’s more, providers may need to carry a separate token for each disparate organization where they will e-Prescribe controlled substances. This has the potential to be confusing and cumbersome for providers who practice in several different healthcare organizations, which is something that should be considered when developing an EPCS plan.
• Enrollment—A significant portion of the DEA rule for EPCS is devoted identity proofing. Many organizations we speak with interpret this to mean that they will need specific credentialing offices or individuals who will physically check the identification of the provider, verify their DEA number and then supervise the enrollment of the fingerprint or token. If using fingerprint biometrics, however, enrollment must be done on a FIPS 201 compliant reader. So, if an organization is already using fingerprint authentication on an older, non-FIPS compliant reader, their providers will need to be re-enrolled to be authorized for EPCS.
• Back-end Infrastructure–After an organization completes the audit recommended above, it must evaluate whether its back-end infrastructure can handle the volume of e-Prescription transactions. For example, if choosing an authentication modality that requires a certificate authority (CAs), the server which manages CAs must be equipped to handle the added load. In the case noted previously, the customer realized it would average seven transactions per second.

These are just a few of the overlooked items and misperceptions some organizations have when developing their plans for secure e-Prescribing, especially for controlled substances. In the coming weeks we’ll dive deeper into these and other topics to provide insight, tips and best practices on how to navigate the requirements for EPCS and start realizing the benefits. If there are any specific topics you are interested in, please leave a comment here and we’ll be sure to address it.