E-Prescribing for Controlled Substances: Will It Work?

Aaron Gilson, PhD, MSSW


March 14, 2011

In This Article

Requirements for E-Prescribing

Practitioners must fulfill a number of conditions before being permitted to issue e-prescriptions for controlled substances. In addition to using an electronic application that complies with regulatory requirements, identity proofing (with government-issued photographic identification) is mandated. To sign an e-prescription, practitioners must obtain a 2-factor authentication credential, selected from 3 potential factors: (1) password or response to a challenging question; (2) biometric data such as a fingerprint or iris scan; or (3) hard token, such as a cryptographic key. Computer-based access controls must be implemented, including the use of 2 people to sign an e-prescription -- one who verifies that the practitioner is authorized to sign, and the authorized signer who uses the 2-factor authentication credential.

Before signing, the prescribing practitioner must indicate which controlled substance prescriptions are ready to be signed for a single patient and review and approve the prescription information (eg, date of issuance, patient's full name, drug name, dosage strength and form of medication, quantity prescribed, etc.). When this is done, the practitioner will be prompted to begin the 2-factor authentication protocol. Practitioners will see a prescription review screen containing a statement that the use of the 2-factor credential is the legal equivalent of a signature.[2] Once signed, the prescription is ready for transmission to the pharmacy.

This is a necessarily oversimplified synthesis of the fundamental regulatory provisions governing e-prescribing, to enhance the basic awareness of the requirements and expectations for prescribing practitioners. A full description of regulatory intricacies is found in the March 31, 2010 Federal Register, and the DEA offers answers to common questions about essential elements of these requirements on their Web page, Office of Diversion Control.


Comments on Medscape are moderated and should be professional in tone and on topic. You must declare any conflicts of interest related to your comments and responses. Please see our Commenting Guide for further information. We reserve the right to remove posts at our sole discretion.