© 1st American Systems and Services LLC

All rights reserved.

NIST NCPDP Analysis –

Electronic Prescribing of Controlled Substances using SCRIPT

August 31, 2011

Prepared by 1st American Systems and Services LLC

for 

National Institute of Standards and Technology

1

st American Systems and Services LLC
© 1st American Systems and Services LLC Page 2 of 6 Electronic Prescribing of Controlled Substances using SCRIPT

www.1asas.com

1st American Systems and Services LLC

469 Township Road 1535

Proctorville, OH 45669 

www.1asas.com

Authors

Laura Topor 

ltopormn@msn.com

Frank McKinney

fm@frankmckinney.com
© 1st American Systems and Services LLC Page 3 of 6 Electronic Prescribing of Controlled Substances using SCRIPT

www.1asas.com

Contents

A. Introduction.........................................................................................................................................4

B. Background..........................................................................................................................................4

C. The EPCS Interim Final Rule..................................................................................................................4

D. AHRQ Pilot...........................................................................................................................................6

E. Remaining Challenges..........................................................................................................................6
© 1st American Systems and Services LLC Page 4 of 6 Electronic Prescribing of Controlled Substances using SCRIPT

www.1asas.com

A. Introduction

The goal of this document is to provide a high-level overview of the prescribing of controlled substances 

using NCPDP SCRIPT, including remaining industry challenges with regard to the SCRIPT standard or other 

factors including security.

Document sections:

Background. Background of events supporting electronic controlled substance prescribing.

The EPCS Interim Rule. Overview of the DEA interim rule on electronic prescribing of controlled 

substances.

AHRQ Pilot. Overview of the findings of an AHRQ-led pilot of electronic controlled substance 

prescribing.

Remaining Challenges. Other challenges to adoption of electronic controlled substance prescribing.

B. Background

The adoption of electronic prescribing has been somewhat hindered due to the unique challenges 

surrounding controlled substances. The DEA is focused on preventing diversion and counterfeit of these 

medications and has published an interim final rule (IFR) that will allow the electronic prescribing of 

controlled substances (EPCS). The IFR was effective June 10, 2010 and according to the DEA Office of 

Diversion Control: 

“The rule revises DEA regulations to provide practitioners with the option of writing prescriptions for 

controlled substances electronically. The regulations also permit pharmacies to receive, dispense, and 

archive these electronic prescriptions. These regulations are an addition to, not a replacement of, the 

existing rules. The regulations provide pharmacies, hospitals, and practitioners with the ability to use 

modern technology for controlled substance prescriptions while maintaining the closed system of controls on 

controlled substances.”

The industry is working towards ways of implementing EPCS in compliance with the IFR while waiting for the 

final rule. According to the DEA’s office of diversion control, as of December 2007 (the latest year data is 

available) controlled substances represented approximately 11% of all prescriptions and 90% of prescribers 

write prescriptions for controlled substances.

C. The EPCS Interim Final Rule

The IFR does allow practitioners to sign and transmit prescriptions for controlled substances electronically. 

It also allows for pharmacies to receive, dispense and archive electronic prescriptions. This is a voluntary 

program that include schedule II-V controlled substances and does not replace written, manually signed or 

oral prescriptions for controlled substances. Both versions of NCPDP SCRIPT (8.1 and 10.6) that are allowed 

for use under MMA support the requirements of the IFR.
© 1st American Systems and Services LLC Page 5 of 6 Electronic Prescribing of Controlled Substances using SCRIPT

www.1asas.com

The IFR addresses DEA Security Safeguards which includes Identify Proofing, Access Control, Two Factor 

Authentication, Secure Network and Digital Signature. 

Identity Proofing is specifically for prescribers and is most likely done by a third party. It is a way for 

the user to prove that they are who they say they are. It can be done remotely, or face-to-face. 

Once complete, the prescriber receives a credential that authenticates each electronic prescription 

for a controlled substance. It also enables two-factor authentication for each prescription written.

Access Control applies to prescribers and pharmacists. It is designed to ensure that only designated 

individuals manage software permissions and that appropriate prescribers and pharmacy staff only 

use the application for EPCS.

Two Factor Authentication is used to prove that the prescriber is authorized to digitally sign an EPCS. 

The two factors include a combination of: 

 Something you have (hard token)

 Something you know (password, PIN)

 Something you are (biometric)

This is one of the key burdens as prescribers are somewhat resistant to carrying yet another device, 

such as a token, and not all mobile technologies can support biometrics. One care system has found 

a way for the prescriber’s mobile device to also function as a token, so that prescribers can respond 

to patient care needs regardless of their physical location.

A Secure Network is provided by an aggregator (i.e. Emdeon eRxNetwork or Surescripts). The IFR 

allows for two options for securely transmitting an authenticated EPCS. One option is end-to-end PKI 

which is digitally signed with the prescriber’s digital certificate. The pharmacy is required to verify 

the signature using the prescriber’s public key. The second option is the inclusion of a flag on the 

EPCS that designates the prescription has been sent by a DEA registrant using two-factor 

authentication. The pharmacy or last intermediary must digitally sign the transaction.

Digital Signatures require that the prescription be signed at its origin. If cryptokeys are being used, 

the prescription must be signed with the user’s digital signature. If using two-factor authentication 

other than cryptokey, then the prescription must be signed with the vendor’s digital signature, which 

proves that two-factor authentication was used. If the prescription is being sent including the flag 

designating two-factor authentication, then the prescription must be signed at the pharmacy, either 

by the pharmacy or the last intermediary.

While the industry is still waiting for a final rule from the DEA, it is important to consider any state-specific 

restrictions. State laws must allow for EPCS; according to a presentation given by Rick Sage, Vice President 

of Clinical Services at Emdeon during the 2011 NCPDP Annual Conference, 18 states currently do not permit 

EPCS. 
© 1st American Systems and Services LLC Page 6 of 6 Electronic Prescribing of Controlled Substances using SCRIPT

www.1asas.com

D. AHRQ Pilot

In a presentation also given at the 2011 NCPDP Annual Conference, Stephen J. Kelleher, Jr., MHA, FACHE of 

the MA Department of Public Health Drug Control Program gave an update on the AHRQ pilot program 

Enabling E-Prescribing and Enhanced Management of Controlled Medications. A number of entities were 

involved with this pilot, including:

 MA Department of Public Health, Drug Control Program

 DrFirst, Inc., Rockville, MD

 Emdeon eRxNetwork, Fort Worth, TX

 Brandeis University, Heller School for Social Policy and Management

 Berkshire Health Systems, Inc.

 U. S. Department of Justice, Drug Enforcement Administration

The scope of the pilot was two-fold. First was to encourage the expansion, adoption and diffusion of eprescribing, to improve medication management by ambulatory care clinicians at the point-of-care. The 

second was to test and demonstrate the safety, security, quality and effectiveness of electronic transmission 

of prescriptions for federally controlled medications in the ambulatory care setting.

Among the key observations from the pilot was that having a significant number of pharmacies in a given 

area prepared to accept EPCS increased provider adoption. The study also showed that providers using EPCS 

had high operational satisfaction, improved EHR accessibility and productivity. 

E. Remaining Challenges

In addition to the technical challenges associated with adoption of EPCS, implementers face increased 

auditing and administrative requirements included in the interim final rule. How to meet these requirements, 

however, is not well understood by all. Given the DEA’s emphasis on management and audit related to 

controlled substances, the American Institute of Certified Public Accountants (AICPA) is developing audit 

guidelines. In addition, the DEA is expected to publish guidelines related to certification organizations. 

Finally, the publication of a Final Rule is critical in increasing adoption of EPCS. Without this, the industry will 

be hesitant to move forward with a costly implementation. There is much work that needs to be done, 

including programming for provider and pharmacy systems, deployment of additional technologies to 

support two-factor authentication, intermediary certification, engagement of auditing firms, education of all 

stakeholders, and modification of state laws.