Electronic Prescription of Controlled Substances
The DEA has officially lifted the restrictions against the use of elec-tronic prescribing for controlled substances (Schedule II to Schedule V), which have been the single greatest barrier to e-prescribing adoption over the last 10 years. The DEA’s regulations—that officially took effect on June 1, 2010—allow prescribers the option to write prescriptions for controlled substances electronically and allow pharmacies to receive, dispense, and archive these electronic prescriptions. The regulations are an addition to existing rules and will maintain a closed system of controls on controlled substances dispensing. The regulations will reduce paperwork for pharmacies registered by DEA and have the potential to reduce prescription forgery. Additionally, the regulations have the potential to reduce the number of prescription errors and will help integrate prescription records into other medical records.
Controlled substances make up roughly 11% of prescriptions written in the United States and are written by approximately 90% of providers. In the past, the inability to write a controlled drug prescription electronically created the need for a provider to implement two office work-flows: one for electronic prescriptions and one for controlled substances that were hand-signed and hand-delivered. This inconsistency in workflow ultimately defeated the efficiency that electronic prescribing otherwise promised to bring to the practice.
After talks at a 2006 symposium held by the DEA, our company, DrFirst—an ePrescribing company headquartered in Rockville, Maryland—became involved in discussions regarding how to build a safe and measurable way to overcome the security and accountability issues. This meeting, along with funding from the Agency for Healthcare Research and Quality (AHRQ) spawned the Electronic Prescribing of Controlled Substances (EPCS) pilot program. Four years later, on June 3, 2010, in a “landmark” event, the nation’s first public end-to-end electronic controlled substance prescribing system was demonstrated at the 2010 AHRQ Annual Health IT Grantee and Contractor meeting in Washington, DC. This fully operational system was developed in collaboration with the Massachusetts Department of Public Health, Berkshire Health Systems, Inc., eRx Network, and Brandeis University’s Heller School for Social Policy and Management and contains the necessary security features required to operate under a special waiver from the DEA.
The specific aims of the project included:
- developing and verifying an e-prescribing system that would allow safe and secure electronic prescribing of controlled substances (EPCS),
- linking the system with the existing Massachusetts Prescription Moni-toring Program for Schedule II controlled substances,
- conducting evaluations of process and outcomes (including improvements in patient care, risk reduction, patient and clinician benefits, patient safety, and confidentiality), and
- disseminating the project findings.
Features of Approved E-Prescribing System
It is important to note that the focus was on keeping the prescribing process simple and within the providers’ existing work-flow while introducing multiple validation checks, supporting the NCPDP “SCRIPT” standard, meeting DEA requirements, and maintaining the long-standing responsibilities associated with dispensing controlled drugs.
This ground-breaking e-prescribing solution resolves the DEA’s requirement to meet the following criteria:
- Authentication. Positively identify the signer and establish who is sending and receiving all prescription data.
- Non-repudiation. Ensure that parties to an activity cannot reasonably deny having participated in the activity.
- Record Integrity. Establish that prescription data and the corresponding electronic signature have not been altered after the prescription has been signed.
- Legal Sufficiency. Provide litigation strength for prosecution (i.e., the ability to prove participation in the prescribing event beyond a reasonable doubt).
- Signature Verification. Ascertain that an identified signer intended to endorse a written prescription.
- Confidentiality. Ensure that only authorized persons have access to the prescription data.
The study successfully demonstrates the technology and capability to make the process efficient, safe, and secure. Security issues have long clouded the issue of e-prescribing controlled sub-stances. A process was created that not only uses tight security for prescribers using the system, but uses the current trusted network between the e-prescribing or EMR application and the pharmacy. This new system will now allow providers to efficiently adopt an optimal e-prescribing workflow in their offices with a complete e-prescribing solution.
The ECPS system exhibited on June 3rd in Washington, DC, displayed the use of a “crypto key,” paired with a unique password, to provide the necessary two-factor authentication for a provider to transmit a controlled drug electronically. A cryptographic key is a security token designed to be inserted into a computer’s USB port. A crypto key was provided to each physician in the pilot for use each time a controlled drug prescription was written. As with regular prescriptions, the first step in writing for a controlled substance is for a provider to log into DrFirst’s system and prepare the prescription. To transmit the prescription, the provider must insert his crypto key into the computer’s USB port and then enter his “signature” (a special numeric pass-word). Once the key is in place and the signature is verified, the provider may transmit the prescription to a participating pharmacy. The prescription is transmitted through a series of secure networks as it touches servers from DrFirst, the DEA, and the prescribing network before it reaches its final destination—the pharmacy. Using this method of delivery, the system binds each physician to a unique crypto key and each individual prescription to its vendor system. This level of security, coupled with appropriate audit logs, allows detailed reports to be generated and made available to the DEA, pharmacy boards, and local and federal law enforcement authorities.
While e-prescribing of controlled sub-stances is now “legal,” it still is not yet technically “possible” on a national scale. Currently, there is no industry-wide infrastructure available to convey controlled substance prescriptions to pharmacies, nor are pharmacies universally ready to accept them. It is anticipated that the pharmacies will begin accepting elec-tronic prescriptions of controlled-drugs in the late fourth quarter 2010. In addition, the recently released DEA regulations require controlled-drug e-prescriptions to include a “flag” that the prescription was authorized using 2-factor authentication. Currently, the NCPDP “SCRIPT” standard does not contain a field designed to hold that flag.