Two bills in U.S. Congress this year are expected to boost e-prescriptions. This article explains the complexities that makes it so hard to implement electronic prescribing for controlled substances (EPCS), summarizes the intended impacts of the bills, and introduces Imprivata digital identity technology, which has been used in health care for such purposes for many years.
Calling the Cops
Health care advocates and reformers can show off plenty of war stories and wounds just from dealing with regulations and bureaucracies in health care. When it comes to controlled substances, toss in the Drug Enforcement Administration (DEA) for extra suspense. State governments are also roped in thanks to their Prescription Drug Monitoring Programs (PDMPs).
Drug abuse is clearly a leading social problem, and prescriptions notoriously play a large part. Opiate pain killers are not the only culprits: Medications for ADHD and other conditions can also be abused. I estimate more than 550 medications on the DEA’s controlled substance list.
The mechanisms of abuse, potential or alleged, are also multi-faceted: advertising that minimized drugs’ dangers, deliberate pill mills, doctor shopping (sometimes across state lines to avoid triggering detection), and doctors who inadvertently overprescribe because they’re poorly educated or too busy to investigate more appropriate treatments. Hence the multitude of federal and state oversight mechanisms to prevent abuse.
Dr. Sean Kelly, chief medical officer and SVP of customer strategy for healthcare at Imprivata, lays out the procedures required for prescribing a controlled substance:
- A medical setting is authorized by the DEA to issue prescriptions, and designates trusted administrators to authorize clinicians in turn.
- Each clinician is registered to prescribe controlled substances. This requires an in-person meeting between the administrator and clinician, where the clinician provides an ID.
- Traditionally, the DEA required patients to meet in person with the clinician before that clinician can issue a controlled substance prescription. This requirement was relaxed by DEA and HHS early in the COVID-19 shutdown, but the old restrictions are set to return at the end of the 2024.
- Traditionally, the doctor has given a paper prescription to the patient, who delivers it to the pharmacy. Electronic prescribing makes the process easier for patients and clinician and allows better monitoring.
- When prescriptions for controlled substances are filled, they are reported by the pharmacy to the state’s PDMP. Records are checked by prescribers and pharmacies to ensure that patients are not receiving duplicative therapies, which are potentially harmful.
Various analytics can also be performed during and afterward to see which doctors are doing a suspicious amount of prescribing.
History of EPCS
Kyle Zebley, head of public policy American Telemedicine Association (ATA), says that Congress called on the DEA to implement a policy for a special controlled substance registration process in 2008. This requirement languished for the past 15 years, probably because the DEA had a multitude of competing priorities.
In September 2023, according to Zebley, “ATA Action submitted comprehensive recommendations to the DEA to create a Special Registration process that would work in conjunction with the existing registration process. One recommendation was to include a modifier or ‘stamp’ (e.g., ‘T’ for telemedicine) to the prescriber’s DEA number, indicating a special telemedicine registration.” Telehealth leader Joe Kvedar, MD, notes in a recent blog posting, “A valid prescription is a valid prescription, and the fact that one was issued via telemedicine makes it no less so. If the DEA maintains the proposed ‘stamp’ on prescriptions indicating they were issued via telemedicine, this should serve as a marker of legitimacy, not a red flag. The ‘T’ modifier on a prescriber’s registration number should specify to pharmacists that the telehealth provider has undergone Special Registration, validating the prescription regardless of geographic location.”
I can understand the recalcitrance of the DEA. The complex dance listed in the previous section of this article required formalization of a lot of processes. How can a pharmacist verify electronically that a prescription came from a doctor who was legitimately registered by a legitimate health care provider? How do you transmit the prescription to the pharmacy and record it in the PDMP? Later in this article, we’ll look at some solutions from Imprivata.
According to Dr. Colin Banas, chief medical officer at DrFirst, they initiated EPCS in 2010, partnering with the Massachusetts Department of Health. This experiment became the basis for a federal bill 12 years ago allowing EPCS nationally.
Pooja Babbrah, who is currrently the practice lead for pharmacy and PBM services at Point-of-Care Partners, worked at DrFirst when they launched EPCS. The health care field did not adopt it easily or smoothly. She recalls the company being on the phone constantly with pharmacists who worried that the electronic prescriptions didn’t fulfill DEA requirements and that the pharmacists could be the ones prosecuted for violations.
She singles out New York as the first state to require that all prescriptions for controlled substances be sent electronically. That is now the law in 35 states, with minimal exceptions for particular circumstances. Banas says that these laws vary a great deal, often covering only a subset of controlled substances.
Kelly says that a federal bill in 2021 required EPCS for Medicare prescriptions. Just as one large state (such as California or Texas) can create a mandate that leads companies to implement a change in all states, a mandate for EPCS in Medicare has led providers to adopt platforms that allow EPCS for everyone.
Finally, in 2023, CMS said that 70% of Medicare and Medicaid patients have to receive their controlled substances through EPCS, but there is currently no penalty for providers who don’t comply, just a letter notifying the prescriber of non-compliance.
Two Proposed Bills
The lagging DEA could finally be prodded into action, according to Zebley, by a single-sentence clause (section 210) in a bill introduced by Senator Bernie Sanders. The new bill reiterates previous Congressional interventions on this topic. The DEA has allowed EPCS during a telehelath visit since the beginning of the COVID-19 public health emergency. Section 210 requires them to formalize a process for EPCS, because otherwise it will be unavailable once the waiver expires at the end of the year.
Another bill, the EPCS 2.0 Act, addresses the issues more directly. This bill was introduced by a Senator and Representative from New Hampshire. Babbrah says that the law requires EPCS throughout the country and standardizes its use, such as by formalizing the use of the National Council for Prescription Drug Programs (NCPDP) standard for data exchange.
Technological Support for EPCS
The processes described earlier are quite cumbersome in the absence of technical support. Imprivata, a Massachusetts firm specializing in digital identities, was in on EPCS from quite early on. Kelly describes its support as an “auditable chain of trust,” starting from credentialing and going through transmission to the pharmacy. The system uses two-factor authentication: a password plus one of the systems I’ll describe in a moment.
Regulations still require an in-person meeting between an administrator and the clinician being registered. Imprivata allows the physician to provide a variety of ways that they can be identified when prescribing a medication. For instance, the physician can provide a fingerprint. Later, the fingerprint will be read by a secure, accurate device attached to the computer where the clinician is entering the prescription. (The fingerprint readers on garden-variety cell phones aren’t secure or accurate enough.)
Alternatively, the physician can load software on a standard mobile device to generate one-time tokens, and submit these when entering a prescription. Yet another form of identification is a badge, which can be read by a badge reader attached to the computer for what Imprivata calls “No Click Access” (Figure 1).
Integration with the EHR and electronic prescribing networks, such as Surescripts, allows prescriptions to be transmitted seamlessly to the pharmacy. These integrations also alleviate some of the burden of the pharmacy filling these prescriptions, because many fields in the data entry process are autopopulated.
In general, electronic prescriptions have been a singular area of success in digital healthcare. Somehow, the various actors have solved the problems of security with convenience, interoperable data exchange, and near-universal access that the rest of the health care system still stumbles over. In the critical, dual need to provide people with symptomatic relief while preventing life-threatening abuses, it’s good to see progress in the digital space.
