Electronic prescribing of controlled substances (EPCS) is governed by one federal rule and measured by one federal program, and most of the confusion comes from mixing the two. The DEA rule, 21 CFR Part 1311, says what a prescriber and a software application must do for an electronic controlled-substance prescription to be valid. The CMS EPCS Program says how much of your Medicare Part D controlled-substance prescribing must be electronic. State law adds a third layer that varies by state.

This checklist separates the three, explains what each one requires of you as a prescriber, shows what EPCS costs on standalone platforms as of September 2026, and lists the setup steps that most often stall onboarding.

Is EPCS required?

Under DEA rules, no. DEA's regulations permit electronic prescribing of controlled substances but do not mandate it. Practitioners may still issue paper prescriptions with a manual signature, and pharmacies may decline to accept electronic ones (DEA Diversion Control Division, EPCS Q&A).

Under the CMS EPCS Program, effectively yes for most Medicare Part D prescribers. Authorized by Section 2003 of the SUPPORT Act, the program requires prescribers to e-prescribe at least 70% of their qualifying Schedule II–V controlled-substance prescriptions for patients covered under Medicare Part D and Medicare Advantage prescription drug plans in each measurement year (January 1 to December 31). Three exceptions apply:

• Small prescriber exception, granted automatically to prescribers who issue 100 or fewer qualifying Part D controlled-substance prescriptions in the year.
• Declared disaster exception, granted automatically in CMS-identified emergency areas.
• CMS-approved waiver, for prescribers who apply during the fall window and show circumstances beyond their control.

CMS calculates compliance from Part D claims starting in August after the measurement year, and sends non-compliance notices in September. The program does not impose a direct fine. CMS states that non-compliance may be considered in its fraud, waste, and abuse processes, which in some instances could lead to referral or revocation of billing privileges. Prescriptions for beneficiaries in long-term care facilities will not count toward compliance before January 1, 2028 (CMS EPCS Program page, updated June 26, 2026; CMS Getting Started Quick Reference Guide v9.0, January 2026).

Under state law, it depends where you practice. Many states require electronic prescribing for controlled substances or for all prescriptions, with their own exceptions, waivers, and effective dates. CMS notes that its program is separate from state requirements. Check your state board of pharmacy or medical board rather than a vendor roundup, since roundups age quickly.

The practical reading: if you write more than about 100 controlled-substance prescriptions a year for Medicare Part D patients, or practice in a state with a mandate, you need EPCS.

What DEA requires of you, the prescriber

Four things, and none of them is optional.

1. A DEA registration. EPCS does not change who may prescribe controlled substances. You need an active DEA registration and, where your state requires it, a state controlled-substance registration.

2. Identity proofing. Before you can be issued an authentication credential for EPCS, your identity must be verified by an approved credential service provider or certification authority. The rule, 21 CFR 1311.105, requires identity proofing at NIST SP 800-63-1 Assurance Level 3 or higher, which corresponds to Identity Assurance Level 2 (IAL2) under the current NIST 800-63-3 framework. Remote identity proofing is permitted (21 CFR 1311.105; DEA EPCS Q&A). In practice this means submitting a government ID and other verification through the vendor's identity provider, and the credential being issued through two separate channels.

3. Two-factor authentication at signing. To sign a controlled-substance prescription, the application must require two of three factors: something you know (a password or challenge response), something you have (a hard token separate from the computer, meeting at least FIPS 140-2 Security Level 1), or something you are (a biometric meeting DEA's standards). An authenticator app on a phone is a common "something you have." The credential is yours alone; you may not share it, and prescriptions signed with it are your responsibility (21 CFR 1311.115).

4. Affirmative review and signing of each prescription. Staff may prepare a controlled-substance prescription, but the prescriber must review the required information and indicate that it is ready to be signed, then sign it with two-factor authentication. Responsibility for the prescription rests with the prescriber, exactly as with paper (DEA EPCS Q&A).

What DEA requires of the software

You do not have to audit the software yourself, but you should know what to ask for.

Under 21 CFR 1311.300, an electronic prescription application must pass a third-party audit or a DEA-approved certification before it processes controlled-substance prescriptions, and again whenever controlled-substance functionality changes or every two years, whichever comes first. The application provider must make the audit or certification report available to any practitioner who uses or is considering the application (21 CFR 1311.300). Drummond Group is one certification body that tests applications against 21 CFR Part 1311, with recertification on a two-year cycle (Drummond Group).

Two questions to ask any vendor: "Which body certified your EPCS functionality, and when?" and "Can you send me the current certification report?" A vendor that cannot produce the report is telling you something.

Setup checklist

Work through these in order. Most take minutes; the ones that take days are flagged.

Confirm your DEA registration is active and matches the name and address you will use for identity proofing. A mismatch between your DEA record, your government ID, and your NPPES record is the most common reason identity proofing fails.

Check state requirements. Some states require a separate controlled-substance registration, a PDMP account, or state-specific EPCS steps. CMS's own guide reminds prescribers to check state law.

Update your contact information in NPPES and PECOS. CMS uses these records to apply automatic exceptions and to send non-compliance notices. Stale addresses mean missed notices (CMS Quick Reference Guide v9.0).

Choose a certified application and request the certification report. See the questions above.

Complete identity proofing. Have your government ID ready. Timing varies from same-day to more than a week depending on the vendor's identity provider.

Set up two-factor authentication. Install the authenticator app or enroll the biometric or token the vendor uses. Do this on the device you will actually prescribe from.

Configure access controls if you have staff. If staff will prepare prescriptions, set their roles so that only you can sign.

Send a test prescription to a pharmacy that has agreed to receive one, or use the vendor's test pharmacy, and confirm the pharmacy sees it as a controlled-substance prescription.

Optionally, create a HARP account so you can view your CMS EPCS Program compliance status on the CMS EPCS Prescriber Portal each fall and submit a waiver if you ever need one.

Common onboarding problems

The platform is desktop-only for EPCS. Some vendors, including eNavvi, offer EPCS only on desktop while non-controlled prescribing works on mobile. If you prescribe controlled substances from a phone today, plan for that.

Identity proofing fails on a name or address. Use the exact legal name on your ID and make your DEA and NPPES records consistent before you start.

The two-factor device is not where you are. Choose a second factor that travels with you. A hard token left at the office blocks signing at home.

Multi-state prescribers. Confirm the platform supports EPCS in every state where you hold a DEA registration, and that the pharmacy you are sending to accepts EPCS. eNavvi's FAQ states EPCS is available in every state on its platform.

Expecting the software to satisfy CMS for you. The application meets DEA's technical rule. Meeting the CMS 70% threshold is about how you prescribe, not which tool you use. No vendor can enroll you in or exempt you from the CMS program.

Where eNavvi fits

eNavvi is a standalone e-prescribing platform whose non-controlled prescribing is free. Its EPCS plan costs $20 per month or $200 per year per prescriber after a one-month free trial, cancel anytime, and requires an active Core account. According to eNavvi's pricing page and FAQ, the EPCS plan is Drummond-certified for Schedules II–V, uses IAL2 identity verification (included with Core) plus Microsoft Authenticator for two-factor authentication, transmits over the Surescripts network, is available in every state, and is desktop only. Credential verification typically takes about two hours during business hours, and EPCS multi-factor setup adds up to ten minutes. eNavvi requires a DEA registration for EPCS and supports MD, DO, DMD, DDS, DPM, NP, DNP, and PA prescribers.

For a specialty-focused discussion of running EPCS without buying an EHR, see EPCS Without the EHR: A Guide for Small Dental and Psychiatric Practices.

Questions prescribers ask about EPCS

Do I need a hard token? Not necessarily. DEA requires two of three factors. A password plus an authenticator app on a separate device, or a password plus a compliant biometric, satisfies the rule. A hard token is one option, not a requirement.

If I write fewer than 100 controlled-substance prescriptions a year for Part D patients, can I skip EPCS? The CMS small prescriber exception is automatic at 100 or fewer qualifying prescriptions. State law may still require EPCS, and pharmacies increasingly prefer it. Check your state before deciding.

Does EPCS certification expire? Under 21 CFR 1311.300, the application must be re-audited or recertified at least every two years, or sooner when controlled-substance functionality changes. Ask for the date of the vendor's current report.

Can my nurse or assistant send controlled-substance prescriptions for me? Staff may prepare a prescription, but the prescriber must review it, indicate it is ready to sign, and sign it with their own two-factor credential. Sharing the credential is prohibited.

Next step

If you want to see how a standalone EPCS setup compares to your current option, eNavvi's pricing page lists the EPCS plan at $20 per month with the first month free. You can register for the free Core plan at enavvi.com and add EPCS from your account.