10+ Years Later: Our Thoughts on Refining the EPCS IFR

By Tony Schueth, CEO & Managing Partner

In the fast-paced world of health IT, seldom does anything “last” more than a few years. Yet the Drug Enforcement Administration’s (DEA) Interim Final Rule with Comment (IFR) on Electronic Prescribing for Controlled Substances (EPCS) has remained in force for the last decade. Recently, however, the DEA reopened comments to give the industry chance to provide feedback on the March 31, 2010 IFR “in anticipation of subsequently publishing a final rule.”

The DEA’s April 21 document is aimed at revisiting some requirements of the original IFR in light of changes in technology and the healthcare landscape, which have occurred since the original IFR was issued in 2010. Comments are due by close of business on June 22, 2020.

Point-of-Care Partners (POCP) has been deeply involved in EPCS for the past 14 years. We have testified frequently on related standards and technology issues before the National Committee on Vital and Health Statistics (NCVHS), as well as provided technical assistance to both the Centers for Medicare and Medicaid Services (CMS) and the Office of the National Coordinator for Health Information Technology (ONC). In fact, POCP testified on the need for EPCS at NCVHS’s hearings in 2006, which helped inform the development of the DEA’s original IFR.

We applaud the DEA for revisiting its EPCS requirements. Since there is no timeline for potentially issuing a final EPCS, we urge the DEA to reopen the IFR comment period in five years to assess and subsequently adopt new technologies that will support the agency’s core mission and the changing needs of healthcare with regard to EPCS. A ten-year window for revisiting EPCS is untenable in light of rapid developments that are occurring in technologies and the delivery of healthcare.

POCP submitted a detailed comment letter, which is available here. The following is a summary of our comments. They fall into four categories: 1) Synchronization of requirements by the federal and state governments; 2) provider authentication; 3) approval of additional transactions; and 4) looking ahead to the post-COVID-19 era.

1. Synchronizing EPCS Requirements by the Federal and State Governments. Federal and state regulations concerning EPCS are a patchwork, which have served as a barrier to adoption. However, things are changing, and adoption will be trending upward due to two factors. States are ramping up EPCS requirements in light of the opioid epidemic as a means to deter fraud and diversion. According to POCP’s Regulatory Resource Center, a dozen states have some kind of EPCS mandate in place today and another 18 have passed EPCS mandates scheduled to go into effect between July 1, 2020 and January 1, 2022. In addition, all controlled substance prescriptions for Medicare Part D beneficiaries must be transmitted electronically beginning on January 1, 2021, including those for controlled substances. These events heighten the need for synchronization of EPCS requirements.

In addition, the patchwork of federal and state requirements concerning EPCS creates confusion in the market and leaves the door open to possible unintended diversion opportunities. Consistency is needed to ensure the most secure and efficient use of resources by law enforcement and the healthcare system.

• We urge the DEA to mandate a base-level utilization of EPCS nationally while enabling states to retain the ability to impose more stringent requirements. Doing so will eliminate the need for providers and technology vendors to support multiple workflows for controlled substance prescribing and better promote the safe and effective transmission of controlled substance prescriptions. In addition, patients would understand that controlled substances must be prescribed electronically in all states, regardless of whether they have Medicare coverage.

2. Prescriber authentication. The DEA’s prescriber authentication requirements require a separate EHR workflow for EPCS from legend medications. Two separate workflows are viewed as burdensome by many prescribers. They also cause the prescriber to bear additional costs in order to comply. These, individually and cumulatively, have served as barriers to adoption.

As suggested in the April 21 Federal Register document, there are possible technology updates that would be compliant and more in sync with today’s prescribing workflows. In particular are those authentication modalities that could be used with the prescriber’s smart phone. Use of a smart phone in care delivery is becoming increasingly important and various mobile applications have burst into the healthcare mainstream in response to changing business needs and legislation, including the 21^st Century Cures Act.

Prescribers increasingly are using their smart phones and tablets to prescribe medications. This is true in the office and with the accelerated use of telemedicine in response to the COVID-19 crisis. (Experts believe telehealth will remain as a key diagnostic and treatment modality even after the crisis subsides.) Most telehealth platforms encompass both audio and video. It is important to note that many desktop computers do not have those capabilities. As a result, providers use their smartphones and tablets for the video visit, which are subsequently used for prescribing. With the COVID-19 crisis, video visits typically occur outside the physician’s office. The DEA’s original authentication and log-in requirements are not user-friendly and fall outside of these out-of-office workflows.

• We recommend the DEA work in conjunction with federal and state agencies as well as the electronic prescribing industry to simplify prescriber authentication in order to reduce burden on prescribers and continue to protect the health and safety of the American public through secure and compliant controlled substance prescribing.
• We urge the DEA to approve new means of prescriber authentication compatible with smart-phone and tablet prescribing. These include the use of SMS messaging, Bluetooth and near-field communication (NFC). The latter is an advanced technology for an easy-to-use and secure multifactor authentication. While these authentication methods are not a seamless part of the EHR electronic prescribing process today, they are much less onerous and considerably more user-friendly than the DEA’s currently approved authentication methods.
• We recommend that the DEA review and modify the onboarding process. The current process for set up of a prescriber to receive credentials for EPCS is particularly onerous and costly. The credentialing, the logical access control and token and/or biometric set-up is a challenge. For telehealth prescribers, logical access control is not feasible as these prescribers typically do not have staff who can verify their identities. Essentially, they must resort to friends or family for this step.

3. Approval of other transactions. There are three transactions (described below) that are not considered to be legal by the DEA as part of the EPCS process. This situation continues to create opportunities for diversion and abuse because the prescription must “drop back to paper” when these transactions cannot be performed electronically. Putting “paper in the hands of patients” and/or faxing heightens the risk of fraud and abuse by creating the opportunity for a patient and/or others to alter quantities or number of refills or view a physician’s DEA number. In addition, this back-and-forth and rework is costly and time consuming for physicians and pharmacies, which runs counter to the Administration’s desire to eliminate burden, fraud and abuse.

We recommend the DEA approve the following transactions for use in EPCS:

Electronic Refill request/response. Electronic Refill authorization requests for controlled substances are a frequent occurrence. This issue has become particularly acute because of the quantity limits on controlled substance prescriptions that many states have put in place to fight the opioid epidemic.

Allowing EPCS for refill requests would accomplish several things. First, make it easier for prescribers to leverage EHR-enabled state PDMPs, or prescription drug monitoring programs. Second, not being able to authorize an EPCS renewal request electronically moves the process of managing these prescriptions outside of the prescriber’s EHR workflow, back to paper and faxes. Vital drug allergy and drug interaction checking features of the EHR cannot take place if the renewal request is on paper, putting patient safety at risk. Moreover, the number and frequency of refill requests (or lack of a refill request) could indicate that the patient is not taking a medication, or not taking it correctly. Such medication nonadherence costs the healthcare system some $290 billion annually.

Prescription transfers (or forwarding). Many times, a pharmacy receives an electronic prescription for a controlled substance and cannot fill it because the medication is not in stock or the patient decides to use a different pharmacy. Instead of being able to forward the prescription electronically to another pharmacy, the patient either must go back or contact the prescriber and obtain a new prescription or the pharmacy must spend time on the phone seeking authorization for a transfer. This places administrative burden on the pharmacy, prescriber, and patient, as well as opens the door to diversion by providing a paper prescription.

Resends. Electronically transmitted prescriptions occasionally don’t go through to the pharmacy and need to be resent. If a prescription transmission fails, the prescriber now has to handwrite a new prescription and notate that the original failed. This process can be a real issue for many patients, especially on weekends when the pharmacy cannot get in touch with the prescriber. It also transfers the burden on the pharmacy, prescriber, and patient, as well as opens the door to diversion by providing a paper prescription.

4. Looking ahead to the Post COVID-19 environment. The novel coronavirus and its related health impacts (COVID-19) changed the way we diagnose and treat disease. This includes how and where drugs are prescribed, such as telehealth or virtual visits. The DEA as well as some states have facilitated the process by temporarily relaxing restrictions related to prescribing. These include the need for multi-state licensure and the definition of a patient-prescriber relationship, which under DEA regulations must be in place before a prescription is issued. While we cannot predict how long the COVID-19 pandemic will be in effect, its changes in how healthcare is delivered will not be going away. We must be preparing now for the future and not be caught shorthanded.

• We recommend the DEA monitor its regulations related to prescribing and make plans for making permanent the temporarily relaxed restrictions that have proved effective and analyze additional regulations that might be proved unnecessary with the experience gained during the COVID-19 crisis.
• We recommend the DEA permanently allow prescribing via telehealth and permanently keep in place related relaxed restrictions.
• We recommend the DEA allow electronic prescriptions as a replacement for a print prescription when an emergency oral prescription is required. Requiring a provider to mail a prescription provides opportunities for fraud and diversion. A notation on the electronic prescription would suffice and move the industry forward with technology solutions.

POCP continues to monitor progress with EPCS and stay involved in related technological and regulatory issues. We’d be happy to provide more information as well as help your organization develop a comment letter. Reach out to me at tonys@pocp.com.