EPCS Explained: What Telehealth Operators Need to Know About Prescribing Controlled Substances

This distinction matters for telehealth businesses working in areas where controlled substances may be prescribed. A platform may already support electronic prescribing, but standard e-prescribing alone does not automatically satisfy the requirements for electronically prescribing Schedule II through V controlled substances.

For operators, the practical question is not only whether a prescription can be sent electronically. It is whether the people and systems involved can do so under the rules that apply to controlled substances.

What Is EPCS?

EPCS stands for Electronic Prescribing for Controlled Substances. It is the electronic prescribing process used for Schedule II through V controlled substances under requirements established by the Drug Enforcement Administration.

That makes EPCS different from standard e-prescribing.

A provider may already use an electronic system to prescribe non-controlled medications. To electronically prescribe controlled substances, the practitioner and the prescribing application must meet additional requirements, including identity proofing, authentication credentials, access controls, and application compliance.

DEA's current EPCS guidance explains that a practitioner cannot use a noncompliant electronic prescribing or EHR application to sign and transmit controlled-substance prescriptions electronically. Until the application meets DEA requirements, a controlled-substance prescription prepared through such software must follow an allowed alternative process, such as printing for manual signature where permitted.

For a telehealth company, EPCS should therefore be considered part of prescribing infrastructure rather than an optional workflow enhancement. Bask's e-prescribing infrastructure sits within its broader no-code telehealth platform. However, operators supporting controlled-substance care still need to understand the additional federal and state requirements that apply to EPCS.

The distinction can become particularly relevant in care models involving medications such as testosterone, which is a Schedule III controlled substance, as well as certain medications used in ADHD and psychiatric care.

[INSERT URL: existing testosterone therapy / DEA Schedule III article] should be linked here using anchor text related to Bask's existing discussion of Schedule III requirements and telehealth prescribing.

The basic difference can be summarized simply:

EPCS is therefore not another name for e-prescribing. It is a more tightly controlled prescribing workflow.

DEA Requirements for EPCS

The DEA framework does not rely on a single security feature. It establishes requirements around practitioner identity, authentication, authorization, and the electronic prescribing application itself.

For telehealth operators, this means EPCS compliance affects both provider onboarding and the technology used to issue controlled-substance prescriptions.

Identity Proofing and Two-Factor Authentication

Before an individual practitioner can electronically prescribe controlled substances, the practitioner's identity must be verified through the applicable identity-proofing process.

DEA explains that authentication credentials used to sign controlled-substance prescriptions may be issued only after the practitioner's identity has been confirmed. For individual practitioners, the process involves approved credential service providers or certification authorities. DEA permits both in-person and qualifying remote identity proofing.

Identity verification is only the beginning.

When the practitioner signs a controlled-substance prescription electronically, DEA requires two-factor authentication. The authentication process uses two of three factor categories:

• something the practitioner knows;
• something the practitioner has;
• something the practitioner is.

For example, a workflow might combine a password or other knowledge factor with an appropriate hard token. A qualifying biometric can also serve as one of the factors under DEA requirements.

The important operational point is that these credentials belong to the practitioner. DEA states that a practitioner must retain control of applicable authentication factors and cannot allow another person to use them to sign controlled-substance prescriptions.

For a telehealth business with multiple providers, EPCS therefore affects provider activation. Adding a clinician to the network does not automatically mean that clinician is ready to prescribe controlled substances electronically. Providers must complete the required identity, credential, authorization, and system-access steps first.

Certified EPCS Software

The prescribing application must also meet DEA requirements.

DEA explains that practitioners need an audit or certification report showing that an electronic prescribing application meets the applicable requirements before they can use it to sign controlled-substance prescriptions electronically.

The application must also support controls around who is allowed to prescribe controlled substances. DEA requires logical access controls so that only appropriately authorized practitioners can sign these prescriptions. Establishing those permissions involves verification of relevant DEA registration and applicable state authorization, and the access list must be updated when a practitioner's status changes.

That creates an operational responsibility beyond buying software labeled "e-prescribing."

A telehealth business needs to know:

• whether its prescribing application meets applicable DEA EPCS requirements;
• how practitioner identity proofing and authentication are handled;
• how EPCS permissions are granted;
• how provider authorization is verified;
• how access is removed when credentials or authorization change;
• how required records and audit information are maintained.

This is also why general security controls and EPCS requirements should not be treated as interchangeable. Strong platform security supports the broader compliance environment, but EPCS has its own specific requirements.

Bask's verified security controls include SOC 2 Type II controls, MFA, audit logging, HIPAA and LegitScript compliance, and telehealth-certification assistance. Those capabilities support the platform's overall compliance posture. Operators should separately confirm the specific EPCS capabilities and certifications required for their controlled-substance prescribing model.

CMS Mandate and State-Level Requirements

EPCS requirements extend beyond the DEA framework.

The federal SUPPORT Act generally requires Schedule II through V controlled substances prescribed for beneficiaries under Medicare Part D and Medicare Advantage prescription drug plans to be prescribed electronically, subject to the CMS program's rules, exceptions, and waivers.

CMS's current Electronic Prescribing for Controlled Substances Program explains that the program is separate from state EPCS requirements. For measurement year 2026, CMS states that the program requirement remains the same as in 2025. CMS currently considers a covered prescriber compliant when the applicable EPCS compliance rate reaches at least 70%, while defined exceptions can apply in particular circumstances.

CMS also publishes detailed EPCS FAQs covering compliance, exceptions, waivers, and other program questions. The current FAQ makes clear that having a state EPCS requirement does not automatically establish compliance with the separate CMS program.

State rules add another layer.

Many states have electronic prescribing requirements affecting controlled substances, but the details, exemptions, implementation rules, and affected prescriptions can vary. A telehealth business should therefore verify requirements for each state where its providers prescribe, rather than treating EPCS as a single national checklist.

That matters as a business expands. Adding a new state is not simply a marketing or provider-network decision. The prescribing workflow must also meet the federal and state requirements that apply there.

Why EPCS Matters for a Telehealth Business

Controlled-substance prescribing can appear in several telehealth verticals, including testosterone therapy, ADHD treatment, and some areas of psychiatric care.

For an operator, the commercial opportunity does not remove the compliance complexity.

The business needs to understand whether its providers are appropriately authorized, whether the prescribing technology supports the required workflow, how it handles authentication, and how federal and applicable state rules affect the care model.

This makes EPCS an operational issue, not merely a prescriber feature.

Consider a telehealth company expanding a program that may involve controlled substances. Marketing can potentially scale quickly, but controlled-substance prescribing cannot simply be switched on for every provider in the same way as a standard software permission.

The organization may need to account for:

Provider eligibility. Is the practitioner appropriately registered and authorized for the prescribing activity?

EPCS readiness. Has the required identity-proofing and authentication process been completed?

System access. Has appropriate authorization been granted within the prescribing application?

Technology compliance. Does the application meet the applicable DEA requirements?

State requirements. Are there additional rules or exemptions in the patient's state?

CMS requirements. Does the prescribing activity fall within the CMS EPCS Program, and if so, how do its requirements apply?

Treating these as ordinary software settings carries significant risk. DEA makes clear that the prescribing practitioner remains responsible for ensuring a controlled-substance prescription conforms to applicable federal law and regulations, regardless of whether another staff member helped enter information.

For the business, that means compliance processes should support the provider rather than create ambiguity around who is authorized to do what.

Bask's compliance and audit-logging infrastructure includes SOC 2 Type II controls, MFA, audit logging, HIPAA and LegitScript compliance, and telehealth-certification assistance. Those broader controls can support a telehealth organization's compliance environment, while EPCS-specific requirements still need to be evaluated for the controlled-substance workflow being offered.

How Bask Health Supports EPCS Compliance

Every plan includes integrated doctor groups as standard through a shared network model. Enterprise customers can also bring or integrate their own clinical network when they need full ownership of the patient-provider relationship.

From a compliance perspective, Bask's verified platform controls include SOC 2 Type II controls, MFA, audit logging, HIPAA and LegitScript compliance, and telehealth-certification assistance.

For EPCS specifically, operators should confirm that the prescribing workflow they intend to use satisfies all applicable DEA, CMS, and state requirements. General platform MFA and audit logging should not be presented as substitutes for the specific identity-proofing, authentication, access-control, and application requirements established for EPCS.

This distinction matters because compliance isn't achieved by checking a single platform feature.

A telehealth company needs the business model, providers, prescribing workflow, technology, and applicable regulatory requirements to work together.

Bask's telehealth platform plans provide the broader infrastructure for launching and scaling digital care, while you should evaluate the requirements of any controlled-substance program based on the medications, providers, jurisdictions, and prescribing workflows involved.

FAQs

What does EPCS stand for?

EPCS stands for Electronic Prescribing for Controlled Substances. It refers specifically to electronic prescribing of Schedule II through V controlled substances under applicable DEA requirements.

Does law require EPCS?

EPCS is subject to several layers of law and regulation. Federal requirements include the DEA framework for electronic controlled-substance prescriptions and the CMS EPCS Program for qualifying Medicare Part D and MA-PD prescriptions, while state requirements can also apply.

What's the difference between e-prescribing and EPCS?

Standard e-prescribing allows prescriptions to be transmitted electronically. EPCS adds specific requirements for controlled substances, including practitioner identity proofing, two-factor authentication, access controls, and compliant prescribing technology.

Does every state require EPCS?

State requirements vary, including which prescriptions are covered and what exceptions may apply. Telehealth operators should verify the current requirements in every state where their providers prescribe rather than assuming one rule applies nationwide.

What happens if a provider prescribes controlled substances without EPCS certification?

The answer depends on the circumstances and applicable federal and state rules. DEA states that if an electronic prescribing application does not meet its EPCS requirements, it cannot be used to sign and transmit controlled-substance prescriptions electronically under the EPCS framework; other legally permitted prescribing methods may apply. Providers and operators should verify the requirements that apply to their specific prescribing model.

Conclusion

EPCS turns controlled-substance prescribing into more than an electronic transmission step. Provider identity, authentication, authorization, prescribing technology, federal requirements, and state rules must work together before a telehealth business can treat the workflow as operationally ready.

For businesses building or expanding a digital-care model, Bask Health plans provide a starting point for evaluating the clinical, technology, pharmacy, payment, and compliance infrastructure available within the platform.

References

1. Drug Enforcement Administration, Diversion Control Division. (n.d.). Electronic prescriptions for controlled substances (EPCS) Q&A. https://www.deadiversion.usdoj.gov/faq/epcs-faq.html
2. Centers for Medicare & Medicaid Services. (n.d.). Electronic prescribing for controlled substances (EPCS) program. https://www.cms.gov/medicare/e-health/eprescribing/cms-eprescribing-for-controlled-substances-program
3. Centers for Medicare & Medicaid Services. (n.d.). EPCS frequently asked questions. https://www.cms.gov/files/document/epcs-frequently-asked-questions.pdf