Telehealth Prescribing & HIPAA: E-Prescribing Compliance

Master EPCS requirements, controlled substance rules, identity verification, and secure transmission for compliant telehealth prescribing

Quick Answer

Can I prescribe controlled substances via telehealth?

Yes, but with strict requirements. You must: (1) Use EPCS (Electronic Prescriptions for Controlled Substances) software certified by DEA, (2) Complete proper identity verification using two-factor authentication or video identification, (3) Follow DEA regulations including proper licensing and state requirements, (4) Maintain detailed records of each controlled substance prescription, (5) Establish prior in-person relationship or use state-approved telehealth modalities, (6) Ensure HIPAA-compliant secure transmission, and (7) Follow state-specific restrictions. Non-controlled substances can use standard e-prescribing if transmitted securely.

Overview of Telehealth Prescribing Requirements

Two Categories of Prescribing

Telehealth prescribing is divided into two regulatory frameworks:

Non-Controlled Substances

Prescribed medications that are not DEA Schedule I-V. These follow standard e-prescribing rules. Requirements: (1) Use HIPAA-compliant e-prescribing platform, (2) Transmit securely with encryption, (3) Maintain audit logs, (4) Follow state-specific e-prescribing regulations, (5) Verify patient identity appropriately. Standard state telehealth regulations apply.

Controlled Substances

DEA Schedule II-V medications. These require additional compliance: (1) DEA certification and registration, (2) EPCS (Electronic Prescriptions for Controlled Substances) software, (3) Two-factor authentication or video identity verification, (4) Detailed record-keeping, (5) Prior patient relationship (with exceptions), (6) State-specific approval, (7) Enhanced security standards. Federal and state regulations are strict.

EPCS Certification and DEA Requirements

What is EPCS?

EPCS is the only legal method for electronically prescribing controlled substances. The DEA requires:

Software must be DEA-certified as compliant with 21 CFR Part 1311
Software must authenticate the prescriber through two-factor authentication
Prescriptions must include specific security elements
Audit logs must track all EPCS activity
Software must encrypt data in transit and at rest

Provider Registration Requirements

To prescribe controlled substances via telehealth:

You must have active DEA registration
You must notify DEA of intention to use EPCS
You must complete Form DEA-106 (Application for Registration of EPCS Practitioner)
You must have state medical license
You must comply with state medical board regulations
Check state requirements—some states require additional application/approval

DEA-Certified EPCS Vendors

Your EPCS software must be DEA-certified. Common vendors include:

Major EHR platforms (Epic, Cerner, NextGen, Athena)
Specialized pharmacy partners
Telehealth platforms with integrated EPCS
Check DEA's list of approved EPCS vendors

Identity Verification for Controlled Substances

Two-Factor Authentication Methods

DEA requires strong identity verification to ensure the correct patient receives the prescription:

Knowledge-based: Questions only patient should know (security questions, medical history)
Possession-based: Something patient has (OTP device, text message code, authentication app)
Biometric: Fingerprint, facial recognition, or voice recognition
Multi-factor requirement: Most DEA guidance recommends two of these methods

Video Identity Verification

Alternative to two-factor: live video with proper identity verification

Provider must visually confirm patient identity
Can use government-issued ID verification
Must be during the telehealth session
Creates stronger documented verification
Some states prefer or require video verification

Prior Patient Relationship Exception

Telehealth prescribing of controlled substances generally requires prior in-person relationship, except:

Established patients (within 12 months) can refill controlled substances via telehealth
Some states allow exception for addiction treatment (methadone, buprenorphine)
Post-surgical pain management may have limited exceptions
Always verify your state's specific rules

State-Specific Telehealth Prescribing Rules

Controlled Substance Variability

States have different rules for controlled substance prescribing:

More Permissive States

Some states allow controlled substance prescribing for new patients via telehealth if proper identity verification and evaluation occur. Examples: Colorado, Massachusetts, Tennessee. Requirements may include specific platform standards or specialist consultation.

Restrictive States

Some states require in-person visit before any telehealth prescribing of controlled substances. Examples include states requiring initial in-person evaluation. Check your state medical board's specific telehealth prescribing policy.

Special Categories

Addiction treatment: Many states allow telehealth prescribing of buprenorphine/methadone with specific requirements
Mental health: Stimulants may have different rules than opioids
Pain management: Often strictly limited to established patients
Emergency situations: Some states allow emergency controlled substance prescriptions

Secure E-Prescribing and Transmission

HIPAA Security Requirements

All electronic prescriptions must comply with HIPAA standards:

Encryption: Prescriptions in transit must use TLS 1.2 or higher
Authentication: Verify identity of prescriber and pharmacy
Audit logs: Track all prescription activity
Access controls: Only authorized personnel can view/transmit
Storage: Encrypt prescription records at rest

E-Prescription Standards

NCPDP format: Required standard for prescription transmission
Pharmacy verification: Confirm pharmacy license and identity
Tamper prevention: No alterations after transmission
Signature verification: Digital signatures for controlled substances

Paper Prescriptions (Fallback)

If e-prescribing fails:

Can provide signed paper prescription during visit (if patient present)
Can read prescription verbally for patient to pick up at pharmacy
Controlled substances require DEA-required written prescription handling
Document reason for non-electronic transmission

Documentation and Record-Keeping

Required Documentation

For each telehealth prescription, maintain:

Date and time of prescription
Patient identification method used
Name of prescribing provider
Medication name, strength, quantity, directions
Patient medical history relevant to prescription
Clinical indication/reason for prescription
Any identity verification method used
Copy of prescription transmitted
For controlled substances: confirmation of prior relationship or exception used

Retention Requirements

Maintain prescription records for minimum 3 years
Keep audit logs for all electronic transactions
Some states require longer retention
DEA may audit controlled substance records
Ensure secure, encrypted storage

Refill Authorizations

Only authorized prescribers can authorize refills
Patient must request refill through proper channels
Prescriber must review before authorizing
Pharmacy verifies authorization before dispensing
Document refill authorizations in medical record

Telehealth Prescribing Compliance Checklist

Verify state telehealth prescribing regulations

For controlled substances: obtain DEA EPCS certification

Implement DEA-certified EPCS software

Set up two-factor authentication or video verification

Establish prior patient relationship verification process

Verify HIPAA-compliant e-prescribing platform

Implement encryption for prescription transmission

Set up audit logging for all prescriptions

Train staff on prescribing requirements and compliance

Document all prescribing activities comprehensively

Ensure Your Telehealth Prescribing Complies with DEA and HIPAA

Get expert guidance on implementing secure, compliant e-prescribing systems. Our assessment includes review of your EPCS implementation, identity verification, and data security.

Start Your Assessment

Frequently Asked Questions

Can I use my EHR's e-prescribing to send controlled substance prescriptions?

Only if your EHR's e-prescribing module is DEA-certified for EPCS (Electronic Prescriptions for Controlled Substances). Standard e-prescribing, even in certified EHRs, is not compliant for controlled substances. You must specifically verify that the EPCS component meets DEA standards. The DEA maintains a list of certified vendors. Your EHR vendor can confirm whether your system includes DEA-certified EPCS functionality.

Do I need a new DEA registration for EPCS?

No, you don't need new registration if you already have an active DEA registration. However, you must notify DEA that you intend to use EPCS by completing Form DEA-106 (Notice of Intention to Conduct Telehealth for the Purpose of Prescribing Controlled Substances). Some states require additional state-level approval or registration. Check both federal DEA requirements and your state medical board's requirements before starting EPCS prescribing.

What patient information do I need to verify for controlled substance prescriptions?

DEA requires strong identity verification using two factors: (1) Knowledge-based (security questions, medical history), (2) Possession-based (one-time password, authentication app), or (3) Biometric (fingerprint, facial recognition). You could also use video verification with government-issued ID review. The method must be documented in the prescription record. Telehealth platforms often build in these verification methods, so check what your EPCS software provides.

Can I prescribe controlled substances to new patients via telehealth?

It depends on your state. Most states require prior in-person relationship before telehealth prescribing of controlled substances. However, some states make exceptions for: (1) Established patients (within 12 months), (2) Addiction treatment (buprenorphine/methadone), and (3) Specific scenarios. A few states allow controlled substance prescribing to new patients if proper telehealth modality and identity verification occur. Check your state medical board's specific telehealth policy for prescribing rules.