SCRIPT 2023 has been on the radar for a while. Most teams working in e-prescribing know it is coming, know the January 1, 2028 deadline exists, and have a general sense that it will require some development work. What far fewer teams have figured out is exactly which SCRIPT 2023 changes affect their EPCS certification and which ones do not.
That distinction matters more than it might seem. The DEA requires a third-party EPCS audit whenever changes affect controlled substance prescription functionality, or every two years, whichever comes first. If your organization implements SCRIPT 2023 features that touch the controlled substance workflow without coordinating that update with your EPCS audit cycle, you may find yourself facing an unscheduled audit in addition to your normal two-year review. That is extra cost, extra time, and a compliance challenge that careful planning can avoid.
At Drummond’s SCRIPT 2023 Readiness webinar, practitioners across prescribing, pharmacy, and long-term care brought exactly these questions to our EPCS certification experts. What follows are those questions, answered directly. If you are a Product Manager, IT Compliance Manager, or developer working in e-prescribing, this is the guidance you need before your organization begins implementing SCRIPT 2023.
If you want broader context on what SCRIPT 2023 changes and how to implement it, see our guides on implementing SCRIPT 2023 and key enhancements in SCRIPT 2023. This post focuses specifically on what all of it means for your EPCS certification.
Frequently Asked Questions
The questions below come directly from attendees at Drummond’s SCRIPT 2023 Readiness webinar. They cover the scope of EPCS certification under the new standard, prescription transfers, renewal workflow changes, compounding requirements, long-term care facility compliance, and implementation planning. If your question is not here, our EPCS team is happy to help.
What changes in SCRIPT 2023 will not affect EPCS certification?
Several major changes to SCRIPT 2023 fall outside the scope of EPCS certification requirements. Changes to medication history, new RX request workflows, and electronic prior authorization are not part of EPCS criteria. Additionally, new versions of real-time prescription benefit and formulary benefit functionality will not impact your EPCS certification. The DEA only focuses on changes affecting the process for issuing or receiving controlled substance prescriptions.
Why do medication history and electronic prior authorization not affect EPCS certification?
EPCS certification applies only when changes impact the process for issuing or receiving a controlled substance prescription. Context around issuing a prescription—such as prior authorization or retrieving a patient’s medication history—does not fall under DEA standards. The DEA is solely concerned with messages that authorize the dispensing of controlled substance medications.
What new patient demographic fields has SCRIPT 2023 added?
The NCPDP standard has expanded patient demographic fields significantly to provide more detailed information. These new fields include additional identifiers, gender identity, sex, pronouns, race, and ethnicity information. However, the DEA only requires two fields for controlled substance transactions: patient name and address. The additional demographic fields are optional and will not impact your EPCS certification requirements.
Will new demographic fields require changes to EPCS systems?
No. While these new demographic fields are useful for providing additional patient context, they do not trigger EPCS recertification requirements. EPCS systems only need to maintain compliance with DEA requirements for patient name and address. Organizations can implement the additional fields without affecting their EPCS certification status.
What is the difference between patient-level and prescription-level diagnosis?
Patient-level diagnosis is a new field in SCRIPT 2023 that identifies broader conditions a patient may have. Prescription-level diagnosis has existed previously and applies to individual controlled substance prescriptions. These two fields serve different purposes and should not be confused. For GHB prescriptions specifically, the prescription-level diagnosis is what validates the patient’s medical need and must remain in use.
Should I replace prescription-level diagnosis with patient-level diagnosis for GHB?
No. The DEA requires that prescription-level diagnoses remain in use for GHB prescriptions. Patient-level diagnosis fields are supplementary and should not replace the existing prescription-level diagnosis. The pharmacy relies on the prescription-level diagnosis to validate that the patient has a legitimate medical need for the GHB prescription.
How does SCRIPT 2023 support compounded controlled substance prescriptions?
SCRIPT 2023 introduces a new compound information section that allows prescribers to fully document all components and ingredients in a compounded prescription. This addresses a significant limitation in the previous standard, where compound information was difficult to convey. For controlled substances in compounds, it is critical to accurately list the controlled substance medication, its strength, and the percentage it comprises in the final compound.
What compliance considerations apply to compounded controlled substances?
When documenting compound prescriptions containing controlled substances, accuracy in specifying the controlled substance medication and its strength within the compound is essential. DEA certification reviewers will pay close attention to how compounding pharmacies document controlled substance compounds to ensure the exact quantity being dispensed is clearly identifiable. Organizations using the new compound section should ensure their systems properly capture and validate this information.
What is the new expiration date requirement for renewal requests?
SCRIPT 2023 introduces a new data field specifying an expiration date for renewal requests. A pharmacist can set this date to indicate when a renewal request is no longer valid. Prescribing applications must now check these expiration dates and prevent responses to messages that have passed their expiration. This is a hard requirement—expiration dates must be enforced.
What does the prescription withdrawal flag mean?
The message indicator flag for restriction/withdrawal allows a renewal request to be withdrawn by the requester. For example, if a pharmacy issues a renewal request but the patient no longer needs those refills, the pharmacy can retract the request. The prescriber must honor this retraction and cannot respond to a withdrawn message. However, both the original and retraction must be archived for audit and investigative purposes.
What is the prohibit renewal request flag?
The prohibit renewal request flag is a setting that prescribers can enable to instruct pharmacies not to send renewal requests for a specific prescription. If a prescriber sets this flag, the pharmacy system must prevent pharmacists from issuing renewals for that prescription. This flag is part of EPCS certification requirements for pharmacy providers.
Do pending response types create new EPCS requirements?
No. Pending response types do not create new EPCS certification requirements. A pending response allows the prescriber to inform the pharmacy that a response is forthcoming—perhaps because the message was received and processed by a nurse or lower-level practitioner, but the physician’s response is still being prepared. This is a communication feature, not a compliance requirement.
What is the July 2023 DEA Final Rule that enables prescription transfers?
In July 2023, the DEA published a final rule allowing controlled substance prescriptions to be transferred from one pharmacy to another. Previously, pharmacies could only request prescriptions through a pull workflow. The new rule enables both push workflows (where one pharmacy unprompted sends a prescription to another) and pull workflows, making transfers more practical for patients traveling or relocating.
How does SCRIPT 2023 enable prescription transfers?
SCRIPT 2023 supports both push and pull workflows for controlled substance transfers. Under the push workflow, a pharmacy can send a controlled substance prescription directly to another pharmacy without waiting for a request. This simplifies the process when patients need to transfer prescriptions due to travel, relocation, or other circumstances. The pull workflow remains available as an alternative.
Are transferred controlled substance prescriptions treated like new prescriptions?
Yes. A transferred incoming controlled substance prescription must be treated exactly like a new prescription from an EPCS perspective. The receiving pharmacy must validate any signature indicator flags and archive them. If the message contains an embedded digital signature, the pharmacist must verify it cryptographically, just as they would for any new prescription.
What are the digital signature requirements for transferred prescriptions?
Transferred prescriptions may carry a signature indicator flag or an embedded encrypted signature. When a pharmacy uses the signature indicator flag, the receiving pharmacy creates a digital signature and archives it. When transferring to another pharmacy, the indicator flag remains set, and the next pharmacy creates an encrypted hash upon receipt. If the prescription has an embedded signature, the receiving pharmacy must validate and decrypt it, verify the message hash, and then either transfer it intact (if the next pharmacy is equipped to receive embedded signatures) or reject it if the next pharmacy cannot accept embedded signatures. Prescriptions must never be altered during transfer—they must be transferred intact and unaltered.
Can a receiving pharmacy reject a transferred prescription?
Yes, but only in specific circumstances. If the transferring pharmacy sends a prescription with an embedded signature and the receiving pharmacy is not equipped to handle embedded signatures, the receiving pharmacy must reject the transfer. The transferring pharmacy cannot edit or alter the prescription to make it acceptable to the receiving pharmacy—prescriptions must be transferred intact. If technical incompatibility exists, the transfer cannot proceed.
What source pharmacy information must be captured for transfers?
Source pharmacy information is now mandatory for transferred controlled substance prescriptions. The transferring pharmacy must include their pharmacy information in the transfer message. This allows the receiving pharmacy to track which pharmacies the prescription has passed through, creating an audit trail and ensuring compliance with DEA requirements. This information was not previously required for non-transferred prescriptions.
What new test cases are needed for EPCS certification regarding transfers?
EPCS certification testing for pharmacies must now include transfer scenarios. Testing should confirm that source pharmacy information is correctly added to transferred prescriptions and that signature information is properly applied. Testing should also simulate prescriptions being received as transfers and verify that the receiving pharmacy applies the same validations and checks as it would for brand new prescriptions.
Why have long-term care facilities struggled with EPCS compliance?
Long-term care facilities face unique challenges because controlled substance prescriptions involve three parties: the prescriber, the facility, and the pharmacy. The prescriber signs the prescription, the facility administers it to patients, and the pharmacy fills it. This three-party workflow was not explicitly supported in the previous SCRIPT standard, making compliance difficult. SCRIPT 2023 now provides explicit support for this intermediary role.
How does SCRIPT 2023 support the three-party model?
SCRIPT 2023 allows a long-term care facility to act as a third-party intermediary in the controlled substance prescription workflow. The facility can receive a prescription from the prescriber and add operational context (such as delivery instructions, routing information, administrative schedule, and workflow notes) before forwarding it to the pharmacy. This explicit support simplifies the facility’s role while maintaining DEA compliance and prescription integrity.
What operational context can a long-term care facility add?
Long-term care facilities can add delivery and administrative information that supports their operations. This includes delivery instructions, routing information, administrative schedules, and workflow notes. The facility can clarify how the patient prefers to receive medication or specify the schedule on which the patient will be administered the drug. Any clarifying information relevant to the patient and medication can be added—as long as it does not alter the prescription details that the prescriber originally signed.
What prescription content cannot be changed by a facility?
Long-term care facilities cannot alter the core controlled substance prescription elements that the DEA specifies. These protected elements include patient details, prescriber information, and the specific medication information (drug name, strength, dosage form, quantity prescribed, and directions for use). Altering any of these elements would invalidate the prescription that the prescriber signed. The bright line is: anything flagged by the DEA as part of the controlled substance prescription cannot be changed. Everything else can be added or modified.
What digital signature requirements apply to facilities?
Because the long-term care facility now acts as an intermediary, it must meet DEA requirements for digital signing and archiving. When the facility receives a prescription from the prescriber, it must digitally sign and archive the received data, creating a record of what was originally received. When the facility adds operational context and forwards the prescription to the pharmacy, it must digitally sign that outgoing message as well. This double-signing creates a complete audit trail: the original prescription, what was added, and what was sent forward. The pharmacy then digitally signs the message upon receipt, just as it would for any new prescription.
What infrastructure investments are required for facilities?
Long-term care facilities operating as intermediaries must invest in the technical infrastructure to digitally sign and archive prescription data. They need systems capable of receiving prescriptions from prescribers, maintaining records of both the original and modified messages, and securely transmitting to pharmacies. This infrastructure is comparable to what prescriber and pharmacy systems require for EPCS compliance.
Do long-term care facilities need EPCS certification?
Yes. Long-term care facilities that process controlled substance prescriptions as intermediaries must obtain a limited scope EPCS certification. This certification is unique to their role and differs from either prescriber or pharmacy certification because the facility performs elements of both roles. The certification ensures the facility meets all DEA requirements applicable to their intermediary function.
What test scenarios are needed for facility EPCS certification?
Testing a three-party workflow requires EPCS certification specifically tailored to long-term care facilities. The testing must validate that facilities correctly receive prescriptions, digitally sign and archive them, add operational context without altering protected prescription elements, and forward modified messages to pharmacies with proper signatures. The testing should confirm that the complete audit trail—original prescription, facility modifications, and forwarded message—is properly maintained and archived.
Walk me through the process when a physician prescribes a controlled substance for a nursing home patient.
The prescriber prepares the prescription with standard details: patient information, drug name, strength, dosage form, quantity, and directions. The prescriber signs the prescription using two-factor authentication and transmits it. Under the new model, the prescription goes to the long-term care facility rather than directly to the pharmacy. The facility receives it, verifies the prescriber’s signature, and digitally signs and archives the original message. The facility then adds operational context relevant to the patient and facility operations—perhaps noting the patient’s preferred medication administration time, the nursing schedule, or special handling instructions. The facility digitally signs this modified message and forwards it to the pharmacy with both signatures intact: the prescriber’s original signature and the facility’s additional signature. The pharmacy receives the message, verifies both signatures, adds its own digital signature, and archives the complete transaction history. This creates a transparent record of every party involved and every action taken.
When does the SCRIPT 2023 implementation deadline occur?
The CMS (Centers for Medicare and Medicaid Services) requirement mandates implementation by January 1, 2028. Organizations have several years to prepare and transition to the new standard.
Are there areas of SCRIPT 2023 where I don't need to worry about recertification?
Yes. Many changes—medication history, prior authorization, and formulary benefit updates—fall outside EPCS scope. Focus your recertification efforts on changes affecting the controlled substance prescription workflow.
What should I prioritize when planning for SCRIPT 2023 compliance?
Understand which changes affect your EPCS certification status. The areas requiring action include prescription transfers, renewal request expiration dates, withdrawal flags, compound prescriptions with controlled substances, and if applicable, three-party intermediary support for long-term care facilities.
Will all of my current EPCS certification remain valid under SCRIPT 2023?
Existing certification may require updates or recertification depending on which SCRIPT 2023 features you implement. If you add support for transfers, compounds, or intermediary roles, those specific areas will need certification testing. Under DEA regulations at 21 CFR Part 1311, recertification is required whenever functionality related to controlled substance requirements is altered, or every two years, whichever comes first.
How do I determine which SCRIPT 2023 features apply to my organization?
Start by identifying your role: prescriber, pharmacy, or facility. Prescribers should assess whether they work with compound prescriptions or long-term care facilities. Pharmacies should prepare for transfer functionality. Long-term care facilities need to understand the new intermediary model. Focusing on features relevant to your role helps streamline your compliance planning.
What resources are available to help with SCRIPT 2023 implementation?
Drummond and other industry partners provide certification testing services, implementation guidance, and technical consulting. Engage with your software vendor and industry consultants early in the planning process to understand the technical changes required and the scope of testing needed.
Still Have Questions?
SCRIPT 2023 affects prescribers, pharmacies, and long-term care facilities differently, and where you are in your existing EPCS audit cycle changes the picture further. If you are not sure which of these changes apply to your system or how to time your implementation alongside your next recertification, talking to an EPCS expert is the most efficient way to get clarity. Drummond’s EPCS testing and certification team works with vendors at every stage of the SCRIPT 2023 transition and can help you understand exactly what your system needs and when.