EPCS Integration Review
Find out why more EPCS developers trust Drummond with their EPCS certification than any other auditor.
Schedule your FREE CONSULTATION with an expert Drummond EPCS auditor today.
What Is an Integrated EPCS Module
An integrated module allows EHR vendors to add EPCS functionality to their application without building their own user interfaces, workflows, or back-end processes. The EHR application embeds or redirects the user to the module provider’s software, which handles EPCS functions on behalf of the EHR vendor. These functions include access controls, prescription creation, two-factor authentication, logging and reporting, and transmission of controlled substance prescriptions.
Common EPCS module providers whose modules Drummond has certified include DrFirst, DoseSpot, NewCrop, Eazyscripts, DAW, and MD Toolbox. When an EHR vendor integrates one of these pre-certified modules, that vendor partially inherits the certification from the module provider. However, a separate Integration Review is still required before the EHR application can transmit controlled substance prescriptions.
Who Needs an Integration Review
Under 21 CFR Part 1311, any provider of an electronic prescription application must undergo a third-party audit before the application may be used to create, sign, transmit, or process prescriptions for controlled substances. This requirement applies to EHR vendors that have elected to integrate an EPCS module rather than build their own EPCS functionality.
The Integration Review covers the specific subset of DEA criteria applicable to the integration, not the full prescriber application criteria set. The review is targeted, typically requiring less than one hour for a prepared applicant, and is conducted against a production release version of the application in a staging environment. No code changes are permitted during the review session.
Preparing for the Review
The EHR vendor is expected to have a working knowledge of the DEA criteria covered in this review before the session begins. Drummond strongly recommends completing a self-review using the applicable test cases in advance. The Integration Review is a live demonstration, not a guided walkthrough. Arriving prepared is the single most effective way to complete the review in one session.
Audit Procedure
The Drummond Integration Review covers four categories. The application provider demonstrates each of the following during the live session:
User Creation and Access Controls
- Demonstrate the process for creating a new user who does not have EPCS permission or role
- Demonstrate that the user cannot mark prescriptions ready to sign, sign prescriptions, or elevate their own privileges
- Detail the identity proofing process for a practitioner and the issuance of two-factor authentication credentials
- Demonstrate the process for granting EPCS permissions — show that two individuals are required, one of whom must be a practitioner who provides two-factor authentication to confirm the permission change
Prescription Creation
- emonstrate that any prescription created contains all required information: full name and address of the patient, drug name, strength, dosage form, quantity prescribed, directions for use, and the name, address, and DEA registration number of the practitioner
- Demonstrate required fields for special case drugs including GHB and detoxification drugs
Prescription Signing
- Demonstrate that controlled substance prescriptions must be reviewed and marked ready to sign before they can be signed or transmitted, and that the review page displays all required information
- Demonstrate that the application displays all required information when prompting the practitioner for two-factor authentication
- Demonstrate that prescriptions can only be signed using the two-factor credential of the prescriber
Reports and Audit Trail
- Demonstrate a sortable report containing all controlled substance prescriptions
- Demonstrate the audit trail and show through sample entries that it captures the creation, alteration, readiness indication, signing, transmission, or deletion of a controlled substance prescription, setting or changing logical access controls, and notice of failed transmission—with all required data elements in each entry
- Demonstrate the security incident report and show that it captures all required entries
Audit Method
The Integration Review is conducted remotely via video conference and screen sharing. No travel is required. The review typically requires less than one hour for a prepared applicant.
Re-Audit Requirements
Re-audit is required by the DEA every two years. The following scenarios also affect re-audit obligations:
- If the integrated module is modified in a way that does not alter the integration functionality, Drummond reviews the module provider’s changes and the integrating EHR application can inherit those changes without attestation or re-audit
- If changes to the integrated module affect integration functionality, the integrating EHR application must undergo re-evaluation
- If the integrating EHR application changes module providers or switches to a different module, the existing Audit Final Report does not apply to the new version — a new Integration Review is required
For changes to the integrated module, the module’s software vendor must complete an EPCS Attestation form describing the change. Email epcs@drummondgroup.com to request the attestation form. The Drummond Review Board will determine whether retesting is required and to what degree. Re-audit fees are generally lower than initial fees.
What You Receive
Upon successful completion of the Integration Review, Drummond issues an Audit Final Report confirming that your application has undergone the required third-party audit under 21 CFR Part 1311. You may then communicate to customers that the application has been audited and is available for controlled substance e-prescribing.
If non-compliant items are identified during the review, Drummond issues a corrective action report detailing which requirements were not met. Retesting fees apply and a new session will be scheduled upon receipt of payment.
Speak with a Drummond Expert
Experience the difference with a Drummond EPCS certification.
Share your contact information with us, and a Drummond representative will schedule a time to speak with you about how the Drummond EPCS Certified status can help you build trust with your existing and future customers.