EPCS Certification Guide
Find out why more EPCS developers trust Drummond with their EPCS certification than any other auditor.
Schedule your FREE CONSULTATION with an expert Drummond EPCS auditor today.
What Is EPCS Certification
Electronic Prescribing of Controlled Substances (EPCS) is a federal regulatory framework established by the Drug Enforcement Administration (DEA) under 21 CFR Part 1311. The regulations allow licensed practitioners to sign and send controlled substance prescriptions electronically and permit pharmacies to receive, dispense, and archive those prescriptions digitally.
Before any software application can be used to create, sign, transmit, or process-controlled substance prescriptions, it must be audited by a DEA-approved certification organization. Drummond has been conducting EPCS certifications since 2012 and holds more active EPCS certifications than any other DEA-approved auditor.
Who Must Comply
The certification requirement applies to software applications, not to the individual prescribers or pharmacies that use them. Any organization that develops, sells, or maintains an application used to electronically prescribe or dispense controlled substances in the United States falls within scope of 21 CFR Part 1311. This includes:
- EHR vendors and standalone e-prescribing application developers whose software is used by practitioners to create, sign, and transmit controlled substance prescriptions
- Pharmacy management software companies whose applications are used to receive, dispense, and archive controlled substance prescriptions
- EPCS module providers whose modules are licensed and integrated into third-party EHR applications — vendors integrating a pre-certified module must complete a separate Integration Review before transmitting controlled substance prescriptions
- Veterinary practice management software developers whose applications are used by DEA-registered veterinarians to electronically prescribe controlled substances for animals
- Health system IT teams that have developed in-house prescribing or pharmacy systems
The requirement applies regardless of organization size or care setting. Certification must be renewed every two years, and significant application updates may require additional review before the updated version can be used in production.
Certification Pathways
Drummond offers four certification pathways, each designed for a specific application type. The correct pathway is determined by the nature of your software and how EPCS functionality is implemented.
Initial Certification: Prescriber Applications
For EHR vendors and standalone e-prescribing application developers that have built their own EPCS functionality. The audit covers the full set of DEA criteria under 21 CFR Part 1311, including:
- User creation and logical access controls
- Identity proofing requirements for practitioners
- Two-factor authentication implementation
- Prescription creation, review, and signing workflows
- Security review and processing integrity assessment
- Audit trail and reporting requirements
- Record retention requirements
Audits are conducted in live sessions by a dedicated Drummond EPCS auditor. When applicants arrive prepared, certifications can often be completed in as few as two live sessions. Applicants who need additional time to address gaps or who require retesting should expect additional sessions (at no additional cost). There are no pre-work packages or self-audit forms required before you begin—your Drummond auditor works closely with you throughout the process. Upon successful completion, Drummond issues a Certification Report and Certification Seal, and your product is listed on the Drummond certified products page.
Initial Certification: Pharmacy Applications
For pharmacy management software companies whose applications receive, dispense, and archive-controlled substance prescriptions. The full audit covers DEA criteria for pharmacy applications including logical access controls, dispensing workflows, cryptography requirements, renewal and change requests, record retention, and audit logging.
Audits are conducted in live sessions by a dedicated Drummond EPCS auditor. When applicants arrive prepared, certifications can often be completed in as few as two live sessions. Applicants who need additional time to address gaps or who require retesting should expect additional sessions (at no additional cost). There are no pre-work packages or self-audit forms required before you begin—your Drummond auditor works closely with you throughout the process. Upon successful completion, Drummond issues a Certification Report and Certification Seal, and your product is listed on the Drummond certified products page.
Biennial Recertification
DEA regulations require recertification every two years, and Drummond keeps it fast. Recertification runs in two live calls: a kickoff and a demo. You will not prepare screenshots or assemble extensive documentation. Drummond audits the current production release of your application in a staging environment, and retesting is free if you need it. The same process applies to both prescriber and pharmacy applications.
Interim Recertifications Included
Your certification comes with two years of Drummond support. When your application changes during the cycle, Drummond guides, audits, and certifies the update as part of your flat fee, through to your next recertification. Interim recertifications are included, and so is guidance whenever regulations change.
If a change affects EPCS criteria, complete an EPCS Attestation form describing it. A Drummond reviewer determines whether the change needs retesting and gives you the scope and timing. Contact EPCS@drummondgroup.com for the form.
Veterinary EPCS Certification
DEA-registered veterinarians who prescribe controlled substances are subject to the same requirements under 21 CFR Part 1311 as other DEA-registered practitioners. Veterinary practice management software developers whose applications support electronic controlled substance prescribing must therefore obtain DEA-approved third-party certification before those applications can be used in production.
Drummond provides EPCS certification for veterinary practice management software and EHR systems. The audit process follows the same structured approach as initial prescriber certification, adapted to the veterinary application type and use case. An increasing number of states have enacted EPCS mandates that extend to veterinary prescribers, creating market-access requirements for software vendors in this space as well as federal compliance obligations.
What You Receive
Upon successful completion of the EPCS audit, Drummond issues:
- A signed Certification Report confirming your application meets all applicable DEA requirements under 21 CFR Part 1311
- A Drummond Certification Seal for use in customer communications and marketing materials, subject to Drummond’s Seal Usage Guidelines
- Two years of support from your Drummond auditor, and testing of any changes made to your software at no additional cost.
- Subscription to the Drummond newsletter and technical updates to keep you informed about regulatory changes.
- Listing on the Drummond certified products page
Once certification is complete, you can go live in all 50 states, sending and receiving controlled substance prescriptions electronically. You may share the Certification Report with your prescriber and pharmacy partners, who may need to inspect it to meet their own compliance obligations.
Speak with a Drummond Expert
Experience the difference with a Drummond EPCS certification.
Share your contact information with us, and a Drummond representative will schedule a time to speak with you about how the Drummond EPCS Certified status can help you build trust with your existing and future customers.