Confidential 1 Electronic Prescribing of Controlled Substances (EPCS) Part 1 of a 3 Part Series Chuck Klein, Ph.D. GM/Director, Medication Management

Confidential 2 Agenda Defining EPCS Legal Aspects of EPCS Pharmacies Requirements: OrderConnect Requirements: Prescribers Two-Factor Authentication Identity Proofing and Credentialing Workflow Audit Reports NY I-STOP Law OrderConnect Timeline

Confidential 3 What is EPCS? EPCS—the Electronic Prescribing of Controlled Substances— allows prescribers who use an EPCS-certified e-prescribing application to send prescriptions for controlled substances electronically to pharmacies. Although highly desired, EPCS is not mandatory, except for New York State prescribers (effective 3/27/2015).

Confidential 4 Is EPCS Legal? Yes. On March 31, 2010, DEA's Interim Final Rule with Request for Comment titled "Electronic Prescriptions for Controlled Substances" [Docket No. DEA-218, RIN 1117-AA61] was published in the Federal Register. The rule became effective June 1, The rule revises DEA regulations to provide practitioners with the option of writing prescriptions for controlled substances electronically. The regulations also permit pharmacies to receive, dispense, and archive these electronic prescriptions. These regulations are an addition to, not a replacement of, the existing rules. The regulations provide pharmacies, hospitals, and practitioners with the ability to use modern technology for controlled substance prescriptions while maintaining the closed system of controls on controlled substances.

Confidential 5 So EPCS is Legal in Every State? State Boards of Pharmacy can enforce stricter rules than the DEA but not less strict. All states except Montana currently allow the electronic prescribing of controlled substances. Kansas and Vermont do not allow Schedule II medications to be sent electronically. Nurse practitioners in Texas may not send Schedule II medications electronically. Effective March 27, 2015, all prescribers in New York must send all prescriptions electronically to pharmacies, including those for controlled substances (NY-ISTOP).

Confidential 6 Is EPCS Mandatory? From the DEA’s perspective the new regulations do not mandate that practitioners prescribe controlled substances using only electronic prescriptions. Nor do they require pharmacies to accept electronic prescriptions for controlled substances for dispensing. Whether a practitioner or pharmacy uses electronic prescriptions for controlled substances is voluntary from DEA’s perspective. Prescribing practitioners are still able to write, and manually sign, prescriptions for schedule II, III, IV, and V controlled substances and pharmacies are still able to dispense controlled substances based on those written prescriptions. Oral prescriptions remain valid for schedule III, IV, and V controlled substances. Electronic prescriptions for controlled substances are only allowed if the electronic prescription and the pharmacy application meet DEA’s requirements. In addition, electronic prescriptions for controlled substances may be subject to State laws and regulations. If State requirements are more stringent than DEA’s regulations, the State requirements would supersede any less stringent DEA provision.

Confidential 7 Will All Pharmacies Accept Electronic Prescriptions for Controlled Substances? Just as e-prescribing software applications (like OrderConnect) have to go through DEA and Surescripts certifications, so, too, do pharmacy software applications. When OrderConnect is EPCS enabled, it will automatically know which pharmacies can and cannot accept prescriptions for controlled substances. It will not allow users to send prescriptions for controlled substances electronically to pharmacies that are not authorized to receive them.

Confidential 8 The Pharmacy Landscape for EPCS

Confidential 9 What is Required for OrderConnect to do EPCS? ePrescribing Software Vendors: ePrescribing software vendors must get certified by a DEA- approved auditor. Increased focus and attention is on strict access control and auditing. Two factor authentication is required when transmitting EPCS prescriptions. Surescripts certification for EPCS is also required.

Confidential 10 What is Required for Prescribers to do EPCS? Prescribers: The DEA requires prescribers to go through Identity Proofing and Issuance of Credentials. Specific processes are outlined by the DEA for ‘activating’ physicians to do EPCS. Two factor authentication is required by prescribers when transmitting EPCS prescriptions.

Confidential 11 What is Two-Factor Authentication? Two-factor authentication (2FA) adds a second level of authentication to an account log-in. When you have to enter only your username and one password, that's considered a single-factor authentication. 2FA requires the user to have two out of three types of credentials before being able to access an account. The three types are: Something you know, such as a Personal Identification Number (PIN) or a password. Something you have, such as a soft or hard token. Something you are, such as a biometric like a fingerprint, iris scan, or voice print. Netsmart is choosing to use the first two and will offer both hard and soft token options.

Confidential 12 Identity Proofing and Credentialing Netsmart has partnered with Verizon who will provide identity proofing and credentialing services. Verizon is a federally approved Certificate Authority and a Credential Services Provider (NIST SP Assurance Level 3). Netsmart will offer, through the OrderConnect Admin Tool and Registration Tool, the ability for providers to get identity proofed and credentialed (via Verizon). [More information about this will be offered in our next webinar on January 22, 2015.]

Confidential 13 Setting Access Controls in OrderConnect for EPCS Once a prescriber has gone through identity proofing and obtained an authentication credential he/she is eligible for EPCS access in OrderConnect. The OrderConnect Admin Tool will contain the access controls needed to activate prescribers for EPCS according to strict DEA standards. Two separate individuals will be required to grant access for each prescriber.

Confidential 14 Prescriber Workflow Prescribers will be able to order controlled substances and non- controlled substances at the same time. OrderConnect will know which medications require two-factor authentication on the Order Confirmation screen. Prescribers can apply two factor authentication once for all the controlled substances being ordered at that time for that patient.

Confidential 15 Agent Workflow Prescriber agents (eg, nurses, etc.) will be able to prepare prescriptions for controlled substances on behalf of a prescriber. Once prepared, the prescriptions will go into a prescriber’s queue. Once the prescriber reviews the prescriptions and applies his/her two factor authentication, they will be transmitted to the pharmacy.

Confidential 16 New Audit Reports New audit reports will be available in OrderConnect that will allow a prescriber to see all activities pertaining to his/her EPCS. The DEA requires that each EPCS prescriber review his/her audit report every week. OrderConnect will give the ability for prescribers to look at a week’s work of activity or any time range they wish. It is up to each prescriber to check their report. Reports will not be “pushed” to prescribers nor will OrderConnect track who has accessed their reports and who has not.

Confidential 17 What is the New York I-STOP Law and What Does it Have to Do with EPCS? On March 27, 2015, electronic prescribing of non-controlled as well as controlled substances will be required in New York State under the provisions of the I-STOP law and subsequent regulations. Title 10 NYCRR Part 80 Rules and Regulations on Controlled Substances authorizes a practitioner in New York State to issue an electronic prescription for controlled substances in Schedules II through V. For electronic prescribing of controlled substances (EPCS), the regulations require a facility to register their certified electronic prescribing computer application with the New York State Department of Health, Bureau of Narcotic Enforcement (BNE).

Confidential 18 OrderConnect’s Timeline for EPCS OrderConnect EPCS will be released for use by our New York clients on March 16, Prior to its release, user documentation will be provided as well as a recorded training webinar. Instructions will also be sent that will allow providers to go through identity proofing and credentialing. In addition, information will be sent to our NY clients that will allow them to register their OrderConnect with the NY Bureau of Narcotic Enforcement. OrderConnect EPCS will be available for use by all other clients by April 30, 2015.

Confidential 19 What Will the Additional Cost be for EPCS? This is still being determined. It will be similar to other e-prescribing systems; there will be a per prescriber setup fee and a small monthly increase in each prescriber license. As soon as the cost is finalized it will be announced.

Confidential 20 OrderConnect EPCS Webinars: Part 2 and Part 3 Part 2: January 22, 2015 Will cover identity proofing and credentialing and access controls in OrderConnect. Part 3: February 19, 2015 Will cover EPCS workflow in OrderConnect for prescribers and agents. Invitations will be forthcoming.

Confidential 21 Questions?