What EPCS is and why DEA cares
EPCS is the DEA-regulated electronic prescribing standard for Schedule II–V controlled substances. The DEA created EPCS to reduce prescription fraud, diversion, and forgery. Paper and faxed prescriptions are easy to alter or duplicate; electronic prescriptions sent through a Surescripts-certified pipeline with tamper-evident logging are not.
DEA 1311 compliance: what your ePrescribe must do
The DEA's 21 CFR Part 1311 rule defines what an EPCS-capable system must implement. Five things matter:
- IAL2-level identity proofing of each prescriber before EPCS rights are granted (NIST 800-63-3 standard)
- AAL2 two-factor authentication at the point of prescribing (typically password + hardware token or biometric)
- Biometric false match rate of ≤0.001 if biometrics are used
- FIPS 140-2 Level 1 hardware tokens if hardware tokens are used
- Tamper-evident audit logging of every EPCS event for at least 2 years
PDMP integration: state-mandated checking
Many states (NY, TN, KY, OH, MN, MA, and others) now require prescribers to check the state Prescription Drug Monitoring Program (PDMP) before writing certain controlled substances. PDMP integration inside the ePrescribe flow is essentially required for behavioral health practices in those states — manual portal lookups don't scale and lead to compliance violations.
Build vs. buy: should you integrate Surescripts directly?
Direct Surescripts certification takes 12-18 months and significant compliance investment. The practical path for almost every practice is integrating with an ePrescribe vendor that's already Surescripts-certified. Choose based on: (1) does it support EPCS for all 50 states, (2) does PDMP integration happen inline (no portal switching), (3) is identity proofing included or separate cost, (4) does it integrate with your existing chart, (5) what does it cost per prescriber per month.
- Direct certification: 12-18 months, $200k+ in compliance investment — not viable for individual practices
- Surescripts-certified middleware: 2-4 weeks to onboard, $50-100/month per prescriber — the standard path
- Velant ePrescribe: $75/month per prescriber (volume discounts at 5+ and 10+), DEA 1311 identity proofing included
What practices typically miss in EPCS evaluation
Three things consistently catch practices off guard: (1) the third-party DEA audit cost if you build custom UI on top of an ePrescribe API ($15-30k typically), (2) per-state nuances in PDMP requirements (NY requires PMP check before nearly every controlled prescription; CA has narrower rules), and (3) the operational burden of maintaining identity proofing for new hires.
Cost ranges across the market
Per-prescriber ePrescribe pricing varies widely depending on volume and whether EPCS is bundled. Typical ranges in 2026:
- Weno (NewCrop) — $48/year base + $48/year EPCS + transaction fees: ~$200/year all-in for a moderate-volume prescriber
- DoseSpot — $500-$800/year per prescriber, sales-led pricing
- DrFirst Rcopia — $700-$1,200/year per prescriber, enterprise pricing
- Velant ePrescribe — $75/month per prescriber, $65/month at 5+, $55/month at 10+
Inside Velant
Velant ships this entire workflow out of the box — HIPAA-compliant CRM, AI Voice Agent, AI Lead Follow-up, Surescripts-certified ePrescribe, 270/271 eligibility, 837P claims, and closed-loop attribution. Book a 20-minute walkthrough and we'll show you how it runs end to end.
Frequently asked questions
Do I need EPCS for non-controlled substances?
No. EPCS only covers Schedule II–V controlled substances. Non-controlled substance ePrescribing uses standard Surescripts certification without the DEA 1311 identity proofing and two-factor authentication overhead.
What states mandate EPCS?
About 35 US states currently mandate EPCS for controlled substance prescriptions, with phased deadlines through 2027. CMS mandates EPCS for all Schedule II–V Medicare Part D prescriptions as of 2023. The practical answer: assume your state requires it.
How long does EPCS identity proofing take?
Remote IAL2 identity proofing (through Experian, ID.me, or a similar service) typically takes 10-20 minutes per prescriber. In-person proofing is faster (5 minutes) but requires a credentialed proofing agent. Most vendors include this in onboarding.
Is Velant ePrescribe EPCS-certified for all 50 states?
Yes. Velant ePrescribe is Surescripts-certified for EPCS in all 50 states with DEA 1311 identity proofing, PDMP integration where state-mandated, formulary lookup, and drug interaction checks. $75/mo per prescriber with volume discounts.
Does Velant include PDMP lookup automatically?
Yes. In state-mandated jurisdictions (NY, TN, KY, OH, MN, and others), PDMP lookup happens inline during the prescribing flow without leaving the chart. The check is logged for compliance.
Related reading
- Patient AcquisitionHow to Respond to Healthcare Leads in Under 30 SecondsHealthcare leads cool 80% within 30 minutes. This guide shows how to build a response system that hits sub-30-second SMS, sub-5-second inbound calls, and full 24/7 coverage — without adding intake staff.
- Patient AcquisitionPatient Acquisition Cost: The 2026 Buyer's Guide for Healthcare PracticesHow to measure, benchmark, and reduce patient acquisition cost (PAC) — including realistic 2026 benchmarks for behavioral health, addiction treatment, primary care, dental, and aesthetics practices.