COVID-19 QA EPCS Hospitals & Remote ID Proofing

Questions & Answers
Electronic Prescriptions for Controlled Substances (EPCS)
Question: During the COVID-19 public health emergency, may DEA-registered
hospitals/clinics conduct remote identity proofing of individual practitioners eligible
to use the hospital/clinic’s electronic prescription application to sign prescriptions
for controlled substances?
Answer: Yes, DEA regulations generally authorize the use of remote identity
proofing when issuing authentication credentials for use in the electronic
prescribing of controlled substances (EPCS), even in the absence of a public
health emergency. If a hospital/clinic wishes to conduct remote identity
proofing, DEA suggests using a device that allows for real-time, two-way,
audio-visual interactive communication.
DEA regulations require individual practitioners engaged in EPCS, including
individual practitioners working under the DEA registration of a hospital or
clinic pursuant to 21 CFR 1301.22(c), to obtain an authentication credential
and use that credential to electronically sign prescriptions for controlled
substances. See, e.g., 21 CFR 1311.120, 1311.140. A hospital, clinic, or
other institutional practitioner may obtain the necessary authentication
credentials for individual practitioners eligible to use the institution’s EPCS
application in either of two basic ways.
First, the hospital/clinic may elect to conduct its own in-house identity
proofing as part of its credentialing process of these individual practitioners
and itself authorize the issuance of the authentication credentials. 	If an
institutional practitioner chooses to conduct its own internal identity proofing,
DEA regulations require that process to meet a number of specific
requirements. See 21 CFR 1311.110. DEA regulations, however, do not
require that this process occur in-person. Thus, if the hospital/clinic is able
to remotely conduct identity proofing in a manner that satisfies these DEA
regulatory requirements, it may do so.
Second, rather than conducting its own identity proofing, a hospital/clinic
may require practitioners to obtain identity proofing and authentication
credentials in the same manner as practitioners not operating under an
institution’s DEA registration, i.e., through a credential service provider (CSP)
or certificate authority (CA). See 21 CFR 1311.105. 	DEA regulations require
CSPs and CAs to conduct identity proofing at Assurance Level 3 or above of
the National Institute of Standards and Technology (NIST) Special Publication
(SP) 800-63-1, “Electronic Authentication Guideline,” which allows either in-
person or remote identity proofing. 	(Since those regulations were published,

changes in technology have led to the creation of new, updated NIST
guidelines, NIST SP 800-63-3, “Digital Identity Guidelines.” Under NIST SP
800-63-3, the relevant identity proofing assurance level is Identity Assurance
Level 2. Identity Assurance Level 2 of NIST SP 800-63-3, like Assurance
Level 3 of NIST SP 800-63-1, allows either in-person or remote identity
proofing).
Thus, DEA regulations generally allow hospitals and clinics (as well as CSPs
and CAs) to remotely conduct the identity proofing necessary to issue EPCS
authentication credentials to individual practitioners. 	A DEA registered
hospital/clinic may also want to check with their state regulatory boards to
maintain compliance with any state rules or regulations regarding this
matter.
Guidance documents, like this document, are not binding and lack the force
and effect of law, unless expressly authorized by statute or expressly
incorporated into a contract, grant, or cooperative agreement. Consistent
with Executive Order 13891 and the Office of Management and Budget
implementing memoranda, the Department will not cite, use, or rely on any
guidance document that is not accessible through the Department’s guidance
portal, or similar guidance portals for other Executive Branch departments
and agencies, except to establish historical facts. To the extent any guidance
document sets out voluntary standards (e.g., recommended practices),
compliance with those standards is voluntary, and noncompliance will not
result in enforcement action. 	Guidance documents may be rescinded or
modified in the Department’s complete discretion, consistent with applicable
laws.
DEA080, April 05, 2020.