Overview McKesson Practice Choice TM Electronic Prescribing of Controlled Substances (EPCS) Frequently Asked Questions What is EPCS? EPCS stands for Electronic Prescribing of Controlled Substances. Our erx vendor, DxWeb, has been certified by both EHNAC (Electronic Healthcare Network Accreditation Commission) for EPCS DEA requirements and Surescripts to allow us to offer this functionality via the e- Prescribing tool you are already using today. The DEA had previously prohibited controlled substances from being e-prescribed, but has introduced a stringent vendor and provider certification process to now allow it. To which McKesson BPS products does this document apply? EPCS is ready for users of McKesson Practice Choice only at this time, including those that use Medisoft or Lytec PM along with McKesson Practice Choice EMR. What does the enrollment process for EPCS involve? To provide you a quick overview, the enrollment process requires that a provider provide proof of his/her identity and also that a second provider verify the identity of the first provider as well. There are three steps that must be completed for every provider and a couple more for singleprovider practices: 1. Provider must purchase an annual license and be identity proofed via Symantec s Norton technology. (You may know Symantec from its anti-virus software. They provide identity-proofing services as well, in a partnership with Experian.) 2. A member of the provider s practice must log into DxWeb and check a box to enable the provider for EPCS. 3. Another practice provider who has already been identity proofed must log into DxWeb and check a box to verify the provider for EPCS. If you have a single-provider practice, you must locate a colleague outside of the practice to verify you and create a record for him/her in External Providers before Step 3 above can be completed. Why is the process so complicated? By law, DxWeb must follow the identity proofing guidelines as set forth by the DEA and, given the tight controls around Controlled Substances, those guidelines are very stringent. How much does EPCS cost? The annual license costs $57.00 and will need to be renewed each year. McKesson did not set this fee but instead it is used to pay for the ID proofing license online at the Symantec site rather to McKesson Practice Choice or your VAR. Following are the different components and options with which you will be presented on the Norton site. Please note that the VIP app is not offered to you until a later Norton screen in the process.
$57 EPCS license: Required annually for EPCS regardless of which optional connection option you may choose below. With the $57 annual license, you will be able to choose whether you want EPCS passcodes transmitted to you via a voice call or text. In other words, you do not need to purchase or download any of the below apps or products to receive passcodes when you are prescribing controlled substances. $30 token: Optional, please choose this option if you intend to use your device for normal e- Prescribing. The DEA will not allow you to prescribe and receive EPCS codes on the same device. Free VIP app on device: Optional, please choose this option if you frequently prescribe in areas with limited or no connectivity Free VIP app on desktop: Optional, please choose this option if you would like to install an add-on that will deliver codes to a nearby desktop Why does McKesson Practice Choice require Symantec and not allow providers to choose other vendors for identity proofing? DxWeb, our e-prescribing vendor, chose Symantec for their stellar reputation and nationwide penetration. An e-prescribing vendor can only be certified with/by one security company. What is a token? A token (sometimes also known as a hard token) provides a unique, expiring passcode at just the time you need it; in this case, when you are about to transmit a controlled substance in DxScript, you will be asked for this passcode. You may have used a device like this in the past to securely access work email remotely. Using a token device or an expiring code sent to your phone is known as second-factor authentication. Or, in other words, a second way of proving your identity past an initial username and password login. This hard token is small enough to fit in your pocket, lab coat or on a key chain. It is important to note that a hard token is not required for the EPCS process. You can have the second factor authentication codes sent to your mobile device as detailed in the next question. Can I prescribe controlled substances on my mobile device? You may have read that DxWeb has released mobile prescribing apps for both Apple and Android devices to coincide with the deployment of release 4.10 for McKesson Practice Choice 4.10 and EPCS availability. Unfortunately, the DEA does not allow you to receive the second-factor authentication code on the same device you prescribe. One alternative to this would be to prescribe controlled substances on your desktop, laptop, tablet or secondary mobile phone and receive the codes on your primary mobile phone. Another alternative would be to purchase the hard token for complete device prescribing freedom. Can I still fax controlled substances after I am set up for EPCS? No, the DEA mandates that once a provider is verified for EPCS, he/she can no longer fax these to the pharmacy.
Identity Proofing How long does the identity proofing process take? The Symantec online identify proofing process will take about 30 minutes. If you purchase the hard token referenced above, you will need to wait for a Mailer Code from Symantec before you can complete the process. What kind of information is required and what is done with it? Identify proofing may feel very much like a credit check or short loan application process to you. You will be asked for personal information that will be used to access your credit history and require you to correctly answer questions based upon it. Norton will not use this information for any other purpose. Some of these questions may be challenging and are intentionally tricky to prevent identity theft or fraud. What happens if I fail my identity proofing questions? You can retry five times every 12 hours. Can an Office Manager, Nurse or other practice personnel complete Identity Proofing on behalf of the provider? No, this should be completed by the provider only. Can a VAR complete Identify Proofing on behalf of the provider? No, this should be completed by the provider only. What is a mailer and why do I need one? A mailer is sent when Experian (via Symantec) cannot validate the phone number you supplied because 1) Experian cannot identify it as your number or 2) Experian cannot reach you at that number when they call to validate. This mailer will be sent to your home address. Keep in mind that you cannot specify an office phone number during this process. Also, some cell phone numbers cannot be linked back to their owners, so even if a provider specifies a cell phone number (which is suggested during the ID proofing process), it does not mean that Experian will be able to use it as part of the identity proofing process. You are not able to verify another provider for EPCS or have one verify you until this mailer is received. Who should I call if I have trouble with the Identity Proofing process? Please email idproofing@mckerx.com or call 212-967-1944. Enabling and Verifying an EPCS Provider Why must a member of my practice first enable me in DxScript? The enabling part of the process is actually a first-line verification and can be performed by anyone in the practice whether a provider or not. It is as simple as Appointment Scheduler Don checking a box in DxScript to confirm that Provider Joan is actually a provider.
Why must an already-identity proofed provider verify me after a member of my practice does? This is the second part of the DEA and Symantec s verification process. Think of it like this: my colleague in the practice, Provider Roger, has already been fully checked with the same stringent identity process that I just went through. This gives Provider Roger an extra set of credentials to vouch that Provider Joan really is Provider Joan. If I am in a multi-provider practice, can I and another provider verify each other? Yes If I am in a multi-provider practice, can I or someone else verify more than one other provider? Yes, there is no limit What should I do if I am a single-provider practice? Your first step should be to go ahead and get your Identity Proofing out of the way. This will not differ regardless of your practice size. Next, check with other colleagues that practice in your area (or even in another state you may know). Perhaps one of them is already prescribing controlled substances and can verify you? Once you have identified an external provider to verify you, please follow the steps in the EPCS documentation provided. You (or a practice member) will basically be setting them up with a McKesson Practice Choice user account in Admin>External Providers. Once you click Save, the information will be transmitted to DxWeb, which will create a DxScript account for them to log in and verify you. Is there anything else I should know before choosing an External Provider? Yes, this provider should have also been previously identity proofed from Symantec and must have a DEA number. What should I give to the External Provider after we create a user profile for him/her in Admin>External Provider? We have written an email template and short guide for you to email this provider. The email will contain a web address, username and password to DxScript for the External Provider. The entire process for the External Provider to verify you in DxScript should take about five minutes. Will the External Provider be able to prescribe on behalf of my practice since they are given a DxScript login? No, DxWeb is creating a user account that only allows for provider verification. Prescribing Controlled Substances Do I have to install an app on my phone in order to receive the passcode needed to prescribe each controlled substance? No, the VIP app is optional and useful if you frequently prescribe in areas with limited or no cell phone connectivity. If this does not apply to you AND you do not intend to use the new DxScript
mobile app to prescribe on your phone, you do not need to download an app to receive the passcodes. After the External Provider verifies me, how long do I have to wait before e-prescribing controlled substances? None, you can begin right away! How will my prescribing process change? Whenever you attempt to send a controlled substance, you will be presented with a box to input your Symantec username and password. Upon submitting that, you will receive an expiring passcode on your token or mobile device. Do I have to input the Symantec username and password every time I prescribe a controlled substance? Yes, unfortunately this is a DEA requirement. However, DxWeb is working on an enhancement for the ability to prescribing multiple scripts per patient at one time, which should make this process a little easier.