Recordkeeping for electronic prescriptions for controlled substances

DEA requires that each registered practitioner apply to an approved credential service provider to obtain identity proofing and a credential. Hospitals and other institutional practitioners may conduct this process in house as part of their credentialing. For practitioners currently working at or affiliated with a registered hospital or clinic, the hospital/clinic have to check a government-issued photographic identification. This may be done when the hospital/clinic issues credentials to new hires or newly affiliated physicians. For individual practitioners, two people need to enter logical access control data to grant permission for practitioners authorized to approve and sign controlled substance prescriptions using the electronic prescription application. For institutional practitioners, logical access control data is entered by two people from an entity within the hospital/clinic that is separate from the entity that conducts identity proofing in-house. Similarly, pharmacies have to set logical access controls in the pharmacy application so that only authorized employees have permission to annotate or alter prescription records. Finally, if the electronic prescription or pharmacy application generates an incident report, practitioners, hospitals/clinics, and pharmacies have to review the incident report to determine if the event identified by the application represents a security incident.

The latest form for Recordkeeping for electronic prescriptions for controlled substances expires 2028-06-30 and can be found here.

Recordkeeping for electronic prescriptions for controlled substances (Practitioners)

Federal Enterprise Architecture: Law Enforcement - Substance Control