The Adoption and Increased Use of Electronic Prescribing of Controlled Substances

The opioid epidemic continues to be one of the most significant public health challenges in the United States. In 2018, the CDC reported 67,367 drug overdose deaths in the U.S.²  Both prescription opioids and illicit opioids accounted for 69.5% (46,802) of those deaths, with increases across age groups, racial/ethnic groups, urbanization levels, and multiple states.²  The CDC estimates the “economic burden” of prescription opioid misuse alone in the United States is $78.5 billion a year, including the costs of health care, lost productivity, addiction treatment, and criminal justice involvement.³  Approximately one-third of people who misused pain relievers in the past year (37.5 percent) indicated that they obtained pain relievers the last time through prescription(s) or stole from a health care provider, as shown in Figure 1.⁴  While organizations such as Health and Human Services (HHS), DEA and the CDC are leading the way to find solutions to address this public health crisis,⁵  many health care professionals are still using paper scripts for controlled drugs.⁶ 

To address the opioid epidemic, The Ryan Creedon Act (2011) was passed, and it amended the Controlled Substances Act (CSA) of 1970 by requiring practitioners to obtain particular training to meet standards established by HHS on controlled substance addiction and abuse, and appropriate use of such controlled substances.⁷  Originally, a written prescription for controlled substances signed manually by a provider was required as an attempt to prevent the misuse of controlled substances. Even with written prescriptions, concerns about fraud, patient safety and error rates continued. In 2010, the DEA published the DEA Interim Final Rule rule, giving practitioners the option of submitting prescriptions for controlled substances electronically.⁸  Electronic prescribing of controlled substances (EPCS) allows prescribers to electronically send an accurate and comprehensible prescription directly to a pharmacy through a secured network. Regulations set in place allow pharmacies to receive, dispense and archive these electronic prescriptions. Since this rule was passed, EPCS has increased every year. According to Surescripts, a nationally recognized health information network, the percentage of providers using EPCS went from 26% in 2018 to 38% in 2019.⁹  In 2018, there were 115.16 million electronic orders for controlled substances. This number rose to 159.77 million in 2019.⁹  Most recently, Congress passed the Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment (SUPPORT) for Patients and Communities Act to address the opioid crisis.¹⁰  The SUPPORT for Patients and Communities Act includes a provision requiring prescriptions for controlled substances covered by Medicare Part D to be transmitted electronically as of January 1, 2021.¹⁰ 

As electronic prescriptions for opioids increased by 36% from 2018 to 2019, overall opioid prescribing rates declined.¹¹  While EPCS is allowed nationally, each state is at a different stage of implementation. Thirteen states enacted e-prescribing requirements in 2019, with more than half of all states now requiring e-prescribing for opioids, all controlled substances, or all substances (Figure 2).¹²  EPCS is also utilized at different rates among specialties. The top five specialties using EPCS include Psychiatry (42%), Pain Management (40%), Family Practitioners (40%), Orthopedic Surgery (38%), Neurology (37%).¹¹ 

Under the DEA Interim Final Rule, an EPCS program is defined as: “A voluntary program that gives prescribers the ability to electronically sign and transmit Schedule II–V prescriptions to pharmacies. These pharmacies may then receive, dispense, and archive these electronic prescriptions.”⁸  For EPCS to be effective and usable, providers, software vendors, and pharmacies all have to take certain steps to integrate EPCS. Providers, software vendors, and pharmacies must: update e-prescribing software to meet all requirements specified in the DEA’s Interim Final Rule, enable SCRIPT messaging that supports EPCS, undergo a third-party audit to ensure the software meets all DEA EPCS requirements, and achieve certification for EPCS from an accredited health information network, and make their audit results available to that network along with a completed EPCS audit attestation form.¹³  For providers from solo or small practices (who have an individual DEA number) and providers from health system affiliated practices (who have a shared DEA number), the steps for EPCS adoption are similar. Like pharmacies and software vendors, the software used must be certified and approved to use for EPCS.¹³ 

The next step for the provider is identity (ID) proofing. ID proofing is done for prescribers via a third party by verification of prescriber, which may be face-to-face or online. For online ID proofing, a security question may need to be answered, and email scanned copies of government-issued documents, a photo ID, and the provider’s medical license are required.¹³  The provider then receives a credential that is used to authenticate EPCS.¹³  Next, the authentication of the EPCS is completed by a two-factor authentication for each prescription written. There are three basic options for two-factor authentication, and any two used together are sufficient for keeping sensitive information inaccessible from unauthorized users. Table 1 shows the three different options (a hard token, knowledge of a linked password, and stored biometric data) and examples of each.

The final step is to set up software access. This involves two separate people setting secure access controls for the provider’s EHR e-prescribing software.¹³  One person needs to be a DEA registrant who has been ID-proofed and has the two-factor authentication method in place — this can be the provider.¹³  The other is a person who can confirm the provider’s identity, such as an office manager or another member of the practice.¹³  Establishing secure access control for providers and pharmacies allows only the appropriately credentialed providers or pharmacy staff to have the ability to create or alter EPCS prescriptions. The secure network is then filled in by intermediaries (health information networks) between the provider EHR and the pharmacy electronic application (Figure 3). By this point, the provider is ready to send an EPCS to a pharmacy.

Implementing EPCS with an electronic health record (EHR) allows prescribers to access patient medical history, labs, possible allergic reactions and interactions with other medications when prescribing. It also promotes patient safety by potentially preventing fraud and diversion noted with paper opioid prescriptions. With up to 9% of opioid paper prescriptions linked to fraud or forgery, broad adoption of EPCS could have a significant impact on opioid prescribing.¹⁴  According to the DEA, EPCS will positively affect the following types of diversion: stealing prescription pads or printing them and writing non-legitimate paper prescriptions; altering a legitimate prescription to obtain a higher dose or more dosage units (e.g., changing a “10” to a “40”); phoning-in non-legitimate prescriptions late in the day when it is difficult for a pharmacy to complete a confirmation call to the practitioner’s office; and altering a prescription record at the pharmacy to hide diversion from pharmacy stock.¹⁴ 

EPCS, when used with an EHR, reduces errors compared to both handwritten prescriptions and non-EHR generated prescriptions. A 2016 retrospective review of 510 opioid prescriptions processed at an outpatient pharmacy aimed to determine the opioid prescribing patterns, rates of errors, discrepancies, and variation from ideal opioid-prescribing. At least one error occurred in 89% of handwritten prescriptions. The error rate of (EHR) computer-generated prescriptions was 0%. There was a 12% error rate in the non-EHR computer-generated prescriptions.¹⁵  Of the handwritten prescriptions, 87% of these prescriptions were noncompliant with DEA rules, and 46% lacked two patient identifiers, whereas 0% of EHR computer-generated prescriptions were noncompliant with DEA rules; they all included two patient identifiers.¹⁵ 

New York State passed a law on March 27, 2016, mandating practitioners to issue an electronic prescription for controlled substances in Schedules II through V and allowing a pharmacist to accept, annotate, dispense and electronically archive such prescriptions.¹⁶  There are certain exceptions in which a practitioner may issue an Official New York State prescription (ONYSRx) form, oral prescription or a fax of an ONYSRx.¹⁶  New York State serves as a model to access the impact EPCS has on prescription accuracy, rates of opioid prescriptions prescribed and quality of health care treatment. As of 2019, 98.5% of pharmacies, and 81.6% of prescribers in New York State use EPCS, and 88.3% of controlled substances are prescribed electronically in the state.¹⁷  From 2015 to 2016, a retrospective, single-center study with a pre-/post-test design was done to describe the opioid-prescribing patterns of emergency physicians after the introduction of the New York State EPCS mandate requiring EPCS.¹⁸  The results showed an absolute decrease of 724 (53%) opioid prescriptions (p < 0.0001), which is an absolute difference of 2.3%.¹⁸  There was a significant decline in the overall number of opioid prescriptions coinciding with the implementation of the New York EPCS mandate.¹⁸ 

A study published by the Drug Enforcement Administration (DEA) showed a reduction in the number of callbacks to clarify prescriptions, wait-time for patients picking up prescriptions and the overall cost of storage of paper records in pharmacies. The report signifies the annual cost savings in these parameters to be $439 million, $1.1 billion, and $1.4 million, respectively.⁸  From 2008–2009, Thomas et. al surveyed prescriber attitudes towards EPCS.¹⁹  102 prescribers were interviewed before EPCS implementation (expectation) and after implementation (experience).¹⁹  Questions of the Thomas, et al. survey included difficulty of security measures, the impact of EPCS on workflow, efficiency, practice management and patient safety.¹⁹  While 45% of providers expected that carrying a security token at all times would be a large inconvenience, only 10.3% found it to be so (p<0.001).¹⁹  Over half of the surveyed prescribers found EPCS to be easy to use (72.9%); to improve the accuracy of prescriptions (69.5%); to improve workflow (66.1%); to improve monitoring of medications (59.3%); to improve coordination with pharmacists (55.9%); and to lead to fewer calls to pharmacists (54.2%).¹⁹ 

Lack of financial support for implementation is a barrier reported by more than 80% of primary care physicians.²⁰  Additionally, the standards required by the DEA to ensure the privacy and security of EPCS, such as provider credentialing, certification of all components, two-factor authentication, data storage and auditing capabilities, can be costly to implement. Applying these measures for vendors was estimated by the DEA in 2010 to have potential costs from $43 million to $54 million, annualized over 15 years.²¹  The overall cost of EPCS for providers may vary and be a potential challenge to providers who write few controlled substance prescriptions.²² Table 2 shows the cost of EPCS for the most widely used EHRs.

Providers may feel burdened by EPCS security measures. In a 2009 survey with 246 providers of the Berkshire Health System in Massachusetts, prescribers expressed that keeping a hard token in possession at all times (35.3%), using a token or a flash drive with electronic signatures to authenticate and send all CS Rx’s (25.8%) and re-entering a password after computer screen timeout/brief period of inactivity (22.6%) would be a large inconvenience.²³  In the same survey, 58.9% of prescribers did not respond or rarely (once a week) responded to warnings such as drug-drug interactions.²³  From 2008–2009, Thomas, et al. surveyed prescriber attitudes towards EPCS. 38.4% of prescribers noted that the computer program used for EPCS was not always reliable, and 34.5% of prescribers said the flash-drive sized security token was hard to use.¹⁹ 

The National Ambulatory Medical Care Survey (NAMCS) analyzed the effects of PDMPs on the prescribing of opioid analgesics and other pain medications in ambulatory care settings at the point of care in twenty-four states from 2001 to 2010.²⁴  The NAMCS data sample included 26,275 ambulatory care office visits for pain.²⁴  Results showed that implementation of a PDMP was associated with more than a 30% reduction in the rate of prescribing of Schedule II opioids.²⁴  This reduction was seen immediately following the launch of the program and was maintained in the second and third years afterward.²⁴ 

Although integration of EPCS with PDMPs may be helpful, there is inconsistency in PDMP programs across states.²⁵  A cohort study published in 2016 by Dartmouth and UCLA researchers reviewed Medicare administrative data for fee-for-service disabled beneficiaries 21 to 64 years of age and eight types of state-specific laws, including PDMPs, surrounding prescription opioids to estimate how opioid outcomes varied according to these eight laws.²⁶  The percentage of beneficiaries with a prescription yielding a daily morphine equivalent dose (MED) of more than 120 mg did not decline after the adoption of a PDMP.²⁶  No meaningful reductions in the number of opioid prescriptions written in states adopting the eight laws were found.²⁶ 

This review from 1990–2020 yielded 28 references, including seven primary studies. The findings show the potential benefits of EPCS in error, fraud, overprescribing reduction and improvements in efficiency and financial impact. Challenges noted in the published studies focus on cost and technological burdens for providers.

While EPCS can be an independent system, linking it into the EHR system, and even a PDMP, can improve patient safety to reduce “doctor shopping,” over-prescribing, errors and opportunities for diversion compared to handwritten prescriptions. The Danovich, et al. study shows promise in EPCS’s role in reducing overprescribing but it is not clear if confounding variables were fully accounted for.¹⁸  As EPCS implementation continues in most U.S. states, further controlled studies could test the association between EPCS implementation and reduction in opioid overprescribing in a variety of health care settings. Additionally, educational programs about e-prescribing could help medical groups and providers address technical challenges and concerns. It is encouraging that surveys from the original test sites for EPCS in 2008 note that physicians are satisfied with the accuracy of prescriptions, improved work-flow and improvements in monitoring medications.¹⁹  However, more recent quantitative and qualitative research needs to be conducted to measure the effects of EPCS on prescription accuracy and quality of health care treatment.

Although we could find no research that reviewed the outcomes of CDS tools with EPCS, pairing Smartsets with a naloxone auto-injector could improve patient safety. In April 2014, the FDA approved a naloxone auto-injector designed for use by a layperson in a non-medical setting while awaiting an emergency response.²⁷  Researchers could evaluate how bundling naloxone medication devices with a Smartset for opioid prescriptions could mitigate the risks of overdose.

The CDC guidelines for safe and appropriate prescribing of opioids recommend that providers review the patient’s history of controlled substance prescriptions using PDMP data prior to prescribing.²⁸  In our review, the evidence is unclear whether combining PDMPs with EPCS reduces overprescribing. Preliminary research suggests that linking pharmacy benefit managers (PBMs), instead of just a PDMP, could be more helpful for providers to detect and reduce dangerous prescribing.²⁵ 

This review presented some limitations which prevented us from drawing conclusions based on the data given. Since EPCS is a novel system, few studies have been published that investigate the benefits and challenges of EPCS specifically. The lack of available and reliable data, combined with the lack of prior research studies on the topic, limits the currency and scope of our review. Of the seven primary studies reviewed, two were low quality, three were moderate quality and two were high quality. Of these seven studies, two were observational studies, three were comparative analyses and two were retrospective cohort studies.

Published research, as with Thomas, et al. (2013) measured the impact of EPCS on quality of care not directly through the patient record but through prescriber perceptions before and after implementation, potentially limiting the precision of the reported data. While Thomas, et al. (2012) conducted a survey on expectations and barriers towards EPCS involving various specialties, the survey included prescribers affiliated with a single health care system, resulting in possible biases. The analysis from Bao, et al. (2016) was restricted to PDMPs implemented in the period 2001–2010 and thus does not represent the most recent association of PDMPs on opioid prescribing rates. In Meara, et al. (2016), the subjects of the study were disabled fee-for-service Medicare beneficiaries, who have higher rates of opioid use, poverty and coexisting complex medical conditions than the general U.S. population, resulting in limited generalizability of the study. Bicket, et al. (2017), which analyzed errors and discrepancies in opioid prescriptions, has results that may not be generalizable to non-hospital-based pharmacies. Most of the research examined in this review focuses on EPCS in primary care settings. Search results did not yield studies about the effects of EPCS in specialty clinics.

EPCS is required for Medicare Part D patients in all U.S. states as of January 1, 2021.⁹  As of 2019, half of all U.S. states have mandates requiring EPCS, with more states potentially following (Figure 2).¹¹  Further research should evaluate the benefits and harms of EPCS on prescription accuracy, error reduction and prescriptions with additive risks, such as opioids and benzodiazepines together. With widespread utilization on the horizon with the new Medicare rules, research should evaluate the particular impact of EPCS on seniors, those with disabilities and end-of-life care.