EPCS and E-Prescribing Requirements for 2027 (What Small Practices Need)

Do You Need EPCS in 2027?

If you prescribe controlled substances, you almost certainly need electronic prescribing for controlled substances (EPCS) in 2027, but the reason is your state law or your Medicare Part D volume, not the DEA. The DEA rules in 21 CFR Part 1311 make EPCS allowed and set the security bar, while states such as New York, Texas and Florida require most controlled prescriptions to go out electronically. On top of that, the CMS EPCS Program requires at least 70% of a prescriber's Medicare Part D Schedule II to V prescriptions to be electronic, unless they wrote 100 or fewer.

For a small or direct primary care (DPC) practice, the practical question is less "is this required" and more "how do I get it set up once and stop thinking about it." This guide covers the three layers of rules (DEA, CMS and state), the exceptions and waivers, how identity proofing and two-factor login work, and what to ask your EHR vendor. It is a plain-language overview, not legal advice, so confirm the details for your state with your board or a health care attorney.

If you are still choosing an EHR for a new practice, the 2027 guide to starting a DPC practice and the DPC EHR comparison are good companions to this one.

EPCS Requirements at a Glance

Here is how the main rules stack up for a small practice.

What the DEA Requires (21 CFR Part 1311)

The DEA published its EPCS rule in 2010, and it lives in 21 CFR Part 1311. The rule does not require anyone to prescribe electronically. What it does is define what has to be true about the prescriber, the practice and the software before an electronic controlled substance prescription is valid. Most of the work falls on your software vendor, but four pieces involve you directly.

Identity proofing

Before you can sign controlled prescriptions, you need a two-factor credential from a credential service provider approved to do identity proofing at Assurance Level 3 under NIST SP 800-63-1, or from a certification authority cross-certified with the Federal Bridge, as set out in section 1311.105. In practice your EHR or e-prescribing vendor walks you through this with a partner service. You usually upload or show a government ID, answer identity questions, and receive your credential through two separate channels such as email and phone.

Clinicians who prescribe under a hospital's system can be proofed by the hospital's credentialing office instead, under section 1311.110. An independent DPC practice almost always goes the individual route.

Two-factor authentication

Each time you sign a controlled substance prescription, the software has to ask for two of these three factors, per section 1311.115:

• Something only you know, such as a password or a challenge answer.
• Something you are, such as a fingerprint or iris scan.
• Something you have, a device (a hard token) separate from the computer you are signing on.

A hard token has to meet at least FIPS 140-2 Security Level 1. For most small practices this ends up being a password plus a one-time code from an authenticator app on the prescriber's phone. The rule also makes the token personal. Section 1311.102 says the prescriber must keep sole possession of it, must not share it, and must report a lost or compromised token to the practice's access managers within one business day.

Logical access controls

At each registered location, the practice has to name at least two people to manage who can sign controlled prescriptions, and at least one must be a DEA registrant with their own two-factor credential, under section 1311.125. One of them verifies that each prescriber's DEA registration and state license are current. One person enters the permission and the second approves it.

For a solo DPC physician, that usually means the physician plus an office manager or nurse. Writing down who those two people are, and keeping the setup confirmation your vendor gives you, saves a scramble if anyone ever asks.

Third-party audit or certification of the software

Your e-prescribing application must have a third-party audit or certification showing it meets Part 1311 before it is used for controlled prescriptions, and again whenever controlled substance features change or every two years, whichever comes first, per section 1311.300. Section 1311.102 also asks the prescriber to confirm, before first use, that the auditor or certifier found the application meets the rule. Ask your vendor for its current EPCS audit or certification letter and keep a copy with your compliance files.

Does the Medicare Part D EPCS Rule Apply to DPC Physicians?

Section 2003 of the SUPPORT Act requires Schedule II to V controlled substance prescriptions covered under Medicare Part D to be sent electronically, subject to exceptions set by HHS. CMS runs this as the CMS EPCS Program. The CMS FAQ says compliance has been measured since calendar year 2023, each measurement year runs January 1 to December 31, and the program is not voluntary.

The part that surprises DPC physicians is who is included. The CMS requirement summary says a prescriber must comply if they issued controlled substance prescriptions under Medicare Part D in the measurement year, regardless of Medicare participation status. CMS measures this from Part D claims data, and nobody reports anything to CMS. So if you opted out of Medicare but your Medicare-age members fill controlled prescriptions through their Part D plans, those prescriptions count toward your total.

The 70% rule and the exceptions

To comply, a prescriber sends at least 70% of qualifying Part D Schedule II to V prescriptions electronically, or qualifies for an exception. CMS lists three exceptions in its At-A-Glance summary:

• Small prescriber exception, applied automatically to prescribers with 100 or fewer qualifying Part D controlled substance prescriptions in the year.
• Declared disaster exception, applied automatically to prescribers in an area CMS identifies as affected by a disaster or emergency.
• A CMS-approved waiver for circumstances beyond the prescriber's control, which you apply for after your compliance data is posted.

Prescriptions for beneficiaries in long-term care facilities will not count toward compliance until January 1, 2028, per the same summary. A faxed prescription does not count as electronic under the program, according to the CMS FAQ.

What enforcement looks like in 2026 and 2027

According to the CMS EPCS Program page, CMS began sending measurement year 2025 non-compliance notices in September 2026. Notices go by email when CMS has a current address in PECOS or NPPES, and by letter otherwise. Prescribers can look up their status on the CMS EPCS Prescriber Portal and submit a waiver application between September 16 and November 18, 2026 for measurement year 2025.

For 2027 planning, the useful takeaway is that the prescriptions you write during 2027 will be measured in a cycle that reports back in fall 2028. If your Medicare panel is growing, it is easier to send every control electronically from the start than to count prescriptions against the 100 line.

Exceptions and Waivers Under State Law

State mandates come with their own exceptions, and they vary. Texas is a good example of how detailed they get. Texas Health and Safety Code section 481.0755 allows a written controlled substance prescription in situations including a temporary technological or electronic failure, a prescription to be filled by a pharmacy outside Texas, when the prescriber and dispenser are at the same location or under the same license, and when the practitioner has a waiver under section 481.0756.

Texas also has an exception for when the prescriber can e-prescribe but reasonably decides the patient could not get the drug in time electronically and a delay would harm their condition. Waivers in Texas are granted by the prescriber's licensing board, so a physician would look to the Texas Medical Board's process.

If an e-prescription fails to reach the pharmacy, DEA rules also shape the backup. Under section 1311.170, a replacement paper prescription has to note that it was first sent electronically to a named pharmacy on a given date and that the transmission failed.

State E-Prescribing Mandates for 2027

State law is usually the rule that actually binds a cash-pay DPC practice, because it applies regardless of how the patient pays. A few large states show the range.

• New York requires prescriptions for both controlled and non-controlled substances to be sent electronically, a requirement that took effect March 27, 2016. The NYSED Office of the Professions and the New York Department of Health describe the exceptions and waiver process.
• Texas has required controlled substance prescriptions to be sent electronically since January 1, 2021, under section 481.0755, with the exceptions and waivers described above.
• Florida requires prescribers who keep an electronic health record system, or who prescribe as an owner, employee or contractor of a practice that does, to transmit prescriptions electronically, starting at license renewal or by July 1, 2021, whichever came first, under Florida Statutes section 456.42. Narrow exceptions apply, such as when the practitioner and the dispenser are the same entity.

Many other states have their own versions, and they differ in scope (all prescriptions or controls only), timing and waiver rules. Check your state board of medicine or board of pharmacy for the current text rather than relying on a national list, since those lists go stale. If you plan to dispense in-office, read the same-entity exceptions closely and see our guide to DPC dispensing of medications and labs. For the broader legal picture, DPC laws by state is a useful starting point.

PDMP Checks Are a Separate Step

EPCS covers how a prescription is signed and sent. Checking your state's prescription drug monitoring program (PDMP) is a different obligation, set state by state, and many states require it before prescribing opioids, benzodiazepines or other controls. Some EHRs and e-prescribing tools show PDMP results inside the prescribing screen, which makes it far easier to do both in one sitting.

We walk through a simple, repeatable routine in our controlled substance PDMP check workflow, including how to document the check so it is easy to show later.

Which DPC EHRs Offer EPCS?

Most EHRs that DPC practices use either build EPCS in or connect to an e-prescribing partner that handles identity proofing and two-factor signing. As of October 29, 2026, we found EPCS pages published by these vendors:

• DrFirst publishes an EPCS product page for its e-prescribing platform, which many EHRs embed.
• Charm publishes an eRx and EPCS page for its EHR.
• Elation publishes an EPCS FAQ and a how-to guide for prescribing controlled substances in its help center.

We did not verify current EPCS details for Akute, Cerbo, Atlas.md, Hint Clinical, DoseSpot or MDToolbox on their own pages today, so we are not making claims about them here. If you are evaluating any EHR, ask these questions on the demo call:

1. Is EPCS built in, or does it run through a partner such as DrFirst or DoseSpot?
2. Can you share your current DEA third-party audit or certification letter?
3. How does identity proofing work, how long does it take, and is there a separate fee per prescriber?
4. What second factor do you support (phone app, hard token, fingerprint)?
5. Does the prescribing screen show my state's PDMP data?
6. How do I set up the two-person access control, and can I export a record of it?

The DPC EHR comparison and best DPC software for 2027 cover the rest of what to weigh when picking an EHR. We have not listed EPCS prices because we could not verify any on vendor pages today, so ask for them in writing.

Telehealth Prescribing and EPCS

EPCS and telehealth rules overlap whenever you prescribe a control to a patient you see by video. The DEA's telemedicine flexibilities and any final special registration rule decide whether you can prescribe the control at all without an in-person visit, while EPCS and state mandates decide how the prescription is sent. A DPC practice that sees members across state lines also has to meet each patient's state rules on licensure and e-prescribing.

Our guide to telehealth prescribing rules for 2027 covers the DEA telemedicine timeline in detail. For e-prescribing itself, the safest default is to send every telehealth control electronically, since that satisfies most state mandates and counts toward the CMS 70% line.

A Setup Checklist for Small Practices

If you are opening a practice or turning on EPCS for the first time, this order tends to go smoothly:

1. Confirm your DEA registration and state controlled substance license (if your state has one) are current for your practice address.
2. Choose an EHR or e-prescribing tool and get its DEA audit or certification letter.
3. Complete identity proofing for each prescriber through the vendor's partner.
4. Set up the second factor on a device each prescriber keeps with them.
5. Name your two access managers and complete the two-person approval in the software.
6. Connect your state PDMP if the software supports it, and decide how you document checks.
7. Send a test prescription with your vendor's guidance and keep a copy of the setup records.
8. Put a yearly reminder on the calendar to check your CMS EPCS status if you prescribe to Medicare members.

The steps themselves are not hard, but they span several tools and people, and they are easy to lose track of when a new clinician joins or a phone with an authenticator app gets replaced. Tabflows is a dedicated tech team that connects the tools a clinic already uses, such as the EHR, billing and messaging, so follow-ups like credential renewals, access changes and PDMP documentation become tasks with an owner instead of things someone has to remember.

The Bottom Line

For 2027, EPCS is the default for any practice that prescribes controlled substances. The DEA sets the security rules (identity proofing, two-factor signing, two-person access control and audited software), your state usually sets the mandate, and the CMS EPCS Program adds a 70% Part D requirement that can reach opted-out DPC physicians once they pass 100 qualifying prescriptions a year. Set it up once with a vendor that can show its certification, keep your records, and pair it with a steady PDMP routine.

This article is general information, not legal advice. Rules change, so confirm current requirements with your state board, the DEA Diversion Control Division and the CMS EPCS Program before you rely on them.