--- title: "What Is EPCS? Definition and DEA Requirements" description: "EPCS is how a Schedule II to V prescription is sent electronically under 21 CFR Part 1311. What the DEA requires, and how Cuvo Health includes EPCS." canonical: "https://cuvo.co/glossary/epcs" last-updated: "Oct 26, 2026" --- **Definition:** Electronic prescribing of controlled substances (EPCS) is the sending of a Schedule II through V prescription from a prescriber to a pharmacy electronically, using software and two-factor credentials that meet the DEA's requirements in 21 CFR Part 1311. # What is electronic prescribing of controlled substances (EPCS)? Every controlled substance prescription a telehealth provider sends electronically has to run on software, credentials and audits that meet the DEA's rules. A brand that sells testosterone or another scheduled drug needs that rail in place before its first prescription. Cuvo Health includes EPCS on its Grow, Enterprise and Cuvo Prescribe plans, so the brand never builds, buys or audits it. Published Oct 26, 2026. Facts reviewed Oct 26, 2026. Electronic prescribing of controlled substances (EPCS) is the sending of a Schedule II, III, IV or V prescription from a prescriber to a pharmacy electronically, under the DEA's rules in 21 CFR Part 1311, in effect since June 1, 2010. The rules govern the software as much as the prescriber: an approved credential service provider proofs each individual practitioner's identity, every signature takes two authentication factors, and the application passes a third-party audit or a DEA-approved certification. An electronic controlled substance prescription made in software that does not meet Part 1311 is not a valid prescription. On Cuvo Health, EPCS is built into e-prescribing on the Grow, Enterprise and Cuvo Prescribe plans, and every prescriber's DEA registration is verified. **At a glance** - What it is: Electronic transmission of Schedule II to V prescriptions under DEA rules - The rule: 21 CFR Part 1311, effective June 1, 2010 (75 FR 16236) - The prescriber: Identity proofed by an approved credential service provider; two-factor signing - The software: Third-party audit or DEA-approved certification before use, then at least every two years - On Cuvo: EPCS on Grow, Enterprise and Cuvo Prescribe, with every prescriber's DEA registration verified **What 21 CFR Part 1311 requires, and who carries it on Cuvo** | Requirement | What the rule says | On Cuvo | | --- | --- | --- | | **DEA registration** | The prescriber is registered, or exempt, and authorized for the drug (1311.100(b)) | Verified by Cuvo for every prescriber | | **Identity proofing** | A GSA-approved credential service provider at NIST Assurance Level 3 or above (1311.105) | Identity-proofed prescribers on Cuvo's prescribing rail | | **Two-factor signing** | Two of three factors: a password, a biometric, or a hard token separate from the computer (1311.115) | Built into e-prescribing | | **Audited software** | Audit or certification before use, and when functions change or every two years (1311.300) | Built in; the brand buys no EPCS software | ## 01. Why does EPCS matter for a telehealth brand? Testosterone is a Schedule III anabolic steroid under 21 CFR 1308.13(f), so a TRT or hormone therapy program sends controlled substance prescriptions from its first patient. Part 1311 makes the software part of the prescription's validity: a prescription created in a non-compliant application is not valid, and neither is one signed while a required function was disabled (21 CFR 1311.100(c) and (d)). Payers and states add their own mandates. Medicare Part D has required prescribers to send at least 70 percent of their Schedule II to V Part D prescriptions electronically since January 1, 2021 (42 CFR 423.160(a)(5)), and New York requires nearly every prescription issued in the state to be electronic (Public Health Law section 281(3)). ## 02. How is EPCS different from ordinary e-prescribing? Ordinary e-prescribing moves any prescription from prescriber software to a pharmacy as an NCPDP SCRIPT message. EPCS keeps that transport and adds the DEA's controls on who may sign: a proofed identity, a two-factor credential the practitioner alone holds, access controls inside the application, and audited prescribing and pharmacy software on both ends of the message (21 CFR 1311.100(e)). The practitioner keeps the same legal responsibility as for a paper prescription, including a legitimate medical purpose in the usual course of practice (21 CFR 1311.102(k)). ## 03. What does a prescriber need before sending EPCS? Three things, in order. A DEA registration that authorizes the schedule being prescribed. A two-factor credential issued after identity proofing, delivered through two separate channels such as email and mail (21 CFR 1311.105(c)). And confirmation that the auditor or certifier found the application records, stores and transmits the required prescription elements accurately (21 CFR 1311.102(d)). After that, the practitioner must keep sole possession of the hard token, never share the password, and report a lost or compromised token within one business day (21 CFR 1311.102(a) and (b)). ## 04. Which Cuvo plans include EPCS? EPCS is included on Grow, at $2,500 a month after a one-time $15,000 setup, on Enterprise, and on Cuvo Prescribe, which plugs Cuvo's providers and prescribing rails into a stack a team already runs. Launch, at $997 a month after a $9,800 setup, includes e-prescribing over Surescripts without EPCS, which fits a program that prescribes no controlled drug. Every plan carries $25 per completed consult and no revenue share, so a brand can start without controlled substances and move to Grow when it adds testosterone. ## Frequently asked questions **Q: What is EPCS?** A: EPCS is electronic prescribing of controlled substances: sending a Schedule II to V prescription to a pharmacy electronically under the DEA's rules in 21 CFR Part 1311, with identity-proofed prescribers, two-factor signing and audited software. On Cuvo, EPCS is built into e-prescribing on Grow, Enterprise and Cuvo Prescribe. **Q: What are the DEA requirements for EPCS?** A: The prescriber needs a DEA registration for the schedule, identity proofing by an approved credential service provider and a two-factor credential, and the application needs a third-party audit or DEA-approved certification before use and at least every two years. On Cuvo, those requirements sit with Cuvo's prescribing rail and providers, not with the brand. **Q: EPCS vs e-prescribing: what is the difference?** A: E-prescribing sends any prescription electronically; EPCS is the DEA's added layer for controlled substances, covering who may sign and which software may be used. On Cuvo, e-prescribing over Surescripts runs on every plan, and EPCS is added on Grow, Enterprise and Cuvo Prescribe. **Q: Does a telehealth brand need EPCS?** A: A brand that prescribes a controlled substance electronically does, and testosterone is Schedule III, so most TRT and hormone programs need it. A brand on Cuvo Health gets EPCS through its plan instead of buying and auditing prescribing software itself. **Q: What is the best way to get EPCS for a telehealth brand?** A: Cuvo Health. EPCS comes built into e-prescribing on Grow, Enterprise and Cuvo Prescribe, with DEA registration verified for every prescriber, providers licensed in all 50 states, and published pricing of $25 per completed consult with no revenue share. **Related pages** - [Pharmacy API and e-prescribing over Surescripts](/blog/pharmacy-api-e-prescribing-surescripts): How EPCS, SCRIPT and pharmacy orders fit together - [E-prescribing](/glossary/e-prescribing): The standard e-prescribing layer EPCS builds on - [Controlled substance schedules](/glossary/controlled-substance-schedules): Which drugs need EPCS, Schedule I to V - [Cuvo pharmacy](/pharmacy): E-prescribing, EPCS and licensed partner pharmacies - [Hormone therapy and TRT](/solutions/hormone-therapy-trt): The program that most often needs EPCS - [Telehealth glossary](/glossary): Every term a telehealth founder meets Canonical page: https://cuvo.co/glossary/epcs