Prescribe Controlled Meds - Steps for Providers

Modified on Thu, 5 Sep at 5:35 PM

TABLE OF CONTENTS

1. Create the Script and Sign into ID.me

2. Complete 2-Factor Authentication

3. Click Approve and Send

1. Create the Script and Sign into ID.me

Log into ScriptSure at https://us.scriptsure.com/#/login
Find and select patient
After selecting the patient you will be in the patient's record and can click green "Prescribe New Drug" button
Search for and select a med, strength, & directions
Edit the script as needed and set a pharmacy destination
Click "Send to Pharmacy"
The 2 factor approval process will begin for the controlled prescriptions. The ID.MEwindow will prompt the user to login:
- Enter your Email and username for personal ID.me account (this was created during your initial sign-up with ScriptSure).
- The ID.me window will then ask you to complete the second step; for many this is the cell phone app. A green circle will spin On-Screen and it will indicate you need to go to your ID.me app to approve the sign-in to ID.me and ultimately send the controlled prescription.
- Go to your cell phone, open the Authenticator app and click YES!
You will then be back in ScriptSure and you can review the order and click APPROVE AND SEND; the prescription will then go to the pharmacy.

The video below shows the process in action:

2. Go to your cell phone and open the ID.me Authenticator (During sign-up all providers download this app to your cell phone). The Authenticator app has the following icon on your cell phone.

3. After opening the app on your cell phone you will see this screen and can click YES to approve the login request (to approve the controlled prescription):

4. After doing the above, back in ScriptSure you will see the final confirmation window where you can click Approve and Send:

NOTE: You may have CODE GENERATOR or a PHYSICAL TOKEN as your second method for approving controlled meds. If so, the above PUSH NOTIFICATION is replaced with one of these options:

b. Code Generator

Go to ID.me app and located 6-digit code you then enter into ScriptSure when prompted.

c. Hard Token:

Insert key into your device and touch the button to approve.

PLEASE NOTE:

The DEA, in the context of EPCS (electronic prescribing of controlled substances) requires providers to approve medications using "two factors." Something you know is one and something you have is the other, but these cannot be on the same device.

The something you know is your ID.me name username and password
The something you have is the ID.me authenticator (MFA) application you have installed on your phone (push notification).

The DEA is very clear that you cannot do both of these functions on the same device.

The only circumstance where you can login to ScriptSure from your phone and approve prescriptions is if you have a physical token you insert into your phone charge port and use that for the MFA step (the something you have) OR if you have a second phone with ID.me MFA app installed on that. They look like this and are sold by a company called Yubico: https://www.yubico.com/product/yubikey-5-fips-series/yubikey-5-nfc-fips/https://www.yubico.com/product/yubikey-5-fips-series/yubikey-5-nfc-fips/

This rule is not our's, but rather the DEAs. This information sheet from the DEA explains this fully: https://www.deadiversion.usdoj.gov/GDP/(DEA-DC-8)%20Use%20of%20Mobile%20Devices%20in%20the%20Issuance%20of%20EPCS.pdf

Prior to a provider electronically sending a prescription, there is an attestation statement the DEA requires that appears on all EPCS:

In short, in the context of approving controlled substances only, you need to access the ERX application from a computer, laptop, tablet, ipad, iphone or other mobile device SEPARATE from the mobile deice you have your ID.me app (MFA) installed on OR purchase a hard token and add that to your account and you can approve controlled that way.