2-Factor Authentication (2FA) Options

ScriptSure allows providers to electronically send controlled substances (Schedule II–V) to pharmacies. This is called Electronic Prescribing of Controlled Substances (EPCS).

Before a provider can send a controlled prescription, they must set up an ID.me account. The ID.me setup process does two things:

1. Verifies the provider’s identity through ID.me Identity Proofing.
2. Allows the provider to select an authentication method for approving controlled prescriptions.
   
   

There are two primary options for EPCS approval:

1. Push Notification or Code Generator – ID.me Authenticator App

With this option, the provider installs the ID.me Authenticator app on their mobile phone.

When approving a controlled prescription, the provider receives a push notification or a code on the phone and uses the app to approve the prescription.

Important: The phone with the ID.me Authenticator app must be separate from the device being used to access ScriptSure.

2. Physical Token

A provider can also use a FIPS 140-2 compliant physical token for EPCS authentication.

These devices can be purchased directly from Yubico:

Yubico FIPS Security Keys

The physical token serves as the provider’s "something you have" authentication factor.

Important DEA Requirement: Two Factors

The DEA requires two separate authentication factors when approving controlled prescriptions.

The two factors are:

Something you know

• Your ID.me username
• Your ID.me password

Something you have

• The ID.me Authenticator app on your phone, or
• A compliant physical security token

⚠️ The two factors cannot be on the same device.

This means a provider cannot use the same phone to:

• Log in to ScriptSure, and
• Use the ID.me Authenticator app to approve the controlled prescription.

Can I Prescribe Controlled Substances Using My Phone?

Yes, but there are specific requirements.

A provider can access ScriptSure from a phone or other mobile device only if the second authentication factor is on a separate device.

There are two ways to do this:

Option A — Use a Second Phone

• Phone 1: Access ScriptSure and prescribe.
• Phone 2: ID.me Authenticator app receives the approval request.

Option B — Use a Physical Token

The provider can use a compliant physical security token as the second authentication factor.

This allows the provider to access ScriptSure from their mobile device while using the physical token for authentication.

For example, Yubico offers FIPS-compliant security keys such as the YubiKey 5 FIPS series:

YubiKey 5 FIPS Series – Yubico

DEA Requirement – EPCS Attestation

Before electronically sending a controlled prescription, the provider must complete the DEA-required attestation statement that appears during the EPCS approval process.

This is a required part of approving and electronically transmitting controlled prescriptions.

Quick Summary

In short:

For EPCS, the provider must use two separate authentication factors:

1. Something you know: ID.me username + password
2. Something you have: ID.me Authenticator on a separate device OR a compliant physical token

The requirement to use separate devices is a DEA requirement, not a ScriptSure-specific rule.

For additional details, refer to the DEA guidance on the use of mobile devices for EPCS:

DEA – Use of Mobile Devices in the Issuance of EPCS