Adding a Second User (Logical Access Controller) in ScriptSure -

Adding a Second User (Logical Access Controller) in ScriptSure

To complete the setup of your ScriptSure account, a second user must be added as an administrator. This step is required by the DEA for EPCS (Electronic Prescribing of Controlled Substances) and must be completed before you can prescribe controlled substances.

Why a Second User Is Required
The DEA requires that every prescribing account, whether in a group or solo practice, have at least two users. This second user is called a Logical Access Controller. Their role is to log in once to ScriptSure, review your profile, and click Approve next to your name. Until this approval occurs, you will not be able to prescribe controlled substances.

The DEA adopted this rule to ensure separation of duties: no single individual can grant themselves access to controlled substance prescribing. Two people must be involved in granting and maintaining prescribing privileges. This requirement comes directly from the DEA’s Interim Final Rule on EPCS:

• “DEA is adopting an approach to identity proofing (verifying that the user is who he or she claims to be) and logical access control (verifying that the authenticated user has the authority to perform the requested operation). The interim final rule provisions related to these two steps are based on the concept of separation of duties: No single individual will have the ability to grant access to an electronic prescription application or pharmacy application.” (75 Fed. Reg. 16242, March 31, 2010)

• “Once DEA registration and State authorization to practice and State authorization to dispense controlled substances have been verified, two people must be involved in entering the data to the application to identify those people authorized to indicate that a prescription is ready for signing and to sign controlled substance prescriptions.” (75 Fed. Reg. 16247)

• “All entries and changes to the logical access controls for setting the controls and for the controlled substance prescription functions must be defined as auditable events and a record of the changes retained as part of the internal audit trail.” (75 Fed. Reg. 16247–48)

Who Can Be the Second User
The second user does not need to be a prescriber or an employee. They can be:

• Nurse, office manager, or admin

• Colleague or business partner

• Spouse, friend, son, or daughter

Requirements:

• Must be added as both a Basic and Full Administrator in ScriptSure

• Must log in at least once and approve you as a prescriber

• Will not be charged for access

How to Add the Second User
Follow the steps in this ScriptSure support article: https://scriptsure.freshdesk.com/a/solutions/articles/69000832794

Once the second user receives their invite and sets up their login:

• They will be presented with an EPCS Review screen

• They must click Approve next to your name

• After this approval, you can begin prescribing controlled substances in ScriptSure

Key Notes

• This is usually a one-time setup unless you experience staff turnover

• The Logical Access Controller’s role is limited to this approval function, though they may also be set up to create prescriptions for your approval

• All changes to logical access controls are recorded in ScriptSure’s audit trail for DEA compliance

In short: every practice must add a Supporting User or Logical Access Controller (who can be another provider) as a second administrator in ScriptSure. Without this step, controlled substance prescribing will remain disabled.

Note: Vendor partners are able to compelte the EPCS Approval of providers in ScriptSure.  This can be done via the managment portal and by vendor admins.