1. What EPCS actually requires
EPCS is governed by 21 CFR Part 1311. It sets out what an application must do before a prescriber can transmit a controlled-substance prescription electronically, and the requirements are specific rather than aspirational: identity proofing of the prescriber, two-factor authentication at the moment of signing, logical access controls, an audit trail, and third-party certification of the application itself.
The last one matters most when you are shopping. The software must have been audited and certified for EPCS. A platform that integrates with a certified e-prescribing service inherits that; a platform that has simply built its own prescribing screen has not.
2. Identity proofing and two-factor — the part that surprises people
Every prescriber must be identity-proofed before they can send their first controlled-substance prescription. In practice that means a verification process and a credential, and it takes days rather than minutes. Clinics routinely discover this the week they planned to go live.
Then, at the moment of signing, two factors are required from separate categories — typically something you know plus something you have, such as a hard token or a push to a registered phone. This is a legal requirement, not a security preference, and it cannot be turned off for convenience. Budget the time for onboarding each prescriber, and start it before you need it.
3. Schedule II is different — and where systems get it wrong
Under 21 CFR 1306.12, Schedule II prescriptions may not be refilled. Full stop. A system that lets a staff member click "refill" on a Schedule II prescription is not merely inconvenient — it is inviting a dispensing event that should never have existed.
Worth checking specifically in a demo: does the software know the DEA schedule of each medication as a distinct, structured field, and does it use that to control the refill and transmission path? Systems that store the schedule loosely, or infer it from the drug name, are the ones that eventually route a controlled substance down the wrong path.
4. How to evaluate a vendor’s EPCS claim
Ask four questions. Is the EPCS certification held by you or by an underlying service, and which one? What is the identity-proofing process and how long does it take per prescriber? What second factor is supported? And can you show me, in the demo, a Schedule II prescription being blocked from refill?
A vendor comfortable with EPCS will answer all four immediately. A vendor who redirects to a partner or gets vague about certification is telling you that this was not built for prescribing clinics.
5. What it costs, and how it is usually priced
EPCS is typically priced per prescriber rather than per clinic, often with a platform fee underneath. That is normal — the underlying service and the identity proofing are genuinely per person. What is worth watching is whether the EMR adds its own margin on top, and whether non-prescribing staff are charged for a capability they cannot legally use.
Ask for the number per prescriber per month, all in, and confirm that your medical assistants and front desk do not appear on that line.
6. Where Aminova fits
Aminova treats controlled-substance prescribing as core rather than an integration, because for a TRT or hormone clinic it is the main clinical activity rather than an edge case. E-prescribing with EPCS is built in, the DEA schedule is stored as a structured field that governs the transmission path, and refill rules follow the schedule rather than a free-text note.
Around it sits the rest of what a prescribing clinic needs: inventory with lot and expiry tracking for compounded and temperature-sensitive product, protocols and injection cadence, lab ordering with trendable results, and a white-label patient app under your own brand — all under a signed BAA.
7. Frequently asked questions
What is EPCS?
Electronic Prescribing of Controlled Substances — the DEA-regulated ability to transmit a prescription for a scheduled medication electronically instead of on paper. It is governed by 21 CFR Part 1311 and requires prescriber identity proofing, two-factor authentication at signing, and third-party certification of the software.
Can I prescribe testosterone through any EMR?
No. Testosterone is a Schedule III controlled substance, so transmitting the prescription electronically requires EPCS specifically. An EMR with ordinary e-prescribing cannot legally send it, which is why this is the first question a TRT clinic should ask any vendor.
Why do I need two-factor authentication just to sign a prescription?
Because 21 CFR 1311 requires it, using two factors from separate categories. It is a regulatory requirement rather than a vendor security preference, and it applies at the moment of signing rather than at login.
Can a Schedule II prescription be refilled?
No. 21 CFR 1306.12 prohibits refills on Schedule II prescriptions entirely; each fill requires a new prescription. Any software that presents a refill option on a Schedule II item is a genuine risk, and it is worth testing that specific case during a demo.
How long does EPCS onboarding take?
Plan for weeks rather than days per prescriber. Identity proofing is the long pole and it cannot be rushed or delegated, so start the process well before your intended go-live date.