1. What is EPCS identity proofing and why does it exist?
Identity proofing is the one-time verification process that confirms a prescriber’s identity and DEA registration before they are allowed to e-prescribe controlled substances (Schedules II–V). It exists because a stolen DEA number on an electronic prescription is harder to catch than a forged wet signature on a paper pad — the system has to know, not trust, that the person behind the credential is real.
The requirement comes from 21 CFR 1311.105 and 1311.110, which mandate identity proofing to NIST SP 800-63 Identity Assurance Level 2 (IAL2) standards. In practice, that means an in-person or remote identity check conducted by a credential service provider (CSP) that the EPCS application has approved.
2. The nine steps of EPCS identity proofing
Start to finish, the process takes 1–5 business days. Most of the elapsed time is waiting for the CSP to schedule and complete the identity check; the prescriber’s active involvement is about 30–45 minutes total.
| Step | What happens | Who does it | Time | Documents needed |
|---|---|---|---|---|
| 1. DEA registration check | The EPCS application verifies the prescriber holds a valid, unexpired DEA registration. | Automated (the application) | < 1 minute | DEA number |
| 2. State licence verification | The application confirms the prescriber’s state medical licence is active and in good standing. | Automated or manual | < 1 day | State licence number |
| 3. NPI cross-reference | The NPI is matched against the NPPES registry to confirm the prescriber’s identity and taxonomy. | Automated | < 1 minute | NPI |
| 4. Identity proofing request | The prescriber initiates the identity-proofing process through the EPCS application and is routed to an approved credential service provider. | Prescriber | 5 minutes | None |
| 5. Document collection | The CSP collects a government-issued photo ID (passport, driver’s licence) and verifies it against the DEA and licence records. | CSP + prescriber | 10–15 minutes | Government photo ID |
| 6. Identity verification | The CSP conducts an IAL2-level identity check: knowledge-based authentication questions, biometric verification, or a live video identity interview, depending on the CSP. | CSP + prescriber | 10–20 minutes | Answers to KBA questions or biometric capture |
| 7. Credential issuance | The CSP issues a two-factor authentication credential (hard token or soft token) bound to the prescriber’s verified identity. | CSP | 1–3 business days | None (waiting) |
| 8. Token activation | The prescriber activates the two-factor token in the EPCS application and completes a test signing. | Prescriber | 5–10 minutes | The issued token or authenticator app |
| 9. EPCS activation | The EPCS application enables controlled-substance prescribing for the verified prescriber. | Application admin or automated | < 1 day | None |
The entire arc from step 1 to step 9 is typically 1–5 business days, with the bottleneck at step 7 (credential issuance). Prescribers who have been identity-proofed before with the same CSP may skip steps 5–6, reducing the timeline to 1–2 days.
3. What does EPCS identity proofing cost?
Typically $0–$150 per prescriber, depending on the EPCS application and CSP. Some platforms absorb the identity-proofing cost into their subscription; others pass through the CSP’s fee.
| Cost item | Range | Who pays |
|---|---|---|
| Identity-proofing fee (CSP) | $0–$99 per prescriber | Varies: some EPCS applications include it; others pass it through. Exprion, ID.me and similar CSPs publish their own schedules. |
| Two-factor token (if hardware) | $25–$50 one-time | Only if the CSP issues a physical token. Soft tokens (authenticator apps) are free. |
| Annual EPCS subscription (application) | $0–$600/year per prescriber | Some platforms include EPCS in the base subscription; others charge a per-prescriber add-on. |
| DEA registration (federal) | $888 for 3 years (as of 2026) | The prescriber — this is the DEA fee, not the identity-proofing fee, but it is a prerequisite. |
4. What causes identity proofing to fail?
Four things, all fixable:
| Failure | Why it happens | How to fix it |
|---|---|---|
| DEA registration expired | The registration lapsed and was not renewed. The DEA database reflects this immediately. | Renew at deadiversion.usdoj.gov. Processing takes 4–6 weeks; do not wait until identity proofing to discover it. |
| Name mismatch | The name on the photo ID does not match the name on the DEA registration or state licence exactly (maiden name, middle initial, suffix). | Update the non-matching credential. Marriage-related name changes on a DEA registration require a letter to the DEA field office. |
| KBA failure | The prescriber fails the knowledge-based authentication questions (credit-history-based questions about past addresses, vehicles, etc.). | Request a video-identity interview as an alternative pathway. Not all CSPs offer it; confirm before starting. |
| State licence issue | The licence is restricted, suspended, on probation, or shows a different state than the DEA registration. | Resolve with the state board. A restricted licence may not prevent identity proofing but may limit prescribing scope. |
5. How does the two-factor requirement work after proofing?
Every controlled-substance prescription must be signed with two independent factors: something you know (password or PIN) and something you have (token or biometric). This is not the same as login MFA — it is per-prescription signing required by 21 CFR 1311.115.
In practice: the prescriber reviews the prescription, enters their EPCS PIN, and approves with their token (a push notification, an authenticator code, or a biometric). The signing event is logged with a timestamp, the prescriber’s identity, and the prescription details. Each signing is auditable.
The two-factor credential lasts until revoked; it does not expire annually. But the DEA registration underneath it does expire (every 3 years), and an expired registration disables EPCS even if the credential is still active.
6. Do states add their own EPCS requirements?
Yes — and some states mandate electronic prescribing for all controlled substances, making EPCS not optional. The federal rule (21 CFR 1311) permits EPCS; state mandates require it.
As of September 2026, most states have either mandated EPCS or announced a mandate date. The requirements that states typically add on top of the federal process: a PDMP check before or at the time of prescribing, specific prescriber-training hours (commonly 2–3 CE hours on controlled-substance prescribing), and state-specific telehealth rules for the initial prescribing encounter.
State-specific prescribing rules that layer on top of EPCS are covered in our state guides where available — for example, prescribing TRT and GLP-1 in a Florida med spa.
7. Frequently asked questions
How long does EPCS identity proofing take?
1–5 business days from start to finish. The prescriber’s active time is about 30–45 minutes; the rest is waiting for the credential service provider to issue the two-factor token.
How much does EPCS identity proofing cost?
Typically between nothing (if the EPCS application absorbs it) and around one hundred fifty dollars per prescriber, including the CSP fee and a soft token. The DEA registration itself costs $888 for three years and is a prerequisite.
Do I need EPCS for GLP-1 prescriptions?
No — GLP-1 medications (semaglutide, tirzepatide) are not controlled substances. EPCS is required only for Schedules II–V. If the same practice also prescribes testosterone (Schedule III), EPCS is required for those prescriptions.
Can I use my existing authenticator app?
It depends on the credential service provider. Most modern CSPs support standard TOTP authenticator apps (Google Authenticator, Microsoft Authenticator, Authy); some issue their own app or a hardware token.
What if my prescriber has been identity-proofed before?
If the previous proofing was with the same CSP and the credential is still active, the prescriber may be able to transfer or re-activate it rather than going through the full process. Ask the EPCS application vendor before assuming a fresh enrollment is required.
Is this guide independent?
No — Aminova publishes it and its e-prescribing includes EPCS. The steps and costs are the federal requirements under 21 CFR 1311, verifiable against the regulation directly.