1. Electronic Prescription of Controlled Substances
Sean P. Kelly, MD

2. Agenda Why EPCS matters & drivers of adoption Regulatory overview
Best practices
Benefits and discussion

3. Why EPCS Matters?

4. Combat a national public health epidemic
Drug overdoses kill more people than motor vehicle crashes
480 million opiate Rx’s in 2014
47,055
32,675
Source: CDC U.S. Population Mortality Data 2014

5. Combat a national public health epidemic
More deaths from prescription drugs than cocaine and heroin combined
Source: CDC

6. Leverage Proven Technology Already in Place
1.5 billion in 2015
95% pharmacies 60% prescribers
Billions of Rx’s
12.8 million in 2015
766+% YOY growth
1.5B e-Rx were sent in 2015
Nationally 60% of all prescribers sent an eRx in the last 30 days
Nationally 95% of all pharmacies received an eRx in the last 30 days3
Data from Surescripts, the national health information network, through March 31, 2016

7. NY State I-STOP Legislation
“Internet System for Tracking Over-Prescribing”
All prescribers must check PDMP prior to Rx
All prescriptions electronic as of March 27, 2016
Catalyst for change and acceleration of software development

8. Virginia State Law Allowing EPCS
18VAC Electronic Transmission of Prescriptions from Prescriber to Pharmacy.
A. Unless otherwise prohibited by law, an electronic prescription may be transmitted from the prescriber or an authorized agent as defined in § C of the Code of Virginia directly to the dispensing pharmacy. Electronic prescriptions of Schedule II-V controlled substances shall comply with any security or other requirements of federal law. All electronic prescriptions shall also comply with all security requirements of state law related to privacy of protected health information.
B. A pharmacy receiving an electronic prescription shall maintain such prescription record in accordance with 18VAC A.
C. An electronic prescription shall be transmitted only to the pharmacy of the patient's choice.

9. Virginia Prescription Monitoring Program (PMP)
July 1, 2016
Check PMP for any opiate Rx > 14 days
Exceptions
Non-refillable Rx’s after surgery/invasive procedure
Hospice or palliative care
Inpatient treatment
Assisted living or nursing home patients
PMP non-operational
Provider unable to access PMP due to emergency or disaster

10. Address the challenges of paper prescriptions
Non-Controlled Substances
Controlled Substances
58% of prescribing transactions involve at least one controlled substance
Increased risk of DEA number theft, fraud, and drug diversion
Hydrocodone reclassification
increases volume of prescriptions
for controlled substances
Inefficient dual workflows cause frustration and dissatisfaction for providers and patients
Meeting Meaningful Use e-prescribing requirements at Risk
Historically, the workflow deemed most secure and best for patient safety is using paper-based prescriptions, either hand-written or printed from the EMR. But there are significant challenges to paper prescriptions for patients, providers, pharmacists and hospital administration. For example:
Providers:
Forced to deal with inefficient, frustrating dual prescribing workflows, often reverting instead to a single, paper-based workflow in the name of efficiency.
DEA number is exposed to potential fraud--in fact, our studies show that about 1 in 10 physicians admit to having their DEA number stolen. This fuels America’s prescription drug abuse epidemic, which claimed the lives of more American’s in 2013 than cocaine and heroin combined.
Patients
Requiring paper prescriptions means more frequent doctor visits and enduring long waits at pharmacies; both of which can be very frustrating, especially for chronic pain patients.
There is also an increased risk patients won’t fill their prescriptions, and paper increases the possibility of inaccuracies or mistakes
Hospital Administration
Meaningful Use e-prescribing targets could be at risk. The volume of prescriptions for controlled substances continues to increase, especially given the reclassification of hydrocodone combination drugs like Vicodin to Schedule II, which puts tighter controls on how these can be prescribed. This exacerbates the inefficiencies of dual workflows and providers are likely to revert to a single, paper-based workflow for prescribing as a matter of efficiency, which can hurt MU e-prescribing numbers. We have one customer in New York that has seen a 23% increase in e-prescribing rates for non-controlled substances as a result of implementing EPCS with just 1/3 of its providers live thus far. This indicates that the single, e-prescribing workflow for all medications helps boost overall e-prescribing rates and can help meet MU goals.
There is also a significant patient safety issue associated with drug diversion, fraud and prescription medication abuse. In 2013, more than 23,000 Americans died from prescription drug overdoses, which was more than from overdoses on cocaine and heroin combined.
For you, IT, this means you are dealing with frustrated providers, dissatisfied patients, and a leadership team needing to deal with solving a public health epidemic.
(Challenger Choreography)
Warmer – building credibility by reading their mind, demonstrating empathy
These are pressure points for the stakeholder

11. DEA Requirements for EPCS

12. DEA Requirements for EPCS

13. DEA-compliant authentication options
Something
you are
Something you have
you know
Fingerprint Biometrics
Hands Free Authentication
Push
Notification
Soft
Token
Hardware
Password

14. Tokens One Time Pin (OTP) tokens Hard token (key fob)
Soft token (secure app)

15. Push token notification
Fast, convenient authentication from a mobile device
Improve efficiency for remote e- prescribing workflows
Eliminate the need for providers to carry hardware tokens and/or manually enter passcodes
Certified as DEA-compliant for EPCS

16. Hands Free Authentication
Automatically completes one factor of the two-factor authentication
Provider simply enters order and scans fingerprint
1. Provider places EPCS order
2. Provider scans fingerprint* First factor
Hands Free Authentication automatically retrieves token code from provider’s mobile phone Second factor
4. EPCS order complete
Here is how Hands Free Authentication works
Leverages low power and low range wireless technology to securely retrieve the OTP code using a DEA compliant cryptographic algorithm
Uses context (EMR login/first-factor) to identify specific prescriber’s mobile phone to request OTP code from
If unable to retrieve wirelessly, prompts prescriber to enter OTP code shown on phone manually (same as soft token)
* or enters password if biometric not available

17. To learn more about EPCS
Additional Resources
To learn more about EPCS
Questions

19. Appendix

20. Benefits of EPCS

21. Improve patient safety and satisfaction
Tighter controls over drug diversion and fraud
Single, convenient way for patients to get all their medication
Prescription sent to the patient’s pharmacy of choice
No waiting for the prescription to be filled
Fewer trips to the hospital/clinic for refills

22. Benefits for providers: a single, efficient workflow
Integrates directly with EMR e-prescribing workflows
Supports broad range of DEA- approved authentication methods
Presents only the authentication methods available and allowed
An important differentiator for Imprivata Confirm ID is that it is truly designed from the clinical perspective. Even if providers want EPCS and agree that it is far more convenient than paper-based prescriptions, if the EPCS is difficult or inefficient, they are unlike to adopt it.
Imprivata Confirm ID integrates with the e-prescribing workflow of leading EMRs and is called when the provider is prescribing a controlled substance. This means no extra clicking or navigating to a different system, which saves time and keeps the provider focused on the patient.
Imprivata Confirm ID also supports multiple DEA-approved two factor authentication modalities for prescription signing. This includes fingerprint biometrics, hard and soft tokens, and Imprivata hands free authentication.
The EMR integration and the support for multiple two-factor authentication modalities are very important because they

23. Benefits for IT: low total cost of ownership
Release: Tokyo
Benefits for IT: low total cost of ownership
One system of EPCS deployment for multiple EMRs
One identity proofing event
One set of credentials to enroll
One central system for reporting
The complete solution for identity proofing, supervised credential
enrollment, two-factor authentication, and auditing & reporting
From an IT perspective, Imprivata Confirm ID helps IT meet the DEA requirements for EPCS in a cost-effective, efficient and easy-to-manage way. Imprivata Confirm ID supports multiple EMR systems, so if your organization uses a more than one EMR, you only need to deploy Imprivata Confirm ID once. This gives providers a consistent experience which will drive satisfaction and adoption.

24. Benefits to Legal & Compliance: Reducing Risk
Supports DEA and State Regulations
Validated by independent DEA auditor
Supports DEA mandated identity proofing
Enforces FIPS-compliant authentication factors
End to End Auditing and Reporting
User activity for signing transactions, including workflow, modality and device
Admin activity tracks policy changes and overrides
Configurable audit record retention (NY’s I-STOP law requires five years)
Anurag

25. Imprivata Confirm ID customers
Release: Tokyo
Imprivata Confirm ID customers

26. Cambridge Health Alliance
Why EPCS?
Increase patient safety
Improve prescribing workflows
Why Imprivata Confirm ID?
Hands Free Authentication
Seamless EMR integration (Epic)
Comprehensive solution to meet DEA requirements and drive physician adoption

27. Why Imprivata Confirm ID?
Kelsey-Seybold
Why EPCS?
Eliminate dual work
Improve patient safety
Why Imprivata Confirm ID?
Single, comprehensive platform
Individual identity proofing
Seamless EMR integration
Imprivata’s EPCS expertise
EPCS

28. Imprivata Confirm ID customers
These are just a few Imprivata Confirm ID customers.

29. 1,200 3m About Imprivata healthcare organizations care providers
Healthcare Informatics
2015 Leading Edge Award for Workflow Enhancement 3m
care providers
Imprivata is a leading provider of authentication, access management, secure communications solutions. Recently we acquired HT Systems and its Patient Secure technology, which some of you may know is a palm vein biometric based patient identification solution.
We have more than 1,200 healthcare customers globally, and more than 3 million care providers rely on Imprivata solutions. And this is for a reason: Imprivata has the mission making sure that their customers are successful with their solutions. In fact Imprivata OneSign recently won a Leading Edge Award from Healthcare Informatics Magazine as the best solution for clinical workflow enhancement.

30. Premier healthcare customer footprint
IDN
Academic
Community
Clinics / Specialties
International

31. The challenge of dual prescribing workflows
38% of patient interactions in which prescriptions are written include mix of controlled & non-controlled substances
What does this mean?
Providers have to switch between electronic and paper, creating inefficiency and dissatisfaction
Providers may revert to a single, paper- based workflow, which could impact Meaningful Use
We surveyed physicians across the U.S. to understand their prescribing habits and the impact that dual workflows have on e-prescribing rates. We found that 59% of prescriptions involve controlled substances and 38% of the time physicians prescribe medications, there is a mix of controlled and non-controlled substances involved. If they are not using EPCS, this means that each one of these instances could involve two workflows – e-prescribing for non-controlled substances and paper-based for controlled substances.
This magnifies the challenges of having dual workflows and providers may revert to a single, paper based workflow for all medications for the sake of efficiency. If this happens, e-prescribing utilization and possibly Meaningful Use targets are at risk.

32. Impact of hydrocodone reclassification
Hydrocodone combination drugs (i.e., Vicodin) now Schedule II, placing tighter controls on prescribing:
No refills
No verbal/faxed orders
Potential 68% increase in number of prescriptions written for controlled substances, exacerbating challenges of dual workflows
As mentioned, compounding the challenges of dual prescribing workflows and potentially impacting Meaningful Use numbers is the DEA’s reclassification of hydrocodone combination drugs such as Vicodin to Schedule II controlled substances.
The reclassification puts tighter controls on how and how often these medications can be prescribed. For instance, no refills are allowed and prescriptions cannot be called or faxed to the pharmacy. These are among the most-prescribed medications in the U.S. with about 136 million prescriptions written in 2013, which means that the number of original prescriptions written for these medications will increase significantly,.
Based on a survey we conducted of physicians about the impact of the reclassification, the number of original prescriptions for these medications is expected to increase from 7 to nearly 18 per provider, per week. Controlled substances will increase from 21% to 31% of all prescriptions, which translates into a 68% increase in the number of original prescriptions for controlled substances that physicians will need to write each week.
In fact, we have a customer in California—Contra Costa Regional Medical Center—that accelerated its EPCS implementation when the reclassification was announced because the CMIO knew what a significant impact it would have on his clinical staff.

33. Identity proofing – individual
Imprivata Confirm ID performs NIST Level 3 identity-proofing of practitioners using social security number, date of birth, credit card information, valid address and mobile or home phone number
Credential Service Provider
Imprivata Confirm ID registers and issues tokens to practitioners via two channels
Practitioners can optionally self-enroll fingerprints with Imprivata Confirm ID
Imprivata Confirm ID automatically creates records of enrollment of credentials
Synchronizes Imprivata Confirm ID with AD accounts of practitioners
Information Technology
AD accounts must include the full legal name of practitioners and valid addresses
EMR Administrators must be a different entity/group than the Credential Service Provider
EMR Administrator
Sets EPCS access for practitioners in an EMR that has been certified for EPCS
Approvers must be a different group than the EMR Administrators and are required to be DEA registrants
EPCS Access Approvers
Approves EPCS access for practitioners in the EMR using Imprivata Confirm ID two factor authentication 
EPCS
For individual identity proofing, Imprivata Confirm ID integrates with Symantec to enable the credentialing service provider, or CSP, process. This includes the NIST assurance level 3 identity proofing, registration of tokens for providers, and issuance of the two-factor authentication credential to provider. Imprivata Confirm ID also gives the DEA registrant at the hospital or practice the two-factor authentication credentials necessary to sign the approval of a provider’s credential’s for EPCS, as mandated by the DEA.

34. Identity proofing - institutional
Synchronizes Imprivata Confirm ID with AD accounts of practitioners and enrollment supervisors
Information Technology
Synchronizes Imprivata Confirm ID with AD accounts of enrollment supervisors and assigns enrollment privileges
Verifies practitioners are licensed and allowed to prescribe controlled substances
Medical Credentialing Office
Creates a list of practitioners that are allowed to electronically prescribe controlled substances
Creates a list of users that can approve EPCS access in the EMR
Creates a list of supervisors that are authorized to witness enrollment of practitioners in Imprivata Confirm ID
EMR Administrators must be a different entity/group than the Medical Credentialing Office
EMR Administrator
Sets EPCS access for practitioners in an EMR that has been certified for EPCS
Supervisors do not have to be DEA registrants and can be individuals from IT, clinical or hospital administration
Enrollment Supervisors
Verifies photo IDs of practitioners match those on the list from the Medical Credentialing Office
Issues two-factor credentials to practitioners and supervises enrollment of credentials in Imprivata Confirm ID
Imprivata Confirm ID creates records of IDs verified and enrollment of credentials
Approvers must be a different group than the EMR Administrators and do not have to be DEA registrants
EPCS Access Approvers
Approves EPCS access for practitioners in the EMR (does not require two factor authentication) 
EPCS
One of the first steps to EPCS enablement is identity proofing. The DEA requires care providers to complete an identity proofing process before they can be enabled for EPCS. This step ensures the provider is who they claim to be, they are authorized to prescribe controlled substances and they are given the necessary credentials to be enrolled in an EPCS system.
The DEA allows institutional and individual identity proofing for EPCS, both of which are supported by Imprivata Confirm ID.
If an organization chooses institutional identity proofing, Imprivata Confirm ID helps streamline some of the process by issuing the two-factor authentication modalities for a provider as approved by the organization’s credentialing office. Imprivata Confirm ID also automates the enrollment of those credentials into the EPCS or other workflow/application requiring two-factor authentication. To satisfy auditing and reporting requirements, Imprivata Confirm ID also creates a record of the issuance of the credentials.

35. Institutional ID Proofing & Credentialing
Forms of identity checked are stored
IT will not need to create a manual process to store identities checked
Enrollment Supervisor can take notes within Imprivata Confirm ID
IT will not need to create a manual process to store notes
Reports created for what forms of ID and notes entered
IT can easily produce reports if audited

36. Supervised Enrollment
Depending on User preference User Accounts can have a combination of Signing policies:
Fingerprint
Password
One Time Password (token)
Hands Free Authentication
Admin and User will sit together through enrollment

37. Supervised Enrollment
Supervisor witnesses to the Provider enrolling credentials

38. Imprivata Confirm ID benefits for IT
Release: Tokyo
Imprivata Confirm ID benefits for IT
Leverages the Imprivata platform
Supports Imprivata OneSign and Imprivata Confirm ID
Appliances, biometric devices, tokens etc. span multiple Imprivata Solutions
Ease of deployment
Imprivata Agent supports Imprivata OneSign and Imprivata Confirm ID
One agent to maintain on every end point
No extra software to be installed on the end points
Ease of maintenance
One admin console to manage all Imprivata products

39. Auditing and reporting
Enhanced auditing of user and admin activity
User activity for signing transactions, including workflow, modality and device
Admin activity tracks policy changes and overrides
Configurable audit record retention
Imprivata Confirm ID offers detailed reporting capabilities to establish a secure, auditable chain of trust for the entire EPCS process. Imprivata Confirm ID helps organizations demonstrate compliance with DEA and state-level EPCS requirements by delivering comprehensive reports that document the identity proofing, supervised enrollment and prescription signing processes, including any failed transmissions, unauthorized access attempts and other potential discrepancies. Imprivata Confirm ID also stores records for at least two years to meet DEA specifications, but organizations can customize based on their state requirements (for example, New York’s I-STOP requires that records are kept for five years).

40. Benefits to Legal & Compliance: Reducing Risk
Supports DEA and State Regulations
Validated by independent DEA auditor
Supports DEA mandated identity proofing
Enforces FIPS-compliant authentication factors
End to End Auditing and Reporting
User activity for signing transactions, including workflow, modality and device
Admin activity tracks policy changes and overrides
Configurable audit record retention (NY’s I-STOP law requires five years)
Anurag

41. Two-factor authentication considerations
This chart compares the different two-factor authentication options for EPCS and the benefits/challenges of each, which helps understand the importance of selecting the best two factor authentication methods to meet their providers’ needs.

42. Two-factor authentication considerations
Use Case/Workflow
Examples
Password
FIPS Compliant Biometric
FIPS Compliant Token
Value/ Differentiation
Relative Speed & Convenience
Hard/Soft
Hands Free Authentication
Physician prescribing in patient exam room (shared workstation) or
Physician prescribing in their office (dedicated workstation) X
Fastest authentication – touch and done
No disruption to workflow 5
Fast – type password and done
Minimal disruption to workflow 4
Fast – type password and touch finger
Slower than Hands Free Authentication, but fastest workflow when it is not available 3
Slow – type OTP code from token and touch finger 2
Slowest– type password and type OTP code from token
Most disruptive to workflow 1
Physician prescribing in hospital on Windows Tablet (managed)
Typically not available on mobile devices

43. Hands Free Authentication components
(Required in addition to Imprivata Confirm ID)
Imprivata ID
Imprivata ID iPhone App
Downloaded from Apple App Store and activated on user’s phone
Hands Free Authentication subscription/license
Add-on to Imprivata Confirm ID license
Imprivata ID USB Receiver
Encrypted, secure communications channel only accessible to Hands Free Authentication application
Deployed on each Hands Free Authentication enabled end-point
Low power, very compact, plugs into USB port
Symantec VIP or NSL subscription/license*
Required for iPhone App, DEA compliance
* Many Imprivata Confirm ID customers will have already widely deployed Symantec tokens which can be transferred for use with Hands Free Authentication

44. Hands Free Authentication supported configurations
Hands Free Authentication feature of Imprivata Confirm ID 1.1
Workaround if Endpoint not enabled
Phone
iPhone 4S and later
Phone OS
iOS 8.x
Tokens (FIPS Compliant)
Symantec VIP Tokens
Symantec NSL Tokens (includes VIP)
USB Receiver
Imprivata ID USB Receiver
Enter token code manually (just like a soft token)
Endpoints
Windows 7 & 8
Windows Embedded
VDA integration
With a Windows Agent on endpoint:
Citrix XenApp, XenDesktop
VMware View
EMR
All the EMRs which Imprivata Confirm ID supports, that also support tokens
Sales and SEs refer to the Supported Configurations guide for full details