IAL2 Requirements for Electronic Prescription of Controlled Substances

The healthcare industry continues to digitize in an effort to make patient care more accessible, equitable, and convenient. Today, more than 20% of adults use telehealth, allowing patients to connect with healthcare providers without an in-person appointment. As fully remote care becomes more common, it’s important providers adopt a flexible system of care that allows them to support each unique patient.

Here’s how the US Government’s Identity Assurance Level 2 standard helps to unlock fully remote care with the ability for practitioners to electronically prescribe controlled substances.

What is EPCS?

The Electronic Prescribing of Controlled Substances (EPCS) includes requirements that practitioners must follow to electronically issue a prescription for controlled substances. According to the latest EPCS requirements from the Drug Enforcement Administration, prescribers can receive the necessary credentials to remotely prescribe controlled substances to patients after completing identity-proofing at a NIST IAL2 level.  

What is IAL2?

The National Institute of Standards and Technology (NIST) developed digital identity guidelines that set the identity verification requirements for remote identity proofing. To meet NIST Identity Assurance Level 2 (IAL2) standards, an individual must complete multiple levels of identity proofing and verification to establish confidence in their real-world identity.

IAL2 Requirements for the Electronic Prescription of Controlled Substances

As part of the ECPS process, healthcare providers must use technology that can prove:

• The prescriber verified their identity;
• There is strong and substantial evidence that supports the prescriber’s identity; and 
• The prescription is unaltered.

To do this, healthcare providers must offer two types of identifying information: personal information (name, address, phone number, etc) and identifying evidence (driver’s license, passport, etc). The IAL2 service provider then verifies that the information is consistent with a genuine identity, the identifying evidence is authentic, and together, confirms the individual is the true owner of the claimed identity. 

In the case of an ECPS workflow, an IAL2 service provider would validate the authenticity of the driver’s license and verify that the practitioner is the rightful owner of that driver’s license. This is done by capturing a real-time selfie, which is then compared to the photo on the driver’s license. 

An individual with a genuine driver’s license that is not their own would fail verification because the photo on the license would not match their selfie. An individual using a fake driver's license would also fail because the authenticity of the license itself is checked. 

Each transaction must include a robust audit trail that documents each step of the verification process. This audit trail offers accountability and transparency in case of any disputes or legal issues. 

After the practitioner's identity is authenticated, best practice is to cryptographically bind each signer’s authenticated identity to the actions they subsequently perform – in this case, submitting a prescription – in order to produce a tamper-proof digital record.

Benefits of IAL2 Authentication

Key benefits of IAL2 authentication include:

• Reduced Fraud: IAL2 authentication significantly reduces the risk of pharmaceutical fraud, which is estimated to be $3.5 billion in losses annually. Healthcare providers, physicians, other practitioners, and patients are collectively protected in a system where only verified individuals with proper authorization can electronically prescribe controlled substances. ‍
• Continued Compliance: By adhering to IAL2 requirements, healthcare providers physicians, and other practitioners can maintain compliance with the Drug Enforcement Administration, Health and Human Services, and state-specific laws.
• ‍Inclusive Healthcare: Adopting IAL2 standards allows for more comprehensive remote healthcare. For example, an IAL2 workflow would allow practitioners in rural areas to obtain authentication and write prescriptions for controlled substances without the need for travel.‍
• Security and Integrity: As healthcare evolves to allow for greater remote care, IAL2 supports more immediate patient support without sacrificing the safety and security that are necessary when allocating controlled substances.
• ‍Trust and Confidence: Implementing strong authentication measures enhances the trust and confidence of all parties involved in the oversight and distribution of controlled substances. This includes healthcare providers and patients, as well as state and federal government agencies.