E-Prescription Certification & Compliance Requirements

OverviewCopy Anchor Link

This document outlines all certification, registration, and compliance requirements for implementing e-prescribing functionality with Surescripts network integration. Follow these steps sequentially to ensure proper certification and legal compliance.

Certification Timeline OverviewCopy Anchor Link

1. NCPDP Provider ID RegistrationCopy Anchor Link

What is NCPDP?Copy Anchor Link

National Council for Prescription Drug Programs - assigns unique identifiers to pharmacies and providers for e-prescribing.

Registration ProcessCopy Anchor Link

1. Visit: https://www.ncpdp.org/
2. Apply for Provider ID:
   • Cost: $195 initial fee + $95 annual maintenance
   • Processing time: 5-7 business days
3. Required Information:
   • Business name and structure
   • Tax ID (EIN)
   • Physical address
   • Contact information
   • Provider types in practice

Required DocumentsCopy Anchor Link

• Business license
• Tax identification documents
• Provider licenses for all prescribers
• Proof of physical address

2. Surescripts Certification ProcessCopy Anchor Link

Step 1: Initial Registration (Week 1-2)Copy Anchor Link

Create Surescripts AccountCopy Anchor Link

1. Visit: https://surescripts.com/get-started/
2. Select "Health IT Vendor" application
3. Complete vendor application form

Required InformationCopy Anchor Link

• Company legal name
• NCPDP Provider ID (once obtained)
• Technical contact information
• Business contact information
• Estimated prescription volume
• Target go-live date

Step 2: Legal Agreements (Week 2-3)Copy Anchor Link

Agreements to SignCopy Anchor Link

1. Network Agreement: Legal terms for network access
2. Business Associate Agreement (BAA): HIPAA compliance
3. Service Level Agreement (SLA): Performance standards
4. Pricing Agreement: Transaction fee structure

Typical CostsCopy Anchor Link

• Setup Fee: $5,000 - $10,000
• Annual Fee: $3,000 - $5,000
• Transaction Fees: $0.10 - $0.25 per prescription
• Testing Environment: Often included

Step 3: Technical Integration (Week 3-14)Copy Anchor Link

Implementation RequirementsCopy Anchor Link

1. Message Standards:

   • NCPDP SCRIPT Standard 2017071
   • XML message format
   • Required and optional fields

2. Security Requirements:

   • TLS 1.2 or higher
   • Digital certificates (X.509)
   • Message encryption
   • IP whitelisting

3. API Integration:

   Copy Text

   Endpoints Required:
   - /prescriptions/send
   - /prescriptions/cancel
   - /prescriptions/status
   - /pharmacy/search
   - /eligibility/check (optional Phase 1)
   - /formulary/check (optional Phase 1)

4. Required Capabilities:

   • NewRx (new prescriptions)
   • RxChangeRequest (modifications)
   • CancelRx (cancellations)
   • RefillRequest (refills)
   • RxFill (status updates)

Step 4: Testing & Validation (Week 15-20)Copy Anchor Link

Test ScenariosCopy Anchor Link

1. Basic Prescription Flow:

   • Create new prescription
   • Send to test pharmacy
   • Receive acknowledgment
   • Cancel prescription

2. Error Handling:

   • Invalid pharmacy
   • Network timeout
   • Malformed messages
   • Authentication failures

3. Edge Cases:

   • Multiple prescriptions
   • Special characters in SIG
   • Maximum field lengths
   • Time zone handling

Certification TestsCopy Anchor Link

• Minimum 95% pass rate required
• 100+ test prescriptions
• All message types
• Error scenarios
• Performance benchmarks

Step 5: Production Approval (Week 21-24)Copy Anchor Link

Requirements for ProductionCopy Anchor Link

1. Successful Testing: All test cases passed
2. Security Audit: Completed and passed
3. Documentation Review: All guides complete
4. Support Plan: 24/7 contact established
5. Go-Live Plan: Detailed rollout strategy

3. DEA Registration & EPCS CertificationCopy Anchor Link

DEA Registration ProcessCopy Anchor Link

For Each ProviderCopy Anchor Link

1. Obtain DEA Number:

   • Apply at: https://www.deadiversion.usdoj.gov/
   • Cost: $888 for 3 years
   • Processing: 4-6 weeks

2. Required Documents:

   • State medical license
   • State controlled substance license
   • Proof of identity
   • Business registration

EPCS Certification (Phase 2)Copy Anchor Link

RequirementsCopy Anchor Link

1. Identity Proofing:

   • In-person or remote identity verification
   • Government-issued ID validation
   • Credential issuance

2. Two-Factor Authentication:

   • Something you know (password)
   • Something you have (token, phone)
   • Optional: Something you are (biometric)

3. Audit Requirements:

   • Third-party audit required
   • Annual recertification
   • Cost: $10,000 - $15,000

4. Technical Requirements:

   • FIPS 140-2 Level 1 cryptography
   • Logical access controls
   • Audit trail preservation (2 years)
   • Backup and recovery procedures

4. State-Specific RequirementsCopy Anchor Link

All-State Compliance StrategyCopy Anchor Link

Since you're operating in all states, you must meet the most stringent requirements:

Universal RequirementsCopy Anchor Link

1. E-Prescribing Mandates:

   • New York: All prescriptions must be electronic (with exceptions)
   • Minnesota: Opioids must be prescribed electronically
   • Many states moving to mandatory e-prescribing

2. PDMP Integration:

   • 49 states have PDMPs (Prescription Drug Monitoring Programs)
   • Many require checking before prescribing controlled substances
   • Some require automatic reporting

3. Prescription Validity Periods:

   • Controlled substances: 6 months to 1 year
   • Non-controlled: 1-2 years
   • State-specific variations

State Registration RequirementsCopy Anchor Link

Priority States (Strictest Requirements)Copy Anchor Link

1. New York

   • Mandatory e-prescribing
   • PDMP check required
   • Specific security requirements

2. California

   • CURES PDMP integration required
   • Specific tamper-resistant requirements
   • Security prescription forms for fallback

3. Florida

   • E-FORCSE PDMP integration
   • Specific validation requirements
   • Counterfeit-proof prescription requirements

Compliance Matrix ToolCopy Anchor Link

Create a spreadsheet tracking:

• State name
• E-prescribing mandate (Y/N)
• PDMP name and requirements
• Prescription validity periods
• Special requirements
• Registration status

5. Drug Database RequirementsCopy Anchor Link

RxNorm (Free Tier - MVP)Copy Anchor Link

Setup ProcessCopy Anchor Link

1. Access RxNorm:

   • URL: https://www.nlm.nih.gov/research/umls/rxnorm/
   • License: Free, requires UMLS license
   • Updates: Monthly

2. Implementation:

   Copy Text

   Required Data Sets:
   - RxNorm Concepts (drug names)
   - RxNorm Attributes (strength, form)
   - RxNorm Relationships (brand/generic)

3. Integration Requirements:

   • Download monthly updates
   • Parse and import data
   • Map to NCPDP codes
   • Maintain version history

First Databank (Phase 2)Copy Anchor Link

Licensing ProcessCopy Anchor Link

1. Contact FDB Sales:

   • Cost: $30,000 - $50,000 annually
   • Based on provider count and volume

2. Capabilities Included:

   • Drug-drug interactions
   • Allergy checking
   • Dosage range checking
   • Formulary data
   • Clinical decision support

3. Implementation Timeline:

   • Contract negotiation: 2-4 weeks
   • Technical integration: 4-6 weeks
   • Testing and validation: 2-3 weeks

6. Security & Audit RequirementsCopy Anchor Link

HIPAA ComplianceCopy Anchor Link

Technical SafeguardsCopy Anchor Link

1. Access Controls:

   • Unique user identification
   • Automatic logoff (15 minutes)
   • Encryption and decryption

2. Audit Controls:

   • Log all prescription actions
   • Maintain logs for 6 years
   • Regular audit reviews

3. Integrity Controls:

   • Message authentication
   • Error correction procedures
   • Electronic signature standards

4. Transmission Security:

   • End-to-end encryption
   • TLS 1.2 minimum
   • Certificate management

Audit Trail RequirementsCopy Anchor Link

Required Audit ElementsCopy Anchor Link

{
  timestamp: "ISO8601",
  userId: "Provider ID",
  patientId: "Encrypted/Hashed",
  action: "create|modify|cancel|view",
  prescriptionId: "UUID",
  medicationDetails: {
    name: "string",
    quantity: "number",
    controlled: "boolean"
  },
  ipAddress: "string",
  sessionId: "UUID",
  changeReason: "string (if modified/cancelled)"
}

Retention RequirementsCopy Anchor Link

• Standard prescriptions: 2 years
• Controlled substances: 5 years
• Audit logs: 6 years
• Failed attempts: 1 year

7. Implementation ChecklistCopy Anchor Link

Phase 1: Preparation (Weeks 1-4)Copy Anchor Link

• Obtain EIN/Tax ID
• Register for NCPDP Provider ID
• Create Surescripts account
• Assign technical team
• Review state requirements
• Set up legal entity

Phase 2: Legal & Compliance (Weeks 2-6)Copy Anchor Link

• Sign Surescripts agreements
• Complete BAA agreements
• Review state regulations
• Establish security policies
• Create audit procedures
• Obtain business insurance

Phase 3: Development (Weeks 4-16)Copy Anchor Link

• Set up development environment
• Implement NCPDP SCRIPT
• Build pharmacy search
• Create prescription workflow
• Implement security measures
• Build audit system

Phase 4: Testing (Weeks 16-20)Copy Anchor Link

• Complete Surescripts test cases
• Security penetration testing
• Performance testing
• User acceptance testing
• Compliance validation
• Documentation review

Phase 5: Certification (Weeks 20-24)Copy Anchor Link

• Submit for Surescripts certification
• Complete security audit
• Finalize production setup
• Train support team
• Create rollout plan
• Obtain production credentials

Phase 6: Launch Preparation (Weeks 24-26)Copy Anchor Link

• Provider training materials
• Support documentation
• Monitoring setup
• Incident response plan
• Rollback procedures
• Go-live checklist

8. Ongoing ComplianceCopy Anchor Link

Annual RequirementsCopy Anchor Link

1. Recertification:

   • Surescripts annual review
   • Security audit
   • EPCS recertification (Phase 2)

2. Updates:

   • NCPDP SCRIPT standard updates
   • State regulation changes
   • Drug database updates

3. Reporting:

   • Controlled substance reports
   • PDMP submissions
   • Quality metrics

Monthly TasksCopy Anchor Link

• Review audit logs
• Update drug database
• Monitor compliance alerts
• Review failed prescriptions
• Update provider credentials

Compliance CalendarCopy Anchor Link

Create recurring tasks for:

• Daily: Drug database updates
• Weekly: Audit log reviews
• Monthly: Compliance reports
• Quarterly: Security reviews
• Annually: Recertification

9. Cost SummaryCopy Anchor Link

Initial Costs (Year 1)Copy Anchor Link

Ongoing Annual CostsCopy Anchor Link

10. Support ResourcesCopy Anchor Link

Surescripts SupportCopy Anchor Link

• Technical Support: 1-866-797-3239
• Email: support@surescripts.com
• Developer Portal: https://developer.surescripts.com/
• Documentation: Provided after agreement

NCPDP ResourcesCopy Anchor Link

• Website: https://www.ncpdp.org/
• Standards: https://standards.ncpdp.org/
• Support: 480-477-1000

DEA ResourcesCopy Anchor Link

• Registration: https://www.deadiversion.usdoj.gov/
• EPCS Info: DEA Diversion Control Division
• Support: 1-800-882-9539

Compliance ResourcesCopy Anchor Link

• HIPAA: https://www.hhs.gov/hipaa/
• State Boards: Individual state pharmacy boards
• PDMP Contacts: State-specific programs

Appendix A: Common Certification FailuresCopy Anchor Link

Top Reasons for DelaysCopy Anchor Link

1. Incomplete Documentation: Missing provider licenses
2. Failed Security Audit: Inadequate encryption
3. Poor Test Coverage: < 95% pass rate
4. Message Format Errors: Invalid NCPDP SCRIPT
5. Timeout Handling: Poor error recovery

Prevention StrategiesCopy Anchor Link

• Start documentation early
• Engage security consultant
• Comprehensive test plan
• Use Surescripts validators
• Implement robust error handling

Appendix B: Emergency ProceduresCopy Anchor Link

Certification IssuesCopy Anchor Link

1. Contact Surescripts support immediately
2. Document all issues thoroughly
3. Engage technical consultant if needed
4. Have fallback plan (print prescriptions)

Compliance ViolationsCopy Anchor Link

1. Self-report to relevant authority
2. Implement immediate corrections
3. Document remediation steps
4. Update policies and procedures

Document Version: 1.0
Last Updated: November 2024
Author: Compliance Team
Next Review: Quarterly
Contact: compliance@kulcare.com