EPCS for Weight Loss Clinics: Prescribing Controlled Substances Electronically

EPCS is electronic prescribing of controlled substances under the DEA rule at 21 CFR part 1311. It requires identity proofing, a two-factor credential to sign, two-person access control and an audited application. Weight clinics need it when prescribers send scheduled drugs such as phentermine, a Schedule IV substance. In Ona, EPCS is a $25 add-on to e-prescribing.

Quick answer:

• Not every weight clinic needs EPCS. It matters when a prescriber sends controlled substances electronically. Phentermine and diethylpropion are Schedule IV, and benzphetamine and phendimetrazine are Schedule III, per the DEA schedules.
• The DEA rule sets four requirements: identity proofing, two-factor authentication at signing, logical access control set by two people, and an application that has passed a third-party audit or certification.
• Mandates come from elsewhere. The DEA does not require EPCS, but Medicare Part D does for most prescribers, and state law can go further.

Which Weight-Management Drugs Are Controlled

EPCS only applies to prescriptions for controlled substances. Many prescriptions a weight clinic writes are not controlled, and those go through ordinary e-prescribing. The controlled ones are listed in the DEA schedules:

• Schedule IV. 21 CFR 1308.14(f), the stimulants paragraph, lists phentermine and diethylpropion, among others.
• Schedule III. 21 CFR 1308.13(b) lists benzphetamine and phendimetrazine among its stimulants.

Which medication, if any, is appropriate for a patient is a clinical decision. The administrative point is simple: if any prescriber in your clinic will send these electronically, that prescriber needs EPCS, and your clinic needs the access controls that come with it.

What the DEA Rule Requires

The DEA's rule for electronic prescriptions for controlled substances is codified at 21 CFR part 1311. Its practitioner-side requirements come down to four things.

Requirement	What the rule says	Section	Who handles it in practice
Identity proofing	The practitioner gets a two-factor credential from an approved credential service provider that proofs identity at NIST SP 800-63-1 Assurance Level 3 or above, and the credential is issued over two channels	1311.105	The credential service provider your e-prescribing vendor works with
Two-factor authentication	Signing requires two of three factors: something you know, something you are, something you have; a hard token must be separate from the computer and meet FIPS 140-2 Security Level 1	1311.115	The prescriber, at every signing
Logical access control	At least two people are designated to manage access at each registered location; one enters who may sign, and a second, a DEA registrant, approves it with their own two-factor credential	1311.125	Your practice, inside the prescribing application
An audited application	The application must pass a third-party audit or certification before it is used for controlled substances, and again when relevant functions change or every two years, whichever comes first	1311.300	The e-prescribing vendor

A few rules sit on the practitioner personally:

• Sole possession. The practitioner must keep sole possession of the hard token and must not share the password or other knowledge factor. DEA's Q&A says plainly that an office manager may not hold the prescriber's token.
• Report a lost token fast. The practitioner must notify the people managing access within one business day of discovering that a token is lost, stolen or compromised (1311.102).
• Check the audit. Before first use, the practitioner must determine that the auditor or certifying organization found the application compliant (1311.102(d)).
• Staff can prepare, only the prescriber signs. The application may let an agent enter data for a controlled substance prescription, but only the registrant signs it (1311.135).

At signing, the application has to show the prescription details and an attestation that completing the two-factor step legally signs the prescription, then prompt for the two factors (1311.140). The application must also give the practitioner a monthly log of controlled substance prescriptions issued, and be able to produce logs covering at least the previous two years on request (1311.120).

DEA's EPCS Q&A for prescribing practitioners (revised July 24, 2023) confirms that both in-person and remote identity proofing are acceptable.

Who Actually Requires EPCS

From the DEA's own perspective, EPCS is voluntary. The DEA Q&A says practitioners can still write and manually sign prescriptions for Schedule II to V controlled substances. Two other sources of law are what make it effectively mandatory for many clinics.

Medicare Part D. Under Section 2003 of the SUPPORT Act, Schedule II to V controlled substances prescribed to Part D beneficiaries must be prescribed electronically. CMS's EPCS program measures each prescriber over a calendar year and treats a compliance rate of 70% or higher as compliant. Prescribers with 100 or fewer qualifying Part D controlled substance prescriptions in the year are automatically excepted, and there are exceptions for declared disasters and CMS-approved waivers. CMS says the measurement year 2026 requirement matches 2025. Non-compliant prescribers receive notices, and non-compliance may be considered in fraud, waste and abuse assessments.

State law. The DEA Q&A notes that electronic prescriptions for controlled substances may be subject to state laws, and where state requirements are more stringent, they supersede the less stringent DEA provision. Check your state, and every state you prescribe into, with your board of pharmacy or counsel.

Telehealth. For virtual weight programs, the Ryan Haight Act's in-person evaluation rules also apply to controlled substances. DEA and HHS published a fourth temporary extension of the telemedicine prescribing flexibilities in the Federal Register on December 31, 2025, effective January 1 through December 31, 2026. Watch for what DEA puts in place after that date.

How EPCS Works in Ona

Ona's e-prescribing embeds DoseSpot in the patient chart and the visit, and EPCS for Schedule II to V controlled substances runs through the same screen.

Setup, once per clinic. An Owner or Admin provisions the clinic in DoseSpot from Ona's settings, links each clinician as a prescriber and each staff member who prepares prescriptions as a proxy, and adds DEA registrations for anyone who prescribes controlled substances. A DEA number is entered as two letters followed by seven digits, with the registered address. The step-by-step is in Setting up DoseSpot.

Identity proofing and two-factor setup. These happen with DoseSpot. Ona notifies the prescriber and the admins when controlled-substance prescribing is ready or a step fails.

Signing. Controlled prescriptions add DoseSpot's EPCS two-factor prompt at signing. That prompt is separate from Ona's own two-step sign-in verification; turning one on or off changes nothing about the other.

Staff prepare, prescribers send. Staff on proxy accounts queue prescriptions for a named prescriber, who reviews and sends them. A proxy cannot sign, send or prescribe controlled substances, because there is no NPI or DEA registration behind the account. Give each staff member their own proxy account, since DoseSpot attributes a queued prescription to the proxy that staged it. That matches the DEA's line between an agent entering data and the registrant signing.

After sending. Sent prescriptions land on the patient's medication list as read-only records. Refill and change requests, failed transmissions, prescriptions not picked up and prior authorization outcomes arrive in Ona's notification bell, and you respond in DoseSpot.

Around it. Ona's team and security controls cover the rest of the account: four fixed roles, an activity log of who opened or changed each chart, two-step verification with an authenticator app, automatic sign-out after an hour without activity, and a BAA signed by every practice when the workspace is created.

What EPCS Costs

On Ona's pricing, e-prescribing is +$45 per prescribing practitioner per month, and EPCS is a further +$25 per prescribing practitioner and requires the e-prescribing add-on. Only prescribers who send controlled substances need the EPCS add-on. Annual billing takes 10% off the whole plan, add-ons included.

For comparison, here is how three other platforms that weight and nutrition clinics often shortlist list e-prescribing and EPCS on their own pricing pages as of October 22, 2026. Pricing pages change, so confirm with each vendor.

Platform	E-prescribing	EPCS	Notes as listed
Ona	DoseSpot, +$45 per prescribing practitioner per month	+$25 per prescribing practitioner per month, requires e-prescribing	Seats $130 per practitioner and $45 per staff member per month
Healthie	DoseSpot, $40 per clinician per month, no setup fee	Listed as an add-on; "EPCS approval is subject to review"	Plans from $19 per month
Practice Better	ePrescribe (EPCS) add-on listed at $49	Included in that add-on; separate EPCS onboarding add-on listed at $99	PDMP add-on and PDMP onboarding listed separately
OptiMantra	"eRx license with EPCS" add-on listed at $38 per month	Included in that add-on	Base plan $99 per month for the first practitioner

The per-prescriber price is only part of the cost. Ask each vendor who handles identity proofing, how long a new prescriber takes to go live, and whether the application's audit or certification report is available to you, since the rule makes you check it before first use.

A Setup Checklist for Weight Clinics

1. List who prescribes controlled substances. Only those prescribers need EPCS, DEA registrations on file, and two-factor credentials.
2. Confirm each prescriber's DEA registration and state authorizations are current. The rule requires someone setting access controls to verify them.
3. Designate two people to manage access at each registered location, at least one of them a DEA registrant with a two-factor credential.
4. Complete identity proofing and credential setup through your e-prescribing vendor's process.
5. Set up proxies for staff who prepare prescriptions, one account per person.
6. Check your state rules and every state your telehealth patients are in.
7. Track your Part D share if you see Medicare patients, against the 70% threshold.

For prescribing-heavy practices more broadly, see our guide to the best EHR for psychiatry and prescribing practices.

Frequently asked questions

What is EPCS?

EPCS is electronic prescribing of controlled substances. Under the DEA rule at 21 CFR part 1311, a prescriber can send Schedule II to V prescriptions electronically if the application has passed a third-party audit or certification, the prescriber's identity has been proofed, access controls are set by two people, and the prescriber signs with a two-factor credential.

What are the EPCS requirements for prescribers?

Identity proofing through an approved credential service provider at NIST SP 800-63-1 Assurance Level 3, a two-factor credential using two of something you know, are or have, logical access controls set by two designated people with a DEA registrant approving, and an application that passed a third-party audit or certification. The prescriber must keep sole possession of their token.

Do weight loss clinics need EPCS?

Only if a prescriber will send controlled substances electronically. Phentermine and diethylpropion are Schedule IV, and benzphetamine and phendimetrazine are Schedule III, per the DEA schedules. Prescriptions for drugs that are not controlled go through ordinary e-prescribing. Medicare Part D and some states require EPCS for controlled substances.

Is EPCS mandatory?

Not under DEA rules alone, which still allow manually signed paper prescriptions. Medicare Part D requires electronic prescribing of Schedule II to V controlled substances, with CMS treating 70% or higher as compliant and excepting prescribers with 100 or fewer qualifying Part D prescriptions a year. State laws can add stricter requirements.

How much does EPCS cost in Ona?

E-prescribing is +$45 per prescribing practitioner per month, and EPCS is a further +$25 per prescribing practitioner per month. EPCS requires the e-prescribing add-on, and only prescribers who send controlled substances need it. Annual billing takes 10% off.

Can staff prepare controlled substance prescriptions in Ona?

Staff on proxy accounts can queue prescriptions for a named prescriber to review and send, but a proxy cannot sign, send or prescribe controlled substances. Controlled prescriptions are signed by the prescriber with DoseSpot's EPCS two-factor prompt.

Next step

Walk through prescriber setup, proxies and an EPCS signing in a 20-minute demo, or add e-prescribing and EPCS to your seats on the pricing page and start the 14-day free trial, no credit card required.