Completing the EPCS Invitation

Electronic Prescribing of Controlled Substances (EPCS) requires each prescriber to complete an identity proofing and logical access control setup process before they can prescribe Schedule II–V medications electronically. This page walks through the steps a prescriber must take to complete EPCS enrollment.

Prerequisites

Before starting EPCS enrollment:

• The prescriber must have an active DEA registration number

• The prescriber's DrFirst Rcopia account must be provisioned

• The Welkin eRx integration must be active for your organization

• The prescriber must have a compatible device for two-factor authentication

Step 1: Receive the EPCS invitation

DrFirst will send an email invitation to the prescriber's registered email address. The invitation contains a unique link and is time-limited (typically 72 hours).

If the invitation has expired, contact your Welkin Customer Success Manager to request a new one.

Step 2: Verify your identity

Click the link in the invitation email. You will be taken to the DrFirst identity proofing portal, where you must:

1. Enter your DEA registration number exactly as it appears on your DEA certificate

2. Provide your name, date of birth, and address – these must match DEA records

3. Answer knowledge-based authentication (KBA) questions sourced from public records (e.g., previous addresses, financial history)

4. Pass all verification checks before proceeding

If identity verification fails, the prescriber must contact DrFirst support to resolve the discrepancy before retrying.

Step 3: Enroll a second factor (two-factor authentication)

EPCS requires two-factor authentication every time a controlled substance is prescribed. DrFirst supports:

• Hard token (physical device) – a dedicated token fob that generates a one-time code

• Soft token (mobile app) – an authenticator app such as Google Authenticator or Authy

To enroll:

1. Select your preferred token type

2. For soft tokens: scan the QR code with your authenticator app

3. Enter the current one-time code to confirm enrollment

4. Save your backup codes in a secure location

Step 4: Set your EPCS passphrase

You will be prompted to create an EPCS passphrase – a memorable phrase (minimum 10 characters) that you will use alongside your two-factor code when signing controlled substance prescriptions.

Store this passphrase securely. If you forget it, see Reset EPCS Passphrase.

Step 5: Logical access control confirmation

As part of DEA compliance, a second authorized individual at your organization (typically an administrator) must confirm that the prescriber has been granted logical access to EPCS. This step:

1. Is completed by an administrator in the DrFirst Admin console or through the Welkin Admin portal

2. Requires the administrator to verify the prescriber's identity and DEA number independently

3. Creates an auditable record that both parties have completed the authorization

Contact your Welkin administrator to complete this step.

Step 6: Test EPCS prescribing

Once enrollment is complete, test in the sandbox environment:

1. Log in to Welkin Care and open a test patient record

2. Launch the Rcopia eRx panel

3. Select a Schedule II–V medication

4. Complete the EPCS signing process using your two-factor code and passphrase

5. Confirm the prescription is marked as transmitted successfully

If testing is successful, notify your Welkin CSM that EPCS enrollment is complete.