EPCS for PMHNPs and Psychiatrists in New York: Setup, Security, and Common Mistakes
Setting up electronic prescribing for controlled substances in New York takes more than turning on e-prescribing inside an EHR.
A psychiatrist or PMHNP who prescribes controlled substances electronically needs a qualifying application that meets federal security requirements, identity proofing, two-factor authentication, and registration of the certified EPCS application with the New York State Department of Health's Bureau of Narcotic Enforcement (BNE). The practitioner must retain control of the credentials used to sign controlled-substance prescriptions.
Those requirements sit alongside DEA registration, New York's Prescription Monitoring Program (PMP/I-STOP), clinical documentation, and prescribing policies. This guide focuses on EPCS itself: what it is, how to set it up, how signing works, how to use it during a prescribing workflow, and how to protect access once it is active.
What Is EPCS, and How Is It Different From Regular E-Prescribing?
EPCS stands for Electronic Prescribing of Controlled Substances. It is the electronic process used to create, sign, and transmit prescriptions for controlled substances through applications that meet federal security requirements.
New York permits electronic prescriptions for controlled substances in Schedules II through V. Applications used for EPCS must meet federal security standards and meet New York registration requirements.
That makes EPCS different from ordinary e-prescribing. An EHR may let a clinician send non-controlled prescriptions electronically without having controlled-substance functionality activated.
If you expect to prescribe controlled medications, ask whether the system supports EPCS in New York, which application and version has been certified or audited, and what you personally need to complete before prescribing.
Is Electronic Prescribing Required for Psychiatrists and PMHNPs in New York?
New York requires practitioners to issue controlled and non-controlled prescriptions electronically in most circumstances, subject to defined exceptions.
The mandate took effect March 27, 2016. Current exceptions include certain approved waivers, specified institutional circumstances, temporary technical or electrical failures, prescriptions intended for dispensing outside New York, and situations in which delay could adversely affect the patient.
A separate certification process exists for qualifying practitioners who issue no more than 25 prescriptions during a 12-month period.
For an outpatient psychiatric practice that routinely prescribes medication, electronic prescribing should be part of the normal practice setup rather than treated as an occasional workaround.
See the New York State Department of Health electronic-prescribing guidance for the current state rules and exceptions.
What Does a New York Prescriber Need Before Using EPCS?
A psychiatrist or PMHNP should confirm several separate requirements before issuing the first electronic controlled-substance prescription.
A practical setup sequence is:
Confirm the professional authority needed for the prescribing activity.
Have the required DEA registration in place for federally controlled substances.
Select an EPCS-capable application that meets federal security requirements.
Complete identity proofing.
Obtain and activate the required authentication credentials.
Complete the application's practitioner authorization and EPCS activation steps.
Register the certified EPCS application with New York BNE through the applicable state process.
Confirm that the prescribing workflow works before first use.
New York currently directs practitioners who have completed the federal security steps to its ROPES online registration process.
One distinction matters during software onboarding: the individual practitioner is responsible for registering the certified EPCS application with BNE. Vendor certification does not complete that practitioner obligation.
New York's practitioner instructions state that identity proofing and two-factor authentication must be completed before BNE registration.
See the NYSDOH Practitioner EPCS Registration Instructions for the current process.
What Should You Verify Before Choosing an EHR or EPCS Vendor?
Before committing to an EHR, confirm that its controlled-substance functionality fits your New York prescribing workflow.
Ask the vendor:
Does the application support EPCS for New York practitioners?
Which application and software version has been certified or audited?
What identity-proofing and authentication process will I complete?
Is EPCS included in my plan or sold as a separate module?
What steps do I personally need to complete for BNE registration?
How are practitioner and staff permissions separated?
What audit information can I access?
What happens after a lost credential, software change, version change, or vendor migration?
A vendor can explain its product and activation process. The prescriber still needs to know which regulatory steps belong to the vendor and which belong to the individual practitioner.
Checking this before selecting an EHR can prevent an expensive switch or a delayed controlled-substance workflow later.
How Do Identity Proofing and Two-Factor Authentication Work for EPCS?
Identity proofing confirms the identity of the practitioner receiving EPCS credentials. Two-factor authentication is then used when that practitioner signs a controlled-substance prescription.
DEA guidance states that authentication credentials used for EPCS may be issued only after the practitioner's identity has been confirmed. The exact identity-proofing process depends on the application and credential provider.
Two-factor authentication requires two qualifying authentication factors rather than relying on a password alone. The factors may involve something the practitioner knows, possesses, or is, depending on the system.
The authentication step has legal significance. DEA treats completion of the required two-factor authentication protocol as the practitioner's signing of the controlled-substance prescription.
For that reason, an authentication prompt on a phone, token, or other device is part of the prescription-signing process, not an ordinary login notification.
Can an Assistant Prepare or Sign an EPCS Prescription?
Staff may assist with permitted preparatory work, but the practitioner must personally control the signing credentials and complete the authentication used to sign the controlled-substance prescription.
New York's 10 NYCRR ยง80.77 requires practitioners to retain sole possession of EPCS signing credentials and prohibits sharing them or allowing another person to use them.
DEA guidance permits office staff or another authorized agent to enter prescription information at the practitioner's direction before practitioner review. The prescriber remains responsible for reviewing the prescription and personally completing the authentication that signs it.
A practice can give staff access appropriate to their roles without giving them the practitioner's signing credentials.
What Should You Do if an EPCS Credential Is Lost, Stolen, or Compromised?
Secure the affected credential immediately, follow the application's process for terminating or replacing access, and complete any required regulatory notifications.
New York requires practitioners to notify BNE immediately when EPCS signing credentials are lost, stolen, or compromised.
A practice should already know:
how to disable or suspend the affected credential;
how to contact the EPCS vendor;
how to notify BNE;
how replacement credentials are issued;
how recent prescribing activity can be reviewed.
What if You Find a Prescription You Did Not Sign?
New York requires immediate BNE notification when a practitioner discovers a prescription issued under the practitioner's DEA registration that the practitioner did not sign, or a prescription that differs from the one the practitioner signed.
The response may include securing the account, contacting the vendor, reviewing recent prescribing activity and audit information, documenting what occurred, and determining whether other reporting or professional guidance is needed.
The best time to identify those contacts and procedures is before an incident occurs.
What Does an EPCS Workflow Look Like in Day-to-Day Psychiatric Practice?
Once EPCS is active, the prescribing workflow should preserve a clear chain between clinical judgment, any required monitoring, prescription review, and the practitioner's own authentication.
A typical sequence may look like this:
Patient encounter: Confirm the information needed for the visit and prescribing decision.
Clinical assessment: Decide whether the medication and controlled-substance prescription are clinically appropriate.
PMP consultation when required: Review New York controlled-substance dispensing history when the PMP rule applies.
Prescription preparation: Enter or review the medication, dose, quantity, instructions, and pharmacy.
Practitioner review: Confirm the prescription before signing.
EPCS authentication: Personally complete the required authentication process.
Transmission: Send the signed prescription electronically.
Documentation: Complete the clinical and prescribing documentation required for the encounter.
Staff may assist with permitted parts of preparation or routing. The prescriber makes the clinical decision and completes the EPCS signature.
This workflow keeps the EPCS step in its proper place within the larger prescribing process.
How Do PMP/I-STOP and EPCS Differ?
PMP/I-STOP and EPCS perform separate functions. The PMP Registry supports review of controlled-substance dispensing information when consultation is required. EPCS is the mechanism used to electronically sign and transmit the prescription.
New York currently requires PMP consultation before prescribing Schedule II, III, or IV controlled substances unless an exception applies. Completing the PMP review does not sign or transmit the prescription.
For consultation rules and exceptions, see CHW's New York PMP/I-STOP for PMHNPs and Psychiatrists guide.
What Are the Most Common EPCS Setup and Security Mistakes?
Common preventable problems include:
choosing an EHR before confirming its New York EPCS functionality;
assuming the vendor completes the practitioner's BNE registration;
sharing passwords, tokens, authentication prompts, or other signing credentials;
giving staff permissions beyond what their roles require;
having no process for a lost or compromised authentication factor;
confusing PMP access with EPCS activation;
failing to review access after staff changes;
missing a re-registration trigger after an application, version, vendor, or controlled-substance functionality change.
The BNE timing rule needs careful wording. New York states that the certified application must be registered with BNE at least every two years from the application's DEA certification or third-party audit date, or sooner when controlled-substance functionality changes. Certain application, software-version, or vendor changes can trigger re-registration.
That is different from saying every practitioner's registration simply expires two years after the date the practitioner enrolled.
What Should You Review After EPCS Is Active?
Periodic EPCS review should focus on the system you actually use.
Check that:
the registered application and version still match;
no software or vendor change has triggered re-registration;
authentication factors remain under your control;
staff permissions still match current roles;
former staff access has been removed;
vendor and BNE contacts are available;
you know how to retrieve relevant audit information.
This is a focused EPCS maintenance check, not a substitute for reviewing the rest of the practice's prescribing, recordkeeping, or security obligations.
New-Practice EPCS Checklist
Before your first controlled-substance prescription, confirm:
the required DEA registration is active;
the selected application supports New York EPCS;
identity proofing is complete;
two-factor authentication is active;
practitioner EPCS permissions are activated;
the certified application has been registered with BNE as required;
staff permissions are appropriately limited;
credential-loss and vendor contacts are documented.
For the broader launch sequence, see CHW's How to Start a Telepsychiatry Private Practice in New York guide.
Where Does Clarity Health + Wellness Fit When You Are Building a New York Prescribing Practice?
Clarity Health + Wellness can support qualified practitioners who need professional infrastructure around an independently managed New York practice.
For clinicians who separately need a New York professional address, mail handling, and access to private clinical rooms, Virtual Membership may be one option to evaluate. Virtual Members can book rooms as needed in addition to using the professional-address and mail-handling components of the membership.
Those services remain separate from EPCS. The clinician maintains the EHR, EPCS application, DEA registration, BNE registration, authentication credentials, PMP access, and prescribing workflow.
CHW does not hold or use a member's EPCS credentials and does not replace the systems or professional responsibilities involved in electronic controlled-substance prescribing.
Build EPCS Around a Clear, Repeatable Process
A sound EPCS setup starts with the right application, identity proofing, authentication, New York registration, and personal control of signing credentials.
Once the system is active, the practical task is to keep those pieces current. Review access after staffing changes, track application or vendor changes, know what triggers re-registration, and have a response procedure for credential problems before one occurs.
PMP consultation, DEA practice-location requirements, recordkeeping, and prescribing policies each have their own rules. Keeping those functions distinct makes the EPCS workflow easier to manage and easier to review.
If you are building a New York psychiatric practice and need a professional address, secure mail handling, and the option to book private clinical rooms, explore Clarity Health + Wellness Virtual Membership.
Frequently Asked Questions About EPCS for PMHNPs and Psychiatrists in New York
-
EPCS means Electronic Prescribing of Controlled Substances. It is the secure electronic process used to sign and transmit controlled-substance prescriptions through applications that meet applicable federal requirements.
-
New York requires electronic prescribing of controlled and non-controlled substances in most circumstances, subject to specified exceptions. A clinician prescribing controlled substances electronically needs the appropriate EPCS setup and prescribing authority.
-
No. Standard e-prescribing functionality does not establish that the application has controlled-substance functionality. Confirm its EPCS capability, certification or audit status, activation process, and New York registration requirements.
-
Yes, when using a qualifying application for EPCS in New York. The state places responsibility for registering the certified application with BNE on the individual practitioner after the federal security requirements have been completed.
-
New York states that the certified application must be registered at least every two years from its DEA certification or third-party audit date, or sooner when controlled-substance functionality changes. Certain application, version, or vendor changes can require re-registration.
-
No. New York requires the practitioner to retain sole possession of EPCS signing credentials. Staff may perform permitted preparatory functions, but the practitioner must personally complete the signing authentication.
-
Secure or terminate the affected access immediately, contact the vendor, and follow the applicable reporting requirements. New York requires immediate BNE notification when EPCS signing credentials are lost, stolen, or compromised.
-
No. PMP/I-STOP is used for controlled-substance dispensing-history consultation when required. EPCS is used to electronically sign and transmit the prescription. See CHW's New York PMP/I-STOP for PMHNPs and Psychiatrists guide for the monitoring rules.
Educational Disclaimer
This article provides general educational information and is not legal advice, regulatory advice, or individualized professional guidance. Requirements can vary based on profession, prescribing authority, controlled-substance activities, patient locations, state authorization, practice structure, and individual circumstances. Clinicians should verify current requirements directly with applicable federal and New York authorities and qualified legal or regulatory counsel when appropriate.
About Clarity Health + Wellness
Clarity Health + Wellness is a therapist-led office and membership space in Midtown Manhattan founded by Dr. Logan Jones. Located on Fifth Avenue, CHW offers flexible therapy room rentals, professional memberships, and a more connected private-practice experience for mental health clinicians and aligned wellness professionals who want a space that feels polished, calm, and clinically appropriate without taking on the burden of a traditional lease.
Members can choose from On-Demand, Virtual, and Club options depending on how they practice. Offerings include furnished therapy suites, flexible room booking through Skedda, a compliant NYC business address for eligible professional use, and access to community features such as events, networking, and Clarity Chats through Club Membership.
Clarity Health + Wellness is especially known for combining sophisticated design, flexibility, and therapist-centered community in a way that supports both client experience and long-term practice growth.
Last reviewed: September 2026