EPCS certification is the third-party audit or certification that the DEA requires, under 21 CFR § 1311.300, before an electronic prescribing or pharmacy application can be used for controlled substance prescriptions; DirectTrust runs a DEA-approved certification program for it, alongside a separate E-Prescribing Network accreditation. Both apply to electronic prescribing networks and to prescribing or pharmacy software vendors. Integral Healthcare Solutions (IHS) drafts your organizational procedures and evidence for e-prescribing accreditation and certification; your engineers own technical conformance.

What is EPCS certification and e-prescribing accreditation?

Two sets of text govern this work.

The DEA rule: 21 CFR Part 1311

Under 21 CFR § 1311.300(a) (eCFR text as of September 1, 2026), “the application provider of an electronic prescription application or a pharmacy application must have a third-party audit of the application that determines that the application meets the requirements of this part”. The audit is required “(1) Before the application may be used to create, sign, transmit, or process controlled substance prescriptions. (2) Whenever a functionality related to controlled substance prescription requirements is altered or every two years, whichever occurs first.”

Section 1311.300(e) allows a certification in place of the audit: “If a certifying organization whose certification process has been approved by DEA verifies and certifies that an electronic prescription or pharmacy application meets the requirements of this part, certification by that organization may be used as an alternative to the audit requirements”. Section 1311.300(f) adds a disclosure duty: “The application provider must make the audit or certification report available to any practitioner or pharmacy that uses the application or is considering use of the application.”

The DirectTrust programs: 2026 criteria

DirectTrust's January 5, 2026 criteria release lists three programs for this work: “E-Prescribing Network v10.1*”, “Electronic Prescriptions for Controlled Substances Certification Program for Pharmacy Vendors v4.6” and “Electronic Prescriptions for Controlled Substances Certification Program for Prescribing Vendors v4.6”. The asterisk marks programs that contain DirectTrust's standard Privacy and Security criteria. DirectTrust states that its programs are “governed by the organization's Electronic Healthcare Network Accreditation Commission (EHNAC).”

On its e-prescribing program page, DirectTrust says: “These programs assess electronic prescribing transactions for compliance with industry standards and government regulations and provide an organization's existing and prospective customers with confidence that appropriate risk-based security and privacy controls are in place and key performance metrics are being met on an ongoing basis.” It also states: “DirectTrust is one of four co-organizations currently approved by the DEA to be a certifier under this program.” DirectTrust releases its criteria on request rather than publishing them: “Criteria for each of our Accreditation Programs are available for request at the top of the Programs and Criteria page” (DirectTrust program pages).

Who needs it and what triggers it

• A prescribing or pharmacy application that will handle controlled substance prescriptions for the first time. The audit or certification comes before use (§ 1311.300(a)(1)).
• A release that alters functionality related to controlled substance prescription requirements (§ 1311.300(a)(2)).
• Two years since the last audit or certification, if no qualifying change came first (§ 1311.300(a)(2)).
• A customer, practitioner or pharmacy asking for the report, which the provider must make available (§ 1311.300(f)).
• An e-prescribing network seeking DirectTrust E-Prescribing Network accreditation, whether or not controlled substances are in scope.

DirectTrust's accreditation process page sets the steps for its accreditation programs: “An Accreditation Program Agreement must be signed by the applicant and submitted”, “A Financial Attestation to verify your organization's revenue must also be submitted”, a self-assessment follows, and “The Commission reviews and votes on the Accreditation Report.” It states that “The accreditation cycle is for 2 years.” Confirm with DirectTrust how each step applies to the EPCS certification programs you choose.

How IHS helps

IHS works on the organizational procedures and evidence that sit around the software. The work runs in this order:

1. A gap assessment of your organizational procedures against the DirectTrust criteria you request and obtain.
2. Questionnaires on releases, access governance and incidents.
3. A requirement ownership map that ties each criterion and each § 1311.300 obligation to an owner.
4. Drafting: release and change documentation procedures (including how a change to controlled-substance functionality is flagged for a new audit or certification), access governance and incident procedures, and the evidence file.
5. A mock review against the criteria, and drafted responses to findings for your team to finalize.

You supply the criteria, product documentation, security records, and your software, pharmacy and legal specialists. You engage your own auditor or certifier.

The limit: technical conformance, and the EPCS audit or certification itself, belong to your engineers and your auditor or certifier. IHS is not an auditor or a certifying organization and does not test your application.

What to have ready

Each item ties to 21 CFR § 1311.300 (eCFR, September 1, 2026) or to DirectTrust's 2026 criteria and process and application pages.

• Which applications are in scope and whether each is a prescribing or a pharmacy application, since DirectTrust runs separate v4.6 programs for each and § 1311.300(a) covers both.
• Your release history for controlled-substance functionality since the last audit or certification (§ 1311.300(a)(2)).
• The date of your last audit or certification, to check the two-year limit (§ 1311.300(a)(2)).
• Your choice of route: a third-party audit under § 1311.300(b) or a DEA-approved certification under § 1311.300(e).
• Your current audit or certification report and how you make it available to practitioners and pharmacies (§ 1311.300(f)).
• The DirectTrust criteria for each program you will pursue (E-Prescribing Network v10.1, EPCS Prescribing Vendors v4.6, EPCS Pharmacy Vendors v4.6), requested from DirectTrust.
• Your privacy and security policies, if you will pursue E-Prescribing Network v10.1, which contains DirectTrust's standard Privacy and Security criteria.
• Revenue figures for the Financial Attestation and the name of the person who will sign the Accreditation Program Agreement (process page).

Bring what you have to the introductory call; the ownership map starts from it.

How it compares

Your auditor or certifier, your customers' contracts and your counsel set which route fits.

What it costs

DirectTrust publishes its fees on its application page. It states that “Accreditation fees are based on program(s), location(s), and revenue-level.” The program-specific EPCS line reads “EPCS $3,500” annual, “$1,750*” multi-program and “$4,000” assessment, with the note “*EPCS can only be a Multiple Program with another EPCS program.” For the revenue-tiered schedule, the published range runs from “1 – Very Small – Under $3M” at a $3,100 annual fee and $5,500 assessment fee to “6 – Very Large – Greater than $75M” at $27,500 and $15,000. The same page states that “Travel expenses are not included and will be invoiced after any physical location review(s) occur” and that “there will be a charge of $250/hour for the Assessor time per additional submission of documentation.” Verify current fees with DirectTrust. Auditor fees under § 1311.300(b) are set by the auditor.

IHS scopes each engagement after a free introductory call.

What this is not

• It is not legal advice on DEA requirements. Those questions go to your counsel.
• It is not an EPCS audit or certification, and it does not guarantee DirectTrust's or an auditor's decision.
• IHS does not submit applications or deal with DirectTrust, the DEA or your auditor for you. IHS drafts; your organization submits.

Frequently asked questions

What is EPCS certification and who needs it?

Under 21 CFR 1311.300, the provider of an electronic prescription application or a pharmacy application must have a third-party audit showing the application meets DEA's Part 1311 requirements before it is used for controlled substance prescriptions. A certification by a DEA-approved certifying organization may be used instead of the audit. It applies to prescribing and pharmacy software vendors whose products handle controlled substance prescriptions.

Does DEA require a third-party audit or certification for e-prescribing software?

Yes, for applications used to create, sign, transmit, or process controlled substance prescriptions. Section 1311.300(a) requires the third-party audit, and section 1311.300(e) allows certification by a DEA-approved certifying organization as an alternative.

Who can perform the EPCS audit?

Section 1311.300(b) names a person qualified to conduct a SysTrust, WebTrust, or SAS 70 audit, or a Certified Information System Auditor who performs compliance audits as a regular ongoing business activity. A DEA-approved certifying organization can certify the application instead. DirectTrust states it is one of four co-organizations currently approved by the DEA to be a certifier.

How often must an EPCS application be re-audited or re-certified?

Section 1311.300(a)(2) requires a new audit whenever a functionality related to controlled substance prescription requirements is altered, or every two years, whichever occurs first.

What is DirectTrust E-Prescribing Network accreditation and how does it differ from EPCS certification?

E-Prescribing Network v10.1 is a DirectTrust accreditation that assesses electronic prescribing transactions for compliance with industry standards and government regulations, and it contains DirectTrust's standard Privacy and Security criteria. EPCS certification is a separate DirectTrust program, at v4.6 for prescribing vendors and for pharmacy vendors, tied to the DEA requirement in 21 CFR 1311.300.

How much does DirectTrust EPCS certification cost?

DirectTrust's application page lists EPCS at $3,500 annual, $1,750 multi-program and $4,000 assessment, and notes that EPCS can only be a multiple program with another EPCS program. Travel for location reviews is invoiced separately, and additional documentation submissions are charged at $250 per hour of assessor time. Verify current fees with DirectTrust.

Must we share our EPCS audit report with prescribers and pharmacies?

Yes. Section 1311.300(f) states that the application provider must make the audit or certification report available to any practitioner or pharmacy that uses the application or is considering use of the application.

What triggers a new EPCS audit when we change our software?

Any alteration to a functionality related to controlled substance prescription requirements triggers a new audit or certification under section 1311.300(a)(2). IHS drafts the release and change documentation procedure that flags those changes so your team can act on them.

EPCS certification for prescribing vs pharmacy applications: what is different?

Section 1311.300 applies to both electronic prescription applications and pharmacy applications. DirectTrust runs them as two programs, the EPCS Certification Program for Prescribing Vendors v4.6 and for Pharmacy Vendors v4.6. The criteria for each are released on request, so the differences are read from the criteria your organization obtains.