Two-Factor Authentication

As part of the 2010 DEA Rule “Electronic Prescriptions for Controlled Substances,” the DEA mandated that a Two-Factor Authentication process be used verify the identity of the provider e-prescribing schedule II, III, IV, and V controlled substances.

Practitioners must be sure that the electronic prescription or electronic health record (EHR) application they are using complies with the requirements in the interim final rule.₄ Allscripts’ TouchWorks EHR^TM version 11.5 is certified by the DEA to comply with the new EPCS requirements.₃

To meet these standards, new security features have been added to TouchWorks EHR^TM.  These enhancements require that additional steps be incorporated into the e-prescribing workflow for controlled substances to support the two-factor authentication required by the final rule.

This is the third article in our EPCS series, in which we’ll discuss the additional workflow and functionality steps required for two-factor authentication.  Make sure to check out Part 1 and Part 2 here!

Electronic Authentication

The HIT Standards Committee explains that “electronic authentication (e-authentication) is the process of establishing confidence in user identities electronically presented to an information system.  It is the process of establishing confidence that an individual/organization using a credential that is known to the system (e.g., login name, digital certificate) is indeed the person/organization to whom the credential was issued.”₁

There are three types of authentication factors:  something you know (e.g., password, PIN), something you have (e.g., smartcard, hard token, mobile phone), or something you are (e.g., biometric characteristic such as a fingerprint or voice pattern).₁

“Authentication is performed each time a user logs into an account (e.g., portal, email) or otherwise uses a credential.  Multi-factor authentication (which requires more than one type of authentication to be used at the point of system login) is sometimes used to achieve a higher level of assurance.”₂

The two-factor authentication begins when you log into EHR using your secure password. This meets the criteria for 1 factor “something you know”.  The second factor, “something you have,” was provided with the issue and registration of your one-time password (OTP) key fob or smartphone application with Verizon Credentialing Services. (Please refer to Part 2 of this series Identity Proofing – What Is It? How is it Accomplished? for more information)

New Functionality with v11.5

With the installation of TouchWorks EHR^TM v.11.5, you will now be prompted to enter a number, issued by your OTP device, during the e-prescribing workflow for controlled substances.

This workflow assumes you are a user/provider with an active NPI, State License, and DEA number, along with the proper application security settings.  You must also be registered with Surescripts and have completed the Identity Proofing process.

The established workflow for e-prescribing has not changed, but at the point that a schedule II-V medication is selected, the system will automatically begin the authentication process.

E-Prescribing Workflow

1. Choose a patient
2. Choose a controlled substance/medication
3. Choose an EPCS certified pharmacy (the system will prompt you with a red highlight if the pharmacy is not EPCS certified)
4. Save and Close and Commit

At this point you will be routed to a new screen for the next steps. 

5. Verify your DEA number
6. Confirm the medication
7. Click on sign

The next screen is the new two-factor authentication screen 

8. Enter your password
9. Select your OTP device (key fob or smartphone)
10. Enter your OTP issued number
11. Click on sign to complete the script.
12. The script has now been sent to the pharmacy.₃

These changes and other configuration considerations made possible by the 11.5 upgrade will add new functionality that can assist healthcare professionals in moving forward with EPCS and meet the underlying goals of EPCS to ensure patient safety, lower the risk of fraud, reduce medication errors, and improve patient satisfaction.

References:

1http://www.healthit.gov/sites/default/files/2012dec19-pswg-hearing.pdf

2http://www.healthit.gov/sites/default/files/identitymanagementfinal.pdf

₃https://clientconnect.allscripts.com/videos/6941

₄http://www.deadiversion.usdoj.gov/ecomm/e_rx/faq/practitioners.htm