Skip to main content


Kareo Help Center


Updated: 09/10/2021
Views: 3323

Answers to the most common electronic prescribing for controlled substances (EPCS) questions.



What is the difference between ePrescribing and EPCS? ePrescribing enables providers to prescribe nonscheduled medications. EPCS is required to prescribe controlled substances.
How a provider enroll for EPCS? Enroll for EPCS.
What vendor does Kareo use for EPCS? Kareo uses SureScripts to prescribe controlled substances and DrFirst to complete the identity proofing process.
Can a provider prescribe EPCS from multiple EHR systems? Yes.
What is a token? What is the difference between a hard and soft token? A token, or sometimes referred to as a fob, is a small handheld device that emits a different 6-digit code every 30 seconds. It is used for enrollment purposes and must be used each time the provider prescribes a controlled substance.

A hard token is a small keychain that is mailed to the provider during enrollments.

A soft token is an application that can be downloaded on a phone or tablet.

Either can be used for enrollments or prescribing as long as it is linked to the provider's DrFirst account.

How does a provider order a hard token and when will the provider receive the hard token? During enrollments, the provider can request a hard token. The request is sent to DrFirst and they will send the hard token to the provider.
Can a provider use more than one token? Yes.
How many tokens can a provider link to their DrFirst account? Any combination of hard and soft tokens up to 5 can be added.
What is identity proofing? Identity proofing is a step administered by DrFirst to verify the provider's identity using their personal financial information.
What happens if the provider fails identity proofing? After three unsuccessful attempts at identity proofing, the provider will be locked out for 24 hours. It recommended the provider contact Experian at (877) 284-7942 to pull their credit report to help complete identity proofing.
What is a transaction ID and when will the provider receive it? Once the IDP process has been completed and the token(s) activated, the provider will receive a letter with an IDP Confirmation Code, also known as the transaction ID, from Experian via USPS within a couple days.

If a mobile phone number provided in the User Registration and is validated by Experian, the provider will receive a text message with the IDP Confirmation Code instead of receiving a letter.
What if the provider never received their transaction ID? The provider will need to complete the identify proofing again. Reach out the Enrollments Team for an invitation
Who can activate the Logical Access Control (LAC) for the provider? This step must be completed by a user with a System Admin role who is not the provider.

If necessary, add a new System Admin user who is an individual who knows the provider and not the provider themselves.


  • Was this article helpful?