Skip to main content


Kareo Help Center


Updated: 05/26/2023
Views: 7489

Answers to the most common electronic prescribing for controlled substances (EPCS) questions.

Question Answer
What is the difference between ePrescribing and EPCS? ePrescribing (or eRx) enables providers to prescribe nonscheduled medications. EPCS enrollment is required to prescribe controlled substances.
How does a provider enroll for EPCS? Review Enroll for EPCS to learn more.
Note: Providers must be enrolled for eRx prior to requesting enrollment for EPCS.
What is the cost to enroll for EPCS? The cost to enroll for EPCS is a one-time $75.00 setup fee per provider.
How is the setup fee billed? The setup fee is billed to the account's next monthly invoice.
Once the EPCS enrollment request is submitted, how long does it take to process? Successful enrollment typically takes 5 - 7 business days after the order form is submitted to Kareo.
What vendor does Kareo use for EPCS? Kareo uses SureScripts to prescribe controlled substances and DrFirst to complete the identity proofing process.
Can a provider prescribe EPCS from multiple EHR systems? Yes.
What is a token? What is the difference between a hard and soft token? A token, or sometimes referred to as a fob, is a small handheld device that emits a different 6-digit code every 30 seconds. It is used for enrollment purposes and must be used each time the provider prescribes a controlled substance.

A hard token is a small keychain that is mailed to the provider during enrollments.

A soft token is an application that can be downloaded on a phone or tablet.

Either can be used for enrollments or prescribing as long as it is linked to the provider's DrFirst account.

How does a provider order a hard token and when will the provider receive the hard token? During enrollments, the provider can request a hard token. The request is sent to DrFirst and they will send the hard token to the provider.
Can a provider use more than one token? Yes.
How many tokens can a provider link to their DrFirst account? Any combination of hard and soft tokens up to 5 can be added.
What is identity proofing? Identity proofing is a step administered by DrFirst to verify the provider's identity using their personal financial information.
What happens if the provider fails identity proofing? After three unsuccessful attempts at identity proofing, the provider will be locked out for 24 hours. It recommended the provider contact Experian at (877) 284-7942 to pull their credit report to help complete identity proofing.
What is a transaction ID and when will the provider receive it? Once the IDP process has been completed and the token(s) activated, the provider will receive a letter with an IDP Confirmation Code, also known as the transaction ID, from Experian via USPS within a couple days.

If a mobile phone number provided in the User Registration and is validated by Experian, the provider will receive a text message with the IDP Confirmation Code instead of receiving a letter.
What if the provider never received their transaction ID? The provider will need to complete the identify proofing again. Reach out the Enrollments Team for an invitation
Who can activate the Logical Access Control (LAC) for the provider? This step must be completed by a user with a System Admin role who is not the provider.

If necessary, add a new System Admin user who is an individual who knows the provider and not the provider themselves.
Who do I contact if I have questions about DrFirst's Identity Proofing or User Registration? Review DrFirst's EPCSGold help center for assistance or contact their support team.
  • Was this article helpful?