4.3 Mandatory Electronic Prescribing of Controlled Substances (EPCS) in Utah

4.3 Mandatory Electronic Prescribing of Controlled Substances (EPCS) in Utah

Utah's EPCS mandate was formerly in § 58-37-22. Since July 1, 2026 it is in § 58-37-302. It puts the duty on the prescriber, and the rules give pharmacists specific protections and protocols.

The mandate (§ 58-37-302(1))

Beginning January 1, 2022, each prescription for a controlled substance in any schedule (II–V) must be transmitted electronically unless it is:

• (a) for a patient residing in an assisted living facility, long-term care facility, or correctional facility;
• (b) issued by a veterinarian;
• (c) dispensed by a Department of Veterans Affairs pharmacy;
• (d) issued during a temporary technical or electronic failure at the practitioner's or pharmacy's location; or
• (e) issued in an emergency situation.

Since Utah made gabapentin Schedule V in 2024, gabapentin prescriptions are also subject to EPCS.

Additional exemptions by rule (R156-37-609(3); R156-37-610)

A prescriber or pharmacy is also exempt if the exemption is documented on the prescription's hard copy and:

1. the prescriber is licensed outside Utah and the pharmacy orally confirms the prescription with the prescriber;
2. the prescriber and dispensing pharmacy are the same entity;
3. the prescription is a Schedule II oral emergency prescription under R156-37-605;
4. the FDA requires elements that cannot be included electronically;
5. the drug is under a research protocol;
6. the prescription requires compounding two or more ingredients;
7. the prescriber or pharmacy is in an area CMS has identified as a qualifying emergency or disaster on its EPCS website; or
8. the prescriber qualifies for the small prescriber exemption: 300 or fewer CS prescriptions per calendar year or 25 or fewer per month. Exempt prescriptions and most refills don't count toward these totals. Prescribers don't register for this exemption; DOPL measures it by NPI using CSD data, and it may revoke eligibility by notice.

What counts as an "emergency" and a "technical failure" (R156-37-102)

• An emergency situation exists when a CS prescription cannot be issued or transmitted electronically without a delay that would adversely affect the patient's condition, and prompt prescribing or dispensing is necessary. It includes urgent prescribing when the prescriber cannot reasonably transmit to the patient's pharmacy, and after-hours situations (weekends, holidays, overnight) when the patient cannot get to a 24-hour pharmacy or their regular pharmacy.
• A technical difficulty or electronic failure means a loss of power or internet service, or a failure of a computer system, application, or device, that reasonably prevents the prescriber from transmitting, the pharmacy from receiving or forwarding, or either from complying with law (including 21 CFR Part 1311).

When a prescriber or pharmacy relies on a technical failure, the nature of the failure must be documented on the prescription's hard copy (R156-37-609(1)). A prescriber or pharmacy that fails to try to fix a technical problem reasonably within its control commits unprofessional conduct (R156-37-502(10)–(11)).

The pharmacist's position

This does not replace the pharmacist's other duties. The prescription still must be complete, lawful, and issued for a legitimate medical purpose (see Section 4.4).

When the pharmacy can't fill an electronic CS prescription (R156-37-609(4))

Since July 1, 2024, pharmacy software receiving electronic CS prescriptions must be able to electronically transfer an unfilled prescription to a different pharmacy on request of the patient or practitioner, with approval of a pharmacist at the originating pharmacy (§ 58-37-302(3)). This matches DEA's 2023 rule allowing a one-time transfer of an unfilled electronic CS prescription, including Schedule II, between pharmacies (21 CFR 1306.08(e), 1306.25).

Federal EPCS security (21 CFR Part 1311)

• The prescriber's application and the pharmacy application must be certified by a third party (or audited) as meeting DEA requirements.
• Prescribers undergo identity proofing through an approved credential service provider.
• Logical access controls set signing permissions, with two individuals involved in granting access.
• Signing requires two-factor authentication using two of three factor types: something you know (password or PIN), something you have (a hard token separate from the computer), and something you are (biometric). Two knowledge factors do not satisfy the rule.
• The pharmacy application must digitally sign, or receive and archive, the prescription and keep audit trails.

DOPL rules incorporate Part 1311: electronic CS prescriptions must be issued and dispensed in accordance with it (R156-37-609(5)).

Scenarios

• A surgeon's EHR goes down during a storm. The surgeon writes a paper hydrocodone/acetaminophen prescription and notes the outage. The pharmacist may fill it without independently verifying the outage.
• A dentist who writes about 15 CS prescriptions a month issues a paper prescription for a CIV drug. This is likely covered by the small-prescriber exemption, and the pharmacist need not verify.
• A patient asks to move an unfilled e-prescription for methylphenidate to another pharmacy. Federal rules allow a one-time transfer of the unfilled electronic prescription. Utah requires software capable of it, with the originating pharmacist's approval.