EPCS Access Management

The DEA requires two people to set or change who may prescribe controlled substances: one enters the change, and another approves it with two-factor authentication. The ePrescription module lets each location appoint its own access managers for this job:

• An administrator access manager at the location:
  • requests access changes
  • requests grants and revocations of the EPCS prescribing permission epcs-prescribing for practitioners (it covers all their DEA numbers at the location)
  • lists access permissions
• An EPCS approver approves access changes with two-factor authentication.

Each role and permission applies to an Aidbox User at a Location.

Prescribing Controlled Substances

Only the prescriber of a controlled prescription can mark it ready to sign and sign it, and only while they hold the EPCS prescribing permission at the prescription's location. For both steps, the module checks that:

• the request has an acting user
• the prescriber's PractitionerRole references a Location that has:
  • status set to active, or no status
  • a tag with the system urn:app:aidbox:e-prescriptions:surescripts:providerDirectory
• User.fhirUser of the acting user references the Practitioner of that PractitionerRole
• that Practitioner does not have active set to false
• the PractitionerRole has:
  • active set to true
  • period.start in the past (required)
  • period.end in the future (required)
• the acting user holds the EPCS prescribing permission at that Location

Signing runs these checks again, so if the permission is revoked after the prescriber marks the prescription ready, signing returns 403.

Operations

The Aidbox App exposes the operations under /e-prescription/access/epcs:

• Configure Access Policies: decide who may call each operation. Do this first.
• Bootstrap the First Administrator: grant a location's first administrator during deployment.
• Access-Change Requests: change who holds an access manager role or the EPCS prescribing permission at a location.
• List Permissions: list your own permissions and those at the locations you administer.
• Location Compliance Status: check whether a location has an administrator and an approver who are different users.

The operations work whether or not controlled-substance prescribing is enabled, so you can set up access managers and prescribers ahead of time.