In February 2026, our team opened a long document: the self-assessment for our EPCS recertification. We sent it back in July, after more than 80 hours of combined work and with 39 pieces of evidence attached. In August, auditors spent a day reviewing how we work. On October 1, the certification was approved. And every two years, it starts again.
This is what keeping an e-prescribing platform certified for controlled substances looks like from the inside. If you build or run an EHR and are deciding whether to develop this capability yourself or give clinicians access to a certified platform from within your EHR, it is worth knowing what sits behind the badge.
What it really takes to support EPCS
Controlled substances, such as opioids, benzodiazepines and stimulants, can be prescribed electronically in the United States only under strict conditions set by the DEA in 21 CFR Part 1311. These rules apply to the software itself, not only to the prescriber.
In plain terms, the application must confirm that each prescriber is who they claim to be before they can prescribe. It must require two-factor authentication every time a controlled substance prescription is signed. It must control who can grant or change prescribing rights, and record every one of those actions. Each prescription must be digitally signed and protected from changes, and every event must leave a trace that can be reviewed later.
Meeting these rules is not enough: you have to prove it to an independent auditor approved by the DEA. The review looks at two things. The first is the privacy and security policies of the whole company, not just the product. The second is the product itself: its interface, its back end and the infrastructure it runs on, checked line by line against the DEA requirements.
At Synapse Medicine, this work involves our executive leadership, our regulatory and compliance team, product management and engineering. The self-assessment alone takes several months to prepare, and the live audit requires its own preparation.
And it never really ends. The DEA requires a new audit every two years, and also whenever a feature linked to controlled substance prescribing is changed, whichever comes first. Supporting EPCS is not a project you finish. It is a responsibility you carry for as long as the feature exists.
Building it vs. integrating it
For an EHR vendor, the question is easy to ask and harder to answer: should you build and certify EPCS yourself, or integrate access to a platform that is already certified?
Building it means carrying everything described above on your own: the first certification, a new one every two years, and a new review each time your prescribing features change. That last point matters more than it seems. When every improvement can trigger an audit, it becomes tempting to stop touching the prescribing module at all. This may be one reason why e-prescribing has changed so little in so many products.
Integrating a certified platform changes three things :
- First, the certified application, and the audit work, stay with us. Your integration covers how clinicians reach Synapse Prescribe: account setup, launch from within your EHR, and patient context. Prescribing itself, including identity proofing, two-factor signing and the audit trail, happens inside Synapse Prescribe. The initial certification, the reviews every two years and the reviews after each change are ours to carry.
- Second, the prescribing experience keeps moving forward. E-prescribing has barely changed in a generation, and we built Synapse Prescribe to change that: a platform designed around the people who prescribe, with a roadmap our partners help shape. The regulatory process is still heavy for us, but we go through it regularly and we are used to it, so it never becomes a reason to stop improving. Clinicians who reach Synapse Prescribe from your EHR get a tool that keeps getting better, not one frozen by its last audit.
- Third, the risk is carried by a team whose core job it is. Staying compliant with DEA rules is not a side topic for us. It is part of what we do every day.
Integrating access does not remove every responsibility, and it would be wrong to claim it does. Your integration still needs to launch clinicians into Synapse Prescribe securely and pass accurate patient information, and prescribers and practices keep their own obligations under the DEA rules.
What stands behind the badge
Every application used to prescribe controlled substances electronically must hold a current EPCS certification. When you choose a partner, what matters is what stands behind it.
For Synapse Prescribe, it starts with time. The platform has been EPCS-certified since October 2020. Six years of real prescriptions, through every update to the product, show that compliance holds over time, not only on audit day.
It also shows in how the audits go. Our 2026 review closed with no corrective action required. In an audit this detailed, a clean result reflects how the work is done every day, not only in the weeks before the auditors arrive.
And it matters most when you think about what could go wrong. Under DEA rules, when an audit report finds that an application no longer meets the requirements, the provider must tell its users within five business days to stop using it for controlled substance prescriptions. For an EHR, that would mean prescribers who suddenly cannot send these prescriptions, and a difficult conversation with every one of them. Six years of continuous certification is the best answer we can give to that risk.
A discipline, not a trophy
Certification is not something you win once and hang on the wall. It is a discipline you keep up, audit after audit, while the product continues to move forward. For the EHRs that integrate Synapse Prescribe, that discipline is ours to maintain, so they can focus on building their own product.
[Link to the press release and to the Synapse Medicine listing in the DirectTrust directory]
If you are weighing whether to build EPCS in-house or integrate access to an already certified platform, our team is happy to walk you through what integration looks like in practice.
