Electronic Prescribing of Controlled Substances (EPCS) Enrollment

After your practice submits an EPCS enrollment request through the Provider Enrollment Dashboard, you'll receive a DrFirst invite at your work email. You'll need to complete a multi-step enrollment process including identity verification, token setup, and passphrase creation before you can prescribe controlled substances.

What you'll learn

• What EPCS enables

• Prerequisites before enrollment begins

• How to complete the DrFirst enrollment process

• What happens after you finish

What EPCS Enables

Once enrolled, you can electronically prescribe Schedule II-V controlled substances directly to pharmacies.

Haven't completed ePrescribing yet? You'll need an SPI first before EPCS enrollment can begin. Check with your practice administrator on the status.

DrFirst Enrollment Process

You'll complete all steps below to enroll in EPCS. This includes identity verification, security token setup, and passphrase creation.

Step 1: Open your DrFirst invite

1. Open the invite email from DO-NOT-REPLY-EPCS@drfirst.com

2. Click Enroll now

3. Find the I have an Invite section on the DrFirst website

4. Enter your NPI number and Invite ID from the email

5. Click Proceed

   

Step 2: Download VIP Access app

You'll need the VIP Access app to generate time-based security codes for prescribing controlled substances.

1. Install VIP Access on your phone

   • iOS — Download from App Store

   • Android — Download from Google Play

2. After installing, click Continue on the DrFirst website

Step 3: Evidence collection

Experian uses this information to confirm your identity. Passing identity proofing depends on an exact match between what you enter and what's in your credit report.

Before you begin — Check your credit report at annualcreditreport.com so you know exactly what Experian has on file.

1. Complete all fields for identification

2. Click Continue to submit your information to Experian

3. If Experian can't match your demographic information, you'll get 3-5 security questions based on your credit report.

Tips for entering your information

• Name: Remove any periods. If your name has a period in it, you may need to temporarily update your NPI Registry to pass.

• Address: Remove special characters and periods. For example, "1 E. Main St. Apt. # 204" should be entered as "1 E Main St Apt 204"

• Address type: If your credit history is associated with a P.O. Box, use that instead of your residential address

• Location: You must have a U.S. address associated with your credit history

• Mobile number: Enter a personal mobile number where you can receive text messages

If identity proofing fails

Your EPCS Admin will see the IDPFAILED status on the EPCS dashboard. If that happens, you can make 3 more attempts that day to pass. After 3 attempts, your account locks for 24 hours—this is an Experian security measure and can't be unlocked early.

Still can't pass? Contact DrFirst Support for next steps. Have your NPI and invite ID handy.

Step 4: Identity document

You'll use Experian's documentation capture workflow to verify your identity.

1. Follow the prompts in Experian to upload documentation and submit a photo

2. Upload your government-issued ID — driver's license or passport

3. Take a photo of yourself

4. Return to the DrFirst page and click Check Status

   

DON'T FORGET TO CLICK! This is a commonly missed step. If you don't click Check Status within 24 hours, your enrollment gets stuck and you'll need a new invite. Write down the session key too—if you get disconnected, you can use it to get back in without starting over.

Tips for capturing your ID

• Use your phone or tablet camera

• Center your ID on a darker background

• If the image won't focus, try moving your device closer or farther from your ID

• Allow camera access when prompted

Step 5: Token registration

Register your VIP Access token with DrFirst.

1. Open the VIP Access app on your phone

2. Locate the Credential ID in the app

3. Enter the Credential ID in DrFirst

4. Create a nickname for your token so you can identify it later — don't use underscores

5. Return to the VIP Access app to view the current OTP Code — a 6-digit code that changes every 30 seconds

6. Enter the OTP Code in DrFirst before it expires

7. Submit the token registration

Register for backup — DrFirst recommend registering at least 2 tokens. If you lose access to your only token, you'll have to repeat the entire enrollment process. DEA regulations also require your token to be on a different device than the one you use to prescribe.

Step 6: Verification code

Enter the verification code to confirm your contact information.

1. Check your phone for a text message with the verification code

2. Enter the verification code in DrFirst

3. Submit

Can't receive texts? No worries — DrFirst will mail you a physical verification code. It can take up to 2 weeks, so sit tight.

Step 7: Create passphrase

Create a passphrase you'll use to sign controlled substance prescriptions.

1. Open the email from Experian with your Transaction Number

2. Navigate to the passphrase setup page using the link provided

3. Enter the Transaction Number

4. Create a passphrase meeting the requirements below

5. Confirm your passphrase

6. Submit

Passphrase requirements

• 8-20 characters

• At least 1 uppercase letter

• At least 1 number

• No special characters

• No more than 2 of the same letter or number in a row

Worried about forgetting? There's no password recovery option. Store your passphrase somewhere safe like a password manager.

Step 8: Grant activation

You're almost there! The final step requires your EPCS Administrator to activate your grant.

1. Let your practice administrator know you've completed the steps above.

2. Pair with the EPCS admin to activate your grant with DrFirst

After Enrollment is Complete

Once your grant is activated and Canvas Support finalizes enrollment, you can start prescribing controlled substances in Canvas. Your practice administrator will let you know when everything is ready.

Frequently Asked Questions

Timeline and process

Q: How long does EPCS enrollment take?

A: Timelines vary, but it is typically 3-5 days if there are no delays such as the provider and EPCS admin setting time to activate the grant

Q: Why is EPCS enrollment so complicated?

A: Federal regulations for controlled substances require extra security to prevent abuse and diversion. All the steps—identity proofing, OTP tokens, passphrases—are legally mandated.

Q: Can I complete identity proofing before ePrescribing is done?

A: No. You'll only receive the DrFirst invite after ePrescribing enrollment is complete. The systems work in a specific order that can't be changed.

Identity proofing

Q: Do I need to turn off fraud alerts before identity proofing?

A: No. Fraud alerts don't need to be turned off.

Q: Why am I getting security questions after entering my information?

A: If Experian can't match your demographic information to your credit report, you'll get 3-5 security questions based on your credit history. Having your credit report handy helps you answer them correctly.

24-hour window

Q: What if I forget to click Check Status after uploading documents?

A: You have 24 hours to complete this step. After that, your enrollment gets stuck and you'll need a new invite from Canvas Support.

Q: What if I get disconnected during the 24-hour window?

A: If you saved the session key, you can use it to resume. Otherwise, contact your practice administrator to request a new invite from Canvas Support.

Technical issues

Q: What if I can't scan the QR code?

A: Open your phone's camera and hold it so the QR code appears in the viewfinder. Try moving your device closer or farther until it focuses. Once recognized, tap the website banner that appears. You may need to try a few times.

Q: Why isn't my OTP token working?

A: Check that your phone's time and date are set to automatic—tokens are time-synchronized. Also make sure you're using the current code, as it expires every 30 seconds.

Q: What if I forget my passphrase?

A: You can reset it through DrFirst's website. See Resetting Your EPCS Passphrase for step-by-step instructions.

Getting help

Q: Where do I get help with DrFirst issues?

A: For VIP Access app issues, passphrase resets, token problems, or account lockouts, contact DrFirst Support. Have your NPI and invite ID handy.

Related Articles

• Using the Provider Enrollment Dashboard

• Preparing Provider Profiles for Enrollment

• ePrescribing (eRx) Enrollment

• Activating EPCS Grants with DrFirst

• Setting Up VIP Access on a New Phone

• Resetting Your EPCS Passphrase

• Troubleshooting EPCS Authentication Errors

Keywords: EPCS, DrFirst, controlled substances, identity proofing, VIP Access app, OTP token, passphrase, grant activation, Experian, EPCS enrollment

Categories: Provider Enrollment, EPCS, DrFirst

Roles: Providers