EPCS Two-Factor Authentication: How to Choose a Solution Beyond Imprivata

Electronic prescribing for controlled substances started as an option. Today it is the default, and the authentication step attached to it has become one of the most repeated security checks in healthcare. Surescripts data shows more than 310 million electronic prescriptions for controlled substances in 2024, and every one of them needed two-factor authentication at the moment of signing. Federal pressure keeps that volume climbing.

For a busy prescriber, repeated authentication requirements can add friction to an already demanding clinical workflow. Many health systems use Imprivata for EPCS, often alongside their broader clinical single sign-on infrastructure. However, changing phone policies, existing identity provider investments, licensing considerations, and the need for faster authentication are prompting healthcare IT teams to reassess their EPCS approach.

This guide covers what DEA requires, where common EPCS factors slow prescribers down, and how to evaluate an EPCS two-factor authentication solution beyond Imprivata.

What Is EPCS Two-Factor Authentication?

EPCS two-factor authentication is the identity check a prescriber completes each time they sign an electronic prescription for a Schedule II to V controlled substance. DEA rules under 21 CFR Part 1311 require two of three factor types: something you know (a password or PIN), something you have (a hard token), and something you are (a biometric). Completing those two factors applies the prescriber’s legal signature to the order.

Logging into the EHR does not count toward the requirement. The two factors must happen at signing, inside the prescribing workflow.

What DEA Requires From an EPCS Two-Factor Solution

Every compliant setup rests on five controls:

• Identity proofing: Before receiving EPCS credentials, each prescriber's identity must be verified using an identity proofing process that meets the applicable DEA requirements. Healthcare organizations should confirm whether the solution supports institutional identity proofing or an approved credential service provider process.
• Hard tokens: A qualifying hard token must meet the applicable DEA security requirements and remain separate from the computer being used to access the EPCS application. Certain smartphones may also serve as hard tokens when they meet the required security standards.
• Biometrics: Biometric authentication systems used for EPCS must meet the performance and testing requirements specified under 21 CFR 1311.116. Ask vendors for their independent biometric testing documentation, including the tested modality, false match rate, software version, and supported devices.
• Logical access control: Two individuals take part in granting EPCS permissions; one requests access and another approves it.
• Audit trail: The application records prescription creation, signing, and access changes, and keeps those records for at least two years.

For a full compliance walkthrough, see our DEA EPCS compliance guide.

How Imprivata Handles EPCS Two-Factor Authentication

Imprivata offers EPCS through Imprivata Enterprise Access Management for EPCS, previously known as Confirm ID. The solution supports provider identity proofing, supervised enrollment, two-factor authentication, and compliance reporting, with integrations into Epic, Oracle Health, and other EHR workflows.

Its established presence in healthcare has made it a familiar choice for organizations looking to manage clinical authentication and EPCS through an integrated platform.

Its main factor options are:

• Hands Free Authentication: Retrieves a one-time password from the prescriber’s phone over a proximity connection, even when the phone stays locked in a pocket.
• Push token notification: The prescriber approves a prompt on the Imprivata mobile app.
• Fingerprint biometrics: A certified reader at the workstation.

Imprivata presents authentication options based on the factors available in a particular setting. For example, a prescriber working remotely without access to a fingerprint reader may need to use a phone-based authentication method. While this flexibility supports different clinical environments, it also highlights an important consideration for healthcare organizations: how much their EPCS workflows depend on prescribers having access to personal smartphones.

Why Health Systems Look for an Imprivata EPCS Alternative

Imprivata's EPCS solution has been used by healthcare organizations for years. However, changing clinical workflows, evolving authentication requirements, and existing investments in enterprise identity providers are prompting some organizations to reassess their approach. The decision is often less about whether an existing solution meets compliance requirements and more about whether it delivers the right balance of security, usability, integration, and total cost of ownership.

The fastest factors depend on a personal phone: Hands Free Authentication and push notifications both need the prescriber’s own smartphone, charged, enrolled, and in range. Phone-restricted units, basement floors with weak signal, BYOD pushback, and dead batteries all leave prescribers searching for a backup in the middle of an order.

The phone-free option needs fingerprint hardware: Fingerprint readers struggle with gloves, frequent handwashing, and dry skin. Every shared workstation needs a certified reader, and Imprivata itself notes that standard laptop swipe readers do not meet FIPS requirements.

EPCS sits in a separately licensed module: Imprivata prices EPCS as part of a module stack and does not publish list prices, so renewals are hard to benchmark. Health systems that standardized on Okta or Microsoft Entra ID often pay for MFA twice: once in the identity provider and again in the EPCS layer.

EPCS is tied to the rest of the Imprivata stack: Many hospitals added EPCS because they already ran Imprivata SSO, so the two decisions became one. Teams that want to rethink clinical SSO find EPCS moving with it, even when prescribers have no complaints about signing.

Badge tap does not carry through to signing: Proximity badges speed up workstation login, but DEA does not accept a standard proximity card as an EPCS factor. Prescribers who tap in still face a second prompt at signing.

8 Questions to Ask Any EPCS Two-Factor Authentication Vendor

Use these questions in any EPCS evaluation, including when you review Imprivata:

1. Can you share your DEA biometric certification report? DEA-approved labs such as iBeta publish test reports under 21 CFR 1311.116. Ask which modality, software version, and devices the lab tested.
2. Which factors work without a personal smartphone? Confirm at least one fast, compliant option for prescribers who cannot or will not use their own phone.
3. How does the prompt appear inside the EHR? Look for native integration with Epic signing contexts, plus support for Hyperspace, Hyperdrive, and your VDI setup.
4. What happens when the primary factor fails? Ask for the backup flow and how quickly a prescriber can complete the order with it.
5. Can the solution support shared clinical workstations and frequent user switching? Evaluate how quickly prescribers can authenticate when moving between shared workstations, how sessions are managed, and whether the solution introduces additional steps during shift changes and clinical handoffs.
6. How does the solution fit with our identity provider? Check whether it works alongside Okta, Entra ID, or Ping, or requires its own directory and admin console.
7. How do you support identity proofing and logical access control? Confirm the two-person approval workflow and how the vendor supports institutional or CSP-based proofing.
8. Is EPCS licensed separately? Get pricing for EPCS alone and bundled, so you can compare total cost.

Mapping EPCS Factors to Each Care Setting

No single EPCS two-factor authentication method fits every unit. Map the strongest option to each setting before you pick a vendor.

EPCS Two-Factor Authentication Options Beyond Imprivata

Healthcare organizations evaluating alternatives to Imprivata can consider three broad approaches to EPCS authentication. These include extending existing identity provider capabilities, using dedicated hardware authentication solutions, or adopting passwordless authentication platforms designed for shared clinical workstations and frontline environments. Each approach has different implications for usability, integration, deployment, and ongoing management.

MFA platforms and identity providers: Cisco Duo supports EPCS with Duo Push, WebAuthn, security keys, and hardware tokens, and integrates with Epic for re-authentication. Some health systems run EPCS through Microsoft Authenticator in Entra ID. Okta documents EPCS integrations for Epic, though its published Hyperdrive flow still starts with a password. These options suit remote prescribing and prescribers who carry smartphones.

Token and smart card vendors: Thales and HID provide FIPS-validated hardware tokens and smart cards. They work for small prescriber groups, but carrying and replacing tokens adds friction at scale.

Frontline passwordless platforms: These platforms handle shared workstation login and EPCS signing in one layer, so prescribers use the same factor to unlock a workstation and to sign an order. They also sit on top of your existing identity provider instead of replacing it. That design targets the friction points above: no personal phone in the signing path, no fingerprint reader to maintain, and no second MFA bill on top of Okta or Entra ID.

OLOID is built for this model. Its facial authentication passed iBeta’s DEA biometric testing at a false match rate of 0.001 or lower, and OLOID Passwordless is listed in the Epic End-User Authentication Toolbox. In its Epic integration, the prompt appears inside more than 40 Epic signing contexts. Face recognition validates the prescriber, and a cryptographic token supplies the second factor automatically, so the order is signed without typing a code or reaching for a phone. Each event is written to both the OLOID and Epic audit logs with the metadata DEA requires. OLOID works alongside Okta, Entra ID, Ping Identity, and Duo.

Start your pilot in the hardest setting: Whichever direction you take, test first in the unit where EPCS breaks most often, usually the ED. Track three numbers before you scale: average signing time, failed authentication attempts, and how often prescribers fall back to a backup factor. If those hold up in the ED, they will hold up everywhere else.

For a broader view of the market, see our comparison of Imprivata competitors and alternatives.

Choosing the Right EPCS Two-Factor Authentication Solution

EPCS two-factor authentication is a recurring part of controlled substance prescribing, making the authentication experience an important consideration for healthcare organizations. While established solutions such as Imprivata support a range of authentication methods, healthcare IT teams should evaluate how well their current approach supports shared workstations, phone-restricted clinical environments, existing identity infrastructure, and the overall cost of authentication. The goal is not simply to meet DEA requirements, but to deliver a secure and efficient signing experience that works for prescribers across different clinical settings.

Start with your clinical workflows rather than a vendor shortlist. Identify where authentication creates friction, evaluate how different solutions integrate with your existing identity infrastructure, and verify their compliance documentation. Use the eight questions in this guide to assess vendors and pilot your preferred approach in a demanding clinical environment before expanding deployment.

Ultimately, the right EPCS authentication solution is one that maintains the required security and compliance standards while allowing prescribers to focus on patient care rather than the authentication process.

FAQs

1. What are the DEA requirements for EPCS two-factor authentication?

DEA requires two of three factor types (knowledge, hard token, or biometric) at signing, plus identity proofing, two-person logical access control, a tamper-evident audit trail, and a third-party audit of the EPCS application.

2. Does a username and password count as two-factor authentication for EPCS?

No. A username and password together form one knowledge factor. EHR login also does not satisfy the signing requirement.

3. Can a smartphone be an EPCS hard token?

Yes. DEA allows a phone to serve as the hard token device if it meets FIPS 140-2 Security Level 1 and stays separate from the computer used to prescribe.

4. Is face recognition allowed for EPCS?

Yes. Biometric authentication, including facial recognition, can be used as one of the permitted EPCS authentication factors when the biometric subsystem meets the applicable requirements under 21 CFR 1311.116. Healthcare organizations should request independent testing documentation and verify the biometric solution's compliance before deployment.

5. Can we replace Imprivata for EPCS and keep Imprivata for SSO?

Potentially, yes. EPCS authentication and clinical single sign-on can be evaluated as separate components, depending on the EHR integration and deployment architecture. Healthcare organizations considering this approach should assess compatibility with their existing EHR workflows, prescriber credentialing and re-enrollment requirements, logical access controls, and regulatory compliance before making a change.

6. Can EPCS authentication work without a smartphone?

Yes. EPCS regulations permit different combinations of qualifying authentication factors. Depending on the implementation, healthcare organizations can evaluate biometric authentication and qualifying hardware tokens as alternatives to smartphone-based authentication.

7. Does EPCS require biometric authentication?

No. DEA permits two-factor authentication using two of three qualifying factor categories: something you know, something you have, and something you are. Biometric authentication is one permitted option, but it is not universally mandatory.

8. Can healthcare organizations use an alternative to Imprivata for Epic EPCS?

Healthcare organizations can evaluate alternative EPCS authentication solutions for their Epic environments. The important considerations are compatibility with the existing Epic signing workflow, support for required authentication factors, identity proofing, logical access controls, and compliance with applicable DEA requirements.