QSI EPCS On-Boarding Manual User
Table of Contents Introduction... 2 EPCS On-Boarding Steps Checklist... 2 EPCS On-Boarding Steps... 3 EPCS Token... 8 Multiple Tokens... 9 System Administrator... 12 Terminating a Provider... 15 Contract/Extended Leave Provider... 15 1 P a g e
Introduction This manual will be used to successfully onboard providers to be able to electronically prescribe controlled substances within the DrFirst/Rcopia application. Due to the nature of prescribing controlled substances, there is a lot of personal information from the provider that is required. Before starting this process, the System Administrator must submit a Soffront Support Request to begin the EPCS process. A Service Change Form (SCF/Contract) must be completed and hard tokens will be mailed to the facility for each provider. The Support Analyst must verify that the e-mail address in the provider s DrFirst profile is their personal e-mail address. The Support Analyst will select the providers to begin the EPCS On-Boarding Process and the provider will receive an e-mail invitation to their personal e-mail from DrFirst to initiate the registration. IMPORTANT: The provider should not begin the registration process without a hard token assigned and in their possession. The System administrator will facilitate the hard token assignment. EPCS On-Boarding Steps Checklist This is a quick reference to each step that must be completed to successfully on-board. After this checklist, each step is fully explained with screenshots in the pages below. 1. System Administrator submits Soffront Ticket Request to begin process. a. SCF/Contract change will be completed b. Hard tokens will be mailed to system admin 2. Hard Token must be received before the process begins. 3. E-mail must be the provider s PERSONAL email address. 4. Email invite is received. 5. NPI and Invite ID will be filled out. 6. Terms of use will be accepted. 7. Review Prerequisites. 8. Enter in personal information and use the provider s home address. 9. Use a personal credit card. 10. Use all capital letters for the primary DEA# 11. If demographics are entered correctly, answer questions about personal financial history. 12. Experian will pass or fail the process. 13. If the process fails three times, do not attempt again for 24 hours. 14. A passphrase will be created to access the account. It must be at least eight characters with one capital letter and number. 15. Add token to the account. 16. Nickname for token must be created. 17. Enter the serial number from back of the hard token in all capital letters, starts with AVT. 2 P a g e
18. The OTP pin number from the hard token. 19. Once the IDP process is complete, the token is activated, an IDP letter will be mailed to the provider s home address. 20. Log in to the EPCS Gold Website using the first email invite. See step 4. 21. Access the click here to register link and use the token to enter the OTP pin number and use the passphrase that was created in step 14. 22. Enter the IDP confirmation Code that was in the letter sent by Experian. 23. The provider will need to partner with the System Administrator to get validation. 24. The System Admin will change status to Active for the provider 25. The provider will identify themselves by entering NPI number, OTP pin and passphrase. 26. The provider will click authorize and can now e-prescribe controlled substances. EPCS On-Boarding Steps Every EPCS provider will receive an invite from DrFirst (DO-NOT-REPLY- EPCS@epcsdrfirst.com) and must use this to initiate the process to activate their EPCS token. This email may have gone to the junk folder, so check both the inbox and the spam/junk folder for it. Within the email, there will be a link listed under step one (1) within the directions. The provider will click this link to initiate the process to activate the token. The invite message also includes the invite ID so save this email in case the process is not completed. 3 P a g e
This link will take the provider to the following page where NPI# and Invite ID will already be prepopulated in the I have an Invite section, just confirm the information matches what is in the email that was received. Note: The provider may be required to scroll down and to the right to find the boxes including the Invite ID when launching this page. Some browsers, such as Internet Explorer, do not condense the information at the top of the page. DO NOT START THIS PROCESS WITHOUT THE EPCS TOKEN. Even if the identity-proofing (IDP) process is complete, the last step cannot be completed without the token. Once logged in, the first step will be to accept the terms of use, shown below: 4 P a g e
Second, the provider needs to review the prerequisites that are displayed on the next screen (see below): The provider must enter any information within the user registration screen that was not uploaded by the NPI Registry marked with a red asterisk (*). Please note: NPI, First Name, and Last Name will be prepopulated with data from the National Plan & Enumeration System (NPES). Providers will not have the ability to change the content of these fields. NOTE: It is very important that the address that is entered matches the provider s home address, not the practice address. This address will only be used for the IDP Process and must match the billing address of the credit card being provided. Use a personal credit card, not a debit card or a business credit card, and only the first eight (8) characters are required for the credit card. Even though the credit card and/or Phone # are not mandatory fields, it will help with passing the Identity Proofing process. If the provider chooses to use the Credit Card field, make sure a personal Visa or Master Card (not debit) registered under their name at their residential address is being used. If they choose not to use a credit card, it is strongly recommended to provide telephone number associated with their residential address (landline or cell phone). 5 P a g e
When entering the provider s DEA number, please use all capital letters, for example AA1234567, not aa1234567, nor Aa1234567 Enter the primary DEA number, not a special DEA number or special identification number that has been assigned to the provider in order to prescribe addiction medications. If the demographics were entered correctly, the provider will be required to answer three (3) to four (4) questions pertaining to their personal financial history. Providers who unsuccessfully enter their demographic information will not be presented with financial history based questions. Instead, they will see a message after entering their demographics that informs them of an unsuccessful identity proofing. If Experian was unable to verify the provider s identity based on the answers to the first three questions, the fourth question will be presented. 6 P a g e
Based on the answers as well as the initial information that was entered on the previous screen, Experian will determine whether the provider successfully passed or failed. If the process fails, the IDP process must be started over. Note: If failed three (3) times, do not attempt to go through the IDP process again for 24 hours. Once the provider has failed three (3) times, the account will be locked and the process cannot be completed until after 24 hours has passed since the last attempt. Completion Once completed successfully, a confirmation to verify the provider s identity will populate. Next, a passphrase must be created that will be used to access the provider s account in the future and during the process of sending a scheduled medication within Rcopia. The passphrase needs to be at least eight (8) characters long, with one capital letter and one number. 7 P a g e
A security question and answer must be created in case the provider forgets the passphrase. The passphrase can only be reset by the provider and not by Qualifacts or the DrFirst technical support team. EPCS Token To complete this process, the provider will be required to add the EPCS token to their account. The hard token that was received from DrFirst will be used. The one time password pin (OTP) can be obtained by pushing the button. 8 P a g e
The following information must be entered: a. A nickname for the token b. The serial number from the back of the hard token, which starts with AVT. When entering in the serial number, enter the serial number/credential ID in all capital letters. c. The OTP pin number from the hard token (security code from the soft token). Note: On the hard token, the pin will reset and change every 30 seconds, so if it disappears before it is entered, simply push the button again. Multiple Tokens Providers have the ability to add multiple tokens to their account after completing the EPCS Gold identity proofing process. Providers that do not wish to add multiple tokens after completing the identity proofing process can choose to Cancel Additional Token. Providers will continue to have the ability to manage their tokens within the EPCS Gold Prescriber Dashboard later if needed. The provider is allowed to add up to five (5) soft tokens (app token) on multiple devices (ipad, iphone, Android, etc.) Access the App Store and search for the app titled VIP Access. The symbol for this app is also shown below: If the provider is unable to bind their EPCS Gold hard token after successfully passing the identity proofing process, they will see a message asking for an additional PIN from the token. With the additional PIN, EPCS Gold will have the ability to recognize the token and sync it correctly. There will be a confirmation that the token has been added to the account. 9 P a g e
IDP Confirmation Code letter QSI EPCS On-Boarding Manual User Once the IDP process is completed, and the token has been activated, an IDP Confirmation Code will be mailed in a letter from Experian through USPS first class mail. This letter will be mailed to the address that was provided during the IDP process and must be the provider s home address. There is not a signature required upon delivery of the Experian letter. The provider will log into the EPCS Gold website using the first invite email that was received. The provider will click the Click here to register link. The token will need to be used to enter the OTP pin number and the passphrase that was created. 10 P a g e
If the passphrase is forgotten, it can be reset by clicking the link titled Forgot Passphrase. Once logged in, enter the IDP Confirmation Code or Transaction ID found in the letter sent by Experian. This code should be entered into the box shown below and then click Continue: Once completed, the provider should log into Rcopia with the System administrator to activate the provider s grant status. EPCS System Administrator On-Boarding Process In order to complete the necessary steps, a System Administrator must be identified for the organization within DrFirst. To verify this, please contact the QSI Support Analyst to verify if specific staff are marked as System Administrators. If they are not, a Soffront Support Request must be created to have appropriate staff registered as System Administrators within DrFirst. Please note that if the organization has multiple locations, it is best practice to designate a staff member per location as a system administrator in DrFirst. In order to complete the following steps for the provider EPCS registration, the system administrator must physically be with the provider. 11 P a g e
System Administrator To begin, access DrFirst by finding the desired Client> ECR> Medications> Manage Medication> EPCS Gold. This link will launch the Logical Access Control (LAC) screen. The system administrator and a validating provider are necessary to authorize the provider for EPCS. The LAC screen will list only those providers that have enrolled, meaning they have completed the IDP process with Experian, activated their token, and entered their IDP Reference ID successfully. All providers with an inactive grant will be listed first... Note: This screen will show no more than 50 providers, a search for the provider can be conducted at the top of the page. 12 P a g e
Next, the administrator will need to change the LAC grant to Active for any providers that need authorization to electronically prescribe controlled substances. The validating Provider will need to identify themselves on the LAC screen by entering their NPI number. The Validating Provider can be any provider that has an EPCS Status of enrolled. This could be the doctor being activated, or any doctor within the practice that is enrolled with EPCS Gold. 13 P a g e
The provider will choose the OTP token from the list to be used. The provider will need to enter the passphrase and the OTP pin from the token. Once the provider clicks Authorize, the provider will then be able to start e-prescribing controlled substances within DrFirst. If necessary, it is possible for the administrator to see the history of providers that have gone through this process through the Logical Access Control Activity Report. 14 P a g e
Managing EPCS Providers QSI EPCS On-Boarding Manual User There may be different scenarios that impact the status of a provider. The following will explain the difference between terminating a staff and deactivating a staff. Terminating a Provider If a provider is leaving the organization and not returning, then the system administrator will need to create a Soffront Support Request and request that the provider be removed. The system administrator will also need to access their LAC screen within DrFirst and select the Grant status of inactive. By selecting the provider as inactive on the LAC screen, if the provider ever returned to the practice, they would have to go through the entire IDP process, again. Contract/Extended Leave Provider If a provider is a contract provider that works contracts out by month or a provider is going on an extended leave they will still need to create a Soffront Support Request and request the provider be removed. However, if they know the provider will be returning to the organization, they do not need to go to the LAC screen and select a Grant status of inactive. If the inactive status is selected, the provider will have to go through the entire IDP process. 15 P a g e