All questions
Question 1
A pharmacist receives an electronic prescription for a Schedule II controlled substance. Before filling it, which of the following must the pharmacist verify?
- Only that the prescriber's name appears in the pharmacy's prescriber database.
- That the prescription is DEA-compliant and contains all required elements. (correct answer)
- Only that the transmission was received without error.
- Only that the patient has insurance coverage for the medication.
Explanation: For a Schedule II electronic prescription, the pharmacist must verify EPCS compliance, all required prescription elements, and absence of red flags. B correctly identifies these requirements. A is incorrect because prescriber database lookup alone does not satisfy validity verification. C is incorrect because error-free transmission does not address clinical and legal validity. D is incorrect because insurance coverage is administrative and unrelated to prescription validity.
Question 2
Under DEA regulations for EPCS, how must a prescriber apply their electronic signature to a Schedule II controlled substance prescription?
- By typing their name in the signature field.
- By scanning a handwritten signature and attaching it to the electronic prescription.
- Using two-factor authentication at the time of signing. (correct answer)
- By verbally authorizing a staff member to sign electronically on their behalf.
Explanation: DEA EPCS regulations at 21 CFR 1311.120 require two-factor authentication to sign controlled substance prescriptions -- combining a knowledge factor with a possession or biometric factor. C correctly identifies this requirement. A is incorrect because typing a name is not a DEA-compliant electronic signature for controlled substances. B is incorrect because a scanned handwritten signature does not meet EPCS requirements. D is incorrect because delegation of signing authority is prohibited under EPCS regulations.
Question 3
A pharmacist receives an electronic prescription for a Schedule IV benzodiazepine transmitted through a general non-EPCS electronic health record message feature. Which of the following best applies?
- The pharmacist may not fill the prescription; it must comply with DEA EPCS standards under 21 CFR Part 1311. (correct answer)
- The pharmacist may fill the prescription because Schedule IV drugs have less stringent transmission requirements than Schedule II.
- The pharmacist may fill the prescription because any electronic transmission from an EHR satisfies EPCS requirements.
- The pharmacist may fill the prescription because the prescriber's medical license was verified by the EHR vendor.
Explanation: DEA EPCS requirements under 21 CFR Part 1311 apply to electronic prescribing of all schedules of controlled substances, not only Schedule II. A general EHR messaging feature that does not meet EPCS technical specifications -- including identity proofing, two-factor authentication, and audit logging -- does not qualify as a compliant electronic controlled substance prescription. A correctly identifies this requirement. B is incorrect because Schedule IV drugs do not have less stringent EPCS transmission requirements than Schedule II; Part 1311 applies to all schedules. C is incorrect because general EHR electronic transmission does not satisfy EPCS system requirements; the system must meet the specific technical standards in 21 CFR Part 1311. D is incorrect because EHR vendor verification of the prescriber's medical license is not the standard for EPCS compliance; the EPCS system itself must meet DEA requirements.
Question 4
Under DEA EPCS regulations, may a pharmacist print and retain a paper copy of an electronic controlled substance prescription after processing it?
- No, printing is prohibited because EPCS systems must maintain entirely paperless records.
- Yes, but it must be marked as a printout and not used as a new prescription. (correct answer)
- Yes, but printed copies must be submitted to the DEA regional office.
- Yes, but printing converts the prescription to a paper prescription requiring the patient's handwritten signature.
Explanation: DEA regulations permit printing a hard copy for recordkeeping. The copy must be annotated as a printout and cannot be used as a new prescription. B correctly describes these permissions. A is incorrect because printing is specifically permitted. C is incorrect because printed copies are retained at the pharmacy. D is incorrect because printing does not convert an electronic prescription or create a signature requirement.
Question 5
A state requires all practitioners to use electronic prescribing for most non-controlled prescriptions. A dentist argues DEA registration exempts him from this requirement. Which of the following best analyzes this claim?
- The claim is incorrect; DEA registration does not exempt the dentist from state e-prescribing requirements for non-controlled substances. (correct answer)
- The claim is partially correct -- DEA registration exempts him from state e-prescribing requirements for controlled substances only.
- The claim is correct because DEA registration overrides state electronic prescribing mandates.
- The claim is correct because dentists are categorically exempt from state electronic prescribing mandates.
Explanation: DEA registration grants authority to prescribe controlled substances under federal law; it has no bearing on a state's electronic prescribing mandate for non-controlled prescriptions. A correctly identifies that the dentist's claim is incorrect and the state mandate applies. B is incorrect because a partial DEA-registration-based exemption for controlled substances under this state mandate does not exist. C is incorrect because DEA registration does not override state electronic prescribing mandates; the two operate in separate legal domains -- federal controlled substance authority and state prescribing-format requirements. D is incorrect because dentists are generally subject to applicable state electronic prescribing mandates and are not categorically exempt.
Question 6
A pharmacy's EPCS system experiences a technical failure and electronic prescriptions for controlled substances cannot be received for several hours. A patient urgently needs a Schedule II opioid. Which of the following best describes the available options?
- The prescriber may fax the Schedule II prescription as an alternative.
- The prescriber may send the prescription by email as an alternative electronic format.
- The prescriber should wait until the EPCS system is restored.
- The prescriber may issue an emergency oral Schedule II prescription with follow-up documentation. (correct answer)
Explanation: EPCS system unavailability does not prohibit Schedule II prescribing; alternative legally authorized methods remain available. D correctly identifies these alternatives. A is incorrect because fax is not a DEA-authorized Schedule II prescription method in non-emergencies. B is incorrect because email does not satisfy DEA EPCS requirements. C is incorrect because waiting is not required when alternative legal methods exist.
Question 7
A pharmacy discovers that its EPCS system was breached and a hacker used a pharmacist's credentials to access electronic controlled substance prescription records. No prescriptions were altered or diverted. Which of the following best describes the required response?
- No action is required because no prescriptions were altered or diverted.
- Notify the DEA within one business day and secure the compromised account. (correct answer)
- The pharmacy must only notify the affected patients.
- The pharmacy must permanently shut down the EPCS system until a DEA audit is completed.
Explanation: DEA EPCS regulations require reporting security incidents -- including unauthorized access -- to the DEA within one business day. The pharmacy must also secure the compromised account and investigate. B correctly identifies these obligations. A is incorrect because unauthorized access itself is a reportable event regardless of whether prescriptions were altered. C is incorrect because patient notification alone does not satisfy DEA reporting obligations. D is incorrect because permanent shutdown is not required; the compromised account must be secured while the investigation proceeds.
Question 8
A pharmacist receives an electronic prescription for a Schedule II controlled substance transmitted through a DEA-compliant EPCS system, but the prescriber's DEA registration has been revoked. Which of the following best applies?
- The pharmacist may fill the prescription because it was transmitted through a compliant EPCS system.
- The pharmacist may fill the prescription because the EPCS system verified the prescriber's identity at enrollment.
- The pharmacist may fill the prescription because the prescriber signed with valid two-factor authentication.
- The pharmacist must not fill the prescription due to the prescriber's revoked DEA registration. (correct answer)
Explanation: A prescriber with a revoked DEA registration lacks authority to prescribe controlled substances. EPCS compliance verifies the transmission mechanism but cannot authorize a prescription from someone who lacks prescribing authority. D correctly identifies that EPCS compliance does not cure the prescriber's lack of authority. A is incorrect because EPCS system compliance does not grant prescribing authority. B is incorrect because prior identity verification does not validate current authority. C is incorrect because two-factor authentication validates the signer's identity, not their current legal authority to prescribe.
Question 9
A pharmacist receives an electronic prescription for a non-controlled medication. The prescriber's electronic signature was applied using a simple username and password login. Which of the following best applies?
- This is non-compliant because all electronic prescriptions require two-factor authentication.
- This is compliant; state law governs non-controlled electronic prescriptions, not DEA requirements. (correct answer)
- This is non-compliant because DEA requires handwritten signatures on all prescriptions.
- This is non-compliant because username and password never satisfy any electronic prescribing standard.
Explanation: DEA EPCS two-factor authentication requirements apply specifically to controlled substance prescriptions. Non-controlled prescription electronic signatures are governed by state law. B correctly identifies this scope distinction. A is incorrect because DEA EPCS requirements apply only to controlled substances. C is incorrect because handwritten signatures are not required for electronic prescriptions. D is incorrect because username and password systems may satisfy state standards for non-controlled prescriptions.
Question 10
An EPCS vendor provides a prescriber with a token-based second authentication factor. The prescriber loses the token and asks their office manager to use the manager's own token to sign prescriptions in the prescriber's name. Which of the following best analyzes this practice?
- This is acceptable because the office manager is acting at the prescriber's direction.
- This is non-compliant; DEA regulations prohibit sharing authentication credentials for controlled substance prescriptions. (correct answer)
- This is acceptable if the prescriber countersigns the prescriptions afterward.
- This is acceptable as a temporary accommodation until the prescriber's token is replaced.
Explanation: EPCS regulations under 21 CFR Part 1311 prohibit sharing authentication credentials or allowing another person to use their own authentication factors to sign controlled substance prescriptions on behalf of a different prescriber. Each prescriber must authenticate using their own registered, individually assigned credentials. B correctly identifies this prohibition. A is incorrect because acting at the prescriber's direction does not authorize use of another person's authentication factors; individual identity authentication is a non-delegable EPCS requirement. C is incorrect because after-the-fact countersignature does not cure the use of improper authentication; the violation occurs at the time of the unauthorized signing. D is incorrect because there is no temporary accommodation exception to the individual authentication requirement; a lost token must be replaced through the proper re-enrollment process.
Question 11
A pharmacist receives an electronic Schedule III prescription showing evidence of post-transmission alteration -- the quantity was changed from 30 to 90 tablets and the edit is visible in the transmission metadata. Which of the following best describes the pharmacist's obligation?
- Dispense 90 tablets because the final quantity on the prescription governs.
- Dispense 30 tablets using the apparent original quantity and note the discrepancy without further action.
- Dispense 30 tablets and notify the pharmacy's liability insurer.
- Refuse to dispense and verify alteration with prescriber before taking further action. (correct answer)
Explanation: Evidence of post-transmission alteration requires refusing dispensing, investigating with the prescriber through an independent contact, and reporting confirmed tampering to the DEA. D correctly identifies this complete response. A is incorrect because a potentially altered quantity must not be dispensed without verification. B is incorrect because noting the discrepancy without prescriber contact fails corresponding responsibility. C is incorrect because insurer notification is not the required first step.
Question 12
A state law requires prescribers to use EPCS for Schedule II controlled substances unless a specific exemption applies. A prescriber asks whether she may continue to write paper prescriptions for Schedule II drugs. Which of the following applies?
- Yes, because DEA regulations still permit paper prescriptions for Schedule II and federal law preempts the state mandate.
- Yes, because patient preference may always override prescriber EPCS mandates.
- Yes, because technology exemptions always apply when EPCS hardware is not immediately available.
- No, unless she qualifies for a specific state exemption, as state law mandates EPCS for Schedule II prescriptions. (correct answer)
Explanation: Federal DEA permits both paper and electronic Schedule II prescriptions but does not mandate EPCS; state mandates are not preempted by federal permissiveness. The prescriber must comply with the state mandate unless qualifying for an exemption. D correctly identifies this state-federal relationship. A is incorrect because federal permissiveness does not preempt state EPCS mandates. B is incorrect because patient preference is not a universal exemption. C is incorrect because technology exemptions are defined by state law, not automatically available.
Question 13
A state has enacted a mandatory electronic prescribing law with specified exemptions. A pharmacist receives a paper prescription for a controlled substance from a prescriber who may or may not qualify for a state exemption. Which of the following best describes the pharmacist's obligation?
- Refuse to fill the paper prescription because state EPCS mandates must always be enforced by pharmacists.
- Fill the prescription without question because the prescriber bears sole responsibility for EPCS compliance.
- Dispense if valid; pharmacists are not responsible for enforcing prescriber EPCS mandates but must address other concerns. (correct answer)
- Fill only after contacting the state board to verify the prescriber's exemption status.
Explanation: State EPCS mandates are prescriber compliance obligations. Pharmacists are generally not required to verify or enforce prescriber EPCS compliance before dispensing an otherwise valid prescription. C correctly identifies this allocation of responsibility. A is incorrect because pharmacists are not assigned enforcement responsibility for prescriber EPCS mandates. B is incorrect because the pharmacist must still verify the prescription is otherwise valid. D is incorrect because contacting the state board before filling is not a standard pharmacist obligation.
Question 14
A prescriber wants to electronically prescribe a controlled substance to a patient she has consulted only via telemedicine and has never seen in person. Under the Ryan Haight Act, which of the following generally applies?
- Telemedicine prescribing is fully permitted when the prescription is transmitted through a DEA-compliant EPCS system.
- EPCS transmission automatically satisfies all Ryan Haight Act requirements.
- Telemedicine alone fully satisfies all federal requirements for controlled substance prescribing.
- An in-person evaluation is generally required before prescribing controlled substances via telemedicine. (correct answer)
Explanation: The Ryan Haight Online Pharmacy Consumer Protection Act established a general requirement for at least one prior in-person evaluation before online or telemedicine controlled substance prescribing, with limited exceptions. However, DEA and HHS have extended telemedicine prescribing flexibilities through December 31, 2026, which modify the in-person evaluation requirement for certain qualifying telemedicine encounters. EPCS is a transmission mechanism only; it does not satisfy the clinical relationship requirements under the Ryan Haight Act or the applicable telemedicine flexibility framework. D correctly identifies both the general rule and the current flexibility context. A is incorrect because EPCS transmission governs how the prescription is transmitted; it does not independently satisfy or override in-person evaluation or telemedicine requirements. B is incorrect because EPCS satisfies only the transmission format requirement; the clinical relationship requirements are separate. C is incorrect because telemedicine prescribing without satisfying either the in-person evaluation requirement or an applicable flexibility provision violates the Ryan Haight Act.
Question 15
A state enacts an electronic prescribing mandate requiring EPCS for all controlled substances dispensed in the state. A pharmacist receives a paper Schedule III prescription from an out-of-state prescriber licensed in a neighboring state. Which of the following best applies?
- The pharmacist must refuse to fill because all controlled substance prescriptions must be electronic under the state mandate.
- The pharmacist may not fill because out-of-state prescribers are never subject to the receiving state's EPCS mandate.
- The pharmacist may fill the prescription if it complies with all applicable legal standards and is otherwise valid. (correct answer)
- The pharmacist must fill the prescription because federal law preempts state EPCS mandates for out-of-state prescribers.
Explanation: State EPCS mandates typically apply to prescribers licensed in or practicing within the state. An out-of-state prescriber may not be subject to the same mandate, and the pharmacist should evaluate the prescription under all applicable legal standards. C correctly identifies this jurisdiction-specific analysis. A is incorrect because the state mandate may not apply to out-of-state prescribers. B is incorrect as an absolute statement; the analysis depends on the state mandate's scope. D is incorrect because federal law does not preempt state EPCS mandates.
Question 16
Which of the following best describes an electronic prescription under pharmacy law?
- A prescription transmitted by fax from a prescriber's office to a pharmacy.
- A prescription typed on a computer and printed for the patient to hand-deliver to the pharmacy.
- A prescription transmitted verbally by telephone and transcribed by the pharmacist.
- A prescription transmitted electronically via a compliant system meeting state and federal requirements, including EPCS for controlled substances. (correct answer)
Explanation: An electronic prescription is one generated, signed, and transmitted electronically from prescriber to pharmacy. D correctly identifies this definition. A is incorrect because fax involves paper at some point. B is incorrect because printing creates a paper element. C is incorrect because verbal telephone transmission is an oral prescription, not an electronic one.
Question 17
Under most state pharmacy laws, which of the following electronic prescriptions may a pharmacist fill for a Schedule II controlled substance in a non-emergency situation?
- An electronic prescription transmitted through a DEA-compliant EPCS system containing all required controlled substance prescription elements and signed using two-factor authentication. (correct answer)
- Any electronic message from a licensed prescriber, including email, provided the prescriber's license is verified.
- An electronic prescription transmitted by fax, which satisfies electronic prescribing requirements.
- An electronic prescription created by a nurse on behalf of a physician who verbally authorized it.
Explanation: Schedule II electronic prescriptions require a DEA-compliant EPCS system with all required elements and two-factor authentication. A correctly identifies these requirements. B is incorrect because email and informal messages do not satisfy DEA EPCS requirements. C is incorrect because fax is not electronic prescribing. D is incorrect because nurse-created prescriptions with verbal physician authorization are oral prescriptions for Schedule II emergency use only.
Question 18
Under DEA EPCS regulations, what must an EPCS audit trail capture?
- Only the date and time the prescription was transmitted.
- Only the prescriber's name and DEA number.
- All actions on prescriptions, including identity, date, and time. (correct answer)
- Only the date and time the prescription was dispensed.
Explanation: EPCS audit trails must capture all actions on each prescription -- creation, modification, signing, transmission, and dispensing -- with user identity and timestamps. C correctly identifies these comprehensive requirements. A is incorrect because transmission timing alone is insufficient. B is incorrect because prescriber identification alone is not a complete audit trail. D is incorrect because dispense timing alone omits the complete lifecycle required by DEA EPCS regulations.
Question 19
Under federal DEA regulations, which of the following is required for a pharmacist to lawfully fill an electronic prescription for a Schedule II controlled substance?
- The prescription must be sent through a DEA-compliant EPCS system with two-factor authentication. (correct answer)
- The prescription must be sent via fax with the prescriber's handwritten signature attached.
- The prescription must include a DEA Form 222 number linking it to the prescriber's ordering record.
- Any electronic message from a licensed prescriber satisfies Schedule II electronic prescribing requirements.
Explanation: DEA regulations at 21 CFR Part 1311 require Schedule II electronic prescriptions to be transmitted through a compliant EPCS system meeting identity proofing, logical access controls, and audit requirements. A correctly identifies these requirements. B is incorrect because faxed signatures are not electronic prescriptions under DEA EPCS. C is incorrect because DEA Form 222 is for ordering controlled substances, not linking prescriptions. D is incorrect because any electronic message does not satisfy 21 CFR Part 1311 specifications.
Question 20
A prescriber's EPCS system requires identity proofing as part of enrollment. What does identity proofing require?
- Submitting a copy of the state medical license to the pharmacy's system administrator.
- Completing an online training course about controlled substance prescribing.
- Verification of the prescriber's identity using credential checks and authoritative source confirmation. (correct answer)
- Registering the DEA number with the EPCS vendor's public database.
Explanation: DEA identity proofing under 21 CFR 1311.105 requires verification against authoritative sources through credential verification, knowledge-based authentication, and document verification. C correctly describes this process. A is incorrect because license copy submission to a pharmacy administrator is not the DEA standard. B is incorrect because training is not identity proofing. D is incorrect because registering with a vendor database is not the required identity verification process.