E-Prescribing Software for Med Spas (2026): EPCS, State Mandates and What to Check

E-prescribing (eRx) software sends a prescription from the provider's chart straight to the patient's pharmacy, with no paper, phone call or fax. For a med spa or aesthetic practice, four checks matter most: whether the software is certified for electronic prescriptions for controlled substances (EPCS) if any provider prescribes drugs such as testosterone, phentermine or post-operative pain medication; whether it meets your state's e-prescribing mandate; whether it is built into your charting, so allergies, medications and the prescription itself live in one record; and whether it can reach the pharmacies you actually use, including compounding pharmacies.

For medical directors, prescribing providers and practice managers at med spas, plastic surgery and wellness practices. Updated October 28, 2026 · Prepared by Prospyr. Prospyr makes practice software with integrated e-prescribing. Every rule below links to the regulation or official source it comes from. Prescribing rules change and vary by state and by license type, so confirm the current requirements with your state medical, nursing and pharmacy boards before relying on them. This is not legal advice.

When an aesthetic practice needs e-prescribing

Most in-office injectables, such as neuromodulators and fillers, are purchased by the practice and administered under a provider's order, so they don't go to a pharmacy at all. E-prescribing matters when a patient will fill a medication at a pharmacy. Common examples in aesthetic and wellness practices:

• Topical prescriptions such as tretinoin or hydroquinone.
• Antiviral or antibiotic prescriptions ordered around resurfacing or surgery.
• Weight-loss medications, including GLP-1s.
• Hormone therapy.
• Post-operative pain and anti-anxiety medications in plastic surgery practices.

Some of those are controlled substances, which changes what your software must do. According to the DEA's list of controlled substances, testosterone and ketamine are Schedule III; phentermine, diazepam, lorazepam, alprazolam and tramadol are Schedule IV; and oxycodone and hydrocodone are Schedule II.

What to check, at a glance

EPCS: what the DEA rule requires

Electronic prescriptions for controlled substances are governed by 21 CFR Part 1311. The rule puts obligations on both the software vendor and your practice.

The software must be audited or certified. Under §1311.300, the application provider must have a third-party audit or a DEA-approved certification showing the software meets the rule, before it is used for controlled-substance prescriptions and again "whenever a functionality related to controlled substance prescription requirements is altered or every two years, whichever occurs first." Under §1311.102(d), before first using the software for controlled substances, the prescriber "must determine that the third-party auditor or certification organization has found" that it records, stores and transmits prescriptions correctly. In practice, ask for the vendor's audit or certification letter and keep a copy.

Each prescriber needs an identity-proofed, two-factor credential. Section 1311.105 requires prescribers to obtain their credential from an approved credential service provider or certification authority, after identity proofing. Section 1311.115 requires two of three factors to sign: something you know (a password), something you are (a biometric), or something you have (a hard token, which must be a device separate from the computer used to sign).

The credential can't be shared. Under §1311.102(a), the practitioner "must retain sole possession of the hard token" and must not let anyone else sign. Under §1311.135(a), a prescriber's agent, such as a nurse or medical assistant, may enter the prescription details, but "only the registrant may sign the prescription." If a token is lost or compromised, the prescriber must notify the practice's designated access managers "within one business day of discovery."

Two people set up access. Under §1311.125, each registered location must designate at least two individuals to manage who can sign controlled-substance prescriptions. At least one must be a registrant with a two-factor credential, and one must verify each prescriber's DEA registration and state authorization. Granting signing permission takes one person to enter it and a second, a DEA registrant, to approve it with their two-factor credential. A solo injector practice still needs two people for this step.

Records are kept for two years. Section 1311.305 requires electronic records of controlled-substance prescriptions to be kept for two years, unless state law requires longer. If you change vendors, the rule makes you responsible for migrating those records to the new system.

DEA registration is also state-specific. A provider who prescribes controlled substances to patients in more than one state generally needs a DEA registration in each. Our telehealth licensing guide covers the cross-state rules, and the DEA's telemedicine flexibilities, which run through December 31, 2026.

State e-prescribing mandates

States set their own e-prescribing requirements, and they differ in scope. Three examples:

Many other states require e-prescribing for controlled substances only. Check your state board of pharmacy for the current rule and any waiver process, and recheck when you open a location in a new state.

Medicare Part D: the 70 percent EPCS rule

This matters mostly to plastic surgery practices prescribing post-operative controlled medications to patients 65 and older. Under the CMS EPCS Program, prescribers must electronically prescribe at least 70 percent of qualifying Schedule II to V prescriptions filled under Medicare Part D each year. The requirement applies "regardless of Medicare participation status," so a cash-pay practice isn't exempt if its patients fill controlled prescriptions through Part D.

CMS automatically exempts prescribers who issue 100 or fewer qualifying Part D controlled-substance prescriptions in the year. CMS calculates compliance from claims, so there's nothing to report; non-compliant prescribers receive a notice in the fall after the measurement year.

Integration with charting

A standalone eRx tool works, but it creates a second place where medications and allergies live. Look for:

• One medication list. Prescriptions written in eRx appear in the patient's chart, and medications recorded at intake are available when prescribing.
• Allergy and interaction checks against what's in the chart, not a separate list someone has to retype.
• Patient details that carry over (name, date of birth, address, pharmacy), so the pharmacy doesn't call back to confirm them.
• Prescriptions visible in the visit note, so the chart shows what was prescribed and why.
• Renewal requests that route to the right provider instead of a shared fax line.
• Telehealth visits in the same chart, if you run virtual weight-loss or hormone programs.

Compounding pharmacies

Aesthetic and wellness practices often work with compounding pharmacies, and the FDA rules depend on the compounder type. According to the FDA, 503A pharmacies compound "based on the receipt of valid patient-specific prescriptions," while 503B outsourcing facilities may distribute either under a patient-specific prescription or "in response to an order from a health care provider... that is not for an identified individual patient" (office stock).

Before you choose eRx software, list the compounding pharmacies you use and ask the vendor whether it can send compounded prescriptions to each one electronically. If the answer is no for some, decide how those prescriptions will be sent and documented, and check that the method meets your state's mandate. The rules for compounded GLP-1s also changed: the FDA's compounding policy update records that the semaglutide and tirzepatide shortages have been resolved and that the related enforcement discretion has ended.

Questions to ask any e-prescribing vendor

1. Is your software EPCS-certified, and can I see the current audit or certification letter?
2. How do our prescribers get identity-proofed, and how long does it take?
3. Which second factors do you support, and do they meet the DEA's hard-token or biometric requirements?
4. How do we set up the two-person access controls DEA requires?
5. Does a prescription appear in the patient's chart automatically?
6. Do allergy and interaction checks use the medications already in our charts?
7. Can we send to the compounding pharmacies we use?
8. How are renewal requests and pharmacy messages routed?
9. What does it cost per prescriber, and are EPCS, identity proofing or tokens billed separately?
10. If we leave, how do we get our prescription records out?

Where Prospyr fits

Prospyr is an operating platform purpose-built for aesthetic practices. Its e-prescribing runs inside the same system as charting, digital intake and telehealth. Prospyr integrates with DoseSpot, with ScriptSure rolling out, so a prescription created in the chart transmits electronically to the patient's pharmacy and the patient and prescriber details carry over instead of being retyped. If your providers prescribe controlled substances, ask us during your demo to walk through the EPCS setup for your specific providers and states, as you should with any vendor.

Frequently asked questions

Do med spas need e-prescribing software?

If your providers send prescriptions to pharmacies, usually yes, and in states such as New York and California nearly all prescriptions must be electronic. Practices that only administer in-office treatments from their own stock may write few pharmacy prescriptions, but weight-loss, hormone and post-procedure prescriptions are increasingly common.

What is EPCS?

Electronic prescribing of controlled substances. DEA rules in 21 CFR Part 1311 require certified software, identity-proofed prescribers, two-factor authentication to sign, two-person access controls and two years of electronic records.

Can a nurse or medical assistant send a prescription for the provider?

For controlled substances, an agent may enter the prescription details, but only the DEA-registered prescriber can sign it, using their own two-factor credential, which can't be shared. For non-controlled prescriptions, delegation rules come from your state boards.

Is testosterone a controlled substance?

Yes. The DEA lists testosterone as Schedule III, so electronic testosterone prescriptions must meet EPCS rules. Phentermine is Schedule IV.

Do I need a DEA registration in every state where I prescribe?

Generally, yes. A DEA registration is tied to a state, and a practitioner prescribing controlled substances in multiple states needs a registration in each. See our telehealth licensing guide for the DEA's guidance.

Sources

• 21 CFR Part 1311: Requirements for electronic orders and prescriptions (eCFR)
• DEA Diversion Control Division: controlled substances, alphabetical order (PDF)
• CMS: EPCS Program requirement at a glance, measurement year 2026 (PDF)
• New York State Department of Health: electronic prescribing
• California Business and Professions Code §688
• Florida Statutes §456.42
• FDA: Human drug compounding laws
• FDA: Clarifies policies for compounders as national GLP-1 supply begins to stabilize
• DEA: Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities (90 FR 61301)

Editorial scope

This guide was written by Prospyr with AI-assisted research and drafting, and checked against the regulations and official pages above on October 28, 2026. It is not legal advice. Prescribing, delegation and e-prescribing rules vary by state and license type; confirm with your state boards and counsel before relying on it. Read our methodology or report a correction.