Overview
Before you can electronically sign a controlled substance prescription, two things need to be set up: an ID.me identity wallet with verified NPI and DEA credentials, and EPCS access enabled for your practitioner profile. Optionally, you can also enable Two Factor Authentication (2FA) on your account for additional security. This article walks you through all three of these settings.
Before you begin
You'll need access to your practitioner profile in ChartedHealth.
Have your mobile phone number ready to use text messages for ChartedHealth 2FA.
To create an ID.me wallet, you'll need: your Social Security number, a driver's license, state ID, passport, or passport card, a smartphone with a camera, and your NPI and DEA number.
Your NPI and DEA number must already be valid and on file in ChartedHealth before ID.me can verify them.
To enable EPCS for additional practitioners, another provider with EPCS enabled on their own account can enable EPCS.
Field Reference
Field | Required | Notes |
ChartedHealth 2FA method (Phone) | No | Set up from your practitioner profile's Security section |
ID.me wallet (email + password) | Yes | Created once, the first time you sign in with ID.me |
ID.me wallet MFA (Push notification, Code generator, or Security key) | Yes | Required by ID.me to secure your wallet; separate from ChartedHealth's own 2FA |
Government ID (license, passport, or passport card) + selfie | Yes | Used by ID.me to verify your identity |
Social Security number | Yes | Used by ID.me as a unique identifier; does not affect your credit score |
NPI number and DEA number(s) by state | Yes | Verified by ID.me against official NPI/DEA databases |
Enable EPCS | Yes, per practitioner | Requires a valid NPI and DEA on the practitioner's profile; only available to users who already have EPCS enabled |
Enable 2FA in ChartedHealth
Click your avatar in the top-right corner and select View Profile.
Open the Security section of your profile and click Enable 2FA. This opens a new tab.
Enter your phone number and click Verify.
Enter the verification code sent to your phone and click Verify Code. Use Send Code Again or Try Different Phone Number if needed.
Close the tab and return to ChartedHealth. Your Security section will now show Disable 2FA, confirming it is active.
Result: Two-factor authentication is enabled on your ChartedHealth account, and the "2FA required" message no longer appears when you try to sign a controlled substance prescription.
Create your ID.me Wallet and Complete Identity Verification
ID.me verification is a separate, one-time setup: you create an ID.me identity wallet, secure it with ID.me's own multi-factor authentication, verify your identity with a government ID and selfie, and then verify your medical credentials (NPI and DEA). Once complete, ChartedHealth reuses this verified identity automatically every time you sign a controlled substance prescription.
To get started, click the Practitioner avatar in the top-right corner of the platform, then click View Profile.
In the Practitioner Profile, click Configure ID.me.
On the ID.me sign-in page, click Create a wallet if you don't already have an ID.me account.
Create an ID.me wallet
Enter your personal email address and a password, accept the ID.me Terms of Service and Privacy Policy, and click Create wallet.
Confirm your email address by clicking the link ID.me sends you, or entering the 6-digit code from that email.
Secure your ID.me wallet with MFA
ID.me requires its own multi-factor authentication to protect your wallet — this is separate from the 2FA you set up in ChartedHealth.
Choose an MFA method: Push Notification, Code Generator Application, or Security Key.
NOTE: SMS is not an approved MFA option for EPCS Signing.
If you chose Code Generator, download the ID.me Authenticator app on your mobile device, then click Continue.
Scan the QR code with the app.
Enter the 6-digit code the app generates and click Continue.
Your wallet is now secure. Optionally, generate a recovery code in case you lose access to your MFA device, then click Continue.
Verify your identity
Choose a verification method: uploading your driver's license or state ID, passport, or passport card.
Read and accept the consent for ID.me to collect biometric and sensitive personal information.
Enter your mobile phone number so ID.me can text you a link to take photos of your identity document with your phone's camera.
Follow the link on your phone, place your document on a well-lit, dark surface with all four corners visible, and take the requested photos (document and selfie).
Enter your Social Security number when prompted.
Review your personal information (name, date of birth, address, phone) and confirm it's correct.
Result: ID.me compares your selfie to your ID document and confirms your identity.
Verify your medical credentials (NPI and DEA)
On the Medical verification screen, click Begin.
Enter your NPI number and your DEA number(s), including the issuing state for each. Use Add another DEA number if you hold more than one.
Confirm your provider details — state license number, issuing state, provider type, and specialty.
Once ID.me confirms your credentials, you'll see You're Verified!
Authorize ChartedHealth to receive your verified identity information, including your NPI number and DEA number expiration date, then click Allow.
Result: Your ID.me wallet is linked to ChartedHealth with verified NPI and DEA credentials. You won't need to repeat this setup — when you later sign a controlled substance prescription, ChartedHealth uses this verified identity automatically.
Note: You only need to complete ID.me wallet creation and verification once. If your DEA number changes or expires, you may need to update it with ID.me before you can sign again.
How to enable EPCS for a Practitioner
EPCS can only be activated by other clinicians in the practice who have completed their ID.ME verification and have EPCS enabled in the practice as dictated by DEA Security and Compliance.
Go to Practice Users in the practice administration section, and click the three-dot menu next to the practitioner's row.
Check Enable EPCS.
Result: The practitioner can now sign controlled substance prescriptions, provided they also have ChartedHealth 2FA and ID.me verification set up as described above. Note that once EPCS is enabled, "Deny Prescribe Rx" becomes unavailable for that practitioner — the two settings are mutually exclusive.
Who can enable EPCS for Providers
You must already have EPCS enabled on your own account to enable it for another practitioner.
Exception: if you are the only prescriber in the practice, or no prescriber in the practice has EPCS enabled yet, you can enable it for yourself to get started.
The practitioner must have a valid NPI and DEA number on file.
EPCS can't be enabled while the practitioner has "Deny Prescribe Rx" selected, and vice versa.
Best Practices
Set up ChartedHealth 2FA and your ID.me wallet before you need to sign your first controlled substance prescription, so you're not blocked mid-workflow.
Keep your phone number up to date — if you lose access to your 2FA phone number, submit a ticket to update with our team.
Confirm your NPI and DEA number are correct and current before starting ID.me medical verification, since an expired or mismatched DEA will cause verification to fail.
Save your ID.me recovery code somewhere safe in case you lose access to your ID.me MFA device.
Administrators should confirm a practitioner's NPI and DEA are valid before attempting to enable EPCS for them, to avoid the request being blocked.