Identity fraud now affects high-impact sectors beyond payments, including controlled-substance prescribing and distribution. As stolen and synthetic identities improve, organizations need stronger proofing controls at the point of access.
Screenshot of services offering guides for illegal prescriptions. (Video proof of another)
The DEA has attempted to provide additional options for electronically prescribing (e-prescribe - eRx) drugs due to COVID. Before we dive into e-prescribe there is a worse method available: faxes easily faked, but they are fortunately being phased out for all drugs. Their interim final rule (IFR) guidance states, "Under NIST SP 800-63-3, the relevant identity proofing assurance level is Identity Assurance Level 2. Identity Assurance Level 2 of NIST SP 800-63-3, like Assurance Level 3 of NIST SP 800-63-1, allows either in-person or remote identity proofing." Achieving this level of assurance is trivial for these fraudsters, and in previous postings, we have detailed how they bypass identity checks. Adhering to a standard is a good starting point, and we will delve into some ideas to further secure the prescription process.
Identity proofing should not follow the same path for all doctors but adapts and matures according to their actions. Electronic Prescriptions for Controlled Substances (EPCS) policy should detect the abuse happening now and rapidly change with new layers of protection. There are additional resourcing factors that need to be in place to act upon abuse. Like how the financial sector has security teams constantly monitoring their systems for abuse, so should healthcare for controlled substances. EHR/eRx softwares that have worked with Trust Swiftly understand the need to use a system that can be powerful enough to identify cases of fraudulent doctors as non compliance results in significant fines.
Layering in more verifications with the additional use of machine learning can help track the patterns that fraudsters are committing. The current standards have a massive gap if they allow this type of drug fraud to expand into a service seen on fraud chat rooms. A live video session and physical mails would be a substantial step up identity proofing that could stop many fraud cases. More intensive proofing methods could be reserved for cases of high risk or suspected abuse in prescriptions. There will never be one verification method that defeats this fraud, so the industry needs to take a holistic approach with more remedies. This growing epidemic is complex and will take more effort than the current processes to get solved.