Inflection: EPCS Support FAQs


1. Why

a. Inflection delivers instant identity verification and background screening solutions to help reduce risk without compromising scale, user experience, or fairness. As part of our suite of verification services, we provide a simple, intuitive workflow for Electronic Prescription of Controlled Substances (EPCS) that meets DEA requirements for identity proofing and two-factor authentication (in an exclusive partnership with Duo Security). Learn more by visiting

2. How do you keep my information secure?

a. All of your personal information is encrypted both in transit and at rest, and sent over https to ensure top-level security. All sensitive information is stored in a separate, secure environment. We take privacy very seriously. All personal information is encrypted in transit using TLS, and sensitive PII is encrypted at rest using AES256 with a unique encryption key for each record. All data is stored in AWS' secure environment, which has received ISO27001, PCI-DSS, and SOC 2 security certifications.

3. How long do you keep my information for?

a. Federal identity proofing standards require that we keep identity proofing records for as long as you have an active Duo account enrolled in EPCS.

4. How will my information be used?

a. Privacy is very important to us. We will only use this information for the intent of verifying you for this Electronic Prescription of Controlled Substances use case. Your personal information is not shared or used for our own or third-party purposes beyond verification. Learn more about’s Identity Proofing Policy ( ).

5. What do I need in order to complete identity proofing?

 a. Federal identity proofing standards require that you first answer security questions, and then prove that you are the responsible party for either a utility (such as a telephone service) or a financial account (such as a bank account) under your own name and attached to your home address. The first attempt at identity proofing will use your phone number (utility). If additional verification is needed, we will attempt to verify you through a financial verifier (financial account or credit card).

b. You will need to provide a phone number (mobile or landline) that is registered to your legal name and home address.

c. If we cannot verify you using your phone number, we will need to use a financial institution, such as a bank or credit card account. To complete identity proofing using this method, you will be asked to enter your username and password to the financial institution.

d. If you have recently changed your name, and your new legal name is not reflected in your phone carrier or in your financial account, please update your name before going through the verification flow. If you update the legal name in your financial account, we can verify that instantly. If you update your phone carrier record, we will be able to verify you a week after the change.

6. Can everything be done via cell phone? Or do I need a computer?

a. EPCS verification must be completed on a desktop/laptop computer connected to the internet.

7. What happens if I don’t complete the identity verification flow?

a. If you stop verification anytime up to the security questions, there is no impact. But, once you reach the security questions, exiting the flow will count as an attempt to answer the questions. This is done to prevent someone else from fraudulently pretending to be you. We allow up to 3 attempts on security questions within 15 days. Please make sure you are near your mobile or landline registered to your name and home address, or you know your bank account credentials if we cannot verify your identity with your phone carrier.

8. I’d like to learn more about the DEA requirements for EPCS.

a. EPCS Q&A: DEA interim final rule:


9. To verify my utility account, what phone number should I use?

a. You will need to use a phone number that is registered to your legal name and address that you use in the ID proofing flows. The phone number can be either a mobile or landline phone. You must have access to this phone number when completing ID proofing. This phone number should be tied to your legal name as it appears on the iD proofing screen and the home address you entered into

10. I’m on a family plan, can I verify my phone number?

a. In most cases, our system will be able to detect if you’re part of a family plan and still tie your legal name and home address to the account. In cases when we cannot, you can finish identity proofing by verifying a financial account.

11. I have a work cell phone and a personal cell phone, which should I use?

a. It is important that the legal name and address attached to the phone match your legal name and home address. Your work phone may be associated with a medical institution name or address, in which case we would not be able to verify your identity with that phone number. You can still use your work cell phone number to enroll in Duo’s two-factor authentication (2FA) after completing identity proofing.

12. The name and address on my utility bill are correct, but I failed utility verification, how do I get my information updated?

Inflection partners with LexisNexis for utility verification. To correct your information, please contact LexisNexis directly by email at LexisNexis or by phone at 866-277-8763. Please note, it typically takes a week for the update to reflect in the data. If you can’t wait, you can continue and verify with a financial account instead.


13. Who is Plaid and is it safe for me to use?

a. Plaid accesses identity information from financial institutions. All client communication with Plaid's API utilizes cryptographically hashed headers and timestamps to verify authenticity. Plaid has also completed a SOC 2 report. If you have any questions, please email them at or learn more here.

14. What if I bank with an institution that is not listed in the financial verification section?

a. If you have a credit card with one of the institutions, for example, Capital One or Chase, then you can enter the credentials of your credit card account that is associated with your legal name and home address to verify your financial account. If none of these apply to you, please contact your hospital administrator for manual identity proofing options.

15. Do you see or store the password to my financial institution?

a. Your password remains completely protected as we do not have any access to view or store your password. The only information we get from the financial institution is the legal name and address associated with the account. This is to meet federal identity proofing guidelines for EPCS subscriptions.

16. Is my financial account information saved or stored anywhere?

a. We do not see or store any financial account information other than the legal name and address associated with the account. We do not view, nor do we have access to any other financial account information, such as account balances, or transaction information.


17. I failed the security questions

a. You can try again 2 more times within 15 days to verify with security questions. The maximum number of attempts allowed is three times in a 15 day period.

18. I failed the security questions 3 times and got “we are unable to verify you at this time”. What do I do now?

a. The credit bureaus limit the number of security question attempts to 3 times in 15 days. If you have failed once, you can try again 2 more times to verify with security questions. If you have already failed the security questions 3 times and received the “we are unable to verify you at this time,” message, please try again in 15 days or contact your hospital IT administrator for an alternate way to enroll in EPCS.


For more information on Inflection's identity proofing process please visit this site and refer to the Remote Identity Proofing section: Identity Proofing Policy.


Inflection Support: 855-496-1546

Was this article helpful?
1 out of 3 found this helpful
Have more questions? Submit a request


Powered by Zendesk