Why this report is generated | When the report generates and arrives | Where to find the report | Frequently asked questions
Practices with EPCS (Electronic Prescribing of Controlled Substances) enabled will see an automated message appear in their Message Center at the beginning of every month. This message contains an audit log report of controlled substance prescriptions and is sent from the system itself — it is not generated by a staff member, provider, or any manual action taken in the account.
This is expected, required behavior, not a system error or security concern.
Why this report Is generated
The DEA's EPCS regulations require electronic prescription applications, like DrChrono, to provide prescribers with a monthly log of the controlled substance prescriptions they've issued. This requirement comes from:
21 CFR § 1311.120(b)(27)(i) — Electronic prescription application requirements
(27) The electronic prescription application must do the following:
(i) Generate a log of all controlled substance prescriptions issued by a practitioner during the previous calendar month and provide the log to the practitioner no later than seven calendar days after that month.
Full regulation: 21 CFR 1311.120 — Electronic prescription application requirements
Because DrChrono is certified to support EPCS, the system must automatically produce and deliver this log to every EPCS-enabled practitioner every month — regardless of whether anyone in the practice requests it.
When the report generates and arrives
- The report runs automatically on the 1st of each calendar month, covering all controlled substance prescriptions issued by the practitioner during the previous calendar month.
- It is typically delivered to the practitioner's Message Center inbox on the 2nd of the month (the day after generation).
- This satisfies the DEA's requirement that the log reach the practitioner no later than 7 calendar days after the end of the month it covers.
Where to find the report
- Log in to DrChrono as the practitioner (or an account with access to that provider's Message Center).
- Go to Message Center > Inbox.
- Look for a message near the start of the month with an audit log/report attachment. The sender may display as the system account (e.g., "drchrono") rather than a specific staff member's name — this is expected, since no person initiated the export.
Frequently asked questions
Did someone on my team generate this report?
No. This report is produced automatically by DrChrono to meet a DEA regulatory requirement (21 CFR § 1311.120(b)(27)(i)) and does not require any user action.
Can this be turned off?
No. Generating and delivering this log to EPCS-enabled practitioners each month is a federal requirement for electronic prescribing applications, not an optional DrChrono feature.
Why does the sender show as "drchrono" instead of a person's name?
Because the report is system-generated rather than user-initiated, it is attributed to the system account rather than an individual user.
Is this something to be concerned about from a security standpoint?
No. This is expected, compliance-driven behavior tied to the practice's EPCS certification and does not indicate unauthorized account access.