Locked Out at the Last Step: Identity Proofing, E-Prescribing and Why We Went Live in Brazil First

There is a moment every healthcare software company in the United States reaches eventually. The records work. The billing works. The laboratory, the scheduling and the patient portal work. The product has been through testing and has earned ONC Health IT certification.

And then you reach the last gate: letting doctors electronically prescribe controlled substances.

For us, that gate stayed closed for months. This is the story of what happened, how the system around that gate works, and why we ended up going live with electronic prescriptions in Brazil first.

The last barrier: prescribing controlled substances

Electronic prescribing of controlled substances (EPCS) is regulated by the Drug Enforcement Administration under 21 CFR Part 1311. The rules exist for good reasons: opioids and other controlled drugs need strong safeguards. In practice, a software company has to clear several steps:

• The application itself must be audited or certified against the DEA requirements before it can be used for EPCS, and recertified every two years or whenever that functionality changes.
• Every prescriber’s identity must be proofed by an approved credential service provider before they receive the two-factor credential they use to sign prescriptions.
• The prescription network has its own requirements. Surescripts, which runs the network that carries most e-prescriptions in the country, requires prescribers to complete identity proofing at Identity Assurance Level 2 before they are added to it.

None of that is unreasonable on paper. The problem is who controls each step.

A market with very few doors

In practice, most U.S. health software companies do not build identity proofing themselves; they route prescribers through an outside provider. Across the industry, that step most often runs through a small number of companies, with ID.me and Exostar among the most common.

The prescriptions themselves then travel over a network with essentially one dominant operator. In 2019, the Federal Trade Commission sued Surescripts, alleging that it illegally maintained monopolies in two e-prescribing markets, routing and eligibility, using loyalty and exclusivity arrangements to keep competitors out. According to the FTC, a federal court later found that Surescripts held monopoly power in those markets, with a share of about 95%. In July 2023, Surescripts settled with the FTC, agreeing to an order that restricts exclusivity and loyalty terms in its contracts and bars non-compete agreements that kept employees from joining competitors. Surescripts disputed the FTC’s case.

Pharmacies brought their own antitrust class action, In re Surescripts Antitrust Litigation, alleging inflated prices for e-prescription routing. Surescripts and Allscripts (now Veradigm) agreed to pay $39.75 million to settle, after RelayHealth, a McKesson unit, had settled for $10 million. The defendants denied the allegations.

When a few companies control identity, and one company controls the network, a newcomer’s timeline depends on how quickly those companies decide to let it in.

What we experienced

We did everything the process asked. We signed a contract with Surescripts. We worked to connect identity proofing for our prescribers. And we waited, for months.

Requests stalled. Steps that should have taken days stretched into weeks. Problems appeared that we could not explain and nobody resolved. From where we stood, it felt like sabotage: every delay came at the exact step that would have let us compete on equal terms. Whatever the intent on the other side, the effect was the same. A certified platform, ready to serve patients, was kept from completing the last step, while our time and money ran out.

We are not the only ones who have felt this. The FTC’s case and the pharmacies’ lawsuit exist because others found the same doors hard to open.

Who owns whom is getting harder to see

When you run into the same handful of gatekeepers at every step, the natural question is who stands behind them. That question is getting harder to answer.

In March 2025, the Treasury Department’s Financial Crimes Enforcement Network issued an interim final rule that exempts U.S. companies from reporting their beneficial owners under the Corporate Transparency Act. The rule narrowed the reporting requirement to foreign companies, cutting the number of expected filers from about 32 million to roughly 12,000. That database was never public, but it meant the government itself was collecting ownership information. Now, for domestic companies, it largely is not.

In a market where a few companies already control identity, networks and certification, less visibility into ownership makes concentration harder to see and harder to challenge.

The same step in Brazil took a week

So we did what any company with a working product and a closing door would do: we took it where the door was open.

Brazil handles the same problem, proving that a prescriber is who they say they are, through its national public key infrastructure, ICP-Brasil. Digital certificates for professionals are issued by a large, competitive market: according to ITI, the federal agency that runs ICP-Brasil, the infrastructure includes more than 100 certification authorities, around 1,500 registration authorities and more than 25,000 registration agents. A doctor can get a certificate from many different providers, and software companies can integrate with them without waiting for permission from a single gatekeeper.

With that infrastructure in place, we completed electronic prescriptions in Brazil, including controlled substances, in about one week.

Brazil’s health data is also more open in important ways. The national registry of health establishments (CNES) and the national procedure table (SIGTAP) are public, and the Ministry of Health runs a national data network (RNDS) based on the HL7 FHIR standard. Software companies build on public infrastructure instead of renting access to private bottlenecks.

Brazil is not perfect

None of this means Brazil has solved corruption. It has not. I have written about what I saw in Brazilian public health, and those problems are real. Brazil has fewer monopolies in this part of healthcare, but it still struggles with corruption.

The difference is structural. In Brazil, a new company can get through the door and then has to win on merit. In the United States, the door itself can be the barrier.

What would change this

The goal of identity proofing is security, not market control. The United States can keep strong safeguards and still open the market:

• More approved identity providers, with clear timelines for onboarding new software companies
• Interoperable credentials, so a prescriber verified once can use that identity across certified systems
• Enforcement of the FTC order and continued scrutiny of exclusivity in e-prescribing
• Ownership transparency for companies that control critical healthcare infrastructure

Patients and doctors should not have to wait while a few companies decide who may compete.

We have not given up on the United States. This is the country that gave me safety, education and opportunity, and we intend to serve its patients. But we will not stand still while a gate stays closed. We built in Brazil, we went live in Brazil, and we will keep pushing for an American market where the best product can reach the people who need it.

---

Sources

• Federal Trade Commission, stipulated order in FTC v. Surescripts, July 2023; coverage by Healthcare Dive and EHRIntelligence
• In re Surescripts Antitrust Litigation, No. 1:19-cv-06627 (N.D. Ill.); settlement summary and RelayHealth settlement
• DEA Diversion Control Division, EPCS questions and answers for providers
• RXNT on identity proofing for EPCS and the Surescripts network; Exostar on DEA EPCS
• FinCEN interim final rule on beneficial ownership reporting, March 2025, summarized by Davis Polk and Greenberg Traurig
• ITI, ICP-Brasil in 2019

---

Want to see the platform we built? Create your AENTE account or talk to our team.

← Back to blog