21 CFR §1311.140

1. (a)For a practitioner to sign an electronic prescription for a controlled substance the following must occur:
   1. (1)The practitioner must access a list of one or more controlled substance prescriptions for a single patient. The list must display the information required by § 1311.120(b)(9).
   2. (2)The practitioner must indicate the prescriptions that are ready to be signed.
   3. (3)While the prescription information required in § 1311.120(b)(9) is displayed, the following statement or its substantial equivalent is displayed: “By completing the two-factor authentication protocol at this time, you are legally signing the prescription(s) and authorizing the transmission of the above information to the pharmacy for dispensing. The two-factor authentication protocol may only be completed by the practitioner whose name and DEA registration number appear above.”
   4. (4)While the prescription information required in § 1311.120(b)(9) and the statement required by paragraph (a)(3) of this section remain displayed, the practitioner must be prompted to complete the two-factor authentication protocol.
   5. (5)The completion by the practitioner of the two-factor authentication protocol in the manner provided in paragraph (a)(4) of this section will constitute the signing of the prescription by the practitioner for purposes of § 1306.05(a) and (e) of this chapter.
   6. (6)Except as provided under § 1311.145, the practitioner's completion of the two-factor authentication protocol must cause the application to digitally sign and electronically archive the information required under part 1306 of this chapter.
2. (b)The electronic prescription application must clearly label as the signing function the function that prompts the practitioner to execute the two-factor authentication protocol using his credential.
3. (c)Any prescription not signed in the manner required by this section shall not be transmitted.