DoseSpot ePrescribing — Admin Guide

​

Overview

​

Prerequisites

• An active DoseSpot clinic account with API credentials issued by DoseSpot.
• Your organization has at least one user with the cl.dosespot.configure permission (typically the org admin role).
• The Encore Health OS edge function cl-dosespot-webhook is deployed (this is part of the platform release; you do not deploy it manually).

​

Enable DoseSpot for your organization

1. Navigate to Clinical → Settings.
2. Locate the DoseSpot ePrescribing card. The card is permission-gated; it is only visible to users with cl.dosespot.configure.
3. Toggle Enable DoseSpot ePrescribing to On.
4. Enter your DoseSpot connection details:
   • Clinic ID — your DoseSpot clinic identifier.
   • Clinic Key — the secret key paired with the Clinic ID. Treat this like a password; it is stored encrypted at rest.
   • Environment — production or staging. Use staging for testing before go-live.
5. Select Save.

​

Configure the webhook

1. In the DoseSpot ePrescribing settings card, copy the Webhook URL shown in the configuration panel.
2. Generate a signing secret by selecting Rotate signing secret. Copy the value — it is only displayed once.
3. In the DoseSpot vendor portal, register the webhook URL and paste the signing secret.
4. Send a test event from the vendor portal and verify it appears in Clinical → Settings → ePrescribing → Webhook Log with status Delivered (200).

​

Rotating the signing secret

1. Select Rotate signing secret. The new secret is shown once.
2. Update the secret in the DoseSpot vendor portal.
3. The previous secret remains valid for 24 hours to allow for in-flight requests.

​

Enroll prescribers

• Self-enrollment — On their first visit to the ePrescribing sub-tab, prescribers are walked through DoseSpot identity proofing in a guided wizard.
• Admin-initiated enrollment — From Clinical → Settings → ePrescribing → Prescribers, select Invite prescriber, choose a user, and send the enrollment link.

• Valid DEA registration for the prescribing user.
• A registered two-factor device (hardware token or supported mobile authenticator).

​

Permissions

const PRESCRIBER_PERMISSIONS = [
  // …existing CL permissions
  'cl.dosespot.view',
  'cl.dosespot.enroll',
];

const ORG_ADMIN_PERMISSIONS = [
  // …existing admin permissions
  'cl.dosespot.configure',
];

​

Verify the integration

1. Settings visible — A user with cl.dosespot.configure can see and save the DoseSpot card.
2. Tab visible — A user with cl.dosespot.view sees the ePrescribing sub-tab inside a patient chart’s Medications tab.
3. Webhook test event — A test event from the DoseSpot portal returns 200 and appears in the webhook log.
4. Test prescription (staging only) — Send a non-controlled prescription to a test pharmacy and confirm it appears in the Prescriptions sub-tab with status Sent.
5. EPCS enrollment — At least one prescriber completes EPCS enrollment and can sign a Schedule II test prescription.

​

Compliance notes

• EPCS audit trail — Every controlled-substance signing event is written to the immutable audit log with the two-factor method, signing timestamp, and user ID. Audit entries cannot be edited or deleted.
• HIPAA — DoseSpot is a HIPAA Business Associate. The signed BAA between your organization and DoseSpot must be in place before enabling production credentials.
• 42 CFR Part 2 — For SUD-related prescriptions, the standard Part 2 consent gating applies; DoseSpot does not bypass Encore’s consent enforcement.
• PDMP — Use of DoseSpot’s medication history feed does not replace state PDMP queries where required by law.

​

Troubleshooting

​

Related guides

• DoseSpot ePrescribing — User Guide
• Clinical (CL) Overview
• MAT/MOUD Tracking — Admin Guide