Clear adds identity verification for outside providers and controlled-substance prescribing in Epic

Identity verification company Clear has launched two integrations that put its CLEAR1 platform inside Epic Toolbox, one for EpicCare Link and one for electronic prescribing of controlled substances (EPCS), Becker's Hospital Review reports, citing a Nov. 9 company release. The EpicCare Link integration, first announced in August 2025, lets community and affiliated providers establish accounts by matching a government-issued ID to a selfie, replacing processes that may involve paper forms and manual reviews. The EPCS integration verifies clinicians when they register to prescribe and authenticates them at the time of prescribing.

The relevance is the outside door into the chart. EpicCare Link is how non-affiliated physicians, referring practices and post-acute facilities reach a health system's patient records, and HIT Consultant notes that granting that access has historically required IT staff to run manual license checks and process notarized identity forms. The same outlet frames clinical identity fragmentation as a weakness exploited by credential stuffing, social engineering and generative deepfakes. For CISOs, external users are often the least consistently proofed population with access to protected health information. For the IT and access teams, manual onboarding is recurring administrative work.

On prescribing, HIT Consultant reports CLEAR1 achieved Drummond Certified status through third-party auditing by Drummond Group, confirming its identity proofing, biometric matching, credential revocation and audit logging conform to DEA EPCS requirements under 21 CFR Part 1311. Clinicians complete a one-time IAL2 verification and then reverify biometrically, which the company positions as an alternative to hardware tokens. Kristin Milano, associate vice president of cybersecurity at Ochsner Health, said in the release that the EpicCare Link integration creates an opportunity to make verification easier for referring providers while maintaining security.

What the evidence does not show: Clear says the integrations eliminate manual administrative steps and let providers enroll in minutes, but those are company claims. Certification addresses regulatory conformance, not real-world fraud reduction or time saved. Clear did not disclose how many organizations have implemented either integration, and no independent data on security or workflow outcomes exists yet.

The move: audit how outside users of your EpicCare Link instance are identity-proofed today, who performs that work and how long it takes, and how accounts are recovered and revoked. Compare that against your EPCS token experience for prescribers. If the audit finds inconsistent proofing or heavy manual effort, an in-workflow verification option is worth piloting, with compliance and privacy teams reviewing biometric data handling before scale. Measure the pilot yourself, because the outcome evidence will have to come from early adopters.

You are a security advisor to the CISO and executive team of a health system that gives outside providers access to patient records through EpicCare Link.

Context: Becker's Hospital Review reports that Clear has launched two integrations that put its CLEAR1 identity platform inside Epic Toolbox. One is for EpicCare Link and one is for electronic prescribing of controlled substances (EPCS). Becker's cites a Nov. 9 company release. The EpicCare Link integration, first announced in August 2025, lets community and affiliated providers set up accounts by matching a government-issued ID to a selfie. HIT Consultant reports that this access has historically required manual license checks and notarized identity forms. It also reports that CLEAR1 achieved Drummond Certified status for DEA EPCS requirements under 21 CFR Part 1311, and that clinicians complete a one-time IAL2 verification and then reverify biometrically. Clear says the integrations eliminate manual administrative steps, but that is a company claim. Certification addresses regulatory conformance, not fraud reduction or time saved. No independent outcome data exists yet.

Task: Audit how outside users of our EpicCare Link instance are identity-proofed today, who does that work, how long it takes, and how accounts are recovered and revoked. Compare that with our EPCS token experience for prescribers. Then decide whether in-workflow verification closes a gap.

Output: a one-page memo for the executive team with these sections: Current state, Gaps found, EPCS comparison, Recommendation (pilot or not), How we would measure a pilot, Open questions for Clear and for our compliance and privacy teams, including biometric data handling.

Inputs: [your organization], [number of active outside EpicCare Link accounts], [current proofing steps and who performs them], [staff hours per outside account onboarded], [current account recovery and revocation process], [current EPCS token method and known issues].

Guardrails: Use only the facts above and the inputs I fill in. Cite Becker's Hospital Review and HIT Consultant by name. Flag anything uncertain or that needs verifying. Include no patient data. Nothing here is medical advice. Label the memo as a draft for the team to check.