NCPDPe-PrescribingSurescripts

NCPDP SCRIPT Standard: e-Prescribing Guide (2026)

November 13, 202652 min readUpdated Nov 13, 2026

Written by

CTO & Co-Founder

CTO & Co-Founder at Nirmitee.io. Architects healthcare integrations across FHIR, SMART on FHIR, ABDM and NHCX, writing from production experience taking hospital software from sandbox to go-live.

NCPDP SCRIPT Standard: e-Prescribing Guide (2026)

TL;DRSummary. Checked November 13, 2026

NCPDP is the U.S. not-for-profit group that writes the data standards pharmacies, prescribers and drug plans use to talk to each other.
The NCPDP SCRIPT standard covers prescriptions: new ones, changes, renewals, cancellations, fill notices, medication history and electronic prior authorization.
The NCPDP Telecommunication standard (version D.0) is a different standard. It carries the pharmacy's claim to the drug plan.
Medicare Part D has required SCRIPT 2017071 since January 1, 2020. From January 1, 2028, only version 2023011 is allowed.
Most U.S. e-prescriptions travel over the Surescripts network, which checks each message and routes it. Software must pass Surescripts certification first.

pharmacy integration servicesWe reply within 2 working days.

What are the key NCPDP SCRIPT facts?

NCPDP writes the U.S. pharmacy data standards. SCRIPT carries prescriptions, and Telecommunication carries pharmacy claims. Medicare Part D requires SCRIPT, with version 2023011 the only one allowed from January 1, 2028. Surescripts routes most e-prescriptions, DEA rules govern controlled substances, and the specifications themselves are for NCPDP members.

Fact	Detail	Source
Who writes the standards	NCPDP, an ANSI-accredited, not-for-profit membership organization	89 FR 51238 (June 17, 2024)
Prescriptions	NCPDP SCRIPT, versions 2017071 and 2023011 named in federal rules	42 CFR 423.160(c)
Pharmacy claims	NCPDP Telecommunication, version D.0 today, F6 next	45 CFR part 162; NCPDP HIPAA page
The network	Surescripts checks and routes e-prescriptions; software must pass its certification first	Surescripts E-Prescribing FAQ
Controlled substances	DEA rules for electronic prescriptions, plus a Part D electronic prescribing requirement	21 CFR part 1311; 42 CFR 423.160(a)(5)
Who can read the specs	NCPDP members; non-members pay a fee. Field-level detail is in the member-only implementation guide.	NCPDP Access to Standards; 89 FR 51242

The dates are in the plain-English timeline and, with every rule citation, in Part 2.

Who is this guide for, and where should you start?

This guide is for anyone who needs to understand or build U.S. e-prescribing. Part 1 serves founders, pharmacy owners, product managers, operations and compliance staff, in plain English with no field names. Part 2 serves engineers and architects, with messages, XML examples, certification and testing. The FAQ answers the short questions.

If you are...	Start with
New to the topic	What is NCPDP? and How an e-prescription travels
A founder or product lead	Business use cases, Limitations, Cost and certification
A pharmacy owner or pharmacist	Your NCPDP number, What to ask your software vendor
Compliance or operations	Deadlines, EPCS requirements
An integration engineer	What a SCRIPT message looks like, Message catalog, How to integrate, Edge cases

We follow one prescription through the whole guide. A patient we'll call Ana takes lisinopril 10 mg for blood pressure. Her doctor sends a 30-day prescription to her local pharmacy.

If you are scoping a build, our pharmacy integration page explains how we work with pharmacy and e-prescribing products.

Part 1: For everyone

What is NCPDP?

NCPDP stands for the National Council for Prescription Drug Programs. It is an ANSI-accredited, not-for-profit membership organization that writes the data standards U.S. pharmacies, prescribers, drug plans and software vendors use to exchange prescription and pharmacy claim information. Federal rules for Medicare and HIPAA name its standards, so most of the industry must use them.

Think of NCPDP as the group that agrees on the shape of the paperwork. It doesn't run a network and it doesn't move prescriptions. It publishes the rules for how a prescription or a claim must be written so that any system can read it. ANSI accreditation means it writes standards through an open, consensus-based process.

What is an NCPDP number, and how does a pharmacy keep it current?

An NCPDP number, also called the NCPDP Provider ID, is a 7-character ID that NCPDP assigns to each licensed U.S. pharmacy. CMS data dictionaries describe it this way and note that in the NCPDP database it used to be called the NABP number. Plans and networks use it to identify the pharmacy.

Pharmacies keep their own record current through NCPDP's pharmacy profile, which NCPDP's sign-in page at sso.ncpdp.org describes as the place to update and maintain pharmacy information. NCPDP sells the resulting pharmacy database to subscribers as dataQ.

Is NCPDP the same as NABP?

No. NABP is the National Association of Boards of Pharmacy, a different organization. The only overlap is the old name of the pharmacy ID.

Why does NCPDP exist?

NCPDP exists because thousands of pharmacies, drug plans and prescriber systems need one shared format to exchange prescriptions and claims. Without one, every pair of systems would need its own custom link. Federal law later made NCPDP's formats mandatory: HIPAA for pharmacy claims and Medicare Part D for e-prescribing.

A pharmacy that bills ten plans could otherwise face ten claim layouts, and a doctor's system that sends prescriptions to thousands of pharmacies faces the same problem. A common format turns that tangle into one format everyone writes and reads.

HIPAA, the 1996 health privacy and transactions law, requires plans and providers to use the transaction standards HHS adopts, and HHS adopted NCPDP's Telecommunication standard for retail pharmacy claims. The 2003 Medicare Modernization Act created the Part D e-prescribing program, and CMS named NCPDP SCRIPT for it. CMS lists SCRIPT 5.0 as the first foundation standard, effective January 1, 2006.

What are the main types of NCPDP standards?

NCPDP publishes about forty standards and guides. Five matter most for e-prescribing and pharmacy products: SCRIPT for prescriptions, Telecommunication for real-time pharmacy claims, Batch for claims sent in files, Formulary and Benefit for drug coverage lists, and Real-Time Prescription Benefit for live price and coverage checks.

Standard	What it does	Who uses it
SCRIPT	Prescriptions and the conversation about them	Doctors' systems, pharmacies, networks, plans
Telecommunication	The pharmacy's claim to the drug plan, answered in seconds	Pharmacies, drug plans and PBMs
Batch	The same claims, sent many at once in a file	Pharmacies, claims processors
Formulary and Benefit	Which drugs a plan covers, shown in the doctor's system	Plans and PBMs, EHR vendors
Real-Time Prescription Benefit	This patient's price and cheaper options, at the moment of prescribing	EHRs, plans, PBMs

A PBM is a pharmacy benefit manager, the company that runs the drug benefit for a health plan. The full list of standards is in Part 2.

What is the NCPDP SCRIPT standard?

The NCPDP SCRIPT standard is the message format for electronic prescriptions in the United States. It defines how a prescriber's system sends a new prescription, how a pharmacy asks for a change or a renewal, how either side cancels or reports a fill, and how medication history and prior authorization requests move.

For Ana, SCRIPT is the envelope and the form inside it. The doctor's system fills in the drug, strength, quantity, directions, patient and pharmacy, then sends it as a message called NewRx. The pharmacy system finds the same facts in the same places, so nobody retypes anything.

SCRIPT has versions with date-style names: 2017071 was approved in 2017 and 2023011 in January 2023. Federal rules say which version each group must use and when.

What is the NCPDP Telecommunication standard, and how is it different from SCRIPT?

The NCPDP Telecommunication standard carries pharmacy claims to drug plans in real time: the pharmacy asks the plan to pay, and the plan answers paid or rejected. SCRIPT carries the prescription between prescriber and pharmacy. Version D.0 is the current HIPAA claim standard, and HHS has adopted version F6 to replace it.

For Ana, two different conversations happen. The doctor's system sends the prescription to the pharmacy using SCRIPT. Then, at the counter, the pharmacy system sends a Telecommunication claim to Ana's plan to learn what the plan pays and what Ana owes.

The two meet in one place. If the plan rejects the claim because it needs prior authorization, that rejection can start an electronic prior authorization, which runs over SCRIPT. Our CoverMyMeds integration guide shows that hand-off.

	SCRIPT	Telecommunication
Purpose	The prescription and the conversation about it	The claim for payment and the eligibility check
Who talks	Prescriber and pharmacy (and plans, for prior authorization and history)	Pharmacy and drug plan or PBM
Required by	Medicare Part D e-prescribing rules	HIPAA transaction rules
Version now	2017071 or 2023011; only 2023011 from Jan 1, 2028	D.0; F6 from April 14, 2028

How does an e-prescription travel from the doctor to the pharmacy?

The prescriber's electronic health record builds a SCRIPT message and sends it to the Surescripts network. Surescripts checks the message and delivers it to the pharmacy the patient chose. The pharmacy can reply through the same network to ask questions, request renewals or report that the patient picked up the prescription.

One network sits between thousands of prescriber systems and pharmacies, so each side builds one connection.

Here is Ana's prescription, step by step.

The doctor picks lisinopril 10 mg, 30 tablets, one a day, and Ana's usual pharmacy. Before sending, the EHR can check Ana's plan for the price and pull her medication history.
The EHR sends a NewRx message to Surescripts, which checks it.
Surescripts delivers the NewRx to the pharmacy system, where it lands in the pharmacist's queue.
The pharmacist fills it, bills Ana's plan with a Telecommunication claim, and Ana picks up her tablets.
If the doctor's system asked for fill notices, the pharmacy sends an RxFill message saying Ana picked it up.
Near day 30, the pharmacy sends an RxRenewalRequest asking the doctor for more refills.

An EHR is an electronic health record, the software a doctor's office uses for charts and orders. Surescripts describes the same workflow on its E-Prescribing page.

What can a business do with NCPDP SCRIPT?

SCRIPT supports nine common business uses: sending new prescriptions, handling renewals, answering pharmacy change requests, cancelling prescriptions, tracking fills, pulling medication history, running electronic prior authorization, prescribing controlled substances, and supporting specialty, REMS and long-term care workflows. Most products start with new prescriptions and add the rest as users ask.

Each card gives the value, who it is for, how hard it is, and what works well or is limited. Build estimates for each are in one table in Part 2.

1. New prescriptions

The doctor sends Ana's lisinopril straight to her pharmacy, with no paper, fax or phone call.

Value: fewer reading errors and faster starts. Surescripts reports 2.64 billion e-prescriptions filled in 2025.
For: any prescriber product, such as EHRs, telehealth and specialty clinics.
Complexity: medium. You need a drug list, pharmacy search, directions and patient matching.
Limited: compounds and unusual directions can still need a call.

2. Renewals

Ana's refills run out. The pharmacy asks the doctor electronically, and the doctor approves in the EHR inbox.

Value: refill requests arrive in the inbox instead of by phone or fax.
For: primary and chronic care, where refills are frequent.
Complexity: medium. Each request must match the original prescription and reach the right doctor.
Limited: a request for a patient the practice can't match needs manual review.

3. Change requests

Ana's plan prefers a different product. The pharmacist asks the doctor to approve the change instead of phoning.

Value: questions get answered inside the doctor's workflow. Surescripts counted 32.9 million of these change transactions in 2025.
For: any prescriber product, and pharmacies that work with plan rules every day.
Complexity: medium to high. The doctor must see the original and the proposed change side by side.
Limited: if the doctor doesn't answer, the patient still waits.

4. Cancellations

The doctor stops Ana's lisinopril and starts a different drug. A cancel message tells the pharmacy not to fill the old one.

Value: Surescripts reports that 93 percent of discontinued medications were cancelled at the pharmacy after electronic cancellation was in place, citing a 2022 study.
For: health systems, EHRs, medication safety programs.
Complexity: low to medium. The pharmacy may already have dispensed.
Limited: it can't take back a drug already picked up.

5. Fill status

The doctor learns that Ana picked up her tablets, or that she didn't.

Value: a real adherence signal for care teams.
For: care management and chronic disease programs.
Complexity: low to receive, medium to act on.
Limited: the doctor's system chooses which notices it wants, so the data can be partial.

6. Medication history

Before writing the prescription, the doctor sees what Ana filled in the last year.

Value: Surescripts returns 12 months of history from pharmacies and PBMs, including prescriber, pickup date and directions.
For: EHRs, urgent care, hospitals at admission.
Complexity: low. It is read-only, but patient matching decides the quality.
Limited: fills outside these sources may be missing.

7. Electronic prior authorization (ePA)

Ana's plan requires approval for a drug. The doctor answers the plan's questions inside the EHR and gets a decision electronically.

Value: Surescripts reports more than 2 days of wait time saved for patients and responses in under 4 minutes on average.
For: specialty drugs, high-cost brands, any practice with heavy prior authorization volume.
Complexity: high. Questions differ by plan and drug, and can branch.
Limited: plans that only take fax still fall outside the flow.

8. Controlled substances (EPCS)

If the doctor prescribes a Schedule II to V drug, DEA rules require the prescription to be signed with two-factor authentication.

Value: for Medicare Part D, electronic prescribing of controlled substances is required by law from January 1, 2021. CMS measures it against a 70 percent threshold, with compliance actions from January 1, 2023.
For: any prescriber product that handles pain, ADHD, anxiety or addiction treatment.
Complexity: high. Identity checks, two-person access control, signing, audit logs and an outside audit.
Limited: the outside audit is repeated every two years. State EPCS laws apply too; CMS says its program is separate from state EPCS requirements.

9. Specialty, REMS and long-term care

Some drugs carry FDA safety programs, and nursing homes need resupply and administration messages.

Value: keeps high-risk drugs and facility work electronic.
For: specialty pharmacy, long-term and post-acute care.
Complexity: high. More parties take part.
Limited: messages among doctor, facility and pharmacy together need the 2023011 version.

REMS means Risk Evaluation and Mitigation Strategy, an FDA-required safety program for certain drugs.

What are the limitations of NCPDP SCRIPT?

SCRIPT carries messages but doesn't make clinical or coverage decisions, can't force anyone to reply, and can't undo a fill. It doesn't cover payment. The specifications are for members, the network needs certification, and the quality of each prescription still depends on how well each system fills in drugs, directions and patient details.

Access: the guides are free to NCPDP members and cost a fee for others, so you can't build to the field level from public material alone.
No reply guarantee: a pharmacy can ask for a change or a renewal, and the doctor can ignore it.
No payment: the claim is a separate Telecommunication transaction.
Directions vary: many prescriptions still carry typed directions. NCPDP publishes a separate structured format for them.
Network gate: Surescripts requires certification before software can exchange messages, and controlled substances need a DEA-required audit.

Version gaps and the FHIR comparison are in Part 2, under versions and SCRIPT vs FHIR.

What goes wrong in everyday e-prescribing?

Most everyday problems come from seven situations: a patient the system can't match, a prescription sent twice, a pharmacy that can't accept a message, a cancel that arrives after the drug was dispensed, a move to another pharmacy, a change request nobody answers, and a prior authorization that stalls. Each one has a known fix.

Ana's prescription can hit any of these. If her pharmacy closes and she moves stores, that is a transfer. If the doctor stops the drug the same afternoon the pharmacy filled it, that is a cancel after dispense. Part 2 has 23 edge case cards, each starting with what the patient and staff see.

What are the federal deadlines?

Four dates matter most. Medicare Part D has required SCRIPT 2017071 since January 1, 2020. Part D plans have had to support electronic prior authorization since January 1, 2022. New benefit-check versions apply from January 1, 2027. From January 1, 2028, only SCRIPT 2023011 is allowed.

Date	What changes, in plain words
January 1, 2020	Everyone in Medicare Part D moves to SCRIPT 2017071 on the same day.
January 1, 2022	Part D plans must accept electronic prior authorization over SCRIPT.
January 1, 2027	New versions of the price-check and coverage-list standards apply.
January 1, 2028	Only SCRIPT 2023011 is allowed, and nursing home prescriptions join the controlled substance rule.

The full list with every rule citation, including the HIPAA claim change on April 14, 2028, is in Part 2.

What does certification cost, and how long does it take?

Neither Surescripts nor NCPDP publishes certification prices or durations. NCPDP standards are free for members and paid for non-members. Controlled substances add an outside audit before first use and every two years. Building usually takes weeks per feature, and the certification wait comes on top of that.

Specifications: NCPDP membership, or a non-member fee. NCPDP doesn't publish the price on its Access to Standards page, so ask NCPDP.
Network access: direct certification with Surescripts, or a contract with a certified e-prescribing vendor. Surescripts says it guides organizations through certification step by step; terms are not public. We name no vendors here, to stay neutral.
Controlled substances audit: required before first use, then every two years or when those functions change.
Build and support: see the build estimate table, plus monitoring once live.

If prescribing is one feature of a bigger product, a certified vendor is usually faster to market. If e-prescribing is the product, direct certification gives you control.

What should a pharmacy or practice ask its software vendor?

When will you support SCRIPT 2023011, and which of its new messages will you turn on before January 1, 2028?
For pharmacies: when will your claims move from Telecommunication D.0 to F6, ahead of April 14, 2028?
Can you send and receive electronic transfers of controlled substance prescriptions?
Is your controlled substance module audited, and when is the next audit due?
Which messages do you support today: change requests, cancels, fill notices, prior authorization?

Part 2: For integration teams

Part 2 builds on Part 1 and links back instead of repeating it. Our XML examples use element names from public ONC test messages; cardinality, rules and code lists are in the member-only NCPDP guide.

What does an NCPDP SCRIPT XML message look like?

A SCRIPT message is an XML document with one Message root. Inside it, a Header says who sent it, who gets it and which message it answers, and a Body holds exactly one transaction, such as NewRx or Status. A NewRx then carries Patient, Pharmacy, Prescriber and MedicationPrescribed blocks.

Every SCRIPT message has the same envelope. Only the transaction inside the Body changes.

CMS notes that SCRIPT 2017071 uses XML syntax. NCPDP also lists a separate XML Standard and a JSON Standard as base formats for its transactions. The element names below come from the public ONC electronic prescribing test messages, which NIST built for SCRIPT 2017071 certification testing. They are not copied from the NCPDP guide.

Reading a SCRIPT message, for beginners

Start at the root. The Message element's attributes name the version, such as TransactionVersion="20170715" in the 2017071 test files.
Read the Header next. To and From say who is talking. Their Qualifier says what kind of ID follows: in the ONC files D is a prescriber, P a pharmacy, PY a payer and M the network mailbox.
Find the IDs. MessageID is unique to this message. RelatesToMessageID appears on replies and points at the message being answered. PrescriberOrderNumber and RxReferenceNumber are the doctor's and the pharmacy's own IDs for the prescription.
Open the Body. Its first child names the transaction. Everything else is detail for that transaction.
Read the blocks. Patient, Pharmacy and Prescriber identify the people; MedicationPrescribed says what was ordered.

The skeleton, element names only

<Message ...version attributes...>
  <Header>
    <To Qualifier="P">      receiver ID (pharmacy)
    <From Qualifier="D">    sender ID (prescriber)
    <MessageID>             unique per message
    <RelatesToMessageID>    on replies only
    <SentTime>              2026-11-13T09:00:00
    <SenderSoftware>        developer, product, version
    <RxReferenceNumber>     pharmacy's prescription ID, once known
    <PrescriberOrderNumber> doctor's order ID
  <Body>
    <NewRx>
      <Patient><HumanPatient>     Name, Gender, DateOfBirth, Address
      <Pharmacy>                   Identification (NCPDPID, NPI), BusinessName
      <Prescriber><NonVeterinarian> Identification (NPI, DEA), Name
      <MedicationPrescribed>
        DrugDescription, DrugCoded (ProductCode + Qualifier, Strength, DrugDBCode)
        Quantity (Value, CodeListQualifier, QuantityUnitOfMeasure)
        DaysSupply, WrittenDate, Substitutions, NumberOfRefills
        Diagnosis, Sig (SigText, optional structured Instruction), Note

Element names from the ONC/NIST SCRIPT 2017071 test messages. Cardinality, order rules and code values are in the member-only NCPDP guide and schema.

Data types, simply

Codes come from code lists. In ProductCode, the qualifier ND says the code is an NDC, the 11-digit drug product code. DrugDBCode with SCD or SBD points at an RxNorm concept.
Units are codes too. The ONC files pair C48542 with "Tablet" and C28253 with milligrams.
Qualifiers tell you how to read the value next to them, so always read the two together.
Dates are written year-month-day, such as 2026-11-13, and SentTime adds the time.

What changes structurally in 2023011

The public rules list a few structural additions: an optional OtherReferenceNumber in the header for multi-party messages, a Pending response type, RequestExpirationDate on three request messages, NoneChoiceID in PA questions, REMSReproductivePotential replacing REMSPatientRiskCategory, and a ReviewingProvider group on Resupply and Recertification (89 FR 51242). Since 2023011 is backwards compatible with 2017071, the envelope above stays the same.

What do the main SCRIPT messages look like for Ana's prescription?

Below are nine example messages for one prescription thread: NewRx, Status, Error, RxChangeRequest and RxChangeResponse, CancelRx and its response, RxRenewalRequest and its response, RxFill, and a PAInitiationRequest. Each block is collapsed, starts with one plain line, and ends with notes on the elements that matter. IDs stay consistent so you can follow the thread.

The thread starts with NewRx MessageID 1001. Every reply carries RelatesToMessageID pointing at the message it answers: 2001 and 2002 answer 1001, 3002 answers 3001, and so on. The NDC 00093111310 and RxNorm 314076 are real public codes for lisinopril 10 mg oral tablet (NLM RxNav, November 13, 2026). Every name, NPI, NCPDP ID and member ID is fake.

NewRx: the doctor sends Ana's prescription

The prescriber's system (From D) sends a new prescription to the pharmacy (To P). MessageID 1001 starts the thread.

Show the XML