10.2 Controlled Substance Ordering & Procurement: DEA Form 222, CSOS & Invoicing

10.2 Controlled Substance Ordering & Procurement: DEA Form 222, CSOS & Invoicing

[!NOTE] The Procurement Regulatory Divide: Federal law (21 C.F.R. Part 1305) and Alabama law establish an uncompromising bifurcated system for the ordering, transfer, and procurement of controlled substances. Schedule I and Schedule II agents carry extraordinary addiction liability and diversion risk, mandating an unbroken chain of federal documentation executed through DEA Form 222 or the electronic Controlled Substances Ordering System (CSOS). Conversely, Schedule III, IV, and V substances are procured through commercial invoicing, where receiving verification, signature confirmation, and record segregation ensure regulatory accountability. Mastery of these procurement mechanics is essential for daily compliance and MPJE success.

Every controlled substance entering a pharmacy's inventory must be accounted for from the exact moment of manufacture through wholesale distribution to the receiving pharmacy dock. Failure to maintain strict procurement compliance constitutes a federal regulatory violation under the CSA and exposes the pharmacy permit holder and supervising pharmacist to administrative disciplinary action by ALBOP.

---

Procurement of Schedule I and II Controlled Substances

Under federal and Alabama law, Schedule I (for authorized research registrants) and Schedule II controlled substances may only be transferred from one DEA registrant to another pursuant to an official federal order document. Registrants may utilize either the paper single-sheet DEA Form 222 or the electronic CSOS system.

+---------------------------------------------------------------------------------------------------------+
|                                 Schedule II Paper Ordering Lifecycle (Single-Sheet 222)                 |
+---------------------------------------------------------------------------------------------------------+
|  PURCHASER                                          SUPPLIER                                            |
|  1. Completes 20-line Form 222                      3. Verifies purchaser DEA & signature               |
|  2. Makes & retains copy (paper/scan)               4. Records NDC, packages shipped, & date shipped    |
|  3. Sends ORIGINAL Form 222 to supplier             5. Ships commercial containers to purchaser         |
|                                                     6. Reports data to ARCOS or DEA Diversion           |
|                                                                                                         |
|  PURCHASER RECEIVING VERIFICATION:                                                                      |
|  7. Opens shipment & tallies stock                                                                      |
|  8. Records CONTAINERS RECEIVED and DATE RECEIVED directly onto the RETAINED COPY of Form 222          |
+---------------------------------------------------------------------------------------------------------+

The Single-Sheet DEA Form 222 Format

For decades, DEA Form 222 was issued as a triplicate carbon form (Copy 1 Brown to Supplier, Copy 2 Green to DEA, Copy 3 Blue retained by Purchaser). Effective October 30, 2021, the DEA permanently sunset the triplicate form. All paper Schedule II orders are now executed exclusively on the single-sheet DEA Form 222.

Key structural rules governing the single-sheet DEA Form 222 include:

1. Pre-Printed Identifiers: Forms are issued by the DEA in customized order books containing sequentially numbered, watermarked sheets pre-printed with the pharmacy's legal name, municipal address, DEA registration number, and authorized controlled schedules.
2. Twenty (20) Line Limit: Unlike the former triplicate form which contained 10 lines, the single-sheet DEA Form 222 contains twenty (20) order lines. Each line allows ordering only one specific drug item (defined by drug name, dosage form, strength, and package size). Unused lines must remain blank.
3. Line Count Verification: The purchaser must write the total number of lines ordered in the designated signature block at the bottom of the sheet to prevent fraudulent insertion of additional items after signing.
4. No Alterations or Erasures: A DEA Form 222 containing erasures, crossed-out lines, liquid white-out, or typographical alterations is legally invalid and must be rejected by the supplier. If an error is made during completion, the purchaser must mark the entire form "VOID" and archive it in the pharmacy's records.

Purchaser Order Execution & Retention

When placing an order using the single-sheet form:

1. The purchaser completes all required fields: supplier name, supplier address, date, national drug code (NDC, optional but common), item description, container size, and number of containers ordered.
2. The form must be signed by the natural person who signed the most recent DEA registration or renewal application, or by an individual possessing an active Power of Attorney (POA).
3. Purchaser Retained Copy: Before transmitting the original form to the wholesale supplier, the purchaser must create a copy of the completed single-sheet Form 222 (a physical photocopy or an electronic scan) and retain it in the pharmacy's Schedule II files.
4. Original Sent to Supplier: The original physical single-sheet form is delivered to the supplier (by mail, courier, or delivery driver).

Supplier Processing & DEA Reporting

Upon receiving the original Form 222:

• The supplier reviews the form for completeness, verifies the purchaser's active DEA registration, and fulfills the order.
• On the original form, the supplier records the actual NDC number shipped, the number of commercial containers shipped, and the exact date shipped.
• Reporting to DEA: Wholesalers and distributors report Schedule II distribution data to the DEA via the Automation of Reports and Consolidated Orders System (ARCOS). If a supplier is not required to report to ARCOS (such as a registered pharmacy transferring C-II stock to another pharmacy), the supplier must submit a physical copy of the single-sheet Form 222 to the DEA Diversion Control Division by mail, or upload an electronic copy through the DEA secure portal, by the close of the month in which the shipment occurred.

The 60-Day Partial Fill Window

If a supplier has partial stock of an ordered item, the supplier may ship the available inventory and backorder the balance:

• Under 21 C.F.R. § 1305.13(b), the supplier has a maximum of sixty (60) calendar days from the date the Form 222 was issued to fulfill and ship the remaining balance.
• If the remaining balance is not shipped within that 60-day window, the unfulfilled portion is officially void. The supplier cannot fulfill that balance on day 61; the purchaser must execute a brand new Form 222 or CSOS transaction.

Endorsement of DEA Form 222

Under 21 C.F.R. § 1305.16, if a supplier receives a single-sheet Form 222 and cannot fill any portion of the order:

• Only the first supplier may endorse the order to a second supplier. The purchaser cannot endorse the form.
• Supplier 1 endorses the reverse of the original form (or designated endorsement panel), naming Supplier 2, and forwards the original to Supplier 2.
• Supplier 2 fills the order, ships directly to the original purchaser, and reports the transaction to ARCOS or the DEA.

Mandatory Purchaser Receiving Verification

A frequent focus of Board and DEA audits is the receiving verification log:

[!CRITICAL] Purchaser Receiving Confirmation: When a Schedule II shipment arrives at the pharmacy, an authorized individual (pharmacist or designated receiver) must unseal the package, inspect the contents against the packing list, and physically record on the retained purchaser copy of DEA Form 222: (1) the actual number of commercial containers received, and (2) the exact date received. Failing to record the date and containers received on the retained copy leaves the procurement record legally incomplete and violates 21 C.F.R. § 1305.13(e).

Power of Attorney (POA) for DEA Forms 222

A DEA registrant may delegate authority to execute DEA Forms 222 or CSOS orders by issuing a formal Power of Attorney:

• Who May Hold POA: The registrant may designate any qualified individual, including non-pharmacist pharmacy managers, technicians, or staff pharmacists. However, the ultimate legal responsibility for inventory integrity remains with the registrant and the designated supervising pharmacist.
• Execution Requirements: The POA document must be signed by the natural person who signed the most recent DEA registration/renewal application, the individual receiving the authority (attorney-in-fact), and two (2) adult witnesses.
• Storage: The executed POA does not need to be submitted to the DEA or ALBOP. It must be kept on file at the registered location alongside retained DEA Forms 222 and made immediately available for inspection. The POA remains effective until formally revoked.

---

Electronic Controlled Substances Ordering System (CSOS)

The DEA's electronic Controlled Substances Ordering System (CSOS) provides an electronic equivalent to paper DEA Form 222 while introducing dramatic operational efficiencies.

+---------------------------------------------------------------------------------------------------------+
|                                 DEA Form 222 vs. Electronic CSOS Comparison                             |
+-----------------------------+------------------------------------+--------------------------------------+
| Operational Feature         | Paper DEA Form 222 (Single-Sheet)  | Electronic CSOS Ordering             |
+-----------------------------+------------------------------------+--------------------------------------+
| Permitted Schedules         | Schedules I and II ONLY            | Schedules I, II, III, IV, and V      |
+-----------------------------+------------------------------------+--------------------------------------+
| Item Order Line Limit       | Exactly 20 lines per sheet         | NO line limit (unlimited line items) |
+-----------------------------+------------------------------------+--------------------------------------+
| Signing Mechanism           | Handwritten ink signature by       | Public Key Infrastructure (PKI)      |
|                             | registrant or active POA           | digital certificate signature        |
+-----------------------------+------------------------------------+--------------------------------------+
| DEA Supplier Reporting      | Monthly ARCOS / DEA copy upload    | Electronic ARCOS within 2 bus. days  |
+-----------------------------+------------------------------------+--------------------------------------+
| Order Alterations Allowed?  | Strict NO (voids entire form)      | Electronic orders cannot be edited;  |
|                             |                                    | defective orders must be reissued    |
+-----------------------------+------------------------------------+--------------------------------------+
| Record Archiving Format     | Physical paper copy or scan        | Secure electronic database archive   |
|                             | maintained on-site for 2 years     | maintained for 2 years               |
+-----------------------------+------------------------------------+--------------------------------------+

CSOS Digital Certificates & Public Key Infrastructure (PKI)

CSOS utilizes Public Key Infrastructure (PKI) technology to guarantee authentication, data integrity, and non-repudiation:

1. Digital Certificates: Issued exclusively by the DEA Certification Authority (DEA CA) to an authorized registrant or designated CSOS coordinator. Digital certificates are tied to a specific individual and cannot be shared, transferred, or delegated verbally.
2. Digital Signature: When placing an order, the system signs the electronic transmission with the individual's private key. The supplier validates the signature against the public key held by the DEA CA.
3. Supplier Verification: Prior to fulfilling an electronic C-II order, the supplier must verify that the purchaser's digital certificate is active and has not expired or been revoked.
4. Reporting: The supplier must submit an electronic report of all filled C-II CSOS orders to the DEA within two (2) business days of shipment.
5. Defective CSOS Orders: If an electronic order contains invalid signature data, incomplete mandatory fields, or evidence of tampering, the supplier must reject the order. A rejected CSOS order cannot be repaired or patched; the purchaser must generate a brand new electronic order.

---

Procurement of Schedules III, IV, and V Controlled Substances

Unlike Schedule I and II medications, Schedules III, IV, and V controlled substances do not require DEA Form 222 or CSOS digital certificates. Instead, procurement is documented through commercial invoices and packing slips.

Mandatory Invoice Elements

Under 21 C.F.R. § 1304.22 and Alabama law, every commercial invoice documenting the receipt of Schedule III, IV, or V controlled substances must contain:

1. The complete commercial name, dosage form, and strength of the substance;
2. The number of units or volume per commercial container (e.g., 100-tablet bottle, 500 mL bottle);
3. The number of commercial containers ordered and received;
4. The date on which the containers were actually delivered to the pharmacy;
5. The legal name, municipal business address, and federal DEA registration number of the supplier; and
6. The legal name, municipal business address, and federal DEA registration number of the purchasing pharmacy.

Receiving Verification & Pharmacist Signature

When a wholesale delivery containing Schedule III, IV, or V drugs arrives:

• An authorized pharmacy employee must unpack the shipment and count the containers against the commercial invoice.
• A licensed pharmacist must physically verify the accuracy of the shipment, record the date of receipt, and sign or initial the commercial invoice.
• Storing C-III–V invoices without a pharmacist's signature/initials and date of receipt violates federal inventory accounting mandates.

Segregation and Storage of C-III–V Invoices

Invoices for Schedules III, IV, and V must be readily retrievable during an ALBOP or DEA audit. Pharmacies typically maintain a dedicated "Controlled Substance Invoices (C-III–V)" binder arranged chronologically. If C-III–V invoices are filed alongside non-controlled invoice records, they must be organized so that an inspector can extract them promptly without reviewing every commercial invoice.