15.1 Ordering and Acquisition (DEA 222/CSOS)

Why the order document is the scored instrument

Quick Answer: Schedule I and II move on a single-sheet DEA Form 222 or CSOS. The purchaser copies the original, sends the original to the supplier, and records containers received on its copy (21 CFR 1305.13). CIII–V move on an invoice, not a 222. Only the registrant or a person with a written power of attorney (21 CFR 1305.05) may execute the order. Buy only from a DEA-registered supplier. Lost unfilled 222s follow 21 CFR 1305.16. Manufacturers and wholesalers report suspicious orders to DEA and to DCP Drug Control (PA 18-16).

NABP Competency 4.1.1 is procurement. Chapter 7.2 taught which form number to grab. This section is the workflow: how a Hartford pharmacy actually acquires oxycodone without creating a diversion hole, and how CIII–V invoices, CSOS, lost 222s, and suspicious-order flags sit around that workflow. Storage and who holds the safe keys are Chapter 16. Inventories that prove the bottle arrived are 15.4.

Triplicate DEA 222s ceased to be valid on October 30, 2021 (21 CFR 1305.20). A 2026 technical amendment stripped leftover triplicate language. Using a found triplicate from a basement drawer is not a fillable order.

Single-sheet Form 222 — purchaser copy, supplier original

21 CFR Part 1305 requires a Form 222 or its electronic equivalent for each distribution of a Schedule I or II substance (with listed exceptions). CIII–V do not ride a 222.

Execution and filling (21 CFR 1305.12–1305.13):

• The purchaser prepares the form with a typewriter, computer printer, pen, or indelible pencil; one item per line; no alteration that changes the order.
• The purchaser makes a copy of the original (paper or electronic) for its records, then sends the original to the supplier.
• The supplier may fill the order, records its DEA number (if not already entered), the number of commercial or bulk containers furnished on each line, and the ship date on the original, and keeps the original.
• Substances ship only to the purchaser and the location printed by DEA on the form.
• If the order cannot be filled in full, the supplier may ship in part and complete the balance with additional shipments within 60 days of the purchaser’s execution. No 222 is valid more than 60 days after execution (except a narrow Defense Logistics Agency rule that is not a community-pharmacy fact).
• The purchaser records, on its copy, containers received and the dates received. An unannotated purchaser copy is an incomplete record.
• A supplier not required to report to ARCOS (for example a practitioner distributing under the 5 percent rule) must also forward a copy to DEA at the close of the month the order is filled, or, for partials, the month of the last shipment or 60-day expiry.

That copy-versus-original split is the item. The pharmacy does not mail “Copy 2 to DEA” as the old triplicate ritual required. The pharmacy does not send the only original and keep nothing. The pharmacy does not treat a wholesaler packing slip as a 222.

CSOS — the electronic 222

CSOS (Controlled Substance Ordering System) is 21 CFR Part 1305 Subpart C plus Part 1311 digital-signature rules. A digitally signed electronic order does not need a supporting paper 222. CSOS can order any schedule the registration authorizes, which is why a buyer may place CII and CIII–V in one electronic session. Each electronic order carries a unique tracking number. If an unfilled electronic order is lost, the purchaser provides a signed statement to the supplier that includes that tracking number and date and states the goods were not received (21 CFR 1305.26). Voided electronic orders are retained. A CSOS certificate is tied to a person and a registration; it is not a shared PIN on a sticky note at the order desk.

Power of attorney is not PIC status

Only the registrant, or a person named in a current power of attorney, may execute a 222 or CSOS order. 21 CFR 1305.05 lets the registrant authorize one or more individuals, whether or not they work at the registered location, by executing a POA for each person. Keep the POA with the 222 file for as long as any order that attorney signed must be kept.

Who signs the POA is a 2026 trap. After the 2019 single-sheet rule, and as confirmed by DEA’s March 20, 2026 technical amendment, the POA is executed by the registrant if an individual; a partner if a partnership; or an officer if a corporation or similar entity, plus the attorney and two witnesses. The person who merely signed the last Form 224 is not, by that fact alone, authorized to issue or revoke a 222 POA. A staff pharmacist signs 222s only with a current POA — not because “I am the pharmacist manager.” Connecticut’s pharmacist manager (CGS § 20-597) is a state credential. It does not replace 21 CFR 1305.05.

Lost, stolen, and unused 222s

Unfilled form lost in transmission (21 CFR 1305.16(a)). The purchaser executes another 222 and attaches a statement containing the order-form number and date of the lost form and stating that the goods covered by the first form were not received because that form was lost. Keep a copy of the second form and the statement with a copy of the first executed form. Attach a copy of the statement to the second 222 sent to the supplier. If the first form later arrives, the supplier marks the face “Not accepted” and returns the original to the purchaser, who attaches it to the statement.

Used or unused forms stolen or lost other than in transmission (21 CFR 1305.16(b)). Immediately upon discovery, report to the Special Agent in Charge of the DEA Divisional Office for the registrant’s area, stating serial numbers. If numbers are unknown, report the approximate date of issuance or receipt and, for a supplier, purchaser names and addresses. Recovered unused forms that were reported lost are immediately re-reported as found (1305.16(e)). Unused 222s stay secured; they are blank checks on Schedule II stock.

A lost form is not automatically a lost bottle. Form 106 is for theft or significant loss of controlled substances. Do not file a 106 because a 222 went missing in the mail unless the drugs are also missing.

CIII–V invoices and DEA-registered suppliers

Schedule III, IV, and V distributions are documented on an invoice or packing record that is readily retrievable: name, dosage form, strength, quantity, date, and the supplier’s identity. The supplier must be DEA-registered to handle that schedule at that location. A Connecticut pharmacy does not buy alprazolam from an unregistered Instagram account, a cash-pay clinic that is not registered to distribute, or a 503A compounding pharmacy posing as a wholesaler (15.2).

Suspicious orders — the wholesaler’s duty that still hits the pharmacy

21 CFR 1301.74(b) requires a non-practitioner registrant (manufacturer, wholesaler) to design a system that discloses suspicious orders and to inform the DEA Field Division when they are discovered. Suspicious orders include orders of unusual size, orders that deviate substantially from a normal pattern, and orders of unusual frequency.

Connecticut Public Act 18-16, § 3 (codified with the manufacturer/wholesaler CS duties) requires each manufacturer or wholesaler of drugs to operate such a system and to immediately inform the Director of the Drug Control Division of suspicious orders, and to send DCP a copy of any suspicious-activity report filed with DEA. DCP’s published path is email to DCP.DrugControl@ct.gov (or fax (860) 706-1207) with the DEA report plus the Connecticut license number. Public Act 19-191 adds: if a registered manufacturer or wholesaler ceases or declines distribution of any CII–V to a Connecticut pharmacy or practitioner based on diversion concerns, it reports the name, location, and reasons to the Director not later than five business days after ceasing or declining.

The community pharmacist is usually the customer, not the SOM filer. That still matters. A Stamford store whose oxycodone orders suddenly triple, whose cash-pay CII share explodes, or whose wholesaler cuts off CII shipments should treat that cutoff as a corresponding-responsibility and inventory problem, not as a purchasing inconvenience. Do not “make up the difference” from a second, unvetted supplier. Do not ask a neighboring pharmacy to 222 you a case of oxycodone as a workaround if you have crossed into distributor territory (15.2).

Scenario: Saturday CSOS, Monday lost 222

A New London pharmacist manager holds the pharmacy’s DEA registration as an employee of a corporate registrant. Corporate officers executed a POA naming the manager — not the technician who “always orders.” On Saturday the manager places a CSOS order for oxycodone 10 mg and alprazolam 1 mg in one session (lawful: CSOS may include CIII–V). A paper 222 for hydromorphone mailed Friday never arrives. On Monday the manager executes a second 222, attaches the 1305.16 statement with the lost form’s number and date, keeps copies with the first form, and sends the statement with the new original. A floater pharmacist without a POA does not sign a replacement 222 “because I am covering.” The hydromorphone that later shows up with the first form is not accepted by the supplier and comes back marked accordingly — it is not a bonus bottle. A wholesaler who flags the Saturday oxycodone quantity as unusual size notifies DEA and DCP immediately; that notice is about the pharmacy’s pattern, not a license to shop a gray-market vendor.

CT may be stricter; more-restrictive wins.

Official anchors

• 21 CFR Part 1305 — 222, CSOS, POA, lost forms.
• 21 CFR 1305.13 — purchaser copy, supplier original, 60-day validity.
• 21 CFR 1305.16 — lost and stolen 222s.
• 21 CFR 1301.74(b) — suspicious orders.
• DCP Suspicious Order Monitoring — PA 18-16 immediate DCP notice; PA 19-191 five-business-day cease/decline report.