2.2 DEA Registration, Forms 222/106/41 & Security

2.2 DEA Registration, Forms 222/106/41 & Security

Quick Answer: Handling controlled substances requires a current DEA registration for each principal place of business. Order Schedule I/II drugs with DEA Form 222 or electronic CSOS (often under a written power of attorney). Report theft or significant loss promptly and document on Form 106. Document destruction on Form 41. Store and secure CS stock so diversion is reasonably prevented—Illinois IDFPR inspectors care as much about real-world controls as about paperwork.

If scheduling answers “what is this drug?”, registration and forms answer “who may touch it, how do we buy it, and what happens when something goes wrong?”

DEA Registration: The License to Handle CS

The CSA’s closed system works only if every link is identified. Manufacturers, distributors, reverse distributors, importers/exporters, narcotic treatment programs, researchers, practitioners, and pharmacies must obtain DEA registration appropriate to their activity.

Key exam points:

• Registration is activity- and location-specific. A pharmacy registers for dispensing at a particular principal place of business. A second pharmacy at another address generally needs its own registration.
• Retail pharmacies commonly apply on DEA Form 224 (and renew on the DEA’s renewal cycle). Practitioners use practitioner registration pathways; hospitals and clinics have institutional models.
• The DEA number identifies the registered individual or entity. Pharmacists use the pharmacy’s registration for pharmacy ordering and record systems; individual staff pharmacists do not each need a separate pharmacy-location DEA number to work a shift, but the facility must be registered and the pharmacist must practice under lawful Illinois licensure.
• Expiration/suspension matters. Operating without a current registration, or continuing CS activity after suspension, is a federal (and state discipline) problem.

What registration does not do

DEA registration does not replace Illinois pharmacy licensure, PIC designation, or IDFPR permits. An Illinois pharmacy needs both state authorization to operate and DEA registration to handle controlled substances.

Who May Order Schedule II Drugs: Power of Attorney

Only the DEA registrant (or someone authorized under a valid power of attorney (POA)) may execute Form 222 or CSOS orders for Schedule I/II substances.

POA essentials for the exam:

• The registrant may authorize one or more individuals to order CII (and CI if applicable) on the registrant’s behalf
• The POA should be a written document retained in the pharmacy’s records
• The registrant can revoke POA; former employees should lose ordering credentials immediately
• POA is about ordering authority, not about who may counsel patients or perform final verification under Illinois practice rules

Exam scenario: A technician “always orders the CII totes” without any POA on file. That is a compliance failure even if the deliveries look routine.

Form 222 and CSOS: Ordering Schedule I/II

Paper DEA Form 222

DEA Form 222 is the classic triplicate/single-sheet controlled-substance order form used to acquire Schedule I and II substances. Core ideas:

• Used for CI/CII acquisition from suppliers (and certain other transfers among registrants)
• Must be properly completed: purchaser, supplier, drug name/NDC context, quantity, signatures/dates as required
• Errors can void the form—suppliers reject incomplete or altered forms
• Executed forms become part of the two-year (federal minimum) record set and should be readily retrievable

CSOS (Controlled Substance Ordering System)

CSOS is the electronic equivalent of Form 222. Benefits include speed and digital audit trails, but the legal duty is the same: only authorized digital certificates/signers order CI/CII, and records must be retained and available for inspection.

Trap: You cannot lawfully “just use the wholesaler portal invoice” for CII acquisition without the 222/CSOS pathway.

Form 106: Theft and Significant Loss

When a registrant discovers theft or significant loss of controlled substances, federal expectations include:

1. Prompt written notification to DEA upon discovery (classically within one business day)
2. Completion of DEA Form 106 documenting the theft/loss (drug, strength, quantity, circumstances)
3. Notification of local law enforcement when appropriate
4. Internal investigation, corrective security measures, and retention of the report copies

Significant loss is not only “a whole bottle missing”

Significance is a judgment call considering schedule, quantity, drug attractiveness for abuse, pattern of losses, and whether ordinary counting error could explain the variance. Repeated small CII shortages can be significant in aggregate. When in doubt, investigate and document rather than silently adjusting perpetual inventory.

Form 106 vs Form 41

Do not file Form 41 for a burglary, and do not treat reverse distribution of expired stock as a “theft” on Form 106 without facts supporting loss.

Form 41: Destruction

DEA Form 41 documents destruction of controlled substances. Community pharmacies typically move expired or unwanted pharmacy stock through a DEA-registered reverse distributor with complete chain-of-custody paperwork. Key points:

• Destruction must follow authorized methods and registrant rules
• Keep Form 41 / reverse-distributor documentation in the record system
• Patient-returned medications are not free stock—authorized collector rules apply if the pharmacy operates a take-back program; never commingle street returns into dispensable inventory

Security Requirements (Federal Floor + Illinois Reality)

Federal regulations require registrants to provide effective controls and procedures to guard against theft and diversion. For a pharmacy, that practically means:

• Physical security for CII (and often other CS) such as locked cabinets/safes, limited keys/codes, and alarm systems appropriate to the risk
• Access control—only authorized personnel handle CS stock; terminate access when employment ends
• Perpetual inventory / cycle counts for high-risk CII as operational best practice (even where not every count is federally mandated daily)
• Surveillance and audit trails for automated dispensing cabinets and night drop systems
• Separation of duties where feasible (ordering vs receiving vs destruction)

Illinois PIC and facility rules (later chapters) layer state expectations on top of this federal security floor. On the exam, a “secure enough” answer always includes limited access + accountable storage + prompt loss reporting, not merely “we keep the bottles behind the counter.”

Employee Screening Basics

Diversion is often an inside job. Federal and good-practice expectations include screening people who have access to controlled substances:

• Background checks consistent with employer and legal requirements
• Policies against hiring individuals with certain drug-related felony convictions into roles with CS access where restricted by regulation or policy
• Ongoing observation for impairment, unexplained inventory variances, and after-hours access
• Immediate suspension of access and investigation when diversion is suspected

Corresponding responsibility (section 2.1) is about prescription legitimacy. Employee screening and security are about inventory integrity. Both protect the closed system.

Illinois Practice Overlay

For Illinois MPJE items:

• DEA forms and registration are federal, but failure to secure CS, report losses, or maintain ordering records can trigger IDFPR discipline as well as DEA action
• The PIC is commonly the person accountable for operational compliance even when a corporate security team “owns” cameras
• Illinois e-prescribing and ILPMP chapters assume the pharmacy already has lawful DEA registration and secure CS storage
• When corporate policy, federal forms, and Illinois rules all apply, satisfy the strictest combination that still allows lawful care

Worked Example: Naperville Pharmacy Receiving Desk

A CII shipment arrives. The POA-authorized pharmacist completes CSOS receipt, matches the electronic order to the tote, locks the bottles in the CII safe, and files the CSOS record. Two nights later, cameras show forced entry and missing hydromorphone. The PIC discovers the loss Monday morning, notifies DEA within one business day, files Form 106, calls police, resets safe codes, and documents corrective action. That sequence is what exam writers want—not a quiet perpetual adjustment three months later and a Form 41 labeled “outdated stock.”

Common Traps

• Using invoices alone for CII ordering
• Allowing any staff member to order CII without POA / CSOS authority
• Confusing Form 106 (theft/loss) with Form 41 (destruction)
• Waiting for “perfect count certainty” for weeks after an obvious burglary before notifying DEA
• Assuming DEA registration replaces Illinois pharmacy licensure or PIC duties
• Treating security as optional if perpetual software “looks fine”

Registration, ordering forms, loss reporting, destruction documentation, and security are the operational skeleton of the closed system. Master Form 222/CSOS, Form 106, Form 41, and POA—then Illinois operations chapters will feel familiar rather than new.