5.3 Controlled Substance Ordering: Form 222 & CSOS

5.3 Controlled Substance Ordering: Form 222 & CSOS

To prevent diversion and maintain a closed distribution system, federal law strictly regulates the transfer and acquisition of Schedule I and Schedule II controlled substances. Under Title 21 of the Code of Federal Regulations (21 CFR Part 1305), a registrant cannot purchase, sell, or transfer Schedule I or II substances without executing either an official paper DEA Form 222 or an authenticated electronic order via the Controlled Substance Ordering System (CSOS). In contrast, Schedule III, IV, and V substances may be ordered using standard commercial purchase orders and invoices. In Kentucky, while federal law establishes a 2-year record retention baseline, Kentucky statute (KRS 218A.200) mandates that all controlled substance transaction records be retained for five (5) years.

Statutory and Regulatory Authorities:

• Title 21 CFR Part 1305: Orders for Schedule I and II Controlled Substances.
• 21 CFR § 1305.11–1305.20: Paper DEA Form 222 single-sheet execution and handling.
• 21 CFR § 1305.21–1305.29: Electronic Controlled Substance Ordering System (CSOS).
• 21 CFR § 1304.04 & KRS 218A.200: Recordkeeping and retention (Federal 2 years vs. Kentucky 5 years).
• KRS 315.191: Kentucky Board of Pharmacy record retention rules.

1. Controlled Substance Ordering Pathways Comparison

┌─────────────────────────────────────────────────────────────────────────────┐
│                     CONTROLLED SUBSTANCE ORDERING MECHANISMS                │
├──────────────────────────┬──────────────────────────────────────────────────┤
│ Controlled Schedule      │ Lawful Ordering Document / Electronic Platform   │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Schedule I (C-I) &       │ 1. Paper DEA Form 222 (Single-Sheet Standard); OR│
│ Schedule II (C-II)       │ 2. Electronic CSOS with PKI Digital Certificate  │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Schedule III (C-III),    │ Standard Commercial Purchase Order & Invoice:    │
│ Schedule IV (C-IV), &    │ • Drug name, dosage form, strength, and quantity │
│ Schedule V (C-V)         │ • Number of commercial containers received       │
│                          │ • Date received and signed by pharmacist/agent   │
│                          │ • Supplier name, address, and DEA registration   │
└──────────────────────────┴──────────────────────────────────────────────────┘

2. Paper DEA Form 222 Single-Sheet Execution Rules

Historically, the DEA utilized a triplicate carbon-copy Form 222 (Copy 1 Brown, Copy 2 Green, Copy 3 Blue). In 2019, the DEA promulgated final rules transitioning permanently to a Single-Sheet Form 222, rendering the triplicate form completely obsolete as of October 2021.

┌─────────────────────────────────────────────────────────────────────────────┐
│                     SINGLE-SHEET DEA FORM 222 SPECIFICATIONS                │
├──────────────────────────┬──────────────────────────────────────────────────┤
│ Number of Order Lines    │ Exactly 20 order lines (expanded from 10 lines)  │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Preprinted Data          │ Registrant DEA number, name, address, authorized │
│                          │ schedules, and unique serial tracking number     │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Purchaser Execution      │ Purchaser completes form, makes a copy (paper/   │
│                          │ electronic), and sends original to supplier      │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Supplier Execution       │ Supplier records NDC, containers shipped, date   │
│                          │ shipped; reports transaction data to DEA ARCOS   │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Purchaser Receipt Log    │ Purchaser records actual packages received and   │
│                          │ date received directly on retained copy          │
└──────────────────────────┴──────────────────────────────────────────────────┘

Step-by-Step Purchaser Execution Workflow (21 CFR § 1305.12–1305.13)

1. Ordering Execution: The purchaser fills out the single-sheet Form 222 using a typewriter, pen, or indelible pencil. For each line item, the purchaser must specify: the National Drug Code (NDC) or name of the drug, dosage form, strength, package size, and number of packages ordered. Only one item may be entered on each numbered line.
2. Total Lines Completed: The purchaser must record the total number of lines completed at the bottom of the form to prevent unauthorized additions.
3. Signature: The form must be signed and dated by the registrant or an authorized individual holding a valid Power of Attorney (POA).
4. Making Purchaser Copy: Before transmitting the original Form 222 to the supplier, the purchaser must make and retain a copy of the executed form (a photocopy or electronic scan).
5. Submitting Original: The purchaser sends the original single-sheet Form 222 to the registered supplier.
6. Receiving the Shipment: When the shipment arrives, a pharmacist or authorized employee must inspect the containers and record on the retained copy of Form 222:
   • The actual number of commercial containers received for each line item; and
   • The date received.

3. Supplier Rules: Partial Fills, Endorsements, Cancellations & ARCOS

Federal regulations establish precise parameters governing supplier actions upon receiving an executed Form 222:

A. Supplier Partial Filling (The 60-Day Clock)

• If a supplier cannot fill an order in its entirety due to insufficient stock, the supplier may partially fill the line items and ship the available containers.
• The 60-Day Rule: The supplier must supply the remaining balance of the order within sixty (60) days from the date the Form 222 was executed by the purchaser (21 CFR § 1305.13(b)).
• If the balance is not shipped within 60 days, the unfilled portion of the order is automatically void, and the purchaser must execute a new Form 222 to acquire the remaining stock.

B. Supplier Endorsement

• If the initial supplier cannot fill any portion of an executed Form 222, that supplier may endorse (transfer) the entire order to another registered supplier.
• Rules for Endorsement: Only the original supplier may endorse the form. Endorsement must be for the entire order; a supplier cannot partially fill an order and endorse the remainder to another wholesaler.

C. Reporting to DEA ARCOS

• The supplier must submit controlled substance transaction data to the DEA Automation of Reports and Consolidated Orders System (ARCOS).
• For single-sheet Form 222 transactions, the supplier must report the acquisition and disposition data to ARCOS by the close of the month in which the order was filled (or within 30 days of the transaction for non-ARCOS reporting entities).

D. Defective, Altered, or Unaccepted Forms

• A Form 222 is defective if it is incomplete, illegible, altered, erased, or shows signs of tampering (e.g., liquid white-out, crossed-out text).
• A supplier must refuse to fill a defective Form 222 and must return the original form to the purchaser with a written explanation of rejection. The purchaser must attach the returned form and statement to their retained copy files. Defective forms cannot be corrected; a new Form 222 must be executed.

E. Lost or Stolen Form 222 in Transit

• If an executed Form 222 is lost or stolen in transit, the purchaser must execute a second Form 222 and attach a formal written statement containing:
  1. The serial number of the lost Form 222;
  2. The date of the lost form; and
  3. A statement that the controlled substances listed on the initial form were never received.
• The purchaser retains a copy of the second form and the statement alongside the copy of the lost first form.

4. Power of Attorney (POA) for Controlled Substance Ordering (21 CFR § 1305.05)

Under federal law, only the individual who signed the most recent DEA registration application (or renewal) has inherent statutory authority to execute Form 222s or sign CSOS orders. However, the registrant may delegate this authority to one or more agents via a formal Power of Attorney (POA).

┌─────────────────────────────────────────────────────────────────────────────┐
│                     POWER OF ATTORNEY (POA) REGULATORY RULES                │
├──────────────────────────┬──────────────────────────────────────────────────┤
│ Who Can Be Granted POA?  │ Any designated individual. The agent does NOT    │
│                          │ have to be a licensed pharmacist, PIC, or owner  │
│                          │ (e.g., pharmacy technician, business manager).   │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Required Signatures      │ Must be signed by:                               │
│                          │ 1. The registrant (authorizing officer);         │
│                          │ 2. The person granted POA (attorney-in-fact); and│
│                          │ 3. Two (2) competent witnesses.                  │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Filing & Retention       │ Kept on file at the registered location with     │
│                          │ executed Form 222 records; do NOT send to DEA.   │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Revocation of POA        │ May be revoked at any time by the registrant by  │
│                          │ executing a written Notice of Revocation.        │
└──────────────────────────┴──────────────────────────────────────────────────┘

Exam Watch — POA Delegation: Questions frequently ask whether a pharmacy technician or non-pharmacist store manager may legally sign DEA Form 222. Under 21 CFR § 1305.05, the answer is YES, provided they have been granted a valid Power of Attorney executed by the registrant. While professional dispensing requires a pharmacist, ordering controlled substances may be delegated under POA.

5. Electronic Controlled Substance Ordering System (CSOS)

The Controlled Substance Ordering System (CSOS) (21 CFR § 1305.21–1305.29) provides an encrypted electronic alternative to paper Form 222, utilizing Public Key Infrastructure (PKI) digital certificates issued by the DEA CSOS Certification Authority.

Advantages of Electronic CSOS vs. Paper Form 222

CSOS Digital Certificate Management & Security

• CSOS Coordinator: The registrant designates an administrative coordinator to manage digital certificate applications.
• Digital Signature: Electronic orders must be signed using a valid CSOS digital certificate issued to the registrant or an authorized POA holder.
• Revocation / Expiration: If a CSOS certificate holder leaves employment or the private key is compromised, the registrant must notify the DEA Certification Authority within six (6) hours to revoke the certificate.
• Supplier Verification: The supplier must verify the digital signature against the DEA certificate authority, check the validity of the purchaser's DEA registration, and report transaction data to the DEA within two (2) business days.

6. Record Retention Hierarchy: Federal vs. Kentucky

A critical high-yield topic on the Kentucky MPJE is the conflict between federal and state controlled substance record retention mandates:

┌─────────────────────────────────────────────────────────────────────────────┐
│                     CONTROLLED SUBSTANCE RECORD RETENTION                   │
├──────────────────────────┬───────────────────┬──────────────────────────────┤
│ Jurisdiction             │ Statutory Period  │ Enabling Legal Citation      │
├──────────────────────────┼───────────────────┼──────────────────────────────┤
│ Federal Baseline         │ Two (2) Years     │ 21 CFR § 1304.04             │
├──────────────────────────┼───────────────────┼──────────────────────────────┤
│ Kentucky Stricter Law    │ Five (5) Years    │ KRS 218A.200 & KRS 315.191   │
└──────────────────────────┴───────────────────┴──────────────────────────────┘

The Prevailing Kentucky Rule (5 Years): Under KRS 218A.200, every pharmacy, practitioner, and wholesaler in Kentucky must maintain all controlled substance records — including executed single-sheet Form 222s, CSOS electronic archives, receiving invoices, initial/biennial inventories, and prescription dispensing files — for a minimum of five (5) years. Applying the Stricter Law Rule, the 5-year Kentucky requirement supersedes the 2-year federal baseline on all Kentucky MPJE questions.