2.2 DEA Registration, Forms 222/106/41 & Security

2.2 DEA Registration, Forms 222/106/41 & Security

Quick Answer: Handling controlled substances requires a current DEA registration for each principal place of business. Order Schedule I/II drugs with DEA Form 222 or electronic CSOS (often under a written power of attorney). Report theft or significant loss promptly and document on Form 106. Document destruction on Form 41. Store and secure CS stock so diversion is reasonably prevented—Minnesota inspectors care as much about real-world controls as about paperwork.

If scheduling answers “what is this drug?”, registration and forms answer “who may touch it, how do we buy it, and what happens when something goes wrong?”

DEA Registration: The License to Handle CS

The CSA’s closed system works only if every link is identified. Manufacturers, distributors, reverse distributors, importers/exporters, narcotic treatment programs, researchers, practitioners, and pharmacies must obtain DEA registration appropriate to their activity.

Key exam points:

• Registration is activity- and location-specific. A pharmacy registers for dispensing at a particular principal place of business. A second pharmacy at another address generally needs its own registration.
• Retail pharmacies commonly apply on DEA Form 224 (and renew on the DEA’s renewal cycle). Practitioners use practitioner registration pathways; hospitals and clinics have institutional models.
• The DEA number identifies the registered individual or entity. Pharmacists verify that a prescriber’s DEA number is valid and consistent with authority to prescribe the schedule involved (including hospital suffix rules when applicable).
• No current registration means no lawful CS handling for that activity/location—do not order, store, or dispense CS under an expired or surrendered registration.

Minnesota pharmacy licensure and DEA registration are related but separate. You can be a Minnesota-licensed pharmacist yet still be unable to order CII stock if the pharmacy’s DEA registration is not in order. Exam stems sometimes test that distinction: personal pharmacist license ≠ pharmacy DEA registration.

Who Needs Their Own Registration?

• The pharmacy as a dispensing registrant
• An individual practitioner who prescribes (with exceptions/special cases such as agents of hospitals acting under the hospital’s registration with proper internal coding)
• Mid-level practitioners when authorized by state law and registered
• Manufacturers/distributors upstream of the pharmacy

Pharmacists employed by a registered pharmacy generally dispense under the pharmacy’s registration; they do not each need a personal DEA number to fill prescriptions. Prescribing is different: prescribing requires practitioner registration (or a valid institutional arrangement).

Ordering Schedule I/II: Form 222 and CSOS

DEA Form 222

Schedule I and II controlled substances may not be obtained with a casual purchase order. Federally, acquisition of CI/CII by a registrant generally requires:

• A DEA Form 222 (official order form), or
• An electronic order through CSOS (Controlled Substance Ordering System)

Modern paper Form 222 is a single-sheet format (replacing the historic triplicate books), but the exam concept is stable: Form 222 is the official paper order instrument for CI/CII.

High-yield Form 222 ideas:

• Only a person with authority tied to the registrant (the registrant or someone with power of attorney) may execute the form
• The form identifies supplier and purchaser, and lists the CI/CII items ordered
• Errors can void a form; do not casually alter a defective 222—follow DEA procedures for voiding/replacing
• Executed forms and related documents are part of the pharmacy’s required CS records

CSOS (Electronic Ordering)

CSOS is the electronic equivalent of Form 222. Advantages include speed and reduced paper handling, but CSOS is not informal email ordering:

• Participants need DEA-approved digital certificates and compliant software workflows
• Orders are cryptographically signed; certificate control is a security control
• Lost, compromised, or misused certificates are diversion risks—treat them like keys to the CII vault

If an exam asks how a pharmacy orders oxycodone tablets from a wholesaler, the correct mechanism is Form 222 or CSOS, not “regular invoice only.” (Invoices still exist as commercial documents, but they do not replace the DEA order requirement for CII.)

Power of Attorney (POA)

The DEA registrant (for example, the pharmacy owner or other registrant of record) may issue a power of attorney authorizing one or more individuals to obtain and execute Forms 222 and/or issue electronic CSOS orders. This is how busy pharmacies operate without requiring the registrant’s wet signature on every CII order.

POA exam rules of thumb:

• POA must be granted by the registrant (or person with authority) in the required written format
• Multiple POAs can exist; they can be revoked
• When the registrant changes or authority ends, clean up POA paperwork so former employees cannot continue ordering
• POA authority is powerful—limit it to trained, trustworthy staff and audit CII ordering

Technicians or staff without POA cannot lawfully execute Form 222/CSOS orders merely because they “usually handle purchasing.”

Form 106: Theft and Significant Loss

Diversion is not only a crime problem—it is a regulatory reporting problem.

When a pharmacy experiences theft or significant loss of controlled substances:

1. Notify the DEA upon discovery in the required prompt timeframe (federally, in writing within one business day of discovery of theft or significant loss is the classic exam timing)
2. Complete DEA Form 106 to formally report the theft/loss after the facts are developed
3. Notify local law enforcement as appropriate
4. Document internal investigation, camera review, perpetual inventory reconciliation, and corrective security actions
5. In Minnesota practice, expect board and operational fallout if losses show weak controls—do not treat Form 106 as “just paperwork”

What is “significant” loss?

Federal guidance does not give a single tablet-count for every drug. Significance depends on factors such as:

• Schedule and quantity
• Drug’s abuse potential and local diversion patterns
• Whether the loss is unusual for the pharmacy’s volume
• Pattern evidence (repeated small disappearances of the same CII)

A few missing CV tablets in a high-volume store might be evaluated differently than missing fentanyl patches or a broken seal on a CII safe. When in doubt, investigate immediately, document, and do not wait weeks hoping stock “turns up.” Exam items often punish delay and underreporting.

In-transit losses and supplier shortages have their own allocation of responsibility—know whether the drugs had already entered the pharmacy’s custody. Custody is often the dividing line for who files what.

Form 41: Destruction

DEA Form 41 is the record associated with destruction of controlled substances. Pharmacies do not casually pour CII tablets into a sink. Lawful destruction pathways typically involve reverse distributors, authorized collectors, or other DEA-allowed destruction methods, with documentation that accounts for every unit destroyed.

Exam separation of forms:

Mixing these forms is a classic wrong-answer pattern (for example, “use Form 41 for robbery” or “use Form 106 to order morphine”).

Security and Storage Controls

Federal security regulations require registrants to provide effective controls and procedures to guard against theft and diversion. For pharmacies, practical standards include:

Storage options for stock

Pharmacies generally may:

• Store controlled substances in a securely locked, substantially constructed cabinet, and/or
• Disperse controlled substances throughout the non-controlled inventory (so a thief cannot grab one CS-only shelf)

Many pharmacies still keep CII drugs in a locked safe or automated cabinet even if some other schedules are dispersed. The legal goal is effective control, not a single decorative lock.

Access and operations

Strong programs typically include:

• Limited keys/badges/user logins for CII cabinets and automation
• Prompt termination of access when staff leave
• Camera coverage of dispensing and storage areas where appropriate
• Perpetual inventory or frequent counts for high-risk CII drugs
• Delivery acceptance procedures (who may sign for CII totes; where they are staged)
• Alarm systems and after-hours physical security
• Screening and training so staff understand diversion red flags inside the workplace (not only patient red flags)

Minnesota Board inspections and Rule-based operations standards reinforce that security is part of pharmacy practice, not only a DEA theory. A later chapter covers Minnesota facility security rules; for federal foundations, remember that poor security + unexplained loss is both a Form 106 event and a professional liability event.

Employee diversion

Internal theft is common in real investigations. Corresponding controls include dual custody for returns/destructions when feasible, surprise counts, and clear reporting channels for suspected impairment or diversion. Minnesota’s impaired-practitioner and mandatory-reporting themes (later chapters) often intersect with CS security failures.

Transfers Between Registrants

Schedule III–V drugs can generally move between registrants with appropriate invoices and records. Schedule I/II movements between registrants require the Form 222/CSOS mechanism (with limited exceptions defined in federal rules). Do not treat a CII “borrow from the pharmacy next door” favor as a paperwork-free event.

Minnesota Tie-In

Even when a vignette feels purely federal:

• The pharmacy must still hold proper Minnesota pharmacy licensure/permit status while operating
• CS inventory, theft, and security problems can trigger Board of Pharmacy action in addition to DEA consequences
• Reporting significant loss is not a substitute for fixing the control that failed
• MN PMP and corresponding-responsibility analysis still apply to dispensing after you successfully ordered the stock

Workflow Example (Exam-Ready)

1. Wholesaler CII order prepared by purchasing tech → pharmacist with POA executes CSOS order
2. Tote arrives → trained staff verifies contents against CSOS/222 documentation → secured in CII safe
3. Perpetual inventory updated; invoice/222 records filed for the required retention period
4. If three fentanyl patch boxes are missing at count → freeze area, investigate, notify DEA within the required one-business-day window, involve police as appropriate, file Form 106, tighten access logs
5. Expired CII units sent via authorized reverse distributor pathway with destruction documentation (Form 41 context), not informal disposal

Common Traps

• Ordering hydrocodone ER on a regular PO without 222/CSOS
• Allowing any staff member to sign 222s without POA
• Using Form 41 for theft and Form 106 for routine destruction
• Waiting for a monthly inventory cycle before reporting an obvious CII theft
• Confusing the pharmacist’s personal license with the pharmacy’s DEA registration

Master registration, the three forms, CSOS/POA, and security principles, and you will convert many operations items into structured checklists rather than guesswork.