12.2 Controlled Substance Ordering (DEA Form 222 & CSOS)

12.2 Controlled Substance Ordering (DEA Form 222 & CSOS)

The procurement and distribution of controlled dangerous substances are governed by rigorous documentation standards to ensure end-to-end accountability across the closed supply chain. Federal regulations set forth under 21 CFR Part 1305 and Oklahoma administrative rules under OAC Title 475:25 establish distinct legal ordering mechanisms based upon the scheduling classification of the drug product.

+-------------------------------------------------------------------------+
|                   CDS ORDERING MECHANISMS BY SCHEDULE                   |
+-------------------------------------------------------------------------+
|  Schedule I & II CDS  --> Single-Sheet DEA Form 222 OR Electronic CSOS  |
|  Schedule III, IV, V  --> Commercial Invoices / Electronic EDI Systems  |
+-------------------------------------------------------------------------+

---

Single-Sheet DEA Form 222 Architecture & Transition

Historically, the DEA utilized a paper triplicate Form 222 system (Copy 1 to Supplier, Copy 2 to DEA, Copy 3 to Purchaser). Under federal rules finalized in 2019, the triplicate format was completely sunset on October 30, 2021. All paper-based ordering of Schedule I and Schedule II controlled substances is now conducted exclusively on the single-sheet DEA Form 222.

Structural Features of Single-Sheet Form 222

• 20 Order Lines: Unlike the old triplicate format which accommodated only 10 order lines, the single-sheet format provides 20 separate order lines per form.
• Pre-Printed Identifiers: Each form is issued by the DEA with pre-printed registrant information, including the pharmacy name, registered physical address, DEA registration number, authorized CDS schedules, and a unique serialized form tracking number.
• Execution Precision: The purchaser must enter the date, supplier name and physical address, number of commercial packages, container size, and the exact drug name, dosage form, and strength for each line item. At the bottom of the form, the purchaser must specify the total number of lines completed (1 through 20) to prevent unauthorized additions.
• Signature Requirements: The form must be signed and dated by the individual who signed the most recent DEA registration or renewal application, or by an individual holding a valid, legally executed Power of Attorney (POA).

---

Single-Sheet DEA Form 222 Workflow & Fulfillment Lifecycle

The lifecycle of a single-sheet DEA Form 222 follows a precise statutory sequence under 21 CFR § 1305.12–1305.13:

  [PURCHASER]                                                   [SUPPLIER]
  Executes Form 222 (20 lines max)
        |
  Makes & RETAINS legible copy (Paper/Electronic)
        |
  Sends ORIGINAL Form 222 --------------> Receives Original Form 222
                                                |
                                          Fills Order & Records:
                                          - NDC, Packages Shipped, Date
                                                |
                                          Reports to DEA via ARCOS
                                                |
  Receives Physical Shipment <----------- Ships Controlled Substances
        |
  Records on Retained Copy:
  - Number of Containers Received
  - Date Received for each line
        |
  Files Retained Copy (5 yrs in OK)

1. Purchaser Copy Creation & Transmission

Critical Compliance Step: Before sending the original single-sheet DEA Form 222 to the supplier, the purchaser must make a legible copy of the completed form (either a paper photocopy or an electronic scan) and retain it in the pharmacy's records. The original form is transmitted to the supplier via physical courier or mail.

2. Supplier Fulfillment & DEA Reporting

Upon receiving the original Form 222:

• The supplier verifies the purchaser's DEA registration status and validates the form.
• The supplier enters the National Drug Code (NDC), number of commercial containers shipped, and the exact date of shipment on the original form.
• The supplier must report the acquisition and disposition transaction to the DEA's Automation of Reports and Consolidated Orders System (ARCOS). If a supplier is not required to report via ARCOS (e.g., a registered dispenser distributing under the 5% rule), the supplier must submit a copy of the original Form 222 to the DEA via email or mail by the close of the month in which the order was filled.

3. Purchaser Receipt & Verification

When the physical shipment of Schedule II substances arrives at the pharmacy:

• The receiving pharmacist must physically inspect and open the package to verify the contents against the packing slip and the retained Form 222 copy.
• The pharmacist must record on the purchaser's retained copy:
  1. The number of commercial containers received for each line item;
  2. The exact date received.
• The retained copy must be archived alongside Schedule II records for a minimum of 5 years in Oklahoma (2 years under federal law).

---

Supplier Endorsement, Partial Fills, and Defective Forms

Supplier Endorsement (21 CFR § 1305.16)

If a supplier receives a DEA Form 222 and cannot fill all or part of the order within its normal operating inventory, the supplier may endorse the entire order or unfulfilled line items to another registered supplier. Only the first supplier may endorse the form; secondary endorsements are strictly prohibited.

60-Day Partial Fill Rule (21 CFR § 1305.13(b))

If a supplier has insufficient stock to fill a Schedule II order completely, the supplier may ship a partial quantity. The supplier has a statutory maximum of 60 calendar days from the date of the execution of the Form 222 to supply the remaining balance. If the remaining balance is not shipped within 60 days, the unfilled portion of the order is automatically void, and the supplier cannot ship the balance without a newly executed Form 222.

Unaccepted and Defective Forms (21 CFR § 1305.15)

A supplier must reject and refuse to fill a DEA Form 222 if:

• The form is incomplete, illegible, or improperly executed;
• The form shows signs of alteration, erasure, correction fluid (white-out), or cross-outs;
• The registrant's signature is missing or unauthorized.

When a form is rejected, the supplier must return the original single-sheet Form 222 to the purchaser along with a written statement explaining the reason for refusal. The purchaser must attach the rejected original form and explanatory statement to the retained copy and maintain them in the pharmacy's Schedule II files. Purchasers cannot correct a defective form; a brand-new Form 222 must be executed.

Lost or Stolen DEA Form 222 (21 CFR § 1305.16)

• Loss in Transit: If a Form 222 is lost or stolen in transit before reaching the supplier, the purchaser must execute a second Form 222 and prepare an attached affidavit/statement containing:
  1. The unique serial number and date of the lost Form 222;
  2. The specific controlled substances listed on the lost form;
  3. A formal statement asserting that the pharmaceuticals ordered on the first form were never received. The purchaser retains a copy of the second form and the affidavit alongside the retained copy of the lost first form. The original second form and affidavit are sent to the supplier.
• Theft of Unexecuted Forms: If blank, unexecuted DEA Form 222s are lost or stolen from the pharmacy, the PIC must immediately report the loss in writing to the Special Agent in Charge (SAC) of the DEA Field Division, stating the serial numbers of the missing forms.

---

Electronic Controlled Substance Ordering System (CSOS)

Under 21 CFR Part 1305 Subpart C, the DEA established the Controlled Substance Ordering System (CSOS), providing a secure electronic alternative to paper Form 222s.

CSOS Architecture & Public Key Infrastructure (PKI)

• Digital Certificates: CSOS utilizes Public Key Infrastructure (PKI) digital certificates issued exclusively by the DEA E-Commerce Program Certification Authority (CA).
• Legal Equivalency: An electronic CSOS order digitally signed with a valid DEA-issued certificate carries the full legal authority of a handwritten Form 222 signature.
• Scope of Ordering: Unlike paper Form 222s (restricted to Schedule I and II), CSOS can be used to order controlled substances in Schedules I, II, III, IV, and V, as well as non-controlled legend drugs, on a single electronic purchase order.
• No 20-Line Restriction: CSOS purchase orders have no line-item limit.
• Certificate Validity: CSOS digital certificates remain valid until the registrant's DEA registration expires (up to 3 years) or until revoked due to employment termination or system compromise.

CSOS Coordinator & Digital Signature Delegation

The DEA registrant may appoint one or more CSOS Coordinators to manage digital certificate applications, renewals, and revocations. However, an individual cannot sign an electronic CSOS order unless they personally hold a valid individual CSOS signing certificate issued directly to them by the DEA CA pursuant to a verified Power of Attorney.

Electronic Archiving & Validation

• When an electronic CSOS order is received, the supplier's automated system validates the digital signature against the DEA CA Certificate Revocation List (CRL).
• Upon receiving the electronic shipment, the purchaser must electronically link the receipt record (noting container counts and receipt date) to the original electronic CSOS order.
• Electronic CSOS records must be stored securely, backed up regularly, easily retrievable, and retained for 5 years in Oklahoma (2 years federal).

---

Ordering Schedule III, IV, and V Controlled Substances

Schedule III, IV, and V controlled substances do not require a DEA Form 222 or CSOS PKI certificate. They are procured using standard commercial invoices or electronic data interchange (EDI) purchase records.

Mandatory Invoice Data Elements (21 CFR § 1304.22 / OAC Title 475:25)

Every commercial invoice for Schedule III–V CDS must contain:

1. Name of the controlled substance;
2. Dosage form (e.g., tablet, capsule, liquid) and strength (e.g., 50 mg);
3. Number of commercial containers and quantity per container (e.g., 5 bottles of 100 tablets);
4. Exact date the shipment is received;
5. Name, address, and DEA registration number of the supplier;
6. Name, address, and DEA registration number of the purchaser.

Pharmacist Verification Duty

Upon delivery, a licensed pharmacist must physically verify the received contents against the commercial invoice, sign or initial the invoice, and record the exact date of receipt. Schedule III–V invoices must be maintained in a readily retrievable manner (either filed separately from non-controlled invoices or stamped with a 1-inch red "C" in the lower right corner if interfiled with non-controlled records, unless an approved electronic recordkeeping system is utilized).

---

Power of Attorney (POA) for CDS Ordering (21 CFR § 1305.05)

A DEA registrant is legally responsible for all controlled substance procurement. However, a registrant may delegate the authority to execute paper Form 222s and electronic CSOS orders to one or more designated agents by executing a Power of Attorney (POA).

+-------------------------------------------------------------------------+
|                   POWER OF ATTORNEY (POA) REQUIREMENTS                  |
+-------------------------------------------------------------------------+
| 1. Grantor: Signed by most recent DEA application/renewal signatory     |
| 2. Grantee: Signed by the authorized agent (pharmacist, tech, manager)  |
| 3. Witnesses: Signed by TWO independent adult witnesses                 |
| 4. Archiving: Retained ON SITE with Form 222 records (DO NOT MAIL)     |
| 5. Revocation: May be revoked at any time via written Notice of Revoke  |
+-------------------------------------------------------------------------+

Essential Legal Rules for POA Execution

• Broad Eligibility: A POA may be granted to pharmacists, pharmacy interns, registered pharmacy technicians, or non-pharmacist pharmacy managers. The law does not restrict POA authority strictly to licensed pharmacists, although professional practice standards dictate careful oversight.
• Signatures Required: A valid POA must contain the signature of:
  1. The registrant or the authorized individual who signed the most recent DEA Form 224/224a application;
  2. The individual being granted power of attorney authority (grantee);
  3. Two adult witnesses.
• On-Site Retention: The POA document is not submitted to the DEA. It must be filed at the registered pharmacy location alongside the single-sheet Form 222 records and made immediately available during regulatory inspections.
• Revocation: A POA remains valid until formally revoked. If a POA grantee resigns, is terminated, or has their authority rescinded, the registrant must execute a written Notice of Revocation of Power of Attorney, sign it, and file it alongside the original POA.