11.1 Ordering & Acquiring Controlled Substances: DEA Registration, Form 222, CSOS & the 5% Rule

Why this matters

Area 4.1 covers "ordering and acquisition, including the maintenance and content of such records." For controlled substances, federal DEA rules (21 CFR 1301, 1304, 1305) govern how a pharmacy registers, orders and documents receipt. Oregon adds two layers. Pharmacists may acquire drugs only from Oregon-registered outlets (OAR 855-115-0125(3)), and the pharmacy keeps the records for 3 years (OAR 855-080-0070; OAR 855-104-0055).

DEA registration

• Each pharmacy location that dispenses controlled substances needs its own DEA registration (21 CFR 1301.12). Registration for retail pharmacies is renewed every three years.
• The pharmacy must also hold its Oregon retail or institutional drug outlet registration, which expires March 31 annually (OAR 855-041-1080).
• Registration information, including the pharmacy's DEA certificate, must be posted or available as the Board's self-inspection form requires.

Ordering Schedule I–II: DEA Form 222 and CSOS

Single-sheet DEA Form 222 (21 CFR 1305.11–.17)

DEA issues the single-sheet Form 222. The older triplicate forms could not be used after October 30, 2021. The process:

1. The purchaser (the pharmacy) completes the form: supplier name and address, item lines, and the signature of the registrant or a power-of-attorney holder. The purchaser makes a copy (paper or electronic) for its records and sends the original to the supplier.
2. The supplier fills the order if it can and wants to. It records its DEA number, the number of containers furnished for each item and the ship date on the original, and keeps the original.
3. Partial shipments: the balance may follow in additional shipments within 60 days of the date of the form. No Form 222 is valid more than 60 days after it was executed.
4. On receipt, the purchaser records the number of commercial containers received and the date received on its copy for each item.
5. Defective forms: a supplier may not fill a form that is incomplete, illegible, improperly prepared or altered. It returns the form with a statement. A defective form cannot be corrected; the purchaser issues a new one.
6. Lost or stolen forms are reported to DEA. A replacement form references the lost one.

Controlled Substance Ordering System (CSOS)

CSOS is DEA's electronic alternative, using a CSOS digital certificate issued to each individual signer. Electronic orders must be signed with the certificate, the purchaser records receipt electronically, and records are kept electronically. CSOS can also be used for Schedules III–V.

Power of attorney (21 CFR 1305.05)

The registrant, meaning the person who signed the most recent DEA registration application, may grant a power of attorney to one or more individuals to sign Form 222s. A POA holder may be a pharmacist or another employee the registrant chooses. The POA must be signed by the grantor, the attorney-in-fact and two witnesses, kept with the Form 222 records, and revoked in writing.

Ordering Schedules III–V

No Form 222 is needed. The pharmacy keeps invoices or packing slips showing the drug, quantity and date received, and the receipt record must be readily retrievable (21 CFR 1304.04, 1304.22). Schedule II records, including the Form 222 copies, are kept separately from all other records (21 CFR 1304.04). The Board checks this on the self-inspection form.

Pharmacy-to-pharmacy distribution (21 CFR 1307.11)

A pharmacy registered to dispense may distribute controlled substances to another registered practitioner without a distributor registration, if:

• The receiving practitioner is registered to dispense that substance.
• Schedule II transfers use a Form 222 issued by the receiver.
• Both parties record the transfer.
• The total dosage units distributed this way stay at or below 5% of all controlled-substance dosage units the pharmacy distributes and dispenses in the calendar year.

Above 5%, a distributor registration is required.

Oregon acquisition rules

• A pharmacist may receive drugs only from an Oregon-registered drug outlet, such as a wholesaler, manufacturer or pharmacy (OAR 855-115-0125(3)). Wholesale distributors and manufacturers serving Oregon must be registered with the Board (ORS 689.305).
• The pharmacy's policies must cover drug and device procurement and receiving (OAR 855-041-1040).
• Manufacturer and wholesaler transaction records are kept three years (ORS 689.315(3)).
• The DSCSA's authorized trading partner and product-tracing requirements also apply (section 11.2).

Exam scenario

On May 1 an Oregon pharmacy executes a Form 222 for oxycodone 10 mg (4 bottles) and morphine ER 30 mg (2 bottles). The wholesaler ships 2 bottles of oxycodone and both morphine bottles on May 3, and the remaining 2 oxycodone bottles on June 15. The pharmacist who receives each shipment records the number of containers received and the date on the pharmacy's copy. The June 15 shipment is valid because it is within 60 days of May 1. A shipment on July 5 would not be. The pharmacy files the Form 222 copy separately with its Schedule II records and keeps it 3 years.