5.3 DEA Form 222, CSOS Ordering & Power of Attorney

5.3 DEA Form 222, CSOS Ordering & Power of Attorney

Quick Answer: The transfer and procurement of Schedule I and II controlled substances legally mandates either a physical single-sheet DEA Form 222 or an encrypted CSOS (Controlled Substance Ordering System) digital order (21 CFR Part 1305). Purchasers must retain an exact copy of Form 222 before sending the original to the supplier, and must record the number of packages received and date received upon intake. Suppliers have 60 days to complete shipments. A registrant may delegate ordering authority to individuals (including pharmacy technicians) via a Power of Attorney (POA). Under the 5% Rule (21 CFR § 1307.11), pharmacies distributing $>5%$ of total controlled units in a year must obtain a wholesale distributor registration.

Because Schedule I and II controlled substances carry the highest abuse liabilities and diversion risks, federal law strictly prohibits transferring them via standard commercial invoices, telephone orders, or routine electronic purchase orders. Every procurement, inter-facility transfer, or return of a C-I or C-II substance must be authorized and recorded through specialized federal transfer instruments.

---

The Single-Sheet DEA Form 222 Framework (21 CFR Part 1305)

Historically, the DEA utilized a carbon-copy triplicate Form 222 (Copy 1 Brown to Supplier, Copy 2 Green to DEA, Copy 3 Blue retained by Purchaser). In a major regulatory update (effective October 30, 2019, with mandatory compliance taking full effect October 30, 2021), the DEA transitioned entirely to a single-sheet DEA Form 222.

┌─────────────────────────────────────────────────────────────────────────────┐
│                     SINGLE-SHEET DEA FORM 222 WORKFLOW                      │
│                                                                             │
│  1. Purchaser fills out single-sheet Form 222 (20 ordering lines available) │
│  2. Purchaser makes an EXACT COPY (paper or electronic) for pharmacy files  │
│  3. Purchaser sends ORIGINAL single-sheet Form 222 to the Wholesaler        │
│  4. Supplier verifies form, enters National Drug Codes (NDCs), and ships    │
│  5. Supplier reports shipment to DEA ARCOS (or submits copy to DEA)         │
│  6. Purchaser receives physical shipment, verifies contents, and logs       │
│     PACKAGES RECEIVED and DATE RECEIVED onto retained copy                  │
└─────────────────────────────────────────────────────────────────────────────┘

Detailed Step-by-Step Execution Protocol

Step 1: Purchaser Completion

• The purchaser completes the form with indelible ink, typewriter, or computer printer.
• The single-sheet Form 222 contains 20 order lines (expanded from 10 lines on the obsolete triplicate form). Only one item may be entered per line.
• Required fields include: Name and address of supplier, National Drug Code (NDC) of the drug (optional for purchaser, but required for supplier), drug name, dosage form, strength, package size, number of packages ordered, line numbers, total number of completed lines, and the physical signature and date of the registrant or authorized Power of Attorney (POA).

Step 2: Exact Copy Retention

• Critical Regulatory Mandate: Before sending the original Form 222 to the supplier, the purchaser must create an exact copy (via paper photocopy, photographic scan, or electronic image) and store it in the pharmacy's Schedule II procurement file. Transmitting the original without retaining a copy is a federal compliance violation.

Step 3: Supplier Verification & Processing

• Upon receipt of the original Form 222, the supplier verifies that the form is completely filled, untampered, and signed by an authorized party against DEA registration and POA records.
• If a form is incomplete, illegible, or shows signs of alteration, erasure, or white-out correction, the supplier must refuse the order and return the original form to the purchaser with an explanatory statement. Suppliers cannot alter or correct purchaser entries.
• The supplier records the exact National Drug Code (NDC), number of commercial containers shipped, and the date of shipment on the original Form 222.

Step 4: DEA Reporting (ARCOS)

• The supplier must report the acquisition and disposition of the Schedule II substances to the DEA's Automation of Reports and Consolidated Orders System (ARCOS). If the supplier is not required to report to ARCOS (e.g., an independent pharmacy acting as a supplier), the supplier must submit a copy of the completed Form 222 to the DEA via email or postal mail by the close of the month in which the shipment was filled.

Step 5: Receiving and Reconciliation by Purchaser

• When the physical shipment arrives at the pharmacy, a pharmacist or authorized individual must inspect the delivery container, confirm intact tamper-evident packaging, and compare the physical contents against the packing manifest and the retained copy of Form 222.
• The purchaser must manually or electronically record: (1) the exact number of packages received on each line, and (2) the date received on the retained copy of Form 222. Failing to document receipt dates and package counts is one of the most frequent citations issued during DEA audits.

Step 6: 60-Day Order Fulfillment Window

• If a supplier cannot completely fill an order due to stock shortages, the supplier may ship a partial quantity and supply the balance within 60 calendar days from the date of the form's execution by the purchaser.
• After 60 days, the Form 222 becomes invalid; no further units may be shipped against that form, and any unfilled balances are cancelled.
• A supplier may also endorse the entire original Form 222 to another registered supplier if unable to fill any part of the order.

---

Controlled Substance Ordering System (CSOS): Electronic Procurement

Under 21 CFR Part 1311, the DEA established the Controlled Substance Ordering System (CSOS) as a secure, electronic alternative to the paper Form 222.

┌─────────────────────────────────────────────────────────────────────────────┐
│                      PAPER FORM 222 VS. ELECTRONIC CSOS                     │
│                                                                             │
│  FEATURE                  DEA FORM 222 (PAPER)        CSOS (ELECTRONIC)     │
│  ───────────────────────  ──────────────────────────  ───────────────────   │
│  Permitted Schedules      Schedule I and II only      Schedule I, II, III,  │
│                                                       IV, and V             │
│                                                                             │
│  Line Item Capacity       Maximum 20 lines per form   Unlimited lines       │
│                                                                             │
│  Turnaround Time          Several days (postal mail)  Immediate / Real-Time │
│                                                                             │
│  Authentication Method    Physical pen-to-paper hand  PKI Digital Cert      │
│                           signature                   (X.509 Cryptographic) │
│                                                                             │
│  Transaction Error Rate   Higher (manual entry/typos) Automated validation  │
│                                                                             │
│  Record Retention         2 years (Physical/Scanned)  2 years (Electronic)  │
└─────────────────────────────────────────────────────────────────────────────┘

1. Public Key Infrastructure (PKI) & Digital Signatures

CSOS relies on Public Key Infrastructure (PKI) technology utilizing X.509 digital certificates issued exclusively by the DEA Certification Authority (DEA CA). When an authorized user executes a CSOS order, the software applies a unique cryptographic private key to create a digital signature that guarantees:

• Authentication: Verifies that the order originated from a verified, DEA-registered individual or authorized POA holder.
• Non-Repudiation: Legally binds the signer to the order, preventing denial of execution.
• Message Integrity: Ensures that the electronic purchase order cannot be altered or modified in transit without invalidating the cryptographic hash.

2. The CSOS Coordinator & Certificate Lifecycle

• Each registrant appoints at least one CSOS Coordinator who manages certificate applications, administrative enrollments, and user access.
• Digital certificates expire after three (3) years (aligned with the DEA Form 224 renewal cycle) and must be renewed.
• If a certificate holder leaves the organization, is terminated, or has their purchasing authority revoked, the CSOS Coordinator must submit a Certificate Revocation Request to the DEA CA so the certificate can no longer sign orders. Separately, 21 CFR § 1311.30(e) requires the certificate holder to report the loss, theft, or compromise of the private key or its password to the Certification Authority via a revocation request within 24 hours of substantiating the compromise; the holder must then apply for a new certificate under § 1311.25.

3. Electronic Receiving and Archiving

When an electronic CSOS shipment arrives, the pharmacy must link the electronic receiving record (containing the digital timestamp, quantity received, and date) with the original signed electronic purchase order. All CSOS records must be stored electronically in a secure, backed-up database for at least 2 years and be readily retrievable for DEA inspection.

---

Power of Attorney (POA) Delegation Protocols (21 CFR § 1305.05)

Under 21 CFR § 1305.05, the primary DEA registrant—the individual who signed the most recent DEA registration application or renewal (e.g., the owner, CEO, or designated Pharmacist-in-Charge)—may delegate legal authority to one or more individuals to execute DEA Form 222s and sign electronic CSOS orders.

┌─────────────────────────────────────────────────────────────────────────────┐
│                     POWER OF ATTORNEY (POA) KEY FACTS                       │
│                                                                             │
│  • WHO CAN GRANT:  The individual who signed the most recent DEA Form 224   │
│  • WHO CAN RECEIVE: ANY authorized employee (Pharmacist, Lead Technician,   │
│                    Purchasing Agent - does NOT have to be a pharmacist)     │
│  • WITNESSING:     Must be signed by Registrant, POA Grantee, and TWO adult │
│                    witnesses                                                │
│  • RETENTION:      Must be kept on file with Form 222 records for 2 years   │
│  • REVOCATION:     Can be revoked at ANY time by signing Notice of Revoc    │
└─────────────────────────────────────────────────────────────────────────────┘

Crucial POA Regulations for Healthcare Facilities

1. Technician Eligibility: Federal law does not require the POA agent to be a licensed pharmacist. A certified pharmacy technician, pharmacy buyer, or administrative logistics specialist may hold POA and legally execute Form 222 and CSOS orders.
2. Multiple Simultaneous POAs: A registrant may grant active POA to multiple staff members simultaneously to ensure continuous ordering capability across weekends, vacations, and shift changes.
3. Immediate Revocation: If a POA holder transfers to another facility or is terminated, the registrant must immediately execute a formal Notice of Revocation of Power of Attorney, signed by the registrant and two witnesses, and attach it to the original POA document on file.

---

The 5% Rule: Transfers Between Registrants (21 CFR § 1307.11)

In daily clinical operations, healthcare facilities occasionally need to transfer controlled substances to other registrants (e.g., supplying emergency stock to a sister hospital, transferring stock to a closed-door surgery center, or selling medication to a nearby retail pharmacy experiencing an acute shortage).

Under 21 CFR § 1307.11, a registered pharmacy or hospital may distribute controlled substances to another DEA registrant without obtaining a separate wholesale distributor registration, provided they strictly comply with the 5% Rule.

The 5% Threshold Mathematical Calculation

$\text{Distribution Ratio} = \frac{\text{Total Dosage Units of C-II through C-V Distributed in Calendar Year}}{\text{Total Dosage Units of C-II through C-V Dispensed + Distributed in Calendar Year}} \times 100\%$

┌─────────────────────────────────────────────────────────────────────────────┐
│                     5% THRESHOLD REGULATORY CALCULATION                     │
│                                                                             │
│  Hospital Pharmacy Annual Data:                                             │
│  • Total controlled substance dosage units dispensed (patient Rx/orders):   │
│    480,000 dosage units                                                     │
│  • Total controlled substance units distributed to affiliated clinics:      │
│    20,000 dosage units                                                      │
│  • Total units handled = 480,000 + 20,000 = 500,000 dosage units            │
│                                                                             │
│  Calculation:                                                               │
│  Distribution % = (20,000 / 500,000) × 100% = 4.0%                         │
│                                                                             │
│  STATUS: COMPLIANT (4.0% ≤ 5.0%) ──► Permitted under DEA Form 224           │
│  * If distribution exceeded 25,000 units (>5.0%), pharmacy would be an      │
│    unlicensed wholesale distributor and must obtain DEA Form 225.           │
└─────────────────────────────────────────────────────────────────────────────┘

Mandatory Transfer Documentation

• Schedule II Transfers: The receiving registrant must issue an official DEA Form 222 (or CSOS order) to the transferring pharmacy. The transferring pharmacy acts as the "supplier" and fulfills the order.
• Schedule III–V Transfers: The transfer must be documented via a detailed commercial invoice containing: (1) Drug name, dosage form, strength, and quantity; (2) Date of transfer; and (3) Names, addresses, and DEA registration numbers of both the transferring and receiving facilities.