9.1 Controlled Substance Ordering: DEA Form 222 & CSOS

9.1 Controlled Substance Ordering: DEA Form 222 & CSOS

Quick Answer: Under federal regulations (21 CFR Part 1305) and Tennessee law (T.C.A. Title 53, Chapter 11), the procurement of Schedule I and Schedule II controlled substances requires an executed single-sheet DEA Form 222 or an electronic order via the Controlled Substance Ordering System (CSOS) using a Public Key Infrastructure (PKI) digital certificate. Under the single-sheet format, the purchaser retains a copy (hardcopy or electronic) and sends the original to the supplier; upon receipt, the purchaser records the number of containers and date received on their copy. Suppliers may partially fill an order provided the balance is shipped within 60 calendar days. Orders for Schedules III through V do not require Form 222 and are procured via commercial invoices containing mandatory statutory elements. A Power of Attorney (POA) executed under 21 CFR § 1305.05 authorizes designated individuals (pharmacists or non-pharmacists) to execute 222/CSOS orders, requires two witnesses, is retained on site for 2 years, and is never sent to the DEA.

---

1. Statutory Architecture & Scope of Controlled Substance Procurement

The procurement of controlled substances is governed by a strict "closed distribution system" established under Title II of the Comprehensive Drug Abuse Prevention and Control Act of 1970 (21 U.S.C. § 801 et seq.) and mirrored at the state level by the Tennessee Drug Control Act of 1989 (Tennessee Code Annotated [T.C.A.] Title 53, Chapter 11) and administrative rules of the Tennessee Board of Pharmacy (Tenn. Comp. R. & Regs. Chapter 1140-03).

Within this closed distribution network, every commercial transfer of a controlled substance—from manufacturer to wholesale distributor, distributor to community or institutional pharmacy, or pharmacy to practitioner—must be accounted for through statutory documentation. The legal mechanism required depends strictly on the drug's schedule:

• Schedule I and II Controlled Substances: Procured exclusively through DEA Form 222 (paper single-sheet) or the electronic Controlled Substance Ordering System (CSOS) pursuant to 21 CFR Part 1305.
• Schedule III, IV, and V Controlled Substances: Procured through standard commercial invoices or purchase orders, or optionally through CSOS, pursuant to 21 CFR § 1304.22 and T.C.A. § 53-11-306.

[!IMPORTANT] A community pharmacy cannot lawfully transfer or purchase Schedule II controlled substances using standard invoices or verbal orders. Any transfer of a Schedule II drug—even between two community pharmacies under emergency 5% transfer rules—requires an executed DEA Form 222 or valid CSOS transaction.

---

2. Paper DEA Form 222: Single-Sheet Execution Protocol

Historically, the DEA utilized a triplicate carbon-copy Form 222 (Copy 1 to supplier, Copy 2 to DEA, Copy 3 retained by purchaser). In 2019, the DEA promulgated a final rule transitioning to a single-sheet DEA Form 222, with a complete sunset of legacy triplicate forms on October 17, 2021. All paper Schedule I and II ordering today must utilize the single-sheet standard.

┌─────────────────────────────────────────────────────────────────────────────┐
│                     DEA FORM 222: SINGLE-SHEET LIFECYCLE                    │
├─────────────────────────────────────────────────────────────────────────────┤
│ 1. EXECUTION BY PURCHASER:                                                  │
│    • Purchaser completes 1 to 20 lines on original single-sheet Form 222.    │
│    • Must record: drug name, dosage form, strength, package size, quantity. │
│    • Signed & dated by registrant or authorized Power of Attorney (POA).    │
│                                                                             │
│ 2. COPY & TRANSMISSION:                                                     │
│    • Purchaser creates a COPY (hardcopy photocopy or electronic scan).      │
│    • Purchaser RETAINS the copy in pharmacy Schedule II records.            │
│    • Purchaser TRANSMITS original single-sheet Form 222 to supplier.        │
│                                                                             │
│ 3. SUPPLIER FULFILLMENT & ARCOS REPORTING:                                  │
│    • Supplier verifies form, enters DEA registration & NDC numbers.         │
│    • Supplier ships containers and records date of shipment.                │
│    • Supplier reports transaction to DEA via ARCOS, OR sends copy of Form   │
│      222 to DEA via email/secure portal by the CLOSE OF THE MONTH.          │
│                                                                             │
│ 4. RECEIPT & VERIFICATION BY PURCHASER:                                     │
│    • When shipment arrives, purchaser inspects packages against Form 222.   │
│    • Pharmacist records on the RETAINED COPY:                               │
│      - Number of commercial containers received                             │
│      - Exact date shipment received                                         │
└─────────────────────────────────────────────────────────────────────────────┘

Detailed Purchaser Execution Rules (21 CFR § 1305.12)

1. Form Structure: Each single-sheet Form 222 contains 20 order lines (compared to 10 lines on the legacy triplicate form). Only one item may be entered on each numbered line.
2. Item Specifications: For each line, the purchaser must specify:
   • Name of the substance
   • Dosage form (e.g., tablet, capsule, liquid, ampul)
   • Strength or concentration (e.g., 10 mg, 20 mg/mL)
   • Package size (e.g., 100-count bottle, 500-count bottle)
   • Number of commercial containers desired
3. National Drug Code (NDC): Entering the NDC is optional for the purchaser; the supplier is required to enter the NDC of the exact product supplied.
4. Pre-Printed Registrant Data: Forms are pre-printed by the DEA with the pharmacy's name, registered location address, DEA registration number, authorized schedules (e.g., 2, 2N), and a unique sequential Form 222 tracking number. A purchaser cannot alter this pre-printed information.
5. Retaining the Copy: Before transmitting the original Form 222 to the supplier, the purchaser must make a copy of the form (either a paper photocopy or a validated electronic image) and store it in the pharmacy's Schedule II files. The copy must be readily retrievable for inspection.
6. Recording Receipt: When the drugs physically arrive at the pharmacy, the purchaser must examine the shipment and record on the retained copy:
   • The actual number of commercial containers received
   • The date on which the containers were received
   • This documentation must be completed directly on the purchaser's copy; recording receipt solely on the supplier packing slip violates 21 CFR § 1305.13(e).

Supplier Responsibilities & Reporting (21 CFR § 1305.13)

• The supplier must record on the original Form 222 its DEA registration number, the National Drug Code (NDC) for each item shipped, the number of containers shipped, and the date shipped.
• DEA Reporting Requirement: Suppliers that report controlled substance transactions to the DEA's Automation of Reports and Consolidated Orders System (ARCOS) are not required to mail a physical copy to the DEA. Suppliers not required to report via ARCOS must submit a copy of the original Form 222 to the DEA (via postal mail, fax, or secure DEA electronic portal) by the close of the month in which the order is filled.

---

3. Execution Rules, Defective Orders, Endorsements & Partial Filling

Federal regulations enforce strict, unforgiving standards regarding Form 222 integrity. Because Form 222 is a federal tracking instrument, errors cannot be corrected informally.

┌─────────────────────────────────────────────────────────────────────────────┐
│                     FORM 222 COMPLIANCE & EXCEPTION MATRIX                  │
├──────────────────────────┬──────────────────────────────────────────────────┤
│ Situation                │ Mandatory Regulatory Action (21 CFR Part 1305)   │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Alteration / Erasure /   │ Order is DEFECTIVE. Supplier CANNOT fill. Must    │
│ White-out on Form 222    │ return original form to purchaser with statement.│
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Supplier Out of Stock    │ Supplier may PARTIALLY fill; balance must be     │
│ (Partial Filling)        │ shipped within 60 CALENDAR DAYS of form date.    │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Purchaser Cancellation   │ Purchaser notifies supplier in writing; supplier │
│ of Line Item(s)          │ draws line through item and writes "Canceled".   │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Supplier Unable to Fill  │ Supplier may ENDORSE order in entirety to a      │
│ (Endorsement)            │ second registered supplier (21 CFR § 1305.16).   │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Lost in Transit to       │ Purchaser executes second 222 with statement of  │
│ Supplier                 │ serial #, date, and non-receipt; attaches copy.  │
└──────────────────────────┴──────────────────────────────────────────────────┘

Unaccepted and Defective Forms (21 CFR § 1305.15)

A Form 222 is legally defective and must not be filled if:

• The form is incomplete, illegible, or not properly signed.
• The form shows any sign of alteration, erasure, crossed-out text, or correction fluid ("white-out").

Mandatory Defective Form Procedure:

1. The supplier cannot make corrections on the form, even with verbal or written permission from the purchaser.
2. The supplier must refuse the order and return the original Form 222 to the purchaser.
3. The supplier must attach a written statement of explanation detailing the reason for refusal (e.g., "Line 3 altered with correction fluid").
4. Upon return, the purchaser must not discard the defective form. The purchaser must attach the returned original Form 222 to its retained copy and the supplier's explanatory statement, filing them in the pharmacy's Schedule II records for at least two (2) years.

Supplier Partial Filling (21 CFR § 1305.13(b))

If a supplier has insufficient inventory to fill the entire quantity requested on a Form 222 line item, the supplier is legally permitted to partially fill the order, subject to a strict statutory deadline:

• The supplier ships whatever quantity is in stock immediately.
• The supplier has a maximum of sixty (60) calendar days from the date of the Form 222 to supply the remaining balance.
• If the balance is not shipped within the 60-day window, the remaining unfilled quantity automatically expires and becomes void. The supplier cannot ship the balance on Day 61. If the pharmacy still needs the product, a new Form 222 or CSOS order must be executed.

Cancellation and Voiding of Orders (21 CFR § 1305.19)

• A purchaser may cancel all or part of an order by notifying the supplier in writing.
• Upon receipt of written cancellation, the supplier indicates the cancellation on the original Form 222 by drawing a line through the canceled item(s) and printing "Canceled" in the space provided for the number of items shipped.

Endorsement of Form 222 (21 CFR § 1305.16)

If a wholesale supplier receives a Form 222 that it cannot fill (e.g., entire warehouse stock depleted), the supplier may endorse the entire order to another registered supplier:

• The original supplier completes the reverse endorsement block, naming the second supplier.
• Endorsement must be complete: A supplier cannot partially fill an order and endorse the remainder to another distributor. Only the supplier to whom the Form 222 was originally addressed may endorse it.
• The second supplier fills the order, records the shipment, and reports the transaction to the DEA.

---

4. Controlled Substance Ordering System (CSOS)

The Controlled Substance Ordering System (CSOS) is the DEA's secure electronic ordering architecture established under 21 CFR Part 1305, Subpart B. CSOS serves as the electronic equivalent of DEA Form 222 but provides substantially greater operational efficiency and expanded scope.

┌─────────────────────────────────────────────────────────────────────────────┐
│                     CSOS OPERATIONAL & TECHNICAL PROFILE                    │
├──────────────────────────┬──────────────────────────────────────────────────┤
│ Feature                  │ CSOS Regulatory Specification (21 CFR Part 1305) │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Permitted Schedules      │ Schedules I, II, III, IV, and V (plus legend Rx) │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Line Item Limitations    │ NO line limit (unlimited items per order)        │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Security Technology      │ Public Key Infrastructure (PKI) X.509 Certificate│
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Legal Attributes         │ Authentication, Data Integrity, Non-Repudiation  │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Certificate Authority    │ DEA Certification Authority (DEA CA)             │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Supplier DEA Reporting   │ Within TWO (2) BUSINESS DAYS of filling          │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Defective Order Handling │ Supplier notifies purchaser; cannot be altered;  │
│                          │ electronically retained for 2 years.             │
└──────────────────────────┴──────────────────────────────────────────────────┘

PKI Digital Certificates and Non-Repudiation

CSOS operates on Public Key Infrastructure (PKI) technology utilizing asymmetric cryptographic keys:

• Digital Certificate: Issued exclusively by the DEA Certification Authority (DEA CA) to an authorized individual (registrant or designated Power of Attorney). The certificate is an electronic credential containing the subscriber's identity, public key, DEA registration number, authorized schedules, and expiration date.
• Non-Repudiation: Because the private key is held exclusively by the certificate holder, an electronic order signed with the private key creates legal non-repudiation—the signer cannot deny having created and transmitted the order.
• CSOS Coordinator: A registrant appoints a CSOS Coordinator (via DEA Form 224 application or formal letter) who acts as the administrative liaison between the DEA CA and the pharmacy, managing certificate enrollments, renewals, and revocations.

Electronic Order Validation & Fulfillment

When an electronic CSOS order is submitted:

1. Validation Engine: The supplier's software automatically verifies that the purchaser's digital certificate is active, unexpired, and not on the DEA's Certificate Revocation List (CRL).
2. Schedule Check: The system verifies that the purchaser's DEA registration authorizes the specific schedules requested.
3. Integrity Check: The software verifies that the digital signature matches the order content and that no data tampering occurred in transit.
4. Supplier Reporting Deadline: The supplier must create an electronic record of the shipment and submit an electronic report of the transaction to the DEA within two (2) business days of filling the order. This is a major contrast with paper Form 222 reporting, which occurs monthly.

Defective Electronic Orders (21 CFR § 1305.25)

An electronic CSOS order cannot be filled if:

• The data fields are incomplete or corrupted.
• The digital signature is invalid or unverified.
• The digital certificate has expired or been revoked.

If an electronic order is defective, the supplier must issue an electronic notice of rejection to the purchaser. Neither the purchaser nor the supplier may alter an electronic CSOS order. If an order is rejected, the purchaser must execute a brand new electronic order. Both the purchaser and supplier must retain electronic copies of rejected orders for at least two (2) years.

---

5. Procurement of Schedule III, IV, and V Substances

Unlike Schedule I and II drugs, the procurement of Schedule III, IV, and V controlled substances does not require a DEA Form 222 or a CSOS PKI digital certificate. Instead, these substances are ordered through standard commercial invoices or automated electronic ordering systems pursuant to 21 CFR § 1304.22 and T.C.A. § 53-11-306.

Mandatory Commercial Invoice Data Elements

Under federal and Tennessee law, every commercial invoice for Schedule III–V procurement must contain the following five mandatory data elements:

┌─────────────────────────────────────────────────────────────────────────────┐
│               MANDATORY SCHEDULE III–V INVOICE DATA ELEMENTS                │
├─────────────────────────────────────────────────────────────────────────────┤
│ 1. Complete Drug Name, Dosage Form, and Strength                            │
│    (e.g., Acetaminophen with Codeine #3 tablets, 300 mg / 30 mg)            │
│                                                                             │
│ 2. Quantity & Container Size                                                │
│    (e.g., 5 commercial containers, each containing 100 tablets)              │
│                                                                             │
│ 3. Actual Date Received by Pharmacy                                         │
│    (Must be physically recorded upon arrival at the pharmacy)               │
│                                                                             │
│ 4. Name, Address, and DEA Registration Number of the Supplier               │
│                                                                             │
│ 5. Name, Address, and DEA Registration Number of the Purchaser (Pharmacy)   │
└─────────────────────────────────────────────────────────────────────────────┘

Pharmacist Receiving Duties for C-III–V

When a Schedule III–V shipment arrives at the pharmacy:

1. The pharmacist or designated personnel must physically open the shipment and verify that the actual drugs and quantities received match the commercial invoice.
2. The receiver must manually record the date received and document the actual quantity received directly onto the invoice.
3. Invoices must be signed or initialed by the receiving personnel.
4. Invoices must be maintained on site in the pharmacy's controlled substance records for at least two (2) years.

---

6. Power of Attorney (POA) for Controlled Substance Ordering (21 CFR § 1305.05)

A registered pharmacy owner or corporate entity is often not physically present in the pharmacy to sign every daily DEA Form 222 or authenticate every CSOS order. Under 21 CFR § 1305.05, the registrant is legally authorized to delegate this signature authority through an executed Power of Attorney (POA).

┌─────────────────────────────────────────────────────────────────────────────┐
│                     POWER OF ATTORNEY (POA) LEGAL MATRIX                    │
├──────────────────────────┬──────────────────────────────────────────────────┤
│ Legal Dimension          │ Statutory Standard (21 CFR § 1305.05)            │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Who May Grant POA        │ The DEA Registrant (individual owner, partner,   │
│                          │ corporate officer), or the person who signed the │
│                          │ most recent DEA Form 224 registration / renewal. │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Who May Receive POA      │ ANY designated individual (licensed pharmacist,  │
│                          │ intern, or UNLICENSED technician / clerk).       │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Execution Formalities    │ Must follow statutory text; signed by Grantor,   │
│                          │ Grantee, and TWO (2) adult witnesses.            │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Filing with DEA          │ NEVER filed with the DEA! Retained locally at   │
│                          │ the pharmacy practice site.                      │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Retention Period         │ Retained for at least TWO (2) YEARS from the     │
│                          │ date of revocation or termination.               │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Revocation Procedure     │ Grantor executes written Notice of Revocation    │
│                          │ signed by registrant and TWO (2) witnesses.      │
└──────────────────────────┴──────────────────────────────────────────────────┘

Key MPJE Nuances Regarding Power of Attorney

1. Eligible Grantees: The DEA does not require the POA recipient to be a licensed pharmacist. A pharmacy owner may lawfully grant POA to a lead pharmacy technician, inventory specialist, or pharmacy intern. However, professional liability and clinical oversight generally favor granting POA to pharmacists.
2. Multiple POAs Permitted: A registrant may execute as many POAs as necessary (e.g., executing separate POAs for all full-time and part-time staff pharmacists).
3. Witness Mandate: The execution of a POA (and its revocation) requires two (2) adult witnesses to sign alongside the grantor and grantee. An unwitnessed POA is legally void.
4. Local Retention: A common trap on the MPJE asserts that a POA must be mailed to the DEA Special Agent in Charge (SAC) within 14 days. This is completely false. POAs are maintained on site at the registered location with executed Forms 222 and must be readily available for DEA or Board inspection.
5. Change of Registrant Voids POAs: If a pharmacy changes owners or the individual who signed the most recent DEA Form 224 registration leaves the organization, all existing POAs executed by that individual automatically expire. The new registrant must execute fresh POAs for all authorized ordering personnel.

---

7. Procurement Comparison Framework

---

8. Practical Exam Scenarios

Scenario 1: Alteration on a Single-Sheet Form 222

Case: A staff pharmacist in Chattanooga fills out a single-sheet Form 222 to order 10 bottles of methylphenidate 20 mg. While writing, the pharmacist accidentally writes "100" in the package size column, uses white-out correction fluid to cover the error, writes "1000", and initials the change. The distributor's regulatory compliance officer rejects the entire form. Legal Analysis: Under 21 CFR § 1305.15, any DEA Form 222 that shows an erasure, alteration, or correction fluid is legally defective and cannot be filled. The supplier acted correctly in rejecting the order. The supplier must return the original Form 222 to the pharmacy with an explanatory letter. The pharmacist cannot throw away the altered form; it must be attached to the pharmacy's retained copy and kept in Schedule II files for 2 years.

Scenario 2: Supplier 60-Day Partial Fill Window

Case: On June 1, 2026, a Knoxville pharmacy submits a Form 222 for 5 bottles of fentanyl 50 mcg/hr transdermal patches. The distributor ships 2 bottles on June 3 with a note stating the remaining 3 bottles are on manufacturer backorder. The distributor receives fresh stock on August 10, 2026, and ships the remaining 3 bottles to the pharmacy. Legal Analysis: Under 21 CFR § 1305.13(b), a supplier may partially fill a Form 222 only if the balance is shipped within 60 calendar days of the execution date (June 1). Sixty days from June 1 expired on July 31, 2026. The distributor's shipment on August 10 (Day 70) violates federal law. The remaining 3 bottles became void on Day 60 and required a newly executed Form 222 or CSOS order.

Scenario 3: Non-Pharmacist Executing CSOS Orders

Case: A retail pharmacy owner grants Power of Attorney to a nationally certified pharmacy technician who serves as the inventory control lead. The technician uses their own DEA-issued CSOS digital certificate to order oxycodone and hydrocodone stock. During an annual Board inspection, an investigator questions whether a non-pharmacist can lawfully execute Schedule II orders. Legal Analysis: Under 21 CFR § 1305.05, the registrant may grant a Power of Attorney to any individual, regardless of whether they are a licensed pharmacist. Because the technician was validly granted POA with two witnesses, and possesses an individual CSOS certificate issued under that POA, the ordering is fully lawful under both federal and Tennessee law.