9.1 DEA Form 222, CSOS & Controlled Substance Ordering

9.1 DEA Form 222, CSOS & Controlled Substance Ordering

The procurement and inter-registrant transfer of controlled substances represent one of the most strictly policed closed distribution systems in United States administrative law. Established under the federal Controlled Substances Act (CSA) of 1970 (21 U.S.C. § 801 et seq.) and enforced in the Commonwealth through the Virginia Drug Control Act (Va. Code § 54.1-3400 et seq.), this regulatory framework guarantees that every unit of a controlled substance is tracked from initial chemical synthesis through wholesale distribution, pharmacy receipt, and ultimate patient dispensing.

For pharmacy practitioners and Pharmacists-in-Charge (PICs), mastering procurement law requires navigating two parallel ordering pathways: the paper-based DEA Form 222 process (and its modern electronic counterpart, the Controlled Substance Ordering System [CSOS]) for Schedule I and II agents, and the commercial invoice and packing slip documentation standards governing Schedules III through V.

---

Schedule I and II Ordering: DEA Form 222 (Paper Single-Sheet Format)

Under 21 CFR Part 1305, DEA Form 222 is the mandatory paper instrument required for any distribution, purchase, or transfer of a Schedule I or Schedule II controlled substance. Historically, the Drug Enforcement Administration (DEA) mandated a carbon-interleaved triplicate form (Copy 1 to supplier, Copy 2 to DEA, Copy 3 retained by purchaser). Effective October 30, 2021, the DEA completed a full transition that rendered triplicate forms obsolete; all paper Schedule II ordering must now utilize the single-sheet DEA Form 222.

Single-Sheet Procurement and Execution Protocol

1. Procurement of Forms: Only a DEA registrant (or their designated agent holding an active Power of Attorney) may order official single-sheet Form 222 blanks from the DEA. Each form is pre-printed by the agency with the registrant's name, registered business address, DEA registration number, authorized drug schedules, and a unique pre-printed alphanumeric order form number.
2. Drafting the Order: The purchaser must complete the single sheet using a typewriter, pen, or indelible pencil. The single-sheet format provides twenty (20) order lines (an expansion from the 10-line limitation on legacy triplicate forms). Each line item must explicitly state:
   • The number of commercial containers desired;
   • The package size of the commercial container;
   • The name and National Drug Code (NDC) or exact strength and dosage form of the controlled substance.
3. Line Count Notation: At the bottom of the form, the purchaser must record the exact total number of lines completed. This prevents unauthorized post-execution additions by secondary handlers.
4. Signatures and Execution: The form must be dated and signed by the individual who signed the most recent DEA registration or re-registration application, or by an individual possessing an active, legally valid Power of Attorney (POA) executed pursuant to 21 CFR § 1305.05.
5. Making the Retained Purchaser Copy: Prior to sending the form to the wholesale supplier, the purchaser must make a complete, legible copy of the original single-sheet Form 222 for their own records. This retained copy may be maintained in paper form or stored electronically in an readily retrievable digital format.
6. Transmitting the Original: The purchaser sends the original single-sheet Form 222 to the supplier. The supplier cannot ship any Schedule II controlled substance without physical possession of the original signed form.

Supplier Responsibilities and ARCOS Reporting

Upon receipt of the original Form 222, the supplier verifies the legitimacy of the order, confirms that the purchaser's DEA registration is active and authorized for Schedule II substances, and fills the order:

• Recording Shipments: The supplier records on the original single sheet the exact number of commercial containers shipped and the date of shipment for each line item.
• Partial Shipments (The 60-Day Rule): If the supplier does not have the complete requested inventory in stock, they may ship a partial quantity. The supplier has a statutory maximum of sixty (60) days from the date the Form 222 was executed by the purchaser to ship the balance of the order. After 60 days, the form expires, and no further units may be shipped against that specific order line.
• Reporting to DEA (ARCOS): The supplier must report the transaction to the DEA's Automation of Reports and Consolidated Orders System (ARCOS). If the supplier is not an ARCOS participant (such as a community pharmacy acting as a distributor under the 5% Rule), the supplier must make a copy of the original Form 222 and submit it to the DEA via mail or electronic submission by the close of the month in which the shipment occurred.

Purchaser Receipt Verification

When the Schedule II shipment arrives at the pharmacy, the order must be received and processed strictly according to regulatory standards:

• The receiving pharmacist must physically open the shipping container and verify that the contents match the packing list and the purchaser's retained copy of Form 222.
• On the retained copy of Form 222, the pharmacist must record the number of commercial containers actually received and the exact date received for each line item.
• Under Virginia Board of Pharmacy regulation 18VAC110-20-240, this receipt verification must be performed promptly and documented directly on the record.

DEA Form 222 Single-Sheet Execution Pathway:
┌──────────────────────┐         Sends Original Form         ┌──────────────────────┐
│      Purchaser       │────────────────────────────────────►│       Supplier       │
│ (Completes 20 lines; │                                     │ (Fills order; ships; │
│ retains copy/scan)   │◄────────────────────────────────────│ records ship date/qty│
└──────────────────────┘       Ships Physical Product        └──────────────────────┘
           │                                                             │
           ▼                                                             ▼
Records actual packages received                            Reports transaction to DEA
and date on retained copy                                   via ARCOS (or copy submission)

Handling Defective, Lost, or Stolen Forms 222

• Defective Forms: If a Form 222 contains erasures, alterations, white-out, or illegible handwriting, the supplier must refuse to fill the order. The supplier returns the original single sheet to the purchaser accompanied by a written explanation of refusal. The purchaser must attach the returned original to their retained copy and file both in their Schedule II records. A defective form cannot be corrected; a new Form 222 must be drafted.
• Lost or Stolen Forms in Transit: If an executed Form 222 is lost in the mail or stolen before the supplier receives it, the purchaser must execute a new Form 222. The purchaser must also draft a formal statement containing: (1) the order form number of the lost/stolen form, (2) the date of the lost form, and (3) a declaration that the controlled substances listed were never received. The purchaser attaches a copy of this statement to the retained copy of the new Form 222 and sends the original statement with the new Form 222 to the supplier.
• Theft of Unused Forms: If unused single-sheet Forms 222 are stolen or lost from the pharmacy, the PIC must immediately report the theft or loss to the DEA Special Agent in Charge of the local Divisional Office and to the Virginia Board of Pharmacy, stating the specific serial numbers of the missing forms.

---

Power of Attorney (POA) Delegation (21 CFR § 1305.05)

Under federal law, the legal authority to sign DEA Forms 222 and CSOS orders belongs solely to the person who signed the most recent DEA registration application (Form 224) or re-registration. In institutional or large community pharmacies, this individual is rarely present for day-to-day wholesale ordering. Under 21 CFR § 1305.05, the registrant may delegate this authority by executing a formal Power of Attorney (POA).

Statutory Requirements for Valid POA Execution

Exam Tip: State board and federal examiners frequently test whether a pharmacy technician can legally sign a DEA Form 222. Under federal law, yes, a pharmacy technician, intern, or business manager may sign DEA Form 222 or CSOS orders, provided they have been formally granted a valid Power of Attorney executed according to 21 CFR § 1305.05. However, state dispensing and verification duties remain restricted to licensed pharmacists.

---

Electronic Ordering: The Controlled Substance Ordering System (CSOS)

Under 21 CFR §§ 1305.21 through 1305.29, the DEA established the Controlled Substance Ordering System (CSOS), providing a secure, electronic alternative to paper Form 222.

Architecture and Digital PKI Certificates

CSOS operates on Public Key Infrastructure (PKI) technology. To order electronically, the individual authorized to sign orders (either the registrant or an individual holding an approved CSOS Power of Attorney) must obtain a personal CSOS Digital Certificate issued by the DEA's CSOS Certification Authority:

• The digital certificate acts as a legally binding digital signature equivalent to a physical signature on paper Form 222.
• Certificates are tied to the individual's identity and cannot be shared, transferred, or used by anyone else.
• Digital certificates expire every three years (or upon expiration of the pharmacy's DEA registration) and must be renewed.

Comparative Operational Advantages of CSOS vs. Paper Form 222

---

Procurement of Schedules III, IV, and V Controlled Substances

DEA Form 222 is strictly prohibited from being used to order Schedule III, IV, or V medications. Under 21 CFR § 1305.03, any order for Schedules III–V placed on a Form 222 is void.

Commercial Invoice and Packing Slip Requirements

Schedules III through V controlled substances are ordered and received through standard commercial wholesale channels using invoices or packing slips. Under 21 CFR § 1304.22 and Virginia Board regulation 18VAC110-20-240, every incoming invoice for Schedules III–V must contain the following mandatory statutory elements:

1. Name of the controlled substance;
2. Dosage form and strength (e.g., acetaminophen with codeine #3 tablets, 300 mg/30 mg);
3. Number of commercial containers and container size (e.g., 5 bottles of 100 tablets);
4. Date the controlled substances were received by the pharmacy;
5. Full legal business name, street address, and DEA registration number of the supplier;
6. Full legal pharmacy name, practice address, and DEA registration number of the purchaser.

Virginia Pharmacist Physical Verification Mandate

Under Virginia law (18VAC110-20-240), when a shipment of Schedule III, IV, or V controlled substances arrives, a Virginia-licensed pharmacist must physically verify the contents of the shipment against the invoice. Upon confirming that the received drugs match the quantities and strengths invoiced, the receiving pharmacist must personally sign and date the commercial invoice or packing slip. In an automated electronic receiving system, the pharmacist must enter an electronic signature confirming physical inspection on the date of delivery.

---

Inter-Registrant Transfers and the 5% Rule (21 CFR § 1307.11)

Pharmacies frequently need to transfer controlled substances to other pharmacies (e.g., to alleviate an acute stock outage) or to registered physicians (for in-office administration). Under federal and Virginia law, these transactions must follow strict statutory channels:

Absolute Prohibition: A retail pharmacy may NEVER dispense a controlled substance to a physician or practitioner pursuant to a prescription marked "For Office Use". A prescription, by federal definition (21 CFR § 1306.04), can only be issued for an ultimate user (the patient). Providing controlled substances for office stock via a prescription is an illegal distribution.

The 5% Distribution Exemption

Under 21 CFR § 1307.11 and Va. Code § 54.1-3435.01, a licensed pharmacy is permitted to act as an occasional distributor and transfer controlled substances to another DEA-registered entity without registering as a wholesale distributor, subject to the 5% Rule:

• Calculation: The total number of dosage units of all controlled substances (Schedules I through V) distributed by the pharmacy to other registrants during a calendar year cannot exceed 5% of the total dosage units of all controlled substances distributed and dispensed by that pharmacy during the same consecutive 12-month calendar year.
• Exceeding the Threshold: If the pharmacy distributes more than 5% of its total controlled substance units to other entities, the pharmacy must formally register with the DEA and the Virginia Board of Pharmacy as a licensed wholesale distributor.

Transfer Documentation Mechanics

• Schedule II Transfers: The purchasing entity (the pharmacy or physician receiving the drug) must execute and transmit an official DEA Form 222 (or CSOS order) to the supplying pharmacy. The supplying pharmacy acts as the "supplier", fills the order, retains the original Form 222, and submits a copy to the DEA.
• Schedule III–V Transfers: The transaction must be documented via an official commercial invoice generated by the transferring pharmacy, containing all statutory elements (drug name, strength, dosage form, quantity, transfer date, names, addresses, and DEA numbers of both parties).