CSOS certificates and electronic controlled-substance orders

DEA’s Controlled Substance Ordering System (CSOS) lets eligible registrants send controlled-substance orders electronically. Each signer uses an individual DEA-issued digital certificate in approved ordering software; it is not a shared pharmacy password or a scanned paper form.

CSOS in one minute

CSOS is DEA’s secure system for electronic controlled-substance orders. It can be used for Schedule I through V orders, and the electronic Form 222 replaces the paper Form 222 requirement for eligible Schedule I and II orders. A pharmacy can continue using paper Form 222 for Schedule I and II orders if it does not use CSOS. The important distinction is that CSOS is a controlled ordering channel with identity checks and a digital signature, not an ordinary wholesaler cart checkout. The DEA certificate identifies an individual subscriber and ties the order to the registrant and controlled substances the registrant is authorized to handle.

Individual certificates and permitted roles

A CSOS signing certificate is issued to a person, not to a pharmacy location or an entire staff team. Registrants, power-of-attorney holders, and other approved roles may have different permissions. A certificate must not be used by someone other than the individual to whom it was issued. This is why staff should not email certificate files, share their credentials, or sign orders on behalf of a colleague. Access should be removed promptly when an employee leaves, a role changes, or authority is revoked. The pharmacy should know who holds each certificate and have a process to renew, revoke, or replace one.

How an electronic order moves

The purchaser creates an electronic 222 order in CSOS-enabled software, selects products and quantities, and digitally signs it with the subscriber’s certificate. The order is transmitted to the supplier. The supplier validates the certificate and order information, then accepts, rejects, or fulfills it. The supplier reports the transaction to DEA as required. The electronic process leaves an audit trail of the order, signature, transmission, acceptance, and any changes or communications. When product arrives, the pharmacy still performs its ordinary receiving reconciliation; successful electronic transmission is not proof that the physical shipment is correct.

Controls before submission

Before signing, compare the purchaser registration and registered location, supplier, drug schedule, item, strength, dosage form, package, and quantity with the intended order. Check that the signer has authority and that the certificate is active. A secure workflow should separate order preparation from approval where appropriate, restrict who can use certificates, and review unusually large or unusual orders. If a user sees an unexpected order, certificate prompt, or supplier change, do not approve reflexively. Pause and contact the responsible pharmacist or compliance lead through a known channel.

Rejected or incomplete orders

DEA regulations identify conditions where an electronic order may not be filled, including missing required data, an invalid or improperly applied digital certificate, or other defects specified by rule. The supplier may also refuse an order. Read the rejection reason and preserve the original electronic order and response. Do not modify the old transaction to conceal a mistake. Correct the source data under the approved process and create a replacement order when needed. If a supplier says the order was accepted but the shipment differs, use the physical receiving and discrepancy procedures; electronic records do not replace inventory controls.

Records, outages, and continuity

DEA rules require electronic order records to be retained and retrievable for inspection. The facility should ensure the order and any nonacceptance statement, cancellation, or related document can be retrieved as required without reconstructing it from scattered email. Have an outage plan: determine whether ordering pauses or the pharmacy is authorized to use paper Form 222 for Schedule I and II orders, protect blank paper forms, and reconcile any paper order entered after service returns. Do not create duplicate paper and electronic orders for the same supply just because the electronic screen is slow.

Security habits for technicians

Use a named account, a unique password, approved workstation, and the pharmacy’s multi-person review if required. Lock the screen when stepping away. Report a lost device, certificate compromise, suspicious login, or order that you did not create immediately. Never send a certificate by ordinary email or store it in an unapproved shared folder. A digital signature has accountability consequences: treat it like authority to execute a regulated order. A technician’s job is to protect the workflow, check the visible data, and escalate a mismatch—not to make a legal judgment outside the role.

Exam memory points

Remember: individual DEA-issued certificate, electronic signature, approved CSOS software, supplier validation, records retention, and no certificate sharing. Paper Form 222 remains available as the alternative for Schedule I and II orders, subject to DEA rules. CSOS can also order Schedule III through V substances without the same paper 222 requirement. Facility policy and state law may add controls, and only authorized personnel should operate the system.

DEA’s certificate process includes enrollment, activation, renewal, and revocation. A certificate that belongs to a former employee, is lost with a device, or may have been copied should be treated as a security incident. Notify the registrant or CSOS coordinator immediately and follow DEA’s revocation and replacement instructions. The pharmacy should keep an up-to-date roster showing the subscriber, registration, role, expiration or renewal status, and the process for revocation. A backup certificate should never be a generic shared account; each authorized person remains individually accountable.

A safe fallback decision

During an outage, first determine whether the order was already submitted or accepted; this prevents duplicate ordering. If the system is unavailable, follow the facility’s continuity plan and applicable DEA rules for using a paper Form 222 for Schedule I and II substances. A verbal instruction to “just place it later” is not an order record. Secure the paper form, obtain an authorized signature, and reconcile the order when the system returns. Document which channel was used and confirm that the supplier did not process both versions.

Study summary

• Confirm the exact product, instructions, units, and applicable rules before acting.
• Use the written procedure and escalate unclear, unusual, or safety-sensitive cases to the pharmacist.