DEA Form 222 vs. CSOS for Controlled Substance Orders

DEA registrants use Form 222 or its electronic equivalent, CSOS, to order Schedule I and II controlled substances. Paper Form 222 remains an allowed method; CSOS is DEA’s secure electronic ordering system and requires an individual digital certificate tied to a registration. Order records are controlled records and must be handled under DEA and pharmacy procedures.

Why these orders use a special process

Schedule I and II controlled substances have additional ordering controls. A registered purchaser generally places orders with a supplier using a DEA Form 222 or the electronic equivalent authorized by DEA. These are procurement records, distinct from patient prescriptions and dispensing records. They help document the chain of controlled substances from supplier to registrant.

Paper DEA Form 222

A paper Form 222 is an official order form used by authorized registrants. The purchaser completes the form according to DEA requirements and sends it to the supplier; the purchaser retains the required copy or record. Each order must use the correct form and authorized signatory. Unused forms require secure handling, and if a registration ends or is suspended or revoked, DEA rules may require returning unused forms. Follow the DEA manual and facility SOP for errors, voids, and retention.

What CSOS does

The Controlled Substance Ordering System allows secure electronic controlled substance orders without a supporting paper Form 222. DEA states that CSOS is the only method for electronic ordering of Schedule I and II controlled substances, though paper orders remain allowed. CSOS orders use public-key infrastructure and a digital signature to authenticate the subscriber and support nonrepudiation. CSOS may also be used for Schedule III–V orders.

The certificate belongs to a person

A CSOS certificate is a digital identity issued to an individual, not a shared pharmacy login. DEA says certificates must not be used by anyone other than the person to whom they are issued. An approved registrant or person with the appropriate power of attorney may obtain a certificate. The registration and signer’s authority must align. Sharing a certificate or leaving it accessible undermines the control the electronic signature is meant to provide.

Order responsibilities and receiving

Only the registrant or an authorized person may place the order. Receiving staff compare what arrives with the order and invoice, follow the pharmacy’s count and documentation procedure, and report shortages, damage, or discrepancies promptly. A technician should not place an order using another employee’s credentials or silently adjust a discrepancy in the system. The pharmacist or responsible registrant handles escalation according to policy.

Record retention and access

DEA requires controlled substance records to be complete, accurate, and maintained for the applicable period. The DEA Pharmacist’s Manual identifies executed Form 222s or electronic equivalents and related powers of attorney among required records. Schedule II records have separate filing requirements from ordinary records. Keep electronic CSOS records retrievable and protected, and follow state law and company retention policies if they impose additional obligations.

A practical example

A wholesaler order for a Schedule II medication is awaiting approval. A technician may prepare order data if assigned, but the authorized registrant or person with valid authority must complete the required signature step. If a CSOS certificate is expired, inaccessible, or assigned to a former employee, staff must use an approved paper Form 222 process or restore authorized access; they should not borrow another subscriber’s credential.

Common mistakes

Do not treat CSOS as ordinary online ordering without controlled-substance controls. Do not assume an email confirmation substitutes for Form 222 or an authenticated CSOS order. Do not share digital certificates. Do not file Schedule II order records among ordinary invoices if separate filing is required. And do not confuse ordering controls with the rules for dispensing a controlled prescription to a patient.

PTCE takeaway

Form 222 is the paper order process; CSOS is the secure electronic equivalent for controlled-substance orders. Certificates are individual, authority-specific credentials. Follow DEA rules, retain accurate records, and escalate discrepancies.

Operational checks that prevent mix-ups

An order discrepancy should be handled while the facts are fresh. Compare the wholesaler confirmation, received quantity, package size, and the retained order record. Record the actual receipt and contact the supplier and responsible registrant if any line item is missing, substituted, damaged, or inconsistent. Do not edit a completed Form 222 to make it agree with what arrived, and do not assume that a backordered item has been canceled unless the supplier confirms it. The pharmacy should also control account access: remove a former employee’s purchasing authority, revoke or update credentials when roles change, and keep signing certificates protected. If a paper form is lost, stolen, or materially damaged, use the current DEA reporting and facility procedures. These records are subject to inspection, so an orderly audit trail saves time and helps detect diversion early.

Scope and handoff details

This topic is about ordering from an authorized supplier, not controlled-substance dispensing to a patient. A Form 222 or CSOS order is tied to the registrant and controlled substance schedules on that registration. It is not a general purchase order that any branch can reuse. Keep the purchaser’s registration information current and ensure the right location and schedules are represented. A staff member with purchasing responsibilities should know how to report a missing form, suspected credential misuse, or an unexplained order confirmation. The pharmacist-in-charge or registrant is responsible for ensuring the pharmacy’s process meets federal and state requirements. If a question describes a person using another employee’s certificate, the safe answer is to stop the order and restore properly authorized access.

Points to carry into practice

• Check the current FDA or DEA source and the pharmacy SOP for the exact requirement.
• Hold and escalate an unresolved discrepancy instead of guessing or bypassing a control.