What controlled-substance software works for a surgery center with no hospital pharmacy, no dispensing cabinet and no pharmacist?

Software that can hold the whole record by itself. A center in that position has no pharmacy information system carrying the count, no automated dispensing cabinet logging each withdrawal, and no staff pharmacist reconciling at the end of the week. So the software has to be the record: delivery into inventory, checkout for a case, administration, witnessed waste with a witnessed co-signature, an unopened container returned to stock where your policy allows it, and reconciliation against a perpetual inventory your own staff physically count. It has to produce those records on request at your registered location, in a form you can hand to an inspector or a surveyor, without asking you to connect a system you do not have.

The federal records it has to support are the same for every center that holds a DEA registration: inventories (21 CFR 1304.11), a continuing record of each controlled substance received and otherwise disposed of (21 CFR 1304.21(a)), and an administration record carrying the name or initials of the individual who dispensed or administered each dose (21 CFR 1304.22(c)), all kept for at least two years (21 CFR 1304.04(a)).

Which drugs does the record cover, and where does it stop?

The controlled substances your center stocks and administers for sedation, anesthesia and recovery: Schedule II drugs, and the Schedule III to V drugs kept with them. The record runs from the point a delivery arrives and is added to inventory, through the waste at the end of a case, to the count at the end of the day.

Four boundaries are worth settling with any vendor before anything else, because they decide whether a product is even the right category for you:

• Ordering. Schedule II drugs come in on a DEA Form 222 or its electronic equivalent, one for each order (21 CFR 1305.03). Schedule III to V drugs arrive on ordinary invoice records. If you order Schedule II drugs electronically through the Controlled Substance Ordering System (CSOS), you need a separate certificate for each registered location you order them for (21 CFR 1311.35). Executed Form 222s are kept separately from all other records and available for inspection for two years (21 CFR 1305.17(c)). Ask whether the product records any of this or starts at delivery.
• Prescribing. Prescription drug monitoring is a different body of rules. A record of the stock your center administers is not a prescription monitoring program.
• The physical work. The counting, the drawing, the waste and the co-signing happen in your center, done by the people who do them today. Software records the workflow; it does not perform it.
• DEA forms. Form 222, Form 41 and Form 106 are the registrant's to complete, and to send or keep as each form's own rule requires.

Do Schedule II records have to be kept apart from the rest?

Yes. Inventories and records of Schedule I and II controlled substances must be kept separately from all other records of the registrant. Schedule III to V records may be kept separately or in a form that makes the required information readily retrievable from ordinary business records (21 CFR 1304.04(f)). The same rule reaches individual and institutional practitioners through 21 CFR 1304.04(g). "Readily retrievable" is defined at 21 CFR 1300.01.

So every drug in your safe can belong in the same system once it is in the safe, with the Schedule II records kept separately. A binder that interleaves every schedule by date satisfies neither half of the rule. When you look at any product, ask how it keeps the Schedule II records separable, and ask to see them produced on their own.

Why does a system built around a dispensing cabinet not fit a two-OR center?

Because of what it expects to be connected to. Analytics designed for a hospital read their data out of the systems a hospital runs: the cabinet that logs every withdrawal, the pharmacy information system that holds the orders, the wholesaler feed that holds the purchases, the electronic health record (EHR) that holds the administrations, and a person whose job is working the alert queue.

Your center has a locked safe or cabinet, a bound log, a count at the end of the day, and a nurse manager who may also be the infection preventionist and the person who signs for the delivery. Often there is no system to connect to, because the record starts with your own staff. Ask any vendor whether the product needs these before it works:

• an interface to an automated dispensing cabinet
• a feed from a pharmacy information system
• a wholesaler or distributor purchase feed
• a medication administration feed from an EHR
• a named person to triage alerts as part of their job
• an implementation window measured in quarters

None of that is a criticism of anyone's product. It is architecture. A system built to sit on top of that stack works when the stack is there.

What does the record itself have to hold?

Two quantities, in one place: what left your stock, and what was accounted for afterward. A count is arithmetic, and arithmetic needs both numbers. In most centers the two live in different records. The anesthesia record is organized by patient and sits in the chart; the stock side is organized by drug and sits in a binder. The reconciliation belongs to the center, so the center's own record has to hold both halves. Surveyor guidance says the same thing more bluntly. The interpretive guidelines for the pharmaceutical services condition (State Operations Manual, Appendix L, tag Q-0181) expect the ASC's record system to trace scheduled drugs from the point of entry to the point of departure, to reconcile any discrepancy in the count promptly, and to be capable of readily identifying loss or diversion with as little time as possible between the loss and its detection. That is a question about your system, and it is answered by how fast your record can close.

One step decides more than it seems to: the checkout. A drug signed out for a case that is then cancelled, or never given, is the easiest thing to lose between two pieces of paper. If a workflow goes from delivery to administration to waste with no checkout of its own, nothing shows that the vial left the safe, and the gap appears only at the count, with no case attached to it.

A second detail: how the record takes a correction. Staff correct entries at the point of care every day. A correction recorded as a new time-stamped entry leaves the original visible. An edit that overwrites the original leaves no trace of what it said. On paper, the same rule is a single line through the error, initialed and dated.

Does per-provider monitoring make sense for a center your size?

The recordkeeping does at any size, from a single operating room up. Monitoring is a layer on top of the record, and when it works by comparing providers, it needs more than one provider doing the same kind of work. Ask any vendor how many providers its comparison needs, whether the comparison is to peers or to a provider's own history, and, if you have more than one location, whether the peer group can include providers at the others.

Ask too what each alert is triggered by and on what schedule, alert type by alert type. A count discrepancy and a pattern across providers are different signals and may run on different clocks. Anyone who answers both with the same word, usually real time, has not answered. An alert, from any system, is a prompt for a person to look closer. It is not a finding about anyone.

What should you ask any controlled-substance software vendor?

Questions travel better than a scorecard. These are the ones that separate products built for a center like yours from products that assume a hospital behind you. Ask every vendor the same ones.

1. Where does coverage start and stop? At the order, or at delivery into inventory? Ask for the boundary in writing.
2. What has to be connected first? A dispensing cabinet, a pharmacy system, an EHR, a wholesaler feed? What happens if none of them exist?
3. Who enters the data on a normal day? If the answer depends on a group you do not employ adopting new software, ask what happens on the day they do not.
4. What triggers each alert, and on what schedule? Ask for each alert type separately.
5. How many providers does the comparison need, and does the peer group cross locations?
6. How is a wrong entry corrected? Edited in place, or recorded as a new time-stamped entry that leaves the original intact?
7. Is the checkout for a case its own step? Ask to see a cancelled case in a demo.
8. How are Schedule II records kept separate? Ask to see them produced on their own.
9. What comes out at the end? Ask for a report for a date range you pick, on your own workflow, and decide whether you would hand it to an inspector.
10. Can you take everything with you if you leave, and in what format?
11. Does the vendor file anything with DEA for you? If the answer is yes, ask which form and under whose registration.
12. What does the vendor claim about compliance and diversion? A product that promises compliance, or promises to detect or prevent diversion, is claiming more than software can.
13. How does it handle a handoff? Ask to see a break relief, where one person signs a drug out and another gives or wastes it.

If the records live in software, can you still produce them at the registered location?

Yes. Federal rules allow records to be kept on an in-house computer system without notifying the Special Agent in Charge or getting central-recordkeeping approval (21 CFR 1304.04(c)). Records must be available for inspection and copying for at least two years (21 CFR 1304.04(a)). Each inventory is kept in written, typewritten or printed form at the registered location, with a separate inventory for each registered location (21 CFR 1304.11(a)). Electronic copies of executed Form 222s count as kept separately if they are readily retrievable separately from all other records, and they may be stored elsewhere if they are readily retrievable at the registered location (21 CFR 1305.17(e)).

So the thing to test is production, not hosting. No vendor's hosting is pre-approved by anyone. What you should be able to do is pull the records for a drug and a date range at your registered location and hand over a clean copy.

This article describes federal requirements in general terms. It is general information, not legal advice. Countra and Autonomous Healthcare, Inc. are not affiliated with, endorsed by, or acting on behalf of the Drug Enforcement Administration, the Centers for Medicare and Medicaid Services, any state board of pharmacy, or any accrediting organization. Confirm every requirement with your own counsel and your state board of pharmacy before you rely on it. Reviewed and current as of October 21, 2026.

Countra does not make a facility DEA compliant, does not file DEA forms, and does not prevent or guarantee the detection of diversion. Compliance and reporting remain the registrant’s responsibility.