What is DEA Form 222 and when does a clinic need one?

DEA Form 222 is the official order form a DEA registrant uses to obtain Schedule I and Schedule II controlled substances. Schedule I substances are research materials with no accepted medical use, so for a clinic this form is in practice about Schedule II. If your clinic buys Schedule II drugs, for example fentanyl or hydromorphone for procedural sedation, each order is documented either on a Form 222 or through its electronic equivalent, the Controlled Substance Ordering System, known as CSOS (21 CFR 1305.03). Schedule III through V orders do not use Form 222. Those are documented with the supplier’s invoices and packing documents, which you still have to retain and be able to retrieve.

One thing to clear up first, because it still causes confusion: the old carbon triplicate Form 222 is gone. DEA moved to a single-sheet format in 2019, the transition period for using up triplicate stock closed in 2021, and in a technical amendment effective March 20, 2026 DEA removed and reserved the obsolete transition provision at 21 CFR 1305.20. If you have triplicate forms in a drawer, they are not usable.

Which orders does Form 222 actually cover?

Ordering, and only ordering, and only for the stock you hold on site. Form 222 has nothing to do with the prescriptions your providers write, which carry their own obligations, including reporting to your state prescription drug monitoring program. This piece is about the fentanyl, midazolam, ketamine and similar agents that arrive at your clinic in a box, go into a locked cabinet, and get administered in your procedure rooms. Of those, only the Schedule II agents like fentanyl come in on a Form 222. Midazolam is Schedule IV and ketamine is Schedule III, so they arrive on ordinary invoice records, though all of them belong in the same system once they are in the safe, with the Schedule II records kept separately. Everything below is either about getting that stock in the door correctly, or about the record that starts the moment it arrives.

How do you fill out a DEA Form 222?

Carefully, legibly, and in one sitting, because a supplier may not fill a form that is not complete, legible and properly prepared, and a defective form may not be corrected (21 CFR 1305.15). The single-sheet form DEA adopted in 2019 carries twenty numbered order lines, double the old triplicate form.

1. Start from a form DEA issued to your registration. Forms are requested from DEA and arrive pre-printed with your name, address, registration number, authorized activity and schedules. You cannot fix that pre-printed information yourself; an error goes back to DEA (21 CFR 1305.11).
2. Enter one supplier. Name and address, and only one supplier per form. The supplier’s DEA registration number may be entered by either of you (21 CFR 1305.12(c)).
3. Fill the order lines. Only one item may be entered on each numbered line, and an item is one or more containers of the same substance in the same form and quantity (21 CFR 1305.12(b)).
4. Note the number of lines completed in the space at the bottom, so the form states its own count (21 CFR 1305.12(b)).
5. Sign and date it. The signer is the registrant, a partner, or an officer, or an individual holding a power of attorney for this purpose, and if the purchaser differs from the person signing, the purchaser’s name goes in the signature space too (21 CFR 1305.12(d)).
6. Keep a copy and send the original to the supplier. Your retained copy may be paper or electronic (21 CFR 1305.13(a)).
7. Finish your copy when the drugs arrive. Record on it the number of containers furnished for each item and the dates you received them (21 CFR 1305.13(e)). The form is not finished until this is done.

A practical note: if a form is spoiled part way through, do not improvise a fix on the page. Treat it as consumed, retain it with your order form records, and start a clean one. And an unglamorous detail worth knowing if you run satellites. Unexecuted forms may be kept and executed somewhere other than the registered location printed on them, provided every unexecuted form is delivered promptly to the registered location if an inspector shows up (21 CFR 1305.12(e)). In practice that means the stack of blanks in a drawer at your second office is fine, and it is also something you have to be able to produce on a morning nobody planned for.

Who is allowed to sign a DEA Form 222?

The registrant, or an individual the registrant has granted a power of attorney for this purpose. Clinics commonly grant one to whoever actually places orders, so ordering does not stop when a person is out. The power of attorney is signed by the registrant, partner or officer, by the person receiving it, and by two witnesses, and it is retained in your files with the executed forms and available for inspection with your other order records (21 CFR 1305.05).

DEA tightened this language in the technical amendment effective March 20, 2026, which amended 21 CFR 1305.05 to state who may execute or revoke a power of attorney: a registrant, a partner of the registrant, or an officer of a registrant corporate entity. If your practice granted powers of attorney years ago and the person who signed those documents no longer fits that description, that is worth reviewing before your next order rather than at your next inspection.

Revoke in writing when someone leaves, and keep the revocation with the records. A live power of attorney belonging to a departed employee is a small piece of paper with a large amount of authority attached, and nobody goes looking for it until the day it matters.

How long is a DEA Form 222 valid?

Sixty days from the date the purchaser signs it. No Form 222 is valid more than 60 days after its execution by the purchaser, with a narrow exception for certain Defense Logistics Agency orders (21 CFR 1305.13(b)). That is the practical argument for signing a form when you are ready to send it rather than pre-signing a stack for convenience.

What if a form is spoiled, refused, lost, or stolen?

Each of these has its own procedure.

• Spoiled or defective. A form that is incomplete, illegible, improperly prepared, or shows any alteration, erasure or change must not be filled. If the supplier cannot fill it, they return the original with a statement of the reason, and you retain the original and the statement with your order records. A defective form may not be corrected; it is replaced with a new one (21 CFR 1305.15).
• Lost in transit. Execute a replacement form and attach a statement giving the order number and date of the lost form and confirming the substances were not received. Keep copies of both forms and the statement, and send a copy of the statement to the supplier with the replacement (21 CFR 1305.16).
• Stolen, or lost rather than mislaid. Report it to the Special Agent in Charge of your DEA field division, with the serial numbers if you have them or the approximate date of issuance if you do not, and notify DEA if the forms turn up later (21 CFR 1305.16).

The one that trips clinics up is the middle case, because it does not feel like an incident. A form goes out, weeks pass, nothing arrives, and everyone assumes the supplier is slow. The procedure exists for exactly that week, and it is much easier to run while somebody still remembers which order it was.

What happens to the form after the order is placed?

It becomes a record you have to keep and be able to produce. Your copies of executed forms are kept for two years, maintained separately from your other records, and available for inspection at the registered location printed on the form. Electronic copies count as maintained separately if they are readily retrievable separately, and they may sit somewhere other than the registered location provided they are readily retrievable there (21 CFR 1305.17). That last clause is worth knowing before anyone tells you an electronic record cannot satisfy the rule. The test is retrievability at your registered location, not where the hardware lives.

Two things sit on top of the federal rule. Your state board and your accrediting body may set their own expectations for how ordering and inventory records are kept, and satisfying DEA does not satisfy them. And in the states that license pain management clinics as a distinct category, including Florida, Kentucky, Louisiana, Mississippi, Ohio, Tennessee, Texas and West Virginia, the statutes typically name the owner and the designated medical director personally, so producing records on request can be a question about an individual license rather than only about the facility.

The moment that decides how the rest of this goes is the one right after the boxes arrive. The delivery lands mid-morning on a full procedure day, somebody at the front signs for it, and the cartons sit on a counter until a person with a key is free. The form tells you what you ordered. Your own record has to say what actually came in, when, and who put it in the safe. If those two ever disagree, that is the beginning of a discrepancy, and it is far easier to resolve on the day than three weeks later.

DEA Form 222 vs CSOS: which should a clinic use?

CSOS is the electronic version of the same obligation, and it makes sense for a clinic that orders Schedule II often enough that paper handling and mailing time have become a real cost. Form 222 makes sense for a clinic that orders rarely and does not want to maintain a certificate. Neither is more compliant than the other. They are two permitted ways to document the same order.

The thing to understand before choosing is where CSOS certificates come from. You enroll through DEA’s own system at https://www.deaecom.gov, complete identity proofing, list the registrations you are authorized to sign for, and upload any powers of attorney. DEA’s Certification Authority verifies you and issues the signed certificate (21 CFR 1311.25). No software vendor issues one, and none can obtain one for you.

• The certificate belongs to an individual signer, not to the practice as an abstraction. Only the certificate holder may access or use it, backup copies of the private key are not permitted, and a compromised key has to be reported to the Certification Authority within 24 hours (21 CFR 1311.30). It needs the same departure procedure your powers of attorney need. A purchaser also needs a separate certificate for each registered location it orders for (21 CFR 1311.35).
• It expires when the DEA registration it is based on expires, and the Certification Authority notifies the holder 45 days in advance (21 CFR 1311.40).
• If the information the certificate is based on changes, including the registered name or address or the authorized schedules, the holder generates a new key pair and obtains a new certificate (21 CFR 1311.40).

The honest summary for a small multi-provider clinic: CSOS removes paper handling and mailing time from the ordering step, and it adds a certificate you have to obtain, maintain, renew, and retire when someone leaves. If one person places nearly all of your Schedule II orders and the volume is steady, that trade usually favors CSOS. If ordering is occasional and spread across people, paper is often the simpler life.

What does your log have to cover that the order form does not?

Everything after the delivery, which is the part clinics underestimate. Whether you order on paper or through CSOS, the ordering record covers exactly one event, the purchase. The rest is a separate record, and it is the one that gets examined hardest.

1. Delivery into inventory, logged when the stock arrives rather than at the end of the week.
2. Checkout for a case, signed out of stock for a specific case.
3. Administration, documented against that case.
4. Witnessed waste of any remainder, with a witnessed co-signature.
5. Reconciliation of the perpetual inventory against a physical count.

One step in that chain is a policy decision rather than a rule, and it is the one most often left out: what happens to a quantity that is checked out and never given, when a case is cancelled or a vial is only partly used. Some clinics return it to stock and record the return. Others waste everything that leaves the safe. Both are defensible. What is not defensible is a record where the quantity checked out does not equal what was administered plus what was wasted plus what came back.

Countra is a controlled-substance documentation and per-provider diversion-monitoring software for multi-provider clinics and surgery centers that handle controlled substances in-house, with no hospital pharmacy and no dispensing cabinet. It picks the record up at delivery into inventory and carries it through witnessed waste and reconciliation, and it exports clean PDF reports on demand. It does not order anything, it does not file DEA forms, and it cannot issue or hold a CSOS certificate for you. Pain clinics are the lead example, and the same shape fits other procedural practices without a hospital pharmacy.

The documentation half of that applies at any size, from a single proceduralist up. The per-provider comparison is different: it works by comparison, so it earns its place once more than one provider is drawing from the same supply, and it says much less in a solo practice, where there is no internal baseline. If you want to see how the record looks once the boxes are in the safe, the workflow section for multi-provider pain clinics is at https://www.countra.ai/pain-clinics

This guide is general information about federal controlled-substance ordering rules. It is not legal advice, and it is not affiliated with or endorsed by the Drug Enforcement Administration. Requirements change, and state boards and accreditation bodies impose their own on top of the federal rules. Confirm what applies to your practice with your counsel, your state board and the current text of the regulations. Reviewed and current as of September 22, 2026.

Countra does not make a facility DEA compliant, does not file DEA forms, and does not prevent or guarantee the detection of diversion. Compliance and reporting remain the registrant’s responsibility.