CSOS (Controlled Substances Ordering System) Q&A

Answer: The DEA Controlled Substance Ordering System (CSOS) allows for secure electronic transmission of controlled substance orders without the supporting paper DEA Order Form 222. Any registrant permitted to order schedule II controlled substances may do so electronically via CSOS. The use of electronic orders is optional; registrants may continue to issue orders on a paper DEA Order Form 222 if they prefer.

The adoption of the CSOS standards is the only allowance for the electronic transmission of schedule II controlled substance orders between controlled substance manufacturers, distributors, pharmacies, and other DEA authorized entities. CSOS uses Public Key Infrastructure (PKI) technology, which requires CSOS users to obtain a CSOS digital certificate for electronic ordering. The electronic orders must be signed using a digital signature issued by the Certification Authority (CA) run by DEA. 21 CFR 1305.21(a). Digital certificates can only be obtained by the person who signed the most recent DEA registration or renewal application, a person authorized to sign a registration application, or a person granted power of attorney by a DEA registrant to sign orders. 21 CFR 1311.10(a) & (b). A registrant must appoint a CSOS coordinator who will serve as that registrant's recognized agent regarding issues pertaining to issuance of, revocation of, and changes to, digital certificates issued under that registrant's DEA registration 21 CFR 1311.20(a). A CSOS digital certificate will be valid until the DEA registration under which it is issued expires or until the CSOS CA is notified that the certificate should be revoked 21 CFR 1311.30(e), 1311.40(a). Certificates will be revoked if the certificate holder is no longer authorized to sign schedule II orders for the registrant, if the information on which the certificate is based changes, or if the digital certificate used to sign electronic orders has been compromised, stolen, or lost 21 CFR 1311.30(e), 1311.40(a).

A "Questions and Answers" page about the CSOS certificate is available on the DEA E-Commerce Program website at www.DEAecom.gov. Applicants can download the Diversion PKI CSOS Enrollment document and the CSOS Subscriber's Manual for assistance on the enrollment process. DEA also maintains a support line to assist applicants and subscribers with issues pertaining to certificate enrollment, issuance, revocation, and renewal. Staff is available from 8:00 a.m. to 5:50 p.m. Eastern Time, Monday through Friday at 1-877-332-3266 if further assistance is needed. EO-DEA198, October 5, 2020

Answer: Yes. Under 21 CFR 1305.25(a), an electronic order for controlled substances may not be filled if any of the following occur:

  1. The required data fields have not been completed;
  2. The order is not signed using a digital certificate issued by DEA;
  3. The digital certificate used has expired or been revoked prior to signature;
  4. The purchaser’s public key will not validate the digital certificate; or
  5. The validation of the order shows that the order is invalid for any reason.

If an order cannot be filled, the supplier must notify the purchaser and provide a statement as to the reason (e.g., improperly prepared or altered). A supplier may, for any reason, refuse to accept any order. If a supplier refuses, a statement that the order is not accepted is sufficient. 21 CFR 1305.25(b).

When a purchaser receives an unaccepted electronic order from a supplier, the purchaser must electronically link the statement of non-acceptance to the original order. The original statement and all linked records for that order must be retained for two years. 21 CFR 1305.25(c), 1305.27(a). Neither a purchaser nor a supplier may correct a defective order. The purchaser must issue a new order for the order to be filled. 21 CFR 1305.25(d). A supplier may void all (or part) of an electronic order by notifying the purchaser of the voiding. If the entire order is voided, the supplier must make an electronic copy of the order and indicate "void" on the copy and return it to the purchaser. The supplier is not required to retain a record of orders that are not filled. 21 CFR 1305.28(a). The purchaser must retain an electronic copy of the voided order. 21 CFR 1305.28(b). Should a supplier partially void an order, the supplier must indicate in the linked record that nothing was shipped for each item voided. 21 CFR 1305.28(c). EO-DEA184, October 5, 2020

 

Disclaimer: Guidance documents, like this document, are not binding and lack the force and effect of law, unless expressly authorized by statute or expressly incorporated into a contract, grant, or cooperative agreement. Consistent with Executive Order 13891 and the Office of Management and Budget implementing memoranda, the Department will not cite, use, or rely on any guidance document that is not accessible through the Department's guidance portal, or similar guidance portals for other Executive Branch departments and agencies, except to establish historical facts. To the extent any guidance document sets out voluntary standards (e.g., recommended practices), compliance with those standards is voluntary, and noncompliance will not result in enforcement action. Guidance documents may be rescinded or modified in the Department's complete discretion, consistent with applicable laws.