A DEA Power of Attorney is a written delegation, governed by 21 CFR 1305.05, that lets a DEA registrant authorize another person to order Schedule I and II controlled substances on the registrant’s behalf.1eCFR. 21 CFR 1305.05 – Power of Attorney The registrant keeps full legal responsibility for every order the delegate places, which is why the drafting, record-keeping, and revocation steps below all matter.
What the Authority Actually Covers
The delegation is narrow. It authorizes one activity: ordering Schedule I and II controlled substances, either by signing a paper DEA Form 222 or by issuing electronic orders through the Controlled Substance Ordering System (CSOS).1eCFR. 21 CFR 1305.05 – Power of Attorney It does not let the delegate prescribe, dispense, or administer controlled substances. Those need their own DEA registration or separate state authority.
A registrant can appoint more than one delegate, and a delegate does not have to sit at the registrant’s registered address. Each delegate gets a separate POA document. Whatever the delegate does under that authority lands on the registrant’s registration.
Drafting and Signing the Document
Section 1305.05 gives a sample POA that covers everything the document needs. You don’t have to copy it word for word, but staying close to the template is the safest way to keep a DEA inspector from flagging your paperwork.1eCFR. 21 CFR 1305.05 – Power of Attorney The document should identify the registrant (name, address, DEA number), name the delegate (the attorney-in-fact), state clearly that the delegate is authorized to sign Form 222s and issue electronic orders for Schedule I and II substances, and show the date and place of signing.
Three sets of signatures are required. The POA must be signed by whoever is authorized to sign the registrant’s DEA application — an individual practitioner for themselves, a partner for a partnership, an officer for a corporation. The delegate then signs to accept the responsibility. Two witnesses sign last. The regulation doesn’t say who the witnesses have to be, but they should be people who actually watched the signing.1eCFR. 21 CFR 1305.05 – Power of Attorney
Notarization is not required. Two witnesses are enough. This trips people up because most powers of attorney they’ve encountered carry a notary stamp, but a DEA POA runs under 21 CFR 1305, not state POA law.
Placing Paper Orders on Form 222
The delegate signs the DEA Form 222 in the purchaser’s signature space. That signature ties the order back to the registrant through the POA on file. A Form 222 is valid for 60 days from the date the purchaser signs it, and any partial shipments have to finish within that same window.2eCFR. 21 CFR 1305.13 – Procedure for Filling DEA Forms 222 The purchaser keeps a copy of each form and writes in the number of containers received and the receipt date.
Placing Electronic Orders Through CSOS
Electronic ordering adds a step. The delegate needs a CSOS digital certificate, which works as an electronic signature confirming their authority to order under the registrant’s number.3eCFR. 21 CFR 1311.25 – Requirements for Obtaining a CSOS Digital Certificate The registrant enrolls in CSOS first; only then can a delegate apply. When applying, the delegate submits a photocopy of their executed POA letter.4Drug Enforcement Administration. DEA Controlled Substance Ordering System – FAQs Processing runs roughly a month, so build that lead time into onboarding.
Most organizations designate a CSOS Coordinator to sit between the registrant and the DEA certification system. The Coordinator verifies each POA applicant’s identity, confirms the POA is valid, and manages certificate renewals and revocations.5Office of Diversion Control. Registrant Agreement The Coordinator role by itself does not carry ordering authority; ordering authority still comes from the POA the delegate holds.
Records You Have to Keep
Keep the original POA in the registrant’s files alongside executed order forms. Form 222 records must be preserved for at least two years and stay available for DEA inspection.6eCFR. 21 CFR 1305.17 – Preservation of DEA Forms 222 Electronic order records carry the same two-year retention.7eCFR. 21 CFR 1305.27 – Preservation of Electronic Orders The POA itself has to stay on file at least as long as any order the delegate signed, meaning it should remain for two years after the delegate’s last order.1eCFR. 21 CFR 1305.05 – Power of Attorney
A registrant who grants CSOS certificates through a POA must also keep a separate list of every person given that authority.8eCFR. 21 CFR 1311.45 – Requirements for Registrants That Allow Powers of Attorney to Obtain CSOS Digital Certificates Under Their DEA Registration Inspectors expect all of this to be at hand, not in an offsite archive.
Revoking the Power of Attorney
When a delegate leaves, changes roles, or you want to pull ordering back in-house, revoke the POA in writing. Section 1305.05 gives a template notice of revocation, and the execution mirrors the original: the signature of the person who signed the registrant’s most recent DEA registration or reregistration application, plus two witnesses.1eCFR. 21 CFR 1305.05 – Power of Attorney The notice must also state that the delegate was informed of the revocation that same day. That same-day notice is designed to close any window in which a former delegate could still place orders.
File the signed revocation with the original POA and the related order records. If the DEA inspects later, you need to show both that the delegate was authorized while ordering and that their authority was properly ended afterward.
The Six-Hour CSOS Rule
If the delegate held a CSOS digital certificate, there’s a tight extra deadline. The registrant must report to the DEA Certification Authority within six hours of the delegate leaving employment or losing their privileges.8eCFR. 21 CFR 1311.45 – Requirements for Registrants That Allow Powers of Attorney to Obtain CSOS Digital Certificates Under Their DEA Registration Six hours is fast. Your Coordinator needs to be ready to act the same day. Advance notice is allowed when you already know a departure is coming.
When the Underlying Registration Ends
A POA is only as valid as the DEA registration it sits under. Orders can only be placed for a registrant whose registration hasn’t expired, been revoked, or been suspended. If the registration lapses, every delegate’s authority stops automatically, and CSOS digital certificates, which are tied to the registration expiration date, expire with it.9DEA Diversion Control Division. 21 CFR CSOS Final Rule After a renewal, the delegate has to get a new CSOS certificate based on the updated registration.
If the registration terminates, the registrant must also return any unused DEA Form 222s to the nearest DEA office so leftover forms tied to a dead registration can’t be misused.
Penalties for Getting It Wrong
Ordering Schedule I or II substances without proper authorization is a federal crime. Under 21 U.S.C. 843, fraudulent or unauthorized use of order forms carries up to four years in prison and fines, and a second or subsequent conviction doubles the maximum to eight years.10Office of the Law Revision Counsel. 21 USC 843 – Prohibited Acts C
The administrative risk is often the bigger practical problem. The DEA can suspend or revoke a registration when it finds actions inconsistent with public safety, and record-keeping failures, missing POA documentation, and unrevoked authority for a departed employee are exactly the findings that trigger enforcement. For a pharmacy or hospital, losing the ability to order controlled substances is not a minor setback.