An institutional DEA registration is the facility-level authorization a hospital, clinic, surgical center, teaching institution, or in-house pharmacy needs before it can receive, store, or administer controlled substances. It covers the organization rather than any individual prescriber, and it must be issued for each physical location where scheduled drugs are handled. Getting one means filing DEA Form 224 with matching state credentials, meeting the physical security and record-keeping rules that come with it, and renewing on schedule to avoid an illegal gap in authority.1Drug Enforcement Administration. Registration Q&A
Who Registers as an Institution
Federal rules separate individual practitioner registrations from institutional ones. A physician in private practice registers individually. A hospital, clinic, surgical center, teaching institution, or retail pharmacy operating inside a larger healthcare facility registers as an institutional practitioner, which lets the organization receive bulk shipments and manage a collective inventory for patient care across the facility.1Drug Enforcement Administration. Registration Q&A A facility that never handles controlled substances has no obligation to register.
Every physical location gets its own registration. A hospital system with three campuses needs three institutional registrations, not one. The per-location rule extends to off-site clinics and satellite pharmacies that stock scheduled medications independently from the main facility.
What to Have Ready Before You Apply
State paperwork comes first. The facility needs a current medical license from the relevant state board and any state controlled substance license the jurisdiction requires. It also needs its Employer Identification Number from the IRS to verify its legal standing as a business entity. The federal application checks these credentials against existing state records, so any mismatch between the state license and the federal form creates an immediate problem.
The physical address on the application must match the state license exactly. A discrepancy in the street address or facility name can trigger automatic rejection. If someone other than the primary registrant will sign for drug orders, the facility must designate that person through a Power of Attorney before submitting.
Filing DEA Form 224
The application is DEA Form 224, submitted through the DEA Diversion Control Division’s online portal.2Drug Enforcement Administration Diversion Control Division. DEA Forms and Applications It asks for the facility’s business activity type, the specific drug schedules it intends to handle, and the storage address. It also collects the Social Security Number or Employer Identification Number of the person responsible for the registration, which the DEA uses for background checks.
The fee for a new three-year registration is $888, payable by credit card or electronic fund transfer during the submission session. After payment, the applicant receives a confirmation number and a copy of the submitted form. Review typically takes four to six weeks, though clean applications can move faster. A DEA investigator may schedule a site visit during this period to inspect drug storage against the security standards below.
The facility cannot legally handle controlled substances while the application is pending. Starting operations before the certificate arrives is a federal violation, regardless of how confident the applicant is that approval is coming.
Storage and Security Standards
Institutional practitioners must store Schedule II through V controlled substances in a securely locked, substantially constructed cabinet.3eCFR. 21 CFR 1301.75 – Physical Security Controls for Practitioners As an alternative, the regulation allows dispersing controlled substances throughout noncontrolled stock in a way that makes theft or diversion difficult. In practice, most hospitals use locked cabinets or automated dispensing machines because tracking inventory is far easier when everything is in one place.
Facilities that store large quantities or manufacture controlled substances face significantly stricter requirements involving reinforced concrete vaults, resistance-rated vault doors, alarm systems transmitting to a central station or police agency, and internal detection devices such as ultrasonic sensors or electrical lacing across walls, floors, and ceilings.4eCFR. 21 CFR Part 1301 – Security Requirements Ordinary patient-care operations rarely trigger the vault rules, but a facility that plans to hold bulk quantities should read them closely before choosing a storage design.
Covering Staff Prescribers Under the Institutional Number
An institutional registration extends to individual practitioners who work for the facility. A physician, nurse practitioner, or other provider who is an agent or employee of a registered hospital may prescribe, dispense, and administer controlled substances under the institution’s registration instead of holding their own.5eCFR. 21 CFR 1301.22 – Exemption of Agents and Employees; Affiliated Practitioners This matters most for medical residents, interns, and foreign-trained physicians who have not yet obtained their own DEA numbers.
Four conditions must be met. The practitioner must be acting within their normal professional practice, authorized by the state to prescribe controlled substances, verified by the institution as holding that state authorization, and acting only within the scope of their employment at the facility.5eCFR. 21 CFR 1301.22 – Exemption of Agents and Employees; Affiliated Practitioners The institution bears legal responsibility for the practitioner’s actions under its registration.
To track who is prescribing under its number, the institution assigns each authorized practitioner a unique internal code, appended as a suffix to the institutional DEA number. The facility must maintain a current list of these codes and the practitioners they correspond to, and it must make that list available to law enforcement and other registrants on request to verify prescribing authority.
Records You Must Keep
Registration is the starting point. Once the facility holds a DEA number, it takes on record-keeping duties that federal investigators check during inspections.
Biennial Inventory
Every registered institution must conduct a complete physical inventory of all controlled substances at least every two years.6eCFR. 21 CFR 1304.11 – Inventory Requirements The first inventory happens on the date the facility begins handling controlled substances. Each subsequent inventory can be taken on any date within two years of the last one, and must indicate whether it was taken at the opening or close of business.
Counting rules differ by schedule. Schedule I and II substances require an exact count of every opened container. Schedule III through V substances allow an estimate unless a container holds more than 1,000 tablets or capsules, in which case an exact count is required.6eCFR. 21 CFR 1304.11 – Inventory Requirements Each entry must include the substance name, its finished form and strength, the number of units per container, and the number of containers.
Form 222 and Retention
All inventory records and other controlled substance documentation must be retained for at least two years and kept available for DEA inspection.7eCFR. 21 CFR Part 1304 – Records and Reports of Registrants Ordering Schedule II substances requires DEA Form 222, with its own set of rules: only one supplier per form, only one item per line, and the form expires 60 days after execution.8eCFR. 21 CFR Part 1305 Subpart B – DEA Form 222 The purchaser keeps a copy and the supplier retains the original. These forms are stored separately from other records and kept for two years.
Reporting Theft or Significant Loss
When controlled substances go missing, the clock starts immediately. A facility must notify its local DEA Field Division Office in writing within one business day of discovering a theft or significant loss.9Federal Register. Reporting Theft or Significant Loss of Controlled Substances The facility then has 45 calendar days from discovery to submit a complete DEA Form 106 through the DEA’s secure online system.
Whether a loss counts as “significant” is a judgment call. The DEA weighs the quantity lost relative to business volume, the specific substances involved, whether the loss can be traced to particular individuals or activities, whether there is a pattern of losses over time, and the diversion potential of the missing substances.10Drug Enforcement Administration. Theft or Loss Q&A A single missing tablet of a commonly diverted opioid may warrant a report; the same discrepancy in a low-risk Schedule V cough preparation probably would not. When in doubt, report.
Disposing of Controlled Substances
Expired or unwanted controlled substances cannot go in the trash. A facility has two lawful routes. It may deliver the substances to a registered reverse distributor, either by arranging carrier pickup or having the reverse distributor collect them directly.11eCFR. 21 CFR Part 1317 – Disposal The reverse distributor must personally receive the delivery at its registered location and destroy the substances within 30 calendar days.
Alternatively, a facility can request assistance from the DEA Special Agent in Charge for its area by submitting DEA Form 41 listing the substances to be destroyed.12eCFR. 21 CFR Part 1317 Subpart A – Disposal of Controlled Substances by Registrants Whichever method is used, controlled substances may not be rerouted once in transit to a disposal destination, and every step must be documented and retained with the facility’s other controlled substance records.
Renewal and Modifications
Standard institutional registrations last three years. The DEA sends electronic renewal reminders at 60, 45, 30, 15, and 5 days before expiration to the email address on file.13Drug Enforcement Administration (DEA) Diversion Control Division. Registration Renewal uses DEA Form 224a. A facility that submits its renewal in a timely manner before expiration may continue operating under the existing registration while the renewal is processed.
Missing the deadline creates a cascading problem. The DEA allows reinstatement for one calendar month after the expiration date. After that month, the facility must start over with a brand-new application. And here is the part that catches people: federal law prohibits handling controlled substances for any period under an expired registration, even during that one-month reinstatement window.13Drug Enforcement Administration (DEA) Diversion Control Division. Registration The only way to avoid a gap in legal authority is to file before the registration expires.
Changes to the facility’s name, address, or drug schedules go through a modification request to the DEA Registration Unit at no cost.14eCFR. 21 CFR Part 1301 – Modification, Transfer and Termination of Registration The request can be submitted online and must include the current registration number, the change being requested, and an authorized signature. If approved, the DEA issues a new certificate, which the facility keeps alongside the original until its expiration date.
Penalties for Getting It Wrong
Civil penalties under the Controlled Substances Act are adjusted for inflation annually and have grown substantially. As of 2025, civil fines for most prohibited acts related to controlled substances reach up to $82,950 per violation, with certain opioid-related failures carrying penalties as high as $124,825 per violation.15Federal Register. Civil Monetary Penalties Inflation Adjustments for 2025 Because these amounts apply per violation, a facility with systemic record-keeping failures can face cumulative fines in the hundreds of thousands of dollars.
Criminal exposure is equally serious. Knowingly violating registration requirements or other provisions of the Controlled Substances Act can result in up to four years of imprisonment for a first offense, and a second offense doubles the maximum to eight years.16Office of the Law Revision Counsel. 21 USC 843 – Prohibited Acts C The DEA can also revoke or suspend an institution’s registration entirely, which shuts down the facility’s ability to handle controlled substances until a new registration is obtained.
Opioid Treatment Programs Follow a Different Track
Facilities running opioid treatment programs do not use the standard institutional process. They apply on DEA Form 363 and must obtain certification from the Substance Abuse and Mental Health Services Administration and state approval before the DEA will process the application.17DEA Diversion Control Division. Narcotic Treatment Program Manual Each treatment location, including geographically separate medication units, requires its own registration, and these registrations must be renewed annually using DEA Form 363a rather than on the three-year cycle that governs a standard institutional registration.