Controlled Substance Transport: DEA Chain of Custody for Schedule II to V Deliveries

A hospital pharmacy sending Schedule II opioids to a satellite campus, a specialty pharmacy delivering a stimulant prescription to a patient’s home, a long-term care pharmacy replenishing a nursing facility’s emergency kit: each is a routine order on a courier’s screen, and each sits inside a regulatory structure written around the registrant who owns the drug, not the courier who carries it. Controlled substance transport is a custody and accountability problem before it is a temperature or speed problem.

This guide is for pharmacy operations leads, hospital logistics managers and procurement teams who need to understand what the Drug Enforcement Administration framework expects when Schedule II to V medications leave one registered location for another, or for a patient. It describes the requirements in general terms for operations planning. It is not legal advice; every registrant should confirm its obligations with counsel, its state board of pharmacy and its DEA field office before changing a transport program.

1. Controlled Substance Transport Starts With the Registrant

The Controlled Substances Act builds its entire security model on registration. Manufacturers, distributors, pharmacies, hospitals and practitioners that handle controlled substances register with the DEA Diversion Control Division, and each registered location is accountable for every dosage unit that enters and leaves it. The regulations in 21 CFR Parts 1301 through 1307 cover who must register, records and inventories, ordering of Schedule I and II drugs, and disposal. A courier does not appear in that structure as a registrant; it appears as a carrier the registrant selects.

That selection is itself a regulated act. DEA regulations make a registrant that ships controlled substances responsible for choosing common or contract carriers that provide adequate security against in-transit loss. In practice, the registrant’s compliance officer should be able to show how the courier was vetted: its custody procedures, container security, driver screening and training, incident reporting and tracking.

Responsibility does not transfer at the dock. The sending registrant remains accountable until the receiving registrant, or the patient, takes possession and the record closes. The transport record therefore has to satisfy the pharmacist who dispatched the order and the pharmacist, nurse or practitioner who receives it. The custody mechanics are the same ones described in our guide to chain of custody in medical specimen transport, applied with less tolerance for gaps.

What the sending registrant remains responsible for:

• Selecting a carrier with documented security against in-transit loss and keeping that vetting on file
• Executing the ordering documents for Schedule II before the drug leaves
• Keeping shipment records for the period the regulations require, generally two years
• Reporting any theft or significant loss discovered in transit

2. Who May Transport Schedule II to V Drugs, and What the Courier Is Not

DEA regulations generally exempt a common or contract carrier from registration when its possession of a controlled substance is in the usual course of its business as a carrier. That exemption is what allows a medical courier to move a sealed shipment between two registrants or to a patient without holding its own registration. It is narrow. The courier may possess the drug only while carrying it from the sender to the named recipient. It may not store the shipment overnight at its own premises, open a sealed container, repackage, consolidate contents from different orders, or hand the shipment to anyone other than the authorized receiver.

The practical consequence is a short list of things a courier must refuse to do. A driver may not count tablets; the driver counts sealed containers and verifies seal numbers against the manifest. A driver may not take a shipment home when a receiving pharmacy is closed; the shipment returns to the sending registrant the same day, and the return is recorded. A driver may not leave a controlled substance in a vestibule, with a doorman or with a minor.

State law layers on top. Boards of pharmacy in several Northeast states set their own rules for delivery of controlled substances to patients, for who may sign, and for records, and some restrict home delivery of Schedule II prescriptions more tightly than federal law does. A pharmacy in Philadelphia and one in Newark can be working under different state requirements for the same drug; our Philadelphia medical courier service page covers the regional coverage, and the pharmacy’s counsel confirms the state rule.

Limits a courier observes on controlled substance orders:

• Possession only in transit from the registrant to the named recipient, never overnight at the courier’s premises
• No opening, counting contents, repackaging or combining shipments
• Delivery only to the authorized receiver named on the order, with identity confirmed as the order requires
• Same-day return to the sender if the receiver is unavailable, recorded as a custody event

3. Documentation: DEA Form 222, Invoices and the Transport Record

Schedule II drugs move between registrants on an official order form. DEA Form 222 is the paper version: the purchasing registrant executes it, the supplying registrant fills in what was shipped and when, and both keep copies. The Controlled Substance Ordering System, usually called CSOS, is the electronic equivalent, using digital certificates issued to the purchaser. Schedule III, IV and V drugs do not require the order form; they move on invoices or packing slips that record the drug, the quantity, the date and both parties. The courier executes none of these documents; the registrants complete them, and the courier’s manifest references them.

The transport record is the courier’s contribution, written so a registrant can reconcile it against the order form or invoice without opening anything. At pickup: the number of sealed containers, the seal serial numbers, the sender’s signature, a timestamp and a geofenced photo. At delivery: the receiver’s printed name and e-signature, confirmation that seal numbers match and seals are intact, a timestamp and a photo. Between the two, a continuous location trace. Our chain-of-custody courier page shows the record as it is produced, and our medical courier proof of delivery page shows what the pharmacy receives for each order.

Patient deliveries carry the dispensing label, which is protected health information, and the HIPAA rules administered by HHS apply to the courier as a business associate. The outer package should show a name and address only. Practice resources from ASHP cover the pharmacy-side controls for controlled substance handling and diversion prevention that the transport record should connect to.

Elements of a transport record that reconciles to the registrant’s documents:

• Order reference tying the shipment to the Form 222, CSOS order or invoice number
• Count of sealed containers and the serial number of each tamper-evident seal
• Sender signature, timestamp and geofenced photo at pickup
• Receiver printed name, e-signature, seal verification, timestamp and photo at delivery

4. Locked Containers, Vehicle Security and the Handoff

The regulations describe physical security for registrants in terms of safes, cages and alarms. In transit the equivalent is a layered container: the pharmacy’s sealed inner package, placed in a lockable hard-sided transport case with a numbered tamper-evident seal, placed out of sight in a locked vehicle. The case stays locked from pickup to delivery and is opened only by the receiver. Refrigerated controlled substances use the same locked case inside a conditioned shipper rather than a shared cooler; the tiering is described in our guide to pharmaceutical courier services, compliance and cold chain.

Routing rules matter as much as the box. Controlled substance orders should run direct or with the fewest intermediate stops the route allows, never left in an unattended vehicle at a stop, and tracked continuously so dispatch can see a deviation as it happens; our page on real-time medical delivery tracking describes the view a pharmacy can share. Drivers assigned to these orders should have completed training that covers controlled substance custody specifically, in addition to the standard curriculum described in our guide to medical courier driver certification and training requirements.

The handoff is where most diversion risk concentrates. At a hospital or clinic, the receiver should be a pharmacist, a nurse or another person the registrant has designated in writing, and the courier’s record names that person. At a patient’s home, the receiver is the patient or an adult the pharmacy has authorized on the order. The seal numbers are read against the manifest before the signature is captured, so a discrepancy is caught with both parties present.

Security controls from pickup to receipt:

• Sealed inner package inside a lockable hard-sided case with a numbered tamper-evident seal
• Case out of sight in a locked vehicle; never left in an unattended vehicle at an intermediate stop
• Direct routing with continuous GPS tracking visible to dispatch and, on request, to the pharmacy
• Receiver designated in advance; seal numbers verified before the e-signature is captured

5. Loss, Theft and In-Transit Discrepancies

DEA regulations require a registrant to notify its DEA field division in writing within one business day of discovering a theft or significant loss of controlled substances, and to follow that notification with a completed DEA Form 106, now submitted electronically, documenting the drugs, quantities and circumstances. The obligation belongs to the registrant, so the registrant must hear about an in-transit event from the courier fast enough to meet that window. State boards of pharmacy and local law enforcement generally have their own notification expectations.

The courier’s side of that clock is an incident procedure that treats any irregularity as reportable until the registrant says otherwise: a broken or mismatched seal, a container count that differs from the manifest, a vehicle break-in, a package that cannot be located, or a delivery signed by someone the order did not authorize. The driver stops, secures what remains, and contacts dispatch; dispatch notifies the sending registrant’s designated contact immediately by phone and in writing and preserves the GPS trace and photos. Whether a discrepancy is a significant loss is the registrant’s determination, not the courier’s, but the information to make it has to arrive within minutes.

Most discrepancies are documentation errors found at receipt: a seal number transcribed wrong, a container counted twice. The reconciliation step at delivery surfaces those with both parties present and closes them on the record, so a true loss stands out. For long-term care pharmacies replenishing emergency kits across many facilities and hospital systems moving stock between campuses, that discipline keeps a weekly audit from becoming an investigation; the flows are described on our medical courier service for long-term care and medical courier service for pharmacies pages, and the discharge-fill variant in our post on hospital discharge medication delivery.

Incident sequence for a suspected in-transit loss:

• Driver stops, secures remaining containers and contacts dispatch without attempting delivery
• Dispatch notifies the sending registrant’s designated contact by phone and in writing within minutes
• GPS trace, photos, seal records and the custody log are preserved and exported to the registrant
• Registrant determines whether the event is a theft or significant loss and files with DEA and state authorities

Key Takeaways

Controlled substance transport works when the registrant keeps the regulatory obligations, the courier keeps a custody record tight enough to reconcile against them, and both sides agree in advance on what happens when a seal, a count or a signature does not match.

• The registrant that ships remains accountable until the registered receiver or the patient signs
• A courier operates under the carrier exemption only while in transit: no storage, no opening, no substitution of receiver
• Form 222 and CSOS belong to the registrants; the courier’s record references them and counts sealed containers
• Theft or significant loss must reach the registrant within minutes so it can meet the one-business-day DEA notification

If your pharmacy or health system is building or auditing a controlled substance delivery program and wants to see how sealed-container counts, seal verification, designated receivers and incident alerts are configured per order, schedule a demo of the carGO Health platform and review the custody record with your compliance officer.

Frequently Asked Questions

Does a courier need a DEA registration to transport controlled substances?

Generally no. DEA regulations exempt a common or contract carrier from registration when its possession of a controlled substance is in the usual course of its carrier business. The exemption covers transit only: the courier may not store, open, repackage or redirect the shipment. The shipping registrant remains responsible for selecting a carrier with adequate security. Confirm specifics with counsel.

What is DEA Form 222 and does the courier handle it?

DEA Form 222 is the official order form a registrant uses to purchase Schedule I or II controlled substances from another registrant; CSOS is its electronic equivalent. The purchaser executes it and the supplier records what was shipped. The courier does not complete either document. Its transport record references the order number and documents sealed-container counts, seal numbers, signatures and timestamps.

How must controlled substances be secured during transport?

In layers: the pharmacy’s sealed inner package, inside a lockable hard-sided case with a numbered tamper-evident seal, out of sight in a locked vehicle, routed directly with continuous GPS tracking and never left in an unattended vehicle. The case is opened only by the designated receiver, who verifies seal numbers against the manifest before signing.

What happens if a controlled substance is lost or stolen in transit?

The driver secures what remains and alerts dispatch, which notifies the sending registrant immediately and preserves the GPS trace, photos and custody log. The registrant decides whether the event is a theft or significant loss and, if so, notifies its DEA field division in writing within one business day and files DEA Form 106, along with any state board and police reports required.

Can a medical courier deliver controlled substances to a patient’s home?

In many cases yes, acting as the dispensing pharmacy’s carrier, provided the pharmacy’s state rules allow it and the order specifies who may receive the prescription and what identity check applies. The courier delivers only to the patient or the adult the pharmacy authorized, captures an e-signature and geofenced photo, and returns the package to the pharmacy the same day if no authorized receiver is available.