(a) To be valid, the purchaser must sign an electronic order for a Schedule I or II controlled substance with a digital signature issued to the purchaser, or the purchaser's agent, by DEA as provided in part 1311 of this chapter.

(b) The following data fields must be included on an electronic order for Schedule I and II controlled substances:

(1) A unique number the purchaser assigns to track the order. The number must be in the following 9-character format: the last two digits of the year, X, and six characters as selected by the purchaser.

(2) The purchaser's DEA registration number.

(3) The name of the supplier.

(4) The complete address of the supplier (may be completed by either the purchaser or the supplier).

(5) The supplier's DEA registration number (may be completed by either the purchaser or the supplier).

(6) The date the order is signed.

(7) The name (including strength where appropriate) of the controlled substance product or the National Drug Code (NDC) number (the NDC number may be completed by either the purchaser or the supplier).

(8) The quantity in a single package or container.

(9) The number of packages or containers of each item ordered.

(c) An electronic order may include controlled substances that are not in schedules I and II and non-controlled substances.

(a) A purchaser must submit the order to a specific supplier. The supplier may initially process the order (e.g., entry of the order into the computer system, billing functions, inventory identification, etc.) centrally at any location, regardless of the location's registration with DEA. Following centralized processing, the supplier may distribute the order to one or more registered locations maintained by the supplier for filling. The registrant must maintain control of the processing of the order at all times.

(b) A supplier may fill the order for a Schedule I or II controlled substance, if possible and if the supplier desires to do so and is authorized to do so under § 1305.06.

(c) A supplier must do the following before filling the order:

(1) Verify the integrity of the signature and the order by using software that complies with Part 1311 of this chapter to validate the order.

(2) Verify that the digital certificate has not expired.

(3) Check the validity of the certificate holder's certificate by checking the Certificate Revocation List. The supplier may cache the Certificate Revocation List until it expires.

(4) Verify the registrant's eligibility to order the controlled substances by checking the certificate extension data.

(d) The supplier must retain an electronic record of every order, and, linked to each order, a record of the number of commercial or bulk containers furnished on each item and the date on which the supplier shipped the containers to the purchaser. The linked record must also include any data on the original order that the supplier completes. Software used to handle digitally signed orders must comply with part 1311 of this chapter.

(e) If an order cannot be filled in its entirety, a supplier may fill it in part and supply the balance by additional shipments within 60 days following the date of the order. No order is valid more than 60 days after its execution by the purchaser, except as specified in paragraph (h) of this section.

(f) A supplier must ship the controlled substances to the registered location associated with the digital certificate used to sign the order, except as specified in paragraph (h) of this section.

(g) When a purchaser receives a shipment, the purchaser must create a record of the quantity of each item received and the date received. The record must be electronically linked to the original order and archived.

(h) Registered procurement officers of the Defense Supply Center of the Defense Logistics Agency may order controlled substances for delivery to armed services establishments within the United States. These orders may be shipped to locations other than the registered location, and in partial shipments at different times not to exceed six months from the date of the order, as designated by the procurement officer when submitting the order.

A supplier may not endorse an electronic order to another supplier to fill.

(a) A supplier that has one or more registered locations and maintains a central processing computer system in which orders are stored may have one or more of the supplier's registered locations fill an electronic order if the supplier does the following:

(1) Assigns each item on the order to a specific registered location for filling.

(2) Creates a record linked to the central file noting both which items a location filled and the location identity.

(3) Ensures that no item is filled by more than one location.

(4) Maintains the original order with all linked records on the central computer system.

(b) A company that has central processing of orders must assign responsibility for filling parts of orders only to registered locations that the company owns and operates.

(a) No electronic order may be filled if:

(1) The required data fields have not been completed.

(2) The order is not signed using a digital certificate issued by DEA.

(3) The digital certificate used had expired or had been revoked prior to signature.

(4) The purchaser's public key will not validate the digital signature.

(5) The validation of the order shows that the order is invalid for any reason.

(b) If an order cannot be filled for any reason under this section, the supplier must notify the purchaser and provide a statement as to the reason (e.g., improperly prepared or altered). A supplier may, for any reason, refuse to accept any order, and if a supplier refuses to accept the order, a statement that the order is not accepted is sufficient for purposes of this paragraph.

(c) When a purchaser receives an unaccepted electronic order from the supplier, the purchaser must electronically link the statement of nonacceptance to the original order. The original order and the statement must be retained in accordance with § 1305.27.

(d) Neither a purchaser nor a supplier may correct a defective order; the purchaser must issue a new order for the order to be filled.

(a) If a purchaser determines that an unfilled electronic order has been lost before or after receipt, the purchaser must provide, to the supplier, a signed statement containing the unique tracking number and date of the lost order and stating that the goods covered by the first order were not received through loss of that order.

(b) If the purchaser executes an order to replace the lost order, the purchaser must electronically link an electronic record of the second order and a copy of the statement with the record of the first order and retain them.

(c) If the supplier to whom the order was directed subsequently receives the first order, the supplier must indicate that it is “Not Accepted” and return it to the purchaser. The purchaser must link the returned order to the record of that order and the statement.

(a) A purchaser must, for each order filled, retain the original signed order and all linked records for that order for two years. The purchaser must also retain all copies of each unaccepted or defective order and each linked statement.

(b) A supplier must retain each original order filled and the linked records for two years.

(c) If electronic order records are maintained on a central server, the records must be readily retrievable at the registered location.

(a) A supplier may void all or part of an electronic order by notifying the purchaser of the voiding. If the entire order is voided, the supplier must make an electronic copy of the order, indicate on the copy “Void,” and return it to the purchaser. The supplier is not required to retain a record of orders that are not filled.

(b) The purchaser must retain an electronic copy of the voided order.

(c) To partially void an order, the supplier must indicate in the linked record that nothing was shipped for each item voided.

A supplier must, for each electronic order filled, forward either a copy of the electronic order or an electronic report of the order in a format that DEA specifies to DEA within two business days.