Guest Column | March 11, 2019

FDA's First DSCSA Warning Letter — A Closer Look

By Barbara Unger, Unger Consulting Inc.

The FDA issued the first warning letter1 citing failure to comply with requirements of the November 2013 Drug Supply Chain Security Act (DSCSA) amendments to the Food, Drug, and Cosmetic (FD&C) Act. This warning letter was issued to McKesson Corporation in San Francisco on February 7, 2019, based on observations from a form 483 issued at the close of the inspection on July 3, 2018.2 First-of-a-kind enforcement actions are always of interest — they can be indicative of the FDA’s potential future enforcement in this area. Also, the text in the enforcement action provides insight into what specific activity or process the agency found objectionable, so others who operate in this area may evaluate their own procedures and processes. This article takes a close look at this warning letter, but first it examines why McKesson may have received the first warning letter in this category, and explains why pharmaceutical manufacturers should care and what precautions they should take.

Why McKesson?

On the whole, FDA inspections of McKesson facilities in the past few years seemed unremarkable. In the past three years, the agency conducted 39 inspections at 16 McKesson sites. Only seven of those inspections received a form 483. Also, where information in the form 483s is available, the FDA cites 21 CFR 211 and not the DSCSA, as they have in the warning letter. While this set of inspections is more frequent that I might have predicted, the outcomes didn’t raise particular concerns.

McKesson, however, has been front and center, along with Amerisource Bergen and Cardinal Health, in legal actions associated with the opioid epidemic. On January 17, 2017, McKesson agreed to pay a $150 million settlement for failure to report suspicious orders of pharmaceutical drugs.3 Associated with this settlement is a compliance addendum4 and an administrative memorandum of agreement.5 Further, “The nationwide settlement requires McKesson to suspend sales of controlled substances from distribution centers in Colorado, Ohio, Michigan and Florida for multiple years. The staged suspensions are among the most severe sanctions ever agreed to by a Drug Enforcement Administration (DEA) registered distributor. The settlement also imposes new and enhanced compliance obligations on McKesson’s distribution system.”

Thus, we have exceptional visibility regarding failure to comply with controlled substance regulations, and regarding the DSCSA requirements to investigate suspected illegitimate product and communicate the information to relevant trading partners. As described in the warning letter, illegitimate product notifications were submitted to the FDA that identified problems with product received from McKesson, including, but not limited to, oxycodone. So, despite the unremarkable inspection history, McKesson — or another firm in the same position — appears ripe for this type of action when problems are associated with controlled substances. In my experience, when taking a first-of-its-kind enforcement action, the FDA carefully selects and targets a significant player in the area so that all similar firms will pay close attention. Further proof that the FDA is sending a message is the press release in which Commissioner Gottlieb addresses the warning letter in the context of the opioid epidemic.6

The form 483 and warning letter should be required reading for all distributors of pharmaceutical products. Firms should assess whether they, too, may be vulnerable to similar enforcement action and should take immediate steps to remediate procedures and practices. I would not be surprised to see several additional warning letters to distributors on this same topic. Hopefully, firms will take immediate action to fix shortcomings and ensure that the drug supply chain is secure and continues to protect the public health.

Why should pharmaceutical manufacturers care, and what, if anything, should they do? Pharmaceutical manufacturers typically contract with distributors to warehouse and distribute their products to hospitals, pharmacies, and other drug product customers. Eventually, this issue finds its way to the user/patient.

Now, lets back up and look at some background regarding the DSCSA requirements, the form 483 that precipitated the warning letter, and then the warning letter itself.

Background

Implementation of the requirements in the DSCSA amendment began in 2014, and additional requirements are being phased in through 2023.7 The McKesson warning letter focuses on the requirement that manufacturers, re-packagers, wholesale distributors, and dispensers must establish systems for verification and handling of suspect or illegitimate product, including communication with relevant trading partners. The legislation addresses several requirements, including:

  • Product identification and ability to trace product through the supply chain
  • Verification of the product identifier by members of the supply chain
  • Detection and responses to the potential suspect product including those that may be “counterfeit, unapproved or potentially dangerous”
  • Notification of the FDA and trading partners when an illegitimate product is identified
  • Wholesaler licensing and licensing of third-party logistics providers

The FDA published a collection of guidance and policies addressing the various requirements in the legislation.8 This guidance, along with the requirements of the DSCSA, are useful when pharma firms plan audits of distribution centers. This approach is important for qualification of sites as well as ongoing periodic oversight. It is in each party’s best interest, and in the interest of the public health — patients expect that the medicines they receive from their pharmacy, the hospital, or their doctor’s office are legitimate, safe, and effective. Auditors who qualify and provide ongoing oversite at drug product distributors should ensure that distributors have effective procedures and processes in place to secure suspect product in the supply chain and to actively participate in investigations.

Effective January 1, 2015, trading partners are required to quarantine and investigate suspect product to determine whether it is illegitimate, and to notify the FDA and trading partners if the illegitimate product is found. The FDA published guidance on the topic, Identification of Suspect Product and Notification, in December 2016.9 This was clearly a situation where the firm had plenty of time to come into compliance.

The Form 483

The form 483 was issued to the assistant general counsel at McKesson and identifies three observations:

  • The firm’s systems to comply with FD&C Act section 582(c) are deficient because the firm could not demonstrate that it verified if a reported suspect product existed in their facility(ies), and it could not demonstrate that the reported suspect product was quarantined while an investigation was conducted.
  • The second observation is effectively a repeat of the first, where the firm did not quarantine the product or work with trading partner(s) to disposition illegitimate product not in possession of the firm.
  • The third observation addresses deficiencies in systems and procedures to make notifications to trading partners. McKesson failed to retain adequate information to effectively notify trading partners. 2

The Warning Letter

The warning letter,1 issued approximately seven months after the inspection close, was sent to the to the CEO of McKesson. Dated February 7, 2019, the letter identifies an inspection of the corporate headquarters in San Francisco (see the form 483 above) and references the inspection of a McKesson facility in Oregon that ended June 29, 2018. It’s interesting that the FDA would reference the inspection in Oregon because no form 483 was issued at the close of that inspection. When the FDA references another inspection in a warning letter, it generally includes observations similar to the one that led to the warning letter. That alone raises a question of why this inspection was identified. The question is addressed in Example 2 in the warning letter. It is also interesting that the examples provided in the warning letter are from mid- to late 2016. Obviously, the FDA had the information for almost two years before it inspected the San Francisco site, raising the question of why the inspection and enforcement action were delayed.

The warning letter identifies three deficiencies where McKesson failed to comply with the requirements of section 582(c)(4). The warning letter also describes three examples supporting the FDA’s conclusions and three examples of inadequate corrective actions.

Deficiencies:

  1. Your firm failed to respond to illegitimate product notifications as required, which includes identifying all illegitimate product subject to such notifications in your possession or control and quarantining such product (section 582(c)(4)(B)(iii)).
  2. Your firm failed to quarantine and investigate suspect product (section 582(c)(4)(A)(i)).
  3. Your firm failed to keep, for not less than 6 years, records of the investigation of suspect product and the disposition of illegitimate product (sections 582(c)(4)(A)(iii) and 582(c)(4)(B)(v)).

Example 1 describes product received at three Rite Aid pharmacies in September and October 2016, where bottles of oxycodone hydrochloride were either empty or were substituted with other pharmaceutical drugs. It is worth noting that the first example cited by the FDA is associated with controlled substances and is the lengthiest example in the warning letter highlighting its importance. The product was manufactured by Mallinckrodt, which reported this event to the FDA. Rite Aid communicated to McKesson that it provided the product. Upon investigation, McKesson determined it was likely that the oxycodone was replaced with other products while they were in McKesson’s control. However, McKesson failed to demonstrate that it identified all illegitimate product subject to the notification and placed the product under quarantine. The FDA expected McKesson would search for product with the same lot number or National Drug Code (NDC). McKesson also failed to notify immediate trading partners that may have received a product with the same lot number or NDC. McKesson also could not provide records demonstrating the disposition of these illegitimate products. McKesson also told FDA investigators that “…incidents involving stolen or diverted controlled substances are not treated as Drug Supply Chain Security Act (DSCSA) verification events within the firm.” Personally, that seems to be a troubling conclusion, and it seems the FDA felt the same way.

Example 2 addresses reports from Albertson’s, which received product from McKesson that was missing both lot number and expiry date. Albertson’s reported these events to McKesson and the FDA in December 2016. These events did not involve oxycodone products. The lack of lot number and expiry date is an example of a specific scenario described in the guidance Identification of Suspect Product and Notification as a situation “…that might increase the likelihood that they are suspect products.”9 This alone should have triggered some action or further investigation by McKesson. Even after being contacted both by Albertson’s and the FDA, McKesson did not demonstrate that it quarantined all products and conducted an investigation to determine whether the products were confirmed as illegitimate, according to the warning letter.

Moreover, here is where the Wilsonville, Oregon site mentioned earlier in the warning letter enters the story. McKesson provided documentation that it notified the Oregon facility of this event(s). The Oregon site denied receiving a quarantine notice. Further, no evidence of the quarantine notification was found in McKesson’s electronic system, and there was no evidence that other distribution centers were notified to confirm the presence of these drugs and place them under quarantine. The FDA further stated that “Your firm did subsequently provide what appears to be an inventory listing query, with handwritten notes, that seems to document your inventory check of these products at your Oregon facility. However, the handwritten notes were undated, unsigned, and were not made available to FDA investigators at the Wilsonville, Oregon, facility, which previously denied receiving the notification to quarantine these products.”

Example 3 addresses notification from GlaxoSmithKline, which received a report from a pharmacy in June 2016 about two sealed bottles of product that did not contain the product identified on the label. The pharmacy reported that it had received the product from McKesson. However, McKesson could not provide records demonstrating that it examined its remaining inventory for the product in question. McKesson was unable to determine if it possessed the suspect product and to notify trading partners as required.

The warning letter also provides comments on three corrective actions proposed by the firm:

  1. McKesson stated that “incidents related to potential diversion and theft issues…the incidents were not necessarily to suspect or illegitimate products.” The FDA responded that these “…statements demonstrate a lack of understanding of the definitions of suspect and illegitimate products and your firm’s responsibilities when notified of an illegitimate product by a trading partner.”
  2. The firm’s response did not provide adequate supporting documentation, so the FDA did not have sufficient information to conclude that McKesson will conduct investigations of suspect product in a manner compliant with the DSCSA.
  3. McKesson committed to forming a product safety committee with responsibility to coordinate all actions regarding suspect project. The firm failed, however, to describe membership of the committee, or how the proposed changes will impact McKesson’s compliance with verification requirements of the DSCSA.

As part of its response to the warning letter, McKesson is to identify actions it has “taken to (1) correct the violations identified in this warning letter, and (2) identify and conduct appropriate investigations and follow-up related to other reports of suspect or illegitimate product that you have identified or received.” The FDA also requested that McKesson “include an explanation of each step being taken to prevent the recurrence of violations and include copies of related documentation” and also, “provide the steps [the] firm has taken to prevent incidents of theft and diversion.”

Conclusion

As mentioned earlier, the form 483 and warning letter should be required reading for all distributors of pharmaceutical products and for pharmaceutical firms that use distributors or re-packagers for their products. This isn’t an issue that will simply go away. I would expect to see additional enforcement in this area and will keep you up to date as that happens.

References:

  1. https://www.fda.gov/ICECI/EnforcementActions/WarningLetters/ucm631088.htm
  2. https://www.fda.gov/ucm/groups/fdagov-public/@fdagov-afda-orgs/documents/document/ucm616533.pdf
  3. https://www.justice.gov/opa/pr/mckesson-agrees-pay-record-150-million-settlement-failure-report-suspicious-orders
  4. https://www.justice.gov/opa/press-release/file/928481/download
  5. https://www.justice.gov/opa/press-release/file/928476/download
  6. https://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm631195.htm
  7. https://www.fda.gov/Drugs/DrugSafety/DrugIntegrityandSupplyChainSecurity/DrugSupplyChainSecurityAct/ucm382022.htm
  8. https://www.fda.gov/Drugs/DrugSafety/DrugIntegrityandSupplyChainSecurity/DrugSupplyChainSecurityAct/ucm424963.htm
  9. https://www.fda.gov/downloads/Drugs/GuidanceComplianceRegulatoryInformation/Guidances/UCM400470.pdf

About The Author:

Barbara Unger formed Unger Consulting, Inc. in December 2014 to provide GMP auditing and regulatory intelligence services to the pharmaceutical industry, including auditing and remediation in GMP areas including data management and data integrity. Her auditing experience includes leadership of the Amgen corporate GMP audit group for APIs and quality systems. She also developed, implemented, and maintained the GMP regulatory intelligence program for eight years at Amgen. This included surveillance, analysis, and communication of GMP-related legislation, regulations, guidance, and industry compliance enforcement trends. Unger was the first chairperson of the Rx-360 Monitoring and Reporting work group (2009 to 2014) that summarized and published relevant GMP- and supply chain-related laws, regulations, and guidance. She also served as the chairperson of the Midwest Discussion Group GMP-Intelligence sub-group from 2010 to 2014. She is currently the co-lead of the Rx-360 Data Integrity Working Group. You can contact her at bwunger123@gmail.com.