November 18, 2013

Drug Quality and Security Act Gives FDA Authority to Regulate Drug Compounding and Creates Uniform Federal Standards for Distribution

Holland & Knight Alert
Michael J. Werner

On Nov.18, Congress enacted sweeping changes to the laws governing the safety of the drug supply. The Drug Quality and Security Act (the act) clarifies FDA's authority to regulate drug compounding. It also creates uniform federal standards for key supply chain stakeholders and a national system of serialization to effectively trace drugs throughout the supply chain replacing the existing patchwork of state pedigree rules.

Congress had been working on drug security/traceability for several years. Compounding issues became salient to federal policy makers after a fatal meningitis outbreak last year was caused by drugs produced in a compounding pharmacy.

Compounding Pharmacies as "Outsourcing Facilities"

The act creates a new class of FDA-regulated entities known as "outsourcing facilities." This is a voluntary program — entities can choose whether to undergo FDA review to become classified as an outsourcing facility. Congress' view is that market forces will provide incentives for facilities to participate in the program since hospitals, long-term care facilities and other providers will likely prefer to purchase compounded drugs from regulated entities.

To qualify, the facility must pay user fees to FDA and meet a series of reporting and other quality assurance requirements. Facilities that comply with these provisions "may or may not" obtain prescriptions for identified individual patients. Pharmacies that choose not to participate in this program remain subject to state pharmacy licensure rules.

The act defines compounding as "the combining, admixing, mixing, diluting, pooling, reconstituting, or otherwise altering of a marked and approved drug or bulk drug substance to create a drug." The legislation amends the Food, Drug, and Cosmetic Act and allows an entity to be regulated as an outsourcing facility for compounding as long as:

  • Drugs are compounded by or under the direct supervision of a licensed pharmacist.
  • The facility registers with FDA and complies with reporting requirements.
  • The facility does not compound using bulk drug substances (unless, among other requirements, these substances comply with an applicable monograph under the U.S. Pharmacopeia, the National Formulary, or another compendium or pharmacopeia recognized by the secretary of the U.S. Department of Health and Human Services) and its drugs are manufactured by an FDA-registered establishment.
  • Other ingredients used in compounding the drug must comply with the standards of the applicable U.S. Pharmacopeia or National Formulary monograph, if a monograph exists, or of another compendium or pharmacopeia recognized by the secretary.
  • The drug does not appear on a list published by FDA of unsafe or ineffective drugs.
  • The drug is not "essentially a copy" of one or more marketed drugs.
  • The drug does not appear on the FDA list of drugs or categories of drugs that present "demonstrable difficulties" for compounding.
  • The compounding pharmacist demonstrates that he or she will use controls comparable to the controls applicable under any applicable risk evaluation and mitigation strategy (REMS).
  • The drug will not be sold or transferred by an entity other than the outsourcing facility.
  • The drug is compounded in a facility that has paid user fees.
  • The label of the drug states, "This is a compounded drug" or contains "a reasonable comparable alternative statement" as specified by the secretary, as well as the name of the outsourcing facility, the lot or batch number of the drug, dosage form and strength, and other key information.

The law also clarifies that any misleading advertising or promotion of a compounded drug deems the drug misbranded. It also expressly prohibits the resale of a compounded drug that is labeled "not for resale" and the intentional falsification of a prescription with respect to a compounded drug.

Outsourcing facilities are required to register with FDA each year. The list of registered facilities will be made public by FDA. Every six months, the facility must submit a report to FDA that:

  • identifies the drugs compounded at the facility
  • provides additional information about the drugs including the active ingredient (and its source), the National Drug Code number of the source drug or bulk active ingredient, the strength of the active ingredient per unit and the number of units produced

Outsourcing facilities will be subject to FDA inspection based upon a "risk-based schedule" to be developed by the agency. Inspection determinations will be based on the known safety risks of outsourcing facilities based on compliance history, record and nature of recalls linked to the facility, and the inherent risk of the drugs compounded at the facility. Facilities are also required to submit adverse event reports to FDA.

Outsourcing facilities must pay user fees consisting of an annual establishment fee and a re-inspection fee. The fees are each $15,000 multiplied by an inflation adjustment. An outsourcing facility with gross annual sales of $1 million or less (ending April 1 of the preceding fiscal year) will only pay 33 percent of the amount otherwise owed. The establishment fee for all other facilities is subject to a "small business adjustment" to account for the number of facilities with discounted fees. Failure to pay user fees deems any drug manufactured or compounded at that facility misbranded.

Enhanced Communication

State boards of pharmacy are required to submit to FDA any actions taken against compounding pharmacies or express concerns that a compounding pharmacy may be acting contrary to one or more FDA requirements. This includes warning letters, sanctions, or suspension or revocation of a state license. FDA is required to notify a state pharmacy board if it finds that a compounding pharmacy is violating federal regulations.

Drug Distribution Security

The act creates a new federal system of traceability for prescription drugs. Supply chain stakeholders had argued for many years that the current state-by-state system of pedigree rules was cumbersome and did not take advantage of improved information technologies that can trace packages in distribution across the country.

Certain products are exempt from the act's provisions. They are the following:

  • blood and blood components intended for transfusion
  • radioactive drugs and radioactive biologics
  • intravenous products
  • medical gas
  • compounded drugs
  • dispensing drugs pursuant to a prescription
  • medical convenience kits and combination products not approved as drugs or biologics
  • sterile water and products intended for irrigation

The act assigns regulatory requirements based on changes in ownership of the package, rather than simply change of possession. It requires that each owner (such as the manufacturer, wholesale distributor, or dispenser) transfer to a subsequent owner traceability information with respect to each transaction. The three types of information to be provided are:

1."Transaction Information" — the proprietary or established name or names of the product; the strength and dosage form of the product; the National Drug Code number of the product; the container size; the number of containers; the lot number of the product; the date of the transaction; the date of the shipment if more than 24 hours after the date of the transaction; the business name and address of the person from whom ownership is being transferred; and the business name and address of the person to whom ownership is being transferred

2."Transaction Statement" — paper or electronic, which states the entity:

  • is authorized as required under the [act]
  • received the product from a person that is authorized as required under the [act]
  • received transaction information and a transaction statement from the prior owner of the product
  • did not knowingly ship a suspect or illegitimate product
  • had systems and processes in place to comply with verification requirements
  • did not knowingly provide false transaction information
  • did not knowingly alter the transaction history

3."Transaction History" — paper or electronic statement that includes the transaction information for each prior transaction going back to the manufacturer of the product

These traceability requirements generally require products to be tracked at the lot level. In general, a product owner must provide transaction information, a transaction statement and transaction history to the subsequent owner for each transaction, and capture and maintain the information for six years. This obligation begins on Jan. 1, 2015, for manufacturers, wholesaler distributors and repackagers; and on July 1, 2015, for dispensers. A trading partner is required to provide this information to the secretary or other appropriate official in the event of a recall or an investigation of a product that is suspect. Beginning Jan. 1, 2015, trading partners must also maintain systems and processes for investigating and quarantining products that are suspect or illegitimate.

The act requires members of the supply chain to only transact with registered or licensed entities starting Jan. 1, 2015, with a phase-in period for dispensers starting on July 1, 2015.

The legislation implements a national unit level serialization program by requiring manufacturers to use a product identifier with each individual package and homogenous case of the product in four years. Repackagers must affix product identifiers within five years.

The "standard numerical identifier" is a set of numbers or characters used to uniquely identify each package or homogenous case that is composed of the National Drug Code that corresponds to the specific product (including the particular package configuration) combined with a unique alphanumeric serial number of up to 20 characters. According to the act, unless the secretary allows other technologies, it must be included in a two-dimensional data matrix barcode when affixed to, or imprinted upon, a package; and included in a linear or two-dimensional data matrix barcode when affixed to, or imprinted upon, a homogeneous case. It can be verified using human-readable or machine-readable methods.

The act requires interoperable electronic unit level product tracing in 10 years. The unit level product tracing requirements will be based on guidance issued by FDA regarding unit level product tracing and standards for interoperable data exchange, which, in turn, will be based on public meetings and pilot projects that will evaluate feasibility and cost.

Wholesale Distributor and Third-Party Logistics Provider Licensing

The act establishes uniform national licensing standards for wholesale distributors and third-party logistics providers and authorizes FDA to charge user fees to enforce these standards. The secretary is required to establish the standards within two years. States may continue to license wholesale distributors and third-party logistics providers but must do so using the federal standards. In states that do not establish state licensing programs, entities will receive a federal license from FDA.


The act preempts state laws and regulations that establish "any requirements for tracing products through the distribution system" (such as pedigree rules) that are "inconsistent with, more stringent than, or in addition to" the requirements of the act.

The act also preempts all state regulations related to wholesale distributor or third-party logistics provider licensure that are "inconsistent with, less stringent than, directly related to, or covered by the standards and requirements of the Act."

Implementing Regulations

FDA will begin developing regulations on both compounding and traceability shortly. On compounding, FDA will be developing regulations to implement many of the bill's provisions including:

  • how to determine if a drug presents "demonstrable difficulties" for compounding
  • the process for registration of outsourcing facilities
  • creation of the "risk-based schedule" for inspection
  • creation of an advisory committee on compounding
  • establishing the amount of the establishment fee and re-inspection fee

Regarding traceability, there are several actions FDA will be taking to implement the legislation including:

  • FDA will issue a draft guidance within one year establishing the standards for the interoperable exchange of transaction information, history and statements.
  • FDA will issue guidance within two years regarding process for waivers for the manufacturer, wholesaler or dispenser and exceptions for product identifier requirements.
  • After 10 years, the requirement to perform unit level tracing goes into effect (including passing transaction information, verification requirements, etc.) FDA is required to provide for "alternative methods of compliance" with any of these requirements.
  • FDA is required to hold five public meetings, including meetings on the system attributes necessary to enable secure tracing of a product at the unit level as well as on interoperable standards. Eighteen months after this public meeting, FDA is required to issue a final guidance that outlines and makes recommendations on these issues.
  • FDA is required to establish "one or more" pilot projects with supply chain stakeholders to "explore and evaluate" methods to enhance safety and security of the supply chain.
  • Beginning one year after enactment, wholesale distribution establishments are required to report information annually to FDA. FDA will need to create and identify the format and substance of the report. Subsequently, FDA will develop a public database with this information.
  • FDA will need to establish licensing fees to support the federal licensing programs for wholesale distributors and third-party logistics providers.
  • Not less than two years after enactment, FDA must issue regulations regarding licensing standards, including revocation and re-issuance, for distributors and third-party logistics providers.

All stakeholders in the drug supply chain should monitor and strongly consider participating in these developments in the weeks ahead. FDA's implementation of these provisions will greatly impact regulation of the supply chain.  


To ensure compliance with Treasury Regulations (31 CFR Part 10, §10.35), we inform you that any tax advice contained in this correspondence was not intended or written by us to be used, and cannot be used by you or anyone else, for the purpose of avoiding penalties imposed by the Internal Revenue Code.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem. Moreover, the laws of each jurisdiction are different and are constantly changing. If you have specific questions regarding a particular fact situation, we urge you to consult competent legal counsel.

Related Insights