Drug Quality and Security Act Gives FDA Authority to Regulate Drug Compounding and Creates Uniform Federal Standards for Distribution

by Holland & Knight LLP

On Nov.18, Congress enacted sweeping changes to the laws governing the safety of the drug supply. The Drug Quality and Security Act (the act) clarifies FDA's authority to regulate drug compounding. It also creates uniform federal standards for key supply chain stakeholders and a national system of serialization to effectively trace drugs throughout the supply chain replacing the existing patchwork of state pedigree rules.

Congress had been working on drug security/traceability for several years. Compounding issues became salient to federal policy makers after a fatal meningitis outbreak last year was caused by drugs produced in a compounding pharmacy.

Compounding Pharmacies as "Outsourcing Facilities"

The act creates a new class of FDA-regulated entities known as "outsourcing facilities." This is a voluntary program — entities can choose whether to undergo FDA review to become classified as an outsourcing facility. Congress' view is that market forces will provide incentives for facilities to participate in the program since hospitals, long-term care facilities and other providers will likely prefer to purchase compounded drugs from regulated entities.

To qualify, the facility must pay user fees to FDA and meet a series of reporting and other quality assurance requirements. Facilities that comply with these provisions "may or may not" obtain prescriptions for identified individual patients. Pharmacies that choose not to participate in this program remain subject to state pharmacy licensure rules.

The act defines compounding as "the combining, admixing, mixing, diluting, pooling, reconstituting, or otherwise altering of a marked and approved drug or bulk drug substance to create a drug." The legislation amends the Food, Drug, and Cosmetic Act and allows an entity to be regulated as an outsourcing facility for compounding as long as:

  • Drugs are compounded by or under the direct supervision of a licensed pharmacist.
  • The facility registers with FDA and complies with reporting requirements.
  • The facility does not compound using bulk drug substances (unless, among other requirements, these substances comply with an applicable monograph under the U.S. Pharmacopeia, the National Formulary, or another compendium or pharmacopeia recognized by the secretary of the U.S. Department of Health and Human Services) and its drugs are manufactured by an FDA-registered establishment.
  • Other ingredients used in compounding the drug must comply with the standards of the applicable U.S. Pharmacopeia or National Formulary monograph, if a monograph exists, or of another compendium or pharmacopeia recognized by the secretary.
  • The drug does not appear on a list published by FDA of unsafe or ineffective drugs.
  • The drug is not "essentially a copy" of one or more marketed drugs.
  • The drug does not appear on the FDA list of drugs or categories of drugs that present "demonstrable difficulties" for compounding.
  • The compounding pharmacist demonstrates that he or she will use controls comparable to the controls applicable under any applicable risk evaluation and mitigation strategy (REMS).
  • The drug will not be sold or transferred by an entity other than the outsourcing facility.
  • The drug is compounded in a facility that has paid user fees.
  • The label of the drug states, "This is a compounded drug" or contains "a reasonable comparable alternative statement" as specified by the secretary, as well as the name of the outsourcing facility, the lot or batch number of the drug, dosage form and strength, and other key information.

The law also clarifies that any misleading advertising or promotion of a compounded drug deems the drug misbranded. It also expressly prohibits the resale of a compounded drug that is labeled "not for resale" and the intentional falsification of a prescription with respect to a compounded drug.

Outsourcing facilities are required to register with FDA each year. The list of registered facilities will be made public by FDA. Every six months, the facility must submit a report to FDA that:

  • identifies the drugs compounded at the facility
  • provides additional information about the drugs including the active ingredient (and its source), the National Drug Code number of the source drug or bulk active ingredient, the strength of the active ingredient per unit and the number of units produced

Outsourcing facilities will be subject to FDA inspection based upon a "risk-based schedule" to be developed by the agency. Inspection determinations will be based on the known safety risks of outsourcing facilities based on compliance history, record and nature of recalls linked to the facility, and the inherent risk of the drugs compounded at the facility. Facilities are also required to submit adverse event reports to FDA.

Outsourcing facilities must pay user fees consisting of an annual establishment fee and a re-inspection fee. The fees are each $15,000 multiplied by an inflation adjustment. An outsourcing facility with gross annual sales of $1 million or less (ending April 1 of the preceding fiscal year) will only pay 33 percent of the amount otherwise owed. The establishment fee for all other facilities is subject to a "small business adjustment" to account for the number of facilities with discounted fees. Failure to pay user fees deems any drug manufactured or compounded at that facility misbranded.

Enhanced Communication

State boards of pharmacy are required to submit to FDA any actions taken against compounding pharmacies or express concerns that a compounding pharmacy may be acting contrary to one or more FDA requirements. This includes warning letters, sanctions, or suspension or revocation of a state license. FDA is required to notify a state pharmacy board if it finds that a compounding pharmacy is violating federal regulations.

Drug Distribution Security

The act creates a new federal system of traceability for prescription drugs. Supply chain stakeholders had argued for many years that the current state-by-state system of pedigree rules was cumbersome and did not take advantage of improved information technologies that can trace packages in distribution across the country.

Certain products are exempt from the act's provisions. They are the following:

  • blood and blood components intended for transfusion
  • radioactive drugs and radioactive biologics
  • intravenous products
  • medical gas
  • compounded drugs
  • dispensing drugs pursuant to a prescription
  • medical convenience kits and combination products not approved as drugs or biologics
  • sterile water and products intended for irrigation

The act assigns regulatory requirements based on changes in ownership of the package, rather than simply change of possession. It requires that each owner (such as the manufacturer, wholesale distributor, or dispenser) transfer to a subsequent owner traceability information with respect to each transaction. The three types of information to be provided are:

1."Transaction Information" — the proprietary or established name or names of the product; the strength and dosage form of the product; the National Drug Code number of the product; the container size; the number of containers; the lot number of the product; the date of the transaction; the date of the shipment if more than 24 hours after the date of the transaction; the business name and address of the person from whom ownership is being transferred; and the business name and address of the person to whom ownership is being transferred

2."Transaction Statement" — paper or electronic, which states the entity:

  • is authorized as required under the [act]
  • received the product from a person that is authorized as required under the [act]
  • received transaction information and a transaction statement from the prior owner of the product
  • did not knowingly ship a suspect or illegitimate product
  • had systems and processes in place to comply with verification requirements
  • did not knowingly provide false transaction information
  • did not knowingly alter the transaction history

3."Transaction History" — paper or electronic statement that includes the transaction information for each prior transaction going back to the manufacturer of the product

These traceability requirements generally require products to be tracked at the lot level. In general, a product owner must provide transaction information, a transaction statement and transaction history to the subsequent owner for each transaction, and capture and maintain the information for six years. This obligation begins on Jan. 1, 2015, for manufacturers, wholesaler distributors and repackagers; and on July 1, 2015, for dispensers. A trading partner is required to provide this information to the secretary or other appropriate official in the event of a recall or an investigation of a product that is suspect. Beginning Jan. 1, 2015, trading partners must also maintain systems and processes for investigating and quarantining products that are suspect or illegitimate.

The act requires members of the supply chain to only transact with registered or licensed entities starting Jan. 1, 2015, with a phase-in period for dispensers starting on July 1, 2015.

The legislation implements a national unit level serialization program by requiring manufacturers to use a product identifier with each individual package and homogenous case of the product in four years. Repackagers must affix product identifiers within five years.

The "standard numerical identifier" is a set of numbers or characters used to uniquely identify each package or homogenous case that is composed of the National Drug Code that corresponds to the specific product (including the particular package configuration) combined with a unique alphanumeric serial number of up to 20 characters. According to the act, unless the secretary allows other technologies, it must be included in a two-dimensional data matrix barcode when affixed to, or imprinted upon, a package; and included in a linear or two-dimensional data matrix barcode when affixed to, or imprinted upon, a homogeneous case. It can be verified using human-readable or machine-readable methods.

The act requires interoperable electronic unit level product tracing in 10 years. The unit level product tracing requirements will be based on guidance issued by FDA regarding unit level product tracing and standards for interoperable data exchange, which, in turn, will be based on public meetings and pilot projects that will evaluate feasibility and cost.

Wholesale Distributor and Third-Party Logistics Provider Licensing

The act establishes uniform national licensing standards for wholesale distributors and third-party logistics providers and authorizes FDA to charge user fees to enforce these standards. The secretary is required to establish the standards within two years. States may continue to license wholesale distributors and third-party logistics providers but must do so using the federal standards. In states that do not establish state licensing programs, entities will receive a federal license from FDA.


The act preempts state laws and regulations that establish "any requirements for tracing products through the distribution system" (such as pedigree rules) that are "inconsistent with, more stringent than, or in addition to" the requirements of the act.

The act also preempts all state regulations related to wholesale distributor or third-party logistics provider licensure that are "inconsistent with, less stringent than, directly related to, or covered by the standards and requirements of the Act."

Implementing Regulations

FDA will begin developing regulations on both compounding and traceability shortly. On compounding, FDA will be developing regulations to implement many of the bill's provisions including:

  • how to determine if a drug presents "demonstrable difficulties" for compounding
  • the process for registration of outsourcing facilities
  • creation of the "risk-based schedule" for inspection
  • creation of an advisory committee on compounding
  • establishing the amount of the establishment fee and re-inspection fee

Regarding traceability, there are several actions FDA will be taking to implement the legislation including:

  • FDA will issue a draft guidance within one year establishing the standards for the interoperable exchange of transaction information, history and statements.
  • FDA will issue guidance within two years regarding process for waivers for the manufacturer, wholesaler or dispenser and exceptions for product identifier requirements.
  • After 10 years, the requirement to perform unit level tracing goes into effect (including passing transaction information, verification requirements, etc.) FDA is required to provide for "alternative methods of compliance" with any of these requirements.
  • FDA is required to hold five public meetings, including meetings on the system attributes necessary to enable secure tracing of a product at the unit level as well as on interoperable standards. Eighteen months after this public meeting, FDA is required to issue a final guidance that outlines and makes recommendations on these issues.
  • FDA is required to establish "one or more" pilot projects with supply chain stakeholders to "explore and evaluate" methods to enhance safety and security of the supply chain.
  • Beginning one year after enactment, wholesale distribution establishments are required to report information annually to FDA. FDA will need to create and identify the format and substance of the report. Subsequently, FDA will develop a public database with this information.
  • FDA will need to establish licensing fees to support the federal licensing programs for wholesale distributors and third-party logistics providers.
  • Not less than two years after enactment, FDA must issue regulations regarding licensing standards, including revocation and re-issuance, for distributors and third-party logistics providers.

All stakeholders in the drug supply chain should monitor and strongly consider participating in these developments in the weeks ahead. FDA's implementation of these provisions will greatly impact regulation of the supply chain. 

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Holland & Knight LLP | Attorney Advertising

Written by:

Holland & Knight LLP

Holland & Knight LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at info@jdsupra.com. In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at: info@jdsupra.com.

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.