The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) is bringing sweeping changes to the cosmetics industry. One such change requires a “responsible person” to maintain and submit certain adverse event reports to FDA. Under MoCRA, a “responsible person” is defined as “the manufacturer, packer, or distributor of a cosmetic product whose name appears on the label of such cosmetic product.” While this provision of MoCRA will not go into effect until December 29, 2023, Locke Lord advises anyone who may be considered a responsible person to set up a standard operating procedure (SOP) for collecting complaints and determining which complaints must be recorded as adverse events, and in the case of serious adverse events, submitted to FDA within 15 days of receipt.

Adverse Events vs. Serious Adverse Events:

In our previous Quick Study, Amendments to Section VI of the Federal Food and Drug and Cosmetic Act in the Omnibus Bill (February 23, 2023), we explained how MoCRA sets forth two different levels of adverse events: 1) an “adverse event,” and 2) a “serious adverse event.” MoCRA broadly defines “adverse event” as “any health-related event associated with the use of a cosmetic product that is adverse.” MoCRA offers no definition for a “health-related event,” but “serious adverse event” is defined more specifically as “an adverse event that—

(A) results in—

(i) death;

(ii) a life-threatening experience;

(iii) inpatient hospitalization;

(iv) a persistent or significant disability or incapacity;

(v) a congenital anomaly or birth defect;

(vi) an infection; or

(vii) significant disfigurement (including serious and persistent rashes, second- or third-degree burns, significant hair loss, or persistent or significant alteration of appearance), other than as intended, under conditions of use that are customary or usual; or

(B) requires, based on reasonable medical judgment, a medical or surgical intervention to prevent an outcome described in subparagraph (A).”

We expect that FDA will interpret both “adverse events” and “serious adverse events” liberally given their rather flexible definitions in the statute.

Maintenance Requirements:

MoCRA requires that the “responsible person shall maintain records related to each report of an adverse event associated with the use, in the United States, of a cosmetic product manufactured or distributed by such person received by such person, for a period of 6 years.” Qualified small businesses “who do not engage in the manufacturing or processing of the cosmetic products” must maintain such records for 3 years. The FDA may access the records during an inspection instituted for any reason, including compliance with Good Manufacturing Practices or as a result of a potential safety issue attributed to other products associated with the responsible person or product manufacturing facility.

Submission Requirements:

While all reported adverse events have maintenance requirements, a “serious adverse event” creates an additional duty for the responsible person to submit to FDA “a serious adverse event report accompanied by a copy of the label on or within the retail packaging of such cosmetic product no later than 15 business days after the report is received by the responsible person.” Further, if any “new and material medical information” is received with respect to the serious adverse event report already submitted to FDA, the responsible person must submit the new medical information to FDA “within 1 year of the initial report to the Secretary, no later than 15 business days after such information is received by such responsible person.”

Transmission of Information by FDA:

MoCRA permits FDA not only to obtain records of adverse events from responsible persons and contract manufacturers but also to distribute such information to qualified individuals and agencies. In particular, FDA may transmit a company’s adverse event records to Federal and State safety and health agencies, as well as individuals responsible for monitoring safety and health at other governmental entities and non-governmental agencies. The only limitation on FDA appears to be a prohibition on the transmission of personally identifiable information from the adverse event report, such as names, addresses, and social security numbers. As such, FDA now has broad discretion to take adverse event reports and distribute them to a number of actors that could seek further investigations of adverse event complaints.

SOP:

MoCRA does not provide guidance concerning adverse event reports other than to state that the “responsible person shall receive reports of adverse events through the domestic address, domestic telephone number, or electronic contact information included on the label.” FDA has yet to establish where and in what form companies have to store such records or submit serious adverse event reports to the Agency.

FDA, however, has informally indicated that it believes cosmetic manufacturers and responsible persons should already be tracking adverse event complaints. Therefore, we suggest that SOPs be adopted as soon as possible that can guide your employees in collecting, recording, tracking, and submitting adverse event data, as necessary.

As part of your preparation for compliance, companies should already be considering setting up internal systems to collect, record, track, maintain, and submit complaints that include an adverse event. Such systems will likely require monitoring complaints submitted by mail, phone, email, or other electronic media, such as your webpage.

While MoCRA is silent as to what information will be required in the reports, we anticipate that the information will be similar to what the FDA collects through MedWatch with respect to adverse events associated with the use of prescription drugs and over-the-counter drugs. MedWatch has forms for reporting by a health professional as well as by the consumer/patient. You should attempt to gather from the consumer or health professional the information requested in these forms, including but not limited to:

• consumer contact information;
• other consumer information, including age, weight, date of birth, sex, gender, ethnicity, race, current prescription medications, over-the counter medications and vitamins, minerals, supplements, herbal remedies, and medical devises being used, preexisting medical conditions, and other relevant history such as allergies, pregnancy, tobacco product use, alcohol use, and liver or kidney disease;
• reporter contact information if health professional is reporting;
• name of the product, including its expiration date and lot number;
• date of first use of the product;
• date of last use of the product;
• date on which use of product was reduced, if applicable;
• purpose of using the product;
• amount of the product used at a time;
• frequency of use;
• where the product is used or applied to the body;
• as much detail as possible regarding the adverse event, including whether the event abated after the consumer stopped using the product or reduced use, whether the event reappeared after reintroduction of the product, and the outcome attributed to the adverse event;
• any relevant tests performed and/or laboratory results, including relevant dates; and
• whether the consumer still has the product available for evaluation, including a picture of the product if available.

After collecting the information, it should then be forwarded to a health professional such as a dermatologist to determine whether the complaint can truly be attributed to the product or a non-transient event that would rise to the level of an adverse event or serious adverse event. As a reminder, you should be cognizant of and comply with all applicable privacy laws for the collection, storage and sharing of an individual’s confidential information.

In addition to maintaining the records and submitting serious adverse event reports to FDA, we also recommend forwarding all reports you receive onto every other manufacturer, packer, and distributor of the product so that everyone in the supply chain can remain compliant with the adverse event requirements.

Given the FDA’s new authority to collect and distribute a company’s adverse event records, we suggest that any SOP includes the procedures necessary to treat adverse event records as confidential trade secrets. By doing so, a company may be able to prevent the FDA from transmitting certain information to other agencies that would otherwise not be entitled to such information under Federal or State law.

Getting Your Company Ready for Compliance:

We realize that preparing for MoCRA’s adverse event requirements may seem like a big undertaking, but Locke Lord’s FDA Regulatory and Cosmetics teams have experience with setting up and maintaining the systems necessary for compliance. We are available to assist your company with navigating these and the various other new requirements both before and after MoCRA takes effect.