Why Did McKesson Receive the First DSCSA Warning Letter?

FDA issued the first warning letter that cites failure to comply with requirements of the November, 2013 Drug Supply Chain Security Act (DSCSA) amendments to the FD&C Act. This warning letter was issued to McKesson Corporation in San Francisco CA on February 7, 2019, based on observations from a form 483 issued at the close of the inspection on July 3, 2018.  

First of a kind enforcement actions are always of interest in terms of what they tell us about the FDA’s potential future enforcement in this area. Also, the text in the enforcement action provides insight into what the FDA found to be the specific objectionable activity or process so others who operate in this area may evaluate their procedures and processes.

Let’s take a look at this warning letter, but first, let’s look at why McKesson may have received the first warning letter in this category.

Why McKesson?

On the whole, FDA inspections of McKesson facilities in the past few years have seemed unremarkable. In the past three years, FDA conducted 39 inspections at 16 McKesson sites. Only 7 inspections received a form 483.

Also, where information in the form 483’s is available, FDA cites 21CFR211 and not the DSCSA as they have in the warning letter (FDAzilla data). While this set of inspections seems more frequent that I might have predicted, the outcomes didn’t raise particular concerns.

The form 483 and warning letter should be required reading for all distributors of pharmaceutical products.

McKesson, however, has been front and center, along with Amerisource Bergen and Cardinal Health, in legal actions associated with the opioid epidemic. On January 17, 2017, McKesson agreed to pay a $150 million settlement for failure to report suspicious orders of pharmaceutical drugs. Associated with this settlement is a compliance addendum and an Administrative Memorandum of Agreement.

Further, “The nationwide settlement requires McKesson to suspend sales of controlled substances from distribution centers in Colorado, Ohio, Michigan and Florida for multiple years. The staged suspensions are among the most severe sanctions ever agreed to by a Drug Enforcement Administration (DEA) registered distributor. The settlement also imposes new and enhanced compliance obligations on McKesson’s distribution system.”

So, we have exceptional visibility regarding failure to comply with controlled substance regulations and the DSCSA requirements to investigate the suspected illegitimate product and communicate the information to relevant trading partners which have been placed since 2015.  

As described in the warning letter, illegitimate product notifications were submitted to FDA that identified problems with product received from McKesson, including, but not limited to, oxycodone. So, despite the unremarkable inspection history, McKesson, or another firm in the same position, appears ripe for this type of action when associated with controlled substances. In my experience, when taking a first-of-its-kind enforcement action, FDA carefully selects its target company to be a significant player in the area so that all similar firms will pay close attention.

The form 483 and warning letter should be required reading for all distributors of pharmaceutical products. Firms should assess whether they too may be vulnerable to similar enforcement action and take immediate steps to remediate procedures and practices. I would not be surprised to see several additional warning letters on this same topic. Hopefully, though, firms will take immediate action to fix shortcomings and ensure that the drug supply chain is secure and continues to protect the public health.

Now, let’s back up a bit and look at some background regarding the DSCSA requirements, the form 483 that precipitated the warning letter and then the warning letter itself.

Background

The DSCSA amendment to the FD&C Act includes two sections:

• Title I addressed drug compounding and established the concept of ‘outsourcing facilities,’ and
• Title II addressed drug supply chain security.

The McKesson warning letter focuses on the requirement that manufacturers, re-packagers, wholesale distributors and dispensers must establish systems for verification and handling of the suspect or illegitimate product, including communication with relevant trading partners.

We’re going to focus only on Title II. Implementation of the requirements in the legislation began in 2014, and additional requirements are being phased in through 2023.

The McKesson warning letter focuses on the requirement that manufacturers, re-packagers, wholesale distributors and dispensers must establish systems for verification and handling of the suspect or illegitimate product, including communication with relevant trading partners.

The legislation addresses a variety of requirements including:

• Product identification and ability to trace product through the supply chain;
• Verification of the product identifier by members of the supply chain;
• Detection and responses to the potential suspect product including those that may be ‘counterfeit, unapproved or potentially dangerous’;
• Notification of FDA and trading partners when an illegitimate product is identified;
• Wholesaler licensing and licensing of third-party logistics providers.

FDA published a collection of guidance and policies addressing the various requirements in the legislation.

Effective January 1, 2015 trading partners are required to quarantine and investigate suspect product to determine whether it is illegitimate and to notify FDA and trading partners if the illegitimate product is found.

FDA published guidance on the topic, Identification of Suspect Product and Notification, in December 2016. This was clearly a situation where the firm had plenty of time to come into compliance. We will start with the form 483 issued at the close of the inspection.

McKesson Inspection, Form 483

The form 483 was issued to the Assistant General Counsel at McKesson and identifies three observations:

• The firm’s systems to comply with FD&C Act section 582(c) are deficient because the firm could not demonstrate that they verified if a reported suspect product existed in their facility(ies) and they could not demonstrate that the reported suspect product was quarantined while an investigation was conducted.
• The second observation is effectively a repeat of the first, where the firm did not quarantine the product or work with trading partner(s) to disposition illegitimate product, not in possession of the firm.
• The third observation addresses deficiencies in systems and procedures to make notifications to trading partners. McKesson failed to retain adequate information to effectively notify trading partners.

The warning letter, issued approximately seven months after the inspection close, was sent to the CEO of McKesson.  

McKesson Inspection, Warning Letter

The warning letter dated February 7, 2019, identifies an inspection of the corporate headquarters in San Francisco, CA and references the inspection of a McKesson facility in Oregon that ended June 29, 2018.

It’s interesting that the FDA would reference the inspection in Oregon because no form 483 was issued (see FDAzilla data). Where FDA references another inspection in a warning letter, it generally includes observations similar to the one that led to the warning letter. That alone raises an interesting question of why this inspection was identified.

The question is addressed in Example 2 in the warning letter. It is also interesting that the examples provided in the warning letter are from mid to late 2016.

Obviously, FDA had the information for almost two years before they inspected the San Francisco site. That begs the question of why the delay in inspection and enforcement action.

The warning letter identifies three deficiencies where McKesson Corp failed to comply with the requirements of section 582(c)(4). The warning letter also describes three examples supporting their conclusions and three examples of inadequate corrective actions.

Deficiencies

1. Your firm failed to respond to illegitimate product notifications as required, which includes identifying all illegitimate product subject to such notifications in your possession or control and quarantining such product (section 582(c)(4)(B)(iii))
2. Your firm failed to quarantine and investigate suspect product (section 582(c)(4)(A)(i))
3. Your firm failed to keep, for not less than 6 years, records of the investigation of suspect product and the disposition of illegitimate product (sections 582(c)(4)(A)(iii) and 582(c)(4)(B)(v)).

Example 1

Example 1 describes examples of product received at three Rite Aid pharmacies in September and October 2016 where bottles of oxycodone hydrochloride were either empty or were substituted with other pharmaceutical drugs.

McKesson also told FDA investigators that “…incidents involving stolen or diverted controlled substances are not treated as Drug Supply Chain Security Act (DSCSA) verification events within the firm.”

It is worth noting that the first example FDA cites is associated with controlled substances, and is the lengthiest example in the warning letter highlighting its importance. The product was manufactured by Mallinckrodt who reported this event to the FDA. Rite Aid communicated to McKesson that they provided the product.

Upon investigation, McKesson determined it was likely that the oxycodone was replaced with other products while they were in McKesson’s control. McKesson, however, failed to demonstrate that they identified all illegitimate product subject to the notification and placed them under quarantine.

FDA expected they would search for product with the same lot number or NDC. McKesson also failed to notify immediate trading partners who may have received a product with the same lot number or NDC. They also could not provide records demonstrating the disposition of these illegitimate products.

McKesson also told FDA investigators that “…incidents involving stolen or diverted controlled substances are not treated as Drug Supply Chain Security Act (DSCSA) verification events within the firm.” Personally, that seems to be a troubling conclusion, and it seems FDA felt the same way.

Example 2

Example 2 addresses reports from Albertson’s who received product from McKesson that were missing both lot number and expiry date. Albertson’s reported these events to McKesson and FDA in December 2016. These events did not involve oxycodone products. The lack of lot number and expiry date is an example of a specific scenario described in the guidance ‘Identification of Suspect Product and Notification’ as a situation “…that might increase the likelihood that they are suspect products.”

This alone should have triggered some action or further investigation by McKesson. Even after being contacted both by Albertson’s and FDA, the warning letter states that McKesson did not demonstrate that they quarantined all products and conducted an investigation to determine whether the products were confirmed as illegitimate.

Moreover, here is where the Wilsonville, Oregon site mentioned earlier in the warning letter enters the story. McKesson provided documentation that they notified the Oregon facility of this event(s). The Oregon site denied receiving a quarantine notice. Further, no evidence of the quarantine notification was found in McKesson’s electronic system. There was no evidence that other distribution centers were notified to confirm the presence of these drugs and place them under quarantine.

FDA further stated that “Your firm did subsequently provide what appears to be an inventory listing query, with handwritten notes, that seems to document your inventory check of these products at your Oregon facility. However, the handwritten notes were undated, unsigned, and were not made available to FDA investigators at the Wilsonville, Oregon, facility, which previously denied receiving the notification to quarantine these products.”

Example 3

Example 3 addresses notification from GlaxoSmithKline who received a report in June 2016 from a pharmacy of two sealed bottles of product that did not contain the product identified on the label. The pharmacy received the product from McKesson. McKesson could not provide records demonstrating that they examined their remaining inventory for the product in question.

McKesson was unable to determine if they possessed the suspect product and to notify trading partners as required.

The warning letter also provides comments on three corrective actions proposed by the firm.  

• McKesson stated that “incidents related to potential diversion and theft issues…the incidents were not necessarily to suspect or illegitimate products.” FDA responded that these “…statements demonstrate a lack of understanding of the definitions of suspect and illegitimate products and your firm’s responsibilities when notified of an illegitimate product by a trading partner.”  
• The firm’s response did not provide adequate supporting documentation, and so FDA did not have sufficient information to conclude that McKesson will conduct investigations of suspect product in a manner compliant with the DSCSA.
• McKesson committed to forming a ‘Product Safety Committee” with responsibility to coordinate all actions regarding suspect project. They failed to describe membership of the committee, or how the proposed changes will impact McKesson’s compliance with verification requirements of the DSCSA.  

As part of their response to the warning letter McKesson is to identify actions they “have taken to (1) correct the violations identified in this warning letter, and (2) identify and conduct appropriate investigations and follow-up related to other reports of suspect or illegitimate product that you have identified or received. Please include an explanation of each step being taken to prevent the recurrence of violations and include copies of related documentation. Also, provide the steps your firm has taken to prevent incidents of theft and diversion.”

In Conclusion

The form 483 and warning letter should be required reading for all distributors of pharmaceutical products. Firms should assess whether they too may be vulnerable to similar enforcement action and take immediate steps to remediate procedures and practices.

This isn’t an issue that will simply go away. I would expect to see additional enforcement in this area and we will keep you up to date as that happens.