McKesson’s DSCSA 483 Explained

Back on July 3, 2018 the FDA issued a notice of “inspectional observations”—known as an “FDA Form 483”—containing observations that appeared to the inspector to be potential violations of certain sections of the Drug Supply Chain Security Act (DSCSA).  The FDA recently posted the form on their website, but did not post the response from the company.  I assume McKesson would have contested it.  Without knowing what McKesson said to the FDA in response, let’s take a closer look at the FDA’s logic and come up with our own thoughts.

A 483 is not a report of a definite violation, but whenever a company receives one after an FDA inspection, everybody tends to panic.  According to the FDA’s 483 Q&A:

“Companies are responsible to take corrective action to address the cited objectionable conditions and any related non-cited objectionable conditions that might exist.”

But FDA inspectors are human.  Sometimes they get it wrong.  The DSCSA is so complex, maybe they got this one wrong.

483s issued to other companies in the supply chain are valuable resources for companies to analyze so they can learn how the FDA interprets certain sections of the Food, Drug and Cosmetics Act (FD&C) before their own facilities are inspected.  McKesson’s July 3, 2018 483 can be downloaded here.

The McKesson 483 contains three main observations:


This observation is that McKesson failed to keep records to document that they met their own policy—which is based on DSCSA requirements—to perform “self-checks” of distribution center inventory whenever they receive a suspect or illegitimate product notification (see “DSCSA Guidance: Definitions of Suspect and Illegitimate Product for Verification Obligations” and “DSCSA Verification and Suspect Product”).  And, they failed to record whenever they quarantined suspect product after they received a notification and during their investigation.  The FDA inspector is not claiming that these things were not done, only that they were not documented as having been done, so there is no way for the inspector to confirm that they were done after-the-fact.

This is a valuable lesson for every company in the supply chain, not just wholesale distributors.  First of all, you need to draw up policies—Standard Operating Procedures (SOPs)—that establish what you will do in the event you receive suspect product, and whenever you or someone else determines that product in your possession is illegitimate.  Second, you need to include the capturing of records that you actually did those things when necessary, including who, what, when, where and how.  According to the first observation in the 483, McKesson allegedly did not do that.


This observation implies that McKesson failed to meet the DSCSA requirements regarding illegitimate product [Section 582(c)(4)(B)] when they were apparently notified by a trading partner of illegitimate product that was actually in their possession.  This includes quarantining the product, working with a trading partner to disposition the illegitimate product not in their possession or control, and retaining a sample of the illegitimate product.  At least they allegedly failed to “demonstrate compliance”, which could just be another record-keeping deficiency, although failing to retain a sample of the illegitimate product implies that it may be more serious than that.

This is another valuable lesson for every company, again, not just wholesale distributors.  Whenever illegitimate drugs are involved, you need to take it very seriously.  Follow your SOPs and document everything (see “FDA Finalizes Guidance On Suspect Product”).  Consult the text of the DSCSA.  Understand what is expected of you—and keep samples for inspection by the FDA.  Every notification or determination of illegitimate drugs should immediately be raised to the level of senior management.  Yes, in my view, McKesson’s CEO should have been made aware of this occurrence the day it happened (not the 483—I’m talking about the original illegitimate drug episode!) at least until these events are smoothly operationalized and everyone knows how serious to take them.


This is where things get really interesting.  In this observation the FDA inspector implies a requirement that goes beyond the current requirements of the DSCSA.  Here is the inspector’s main statement:

“Systems and procedures to make notifications following determination of an illegitimate product are deficient in that they do not instruct notifications to all immediate trading partners, and sufficient tracing information is not retained to identify trading partners that received such product.”

First a little background.  Until November 27, 2023, the DSCSA does not require the first wholesale distributors (those buying drugs directly from the manufacturer, the exclusive distributor of the manufacturer, or a repackager that purchased directly from the manufacturer—known as “direct purchases”) to include the lot number of the drugs, among other things, in the Transaction Information (TI) they supply to their customers (see “DSCSA: Special Privileges For The “Big-3” Wholesale Distributors, Part 1” and “…Part 2”).  The DSCSA doesn’t explain exactly why, but it’s kind of obvious.  The lot number is not yet encoded into the barcode, so for “direct purchases”—which are the highest volume of any purchases in the supply chain)—the burden to capture the lot numbers on shipments would be well beyond practical.

The DSCSA is implemented in a series of escalating steps spread over a ten year period.  Even though the lot number will be encoded in all newly packaged drugs that enter the supply chain through manufacturers and repackagers after this November, the DSCSA still doesn’t require direct purchase wholesale distributors to include the lot number in the TI provided to their customers until 2023.  Given the time spread of the escalating requirements, that makes sense.

But in this 483 observation, the FDA inspector indirectly called out the additional requirement found in Section 582(c)(4)(B)(ii)

“Upon determining that a product in the possession or control of the wholesale distributor is an illegitimate product, the wholesale distributor shall notify the Secretary and all immediate trading partners that the wholesale distributor has reason to believe may have received such illegitimate product of such determination not later than 24 hours after making such determination.”

This section has been in effect for wholesale distributors since January 1, 2015.  McKesson apparently had this requirement built into their SOP, but because they were not capturing lot numbers on shipment—in appropriate accordance with their role as a “direct purchaser”—they have no ability to know exactly which customers might have received the illegitimate product.  And since you can’t tell in advance exactly which products will be the subject of a future illegitimate drug notification or determination, this 483 observation seems to expect wholesale distributors to capture the lot numbers printed on even direct purchased product.  They wouldn’t have to pass the lot numbers on in the TIs they construct, but they would have to keep a record of which customers were shipped which lots—which is just as difficult to do.

From the text of this 483 it appears the FDA inspector believes McKesson’s illegitimate drug handling SOPs are deficient, not that McKesson failed to follow the DSCSA in a specific instance of illegitimate drugs.  But in my view the third observation is a stretch.  In the instance of an illegitimate drug prior to November 2023 wholesale distributors should be allowed to notify any customer who purchased the NDC that was involved in the event over an appropriate time range, regardless of lot number.  That fulfills the requirement in my view, without forcing wholesale distributors to take actions today that the law doesn’t mandate until 2023.  Otherwise it’s just a “Catch-22”.

I don’t know what led the FDA to perform this inspection in the first place.  It is possible that it was triggered by an actual instance of illegitimate drugs being found in the supply chain.  Or perhaps the FDA just performed a surprise inspection to see McKesson’s DSCSA-mandated SOPs.  Could you pass such a surprise inspection?  If not, you’d better get ready.