The Phone Call that Comes Too Late

By Brett T. Schwemer

At least once a month, our USDA or FDA practice group receives that phone call…the phone call that comes from an existing or prospective food client at that point in time (and no sooner) when the proverbial “slop is about to hit the fan.”

In our experience, most food companies do a good job recognizing that they need regulatory or legal assistance. They just don’t always recognize it soon enough. While the old adage, “better late then never,” holds true when it comes to seeking regulatory or legal advice, the effectiveness of legal counsels’ or regulatory experts’ efforts in terms of the likelihood of a favorable outcome often hinges on how early these experts become involved.

There are many examples of when food companies have hurt themselves by waiting too long to seek regulatory or legal assistance.  Take, for example, a potential recall situation.  In many instances, companies do not seek assistance from legal counsel or other regulatory experts until just moments before an FDA or FSIS Recall Committee asks for a conference call with the company to discuss the matter.  At this point in time, the agency has likely already made up its mind that there is a need for a recall and has decided on the Recall Classification.  Convincing FSIS or FDA to accept a lesser action (like a market withdrawal) or lower classification (Class II or Class III recall instead of a Class I) at this point is often futile, particularly when there has not been adequate time for legal counsel or other experts to learn all the facts and prepare.  Engaging assistance early in the process, when a potential problem or contamination event is discovered and legal or regulatory experts can discuss the merits of a market withdrawal or a particular recall classification with the agency, will increase the chance of a favorable outcome.

Another re-occurring “late” call is from meat or poultry companies waiting until they receive a Notice of Alleged Violation from FSIS before they seek legal assistance.  A FSIS Notice of Alleged Violation is a letter that alleges violations of the Inspection Acts and threatens referral to a U.S. Attorney’s Office for criminal prosecution.  These letters are typically issued months, and sometimes years, after the alleged unlawful conduct occurred and after the agency has completed its investigation.  If a company waits until the issuance of a Notice of Alleged Violation to hire legal counsel, it will be difficult for counsel to gather the appropriate facts to defend the action, due to factors such as employee turnover at the company, faded recollections, and/or lost or destroyed records.  Even more importantly, by waiting to obtain legal counsel, the company has already missed the most crucial time that legal counsel is needed, i.e., during the process that FSIS collects records, interviews employees, and takes employee statements.  Once this evidence is provided, it is too late to argue that the records or statements were protected by company privileges, were taken out of context, or did not adequately portray the situation at hand.  For this reason, it is critical that companies seek legal counsel immediately after they become aware that there are allegations that could lead to criminal prosecution (e.g., allegations regarding shipment of adulterated or misbranded product, inhumane treatment of animals, fraud, etc.).

Finally, one of our most common late calls…the dreaded FSIS or FDA suspension action after numerous repetitive noncompliances.  In most cases, agencies make companies aware that they are on thin ice well before taking suspension actions.  If a company has been put on notice that its corrective actions are not preventing noncompliances from reoccurring, it may be time to seek outside experts to provide a fresh look at the situation.  In many instances, these experts can provide experience gained from representing clients in similar situations to recommend more effective corrective/preventive actions that a company may not have considered.  In some situations, these experts may also assist a company in appealing alleged noncompliances that are not based in fact or law, helping to ensure that potential enforcement actions are not based on faulty grounds.  In either case, seeking assistance early can help minimize the chance that the government agency will feel the need to take such a drastic action as shutting down an establishment.

Judging whether to seek outside assistance is not always an easy task.  Obviously, the ability to handle an issue in-house, the likelihood of adverse action/results and cost of services provided are factors to be considered. However, when it becomes likely that legal or regulatory counsel is needed, it is imperative that it is sought in a timely manner. Knowing when to seek legal or regulatory assistance could be the difference between a recall or market withdrawal, a criminal prosecution or a letter of warning, and a plant suspension or no action at all.

It Is “That” Time of Year

By Barbara J. Masters, D.V.M.

No, it is not time to face the Christmas shopping crowds, the kids have their back to school supplies, and we have made our fantasy football selections.  So what is it I am supposed to be dreading?  Oh yes, final days for government budgets, continuing resolutions, and possible government shutdowns.  What does this mean, how will the (fill in the blank) Agency be affected?

Well, obviously we don’t have those answers.  The Magic 8 Ball on my desk suggested that I “Ask Again Later.”  However, as I consider the potential impacts on the Food Safety and Inspection Service (FSIS), this is what my crystal ball envisions could happen if a government shutdown were to occur.  First, it is important to note that I have no inside knowledge, and am basing these comments on common sense, as well as my previous work that allowed me the opportunity to get to know many of the FSIS front line inspection personnel and my knowledge of the meat and poultry industry.

I believe that in government shutdowns, the Administrator is able to determine the “essential” personnel and “essential” mission critical functions.  The FSIS maintains a Continuity of Operations Plan (COOP) that provides the Administrator guiding principles in making these determinations.  For example, the employees that work in the plants conducting day-to-day inspection would most likely be determined to be “essential employees” conducting “essential functions.”  These employees are dedicated men and women that verify the safety and wholesomeness of our food supply on a daily basis.  With these devoted employees in place, working at meat and poultry establishments that are also committed to the same goal, I believe that we can continue to have the same confidence in our safe and secure food supply.

Additionally, my crystal ball indicates that the FSIS Administrator and lead management employees will be in place to ensure the essential day to day work and oversight of employees.  The crystal ball shows me there will be employees available to conduct recalls of products if this were to become necessary.  I also “see” necessary sampling being conducted — however, the crystal ball becomes very hazy when I look to see if any routine samples are being conducted, such as baseline studies.  I look deeper into the crystal ball and “see” that the Agency’s Food Safety Assessments, which evaluate the design of an establishment’s food safety system, would cease unless there was an emergency situation such as a foodborne outbreak.  I do not see labels being approved and, therefore, the industry may have difficulty updating product labels.  I do not see the Agency being able to provide technical support for small and very small plants.  I do not see training available for FSIS personnel.  My crystal ball also indicates that FSIS personnel might have to revert back to using paper to document tasks rather than documenting them in the newly updated computer system….

Yes, it is that time of year… Am I concerned?  Not about the safety of my food!  I am certain that extremely committed inspectors will be available, and that both inspectors and industry will do the job required to provide safe and wholesome meat and poultry for my family. However, I am concerned that there could be government employees not working, backlogs and delays in administrative activities.  And yes, this does affect all of us over time.  In my opinion, if these employees were not “critical” to the mission of FSIS, they would not be employed there in the first place.

Now, back to what Congress might do, either with the Continuing Resolution or actually completing further action on appropriations for FSIS, and the many other agencies important to the nation.  My Magic 8 Ball is either prophetic or stuck:  it still says “Ask Again Later.”

Before joining OFW Law, Dr. Masters served as Acting Administrator and then Administrator for the United States Department of Agriculture Food Safety and Inspection Service (FSIS) from March 2004 through January 2007.

Livestock & Meat Groups Want COOL Relief Pending WTO Review

By John G. Dillard

On Monday, a group of trade associations representing the spectrum of America’s beef and pork production system issued an urgent plea to USDA Secretary Tom Vilsack and the Office of the U.S. Trade Representative Ambassador Froman. The coalition wants USDA’s Agricultural Marketing Service (AMS) to hold off on enforcing new country of origin labeling requirements until the World Trade Organization (WTO) has an opportunity to hear Canada and Mexico’s challenge to the new regulations.

The groups requesting the delay represent the meat industry, grocers, and livestock producers. They assert that implementation of AMS’s new COOL labeling requirements, which will ban commingling of products with different countries of origin will be disruptive at many different levels of the meat production value chain. The groups indicate they are concerned that the new labeling scheme is vulnerable to a challenge before the WTO, which would require AMS to re-write the COOL Rule again.

Read the rest of this post on John Dillard’s Blog – Ag in the Courtroom.

FDA’s GRAS Review Process for Foods May Be Tested by Litigious Public Interest Group

By Bruce Silverglade and Mark L. Itzkoff

As reported in Politico this week, there has been a shake-up of sorts within the public interest advocacy community regarding the tactics used to pressure the Food and Drug Administration (FDA) into changing the way food ingredients deemed to be Generally Recognized as Safe (GRAS) are regulated or reviewed by FDA.  This development may have major implications for food companies who conduct self-determinations on the GRAS status of new ingredients and for companies who submit formal GRAS notifications to the agency.

For the last several years, policy controversies surrounding the FDA’s GRAS process have been a focus of the Pew Charitable Trusts which assigned two researchers to draft reports critical of the current process.  An essential pillar of the current law has been that a food company can self-affirm a substance as GRAS.  FDA approval or even notification is not needed.   Pew’s most recent report, published in the Journal of the American Medical Association,  found “ubiquitous” conflicts of interest in such GRAS determinations.  Pew researchers reviewed 451 GRAS notifications that companies voluntarily submitted to FDA between 1997 and 2012, and found that nearly two-thirds of those safety assessments were made by an expert panel selected by the manufacturer or a consulting firm.  About a fifth of those assessments were made by an employee of an additive manufacturer, according to Pew.

As we noted in an earlier post on this blog, the most recent Pew report suffers from major infirmities.  The authors of the Pew report do not take into account the fact that the safety evaluation in a GRAS determination must be based on peer-reviewed data that has been published in scientific journals.  In the blog post, we noted that before an article is published it is reviewed by independent experts in the same field.  When an article reports on scientific studies, such as toxicology studies, the experts review the study methodology, test data, and validity of any conclusions reached in the article.  Thus, contrary to Pew, the data used to support a GRAS determination is subject to independent review before it is even considered by the expert panel.

Nonetheless, the Pew researchers have now sought a new base to advocate for policy changes to the GRAS process.  The researchers left Pew and moved to the more aggressive Natural Resources Defense Council (NRDC).  This tussle within the public interest community may be of more than just passing interest.  Pew is known for its cooperative consensus building approach to working with the food industry and regulatory agencies.  NRDC doesn’t play that game.  Instead, it is known for using tactics ranging from bringing Hollywood celebrities to Washington, D.C. to lobby on Capitol Hill to running an aggressive public interest litigation project.  NRDC’s director of health programs, Linda Greer, Ph.D. an environmental scientist, says NRDC will focus on “whatever works” to strengthen food additive oversight.  This could include a mix of litigation and lobbying Congress.

NRDC’s litigation program is well known among the Bar; the group has brought dozens of precedent setting cases in the environmental protection area.  One case recently forced FDA action on the use of antibiotics in animal feed.  Dr. Greer, however, ought to re-familiarize herself with one of NRDC’s most famous Supreme Court cases, Chevron U.S.A. v. Natural Resources Defense Council.  That case set the Supreme Court’s legal test for determining whether to grant deference to a government agency’s interpretation of its own operating statute. Chevron is the Supreme Court’s clearest articulation of the legal principle “administrative deference,” i.e., the doctrine that requires courts reviewing an agency’s regulatory policies to defer to the agency’s own interpretations of it’s statutory authority even in situations where the intent of Congress is ambiguous, 104 S. Ct. 2781.

The GRAS Exemption is set forth in Section 201(s) of the Federal Food, Drug, and Cosmetic Act (FFDCA), 21 USC §321(s).  It was included in the statutory definition of “food additive” that was enacted in the 1958 Food Additives Amendment to FFDCA.  At that time, Congress recognized that some food ingredients would not require FDA pre-market clearance because their safety had been established by either previous use in food or information readily available to scientists.  See FDA, Substances Generally Recognized as Safe, 62 Fed. Reg. 18938, 939 (April 17, 1997).  NRDC may choose to argue in federal court that FDA has misinterpreted the portion of FDCA that establishes the GRAS exemption, or they may challenge individual GRAS determinations on an ingredient by ingredient basis.  However, given the Supreme Court’s decision in Chevron, the group might be advised to focus on bringing celebrities to Capitol Hill and hoping for the best.

MDR Reporting of Foreign Adverse Events — What is Your Obligation?

By Neil F. O’Flaherty

Under the U.S. Food and Drug Administration’s (FDA) Medical Device Reporting (MDR) Regulation, 21 C.F.R. Part 803, medical device manufacturers must report adverse events involving their devices to FDA when information reasonably suggests that:

  • Their device may have caused or contributed to a death or serious injury; or
  • Their device has malfunctioned, and it or a similar company device would likely cause or contribute to a death or serious injury if the malfunction were to recur.

See 21 C.F.R. § 803.50(a).

FDA’s long-standing policy has been that a manufacturer must report such adverse events occurring outside the United States, under the MDR Regulation, if the same or a similar device is marketed by the manufacturer in the U.S.  The rationale has always been that such foreign adverse events are relevant to the Agency’s assessment of the safety and effectiveness of the same or a similar device marketed by the manufacturer in the U.S.  The Agency most recently articulated its position in its latest draft MDR guidance:

. . . FDA considers an event that occurs in a foreign country reportable under the MDR regulation if it involves a device that has been cleared or approved in the U.S. — or a device similar to a device marketed by the manufacturer that has been cleared or approved in the U.S. — and is also lawfully marketed in a foreign country.  Devices may be manufactured to slightly modified specifications to meet standards in different countries.  If these changes do not substantially alter the performance of the device, then any adverse events that are MDR reportable events relating to such modified devices should be reported under the MDR regulation . . .

See “Draft Guidance for Industry and Food and Drug Administration Staff: Medical Device Reporting for Manufacturers” (issued on July 9, 2013) at page 33.  This seems to be a reasonable requirement where foreign events are relevant to the safety and effectiveness of the U.S. marketed device.  However, the Agency takes its policy further.  FDA has the following Q&A in the latest draft MDR guidance:

4.12.1 If I previously marketed a device that is still in commercial distribution, but have ceased manufacturing the device, do I still have an obligation to submit MDR reportable events?

Yes, as long as you remain in business, you have an obligation to report events involving any device that you manufactured, even if you cease marketing the device.  Note that you are not responsible for MDR reporting if you transfer ownership of a PMA or 510(k) for one of your devices to another company, and the new owner explicitly agrees to be responsible for MDR reporting obligations.  Both firms should maintain documentation of this arrangement for MDR reporting.

Id. at page 34.  According to FDA, this obligation to report foreign adverse events persists even if the manufacturer can demonstrate that no units of the same or similar device remain in the field in the U.S. or can demonstrate that the design and expected life of the last unit of a same or similar device, distributed in the U.S., has expired.  FDA takes the position that, if the product has been approved or cleared for marketing in the U.S., resumption of such marketing could take place at any time, making the interim foreign adverse events relevant to assessing the overall safety and effectiveness of the U.S. version of the device once U.S. distribution is resumed.

Obviously, the most conservative approach is to accept FDA’s interpretation and continue to file foreign adverse events until you go out of business or some new owner assumes responsibility.  This is the easiest approach to avoid potential disagreements with FDA over foreign event MDRs down the road.  However, if one were to be more aggressive, one might question whether FDA has a substantial governmental interest in receiving reports of foreign adverse events when there are no same or similar products in the field in the U.S. anymore or when the design and expected life of all such U.S. units has expired.  Arguably, there is only a hypothetical possibility that U.S. marketing of the same or a similar device will resume at some point in the future.  One might even wonder whether FDA’s policy would stand up to a legal challenge.

Finally, the policy is written in terms of products which are PMA-approved or 510(k)-cleared for marketing in the U.S.  It leaves open the question of how 510(k)-exempt products are affected by the policy.

MDR reporting plays an important role in the FDA device regulatory scheme as the Agency strives to monitor the safety and effectiveness of medical devices marketed in the U.S.  However, reasonable minds could differ over when a reporting obligation should end, especially in the above context.

HITECH First Amendment Challenge Delayed – HHS Promises Guidance and Agrees to Limited Enforcement Delay

By Mason Weeda

The Department of Health and Human Services (HHS) revealed in court filings yesterday that it expects to issue guidance regarding prescription refill reminder programs before September 23, 2013.  It also stated that it will not enforce the restrictions in its new HIPAA Privacy Rule regarding refill reminders and other communications about drugs or biologics until November 7, 2013.  See Joint Motion (Adheris Inc. v. Sebelius).  The Court promptly issued an order granting the joint motion and vacating the parties’ briefing schedule.  Claiming First Amendment violations, Adheris’s complaint and motion for a preliminary injunction seek to enjoin HHS from enforcing its HITECH Act-based marketing restrictions for refill reminders.

The Impact of the New Privacy Rule on Refill Reminder Programs

Adheris, Inc. administers prescription drug adherence and compliance messaging to patients.  These “refill reminder” letters include educational information about the patient’s disease condition, the drug’s side effects, dosage information and effects of non-compliance.  Prior to the new Privacy Rule these messages did not require patient authorization because they fell within the “treatment” exception from “marketing” communications.

As we recently observed, HHS’s new Privacy Rule did away with the treatment exception for third-party sponsored communications where that third-party’s product or service is being marketed.  Adheris’s refill reminder programs, which are sponsored by pharmaceutical companies, now require authorization unless any compensation flowing to the pharmacy is “reasonable in amount.”  Adheris’s pleadings present a sense of urgency due to the “chilling effect” that the new Privacy Rule has had on refill reminder and other adherence and compliance programs since it issued January 25.  Adheris states that it provides refill reminders for 38 pharmacy chains, and many of these chains have expressed concerns about the Privacy Rule’s marketing restrictions.  Some, in fact, according to the suit, have stopped contracting with Adheris entirely.  And Adheris is not alone – over the past several months, various consumer groups, pharmacies and drug manufacturers have complained that the language concerning exemptions for refill reminders will, in many instances, put an end to these programs.  For example, as we previously noted, CVS recently announced the discontinuation of its refill reminder programs.

The primary source of angst for healthcare providers and others in the industry that are involved in refill reminder programs lies in the preamble of the new Privacy Rule, where HHS defines “reasonable in amount.”  HHS’s definition is narrow and considerably ambiguous, only allowing for certain expenses and excluding a return on investment altogether (or profit) for the pharmacies.  We suggested in our May blog post that HHS guidance on the “reasonable in amount” limitation could allow these programs to continue by allowing for broader limitations of permissible costs, making it permissible for providers to effectively provide patients with adherence and compliance messaging without having to obtain authorization.  HHS keeps promising to issue guidance.  Adheris may, however, be forced to move forward with its case if HHS fails to issue something promptly that clarifies these issues and expands the scope of the exception and the permissible costs.

The First Amendment Challenge

In the 2011 Supreme Court’s opinion in Sorrell v IMS Health, Inc., the court affirmed that “speech in aid of pharmaceutical marketing . . . is a form of expression protected by the Free Speech Clause of the First Amendment” and that the free flow of information “in the fields of medicine and public health . . . can save lives.”  Sorrell involved a Vermont statute that prohibited, absent physician opt-in, the sale disclosure and use of pharmacy records that reveal the prescribing practices of that doctor.  See our January 2013 blog which discusses Sorrell arguments.  In Sorrell, the Court applied a heightened standard of scrutiny to the Vermont statute, raising the bar from intermediate scrutiny which traditionally is applied in First Amendment cases involving commercial speech.  The Court subjected the Vermont statute to the heightened standard because it imposed content-based and speaker-based restrictions.

Adheris’s arguments rely on Sorrell’s application of “heightened scrutiny” because HHS’s marketing restrictions impose both content-based and speaker-based restrictions.  The marketing restrictions are content-based because they apply only to communications that encourage individuals to purchase or use a third party’s product or service.  The restrictions are also speaker-based because they discriminate against speakers who communicate in exchange for payment from a third-party whose product or service is being described.  Similar speech by other speakers would, however, not be subject to the same treatment under the rule.  The final rule preamble states, for instance, that funding of refill reminder programs by non-profits, such as “a breast cancer foundation” for mammography screening would not trigger the authorization requirement and it would be permissible for the pharmacy that sends the message to profit.  However, if a pharmaceutical manufacturer made the same payment for the same program, the payment and the resulting communication would not be permitted unless the “refill reminder” exception – including its limitations on compensation – was satisfied.

In applying a “heightened scrutiny” standard, the government must show that its attempt to restrict speech advances a substantial government interest.  In Sorrell, the Court found that Vermont’s justifications for restricting speech did not withstand heightened scrutiny.  Adheris’s pleadings similarly emphasize that HHS’s marketing restrictions do not directly advance a substantial government interest, which is perhaps best exemplified by HHS’s support of such communications in other contexts (e.g., Medicare Part D, MTMP, incentives for “meaningful use”).  In addition, HHS cites no harms or dangers of refill reminders.  Indeed, there are significant benefits of refill reminder programs (e.g., adherence and compliance messaging results in fewer hospitalizations, lower mortality, and cost savings).  Furthermore, HHS’s refill reminder restrictions serve no legitimate privacy interests.  Rather, HHS is restricting Constitutional speech by treating adherence and compliance messages differently depending upon who compensates the speaker and whether the speaker derives a profit.

A Resolution?

Given the well-recognized benefits of adherence and compliance messaging, public interests will be best served with prompt resolution of this issue and it appears that HHS recognizes that Adheris’s claims may be meritorious.  HHS has slowed the judicial process temporarily, so the question is whether HHS will issue guidance that adequately addresses industry concern regarding the restrictions on refill reminders so that these programs can continue to move forward.  The parties are required to file a status report on September 27 and we are eager to see where things stand at that point.

Judge Denies Attempt to Stop New COOL Rule

By John G. Dillard

Opponents of USDA’s new mandatory Country-of-Origin-Labeling (mCOOL) rule received a setback this morning.  A federal judge denied the mCOOL opponents request for a preliminary injunction, which would have halted implementation of the new labeling rule pending ultimate resolution of whether the new mCOOL rule was lawful.

Opponents of the mCOOL rule argued that the new mCOOL compelled speech that was in violation of the First Amendment and that USDA’s new rule was an “arbitrary and capricious” agency action that was not in line with Congress’ intent in requiring country-of-origin labeling on fresh meat products. Furthermore, opponents argue that compliance with the labeling requirements will require fundamental structural changes in the American meat industry that will lead to discrimination against Mexican and Canadian livestock. (Disclosure: I represent North American Meat Association, one of the plaintiffs in this matter).

Read the rest of this post on John Dillard’s Blog – Ag in the Courtroom.

The FTC and Keeping Privacy Promises

By Tish Eggleston Pahl and Jonathan M. Weinrieb

In 2012, identity theft was the number one complaint reported to the Consumer Sentinel Network.  Protection of private consumer information continues to be a high priority for law enforcement and any business dealing with consumer information – that is, everyone – needs to keep abreast of what the Federal Trade Commission (FTC) is up to.  The FTC has frequently pursued companies that failed to adhere to their own security and privacy policies as a violation of Section 5 of the FTC Act.

Making good on that commitment, last week the FTC filed an administrative complaint against Atlanta-based LabMD alleging that the medical testing laboratory failed to protect the personal data and medical information of some 10,000 consumers.  According to the FTC press release, information about LabMD patients, including names, Social Security numbers, dates of birth, insurance providers, and treatment codes, was found on a peer-to-peer (P2P) file-sharing network and provided to the agency.  Sensitive personal information of some 500 LabMD patients was also found in the hands of identity thieves.

The FTC alleges that LabMD violated the FTC Act by failing to take reasonable and appropriate measures to prevent these purported unauthorized disclosures of sensitive consumer data.  It might be assumed that the U.S. Dept. of Health and Human Services (HHS) Office for Civil Rights (OCR) would be the one bringing cases for alleged medical privacy breaches – and they do.  OCR enforces, among other things, the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act).  The FTC, however, has long pursued companies who disclose consumers’ sensitive information in violation of the FTC Act and the FTC and OCR have brought cases jointly.

For instance, in February 2009, CVS Caremark settled with the FTC for violations of the company’s own privacy policy, in violation of the FTC Act, and with OCR for violations of HIPAA.  The investigations and settlements followed disclosures in the media that CVS pharmacies were throwing into unsecured trash bins pill bottles and order information that included, among other things, patient names, addresses, medications, social security numbers, and other confidential information.  There was a similar cooperative case the FTC and OCR settled with Rite Aid in July 2010.

There does not appear to be any explanation for why OCR is not participating in the FTC’s pursuit of LabMD.  Perhaps it is busy drafting much-needed guidance clarifying the refill reminder exception to patient authorization under HIPAA/HITECH.

LabMD is vigorously disputing the FTC’s version of events.  The company accuses the FTC of going on a fishing expedition, appearing to assert that another entity, Tiversa, stole LabMD’s data and then tried to force the company into a service agreement.  The FTC claims, conversely, that LabMD is refusing to cooperate with the investigation.

In the meantime, the FTC offers a business guide on P2P file sharing.  The agency is also sponsoring a workshop on November 19 on The Internet of Things to start up a dialogue about the growing connectivity of consumer devices, such as cars, appliances, and medical devices.  Given that consumers are now doing things like turning their house lights on and monitoring their blood pressure from their mobile phones, assuring security of medical and other private information is a natural outgrowth of the FTC’s interest in the issue.

Companies collecting consumer and patient information should take note and continue to keep abreast of the FTC’s (and HHS’s) activities.  As a former FTC Chairman stated in January 2013, in announcing a settlement with a leading cord blood bank, “[t]he FTC can and will take action to make sure that companies live up to the privacy promises they make to consumers, particularly when it comes to highly sensitive information like the health information.”

FDA Proposed Reg will be “Game Changer” for Auditing and Certification Organizations

By Bruce Silverglade

Get ready, set, go!  After years of delay, FDA is now on a fast-track to finalize its proposed regulation on accreditation of third-party auditors in accordance with the Food Safety Modernization Act (FSMA), 78 Fed. Reg. 45,781 (July 29, 2013) Accreditation of Third-Party Auditors and Certification Bodies.  The agency also issued a proposed rule on the Foreign Supplier Verification Program, (FSVP) that, as a practical matter, turns some food importers into de facto public health officials, who will likely rely on third-party auditors and certifiers to ensure that imported food is safe to enter the U.S.

A FDA “public meeting” for stakeholders is scheduled for September 19-20; written comments are due by November 26; and the agency is under a federal court Order to finalize the proposed regulation (and other FSMA rules) by June 2015.

Those in the business of auditing and certifying food production facilities may be in for some big changes if FDA’s proposed regulation is finalized “as is.”  Hopefully, the agency will be persuaded by comments it receives.  The White House Office of Management and Budget OMB), and the House Appropriations Committee, will also have a major role in influencing whatever FDA attempts to finalize.

FDA characterizes the use of auditing and certification as “voluntary.”  However, as a practical matter, private-sector auditing and certification services are essential to the operation of FSVP, a defining portion of FSMA, which places a burden on importers to assure food safety.  Auditing and certification will also play a central role in the yet to be proposed Voluntary Qualified Importer Program that is set out in FSMA and which permits FDA to give import preferences to foods subject to third-party audits and certifications.

Ominously, at the end of its preamble to its proposed regulation, FDA cites the U.S. government’s obligations under the World Trade Organization Agreement to treat domestically produced food the same as imported food and states that: “We realize that the same principles that are features of a rigorous and credible program for audits of foreign firms would likewise hold great merit for audits of domestic food facilities.”  78 Fed. Reg. at 45823.  So in short, the proposed regulations for auditing and certifying imports may become the de facto rules for auditing and certifying domestically produced foods.

Some of the largest problems that could literally change the auditing and certification industry are FDA’s proposed reporting and notification requirements.  The results of “Consultative Audits” (traditionally referred to in the industry as “second-party audits”) need not be automatically reported to FDA.  (FDA may obtain access to them under the emergency provisions of the Bioterrorism Act  if the agency has a reasonable belief that an article of food presents a threat of serious adverse health consequences).  That’s a good thing because the purpose of a consultative audit is to confidentially advise a food production facility to fix problems before they cause serious injury.  This is in contrast to the purpose of what the industry traditionally refers to as a “third-party” audit, now known under FSMA and FDA’s proposed  rule as a “regulatory audit.”  Under FSMA, the primary purpose of this type of  audit is to obtain a certification acceptable to FDA under FSMA’s FSVP and VQIP programs.

Disclosing confidential advice typically given by an auditor to a food company would cause the current system to implode; few companies would want to use FDA accredited auditors if they were required to “blow the whistle” on a food company’s good faith, behind the scenes efforts, to correct problems and make improvements.

Under the proposed regulation, FDA states that an accredited auditor conducting a “consultative audit” must notify FDA if it finds a “serious risk to public health,” including risk levels akin to those matters that give rise to both Class I and Class II recalls.

FDA’s proposed regulation, as it now stands, would have the unintended effect of providing incentives for food production facilities to use unaccredited auditors who have no regulatory obligation to report to FDA risks discovered during a consultative audit.  FDA specifically requests comments on the issue, 78 Fed. Reg. 45815.  That means FDA knows that the proposal suffers from infirmities and that the agency may be on weak legal ground if it attempts to finalize the provision in its current form.

Further blows to all-important confidentiality include a provision in FDA’s proposed regulation that requires laboratory testing results conducted during a consultative audit (whether conducted by an accredited third-party auditing and certification company’s own labs or another FDA accredited laboratory) to be sent directly to FDA.  This proposed requirement could similarly result in unintended consequences by providing food companies an incentive to use unaccredited auditors for consultative audits in order to keep results and recommendations confidential.

Ideally, FDA’s proposed regulation should support and encourage expansion of reasonably regulated auditing and certification services as contemplated by the drafters of FSMA.  However, broad reporting requirements and submission to FDA of laboratory reports for consultative (not just regulatory audits resulting in certification under FSMA may have the opposite effect and cripple the most credible members of the auditing and certifying industry, as some food production facilities move to use unaccredited entities for consultative purposes.

The fact that statements made to an accredited auditor carries the same legal liability, including the possibility of criminal prosecution, as statements made to FDA itself doesn’t help.  Auditing and certification companies, as well as food companies, have good reason to fully participate in the rulemaking process.

The process has now officially begun and will continue through next year.  FDA’s first “public meeting” on the matter is not just an exercise in government transparency and public participation.  FDA relied on statements made at previous “public meetings” to justify key parts of its proposed regulation.  FDA will likely do the same to justify whatever it comes up with for a final regulation.  Agency justifications are essential because if a final regulation is challenged in federal court, the court will look at the agency’s justification to determine if FDA engaged in “reasoned decision-making.”

By weighing in now, and remaining persistent during the rulemaking process, those with a stake in the outcome of FDA’s final regulation will have the best chance of making sure the agency makes sound public policy choices and avoids final rules that have unintended consequences.