WARNING LETTER
McKesson Corporation Headquarters 2/7/19 MARCS-CMS 565854 —
- Delivery Method:
- VIA SIGNATURE CONFIRMED DELIVE
- Recipient:
-
Recipient NameJohn H. Hammergren
-
Recipient TitleChief Executive Officer
- McKesson Corporation Headquarters 2/7/19
One Post Street
San Francisco, CA 94104
United States
- Issuing Office:
- Division of Pharmaceutical Quality Operations IV
19701 Fairchild Rd
Irvine, CA 92612
United States- 949-608-4417
February 7, 2019
John H. Hammergren
Chief Executive Officer
McKesson Corporation
One Post Street
San Francisco, California 94104
Dear Mr. Hammergren:
From June 25 to July 3, 2018, U.S. Food and Drug Administration (FDA) investigators conducted an inspection at your corporate headquarters located at One Post Street, San Francisco, California. FDA investigators also inspected your distribution center facility at 9700 SW Commerce Circle, Wilsonville, Oregon, from June 26 to 29, 2018.
This warning letter summarizes significant violations of the verification requirements found in section 582(c)(4) of the Federal Food, Drug, and Cosmetic Act (FD&C Act) (21 U.S.C. 360eee(c)(4)). These verification requirements are intended to help preserve the security of the supply chain for prescription drug products, thereby protecting patients from exposure to drugs that may be counterfeit, stolen, contaminated, or otherwise harmful. The verification requirements at issue include those that apply to wholesale distributors when they determine or are notified that a product is suspect or illegitimate.[1]
FDA issued a Form FDA 483 to McKesson Corporation at its San Francisco corporate headquarters on July 3, 2018. FDA reviewed your firm’s responses, dated July 25, 2018, September 25, 2018, and November 4, 2018.
During FDA’s inspection, FDA investigators observed that your firm failed to have systems in place to enable compliance with the verification requirements of section 582(c)(4) of the FD&C Act. Specific violations include, but may not be limited to, the following:
1. Your firm failed to respond to illegitimate product notifications as required, which includes identifying all illegitimate product subject to such notifications in your possession or control and quarantining such product (section 582(c)(4)(B)(iii)).
2. Your firm failed to quarantine and investigate suspect product (section 582(c)(4)(A)(i)).
3. Your firm failed to keep, for not less than 6 years, records of the investigation of suspect product and the disposition of illegitimate product (sections 582(c)(4)(A)(iii) and 582(c)(4)(B)(v)).
Failure to comply with any of the requirements under section 582 of the FD&C Act is a prohibited act under section 301(t) of the FD&C Act (21 U.S.C. 331(t)).
Example 1: In September and October 2016, McKesson was notified by your pharmacy trading partner, Rite Aid, that three separate Rite Aid pharmacies received illegitimate product, which they reported had been distributed by McKesson.
Initially, McKesson was notified by Rite Aid on September 1, 2016, that their pharmacy located in Milford, Michigan, received a bottle labeled as containing 100 tablets of oxycodone hydrochloride (NDC 0406-8530) manufactured by Mallinckrodt. The seal of the bottle was broken, and the bottle contained no oxycodone hydrochloride. The bottle contained only 15 tablets, which were later determined to be naproxen. Rite Aid reported to McKesson that it had received this product through a transaction with McKesson. Mallinckrodt submitted an illegitimate product notification (via Form 3911) to FDA about this oxycodone hydrochloride, noting that “the tablets that were in the bottle were foreign tablets.”
Rite Aid’s pharmacy located in Waterford, Michigan, also received illegitimate product, which they reported had been distributed by McKesson. The pharmacy received one bottle, also labeled as containing 100 tablets of oxycodone hydrochloride, which had a broken seal and did not contain oxycodone hydrochloride. The bottle’s contents were also replaced with 15 tablets of naproxen. Rite Aid reported to McKesson that it had received this product through a transaction with McKesson. On September 15, 2016, Rite Aid alerted McKesson by email about this discovery of product with missing tablets. Mallinckrodt submitted an illegitimate product notification to FDA (via Form 3911) about the oxycodone hydrochloride, noting that the Rite Aid pharmacy in Waterford “reported that upon opening a bottle of Mallinckrodt Oxycodone 30mg the seal was broken and 100 tablets of Oxycodone 30mg were missing. Fifteen tablets of generic Aleve ([n]aproxen sodium 220mg tablets) manufactured by Amneal Pharmaceuticals were inside the bottle.”
On October 6, 2016, Rite Aid’s pharmacy located in Warren, Michigan, also received illegitimate product, which they reported had been distributed by McKesson. The pharmacy had ordered five bottles of oxycodone hydrochloride. In three of the bottles they received, all the oxycodone hydrochloride had been removed. These three bottles contained various combinations of naproxen and ciprofloxacin hydrochloride. Mallinckrodt submitted an illegitimate product notification (via Form 3911) to FDA about these products, noting that “three bottles were missing all 100 tablets of [o]xycodone [h]ydrochloride 30mg tabs and contained foreign tablets.”
Your firm’s investigation of these three incidents of illegitimate product determined that, because of the lack of evidence of tampering with these packages and the proximity of these three Rite Aid pharmacies, it was likely that the oxycodone hydrochloride was replaced with other product while the packages were in the possession or control of McKesson.
These instances illustrate your firm’s failure to have systems in place to enable compliance with the requirements of section 582(c)(4) of the FD&C Act. After receiving illegitimate product notifications from Rite Aid, your firm was required to respond by identifying all illegitimate product subject to such notification that was in its possession or control, including any product that was subsequently received (section 582(c)(4)(B)(iii)). McKesson was then required to quarantine such product within its possession or control from product intended for distribution until such product was dispositioned (section 582(c)(4)(B)(i)(I)), dispose of any illegitimate product within its possession or control (section 582(c)(4)(B)(i)(II)), take reasonable and appropriate steps to assist trading partners to dispose of illegitimate product not in the possession of McKesson (section 582(c)(4)(B)(i)(III)), and notify within 24 hours FDA and all immediate trading partners that may have received such illegitimate product (section 582(c)(4)(B)(ii)). Your firm was also required to keep, for not less than 6 years, records of the disposition of illegitimate product (sections 582(c)(4)(B)(v)).
Although your firm conducted an investigation related to these bottles of oxycodone hydrochloride, your firm was unable to demonstrate that you met key obligations under section 582(c)(4). For example, you did not demonstrate that you identified all illegitimate product subject to the notification, such as by searching for product with the same lot number or NDC, or that you quarantined any such product. Similarly, your firm failed to demonstrate that you notified your immediate trading partners who may have received product with the same lot number or NDC. This is particularly troubling because your firm’s investigation noted that the oxycodone hydrochloride was likely replaced with different product at a McKesson distribution center. Also troubling is that during the FDA inspection of your firm’s San Francisco headquarters, a McKesson representative stated that incidents involving stolen or diverted controlled substances are not treated as Drug Supply Chain Security Act (DSCSA) verification events within the firm. In fact, DSCSA explicitly defines illegitimate product to include “a product for which credible evidence shows that the product is counterfeit, diverted, or stolen.”[2] Finally, your firm provided no records to demonstrate the disposition of these illegitimate products.
Example 2: On December 2, 2016, your firm was notified by Albertsons, one of your pharmacy trading partners, that Albertsons “had reported a Suspect Product [Divalproex Sodium Extended-Release Tablets (divalproex), (NDC 16714-0485)] based on the Drug Supply Chain Security Act. The product does not have a lot [number] or expiration date.” On December 6, 2016, Albertsons submitted an illegitimate product notification (via Form 3911) to FDA regarding this divalproex. On December 7, 2016, Albertsons submitted another illegitimate product notification to FDA (via Form 3911) concerning another product, Losartan Potassium and Hydrochlorothiazide tablets (losartan) (NDC 16714-0225), that Albertsons had received from your firm with no lot number or expiration date. This notification explained that Albertsons had previously notified McKesson via email about the problem with the losartan product. On December 15, 2016, FDA contacted your firm, stating that FDA had received two Form 3911s from Albertsons regarding divalproex and losartan products that lacked lot numbers and expiration dates on their packages. FDA therefore requested that your firm conduct verification to determine the status of these suspect products, as outlined in section 582(c)(4)(A)(i) of the FD&C Act.[3]
In this instance, your firm failed to have systems in place to enable compliance with the verification requirements of section 582(c)(4). Your firm was required to quarantine suspect product from product intended for distribution until such product is cleared or dispositioned, and to promptly conduct an investigation of the suspect product in coordination with trading partners, as applicable, to determine whether the product is illegitimate (section 582(c)(4)(A)(i)). Your firm was also required to keep for not less than 6 years, records of the investigation of suspect product (section 582(c)(4)(A)(iii)).
Even after both Albertsons and FDA had contacted you regarding this divalproex and losartan, you did notdemonstrate that your firm quarantined all such product or conducted an investigation of the suspect product to determine whether the product was illegitimate. After being notified by FDA that Albertsons had submitted Form 3911s for two products (divalproex and losartan) that lacked lot numbers and expiration dates on their packages, your firm acknowledged that “[a]n investigation at McKesson needs to be completed to assure we have no other bottles on the shelf of the two products that lack the lot and expiration dates… If additional bottles are found to be lacking the lot and expiration, it might be necessary to notify customers who purchased these items to check their inventory as well for product without the lot and expiration.” McKesson provided documentation showing that headquarters sent out a notification to its distribution centers. However, your facility in Wilsonville, Oregon, denied receiving any such quarantine notice, and there was no evidence that such a quarantine notification was present in McKesson’s electronic systems. To comply with section 582(c)(4)(A)(iii), McKesson is required to keep records of the investigation of suspect product for not less than 6 years. Your firm did subsequently provide what appears to be an inventory listing query, with handwritten notes, that seems to document your inventory check of these products at your Oregon facility. However, the handwritten notes were undated, unsigned, and were not made available to FDA investigators at the Wilsonville, Oregon, facility, which previously denied receiving the notification to quarantine these products. Your firm also did not provide information to demonstrate that quarantine checks were conducted at each of your firm’s distribution facilities.
Example 3: On or around June 28, 2016, your firm was notified by GlaxoSmithKline (GSK) that a pharmacy reported receiving two sealed bottles of a product labeled as Triumeq (NDC 49702-0231) that in fact contained gemfibrozil. GSK stated that the pharmacy where the product was discovered had purchase orders demonstrating that they purchased the product from McKesson. On July 8, 2016, GSK notified your firm “that GSK has determined that one bottle each from 2 lots of Triumeq … have been confirmed as illegitimate product under the Drug Supply Chain and [sic] Security Act (‘DSCSA’). Both bottles were reported by the Pharmacy who identified the presence of foreign tablets in each sealed Triumeq bottle to have been sourced from McKesson; therefore, pursuant to the requirement of the DSCSA regarding illegitimate product, we have notified FDA as required and hereby notify McKesson as a direct trading partner.”
Once McKesson received notification from its trading partner, GSK, that a determination had been made that a product was an illegitimate product, McKesson was required to identify all illegitimate product subject to such notification in McKesson’s possession or control, including any product that is subsequently received (section 582(c)(4)(B)(iii)). McKesson was also required to quarantine such product within its possession or control from product intended for distribution (sections 582(c)(4)(A)(i)(I) and 582(c)(4)(B)(i)(I)); to disposition any illegitimate product within its possession or control (section 582(c)(4)(B)(i)(II)); and to take reasonable and appropriate steps to assist trading partners to disposition illegitimate product not in McKesson’s possession (section 582(c)(4)(B)(i)(III)).
Your firm was unable to provide records demonstrating that it met the requirement to identify illegitimate product or subsequent requirements. For example, although your representative stated that you examined your remaining inventory and did not identify product with the same lot number, there was no supporting evidence of this, such as records showing that (1) an illegitimate product notification was issued to distribution centers instructing them to conduct inventory shelf-checks for the reported lot number; (2) inventory shelf-checks were conducted at distribution centers to determine if the firm was in possession or control of the illegitimate product; or (3) a quarantine flag was placed into the firm’s system to alert distribution centers in the event they received illegitimate product. McKesson was therefore unable to determine if the firm was in possession of illegitimate product and to notify trading partners as required.
Corrective Actions
FDA has reviewed your firm’s responses to the Form FDA 483 and subsequent correspondence.
1. Your firm’s response to the Form FDA 483 states that while you investigated “incidents related to potential diversion and theft issues … the incidents were not necessarily related to suspect or illegitimate products.” This response parallels your representative’s statement to FDA investigators at your San Francisco headquarters that incidents involving stolen or diverted controlled substances are not treated as DSCSA verification events within the firm. These statements demonstrate a lack of understanding of the definitions of suspect and illegitimate products, and of your firm’s responsibilities when notified of an illegitimate product by a trading partner. All prescription drug products in finished dosage form for administration to a patient[4] – including those containing controlled substances – are subject to DSCSA verification requirements in section 582(c)(4). Moreover, the statute defines illegitimate product to include “a product for which credible evidence shows that the product is counterfeit, diverted, or stolen.”[5] Under the law, your firm must treat incidents involving suspect and illegitimate products as subject to DSCSA requirements, including products that are controlled substances.
2. Your firm’s response to the Form FDA 483 cannot be evaluated because it lacks sufficient supporting documentation. Your response states that McKesson plans to make procedural updates to its standard operating procedures, without describing what these updates are or providing new standard operating procedure documents for review. FDA does not have enough information to conclude that future investigations of suspect or illegitimate product by McKesson will be conducted in a manner compliant with DSCSA. Your firm’s response dated November 4, 2018, contains similar information as your previous response; namely regarding updates you have made to various policy documents. Again, however, your firm provided no supporting documentation for review.
3. Although your November 4, 2018, response to FDA states that you intend to form a “Product Safety Committee that will be responsible for coordination of all actions related to suspect or illegitimate product,” your firm provided no information about the composition of this committee or the procedures under which the committee will function. As a result, your response does not demonstrate how the proposed change will improve McKesson’s compliance with DSCSA verification requirements.
Conclusion
The violations cited in this letter are not intended to be an all-inclusive statement of violations at your facilities. You are responsible for investigating and determining the causes of the violations identified above, and for preventing their recurrence or the occurrence of other violations. It is your responsibility to ensure that your firm complies with all requirements of federal law.
Failure to promptly correct these violations may result in legal action without further notice, including injunction. Unresolved violations in this warning letter may also prevent other federal agencies from awarding contracts.
Within fifteen (15) working days of your receipt of this letter, please notify this office in writing of the specific steps that you have taken to (1) correct the violations identified in this warning letter, and (2) identify and conduct appropriate investigations and follow-up related to other reports of suspect or illegitimate product that you have identified or received. Please include an explanation of each step being taken to prevent the recurrence of violations and include copies of related documentation. In addition, provide the steps your firm has taken to prevent incidents of theft and diversion. If you disagree with the characterization of the violations of the FD&C Act in this warning letter, include your reasoning and any supporting infom,ation for our consideration. If you cannot complete corrective actions within fifteen (15) working days, state the reason for the delay and the time within which you will complete the corrections.
Please send your electronic reply to ORAPHARM4_Responses@FDA.HHS.GOV or mail your reply to:
CDR Steven E. Porter, Jr.
Director, Division of Pharmaceutical Quality Operations IV
U.S. Food & Drug Administration
19701 Fairchild Rd.
Irvine, California 92612-2506
Director, Division of Pharmaceutical Quality Operations IV
U.S. Food & Drug Administration
19701 Fairchild Rd.
Irvine, California 92612-2506
Please identify your responses with the unique identifier: CMS 565854.
If you have questions regarding the contents of this letter, please contact Lance De Souza, Compliance Officer via email at Lance.DeSouza@fda.hhs.gov or by telephone at 510-337-6873.
Sincerely,
/S/
Alonza Cruse
Director
Office of Pharmaceutical Quality Operations
Office of Regulatory Affairs
cc:
Mary Hendrickson, MBA, PharmD, JD
Senior Vice President, Regulatory Affairs and Compliance
McKesson Corporation
6555 North State Highway 161
Irving, Texas 75039
Jenny R. Wallner
Assistant General Counsel
U.S. Pharma & Specialty Health
McKesson Corporation
One Post Street
San Francisco, California 94104
[1] “Suspect product” and “illegitimate product” are defined in section 581(21) and (8), respectively.
[2] FD&C Act section 581(8).
[3] The lack of a lot number or an expiration date on a product’s label are indicia that the product is a suspect product under section 581(21). See FDA’s guidance, “Drug Supply Chain Security Act Implementation: Identification of Suspect Product and Notification,” at 6, 7 (December 2016, issued in draft June 2014)https://www.fda.gov/downloads/Drugs/GuidanceComplianceRegulatoryInformation/Guidances/UCM400470.pdf.
[4] There are certain exceptions, none of which applies here. See FD&C Act section 581(13).
[5] FD&C Act section 581(8).