Yesterday, FDA announced the publication of 89 previously unpublished Complete Response Letters (“CRLs”), which appears to be the next step in FDA’s effort towards “radical transparency.” The first step was the posting of 200 already-published CRLs on July 10, 2025, which we blogged about here. However, this latest development marks a significant change in Agency policy as the CRLs released yesterday are CRLs issued from 2024 to the present for pending or withdrawn applications. This is the first time such letters for products with pending applications or applications that were not later approved have been publicly accessible. The newly posted CRLs are available on the openFDA database along with the initial batch of letters.
FDA also announced that “[g]oing forward, the agency will promptly release newly issued CRLs, and when approving applications will release all CRLs associated with that application. The agency will also publish batches of previously issued CRLs associated with withdrawn or abandoned applications” (emphasis added). The stated bases for the release were to promote transparency, provide insights to help speed therapies to market, restore public trust, and, notably, ensure that sponsors provide “complete and contextualized information in communications to investors and shareholders,” the latter of which echoes themes of the Executive Order 14303 issued on May 23, 2025 to “restore gold standard science.”
The release of these CRLs will undoubtedly affect both sponsor and Agency practices going forward. While our review of these CRLs is still underway, we note that it appears the clinical and statistical deficiencies are largely unredacted, while the product quality deficiencies are largely redacted. This is typically the case for CRLs that have been historically posted as part of an approved product’s action package, where clinical and statistical information is less likely to contain confidential commercial information under the Freedom of Information Act, unlike manufacturing information, which usually contains proprietary information about formulations, stability, etc. We will continue to monitor these developments and expect to post more on this topic in the coming days.
On the heels of President Donald Trump saying that he is considering executive action on marijuana rescheduling determination, Representative Greg Steube (R-Florida) reintroduced his Marijuana 1-to-3 Act that would legislatively reschedule marijuana from schedule I under the federal Controlled Substances Act (“CSA”) to schedule III. Like the 2019, 2021, and 2023 versions of the Marijuana 1-to-3 Act, which never made it out of committee, the 2025 bill would direct the Attorney General to order the transfer of marijuana from schedule I to schedule III within 60 days of enactment. H.R. 4963, 119th Cong. § 2 (2025); H.R. 4323, 116th Cong. § 2 (2019); H.R. 365, 117th Cong. § 2 (2021); H.R. 610, 118th Cong. § 2 (2023).
The Congressman posted on X that “[i]t makes zero sense that federal law treats marijuana the same as heroin and LSD. It is even more ridiculous that cocaine is technically classified as less restrictive than marijuana.” Congressman Greg Steube (@RepGregSteube), X (Aug. 11, 2025, at 15:21 ET). (Unlike marijuana, cocaine has a currently accepted medical use in treatment in the U.S., including, for example, as a topical anesthetic, so is classified a schedule II substance.) Steube characterized the bill as “a common-sense change that will finally allow real scientific research into its medicinal value and ensure our drug laws reflect reality.” Id.
Health and Human Services recommended in August 2023 that the Drug Enforcement Administration (“DEA”) also reschedule marijuana to schedule III. DEA published a Notice of Proposed Rulemaking (“NPRM”) in May 2024 signed by Attorney General Merrick Garland proposing to reschedule marijuana to schedule III, leading to a public hearing that began in January 2025 to receive factual evidence and testimony on marijuana rescheduling. The hearing was stayed in January and, with DEA Chief Administrative Law Judge John Mulrooney’s recent retirement, rescheduling is in the hands of new Administrator Terrance Cole.
Rescheduling marijuana from schedule I, the most restrictive classification, to less restrictive schedule III would continue to present significant implications for marijuana-related businesses and users. The NPRM stated that should rescheduling occur, “the regulatory controls applicable to schedule III controlled substances would apply, as appropriate, along with existing marijuana-specific requirements and any additional controls that might be implemented, including those that might be implemented to meet U.S. treaty obligations.” Schedules of Controlled Substances: Rescheduling of Marijuana, 89 Fed. Reg. 44,597, 44,621 (May 21, 2024). In the absence of marijuana-specific exemptions, cultivators, producers, and processors, distributors, importers, dispensers and practitioners will be subject to specific regulatory requirements under the CSA and DEA regulations. Requirements would likely vary for different business activities.
If marijuana is rescheduled to schedule III, legitimate handlers would be required to obtain a DEA registration, take initial and biennial inventories, maintain transaction records, file theft and significant loss reports, and provide adequate security to prevent diversion. Dispensing marijuana to patients, as with other schedule III substances, would require a prescription issued for legitimate medical purpose by a DEA-registered, state-licensed practitioner. 21 U.S.C. § 829(b). As with the other schedule III substances that they dispense, pharmacists would be required to exercise their corresponding responsibility under the CSA to ensure that marijuana is prescribed and dispensed for legitimate medical purpose. 21 C.F.R. § 1306.04(a). Marijuana activities would be subject to the CSA criminal prohibitions under 21 U.S.C. §§ 841-844 and Federal Food, Drug, and Cosmetic Act provisions. 89 Fed. Reg. 44,597, 44,621.
As with the prior Marijuana 1-to-3 Acts, the 2025 bill was referred to the House Energy and Commerce as well as the Judiciary Committees.
FDA’s recent approval of Papzimeos (zopapogene imadenovec-drba) highlights FDA’s use of regulatory flexibility in rare, serious diseases with unmet medical need. Approved on August 14, 2025, Papzimeos is the first treatment in the U.S. for recurrent respiratory papillomatosis (RRP), a rare disease characterized by recurrent HPV-induced papillomas in the airway that often require repeated surgeries. Papzimeos, a non-replicating adenoviral vector-based immunotherapy, is designed to stimulate a patient’s immune system to tackle the virus-infected cells driving disease. According to FDA’s announcement of the approval and the product’s labeling, approval of Papzimeos was based on a single-arm, open-label Phase 1/2 dose escalation plus dose expansion study that evaluated the safety and efficacy of Papzimeos in adult RRP patients – specifically patients who had three or more surgeries in the prior 12 months.
In FDA’s announcement, the current Center for Biologics Review Director, Dr. Vinay Prasad, stated:
Randomized trials are not always needed to approve medical products and this approval is proof of that philosophy. The FDA will always demand the correct clinical study for the specific medical product and disease. Our requirements for products given to tens of millions of healthy people will be different than products given to at most hundreds or thousands of patients with unique diseases.
This is an important endorsement by new FDA leadership.
FDA’s regulatory framework has long contemplated baseline-controlled and other historically-controlled trials as being capable of establishing drug effectiveness. The December 2019 Draft Guidance: Substantial Evidence of Effectiveness for or Human Drug and Biological Products explains that the substantial evidence of effectiveness standard requires expert judgment, including in accepting study designs that “produce less certainty” than randomized, controlled studies. The May 2001 Guidance for Industry: E10 Choice of Control Group and Related Issues in Clinical Trials explicitly recognizes the baseline-controlled study as a type of historical control group that is appropriate in certain circumstances. Specifically in the context of rare diseases, FDA has recognized that “single-arm trials may be an important option in rare diseases with well-understood pathophysiology and a well-defined disease course,” (FDA’s May 2014 Draft Guidance: Expedited Programs for Serious Conditions – Drugs and Biologics). And, at its core, historical controls are recognized in regulation as capable of being “adequate and well-controlled studies” that can support FDA’s effectiveness conclusions (21 C.F.R. § 314.126).
However, acceptance of non-traditional study designs by regulators requires exercise of judgment, and Agency leadership play an important role in doing so. However, as Dr. Prasad notes, there are certain circumstances where baseline-controlled studies are most appropriate.
The Papzimeos Approval Helps Us Understand Circumstances Where Baseline-Controlled Studies Are Appropriate
The primary efficacy endpoint in the Phase 1/2 study of Papzimeos was Complete Response, defined as the percentage of patients requiring no RRP surgeries in the 12 months following treatment. Key secondary endpoints included HPV-specific immune responses, extent of papilloma growth as measured by Derkay scoring, and quality of life as measured by the Vocal Handicap Index-10 (VHI-10).
Precigen, the drug’s sponsor, announced in August 2023 that it had gained agreement with FDA that the Phase 1/2 study could serve as a single pivotal trial to support accelerated approval utilizing HPV-specific immune response as a surrogate endpoint. However, when FDA issued its approval decision this month, it went further, granting traditional, or full, approval instead. While the approval package is not yet publicly available to provide insight into FDA’s reasoning for supporting a single-arm pivotal trial design, these authors believe the choice of a single-arm study design was particularly well-suited for RRP.
As noted by FDA’s Dr. Prasad, RRP is rare, affecting approximately 27,000 adults in the United States. FDA has a history of applying flexibility for rare diseases, as well as for serious conditions with unmet medical needs. RRP was all these things, with no FDA-approved therapy for this disease, which is characterized by recurrent, rapidly growing papillomas in the upper and lower respiratory tract that cause severe and potentially fatal airway obstruction, chronic lung disease, and recurrent pneumonia, thus requiring frequent surgeries.
Because recurrence of papillomas after surgery is nearly universal, a single-arm study allows for meaningful comparison against the known natural history of the disease because lack of recurrence (defined as being surgery-free for the study duration) can reliably be attributed to treatment effect. This is analogous to solid tumor response in cancer treatment, where spontaneous tumor regression is exceedingly rare and, as a result, single-arm studies have been a mainstay.
To enroll a population with severe enough disease to detect a treatment effect in a 12-month duration study (i.e., to adequately enrich the study), the study recruited RRP patients with three or more surgeries in the prior 12 months. This means that patients are more likely to have recurrence and require additional surgeries if left untreated. It would not be ethical to randomize patients to forego off-label drug therapy often used in conjunction with surgery (e.g., Avastin, Cidofovir) in lieu of placebo for 12 months. It would likely be infeasible to recruit such a study, as the more severe patients targeted for enrichment are likely to pursue off-label treatment if faced with the possibility of being randomized to placebo.
The treatment hypothesis for the primary endpoint was (1) objective (surgery) and (2) of a large magnitude (Complete Response), two key features that help reduce or overcome bias that can be associated with open-label trials. Knowledge of treatment assignment is unlikely to influence their perceptions, behaviors, and reporting of outcomes associated with surgical intervention as an outcome.
The combination of a well understood disease pathophysiology, such as HPV-induced papillomas in RRP, together with a therapy that has a mechanism of action on the causal pathway of the disease, such as Papzimeos which generates HPV 6- and HPV-11 specific T cell responses (see Section 12 of the product’s labeling), provides confidence that a deviation from the expected natural history is more credibly attributed to the drug despite the lack of concurrent control.
The Papzimeos Approval Does Not Stand Alone
This approval is one of a number of recent examples over the past year that demonstrate the ability of a single-arm study to establish effectiveness in a rare disease setting. From August 2024 to date, of the 22 novel, non-oncology rare disease drug approvals by FDA, nearly 20% (n=4) were on the basis of a single-arm trial; beyond Papzimeos, they are:
November 13, 2024 approval of Kebilidi (eladocagene exuparvovec-tneq) for aromatic L-amino acid decarboxylase (AADC) deficiency;
December 18, 2024 approval of Ryoncil (remestemcel-L-rknd) for steroid-refractory acute graft versus-host disease (SR-aGvHD); and
February 11, 2025 approval of Gomekli (miradmetinib) for neurofibromatosis type 1 (NF1).
Each of these cases underscores the FDA’s recognition, across both CDER and CBER, that evidentiary requirements for meeting substantial evidence of effectiveness must be tailored to the context of the product and the patient population. For RRP patients, Papzimeos represents a long-awaited therapeutic option, and for the broader rare disease community, it serves as another illustration of how regulatory flexibility can accelerate access to transformative therapies while still upholding rigorous scientific standards.
Hyman, Phelps & McNamara, P.C. (HPM) is excited to announce speakers for the program we are co-hosting with Freshfields geared toward early-stage biotech and medtech companies.
This program will be a half-day, in-person event at Freshfields’ Silicon Valley office on Wednesday September 10, 2025. HPM’s Michelle Butler and Allyson Mullen will be representing the drug and device perspectives, respectively.
Agenda:
1:00 – 1:30 PM: Registration
1:30 – 2:30 PM: Case Studies: Regulatory Matters in M&A and Licensing Transactions
A recent Warning Letter to a dental laboratory offering direct-to-consumer dental prosthetics highlights the ambiguous regulatory position occupied by dental laboratories and the products they produce for patients. In June 2025, the dental laboratory Reset Technology Corporation received a Warning Letter identifying several areas of noncompliance with medical device regulations. The violations identified in the letter made clear that FDA considered the dental laboratory to be engaged in device manufacturing activities and subject to the same regulatory requirements as manufacturers of other types of devices.
Historically, the traditional role of a dental laboratory has been “to manufacture prosthetics or devices in accordance with the written directives (or instructions) provided by a licensed dentist,” according to the American Dental Association. Following Congressional enactment of the Medical Device Amendments of 1976, FDA promulgated regulations that exempted dental laboratories meeting certain criteria from registration and listing requirements in recognition of their distinct role. 21 C.F.R. Part 807 exempts:
[p]ersons who dispense devices to the ultimate consumer or whose major responsibility is to render a service necessary to provide the consumer (i.e., patient, physician, layman, etc.) with a device or the benefits to be derived from the use of a device; for example, a . . . dental laboratory . . . whose primary responsibility to the ultimate consumer is to dispense or provide a service through the use of a previously manufactured device.
21 C.F.R. § 807.65(i) (emphasis added).
The scope of the exemption as it pertains to dental laboratories has been a source of longstanding confusion. Indeed, in responding to the Form FDA 483 that preceded the Warning Letter, Reset explained that it had previously registered as a device manufacturer “based on incorrect information from a regulatory consultant” but had since deactivated its registration with FDA for FY 2025. Reset asserted that 21 C.F.R. § 807.65(i) applied because it “manufactures patient specific restorative devices (removable partial dentures) based upon a prescription from a licensed dentist” and “use[s] FDA cleared materials . . . to manufacture each patient specific device and do[es] not commercially distribute these devices.” FDA disagreed, stating that Reset did not provide “a service through the use of previously manufactured devices” but rather “manufactures and distributes partial denture devices using devices that lack required approval/clearance and manufactures and distributes impression kits comprised of devices that lack required approval/clearance.“
The Warning Letter also cited numerous violations of the Quality System Regulation (QSR) requirements, including the failure to document procedures for process validation in connection with cleaning the partial denture device. FDA rejected the dental laboratory’s assertion that process validations were not required since they had already been performed as part of the regulatory process for the FDA-cleared materials used in its devices.
Other QSR violations cited in the Warning Letter related to inadequate procedures for controlling non-conforming product, failure to establish and maintain procedures for rework, failure to adequately investigate complaints or maintain complaint files, and failure to adequately establish and maintain procedures for implementing corrective and preventive action.
FDA’s concerns appeared to be driven in part by the direct-to-consumer nature of the dental laboratory’s operations. For example, the Warning Letter asserted that the “adjustment kits” provided to consumers at home to enable at-home modifications of their devices should have been reported as corrections pursuant to 21 C.F.R. Part 806, noting that ill-fitting dentures could lead to adverse health consequences. The Warning Letter cited the dental laboratory’s failure to obtain premarket authorization for its devices and noted that the clearances cited by the dental laboratory were for different indications for use. For example, the 510(k) cited by the dental laboratory for the impression material was for prescription use only, whereas the dental laboratory intended for the material “to be used by customers to take their own impression without the supervision of a dentist.” This change “could significantly affect the safety and effectiveness of the impression material because customers who use at-home impression kits to take their own impressions may be more likely to take improper impressions—and improper impressions can lead to improper fabrication of the denture, which can cause bone loss/resorption, irritation, sores, and TMJ dysfunction.”
Additionally, the Warning Letter noted “it is unclear whether your firm is sending the impression material to customers with a prescription from a dentist—and the labeling of the impression kit does not appear to state that it is for prescription use only” and stated that “[c]hanging a device for prescription use only to a device for over the counter use also could significantly affect the safety or effectiveness of the device.”
The Warning Letter’s focus on a direct-to-consumer dental laboratory is consistent with concerns raised by the American Dental Association about the growing presence of direct-to-consumer dental laboratories, where patients are instructed to independently take their own impressions and order products without the involvement of a dentist.
Although the Warning Letter is specific to Reset Technology Corporation, other dental laboratories, in particular those incorporating direct-to-consumer practices, should take note and ensure they comply with applicable FDA regulations after careful consideration of whether their operations extend beyond what FDA considers to be a dental laboratory exempt from otherwise applicable regulations.
With great sadness, we announce that our colleague and friend Tom Scarlett passed away on August 20, 2025, at the age of 82. Tom was a great lawyer, a recognized leader of the food and drug bar, and an unexcelled teacher and inspiration to all of us in the firm.
A graduate of Columbia University and Yale Law School, Tom began his legal career in 1969 as an associate with the New York office of White & Case. In 1971, he joined the Office of the General Counsel of the Department of Health and Human Services (then HEW) as a staff attorney in the Social and Rehabilitation Services Division. However, it was in 1973 that he found his true calling when he became a trial attorney in the FDA Chief Counsel Office in HHS, where he served until 1979, rising to Deputy Chief Counsel for Regulations and Hearings. After practicing in the D.C. office of Morgan, Lewis & Bockius from 1979 to 1981, Tom was called back to FDA, where he was appointed Chief Counsel of FDA. Tom held that position with distinction, and some drama, until 1989, when we were honored to have him became a Principal in our law firm.
Tom was in active practice with the firm for 19 years, until he became senior counsel in 2008. Tom fully retired in 2017, but he was always available to help when called upon and was a regular attendee at our firm functions.
Tom was one of the intellectual stars of the food and drug bar. He had a quick understanding of the key issues in a matter and the ability to develop thoughtful, effective solutions to them (which he presented in his cool, polite and understated manner). Tom also was an extraordinary writer of clear, efficient and persuasive prose. He was often called on to assist lawyers in other firms with complicated matters.
We extend our heartfelt sympathy to his family. Tom will be greatly missed.
As the summer of 2025 comes to a close and we begin to look toward to the 2026 Fiscal Year, FDA is completing its reporting on 2024. The FDA’s fiscal year 2024 Report on the State of Pharmaceutical Quality from CDER’s Office of Pharmaceutical Quality (OPQ) provides a look at the agency’s efforts under previous leadership to normalize its post-pandemic oversight. But the FDA and the pharmaceutical industry are in transition under the current administration, as new quality challenges have emerged across global supply chains. FY2024 ran from October 2023 through September 2024, so this report does not address the possible impacts of more recent policies, actual and proposed tariffs, and reductions in force at FDA. That said, this look back contains a number of interesting highlights.
Section One of the report examines the overall production site demographics and analyzes how they’ve changed in recent years. According to the report, 36% of registered sites are in the “No Application” sector, the majority of which are OTC monograph products, but also including marketed unapproved prescription drug products and homeopathic products. The remaining 64% of sites each manufacture at least one application product, including biological products licensed under Biologics License Applications (BLAs), products approved under New Drug Applications (NDAs), and generic products approved under Abbreviated New Drug Applications (ANDAs).
The six countries with the most sites in the FY2024 Site Catalog were the U.S., India, China, Germany, Italy, and France. Of note, since 2020, those nations had significant net increases in total listed sites, as seen in the chart below (here).
Five other countries, including China and India, increased registered sites more than 15%. Canada, Japan, and the U.K. each saw declines.
According to the Report, both domestic and foreign drug quality assurance inspections continued to creep up as well, though FDA is still well below pre-pandemic levels. There were over 1,300 inspections in FY2019, compared to 989 quality inspections last fiscal year. Perhaps in a nod to the recent Executive Order and announcement about FDA’s emphasis on foreign inspections, OPQ’s report boasted that “more than 62% of drug quality assurance inspections were at foreign sites —an all-time high. This progress in foreign inspections was particularly evident in India and China, where 34% and 28% of sites in the Site Catalog, respectively, were inspected.” In the 2023 report, we noted that roughly half of all inspections were at foreign facilities. We’ll keep an eye out for how this data might change if and when FDA’s foreign inspection policies evolve.
Section Two of the report examines drug product demographics, stating that CDER’s Product Catalog included 14,168 ANDAs, 3,625 NDAs, 383 BLAs, and 140,119 non-application product NDCs. All were increases from FY2023.
Section Three dissects FY2024’s enforcement matters, including import alerts, recalls, and Warning Letters. According to the report, FDA issued 105 Warning Letters for quality issues, the highest in five years. The report does not discuss Untitled Letters. Globally, 93% of all sites in the CDER Site Catalog have received no action indicated (NAI) or voluntary action indicated (VAI) as their most recent inspection classification. This data reveal an overall high level of compliance; however, classifications varied by global regions. Internationally, China, India, and South Korea were the leaders in quality-related Warning Letters (here).
In terms of percentages, inspected firms in Europe led the global pack with a 98% NAI or VAI classification rate. China’s overall rate was 93%, and the U.S. rate was 92%. India’s overall inspection rate lagged at 87% of inspections classified as NAI or VAI (here).
Import alerts affected 75 sites, primarily OTC manufacturers and API suppliers. The report also reveals that over the last five years, 72% of enforcement actions against API manufacturers targeted sites exclusively supplying compounding pharmacies, though these sites represent just 18% of API manufacturers in CDER’s catalog. OPQ notes that because this small sub-group represents an outsized portion of enforcement actions, “FDA has prioritized these higher risk sites for future surveillance.”
Product recalls dropped to their lowest level in five years at 421 products, though contamination remained the leading cause. Ophthalmic products topped the recall list in terms of numbers, with several multi-product events involving sterility issues.
Looking at FDA’s FY2024 quality surveillance data provides a baseline for evaluating potential regulatory changes under the current administration’s reform agenda. The report’s discussions about FDA’s use of Warning Letters, emphasis on foreign manufacturing oversight, and API quality gaps all suggest areas where the agency’s approach might shift under the current leadership. And challenges with Chinese and Indian suppliers may align with Administration calls for domestic supply chain “reshoring,” and reduced dependence on foreign pharmaceutical manufacturing.
As we turn the calendar to FY2026, we’ll keep an eye on these trends to see how FDA’s assessment of 2024 will inform its future.
Hyman, Phelps & McNamara, P.C. (“HP&M”) is proud to announce that 16 of our attorneys have been recognized in the 2026 edition of The Best Lawyers in America®. This recognition reflects the depth of our team’s experience and our ongoing commitment to excellence in FDA law, health care law, and regulatory matters.
Attorneys recognized in The Best Lawyers in America® include:
The Best Lawyers in America® is based entirely on peer review and is considered one of the most respected and unbiased sources for legal referrals in the United States. Being selected is a testament to the trust and regard of fellow attorneys and reflects HP&M’s leadership in regulatory and health law.
We congratulate our colleagues on this well-deserved recognition.
Karla Palmer and Andrew Hull will be presenting at this year’s Controlled Substances and State Regulatory Conference to be held in Savannah, GA, from September 3-5. Karla Palmer will be presenting on suspicious order monitoring and customer due diligence requirements for manufacturers and distributors as well as leading a session on pharmacist awareness of “red flags” of diversion. Andrew Hull will be presenting on the current DEA enforcement environment and leading a roundtable discussion on legal issues facing DEA registrants.
The conference will feature many other speakers on important topics facing the DEA-regulated industry, as well as a DEA update on controlled substances regulation.
Click here to register for this conference. We hope to see you in Savannah!
Like death and taxes, unannounced, periodic cyclic inspections of controlled substance manufacturers, distributors, importers, exporters, and narcotic treatment programs, by Drug Enforcement Administration (“DEA”) diversion investigators every three to five years is inevitable. “Practitioner” registrants, that include hospitals, pharmacies, and practitioners, are also subject to random unannounced DEA inspections. An accountability audit of selected controlled substances, and a review of required records, reports, and security comprise most DEA cyclic and other inspections.
DEA diversion investigators appearing unannounced, though not totally unexpected, can be nerve racking for employees given the great importance that rides on whether the inspection finds find that registrants are in compliance with the Controlled Substances Act (“CSA”) and DEA regulations. A negative inspection can result in a Corrective Action Letter (formerly a Letter of Admonition), an informal hearing, an Order to Show Cause, a Memorandum of Agreement, and civil monetary penalties. Over the years we have posted recommendations on how registrants can proactively prepare for and manage DEA inspections. See, for example, here, here, and here.
First as a DEA diversion investigator and later in private practice, I have witnessed countless inspections over the years where employees scrambled to gather and provide requested information and documents. The investigators’ first impression can be crucial in how an inspection progresses and whether they conclude that a registrant is compliant. Certainly the best preparation for the inevitable DEA inspections is to comply with the CSA and regulations by maintaining complete and accurate records and reports that are readily accessible, and ensure that security components are operational. Registrants should designate a specific responsible employee to act as liaison with the investigators. Registrants should also conduct periodic DEA-style mock random internal accountability audits and record, report and security reviews.
Investigators always ask for certain basic information and documents upon their arrival. This information is crucial to the inspection and for the files that DEA maintains on the registrant. The initial portion of an inspection after investigators have made their requests is typically an anxious time for employees as they scramble to locate the requested information and documents. One way to alleviate some of the anxiety for employees is for registrants to create and prepare a DEA inspection binder that organizes and contains what investigators typically ask for.
Registrants should remove and provide information and documents from the binder when requested. A typical DEA inspection binder should contain:
Current federal and state license, permit, and registration certificates;
Corporate structure with ownership including incorporation documents;
Executive and corporate officers with their title, date of birth, Social Security number, and home address;
For employees who access controlled substances and listed chemicals, their title, date of birth, Social Security number, and home address; (DEA protects and safeguards all information, including Personal Identifiable Information obtained as required by the Privacy Act of 1974);
Powers of Attorney pertaining to controlled substances and listed chemicals;
Controlled Substances Biennial Inventory;
List of controlled substances/listed chemicals handled for prior two years;
Suppliers with their address and DEA registration numbers;
Customers with their address, DEA registration numbers, and/or unique ID numbers;
Operations information including hours and full- and part-time employee numbers and hours;
Controlled substance/listed chemical Policies and Procedures; (neither the CSA nor DEA regulations require written SOPs, but investigators view them as relevant for assessing compliance);
Central recordkeeping authorization letter if applicable;
Facility interior and exterior security including:
Building plans and diagrams
Alarm:
1. Description,
2. Specifications with literature,
3. Contracts,
4. Central monitoring system contract; and,
5. Test results
Safe/vault/container:
1. Literature with specifications; and
2. Contracts; and
Security guard contract if applicable.
Registrants must update the binder when changes occur, such as when responsible employees leave or new licenses/registrations are issued. Registrants can maintain the materials in a three-ring binder or electronically.
****
Look for additional DEA inspection recommendations here in the coming weeks.
FDA recently released a CDER Center for Clinical Trial Innovation (C3TI) White Paper on Selective Safety Data Collection (SSDC), a subject about which there is little awareness. Selective Safety Data Collection (SSDC) describes the prospectively planned curtailment of safety data collection in studies where the safety profile of the drug has been well characterized. Although some information should always be collected from a clinical trial, e.g., serious adverse events, adverse dropouts, adverse events of special interest, other information may be unnecessary. Consider an approved drug, studied in 1200 subjects, with a table in Section 6 of labeling that lists nausea as an adverse reaction, e.g., 24% with drug and 13% with placebo. If subjects in the planned study are similar to those in registrational studies, how important would it be to query subjects about non-serious adverse events of nausea in a subsequent study? And given that routine laboratory data were collected and analyzed in these 1200 subjects, how important would it be to collect tens of thousands of additional laboratory values in the planned study? In this situation, FDA and other regulatory authorities recognize that such information would not add importantly to the safety knowledge about the drug. Collection of such data increases the burden of the study, first and foremost to participants, and also to investigators, sponsors, and regulatory authorities. Why worry about the burden? If clinical studies are less burdensome, more will be conducted, and more questions will be answered—the main goal of clinical research.
FDA expressed its willingness to adopt SSDC when it released its 2016 Guidance for Industry, “Determining the Extent of Safety Data Collection Needed in Late-Stage Premarket and Postapproval Clinical Investigations.” When I was an Office Director in CDER, we would encourage sponsors to use this approach in studies they were planning. Executives would smile and nod their heads in agreement, but no one took us up on the offer! Our thinking was that we needed international buy-in of this approach for it to be viable, given that these were multinational studies that involved regulators from around the world.
In 2016, I advanced SSDC as a topic for the International Council on Harmonisation (ICH). The matter was taken up as a topic by the ICH E19 Expert Working Group, and I was appointed as one of the FDA leads. In the working group, it became apparent that the resistance to SSDC was not so much from regulators outside the US, but rather from the companies, who felt like they needed to obtain every shred of information from their trials! They worried that a regulator—somewhere, sometime—would request the information, and thought that, rarely, the availability of comprehensive safety information might help explain the etiology of unusual serious adverse events. Moreover, such decisions could be driven by the most conservative member of leadership at each company!
ICH finalized the Guideline, “E19, A Selective Approach to Safety Data Collection in Specific Late-Stage Pre-Approval or Post-Approval Clinical Trials,” almost 3 years ago; however, the concept still draws little attention from industry. FDA is now increasing awareness of the concept with their new White Paper. The White Paper does an excellent job in explaining the concept of SSCD, its utility, past and present experience, and opportunities for future use, all with excellent examples. It is something we hope many of you will read.
The authors of this post are both avid bibliophiles, and keenly appreciate the hook of a good title or first sentence that draws you right in. Usually the titles of government press releases do not share this allure, but there was one recently that caught our attention. On July 31, 2025, the Department of Justice (DOJ) issued a press release titled: “Illumina Inc. to Pay $9.8M to Resolve False Claims Act Allegations Arising from Cybersecurity Vulnerabilities in Genomic Sequencing Systems.” Since most settlements with the government stem from actual harm caused, we found the word “vulnerabilities” of particular interest, and knew we needed to settle in to read more.
The allegations, brought to DOJ’s attention by a qui tam relator, state that from February 2016 through September 2023 Illumina submitted or caused to be submitted false claims to a variety of federal government agencies, including DOJ, Department of Health and Human Services, Department of Veterans Affairs, and others, for payment for the purchase of certain of Illumina’s genomic sequencing systems. The punchline of the settlement may be the following: “The United States contends that the claims to the Agencies were false, regardless of whether any actual cybersecurity breaches occurred, because the [genomic sequencing systems’] software had cybersecurity vulnerabilities, and Illumina did not have an adequate product security program and sufficient quality systems to identify and address cybersecurity vulnerabilities affecting the [] software.” (Emphasis added.)
Like a line out of a good Stephen King novel, this sentence should put fear in the heart of any company that manufactures software-reliant medical devices sold to the government. And just like that Stephen King novel, you need to keep reading to find out more.
It turns out that DOJ’s position was not merely based on the presence of potential “vulnerabilities,” but rather on its finding that “Illumina knowingly failed to incorporate product cybersecurity in its software design, development, installation, and on-market monitoring; failed to properly support and resource personnel, systems, and processes tasked with product security; failed to adequately correct design features that introduced cybersecurity vulnerabilities in the genomic sequencing systems; and falsely represented that the software on the genomic sequencing systems adhered to cybersecurity standards, including standards of the International Organization for Standardization and National Institute of Standards and Technology.”
Even with all that, and even assuming some part of the allegations are true, it is still startling that these actions, which appear to be violations of FDA’s Quality System Regulation, led to a seven-figure settlement. Notably, there is no discussion of FDA requirements, quality system or otherwise, just general references to “cybersecurity standards” and “cybersecurity obligations.”
So what does this mean for medical device companies moving forward? Perhaps not much, beyond additional focus on complying with the already-existing cybersecurity requirements. While not explicitly stated, it stands to reason that, given this administration’s focus on national security, this particular settlement may stem from potential threats to national security that could be presented by cybersecurity “vulnerabilities” and really has very little, if anything, to do with FDA requirements more broadly. As DOJ states in its press release, the concerns here related to protecting “sensitive information from cyber threats,” “combat[ing] cybersecurity risks,” and the consequences that may stem “from a failure to adhere to required cybersecurity standards, especially when the systems involved include sensitive genomic data.”
It is worth comparing this settlement with earlier cases involving alleged violations of drug good manufacturing practices, like United States ex rel. Rostholder v. Omnicare, Inc., No. 12-2431 (4th Circ. Feb. 21, 2014). Courts have rejected False Claims Act theories based solely on alleged regulatory violations, noting that the FCA is not “a sweeping mechanism to promote regulatory compliance.” The focus in those cases was that compliance with the current good manufacturing practice (cGMP) regulations was not material to payment by Medicare and Medicaid. Although “the correction of regulatory problems is a worthy goal,” such a theory is “not actionable under the FCA in the absence of actual fraudulent conduct.”
While the Illumina settlement is not necessarily an indicator that DOJ is interested in going after medical device companies simply for QSR violations, a company’s quality management system and its cybersecurity are inextricably linked. The one thing that is certain from this settlement is that if you have a medical device with software (and let’s be honest, these days, that describes most of them), you should review your cybersecurity risk management plan, assess any potential vulnerabilities, and implement necessary mitigations. You don’t want to be the lead character of the sequel.
* Credit to Helen Exley for the quote, “Books can be dangerous. The best ones should be labeled ‘This could change your life.’”
CDER’s Office of Pharmaceutical Quality (OPQ) recently published a white paper called Quality Management Initiatives in the Pharmaceutical Industry: An Economic Perspective. Not entirely a financial analysis, OPQ is making what amounts to a two-part sales pitch to pharma execs that investment in manufacturing quality systems will return profit and economic savings while also serving broader public health interests. This white paper is the latest release in what OPQ calls their initiative towards “mature quality systems management.” The timing of this release follows other, related papers that endorse the idea that going beyond bare-minimum compliance actually pays dividends.
In part one of the paper, entitled The Economic Return on Investment for Quality Management Initiatives, OPQ makes the case that investment in quality will not merely minimize regulatory headaches but will also advance real savings and profits. Instead of the usual regulatory finger-wagging about compliance, here OPQ is trying to speak the language of CFOs. A central principle here is that companies don’t need to affect massive quality overhauls to see financial benefits. Their research claims that targeted quality investments can lead to cuts in product defects by more than half and reductions in waste of 75%, while allowing companies to redeploy a quarter of their staff from quality troubleshooting to other work. To realize these kinds of benefits, OPQ uses economic modeling that aspires to show that there’s an optimal sweet spot for quality investments where companies can expect measurable returns on their spending. The paper shows this relationship as a curve where total costs decrease with quality investments until reaching an optimal point, after which additional spending produces diminishing returns.
See Table here – Source: OPQ White Paper, Quality Management Initiatives in the Pharmaceutical Industry: An Economic Perspective, page 5.
The agency presents this as a stepwise approach where companies can make incremental investments rather than committing large amounts of capital upfront. According to their model, companies can choose an investment level based on their current situation and business needs, with each step theoretically delivering additional returns even without reaching the optimal investment point.
FDA’s approach here has pros and cons. We appreciate FDA’s allowance that the approach is company specific. It’s certainly true that not all manufacturing facilities nor quality management systems are created equal. We note, however, that FDA’s economic model relies heavily on case studies and anecdotal evidence rather than rigorous econometric analysis, which makes it difficult to verify their claimed returns or determine how applicable they are across different types of pharmaceutical operations.
Additionally, while FDA does provide a mathematical framework for finding the optimal investment level, it appears to us as more theoretical than practical. The key here is that companies should incrementally invest in quality up to the point until the cost of additional spending equals the savings it generates. This is a pretty standard economic optimization theory for finding a “sweet spot” for Return on Investment (ROI). But FDA’s model admittedly doesn’t add in the realities of the “external complexities of the pharmaceutical market.” Thus, manufacturers are left with a model that doesn’t factor in any market-driven externalities. As a theoretical exercise, FDA’s economic model is interesting. But the jury is still out on how helpful it will be for quality managers, CFO’s, and C-Suite executives.
In part two, The Public Health Return on Investment for Quality Management Initiatives, focus shifts from company ROI to the broader public health benefits of mature quality systems, arguing that they help preserve patient safety, prevent drug shortages, and maintain supply chain stability. Here, FDA leans more into its traditional position that frames quality as a public health imperative, noting that functioning, compliant quality systems reduce the risk of treatment delays and adverse patient outcomes that ripple through healthcare systems during shortages.
Section Two’s public health arguments are compelling in principle, albeit not entirely connected to the economic ROI focus of the first part of the paper. FDA acknowledges some of the associated indirect costs with their public health concerns but doesn’t quantify how much companies should spend on quality systems to achieve these public health goals, assuming that the public benefits justify the private costs. And there’s no clear link here to FDA’s earlier theme that even small investments can lead to substantial rewards. This potentially leaves pharmaceutical executives in an awkward position of being asked to optimize for two different objectives without clear regulatory instruction on how to balance profit-driven quality investments against broader public health responsibilities.
The report concludes that whether “companies are implementing their first quality culture initiatives or embracing new technologies, there are opportunities for companies at every stage of quality management implementation.” These incremental opportunities, OPQ writes, are something “that pharmaceutical companies cannot afford to lose.” Time will tell if OPQ merges these economic principles into their inspection and classification assessments, space that is already inhabited by the public health philosophies this report also includes. While there’s a lot of interesting material here, this is a white paper, not a formal guidance document, so it’s not clear how or if this analysis might impact enforcement decisions going forward. We’ll report on any further advancements in the agency’s view on mature quality management as they develop.
News coverage of the citizen petition submitted by Dr. David Kessler has been somewhat breathless, so it was nice to read the document first hand when it was posted yesterday in the docket at regulations.gov – and you should do the same. Spoiler alert! In essence, the petition asks FDA to revoke the generally recognized as safe (GRAS) status of a number of substances categorized as “processed refined carbohydrates” because there no longer exists a consensus among qualified experts that current uses of those substances are safe within the meaning of section 409 of the FD&C Act (i.e., that there exists a reasonable certainty of no harm). Whether those substances could continue to be used in food in the long term would depend on the success of food additive petitions that industry would be required to submit to FDA. The Kessler petition thus presses FDA to follow the path trod by the agency when it revoked the GRAS status of partially hydrogenated oils ten years ago, thereby prompting submission of a food additive petition that was subsequently denied. (Has it really been 10 years?)
The Kessler petition paints a dire picture of the health of the U.S. population, and draws on several lines of scientific argument to conclude that ultra-processed foods (UPFs) and “ultra-processed food technology” encourage food consumption patterns that contribute to a host of diet-related diseases. Rather than struggle over precisely defining UPFs and targeting their consumption directly, the petition argues in favor of targeting processed refined carbohydrates, which are “central to the widespread availability of” UPFs. To the extent that processed refined carbohydrates were previously determined to be GRAS, the petition argues that circumstances have changed such that there can no longer exist a consensus of safety under current conditions of use. The petition argues that those substances “act metabolically in a similar fashion to ‘added sugars’ and small chain saccharides.” Thus, they are “conducive to rapid eating, rapid digestion, fast gastrointestinal transit time, and rapid absorption,” and “stimulate blood insulin and glucose,” thereby resulting in several adverse health effects. Further, the petition argues that “metabolic damage can begin very early in life… as early as the first days of life.” Perhaps most strikingly, the petition argues that any evaluation of safety must take into consideration the already poor metabolic health of the U.S. population.
Some readers might recall that Dr. Kessler was Commissioner of FDA when the agency sought to regulate cigarettes under its then-existing statutory authority, in an effort that narrowly failed to persuade the Supreme Court in FDA v. Brown & Williamson Tobacco Corp. Thus, it comes as little surprise when the petition argues that, “[j]ust as nicotine was central to FDA regulation of tobacco products, processed refined carbohydrates used in industrial food processing are a key component of [UPFs] that the agency needs to address in order to protect the public health from the health risks of these products.”
To give credit where credit is due, this is not the first citizen petition to seek revocation of the GRAS status of substances widely used in processed foods. However, this petition considerably ups the ante by broadening the list of targets, folding in more recent evidence of alleged harm, and playing to a potentially sympathetic regulator by indirectly targeting UPFs. FDA now has 180 days to respond, but given the complexity of the petition, it would be surprising if that response says much beyond “we’re still reviewing your petition.” If a response is significantly delayed, then the petitioner will have to decide whether to sue the agency to compel a response. Here again, the prior fight over partially hydrogenated oils offers a potentially useful precedent.
On August 4, 2025, FDA hosted a public meeting related to the reauthorization of the Medical Device User Fee Act for fiscal years 2028 through 2032 (MDUFA VI). The FDA invited public comment on the following questions and most speakers remarks provided perspectives related to these question (90 FR 24633).
What is your assessment of the overall performance of MDUFA V thus far?
What current features of MDUFA should be reduced or discontinued to ensure the continued efficiency and effectiveness of the medical device review process?
What new features should FDA consider adding to the program to enhance the efficiency and effectiveness of the medical devices review process?
What changes, if any, could be made to the current fee structures and amounts to better advance the goals of the agreement, including facilitating product development and timely access for consumers?
The meeting kicked off with remarks from FDA Commissioner Dr. Martin Makary who commented on the history of medical device user fees, improvements to FDA’s reviews since the first MDUFA was established, goals for modernization, use of common sense, and to make interactions with the agency a user-friendly process. Next, CDRH Director Dr. Michelle Tarver spoke on the CDRH vision for patients in the US to have access to safe and effective medical devices of public health importance first in the world. Dr. Tarver noted that the device center is strong and has met or exceeded review timelines established in MDUFA V. Other topics touched on by Dr. Tarver include: the record use of pre-subs and proposal to further streamline the process, such as by submission type and evidence phase; use of real world evidence and the need for continued collaboration across the total product life cycle; digital health and the agency’s support of responsible innovation; expansion of the use and scope of the Accreditation Scheme for Conformity Assessment (ASCA); strengthening patient-centered development; and providing expanded dashboards with new metrics to improve visibility of the agency’s progress against the MDUFA V performance goals. Dr. Tarver wrapped up stating that while CDRH has made progress in ensuring it has top talent, that they will need critical resources under MDUFA VI, and that CDRH staff will require leading edge scientific training. This comment comes with some irony given the mass layoffs across FDA earlier this year.
The remainder of the meeting presented perspectives external to FDA, including panels from: MedTech industry; patients and consumers; scientific, academic, and health care professionals; and the public.
Remarks from the MedTech panel focused on fine tuning the current FDA processes and highlighted the value of the pre-sub process and the importance of transparency and understanding of where user fees are spent. This panel also noted that while not opposed to FDA’s use of medical device user fees to improve post-market activities, the program was intended for pre-market improvements. Finally, this panel emphasized that user fees provide resources to FDA to support timeliness and predictability and are not and have never been a guarantee of approval.
Patient and consumer groups requested that patient advocacy groups be included as more formal partners in the MDUFA negotiations and also highlighted the need for MDUFA goals related to the quality of FDA reviews in addition to timeliness of reviews. In contrast to the view of the MedTech panel, this panel recommended user fees support improvements to post-market initiatives within the Agency, noting that there have been higher numbers of adverse events in the last 10 years and questioning whether MDUFA pressure for premarket review speed has had an unintentional consequence of more adverse events. One speaker on this panel noted that device user fees are a fraction of drug user fees, even for the biggest companies and commented that they believe user fees, especially for 510(k)s, are too low.
The scientific, academic, and healthcare professional panel noted that collaboration with FDA and developers is essential, especially with new technologies such as AI-enabled devices. This panel also highlighted the need to ensure regulatory frameworks are inclusive of all populations, especially children.
The presenters from the public brought a variety of views. Some felt FDA should be fully funded through appropriations, expressed concern with recent FDA reductions in force and recommended regulation of laboratory developed tests be considered as part of the MDUFA bill, such as the previous VALID act, which we have blogged on previously (link). Others recommended user fees be increased, the program be expanded to provide robust postmarket safety information to the public, that MDUFA include a pilot program for use of digital twins and to reduce clinical trial requirements with in silico testing, and to make MDUFA performance goals more patient centric with a focus on quality and not just speed of review.
FDA’s Total Product Lifecycle Advisory Program (TAP) pilot was discussed by many over the course of the meeting. Dr. Tarver noted that TAP is designed to expedite patient access by making the path to market more efficient and predictable and that 100% of quantitative performance metrics had been met in the pilot with 93 devices currently enrolled. The MedTech panel commented that while the goals of TAP are laudable, that they fall outside of FDA’s purview and recommended revisiting the Breakthrough Program to incorporate the elements of TAP that are in FDA’s control. Conversely, the patient and consumer panel as well as the scientific, academic, and health care professionals panel praised TAP for the integrated approach and bringing the patient and payor voices to the table earlier in the development process, and recommended the program be maintained and grown.
Across all presenters, the common goal of timely patient access to safe and effective devices was reiterated. Public input on the user fee reauthorization can be submitted at https://www.regulations.gov/, Docket No. FDA-2025-N-1157 until September 4, 2025.
