Final Rule: Record Keeping under the Public Health Security
On December 9, 2004, the U.S. Food and Drug Administration (FDA or "agency") published in the Federal Register final regulations on the establishment and maintenance of records for food "non-transporters" and "transporters" under the authority of the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 ("Bioterrorism Act").See Final Regulation Implementing the Public Health Security and Bioterrorism Preparedness and Response Act of 2002—Establishment and Maintenance of Records for Foods, 69 FR 71562 (Dec. 9, 2004) ("Record Keeping Rule") (last viewed Dec. 10, 2004); see also Pub. Law 107-188 (June 12, 2002).
The first notice sets forth the regulations (21 CFR §§1.326-1.368) that implement FDA’s new record keeping requirements imposed by the Bioterrorism Act on persons who manufacture, process, pack, transport, distribute, receive, hold, or import food in the United States. A number of exclusions are available under the regulations, which are identified briefly below. These regulations require both non-transporters and transporters to establish and maintain certain records that will allow FDA to identify the immediate previous sources and immediate subsequent recipients of food, including its packaging, when FDA has "a reasonable belief that an article of food is adulterated and presents a threat of serious adverse health consequences or death to humans or animals." Note that these regulations focus on FDA’s requirements for the covered entities to establish and maintain certain information/records for food as well as the covered entities whose records are to be made available for viewing and copying upon the agency’s request when the evidentiary burden is met.
On the same date, FDA issued guidance explaining the circumstances in and procedures by which FDA intends to request access to records under the Bioterrorism Act’s record keeping authorities. See Draft Guidance for Records Access Authority Provided in Title III, Subtitle A, of the Public Health Security Bioterrorism Preparedness and Response Act of 2002,(Dec. 9, 2004) (last viewed Dec. 10, 2004) (Guidance).
The new regulations and Draft Guidance both relate to and implement food record keeping authority established by the Bioterrorism Act and both are triggered by the same circumstances—namely,
…if (1) The Secretary has a reasonable belief that an article of food is adulterated and presents a threat of serious adverse health consequences or death to humans or animals, and (2) the records are necessary to assist FDA in making such a determination. 69 FR at 71657.
The newly published regulations are final rules that will be the subject of public meetings in early 2005 at which FDA will explain them. We will be attending the first public meeting, scheduled for January 13, 2005, and will provide our analysis of FDA’s discussion upon your request.
Highlights of the Final Regulations
The following significant observations are readily observable from the current record keeping proposal:
- Persons that manufacture, process, pack, transport, distribute, receive, hold or import food are subject to the access provisions of the regulation for records that such persons have regarding the packaging of their food. That is, if you perform one of the above activities, you are not only required to establish and maintain records related to your food, and to grant FDA access to those records when the agency has the appropriate level of evidence to support a request for access, but you are also required to grant access to any records you may have respecting your food’s packaging (packaging includes the outer packaging of food that bears the label and does not contact the food directly);
- FDA’s requirement to establish and maintain a record keeping system applies to any person, subject to certain exclusions identified below, who manufactures, processes, packs, transports, distributes, receives, holds, or imports food in the United States regardless of whether the food is intended for consumption in the United States;
- FDA’s definition of processing is remarkably broad, reaching washing, freezing, cooling, packaging, and labeling of food;
- These regulation do not apply to:
- Persons performing activities on foods that are exclusively regulated by the U.S. Department of Agriculture (USDA) under the Federal Meat Inspection Act (FMIA), the Poultry Products Inspection Act (PPIA), or the Egg Products Inspection Act (EPIA); or
- Foreign persons, except such persons who are transporting food in the United States
- The following facilities are excluded from the provisions requiring the establishment and maintenance of a records system but are not excluded from the records availability requirements:
- Fishing vessels not engaged in processing;
- Retail food establishments employing ten or fewer full time employee;
- Non-profit food establishments; and
- Persons who manufacture, process, pack, transport, distribute, receive, hold, or import food contact surfaces other than the finished container that directly contacts the food
- Non-transporters of food are defined as persons who "own foodor" who "hold, manufacture, process, pack, import, receive or distribute food for purposes other than transportation." The disjunctive in this sentence reaches owners of food in the United States, who are not otherwise excluded from the regulation, whether or not the activity they conduct relates to such food. (emphasis added);
- Transporters of food are defined as persons who have possession, control, or custody of food in the United States solely for the purpose of transporting that food. The requirements for transporters apply equally to foreign persons who transport food in the United States, regardless of whether they have possession, custody, or control of the food for the sole purpose of transporting that food;
- Retail establishments that also sell to persons other than consumers (i.e., facilities that sell food to both consumers and non-consumers) are subject to the record keeping requirements, with respect to their non-consumer sales, "only to the extent the information is reasonably available;"
- Persons who manufacture, process, pack, transport, distribute, receive, hold or import food contact substances, other than the finished container, are exempt from the regulation except the access and availability provisions. However, persons who "place food directly in contact with its finished container" are subject to all of the record keeping regulatory requirements;
- Although restaurants are excluded from the regulation’s requirements, a "restaurant" is defined as a facility that "prepares and sells" food directly to consumers for immediate consumption. (emphasis added); and
- Persons who distribute food directly to consumers are not required to establish and maintain records as to the food so distributed, but must establish and maintain records for food distributed to non-consumers.
General Requirements Under the Record-keeping Regulations: 21 CFR Part 1, Subpart J - Establishment, Maintenance and Availability of Record (§§1.326-1.368)
The regulations identify the specific information that covered persons are required to establish and maintain. The required information is different for transporters and non-transporters of food.
- Non-transporters of food are required to establish and maintain specific detailed information about the food they receive, about the previous source of that food, and about the transporters that deliver that food to them.
- Non-transporters of food are also required to establish and maintain specific detailed information about the food they release, about the nontransporters to whom they release the food, and about the transporters who transport the released food. Additionally, the records of these non-transporters must include information available to them that identifies the specific source of each ingredient used to make every lot of finished product they release.
- Transporters of food are required to establish and maintain detailed information about each food they transport in the U.S.—whether by road, rail, air, or water. Transporters may fulfill the requirements for this information in a number of alternative ways, including:
- Establishing and maintaining the records required by this regulation;
- Establishing and maintaining specified information that is in the records required of roadway interstate transporters by the Department of Transportation’s (DOT) Federal Motor Carrier Safety Administration (FMCSA) contained in 49 CFR 373.101 and 373.103 as of the date of publication of this final rule; or
- Establishing and maintaining specified information that is in the records required of rail and water interstate transporters by the DOT’s Surface Transportation Board (STB) contained in 49 CFR 1035.1 and 1035.2 as of the date of publication of this rule; or
- Establishing and maintaining specified information that is in the records required of international air transporters on air waybills by the Warsaw Convention as Amended at the Hague, 1995 and by Protocol No. 4 of Montreal, 1975 (Warsaw Convention); or
- Entering into an agreement with a nontransporter immediate previous source (if located in the United States) or immediate subsequent recipient (if located in the United States) to establish, maintain, or establish and maintain, the records required under the authority of the FMCSA or the STB. The agreement must contain the elements specified in §1.352(e).
Records Required to be Established and Maintained
The following records, or information contained in records, must be established and maintained by non-transporters of food:
If you are a non-transporter, the following records must be established and maintained:
- The name of the firm, address, telephone number and, if available, the fax number and e-mail address of the non-transporter immediate previous source, whether domestic or foreign;
- The name of the firm, address, telephone number, and, if available, the fax number and e-mail address of the non-transporter immediate subsequent recipient, whether domestic or foreign;
- An adequate description of the type of food received or released, to include brand name and specific variety (e.g., brand x cheddar cheese, not just cheese; or romaine lettuce, not just lettuce);
- The dates you received and released the food;
- For persons who manufacture, process, or pack food, the lot or code number or other identifier of the food (to the extent this information exists);
- The quantity and how the food is packaged (e.g., 6 count bunches, 25 pound (lb) carton, 12 ounce (oz) bottle, 100 gallon (gal) tank);
- The name of the firm, address, telephone number, and, if available, the fax number and e-mail address of the transporter immediate previous source (the transporter who transported the food to you);
- The name of the firm, address, telephone number, and, if available, the fax number and e-mail address of the transporter immediate subsequent recipient (the transporter to whom you released the food); and
- For non-transporters who release food in the United States, your records must include information reasonably available to you to identify the specific source of each ingredient used to make every lot of finished product.
If you are a transporter, you must establish and maintain the following records for all food you receive or release:
- Names of the transporter’s immediate previous source and immediate subsequent recipient;
- Origin and destination points;
- Date shipment received and date released;
- Number of packages;
- Description of freight;
- The Route of movement during the time you transported the food; and
- Transfer point(s) through which shipment moved;
The regulations do not require the creation of new documents or duplication of existing records if the information is already contained in existing records. If the information does not already exist, new records with the requisite information must be created at the time of receipt and release of the food. The regulations do not require covered entities to establish or maintain records, or to make available records, that are: "recipes for food; financial data, pricing data, personnel data, research data, or sales data (other than shipment data regarding sales)."
The regulations set forth the record retention periods for the required information. There are different record retention periods whether or not one is a transporter. The retention periods are as short as six (6) months and as long as two (2) years after the date on which the food is received or released. The length of each retention period relates to the type of entity (non-transporter or transporter) and the degree of risk of spoilage, loss of value, or loss of palatability for the food to which the records relate.
Access to Records
The persons who manufacture, process, pack, transport, distribute, receive, hold or import food in the U.S., and who are required by these regulations to establish/maintain the specific records/information required, must make these records/information "readily available for inspection and photocopying or other means of reproduction . . . as soon as possible, not to exceed 24 hours from the time of receipt of the official request, from an officer or employee duly designated by the Secretary of Health and Human Services who presents appropriate credentials and a written notice." 21 CFR §1.361. FDA is authorized to gain access to these records "[w]hen FDA has a reasonable belief that an article of food is adulterated and presents a threat of serious adverse health consequences or death to humans or animals." Section 1.363 provides that failure to comply with the requirements of these new regulations is a prohibited act under section 301 of the Food Drug and Cosmetic Act.
Draft Guidance for Records Access Authority:
The December 9, 2004 Federal Register Notice of the availability of this draft guidance indicates that it "is intended to clarify the circumstances under which FDA may access and copy records under the [Bioterrorism Act]…and establishes procedures to exercise its authority." 69 FR 71657.
Section B of The Draft Guidance addresses the question, "What records may investigators access and copy under the Bioterrorism Act’s authority?" Guidance at 3.
Depending upon the circumstances, FDA’s authority … may apply to some or all records that are required to be kept by [the new recordkeeping regulations], as well as any other appropriate records already maintained by the entity. Records associated with an article(s) of food that meet the statutory criteria will be requested. These records may be related to the manufacture, processing, packing, transporting, distribution, receipt, holding, or importation of such food that are maintained by or on behalf of an entity subject to the recordkeeping regulation. The records may be in any format (including paper and electronic formats) and at any location. Because the circumstances of a particular event are case specific, the scope of a record request will vary on a case-by-case basis. Id. at 3-4 (emphasis added).
Section D addresses the procedures FDA will follow when it is necessary to access records under the authority of the Bioterrorism Act and pursuant to the new food record-keeping regulations. It describes certain FDA internal procedures, including specific internal notifications, concurrences, consultations, and coordination. See id., section D, at 4.
Section E of the Draft Guidance answers the question, "How does FDA intend t o make a request to access or copy records under the Bioterrorism Act?" in this way:
Once FDA … makes the necessary determination, an investigator or other FDA personnel upon presentation of credentials will submit a written notice, FDA 482 – Notice of Inspection, to the owner, operator, or agent in charge, and inform that person of the records requested and FDA’s legal authority to obtain these records. FDA may request additional records related to the implicated food article at a later time under the same authority. Id. at 4.
The Draft Guidance addresses the issue of confidentiality of "protected information in records it obtains. Basically, FDA invokes its general statutory and regulatory authority to obtain and obligation to protect certain "non-public confidential commercial or trade secret information." It states that "FDA personnel may disclose non-public information otherwise protected from disclosure to the public, if that disclosure is permitted by law and FDA’s procedures." Guidance at 5.
This regulation is effective February 7, 2005; the compliance date is December 9, 2005 except for small businesses (with between 11 and 499 employees) have until June 9, 2006, and for very small businesses (with between 1 and 10 employees) until December 9, 2006.