U.S. FDA Issues First Drug Supply Chain Security Act Warning Letter Targeting a Dispenser, Signaling Expanded Enforcement Focus

The U.S. Food and Drug Administration (FDA) has issued what appears to be the first-ever warning letter to a “dispenser” under the Drug Supply Chain Security Act (DSCSA), targeting a medical spa.

The DSCSA applies to “trading partners” in the pharmaceutical supply chain, but to date FDA has focused its DSCSA enforcement efforts on manufacturers and distributors. However, in addition to retail pharmacies, hospital pharmacies, and chain pharmacies, any other “person authorized to dispense or administer human prescription drugs” is regulated by the DSCSA as a dispenser and must comply with corresponding requirements in Section 582(d) of the Federal Food, Drug, and Cosmetic Act (FD&C Act).

FDA’s latest action demonstrates that FDA is willing to use its authorities under the DSCSA to reach beyond traditional pharmacies as dispensers and target providers and individual practitioners, such as the medical spa here. Accordingly, any entity that administers prescription drugs under physician supervision should assess its DSCSA compliance posture in light of this development.

Inspection Findings and Alleged Violations

FDA inspected the medical spa over three days, focusing on the facility’s sourcing of an FDA-regulated prescription drug product that carries a boxed warning for the risk of serious and life-threatening adverse effects. At the conclusion of the inspection, FDA issued a Form FDA 483 to the facility outlining its inspectional observations. The med spa submitted a response that FDA found inadequate for reasons discussed below.

The ensuing warning letter highlights two alleged DSCSA violations.

1. Conducting Transactions With Unauthorized Trading Partners (Section 582(d)(3))

FDA obtained purchase records directly from the prescription drug manufacturer and compared them to the med spa’s patient treatment records. FDA alleged that comparison of the two sets of records revealed that the med spa had administered to patients substantially more product identified as this drug than could be explained by the med spa’s purchases from the manufacturer through legitimate channels. The facility offered no explanation for the discrepancy during the inspection, according to the warning letter. FDA also noted that the only purchase record showing a larger-than-usual order from the manufacturer was dated after FDA inspectors had arrived on site. FDA concluded that the facility had obtained the drug from unauthorized sources while representing these products to patients as authentic drug products.

2. Engaging in Transactions Involving Product Without a Required Product Identifier (Section 582(d)(2))

During the inspection, FDA also recovered from the facility’s trash an unlabeled, clear vial containing a ring of white powder. Laboratory analysis confirmed it contained the ingredients in the drug, but the vial’s shape was inconsistent with authentic manufacturer packaging. The facility’s manager denied any knowledge of the product. FDA found that the vial lacked the requisite product identifier (a standardized graphic encoding the lot number, expiration date, and standardized numerical identifier) and that the facility had engaged in a transaction involving a noncompliant product.

Inadequate Form FDA 483 Response

The warning letter criticized the med spa’s FDA 483 response for failing to explain how the facility would ensure future DSCSA compliance, lacking supporting documentation such as updated policies and procedures, and failing to address the significant purchase-to-administration volume discrepancy. FDA also highlighted the facility’s unsubstantiated claim that a drug custodian had been appointed, noting that the facility manager had a documented history of obtaining unapproved products from foreign, unverified sources.

Potential Implications for Other Aesthetic Clinics and Providers

As noted, the approach of this warning letter reflects that FDA may continue to use the DSCSA as an enforcement tool against providers and individual practitioners. The statutory hook is straightforward: Section 581(3)’s definition of “dispenser” captures any person authorized by law to dispense or administer prescription drugs, regardless of whether that entity is a pharmacy engaging in the traditional activities of accepting prescriptions and delivering drugs. Such entities may have never considered themselves DSCSA-regulated and may lack the procedural and documentation infrastructure DSCSA compliance requires.

FDA’s enforcement methodology is also noteworthy. By first obtaining purchase records directly from the manufacturer, FDA alleged that it had created an independent evidentiary record which FDA could use to challenge the facility. The agency could use the same cross-referencing technique in other scenarios in which products are alleged to be sourced outside legitimate channels. Accordingly, clinical providers should assume that FDA can and will go to manufacturers and other supply chain partners to verify purchasing claims.

This warning letter fits a broader enforcement pattern. FDA has been actively combating the infiltration of counterfeit and unapproved products into the aesthetic medicine market, including through other warning letters and DOJ criminal referrals. The DSCSA provides FDA a statutory basis to pursue enforcement against aesthetic medicine providers without needing to prove substantive adulteration or misbranding, potentially lowering the evidentiary threshold for future actions.

This enforcement action is unlikely to be isolated. FDA’s Office of Drug Security, Integrity, and Response has clearly prioritized counterfeit and unapproved aesthetic injectables, and this letter establishes a template for future DSCSA actions against nontraditional dispensers.

Sidley is monitoring enforcement activity in this area. Companies and providers with questions about DSCSA compliance or inspection readiness should contact the attorneys listed below.