Research · 11 min read
Who Learns Your Name When a Medication Is Recalled
A recall that has to reach the person holding the medicine has to find that person first. One paragraph of the federal privacy rule is what lets a company be told who to look for.
Key takeaways
- One route in the public health standard runs to a private company subject to the agency's jurisdiction, not to a government office.
- The purpose is fenced: activities related to the quality, safety or effectiveness of the regulated product that company is responsible for.
- Four purposes are printed underneath it, including recalls and lookback, which the rule defines as locating and notifying individuals.
- A recall strategy specifies a depth, and only a consumer or user level recall is aimed at the person holding the product.
- The recall rules describe themselves as guidance and call recall a voluntary action rather than an order.
- The privacy paragraph is permissive throughout, so it describes what a covered entity may do rather than what any company does.
Answer first: one route runs to a company, not a government office
The federal privacy rule has a standard covering public health activities. Most of what it permits runs toward government.
One route in it does not. It permits disclosure to a person subject to the jurisdiction of the Food and Drug Administration, with respect to a regulated product or activity that person is responsible for.
The purpose is limited in the same sentence. The disclosure has to be for activities related to the quality, safety or effectiveness of that regulated product or activity.
So a manufacturer, and an outsourcing facility, can sit on the receiving end of a permitted disclosure about an identifiable patient. That is a different shape from the reporting most people picture.
The four purposes the rule prints underneath it
The paragraph does not stop at a general purpose. It lists four, introduced by the words such purposes include.
The first is to collect or report adverse events, product defects or problems, or biological product deviations. Product problems are defined in the same breath to include problems with the use or labeling of a product.
The second is short enough to quote whole: to track FDA-regulated products.
The third is the one that reaches a person. It permits disclosure to enable product recalls, repairs, or replacement, or lookback. The rule spells lookback out as locating and notifying individuals who have received products that have been recalled, withdrawn, or are the subject of lookback.
The fourth is to conduct post marketing surveillance.
Why locating a person is a real step and not a figure of speech
A separate rulebook, written for the agency and the firms it regulates, sets out how a recall is planned. It calls that plan a recall strategy.
One element of a strategy is depth. Depending on the hazard and how widely the product went out, the strategy specifies the level in the distribution chain the recall reaches.
Three levels are named. Consumer or user level, which may vary with the product and include any intermediate wholesale or retail level. Retail level. Wholesale level.
A recall that stops at wholesale never needs to know who took the medicine. A recall specified to consumer level does, and that is where the privacy paragraph becomes operative.
The same rule adds effectiveness checks. Their stated purpose is to verify that everyone at the specified depth received notification and took appropriate action, by personal visits, telephone calls, letters, or a combination.
The recall rulebook describes itself as guidance
Reading that section without its own framing would overstate it. The policy section above it calls recall a voluntary action.
It says manufacturers and distributors carry out a responsibility to protect the public, and that these sections recognize the voluntary nature of recall by providing guidance.
It also describes recall as an alternative to a court action for removing or correcting a violative product that has already been distributed.
A firm may recall on its own initiative at any time, or at the agency's request, and the rule reserves an agency request for urgent situations.
Who else is inside the same standard
The public health standard has six routes, and the agency route is the third. The others are worth knowing because they explain the heading.
The first runs to a public health authority authorized by law to collect the information for preventing or controlling disease, injury or disability. That covers reporting of disease and injury, vital events such as birth or death, and public health surveillance, investigations and interventions.
A public health authority is a defined term. It reaches an agency of the United States, a state, a territory, a political subdivision, or an Indian tribe. It also reaches a person or entity acting under a grant of authority from or contract with such an agency, where that person is responsible for public health matters as part of its official mandate.
The remaining routes cover reports of child abuse or neglect, and notification of a person who may have been exposed to a communicable disease. They also cover a narrow employer route developed separately, and proof of immunization sent to a school.
One line at the end matters for anyone reading a government privacy notice. Where the covered entity is itself a public health authority, it may use information in every case where it could have disclosed it.
What a reader can actually look at
Whether a privacy notice describes disclosures for public health activities at all, since a notice has to put you on notice of purposes that do not need your authorization.
Whether it separates disclosure to a government authority from disclosure to a regulated company, because the rule does and most notices do not.
Whether the program names the pharmacy or facility that makes what it ships, since that is the party a lookback would run through.
Whether a program tells you how it would reach you if a batch were pulled, and by what channel.
Whether the address and phone number you gave at signup are still ones that reach you, since a consumer-level recall is only as good as the contact details behind it.
What this does not decide
It does not say that any company has made such a disclosure, or that any product has been recalled. The paragraph is a permission with conditions attached.
It does not say a company must disclose anything. Every standard in this section of the privacy rule is written as a may.
It does not describe the whole public health standard, and it does not touch the other eleven lettered standards in the same section.
And it is not legal advice. It reports what two federal rules say, in their own words.
Sources
- 45 CFR 164.512, "Uses and disclosures for which an authorization or opportunity to agree or object is not required", read at paragraph (b)Paragraph (b)(1), permitting use or disclosure for the public health activities and purposes described in it, and its six routes. Paragraph (b)(1)(i), disclosure to a public health authority authorized by law to collect or receive the information for the purpose of preventing or controlling disease, injury, or disability, including the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions. Paragraph (b)(1)(ii), a public health or other appropriate government authority authorized by law to receive reports of child abuse or neglect. Paragraph (b)(1)(iii), disclosure to a person subject to the jurisdiction of the Food and Drug Administration with respect to an FDA-regulated product or activity for which that person has responsibility, for the purpose of activities related to the quality, safety or effectiveness of such product or activity, and the four purposes listed at (A) through (D): collecting or reporting adverse events, product defects or problems including problems with the use or labeling of a product, and biological product deviations; tracking FDA-regulated products; enabling product recalls, repairs, or replacement, or lookback, including locating and notifying individuals who have received products that have been recalled, withdrawn, or are the subject of lookback; and conducting post marketing surveillance. Paragraph (b)(1)(iv), notification of a person who may have been exposed to a communicable disease where the entity or authority is authorized by law to notify. Paragraph (b)(1)(vi), disclosure to a school limited to proof of immunization, where state or other law requires such proof before admission, and only where the entity obtains and documents an agreement. Paragraph (b)(2), permitting a covered entity that is also a public health authority to use information in all cases where it may disclose it.
- 45 CFR 164.501, "Definitions", read at the defined term public health authorityThe definition of public health authority: an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate.
- 21 CFR 7.42, "Recall strategy"Paragraph (b)(1), depth of recall, that depending on the product's degree of hazard and extent of distribution the recall strategy will specify the level in the distribution chain to which the recall is to extend, and the three levels named: consumer or user level, which may vary with product, including any intermediate wholesale or retail level; retail level, including any intermediate wholesale level; and wholesale level. Paragraph (b)(3), effectiveness checks, that their purpose is to verify that all consignees at the recall depth specified by the strategy have received notification about the recall and have taken appropriate action, and that the method for contacting consignees may be accomplished by personal visits, telephone calls, letters, or a combination thereof.
- 21 CFR 7.40, "Recall policy"Paragraph (a), that recall is a voluntary action that takes place because manufacturers and distributors carry out their responsibility to protect the public health, that this section and the sections following it recognize the voluntary nature of recall by providing guidance so that responsible firms may effectively discharge their recall responsibilities, and that recall is an alternative to an agency-initiated court action for removing or correcting violative distributed products. Paragraph (b), that recall may be undertaken voluntarily and at any time by manufacturers and distributors, or at the request of the agency, and that such a request is reserved for urgent situations.
Frequently asked questions
Can a drug company be told who I am under the federal privacy rule?
One paragraph permits it in a narrow way. A covered entity may disclose protected health information to a person subject to the jurisdiction of the Food and Drug Administration, with respect to a regulated product or activity that person has responsibility for. The purpose has to be activities related to the quality, safety or effectiveness of that product or activity. The rule then lists four such purposes: adverse event and product problem reporting, product tracking, recalls and lookback, and post marketing surveillance. It is a permission, not an instruction, and it does not reach a company with no responsibility for the product.
What does lookback mean in this rule?
The rule defines it inside the sentence that permits it. Disclosure is permitted to enable product recalls, repairs, or replacement, or lookback. Lookback is described as including locating and notifying individuals who have received products that have been recalled, withdrawn, or are the subject of lookback. So the word covers the work of finding people, not only the decision to pull a batch.
Does every recall reach the person holding the medicine?
No. The recall rules ask a firm to build a recall strategy, and one element of that strategy is depth. The strategy specifies the level in the distribution chain the recall extends to, and three are named: consumer or user level, retail level, and wholesale level. Only a recall specified to consumer or user level is aimed at the person holding the product. The same rules add effectiveness checks, whose stated purpose is to verify that everyone at the specified depth received notification and took appropriate action.
Is a recall something the agency orders?
The recall policy section calls recall a voluntary action taken by manufacturers and distributors, and says these sections recognize that voluntary nature by providing guidance. A firm may recall on its own initiative at any time, or at the agency's request, and the rule reserves a request for urgent situations. The policy also frames recall as an alternative to a court action for removing or correcting a product that has already been distributed.
Who else can receive information under the public health standard?
Six routes sit in the standard. A public health authority collecting information to prevent or control disease, injury or disability. A public health or other government authority authorized to receive reports of child abuse or neglect. A person subject to the agency's jurisdiction, for the four product purposes. A person who may have been exposed to a communicable disease, where notification is authorized by law. An employer, on narrow conditions covered separately. And a school, limited to proof of immunization and only with a documented agreement.
Would I be told that my information went out this way?
Not by this standard, which says nothing at all about notifying you. A separate right in the same subpart lets you request an accounting of disclosures, and it is covered on its own. An accounting is something you ask for afterwards rather than a message that arrives, and it carries its own clock, its own content rules and a list of things it leaves out.