FDA recently published the final rule requiring persons who manufacture, process, pack, transport, distribute, receive, hold, or import food in the United States to establish and maintain chain of custody records. The purpose of these records is to improve the agency’s ability to respond to an accidental or deliberate contamination of food. FDA was authorized to impose recordkeeping requirements under the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (the Bioterrorism Act), which also authorized the agency to access and copy the records when it reasonably believes that food is adulterated and presents a credible threat of serious adverse health consequences or death to humans or animals.

The final rule applies to food, which includes dietary supplements, dietary ingredients, infant formula, beverages (including alcoholic beverages and bottled water), fruits and vegetables, fish and seafood, raw agricultural commodities for use as food or components of food, animal feed, and pet food. In a significant departure from the proposed recordkeeping rule, foreign persons are exempt, except for those who transport food in the United States. Also excluded from the final rule are farms, restaurants, and persons who handle food under the exclusive jurisdiction of the U.S. Department of Agriculture. Still other entities, such as fishing vessels, nonprofit food establishments, and small retail food establishments (those with fewer than 10 full-time equivalent employees) are excluded from the requirement to establish and maintain records under the rule, but are subject to the record availability requirements for existing records.

The content of the required records depends on whether the person keeping them is a “transporter” or a “nontransporter.” A nontransporter (anyone who owns food or who holds, manufactures, processes, packs, imports, receives, or distributes food for purposes other than transportation) must keep records on: 1) the immediate previous source that is a transporter; 2) the immediate previous source that is a nontransporter; 3) the immediate subsequent recipient that is a transporter; and 4) the immediate subsequent recipient that is a nontransporter. The records always include the name of and contact information for the other party - foreign or domestic. A nontransporter’s records on the immediate previous and immediate subsequent nontranporters must also include additional information, including the type of food, the date it was received or released, and the quantity and type of packaging (e.g., six 50 lb. cartons). A person who manufactures, processes, or packs food also must include lot or code numbers or other identifiers to the extent that information is reasonably available. Those who distribute food directly to consumers, however, do not have to establish and maintain records on the immediate subsequent recipients of food (i.e., consumers). The requirements are different for a transporter (anyone who has possession of food for the purpose of transporting it), and can be satisfied by certain Department of Transportation records or by having an agreement with a nontransporter to keep the required records on the transporter’s behalf.

While the rule specifies the required content of the records, it does not prescribe any particular form. Thus, existing records can be used to satisfy the rule if they contain all of the required information. The record retention requirements range from 6 months to 2 years, depending on the type of food and whether the recordkeeper is a transporter or nontransporter.

When FDA reasonably believes that an article of food is adulterated and presents a threat of serious adverse health consequences, records must be made available for the agency to inspect and copy “as soon as possible,” but not to exceed 24 hours from receipt of its request. FDA has issued a Draft Guidance describing the internal procedures the agency will follow before requesting access to records (available at http://www.cfsan.fda.gov/~dms/secgui12.html).

Recipes and financial, pricing, personnel, research, and sales data (other than shipment data regarding sales) are excluded from the scope of the rule. The required records may, however, contain other confidential commercial or trade secret information, and the Bioterrorism Act directs FDA to take appropriate measures to prevent the unauthorized disclosure of such information. While the recordkeeping rule contains no provision specific to the handling of confidential commercial and trade secret information, FDA has said that it will comply with all applicable legal requirements regarding its protection.

Compliance with the rule is required by December 9, 2005, except for small businesses (11-499 full-time equivalent employees) and very small businesses (10 or fewer full-time equivalent employees), which have additional time to comply.