How the FDA Food Safety Modernization Act Responds to Terrorism Threats: A Primer

Abstract

Legal Perspectives is aimed at informing healthcare providers, emergency planners, and other decision makers about important legal issues related to public health and healthcare preparedness and response. The articles describe these potentially challenging topics and conclude with the authors' suggestions for further action. The articles do not provide legal advice. Therefore, those affected by the issues discussed in this column should seek further guidance from legal counsel. Readers may submit topics of interest to the column's editor, Ryan Morhard, JD, through the Journal's editorial office at jfox@upmc-biosecurity.org.

The FDA Food Safety Modernization Act¹ (FSMA) significantly overhauled the statutory tools used by the US Food and Drug Administration (FDA) to meet its public health mandate, many of which had not changed for more than 70 years. The law focuses on preventing foodborne illness but also strengthens the agency's ability to detect and respond to food safety issues from any source. Although none of the food safety episodes that (at least in part) prompted the law's passage resulted from acts of terrorism,² Congress included in FSMA a number of provisions intended to address the threat that terrorism could pose to the food supply. This article introduces 4 of those provisions, discusses the status of each one's implementation, and offers a recommendation for addressing a major impediment to effective implementation of the law.

FDA's Regulation of Food Products and FSMA

Under the Federal Food, Drug, and Cosmetic Act³ (FFDCA) and the Egg Products Inspections Act,⁴ the FDA regulates an estimated 80-90% of the US food supply.⁵ Congress has tasked the FDA with ensuring the safety⁶ of all domestically produced and imported foods other than certain egg products and most meat and poultry.⁷ The agency approaches this task by enforcing, among other things, good manufacturing practice regulations (GMPs), labeling rules, and food ingredient safety requirements. The FDA assesses compliance through conducting facility inspections, surveillance of products offered for importation, and investigating allegations or evidence of noncompliance from any number of sources.

Upon its January 2011 enactment, FSMA significantly altered the food safety landscape. With FSMA, Congress raised the bar for regulated industry (eg, requiring the performance of hazard analyses and implementation of risk-based preventive controls⁸), augmented the FDA's enforcement capabilities (eg, arming the agency with mandatory recall authority, which it did not previously possess⁹), and funded enhancement of the federal government's foodborne illness surveillance systems.¹⁰ The law created many new obligations for regulated industry and assigned the FDA numerous implementation responsibilities (eg, issuing guidance documents and regulations) as well as conducting specified assessments and drafting various reports.¹¹

In the months since President Obama signed FSMA into law, the agency has worked hard to meet the legislation's ambitious deadlines for implementation. Without the increased resources necessary to meet these timing requirements, the agency has met some deadlines and, as discussed below, missed others.¹² The extent to which FDA's lack of funding¹³ will stunt FSMA's potential impact on food safety certainly warrants discussion. That Congress left many of the implementation details to be developed by regulated industry and the executive branch has engendered considerable uncertainty about FSMA's true impact due, in part, to the funding issue.

Terrorist Attacks and the Food Supply

In the wake of the 2001 terrorist attacks, the specter of terrorism has spurred measures to secure the country's infrastructure, including the food supply. Although the threat of an attack on the food supply may not receive as much attention as those on other infrastructure targets (eg, nuclear power, transportation), we should not discount the threat for a number of reasons. First, features that make the US food production system among the most efficient in the world, such as integration, also leave the domestic food supply particularly vulnerable to disruption.¹⁴ Second, a terrorist organization could potentially launch an attack using readily available pathogens (eg, foot-and-mouth disease) that could devastate food production with considerable speed¹⁵ and have substantial secondary effects on the US economy, including decreases in tourism and trade restrictions.¹⁶ Third, as recently as last year, the US Government Accountability Office acknowledged the federal government's inability to respond rapidly to and recover from such an attack.¹⁷ Fourth, Al Qaeda operatives have at least contemplated an attack on food supplies or agriculture.¹⁸ For these and other reasons, most would agree that the nation's food defense system needs bolstering. In FSMA, Congress sought to supplement the existing counterterrorism regime—including, as regards the FDA's role, the Public Health Security and Bioterrorism Preparedness and Response Act of 2002¹⁹—by enacting (among others) the provisions discussed below.

FSMA Provisions Responding to the Terrorism Threat

Section 103: Hazard Analysis and Preventive Controls

As noted above, FSMA will require food facilities to perform a hazard analysis and implement risk-based preventive controls “to significantly minimize or prevent the occurrence of such hazards and provide assurances that such food is not adulterated … or misbranded^[20] …, monitor the performance of those controls, and maintain records of this monitoring as a matter of routine practice.”²¹ During the hazard analysis, the facility must “identify and evaluate hazards that may be intentionally introduced, including by acts of terrorism.”²² In turn, the facility's preventive controls²³ must account for such hazards.²⁴ The law also requires preparation and maintenance of a written plan documenting the analysis and controls implemented²⁵ and authorizes the FDA to “require a reanalysis … to respond to new hazards and developments in scientific understanding, including, as appropriate, results from the Department of Homeland Security [DHS] biological, chemical, radiological, or other terrorism risk assessment.”²⁶

As regards hazards introduced through acts of terrorism, section 103 presents new challenges for industry. In September 2011, John Hoffman, Senior Research Fellow with the National Center for Food Protection and Defense, testified before a Senate committee as follows:

This is a new responsibility for the sector that has many potential unintended consequences that must be considered before a reasonable implementation of the act can be fully complete. For example, what will be the insurance consequences of this act? How will a firm have any ability to reasonably foresee an intentional act? How does a private sector firm know where the critical point of protection against an intentional act will be when there are currently only limited means to gather, assess, and share such threat information between the government and the private sector?²⁷

Indeed, in providing examples of preventive controls, the statute does not list any controls addressing intentionally introduced hazards, particularly those introduced by acts of terrorism.²⁸ However, Congress clearly recognized that the FDA and industry might require assistance in this regard. Section 103 requires the FDA to promulgate implementing regulations requiring “minimum standards” for compliance and, with regard to intentionally introduced hazards, requires coordination with DHS “as appropriate.”²⁹ Further, as discussed below, Section 106 requires additional FDA assessment and rulemaking on the subject.

It bears noting that the FDA already provides resources for addressing the threat of intentionally introduced hazards. For example, on its website, the agency offers a “Vulnerability Assessment Software tool … that can be used to assess the vulnerabilities within a system or infrastructure in the food industry.”³⁰ The tool employs the CARVER+Shock methodology,³¹ originally developed by the US military, which could serve as the model for the FDA's section 103 regulations. Still, the assessments required by section 106 should strengthen the agency's knowledge base and, in turn, the quality of its important work.

Section 106: Protection Against Intentional Adulteration

FSMA requires that the FDA:

• conduct a vulnerability assessment of the food system, including consideration of DHS biological, chemical, radiological, or other terrorism risk assessments;

• consider the best available understanding of uncertainties, risks, costs, and benefits associated with guarding against intentional adulteration of food at vulnerable points; and

• determine the types of science-based mitigation strategies or measures that are necessary to protect against the intentional adulteration of food.³²

Presumably based on the fruits of these assessments,³³ the FDA must consult with DHS in promulgating regulations to protect against the intentional adulteration of food subject to the FFDCA. FSMA requires that the regulations:

• specify how a person shall assess whether the person is required to implement mitigation strategies or measures intended to protect against the intentional adulteration of food; and

• specify appropriate science-based mitigation strategies or measures to prepare and protect the food supply chain at specific vulnerable points, as appropriate.³⁴

These regulations will apply only to food determined to have a high risk for intentional contamination that could cause serious adverse health consequences or death to humans or animals, including foods:

• for which the FDA has identified clear vulnerabilities (including short shelf-life or susceptibility to intentional contamination at critical control points); and

• in bulk or batch form, prior to being packaged for the final consumer.³⁵

It bears noting that FSMA provides: “In the interest of national security, [FDA], in consultation with the Secretary of Homeland Security, may determine the time, manner, and form in which [the assessments] are made publicly available.”³⁶ Thus, industry may not have access to these assessments for use in conducting hazard analyses and developing preventive controls. To the extent that the assessments will become part of the record underlying the required rulemaking, however, industry and ultimately the consuming public will benefit from the FDA's conducting them.

Section 105: Standards for Produce Safety

FSMA also requires the FDA to coordinate with the US Department of Agriculture (USDA) and its state counterparts, and to consult with DHS, in issuing regulations establishing science-based minimum standards for the safe production and harvesting of fruits and vegetables.³⁷ In particular, the regulations must establish standards for the production and harvesting of fruits and vegetables, including specific mixes or categories thereof, that are raw agricultural commodities³⁸ and for which the FDA determines that such standards “would minimize the risk of serious adverse health consequences or death.” FSMA prioritizes implementation of regulations “for specific fruits and vegetables … based on known risks which may include a history and severity of foodborne illness outbreaks.”³⁹ Recent domestic outbreaks of note have involved cantaloupes, strawberries, romaine lettuce, and spinach.⁴⁰

Relevant for present purposes, the law provides that, in conducting the rulemaking, the FDA must “consider hazards that occur naturally, may be unintentionally introduced, or may be intentionally introduced, including by acts of terrorism.”⁴¹ While FSMA required the FDA to issue a proposed rule within 1 year after the law's enactment, as of the time of this writing, the agency has yet to do so.⁴² Thus, precisely how these standards will reflect the FDA's consideration of the terrorism threat remains to be seen.

Section 108: National Agriculture and Food Defense Strategy

FSMA requires the FDA and the USDA to coordinate with DHS in preparing a new National Agriculture and Defense Strategy.⁴³ The strategy must describe the processes by which the 3 agencies will achieve a number of specific goals relating to preparedness, detection, emergency response, and recovery.⁴⁴ The strategy also must include an implementation plan, present a “coordinated research agenda,” and “be consistent with” related plans (eg, the National Infrastructure Protection Plan, the National Preparedness Goals).⁴⁵ In preparing the strategy, the federal government has an opportunity to address one of the main criticisms of the executive branch's existing food and agriculture defense policy: the lack of centralized coordination to oversee implementation.⁴⁶ FSMA required completion of the strategy within 1 year after enactment.⁴⁷ Again, the agencies do not appear to have met the statutory deadline.

Conclusion and Recommendation

FSMA recognizes the threat of terrorist attacks on the US food supply, assigning responsibilities for meeting that threat to the nation's farmers, food manufacturers, and primary food safety agencies. Perhaps appropriately, the law left many of the details to be determined by regulated industry and the executive branch, in some cases after needed assessment and study. Implementation of a number of provisions has taken longer than Congress envisioned.

The FDA's missed deadlines stem, at least in part, from Congress's failure to provide the agency with adequate funding for FSMA's implementation. Criticizing Congress for failing to provide an agency with the resources necessary to meet new responsibilities hardly qualifies as unique or astute. However, since FSMA's enactment, the FDA has consistently warned of the consequences of Congress's severely underfunding the law's implementation. The legislature's failure to address the issue has had unfortunate yet predictable results. Specifically, the FDA has had to prioritize implementation based on its own risk assessments in lieu of meeting Congress's deadlines for action.⁴⁸ To ensure the FDA implements the law consistent with Congress's intent, the legislature should choose between appropriating to the FDA adequate resources for FSMA's implementation (or authorizing the FDA to collect needed funds from industry) and revisiting aspects of FSMA in light of fiscal conditions.

Footnotes

1

Pub. L. No. 111-353, 124 Stat. 3885 (2011).

2

See Joseph A. Levitt & Stuart M. Pape, FDA Food Safety Modernization Act: The Road to Passage, in The Food Safety Modernization Act: A Comprehensive, Practical Guide to the Landmark Legislation 25, 26-27 (James W. Woodlee, ed., 2012) [hereinafter FSMA Guide] (explaining how FSMA's development “followed a series of three high-profile foodborne illness outbreaks” involving spinach contaminated with a strain of E. coli thought to be spread by animal feces, a pet food ingredient intentionally adulterated with melamine, and peanut butter contaminated with Salmonella).

3

21 U.S.C. §§ 301 et. seq. (2011).

4

21 U.S.C. §§ 1031 et. seq. (2011).

5

See Renée Johnson, Cong. Research Serv., RS22600, The Federal Food Safety System: A Primer 1 (2012).

6

In this field, “[t]he terms ‘food defense,’ ‘food safety,’ and ‘food security’ refer to different issues. Food defense refers to protecting the food supply from intentional contamination.… Food safety refers to avoiding accidental contamination.… Food security refers to having access to enough food. …” Jim Monke, Cong. Research Serv., RL32521, Agroterrorism: Threat and Preparedness 1 n.1 (2007). For simplicity's sake, this article will use the term “safety” to refer to protection against both intentional and unintentional contamination, both of which, among other things, may threaten “food security.”

7

See Johnson, supra note 5, at 1-4 (describing the division of regulatory authority over food between the FDA and the US Department of Agriculture's Food Safety and Inspection Service).

8

See discussion of FSMA § 103, infra.

9

FSMA § 206(a), 124 Stat. at 3940 (to be codified at 21 U.S.C. § 350l).

10

FSMA § 205, 124 Stat. at 3937.

11

Regrettably, space does not permit a comprehensive treatment of FSMA here.

12

For example, the FDA met its 120-day deadline for issuing an interim final rule implementing a statutory amendment requiring importers to provide advance notice that another country has previously refused the shipment. See FSMA § 304(b), 124 Stat. at 3958; 76 Fed. Reg. 25,542 (May 5, 2011) (amending 21 C.F.R. § 1.281). The FDA has missed other deadlines. For example, it missed its 1-year deadline for issuing a proposed rule regarding produce safety standards. See FSMA § 105(a), 124 Stat. at 3899 (to be codified at 21 U.S.C. § 350h(a)(1)(A)).

13

See Elizabeth B. Fawell & Maile G. Hermida, FDA's Implementation: Strategy and Challenges, in FSMA Guide, supra note 2, at 179, 187 (explaining how the additional $39 million appropriated to FDA in fiscal year 2012 for FSMA implementation “is only a small fraction of” the funding that the Congressional Budget Office estimated the FDA will require for FSMA's implementation over the first 5 years).

14

See Roger Breeze, Agroterrorism: Betting Far More than the Farm, 2 Biosecurity & Bioterrorism: Biodefense Strategy, Practice, & Sci. 251, 257 (2004).

15

See O. Shawn Cupp, David E. Walker, & John Hillison, Agroterrorism in the U.S.: Key Security Challenge for the 21st Century, 2 Biosecurity & Bioterrorism: Biodefense Strategy, Practice, & Sci. 97, 100 (2004).

16

Monke, supra note 6, at 8.

17

US Gov't Accountability Office, GAO-11-652, Homeland Security: Actions Needed to Improve Response to Potential Terrorist Attacks and Natural Disasters Affecting Food and Agriculture 34 (2011) [hereinafter GAO-11-652].

18

Monke, supra note 6, at 1.

19

Pub. L. No. 107-188, 116 Stat. 594 (2002). The act included a number of provisions aimed at protecting the safety and security of the food supply. See §§ 301-315, 116 Stat. at 662-675.

20

The FFDCA prohibits, inter alia, the interstate shipment of foods considered “adulterated” or “misbranded.” 21 U.S.C. § 331(a) (2010). At sections 402 and 403, the FFDCA designates the various conditions under which an article of food qualifies as either “adulterated” or “misbranded,” respectively. See §§ 342, 343. For example, the FFDCA deems an article of food “adulterated” if the article “contains any poisonous or deleterious substance which may render it injurious to health,” “if it consists in whole or in part of any filthy, putrid, or decomposed substance, or if it is otherwise unfit for food,” or “if any substance has been added thereto or mixed or packaged therewith so as to increase its bulk or weight, or reduce its quality or strength, or make it appear better or of greater value than it is.” § 342(a)(1), (a)(3), (b)(4). In general, a misbranding occurs upon the violation of a requirement relating to the food's labeling or other market representations. See, eg, § 343(a)(1) (deeming an article of food “misbranded” if “its labeling is false or misleading in any particular”).

21

FSMA § 103(a), 124 Stat. at 3889 (to be codified at 21 U.S.C. § 350g(a)).

22

FSMA § 103(a), 124 Stat. at 3890 (to be codified at 21 U.S.C. § 350g(b)(2)).

23

FSMA defines “preventive controls” as “those risk-based, reasonably appropriate procedures, practices, and processes that a person knowledgeable about the safe manufacturing, processing, packing, or holding of food would employ to significantly minimize or prevent the hazards identified under the hazard analysis … and that are consistent with the current scientific understanding of safe food manufacturing, processing, packing, or holding at the time of the analysis.” FSMA § 103(a), 124 Stat. at 3896 (to be codified at 21 U.S.C. § 350g(o)).

24

FSMA § 103(a), 124 Stat. at 3890 (to be codified at 21 U.S.C. § 350g(c)(2)). The law states that such controls must address intentionally introduced hazards “consistent with” new FFDCA section 420 (to be codified at 21 U.S.C. 350i and discussed below) “as applicable.”

25

FSMA § 103(a), 124 Stat. at 3891 (to be codified at 21 U.S.C. § 350g(h)).

26

FSMA § 103(a), 124 Stat. at 3891 (to be codified at 21 U.S.C. § 350g(i)). This provision also requires reanalysis “whenever a significant change is made in the activities conducted at a facility operated by such owner, operator, or agent if the change creates a reasonable potential for a new hazard or a significant increase in a previously identified hazard or not less frequently than once every 3 years, whichever is earlier.”

27

Agro-Defense: Responding to Threats Against America's Agriculture and Food System: Hearing Before the Senate Subcommittee on Oversight of Government Management, the Federal Workforce and the District of Columbia of the Senate Committee on Homeland Security and Governmental Affairs, 112th Cong. (2011) (statement of Colonel John T. Hoffman (Ret.), Senior Research Fellow, National Center for Food Protection and Defense, University of Minnesota).

28

FSMA § 103(a), 124 Stat. at 3896 (to be codified at 21 U.S.C. § 350g(o)). Provided examples include sanitation procedures for food contact surfaces and utensils and food contact surfaces of equipment, hygiene training, an environmental monitoring program to verify the effectiveness of pathogen controls in processes where a food is exposed to a potential contaminant in the environment, a food allergen control program, a recall plan, GMPs, and supplier verification activities that relate to the safety of food.

29

FSMA § 103(a), 124 Stat. at 3896 (to be codified at 21 U.S.C. § 350g(n)(1), (2)). The law requires industry to conduct hazard analyses and implement preventive controls within 18 months of FSMA's enactment regardless of whether the FDA meets its 18-month deadline for promulgating implementing regulations. FSMA § 103(i)(1), 124 Stat. at 3898. The FDA failed to meet its deadline, and, as of this writing, the agency has not yet issued the required regulations. However, in a trio of letters to industry groups issued on June 18, 2012, FDA's Deputy Commissioner of Foods wrote that “FDA will expect to enforce compliance with” the preventive controls requirements “in timeframes that will be described in the final rule[].” Letter from Michael R. Taylor to Jeannie Shaughnessy Hodges (June 18, 2012), http://www.fda.gov/AboutFDA/CentersOffices/OfficeofFoods/CFSAN/CFSANFOIAElectronicReadingRoom/ucm310085.htm; Letter from Michael R. Taylor to Leon Bruner (June 18, 2012), http://www.fda.gov/AboutFDA/CentersOffices/OfficeofFoods/CFSAN/CFSANFOIAElectronicReadingRoom/ucm310084.htm; Letter from Michael R. Taylor to James A. McCarthy (June 18, 2012), .

30

FDA, Vulnerability Assessment Tool, (last visited July 17, 2012).

31

See FDA explains the methodology as follows:

The risk assessment follows the acronym CARVER, which stands for six attributes that are used to evaluate targets for an attack:

• Criticality: What impact would an attack have on public health and the economy?

• Accessibility: How easily can a terrorist access a target?

• Recuperability: How well could a system recover from an attack?

• Vulnerability: How easily could an attack be accomplished?

• Effect: What would be the direct loss from an attack, as measured by loss in production?

• Recognizability: How easily could a terrorist identify a target?

The CARVER tool also evaluates a seventh attribute—the psychological impacts of an attack or “shock” attributes of a target. For example, the psychological impact tends to be greater if there is a large number of deaths involved or if the target has historical or cultural significance.

FDA, CARVER+Shock: Enhancing Food Defense 1-2 (2010) available at .

32

FSMA § 106(a), 124 Stat. at 3905 (to be codified at 21 U.S.C. § 350i(a)(1)).

33

While FSMA does not provide a deadline for performing the assessments, the law requires issuance of regulations within 18 months after enactment. FSMA § 106(a), 124 Stat. at 3905 (to be codified at 21 U.S.C. § 350i(a), (b)).

34

FSMA § 106(a), 124 Stat. at 3905 (to be codified at 21 U.S.C. § 350i(b)). The FDA must exempt farms (other than those that produce milk) from compliance with these regulations. FSMA § 106(a), 124 Stat. at 3906 (to be codified at 21 U.S.C. § 350i(d)).

35

FSMA § 106(a), 124 Stat. at 3905-06 (to be codified at 21 U.S.C. § 350i(c)).

36

FSMA § 106(a), 124 Stat. at 3905 (to be codified at 21 U.S.C. § 350i(a)(2)).

37

FSMA § 105(a), 124 Stat. at 3899-3900 (to be codified at 21 U.S.C. § 350h(a)(1)(A)).

38

The FFDCA defines “raw agricultural commodity” as “any food in its raw state, including all fruits that are washed, colored, or otherwise treated in their unpeeled natural form prior to marketing.” 21 U.S.C. § 321(r) (2010).

39

FSMA § 105(a), 124 Stat. at 3900-01 (to be codified at 21 U.S.C. § 350h(a)(4)).

40

See Leslie T. Krasny, Produce Safety Standards, in FSMA Guide, supra note 2, at 63, 65-66; Levitt & Pape, supra note 2, at 26-27.

41

FSMA § 105(a), 124 Stat. at 3900 (to be codified at 21 U.S.C. § 350h(a)(3)(C)).

42

FSMA § 105(a), 124 Stat. at 3899 (to be codified at 21 U.S.C. § 350h(a)(1)(A)).

43

FSMA § 108(a), 124 Stat. at 3911.

44

FSMA § 108(b)(2), 124 Stat. at 3911-12.

45

FSMA § 108(a)(2), (3), (5), 124 Stat. at 3911.

46

GAO-11-652, supra note 17, at 8 (discussing Homeland Security Presidential Directive-9 (2004)).

47

FSMA § 108(a)(1), 124 Stat. at 3911.

48

See Stephanie Beasley, FDA Turns to Risk-Based Plan, New Office to Set Food Priorities Due to Resource Limits, Inside Health Pol'y (May 18, 2012), .