■ December 13, 2019, 04:00 AM EDT

FDA recalls are always voluntary and sometimes haphazard—and the agency doesn’t want more authority to protect consumers.

In mid-September the U.S. Food and Drug Administration received a 19-page document with some startling claims about a popular medicine. The online pharmacy Valisure, which tests prescription drugs before dispensing them, said it had found extremely high levels of a probable human carcinogen in the antacid ranitidine, best known under the brand name Zantac. Millions of people around the world use ranitidine; it’s available both with a prescription and over the counter. As for the carcinogen, NDMA, the FDA knew it well: For more than a year the agency had been recalling batches of the blood pressure medication valsartan because they were contaminated with it.

The FDA issued an alert, one that seemed to downplay Valisure’s findings. The agency said it had learned that some ranitidine medicines contained low levels of NDMA, but it wasn’t advising people to stop taking the drug. Those with prescriptions could contact their doctors—if they were worried—and everyone else could consider alternatives on drugstore shelves. In fact, Valisure had found high levels of NDMA in every version of ranitidine it tested and concluded the problem was inherent to the molecule itself. In other words, if Valisure is correct, there is no safe version of ranitidine.

The muted quality of the FDA’s statement didn’t stop concern from going global. The European Medicines Agency had issued its own warning that same day. Singapore health officials pulled eight brands of ranitidine off shelves. South Korean authorities conducted their own tests and banned sales. Canada’s regulators asked companies to stop distributing ranitidine, and some of the country’s manufacturers recalled their drugs. One of India’s biggest generics manufacturers suspended ranitidine supplies. GlaxoSmithKline Plc, the company that originally developed Zantac, halted global distribution. Sandoz Inc. announced it was recalling some of its ranitidine. Several U.S. companies, including CVS, Rite Aid, Walgreen, and Walmart, halted distribution. Memorial Sloan Kettering Cancer Center said it would no longer offer ranitidine to its patients.

By mid-October, a month after the FDA’s alert, at least two dozen countries had pulled ranitidine from stores or halted its distribution. Numerous companies had acted on their own to slow or stop the supply of the drug. The FDA continued to conduct tests.

Finally, on Nov. 1, the agency announced that it had found higher-than-acceptable levels of NDMA in some ranitidine—though not nearly as high as Valisure detected. The FDA then deployed the strongest weapon available to it: The agency asked manufacturers to voluntarily recall some of the Zantac on the market.

Janet Woodcock, director of the FDA’s Center for Drug Evaluation and Research, defends the agency’s deliberative process. Comparisons with other drug regulators are irrelevant, she says: “Do we have to do exactly what others do? We did the testing, and in some we found hardly any. Should they be pulled off the shelves?”

At a time when a poorly policed global supply chain and demand for ever-cheaper generics have exposed drugs to new safety risks, an effective recall system is crucial. Spotting problems earlier is getting harder: From 2016 to 2018 the number of FDA inspections of drug manufacturers declined 10% overseas and 13% for domestic facilities, according to a recent report from the Government Accountability Office. When a manufacturer or the FDA does find that a drug’s quality is compromised, recalls are supposed to reverse the supply chain and remove the affected product from warehouses, pharmacy shelves, and, in the most extreme cases, patients’ medicine cabinets.

But the agency’s authority over this system is limited. It can only request a pullback—manufacturers can and do say no. It can’t contact patients directly; it relies on pharmacies for that. It doesn’t control how the recall is conducted or how its effectiveness is assessed. And it doesn’t seem to want more control. Representative Rosa DeLauro, in her role on the House committee that oversees the agency, has tried to give it more authority over recalls. “It has been my experience over the years that the FDA shies away from its responsibility as a regulatory agency,” she says.

DeLauro has been a Democratic congresswoman from Connecticut since 1991 and a critic of the FDA almost as long. She sponsored a bill that gave the FDA the power to order food recalls; it was signed into law by President Barack Obama in 2011. The agency also has recall power over manufacturers of vaccines, medical devices, infant formula, and tobacco products. As of last year, it can order a recall of opioids deemed dangerous. It can do all of that, but it can’t order a recall of any other prescription drug. DeLauro tried to push a bill two years ago to change that.

The bill went nowhere. At least one reason was opposition to it from the trade group representing drug manufacturers. Andrew Powaleny, a spokesman for the Pharmaceutical Research and Manufacturers of America, or PhRMA, says the agency and the companies it regulates already have robust processes in place. “The biopharmaceutical industry and the FDA further work together throughout the recall process to protect the public health,” he says. “Additional mandatory recall authority is not needed.”

Now, after two high-profile recalls of common drugs have exposed flaws in the system, DeLauro plans to try again to give the FDA more clout. She expects she will again face pushback from the pharmaceutical industry. “It’s a very powerful lobby,” she says. She’s right: Drug manufacturers alone spend roughly $160 million a year making their case in Washington, according to the Center for Responsive Politics. Complicating her effort is the agency itself, which still isn’t asking for more authority.

The FDA’s cautious approach was on display in the valsartan recall. In that case, as with ranitidine, it was a company, the pharmaceutical manufacturer Novartis AG, that conducted more rigorous tests than usual, detected NDMA, and alerted the FDA. After the FDA made its initial announcement in July 2018, it expanded the recall 51 times to include two related drugs made by at least 10 companies.

Patients using valsartan were supposed to be notified by their pharmacies that their drugs could be dangerous. Those notifications didn’t always happen. The failure of that system can be seen in the client base of plaintiffs’ attorney Daniel Nigh, who’s representing about 500 people who took the carcinogenic-tainted drug. So many would-be clients reported that they hadn’t been notified, he says, that he suspended the normal practice of representing only those who had. About one-fifth of his clients said they hadn’t been warned by their pharmacies. Some learned of the recall when they went in to refill their prescriptions. Two found out on the news or secondhand, called their pharmacies, and were told erroneously they hadn’t been given the recalled drugs.

Old mailing addresses, a switch in pharmacies or the use of more than one, the failure to distinguish a recall letter from junk mail—these are among the things that can interfere with ensuring that patients know they have bad drugs. But there’s also a gap in the flow of information, particularly when drugs are recalled in batches identified by manufacturers’ lot numbers, as is common practice. Pharmacists don’t necessarily know a drug’s lot number. And if they do, many still don’t always know whom they sold those lots to. America’s health-care system offers 21st century technology, but it’s still using 20th century record-keeping.

Most drug manufacturers cooperate with the FDA’s recall requests, either because they’re good corporate citizens or because they don’t want the public-relations damage or potential legal liability that could come with refusing. One exception involved a drug producer called Downing Labs, which was doing business as NuVision Pharmacy in Dallas. After the FDA found evidence that NuVision’s injectable sterile drugs weren’t sterile, it asked the company to recall them. NuVision did recall some of its drugs in 2013 but resisted recalling the rest for two years, forcing the FDA to issue repeated warnings about drugs it was powerless to ban. The company finally recalled all lots in 2015, saying it was doing so “voluntarily and solely out of an abundance of caution because Downing Labs takes the utmost care to ensure patient safety.”

The agency also got into a standoff with Standard Homeopathic Co. of Los Angeles, which made Hyland’s homeopathic teething tablets. Reports of babies falling ill or dying after being given the pills prompted an investigation. The FDA found “inconsistent” levels of the toxin belladonna and issued its first warning about the tablets in 2010; a voluntary recall followed. When the problem wasn’t resolved, the company agreed to stop shipping the teething medicine in September 2016 but refused to recall the product it had already released. Standard said it “had not been made aware of any medical or statistical evidence to support a causal link between homeopathic teething tablets and adverse outcomes at this point.” A January 2017 FDA warning letter told consumers to stop buying the medicine, throw out unused portions, and call a doctor if their child “experiences seizures, difficulty breathing, lethargy, and other side effects.” Four months later the company initiated a broad recall, noting it did so “because it is appropriate to do what our regulating agency has formally requested.”

The case infuriated DeLauro. The FDA received more than 400 reports of health problems. It issued a safety warning but didn’t have the authority to order stores to remove the product or websites to stop offering it, and the company wouldn’t do so. “There are real-world consequences,” DeLauro says. “It’s unconscionable that FDA is unable to recall potentially life--threatening medicines.”

Once a company agrees to a recall, the agency’s role remains circumscribed. It places the drug in one of three risk categories, from Class I, for drugs that could cause serious health problems or death, to Class III, for drugs that are unlikely to cause a health reaction but violate FDA manufacturing guidelines. Most ranitidine and valsartan products are Class II, meaning they might cause temporary health problems or pose a slight threat of a serious nature. The agency then recommends how far down the supply chain the recall should extend. But the drug company determines the recall strategy—who will be notified, what information the recall letters and public notices will include, and how the effort’s effectiveness will be measured. The manufacturer is responsible for alerting its various trading partners, who then alert their trading partners, until the warning sometimes, maybe, reaches the consumer.

Although most companies act in good faith, the system has too few checks and balances, says DeLauro, and the agency is too often deferential to industry. “I continually witnessed the FDA’s refusal to act due to their belief that they lacked certain legal authority,” she says. Strictly speaking, that may be true. Asked about DeLauro’s assessment, the FDA said in a statement: “Under the Federal Food, Drug, and Cosmetic Act, a recall is a voluntary action taken by a company. FDA’s role in a recall is to oversee a company’s strategy, assess the adequacy of the recall and classify the recall.”

The agency’s Zantac response was typical, DeLauro says. She and consumer advocates argue it would have been better to get the drug out of the market as soon as possible while continuing to test for NDMA. “It’s a consistent pattern,” she says. “Anything that comes into question, their approach is [to] leave it on the market. In the meantime, let’s do a little here, a little there, see where it goes.”

DeLauro’s husband was taking Zantac. She knew to warn him to stop because she’d seen that regulators in Europe were taking stronger, swifter action than the FDA. “I happened to be reading the reports,” she says. “Not everyone is reading the reports.”

The agency’s defenders contend it’s properly weighing the risks to consumers. “The FDA takes recalls very seriously,” says Peter Pitts, a former communications adviser for the agency who co-founded the Center for Medicine in the Public Interest, a nonprofit research and advocacy group. “It won’t ask anyone to do a recall without evidence and concern about public health.” The agency’s critics, he says, want it to take action just in case, before the weight of evidence is in. That, he says, “is not good science.”

Pitts acknowledges that the agency’s limited mandate means it has a blinkered view of the drug supply chain. “Its authority stops when it issues a recall,” he says. “The FDA doesn’t know where Company X has sold its product.”

Rose Sykes learned she had colon cancer in October 2018. A nurse called to suggest Sykes come into the doctor’s office as soon as possible. She sounded nervous. She offered the last appointment of the next day—an ominous sign to Sykes, a retired nurse. She knew it meant no strangers would be in the waiting room if she left in tears.

A few weeks later, at her home in McComb, Miss., she came across an article about the valsartan recall. NDMA, the chemical in question, is linked specifically to higher risks of colon cancer. She’d taken the drug every day for the past six years. That was the first she’d heard of the recalls. “Nobody tried to inform me about it until I just happened upon it one Saturday morning on the internet,” she says. “My blood pressure went through the roof. I had been taking this medicine for such a long time. I was just so upset.”

Sykes called Walmart, her pharmacy, and then Humana Inc., her insurer, to ask why she hadn’t received a notice. According to Sykes, Walmart reported that it hadn’t received or dispensed any of the contaminated drugs.

But Sykes keeps her old pill bottles, and she was able to read the expiration dates and lot numbers printed in tiny type near the bar codes. She’d taken valsartan from three different lots; one was on the recall list. Walmart Inc. didn’t respond to a question about Sykes’s specific claim. In general, company spokeswoman Marilee McInness says, “when we learn of a recall issued by the manufacturer, we pull products subject to the recall and provide notices to our affected patients.”

Sykes is one of the clients represented by Nigh, the plaintiffs’ attorney, who say they were mistakenly told they hadn’t taken any recalled pills. Computer glitches, human error, or something else entirely may have been at fault. But because drugs don’t have to be traced electronically by lot numbers all the way to customers, it’s hard to know.

Efforts to require an electronic tracking system have been under way for more than a decade, countered by lobbying to delay those efforts. An “unproven, disruptive and costly” mandate is how one pharmacy trade group, the National Association of Chain Drug Stores, described it. When the federal government couldn’t make progress, states tried. The first was California, which, because of its size, can establish de facto national standards for industries. In 2004, California passed a law requiring electronic tracking of drugs all the way to the patient by 2009. The drug industry pushed back, saying the changes were technologically impossible to make that quickly. The deadline was extended to 2014. Nothing happened.

Then, in 2013, the industry preempted the California statute and its deadline by winning passage of a federal drug tracking law. The Pharmaceutical Distribution Security Alliance, a group coordinated by lobbyist Leavitt Partners, was formed specifically to push it. The alliance’s members come from every part of the drug supply chain, including manufacturers, distributors, third-party logistics companies, and pharmacies, according to its website. The group says on the site that it played a key role in helping develop and enact the Drug Supply Chain Security Act, which President Obama signed into law in 2013.

The law created a uniform national system for electronically tracing pharmaceuticals from the manufacturer to the pharmacy’s back door. The industry was given 10 years—until November 2023—to fully comply. Other countries trying to create tracking systems aren’t moving any faster, says Eric Marshall, executive director of a new industry governance group for implementation of the law.

U.S. manufacturers now create and pass on electronic records of the drugs they sell to their primary wholesalers. As of November, both manufacturers and those wholesalers are required to put identifying information, including lot numbers, on the labels of products they sell. But wholesalers don’t yet have to electronically track the lot numbers of drugs they sell to pharmacies. The wholesalers have resisted any attempts to require them to do so before 2023. In comments to the FDA in June, a trade group acknowledged that product tracing “will aid enormously in recall administration and effectiveness.” But it said its members couldn’t comply without having to enter each lot number—“a complex string of alphanumeric characters varying in such features as length”—into their data systems by hand, causing “severe impacts to the delivery of needed medicines to patients and healthcare professionals.”

In other words, it’s too much work.

The legislation exempts pharmacies completely. Even after the law goes into full effect, pharmacies won’t have to track which lots they sell to which customers. Nor will they be required to put lot numbers on labels. Some pharmacies do that now, and others don’t. One concern is patient privacy. To further complicate matters, high-volume pharmacies, such as mail--order companies, mix pills from different lots. Pharmacies can also subdivide packages.

Right now the only way for a pharmacy to keep track of the lot numbers on the medications it dispenses is to type the information into a computer system by hand, says Christian Tadrus, who owns Sam’s Health Mart in Moberly, Mo., and has followed the law’s progress as a member of his state’s pharmacy licensing board. He says his and most pharmacies compensate for the lack of specific information by casting a wide net during recalls. They inform more customers, and remove more product, than might be necessary.

Meanwhile, the number of anxious patients mounts. Orville Lewis, a 64-year-old factory worker who lives outside Pensacola, Fla., is another of Nigh’s clients who’d been taking valsartan daily and was diagnosed with colon cancer. He learned of the recall from a co-worker on the graveyard shift. When he got home, he stayed up until he could call his CVS, which told him he hadn’t received the recalled drugs. “We follow a well-defined recall process that complies with all legal and regulatory requirements,” says Michael DeAngelis, a CVS spokesman.

Lewis was still worried. He contacted his doctor’s office, but no one there had even heard about the recall. Then he took his pill bottle to a friend who worked in a small drugstore in a neighboring town. She looked at the bottle, checked online, and told Lewis his pills were on the list. “I called because it scared me,” Lewis says. “Here I am putting something in my body every morning for my health, and it might have hurt me. If they had said yes, it’s under recall, or they had sent me a letter, I would feel better. It put a bitter taste in my mouth.”

In early December, Singapore found unacceptable levels of NDMA in three versions of a diabetes treatment called metformin and recalled them. The FDA says it’s testing samples sold in the U.S. and, if appropriate, will recommend recalls of the medication. —With Anna Edney

Editors: Flynn McRoberts, Daniel Ferrara and Yue Qiu 

Design & Development: Cedric Sam and Alexander Shoukas