IoT Security Blog

Articles and Posts on IoT Security, Embedded Systems, and the Internet of Things

FDA Tracking Requirements: Drugs, Medical Devices, Why Not Food Too?

Contributed by Joanne C. Kelleher

The July 10, 2008 issue of The New York Times had an article about the nation’s salmonella outbreak called As Outbreak Affects 1,000, Experts See Flaws in Law.

The article says; Dr. David Acheson, the agency/s associate commissioner for foods, said in a telephone interview on Monday that the F.D.A. lacked authority to require full trace-back capability, adding, It’s the industry’s responsibility to put that kind of system in place, not ours.

This comment jumped out at me because the F.D.A. is involved with track and trace for prescription drugs and with medical devices. Why not food too?

Since 1993, the FDA has required that manufacturers of medical devices must adopt a method of tracking devices whose failure would be reasonably likely to have serious, adverse health consequences; or which is intended to be implanted in the human body for more than one year; or are life-sustaining or life-supporting devices used outside of a device user facility. In 2006, the FDA began investigating how a unique device identification (UDI) system might help automate the collection of information about these devices in the supply chain.

The FDA Amendments Act of 2007 (FDAAA) covers standards that should be developed for identification, validation, authentication, and tracking and tracing of prescription drugs and the FDA recently collected comments about the technologies to be used, like RFID. See and

The New York Times article adds: But Dr. David A. Kessler, the F.D.A. commissioner in the Clinton and first Bush administrations, said the agency has the authority to require the industry to trace produce as it travels from farm to table, but has lacked the impetus to do so. The technology exists to trace the entire chain of a food product, Dr. Kessler said. The agency needs to require the industry to put into effect mechanisms to do full trace-back. That regulation could be put in place in months, not years.

Produce items have sickened over 1000 people in largest food-borne outbreak in the last decade and the FDA still can’t identify the cause (raw red tomatoes, jalape peppers or ???). How many more people need to get sick before there is enough of an impetus for the FDA to require the food industry to implement track and trace?