Adverse Event Reporting
MoCRA: This information is applicable to: All Cosmetic Products
Under the new MoCRA laws, you must report any serious adverse events associated with one of your cosmetic products. You also need to keep appropriate records and let an FDA inspector see those records during an inspection.
What is a Serious Adverse Event?
A serious adverse event is one which results in:1
- death;
- a life-threatening experience;
- inpatient hospitalization;
- a persistent or significant disability or incapacity;
- a congenital anomaly or birth defect;
- an infection; or
- significant disfigurement (including serious and persistent rashes, second- or third-degree burns, significant hair loss, or persistent or significant alteration of appearance), other than as intended under conditions of use that are customary or usual.
If an event would have had one of those outcomes but a medical or surgical intervention prevented it, it's still considered a serious adverse event.
Who is responsible for compliance?
The "responsible person"2 is the one who must report any adverse events and comply with this section of MoCRA. It’s the person or company named on the label.
If you are making and selling the product, then your business name and address should be listed on the label. You are the person responsible for reporting any adverse events.
If you make cosmetic products for someone else to sell under their own label, then their business would be on the label. Even though the product label should say "Manufactured for ..." or "Distributed by ..." and it's clear that they didn't actually make the product, they would still be responsible for reporting adverse events since their name is on the label.
The same holds true you if buy cosmetic products and then sell them under your own label. If your business name and address are on the label, then you would be responsible for reporting any adverse events.
What goes on the label?
You have to put enough information on the label so a person can contact you if they have an adverse event to report.
The business name and address are already required on the label. As you probably know, you may omit the street address if it is included in a print or online phone directory under the business name. However, if you omit the full street address then there’s not enough information on the label for someone to contact you.
Under MoCRA, if you don’t include the full US street address then you must include a phone number, website, or email address that a person could use to send an adverse event report to you.
What has to be reported to the FDA?
If you receive a report of a serious adverse event from one of your cosmetic products, you must report it to the FDA within 15 days.3 After that, you must update the report with any new and material4 medical information you receive during the next year. Any updates must be made within 15 days of when you get the additional medical information.5
The FDA is developing an online portal for submitting mandatory adverse event reports for cosmetics.6,7
If FDA believes that a flavor or fragrance caused or contributed to the adverse event, FDA may request a list of the ingredients or categories of ingredients in the flavor or fragrance(s) used in the product. If FDA makes such a request, you have 30 days to provide the information.8 You should be able to get the necessary information from your fragrance supplier.
Protections
Submitting an adverse event report in compliance with these requirements does not automatically mean that you are admitting that the cosmetic product caused or contributed to the relevant adverse event.
Any personally identifiable information or medical detail provided in the adverse event report is protected under the Privacy Act of 1974 and will not be disclosed by the FDA.
What records are required?
You should have a procedure set up and in place to receive and record any adverse event reports connected with any of your products. As a starting point, consider setting up a log book to record any reports received, a form to record the pertinent information, and a place to file any applicable papers and records you receive. The HSCG has created a Sample Adverse Event Log Form that you could use as a starting point.
You must maintain records relating to each report of an adverse event for six years. However, if your business qualifies as a small business under MoCRA,9 you only need to keep the records for three years.10
If you are ever subject to an FDA inspection, either because of the adverse event report or for some other reason, you must allow an authorized inspector to access the adverse event records.11
1 21 USC 364(5)
2 In legal terms, a "person" could be either a real person or a business entity such as an LLC, corporation or partnership.
3 21 USC 364a(b)(1)
4 "Material" in this case means that the information is applicable and has serious or substantial bearing on the matter.
5 21 USC 364a(b)(2)
6 21 USC 364a(b)(3)
7 In the meantime, they are requesting that reports be submitted via the FDA Adverse Event Reporting System (FAERS). Before accessing the Safety Reporting Portal, you must request an account by emailing faersesub@fda.hhs.gov.
8 21 USC 364a(f)
9 Per MoCRA, a small business is one which makes less than $1 million 3-year-average annual cosmetic revenue and which does not make specific exempted products. See MoCRA Small Business Exemption for more details.
10 21 USC 364a(e)(1)
11 21 USC 364a(e)(2)
