A Brave New Food Enforcement World

by Elizabeth Barr Fawell and Brian D. Eyink

If it feels lately like the whole of the food industry is being linked to one outbreak or another or is reportedly the subject of the latest criminal investigation, you’re not that far off. These days, Food and Drug Administration (FDA) enforcement actions and Department of Justice (DOJ) criminal investigations are more frequent and the potential legal and financial exposure more severe. This trend is real, and it will continue because it is being driven by factors that fundamentally raise the baseline risk level facing all food companies and their executives.

Specifically, three foundational changes have created an environment that is significantly more conducive to serious investigations, aggressive enforcement, and criminal prosecutions. First, the FDA Food Safety Modernization Act (FSMA) drastically increases the regulatory burden on food companies to take appropriate measures to prevent food contamination. It also expands FDA access to company records and the number of records that companies need to create. Second, technological leaps in whole genome sequencing have made it much easier to identify smaller foodborne illness outbreaks that previously went undetected, pinpoint the source of those outbreaks, and identify potential causes. Third, FDA and DOJ have greatly expanded the use of criminal investigations and prosecutions—with a focus on corporate executives—as a regular tool in their food enforcement toolbox. Through these foundational changes, we see: A federal government that is more inclined to take aggressive enforcement action in response to foodborne illness outbreaks, including criminally investigating and prosecuting food companies and their executives; scientific tools that make it easier to identify which companies to take action against; and more robust and complex regulatory requirements that make it easier to identify troubling evidence in support of those actions.

Food companies need to understand the fundamental factors driving this new enforcement landscape so that they can protect themselves. Below we review these key factors, show how they work together to fundamentally change the nature of the enforcement risk faced by food companies, and identify key steps companies can take to manage this new risk.

Factor 1: FSMA, FSMA Records, and FDA Records Access

It should surprise no one at this point that FSMA marks a sea change in how FDA regulates food production. FSMA requires food companies to implement a number of new science- and risk-based food safety and supply chain management programs. In addition, all of those programs must be thoroughly documented to demonstrate effective implementation on a day-to-day basis. Thorough documentation means numerous and detailed records, to which FDA will have routine access under FSMA.2

FSMA will affect the enforcement landscape in three ways: First, food companies must implement science- and risk-based preventive measures to protect against contamination. Food safety systems must be well-designed, as FDA will be inspecting and reviewing those systems to ensure they are adequate and are controlling identified food safety hazards. And, in hindsight, failure to implement certain preventive measures or take specific actions could be interpreted as unwittingly putting consumers at risk of harm.

Second, there are new recordkeeping requirements under the law. As a result, failure to keep required records is a regulatory violation. In addition, the failure to document effective implementation of the food safety system could be cited by the government as evidencing more significant violations, including that the system or a particular program wasn’t effective. For example, if employees routinely are inattentive in completing sanitation records, and the facility is later implicated in a foodborne illness outbreak potentially caused by sanitation failures, FDA could point to the incomplete records to support allegations that the facility could not demonstrate that it actually had implemented its sanitation program as designed. That is why we continually remind food companies: “If it isn’t documented, it didn’t happen. If it is documented, it happened just that way.”

Third, greater access to an expanded universe of records will provide substantially more evidence for an FDA or DOJ enforcement investigation. The sheer level of recordkeeping detail required will provide regulators a detailed snapshot into any given day’s operations. Testing records in particular could provide the basis for investigations and enforcement action. Many companies may decide to incorporate environmental, ingredient, and finished product testing into their food safety programs, and FDA will have access to all of those testing records. Environmental testing records, for example, could be cited by the government as evidencing that a company was on notice that Salmonella was present in its facility but failed to eradicate it leading up to a major Salmonella outbreak. Or FDA could point to a batch of product that was rejected due to Salmonella positives in finished product testing as putting a company on notice that other batches potentially should have been tested more rigorously. The permutations are endless.

In short, FSMA ups the ante on companies to implement robust food safety systems and to keep accurate and complete records demonstrating implementation of those systems. At the same time, records access will provide FDA ready access to considerable information the agency may use in an attempt to make a case that a company knew or should have known it had a potential food safety problem.

Factor 2: Whole Genome Sequencing

The advent of readily available whole genome sequencing (WGS) testing is radically altering the way foodborne illness outbreaks are investigated and could fundamentally change the way an outbreak is defined. With WGS, outbreaks can be identified more easily, seemingly unrelated case patients can be connected across time and space, and outbreaks can be linked back to products or facilities with much greater speed and precision.

WGS reveals an exact “genetic fingerprint” for a foodborne pathogen by recording the actual DNA sequence of the organism. WGS looks at the organism’s complete DNA sequence and can differentiate between virtually all strains of foodborne pathogens. This technology allows regulators to say with a high degree of confidence that two organisms are a genetic match.

The effect on foodborne illness investigations and attributions is profound. WGS is being used: to determine which illnesses are part of an outbreak and which are not; to determine which ingredient in a multi-ingredient food is responsible for an outbreak; to identify geographic regions from which a contaminated ingredient may have originated; to differentiate sources of contamination, even within the same outbreak; to link illnesses to a processing facility; to link small numbers of illnesses that otherwise might not have been identified as a common outbreak; and to identify unlikely routes of contamination.3 Using WGS, FDA will be able to pinpoint the exact origin of a pathogen with unprecedented speed and accuracy.

Much of WGS’s investigational value lies in how FDA and the Centers for Disease Control and Prevention (CDC) are using WGS to build a foodborne pathogen database called GenomeTrakr. GenomeTrakr is a library of DNA sequences of pathogens found in food facilities, products, and case patients, and it is going to have profound impacts on the food industry. GenomeTrakr can be used to identify which facilities have persistent strains of pathogens present over a period of time. It can be used by investigators to match the DNA sequences of pathogens from sick individuals to DNA sequences of pathogens found in food facilities. It can connect sick individuals who were infected with matching pathogen strains. And it can connect a newly collected facility sample to samples from sick individuals taken weeks, months, and even years ago.

The effects of WGS are already being felt by the food industry. There have been several high-profile FDA foodborne illness investigations in recent years that were driven by WGS. As one example, in May and July of 2016, General Mills recalled five retail products for potential E. coli contamination as a result of WGS reportedly linking illnesses to its flour when eaten or handled in an uncooked manner.4 Even more recalls, potentially stretching back years, are likely as more strains are added to the GenomeTrakr database.

Factor 3: Revived Use of Criminal Prosecutions Against Food Companies

FDA and DOJ have made clear in recent years that criminal prosecutions and investigations are viewed as a viable enforcement tool in the food space, including an emphasis on holding corporate executives responsible for violations committed by their companies (consistent with the dictates of the “Yates Memo” discussed below).
Technically, it has long been a potential criminal act to commit a “prohibited act” under the Federal Food, Drug, and Cosmetic Act (FDCA), such as introducing into commerce adulterated food.5 And, under the so-called Park Doctrine, named for the 1975 Supreme Court case United States v. Park,6 the government may seek to hold a corporate official criminally liable for violations of the FDCA in areas of the company under the official’s control, even if the official did not intend for the violations to occur or was not aware of the violations. But recent decades had seen Park and criminal prosecutions in the food industry lie more or less dormant, with prosecutions being used only for the most egregious cases.

In 2011, FDA signaled a change by updating its Regulatory Procedures Manual (a handbook used by FDA investigators and other agency personnel when deciding on enforcement action) to reemphasize Park prosecutions of responsible corporate officials, going so far as to identify a number of factors FDA personnel should consider when determining whether to initiate a Park prosecution:

  • The corporate official’s position in the company and relationship to the violation;
  • Whether the official had the authority to correct or prevent the violation;
  • The official’s knowledge of and actual participation in the violation
    (although the RPM notes that these are not prerequisites to a misdemeanor prosecution);
  • Whether the violation involves actual or potential harm to the public;
  • Whether the violation is obvious;
  • Whether the violation reflects a pattern of illegal behavior and/or failure to heed prior warnings;
  • Whether the violation is widespread;
  • The seriousness of the violation;
  • The quality of the legal and factual support for the proposed prosecution;  and
  • Whether the proposed prosecution is a prudent use of agency resources.7

DOJ recently went a step further and announced as a general proposition that corporate officials should be a focus in any criminal or civil investigation of a company. In 2015, Deputy Attorney General Sally Yates released a memorandum instructing all DOJ prosecutors that “criminal and civil corporate investigations should focus on individuals from the inception of the investigation,” and “absent extraordinary circumstances or approved departmental policy, the Department will not release culpable individuals from civil or criminal liability when resolving a matter with a corporation.”8 In other words, company executives may find themselves under investigation from the moment the company is, and if prosecutors believe a company should be held responsible, one or more company officials may be held responsible as well. (This approach is for
all companies investigated by the DOJ, not just food companies.)

The Yates Memo comes at a time when DOJ has been especially active investigating and prosecuting food companies. For example:

  • Peanut Corporation of America owner Stewart Parnell and brother Michael Parnell were charged with felony violations of the FDCA in relation to a widespread Salmonellosis outbreak in peanut butter. They were convicted and sentenced to prison terms of 28 and 20 years.9
  • Jack and Peter DeCoster and their company, Quality Egg, were prosecuted in relation to a Salmonella enteritidis outbreak in eggs with 1,939 confirmed cases. The executives pled guilty to misdemeanor violations and were sentenced to three months imprisonment, a sentence recently upheld by a divided panel of the Eighth Circuit.10
  • Eric and Ryan Jensen (primary principals of Jensen Farms) pled guilty to misdemeanors in relation to Listeria monocytogenes contaminated cantaloupe that resulted in 33 deaths and 147 illnesses.11

Current headlines suggest this trend continuing, with numerous reported DOJ investigations into food companies following reports of foodborne illness outbreaks. In fact, human illnesses are a key factor triggering DOJ investigations, with DOJ considering factors such as consumer illness and the company’s regulatory compliance history when deciding whether to initiate an investigation.12

The Factors Converge

These three factors converge to fundamentally reshape the enforcement landscape facing food companies. DOJ is prioritizing criminal investigations of food companies, especially companies associated with foodborne illness outbreaks. Whole genome sequencing is making it easier to identify outbreaks and easier to link outbreaks to companies. And FSMA will provide unfettered access to a wealth of evidence, as well as more opportunities for regulatory violations. Fundamentally, more companies will find themselves in situations that could invite enforcement action, and there is a greater chance of unearthing evidence against companies to support those actions.

WGS in particular is ratcheting up both regulatory and criminal risk. Previously, enforcement actions from FDA or DOJ against food facilities for foodborne illness outbreaks were relatively rare, in part because of how difficult it was to actually determine the source of an outbreak. It took a lot of people getting seriously sick for FDA or CDC to even realize that a facility might be housing a dangerous pathogen. WGS changes the whole game—as the GenomeTrakr library becomes more extensive and genome sequencing technology becomes faster, it will be easier for FDA to determine which facilities are housing pathogens that are making or have made people sick. Importantly, with WGS, FDA can link isolated or old illness cases to recent sampling of pathogens in product and/or facilities. This means that companies can learn long after the fact that their product made a consumer sick and it can result in greatly expanded recalls. It also means that a company could learn that it had unknowingly harbored a pathogen in its facility for years without eradicating it through effective cleaning and sanitation, raising the risk of the company being painted by investigators as systemically ignoring food safety issues.

Companies also need to be prepared for traditional regulatory action from FDA (e.g., a Warning Letter) without a link to consumer illnesses. For example, WGS can be used to show that a facility has had a persistent strain of a pathogen in its facility over time, which could be used as evidence of insanitary conditions. As one recent example, FDA issued a Warning Letter to Jeni’s Splendid Ice Cream after FDA sampling during a 2016 reinspection found the same strain of Listeria that was associated with the company’s 2015 recall was still present in the facility.13

Finally, if DOJ is more likely to investigate companies associated with foodborne illnesses, and if WGS makes it substantially easier to link a company to a foodborne illness, then the baseline risk of any food company becoming the target of a DOJ investigation likely has increased.

What Companies Can Do

So what can a food company do to manage this new enforcement landscape? Whatever a company thought was enough to comply with food safety standards before needs to be reconsidered in light of whole genome sequencing, FSMA’s food safety and records access requirements, and FDA’s and DOJ’s aggressive enforcement posture. Companies must be proactive. Key actions include (1) implementing strong preventive programs and staying vigilant with regular product and environmental testing; (2) taking aggressive corrective actions when pathogens are found, being as certain as possible that harborage sites have been eradicated; and (3) building a strong food safety culture throughout the company.

Preventive Programs and Routine Testing

At the outset, food companies must design and implement robust food safety systems that prevent product contamination. They must work continuously to improve their programs and practices to ensure they are sufficiently controlling food safety hazards in light of new information and learnings. In addition, companies need to consider whether they have sufficiently robust environmental monitoring and product testing programs in place. That means taking a hard look at where, when, how often, and what is being tested for. In our view, many companies will need to enhance their routine testing programs so that they truly are looking for pathogens. That includes considering whether “zone 1” testing and finished product testing are appropriate for the facility and products. Companies that don’t have a microbiologist should consider working with an outside expert to ensure that the program is looking in the right places. In addition to routine safety testing, companies should be particularly vigilant in undertaking robust corrective actions and investigations as appropriate to be as certain as possible there is no presence of a persistent strain. This may also help companies identify weak points in their procedures and equipment, which should be constantly reevaluated and improved upon.

Corrective Actions

It is critical that companies not only routinely monitor their facilities and products, but also take swift and aggressive corrective action when pathogens are found in their facilities. It’s no longer enough to simply re-clean the areas of a facility that test positive during routine testing. Companies need to be aggressive in finding the source of pathogens and working to completely eliminate any harborage sites for pathogens from their facilities.

Once a pathogen is found in a facility, a company should immediately vector the area to track down the pathogen’s origins. Companies should also consider additional corrective actions such as disassembling equipment. While disruptive and sometimes costly, it’s better to eliminate an environmental pathogen quickly and decisively than let it harbor in a facility. Corrective action plans should include a review of previous environmental testing results, employee adherence to GMPs, equipment design, and whether there are any special events like maintenance or construction that could have changed the environment. Preventive actions will be just as important as corrective actions. This is a different level of response than what many companies are used to, but WGS and the consequences of modern testing require new approaches.

And, now that FSMA Preventive Controls requirements are effective (at least for large companies), FDA will have access to testing and corrective action records during routine inspections. The agency will continue to conduct its own sampling and will be able to see first-hand the actions being taken on a daily basis. It is therefore essential to design and implement a rigorous testing program, to take thorough corrective actions in response to positive testing results, and to keep records of what was done to track down and eliminate the pathogen so that you can prove that you did the right thing to keep facilities clean and consumers safe.

Fostering a Food Safety Culture

The most well-designed food safety system is only as good as the people who are implementing it. For many companies, the biggest challenge in producing safe food in a clean facility may actually be implementing, not designing, the food safety program. Having a strong food safety culture throughout the company often makes the difference between an employee scrawling illegibly on a form or filling it out properly, between the overnight sanitation crew scrubbing a line extra thoroughly to be sure there’s no biofilm buildup or just going through the motions, or between a plant manager understanding that a profitable line must be taken out of service to investigate an environmental finding or putting it off until a future scheduled downtime. And having a strong food safety culture can make a real difference in what type of enforcement action FDA or DOJ decide to take. Company culture alone won’t eliminate legal exposure, but it can make the difference in the severity of any potential government action.

Key Takeaways

The “new normal” for food companies is that they operate in a state of elevated enforcement risk. This risk is being driven by three converging trends: use of WGS; new regulatory requirements with expanded records access; and more frequent criminal investigations and prosecutions against food companies. The likelihood of a company being linked to a foodborne illness—and often with no warning—is far greater than ever before given that FDA now has the ability to trace pathogens with pinpoint precision. FDA also has routine access to broad swaths of information about the day-to-day practices within a food facility. And if a review of those records suggests systemic deficiencies or insufficient attention to food safety, FDA and DOJ are more than willing to investigate a company and its senior executives. Therefore, it is important to stay ahead of regulatory or enforcement action through well-designed and well-executed food safety practices, vigorous testing programs, robust corrective and preventive action procedures, and a strong corporate food safety culture.

  1. Special thanks to Sally Gu, former Hogan Lovells US LLP summer associate, for her contributions to this article.
  2. See, e.g., 21 C.F.R. § 117.320.
  3. Whole Genome Sequencing (WGS) Program, FDA (June 23, 2016), http://www.fda.gov/Food/FoodScienceResearch/WholeGenomeSequencingProgramWGS/.
  4. FDA Investigated Multistate Outbreak of Shiga toxin-producing E. coli Infections Linked to Flour, FDA (Sept. 29, 2016), http://www.fda.gov/Food/RecallsOutbreaksEmergencies/Outbreaks/ucm504192.htm.
  5. 21 U.S.C. § 333(a).
  6. United States v. Park, 421 U.S. 658 (1975).
  7. FDA Regulatory Procedures Manual § 6-5-3.
  8. Memorandum from Sally Quillian Yates, Deputy Attorney General, re: Individual Accountability for Corporate Wrongdoing (Sept. 9, 2015), https://www.justice.gov/dag/file/769036/download.
  9. Brady Dennis, Former Peanut Executive Sentenced to 28 years in Prison, Washington Post, Sept. 21, 2015. The Peanut Corporation of America case is a rare example of DOJ pursuing felony rather than misdemeanor charges (as well as non-FDCA charges), and because the charges required criminal intent, PCA was not a Park case. The quality manager was also charged and convicted of obstruction of justice and sentenced to five-years imprisonment.
  10. United States v. Austin DeCoster, No. 15-1891 (8th Cir., July 6, 2016).
  11. Mary Beth Marklein, Cantaloupe Farmers Get No Prison Time in Disease Outbreak, USA Today, Jan. 28, 2014.
  12. E.g., Joan Byrd, United Fresh explores rising trend in criminal prosecutions, The Produce News, (Sept. 16, 2016), http://www.producenews.com/the-produce-news-today-s-headlines/19716-united-fresh-explores-rising-trend-in-criminal-prosecutions; Criminal Investigations on the Rise in the Food Industry, International Dairy Foods Association, (June 22, 2016), http://www.idfa.org/news-views/headline-news/article/2016/06/22/criminal-investigations-on-the-rise-in-the-food-industry. DOJ also takes referrals from FDA’s Office of Criminal Investigations, which considers similar factors when deciding whether to refer a case for prosecution.
  13. FDA Warning Letter to Jeni’s Splendid Ice Creams, LLC (Aug. 9, 2016), http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/2016/ucm516395.htm.