The 2012 meningitis outbreak and the compounding law that followed

On September 18, 2012, a clinician called the Tennessee Department of Health about a patient with fungal meningitis caused by Aspergillus fumigatus. The infection had been diagnosed 46 days after the patient received an epidural steroid injection at an ambulatory surgery center. Within nine days, state and federal investigators had found eight more patients with meningitis, seven in Tennessee and one in North Carolina, according to CDC's first report on the outbreak¹. All nine had received injections from the same three lots of preservative-free methylprednisolone acetate, made by a Massachusetts compounding pharmacy.

When CDC stopped updating its count on October 30, 2015, the outbreak stood at 753 cases and 64 deaths in 20 states, according to the agency's archived outbreak page².

That outbreak showed how far a pharmacy's sterile products could travel under a patchwork of state and federal oversight. Fourteen months after that first call, Congress passed the Drug Quality and Security Act, which created a new federal category of compounder. This history follows the investigation through CDC's records, then the legal gap the outbreak exposed and the law that followed. It ends with FDA's current list of the facilities that law created.

How investigators traced the vials

Investigators told the pharmacy about their inquiry on September 25, 2012, and its invoices showed that about 17,500 vials from the three suspect lots had gone to 75 facilities in 23 states, the October 2012 MMWR report¹ said. The lots were used for back pain and for injections into joints. The pharmacy recalled the three lots on September 26, expanded the recall to all of its methylprednisolone acetate and its products for spinal injection on October 3, and recalled everything it had compounded on October 6, according to CDC's recall timeline².

By October 10, CDC reported¹, health departments had identified almost 14,000 people who might have been exposed and had reached about 90 percent of them at least once by phone, home visit or registered mail. CDC counted 137 cases and 12 deaths in 10 states at that point. The cases fell into four definitions: meningitis after an epidural injection, a particular kind of stroke, a spinal infection at the injection site, or an infected joint.

Most infections turned out to be caused by Exserohilum rostratum, a mold common in the environment, CDC found. The agency noted that the infections were not transmitted from person to person. Testing of other unopened products from the same pharmacy found bacteria or fungi in vials of betamethasone, triamcinolone and a heart surgery solution, though CDC said it had no laboratory-confirmed meningitis or spinal infections caused by those products.

Michigan had the most cases, 264, with 19 deaths, followed by Tennessee with 153 cases and 16 deaths and Indiana with 93 cases and 11 deaths, according to CDC's state-by-state table³. Florida reported 25 cases and seven deaths.

The legal gap the outbreak exposed

Compounded drugs are not FDA-approved. Federal law lets pharmacists and physicians mix or alter ingredients for individual patients. State boards of pharmacy "have primary responsibility for the day-to-day oversight" of state-licensed pharmacies that are not registered with FDA as outsourcing facilities, FDA says in its compounding questions and answers⁴.

Congress first wrote compounding into federal drug law in section 127 of the Food and Drug Administration Modernization Act of 1997⁵, signed on November 21 of that year. Its new section 503A exempted compounded drugs from the approval requirement if pharmacists met several conditions, including that they "not advertise or promote the compounding of any particular drug, class of drug, or type of drug." In 2002, the Supreme Court struck down the advertising and solicitation limits as violations of the First Amendment, in a 2002 decision⁶. That left the rest of section 503A under a legal cloud for the next decade.

Section 503A has another feature that mattered here. Drugs compounded under it are not subject to federal current good manufacturing practice requirements, the rules that govern sterile processing at drug plants, and they must be made on receipt of valid prescriptions for individual patients, FDA explains⁹. The three outbreak lots alone had gone out as roughly 17,500 vials to 75 facilities.

What the 2013 law changed

H.R. 3204, the bill that became the Drug Quality and Security Act, was introduced on September 27, 2013, and passed the House by voice vote the next day. The Senate voted 97 to 1 to take it up on November 12 and passed it by voice vote on November 18. President Obama signed it on November 27, according to the bill's status record⁷. FDA's history of food and drug law⁸ describes the act as a direct response to the outbreak.

Title I, called the Compounding Quality Act, did two things. It deleted the advertising provisions the Supreme Court had struck down, which, as FDA's compounding law page⁹ puts it, "removed uncertainty about the validity of section 503A." And it added a section 503B that created a voluntary category called outsourcing facilities. How the two kinds of compounders differ today is laid out in our guide to 503A and 503B compounders, and the full statute in our piece on the Drug Quality and Security Act. Title II was the Drug Supply Chain Security Act, the package-tracing law covered in our DSCSA explainer.

Under the text of Public Law 113-54¹⁰, FDA must set inspection schedules by risk, weighing each facility's compliance and recall history, the inherent risk of what it compounds, and whether FDA has inspected it within the last four years. Outsourcing facilities must list every drug they compounded in the previous six months, including the source of each active ingredient and the number of units produced. They must also file adverse event reports. The law made it a prohibited act to resell a compounded drug labeled "not for resale," to falsify a prescription for compounding, or to fail to report as required. Compounded drug advertising that is false or misleading now counts as misbranding.

Registration is optional. A pharmacy that compounds within section 503A's limits can stay a pharmacy. What registration offers is the right to fill orders from hospitals and clinics without a prescription for each patient.

The facilities the law created, 13 years on

FDA's list of registered outsourcing facilities¹¹, updated October 29, 2026, shows 100 entries, GxRadar's count of the table found. Ninety-four said they intend to compound sterile drugs from bulk substances. Forty-two had not yet been inspected. Of the rest, 56 had been issued a Form 483, the list of inspectional observations described in our guide to FDA inspections and warning letters, at their most recent inspection.

Turnover shows up in the dates. Only two current facilities first registered in 2013 and eight in 2014, while 43 first registered in 2024, 2025 or 2026. How shortages widen what compounders may make is covered in our pieces on GLP-1 shortages and compounding during shortages.

Sterility problems remain the most common reason drugs of any kind are recalled, as our piece on sterility assurance explains. Of 18,076 drug recall records in openFDA's enforcement data¹² from 2012 through October 28, 2026, 9,273 fall in GxRadar's sterility and contamination category, as our recalls page shows. The 2012 outbreak sits at the start of that series. CDC's last word on it, posted in October 2015, was that further updates to the case counts "are not anticipated at this time."