The Drug Quality and Security Act of 2013

H.R. 3204 was introduced in the House on September 27, 2013, and passed the next day by voice vote after 40 minutes of debate. The Senate took it up in November, voted 97 to 1 on November 12 to end debate on the motion to proceed, and passed it by voice vote on November 18 without changing a word. It became Public Law 113-54 on November 27, 2013, according to the bill's official status record¹.

Its formal name is the Drug Quality and Security Act. Its long title describes two subjects, "human drug compounding and drug supply chain security," and its text² runs to two titles. Title I, the Compounding Quality Act, created a new kind of FDA-registered compounder. Title II, the Drug Supply Chain Security Act, set a 10-year schedule for tracing prescription drug packages electronically.

Thirteen years on, both titles still shape what reaches pharmacy shelves. This history covers how the law came about, what each title did, and what FDA's own registration list shows about the outsourcing facility sector it created.

The outbreak behind Title I

In 2012, CDC began tracking infections in patients who had received contaminated steroid injections made by a single compounding pharmacy. When the agency stopped updating its count on October 30, 2015, its outbreak page³ listed 753 cases and 64 deaths in 20 states. FDA later called it "the largest healthcare-related outbreak in recent history" in January 2018 testimony⁴ and attributed its scale to "large-scale, multistate distribution of an injectable drug intended to be sterile." Our account of the outbreak and the law that followed covers the events in detail.

Federal compounding law at the time had a specific weakness. Section 503A, added to the Food, Drug, and Cosmetic Act by the FDA Modernization Act of 1997, contained restrictions on advertising compounded drugs and soliciting prescriptions that FDA now describes as unconstitutional. The agency says the 2013 law amended 503A "to remove its unconstitutional provisions," which enabled the agency "to fully implement and enforce the remaining provisions," according to its summary of the compounding provisions⁵.

Sources: GovInfo bill status record; Public Law 113-54; 21 U.S.C. 353a statutory notes⁶; FDA's DSCSA exemptions page¹¹.

What Title I did

Section 102 created section 503B and a new category, the outsourcing facility. Registration is voluntary. A facility that elects to register is exempt from the drug approval requirement, from the requirement to carry adequate directions for use, and from the supply chain tracing rules in section 582, provided it meets the conditions in 21 U.S.C. 353b⁷. It is not exempt from current good manufacturing practice rules, which is the main thing that separates it from a pharmacy compounding under 503A.

Registration comes with concrete conditions. A facility must register each year between October 1 and December 31 and say whether it plans to compound drugs on FDA's shortage list in the coming year. It must report every drug it compounded twice a year, in June and December, with the active ingredient, its source, strength, dosage form and number of units. Labels must say "This is a compounded drug" or a comparable statement, and the facility must pay annual fees. Bulk ingredients are limited to substances on an FDA list of clinical need or to drugs on the shortage list, a rule our piece on compounding during drug shortages explains.

Title I's other sections were shorter. Section 103 made it a prohibited act to resell a compounded drug labeled "not for resale," to intentionally falsify a prescription for a compounded drug, or for a registered outsourcing facility to fail to report drugs or adverse events, and it deemed false or misleading promotion of a compounded drug to be misbranding. Section 105 set up communication between state boards of pharmacy and FDA. Section 106 struck the advertising subsection from 503A and the word "unsolicited" from its prescription requirement, and added a severability clause. Section 107 ordered a GAO study of state and federal compounding oversight within 36 months, according to the public law².

The outsourcing facilities on FDA's list

FDA's list of registered outsourcing facilities⁸, current as of October 29, 2026, includes 100 facilities. In January 2018, FDA told Congress that "the outsourcing facility sector consists of about 75 entities and is growing," in the same testimony⁴. GxRadar's tabulation of FDA's list by the year each facility first registered shows the recent surge.

FDA's list counts only facilities registered now, so firms that registered and later left are not included. Forty-three of the 100 first registered in 2024 or later, and 43 are marked "Not yet inspected." Of the 57 facilities that have had an inspection, FDA's table answers yes to "Form 483 Issued?" for 56; a Form 483 lists an inspector's observations. Ninety-four say they intend to compound sterile drugs from bulk substances. The listed locations cover 28 states and Puerto Rico, led by Texas with 17 facilities and Florida with 16; one entry gives no location. Our explainer on Form 483s and warning letters describes what those observations mean and what they do not.

FDA's early enforcement record was heavy. Between the law's passage and the end of fiscal 2017, the agency said in 2018, it conducted "close to 500 inspections" of 503A and 503B facilities, oversaw "more than 150 recalls of compounded drugs" and issued "more than 180 warning letters."

Registration also carries a price. For fiscal 2027, which began October 1, 2026, FDA set the annual establishment fee at $22,074, or $7,142 for a small business, and the reinspection fee at $21,427, according to a July 2026 Federal Register notice⁹.

What Title II did

Title II, the Drug Supply Chain Security Act, built a federal tracing system for prescription drugs that passes information along with each sale between trading partners. It also added national standards for wholesale distributors and third-party logistics providers and a section headed "uniform national policy," according to the public law's table of contents². Its final stage was written into section 582(g): "On the date that is 10 years after the date of enactment," interoperable, electronic, package-level tracing requirements "shall go into effect." That date was November 27, 2023. FDA's DSCSA page¹⁰ describes the aim as identifying and tracing certain prescription drugs as they move through the supply chain.

For the smallest pharmacies, the deadline has kept moving. FDA has exempted small dispensers, and where applicable their trading partners, from certain section 582 requirements until November 27, 2027, the agency says on its exemptions page¹¹. A dispenser counts as small if, as of November 27, 2026, its owner has 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians. Our explainers on the DSCSA, the enhanced security deadline, wholesale distributor licensing and package serial numbers cover Title II in depth.

Where the two titles meet

Although the two titles deal with different subjects, they intersect in the statute. Outsourcing facilities are exempt from section 582, the tracing provision Title II created, so a compounded batch from a registered facility moves outside the package-level tracing system that governs approved drugs. And the 503B bulk-ingredient and copy rules both turn on FDA's shortage list, which as of November 3, 2026 showed 69 drugs in current shortage on our shortage tracker. The next fixed date in the law's timeline is November 27, 2027, when the small-dispenser exemptions end. More coverage is on our law and policy desk.