What happens when drug samples go missing

Samples are governed as a diversion problem

A free sample of a prescription drug looks like a marketing item. The regulations treat it as a control problem, because a sample is a full-strength medication moving outside the normal supply chain.

The rules that follow are not about whether sampling is allowed. They are about the administrative system a firm has to run around it.

The core of that system is reconciliation: matching what was requested against what was received, and noticing when the two stop agreeing.

The scope limit is worth stating up front. These rules govern manufacturers, authorized distributors of record and their representatives handling prescription drug samples. They are not a general rule about anything a seller calls a sample.

The storage rule, and what it points at

Storage and handling get one short section with two paragraphs.

Manufacturers, authorized distributors of record and their representatives must store and handle all samples under conditions that will maintain their stability, integrity and effectiveness, and ensure the samples are free of contamination, deterioration and adulteration.

The second paragraph tells them how to satisfy it. Compliance can generally be achieved by following the compendial and labeling requirements for storage and handling of that particular prescription drug.

So a sample is held to the same storage conditions as the product on the shelf. The sample carton's own storage statement is the standard, not a lesser one.

Standing orders are prohibited

One section closes a route that would otherwise defeat the whole reconciliation idea.

Manufacturers and authorized distributors of record may not distribute samples on the basis of open-ended or standing requests. They must require separate written requests for each sample or group of samples.

There is a bounded exception, and it is precise. One arrangement escapes that label. A licensed practitioner requests in writing that a specified number of samples be delivered over a period of not more than six months. The actual delivery dates for parts of the order are then set by subsequent oral communication or electronic transmission. That is not a standing request.

The distinguishing features are a specified number, a written request, and a period capped at six months. Take any of those away and it becomes the prohibited thing.

The written administrative systems

Each firm distributing samples must establish, maintain and adhere to written policies and procedures describing its administrative systems for four areas.

Distributing samples by mail or common carrier, including the methodology for reconciliation of requests and receipts.

Distributing by means other than mail or common carrier is the representative-delivery case, and it carries methodology for four sub-items. Reconciling requests and receipts, identifying patterns of nonresponse, and how the firm responds when such patterns are found. Conducting the annual physical inventory and preparing the reconciliation report. Implementing a sample distribution security and audit system, and storage of samples by representatives.

Identifying any significant loss of samples and notifying the agency of the loss. And monitoring any loss or theft of samples.

The audit clause worth noticing

Buried in that list is a requirement about who checks whom.

The security and audit system must include conducting random and for-cause audits of sales representatives "by personnel independent of the sales force".

Two kinds of audit are named. Random, which happens without a reason, and for-cause, which happens because something prompted it.

And the independence requirement makes the audit structurally meaningful rather than nominal. A sales organization auditing itself would satisfy the words but not the clause.

Three notification duties, on two clocks

The investigation and notification section is the operative one when something goes wrong, and it contains three separate triggers.

The first is falsification. A firm with reason to believe any person has falsified sample requests, receipts or records, or is diverting samples, has three duties. Notify the agency by telephone or in writing within five working days. Immediately initiate an investigation. And provide a complete written report, including the reason for and the results of the investigation, no later than thirty days after the initial notification.

The second is loss or theft. A firm distributing samples, or a charitable institution receiving donated samples from a licensed practitioner, must follow the identical three steps within five working days of becoming aware of a significant loss or known theft.

The third runs on a longer clock. A firm must notify the agency within thirty days of becoming aware of the conviction of one of its representatives for a sampling violation. That covers a violation under the statute or a state law, and a complete written report follows within thirty days.

And a person who has to be nameable

A fourth duty in the same section is not about an incident at all.

A firm distributing samples must inform the agency in writing, within thirty days of selecting the individual responsible for responding to requests for information about samples, of that person's name, business address and telephone number.

That is a named human being on file, chosen in advance, whose job is to answer questions about samples.

It is a small requirement with a clear purpose. When something goes wrong, the question of who to call has already been answered.

Outsourcing the work does not outsource the duty

Firms commonly use a fulfillment house, a shipping or mailing service, or a comarketing agreement with another company. One section addresses exactly that.

A firm that uses a third party, or enters a comarketing agreement, to distribute samples or to meet any requirement of these rules stays on the hook. It "remains responsible for creating and maintaining all requests, receipts, forms, reports, and records" required.

And there is a production deadline attached. A firm that contracts with a third party to maintain some or all of its records still has to produce them. Requested forms, reports, records or other required documents go out within two business days of a request. The request can come from the agency or another federal, state or local regulatory or law enforcement official.

Two business days is the same window the general records section sets for making records available. Handing record-keeping to a vendor does not extend it.

Paper, electronic, or a mix

The records section allows electronic records, electronic signatures, and handwritten signatures executed to electronic records as an alternative to paper, provided the electronic records rules are met.

Mixed systems are allowed too, with a condition. Where paper and electronic components are combined, a reasonably secure link between them must exist. The link must be such that the combined records and signatures are "trustworthy and reliable, and to ensure that the signer cannot readily repudiate the signed records as not genuine."

Paper records maintained by photographic imaging or transmitted by facsimile carry three standards. Resistant to tampering, revision, modification, fraud, unauthorized use or alteration. Preserved in accessible and retrievable fashion, and available to permit copying for review, analysis, verification, authentication and reproduction.

One trap is named explicitly. Where a document is created on paper and electronically scanned into a computer, the resulting record is an electronic record and must meet the electronic records requirements.

Three years, and two business days

Retention here is three years. Any person required to create or maintain reports, lists or other records under these rules, including records relating to sample distribution, must retain them for at least three years after their creation.

Availability is two business days. Records must be made available on request, in a form permitting copying or duplication, to the agency or other federal, state or local regulatory and law enforcement officials.

Sample request and receipt forms may be delivered by mail, common carrier or private courier, or transmitted photographically or electronically, provided the transmission method meets the security requirements in the records section.

So the transmission channel is open and the security standard is fixed. The rule cares how a form is protected, not how it travels.

The reward

The last section in the part is one most people do not know exists.

A person who provides information leading to a criminal proceeding, and to a conviction, is entitled to a share of the criminal fine. The proceeding has to be against someone for the sale, purchase or trade of a drug sample, or an offer to do so, in violation of the statute.

The share is one-half of the fine imposed and collected. The section also sets a maximum, which is a dollar figure and is not reproduced here.

Application is by written application to a named office at the agency, with a different office depending on whether the product is regulated by the drug center or the biologics center.

It is a bounty provision sitting at the end of a records regulation, and it tells you how seriously the diversion problem was taken when these rules were written.

Sources

Each document below is named as it names itself, with the date printed on that document rather than the day it was read.

1. 21 CFR 203.32, Drug sample storage and handling requirements — Electronic Code of Federal Regulations, title 21, August 2026
2. 21 CFR 203.33, Drug sample forms — Electronic Code of Federal Regulations, title 21, August 2026
3. 21 CFR 203.34, Policies and procedures; administrative systems — Electronic Code of Federal Regulations, title 21, August 2026
4. 21 CFR 203.35, Standing requests — Electronic Code of Federal Regulations, title 21, August 2026
5. 21 CFR 203.36, Fulfillment houses, shipping and mailing services, comarketing agreements, and third-party recordkeeping — Electronic Code of Federal Regulations, title 21, August 2026
6. 21 CFR 203.37, Investigation and notification requirements — Electronic Code of Federal Regulations, title 21, April 2015
7. 21 CFR 203.60, Request and receipt forms, reports, and records — Electronic Code of Federal Regulations, title 21, August 2026
8. 21 CFR 203.70, Application for a reward — Electronic Code of Federal Regulations, title 21, April 2013