The NECC meningitis outbreak was caused by contaminated steroid injections made by New England Compounding Center, a pharmacy in Framingham, Massachusetts. On September 26, 2012, NECC recalled three lots of that steroid. By the time CDC closed its count in 2015, 753 people in 20 states had fungal infections and 64 had died. Congress's answer, fourteen months later, is the reason a 503B outsourcing facility exists at all.
September 26, 2012: the recall behind the NECC meningitis outbreak
It started with one patient. On September 18, 2012, a clinician alerted the Tennessee Department of Health to a case of fungal meningitis, an infection of the membranes around the brain and spinal cord, diagnosed 46 days after a steroid injection in the spine. Within nine days, CDC's first report says, investigators had found eight more patients. All nine had received preservative-free methylprednisolone acetate, a steroid injected for back and joint pain, compounded at NECC.
NECC was told on September 25 that three lots looked implicated, and it recalled them the next day, according to a 2015 CDC analysis. The lot numbers were 05212012@68, 06292012@26 and 08102012@51. CDC's outbreak page records that September 26 recall and its expansion on October 6 to every NECC product in circulation.
The main fungus was Exserohilum rostratum, a mold CDC describes as common in the environment. It doesn't spread from person to person. It got into people through the needle.
New England Compounding Center, the day before
On September 25, 2012, NECC was a compounding pharmacy. Traditional compounding pharmacies answered mainly to their state board, and the federal law meant to set their limits, section 503A, was in doubt: its advertising provisions had been found unconstitutional, and FDA later said the 2013 law "removed uncertainty about the validity of section 503A".
There was no federal category for what NECC was actually doing. It presented itself as a pharmacy filling patient-specific prescriptions, each written for a named person. Federal prosecutors said it routinely dispensed drugs in bulk without valid prescriptions and even put fictional and celebrity names on fake ones (U.S. Attorney's Office, 2017).
FDA had warned NECC before, in a letter dated December 4, 2006. NECC's reply disputed it.
That is the contrast worth holding onto. A real prescription names one patient, one prescriber and one dispensing pharmacy. Through Promise, tirzepatide is dispensed as a compounded medication, which is different from an FDA-approved product: the formulation offered here is not FDA-approved.
What FDA inspectors found
FDA's inspection report is a Form 483, the list of observations inspectors leave at the end of a visit, not a final agency finding. NECC's covers visits from October 1 to October 26, 2012. In a bin of 321 vials from lot 08102012@51, inspectors saw greenish-black foreign matter in about 83 and white, thread-like material in 17. FDA's own lab found microbes growing in all 50 vials it tested from that lot.
The rest explains how. The pharmacy made the injectable steroid from non-sterile raw ingredients and had no evidence that its autoclave, the pressurized steam oven meant to sterilize it, actually did. Its clean-room monitoring turned up bacteria and mold again and again between January and September 2012, and the firm didn't investigate when results crossed its own action limits. Staff told inspectors the clean-room air conditioning was switched off every night.
What the recall set in motion
Records made the outbreak traceable. Because clinics knew who had received which lot, public health teams could find people fast: by October 19, 2012, more than 99% of 13,534 potentially exposed people had been contacted (Smith et al., NEJM). Patients' median age was 64, and illness showed up a median of 47 days after the shot, sometimes months later.
Speed mattered. The 2015 CDC analysis estimated that the recall, the patient calls and early treatment guidance averted about 3,150 contaminated injections, 153 cases of meningitis or stroke, and 124 deaths.
The Drug Quality and Security Act: why 503B pharmacies exist
Congress answered on November 27, 2013, with the Drug Quality and Security Act. FDA says Congress passed it in response to the outbreak and other serious harm linked to poor-quality compounded drugs.
It kept section 503A, minus the advertising provisions, so traditional pharmacies still compound against valid prescriptions for identified patients. And it created section 503B, a voluntary category of outsourcing facilities that may make sterile drugs without a prescription for each patient but must follow federal manufacturing rules, report adverse events and accept risk-based FDA inspections. What a 503B outsourcing facility is covers how that works day to day.
Sermorelin shows why the patient-specific rule still matters. No FDA-approved sermorelin product is currently marketed — Geref was approved in 1997 and withdrawn in 2009 — and the compounded formulation offered here is not FDA-approved. A prescription for it goes to a licensed compounding pharmacy that prepares it for the one patient it names.
What happened next, year by year
2015. On October 30, CDC said it didn't expect further updates to its count: 753 cases in 20 states and 64 deaths. Michigan had the most cases (264, with 19 deaths), then Tennessee (153, with 16).
2017 to 2021. A federal jury convicted owner and head pharmacist Barry Cadden in March 2017 of racketeering, mail fraud and related charges, and supervisory pharmacist Glenn Chin on all 77 counts that October. After an appeals court vacated their first sentences, Cadden was resentenced on July 7, 2021 to 174 months and Chin on July 21 to 126 months. Prosecutors cited court documents saying more than 100 patients died, a different count from CDC's.
2023. A revised USP General Chapter 797 became official on November 1. USP 797 is the U.S. Pharmacopeia's standard for preparing sterile medicines: staff training, cleanrooms, environmental monitoring, and testing and storage of finished preparations.
2024. In Michigan, Cadden pleaded no contest to 11 counts of involuntary manslaughter for 11 deaths in that state and was sentenced on May 10 to 10 to 15 years, served alongside the federal term.
2026. As of September 22, 2026, the day this article was written, FDA's register of outsourcing facilities, marked "Updated as of 9/8/2026," listed 96 facilities, 41 of them not yet inspected. A 2026 study in the Journal of the American Pharmacists Association followed the 48 facilities registered from January 2020 through April 2025: 11 had been inspected, on average 2.2 years after registering, and each had at least two significant findings (McCall et al., 2026).
What the NECC outbreak means for a prescription now
NECC failed at the most basic job in sterile compounding: keeping microbes out of something injected into the body. Injectable forms of tirzepatide, sermorelin and NAD+ are sterile preparations too, which is why those standards apply to them.
A prescribed route differs from the NECC model in ways you can check. A named prescriber reviewed your history. The prescription is written for you, not for a clinic shelf under an invented name. A licensed U.S. compounding pharmacy puts its name and a lot number on the label, so if a batch ever has a problem, it knows who received it and can call. How compounded medications are made walks through that process, and checking a compounded medication recall shows how a lot number gets matched.
Telling a prescribed vial from an anonymous one
Vials sold online without a prescription have none of those safeguards: no prescriber, often no pharmacy name, no lot trail back to a person. Two questions tell the routes apart. Who is named on the label, and who would call you if something were wrong?
Compounded drugs are not FDA-approved, which means FDA does not review them for safety, effectiveness or quality before they reach patients. A licensed provider may still prescribe a compounded formulation where it is lawful and appropriate; that decision is between you and your doctor. Which raw ingredients a 503A pharmacy may use is covered in the 503A bulks list explained.
At Promise, a licensed provider reviews every request, and not everyone qualifies. If a prescription is written, a licensed U.S. compounding pharmacy prepares it for you specifically.