FDA finds Curia's NY drug lab kept records in shred bins; APIs adulterated

Following an inspection of its Rensselaer, New York active pharmaceutical ingredient facility from 28 January to 5 February 2026, Curia New York, Inc. received an FDA warning letter (reference 320-26-127, dated 18 September 2026) citing three significant CGMP deviations, all involving data integrity, per an FDA.WATCH report on the letter. FDA declared the firm's APIs adulterated under section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act.

The laboratory findings were concrete: thousands of unexplained HPLC and UPLC injections on Empower over 30 months and over 70 trial injections on TotalChrom in October 2025 alone, many acquired under the undocumented 'Developer' role rather than 'Operator' — nearly 20% of Empower trial injections were acquired or altered in Developer mode. On 29 January 2026 inspectors found original records — pH and balance printouts, reviewer-signed data review checklists — in shred bins, with staff reviewing photocopies instead of originals.

The third deviation: one analyst used another analyst's login credentials to run calibrations and sample testing on the electronic system used for GMP analysis. FDA called credential sharing a serious violation of data-integrity principles and said the quality system had failed to detect and prevent repeated occurrences.

FDA found Curia's 27 February 2026 response inadequate — it had not investigated all unexplained injections nor analyzed all shred-bin contents — and required a comprehensive independent data-integrity assessment across all facilities and computerized systems, a current risk assessment covering released drugs, and a global CAPA including hiring a data-integrity compliance officer, with a written response due within 15 business days. Unresolved deviations may lead to seizure, injunction, or withheld application approvals.

APIs declared adulterated; mandatory independent data-integrity assessment, risk assessment of released drugs, global CAPA and a hired data-integrity compliance officer.

Original GMP records sat in shred bins while staff reviewed photocopies — the most direct possible attack on the evidentiary chain behind released drug ingredients.

Thousands of injections over 30 months could not be traced to any product, sample or analysis, so no one could show what testing actually ran.

Shared 'Developer'-role logins on the GMP analysis system undermined who-did-what accountability, and the quality unit never caught it repeating.

The company's own remedial response skipped whole classes of the evidence FDA had flagged, which read as not grasping the scope.

Data integrity fails in mundane places — a shred bin, a shared login, an undocumented injection. If testing records can't be trusted, the product counts as unprovable.

The warning letter requires Curia to respond within fifteen business days with the independent assessment, the risk assessment of already-released drugs, and the global corrective plan. FDA states that failure to resolve the deviations may result in regulatory or legal action including seizure and injunction, and that it may withhold approval of new drug applications until corrections are verified.