When Bacillus cereus Keeps Coming Back: The Medline Warning Letter and Objectionable Microorganisms

When the same organism turns up in your product again and again, the problem is no longer the organism. It is the system that keeps failing to find and fix the source. That is the uncomfortable message in the FDA warning letter to Medline, issued on 28 May 2026, over recurring Bacillus cereus and other objectionable microorganisms in finished drug product. The letter is a case study in contamination control, environmental monitoring and, above all, corrective action that did not work.

For Canadian manufacturers, the lesson travels. The specific citations are United States regulations, but the principles behind them, control contamination at the source, verify it with monitoring, and prove your corrective actions are effective, are exactly what Health Canada inspectors expect under the Good Manufacturing Practices guide. This article explains what FDA found, why a spore-forming organism like Bacillus cereus is so hard to shake, and how to build a contamination control strategy that holds.

Executive Summary

FDA cited Medline for failing to adequately investigate and resolve repeated contamination of finished drug product with objectionable microorganisms, including Bacillus cereus, across more than two years. The agency called the firm's previous corrective actions unsuccessful and its responses inadequate. Key points:

Objectionable organisms were isolated from finished product on about nine occasions between June 2023 and August 2025, and Bacillus cereus was found in at least five manufacturing environment samples since January 2025.
FDA cited 21 CFR 211.192 (failure to thoroughly investigate), 211.42(c) (defined areas to prevent contamination) and 211.67(b) (cleaning and maintenance procedures), and deemed the products adulterated.
The agency stressed that finished-product testing cannot be the sole justification to release a batch, because contamination is not uniformly distributed.
The real failure was not detection, it was CAPA effectiveness: investigations did not reach the true root cause, so the same problem returned.

What Happened at Medline

What it is: an FDA warning letter to a drug manufacturer over repeated microbial contamination of finished product. Why it matters: it shows how a quality system can detect a problem for years and still fail, because the corrective actions never fixed the root cause. What to do: read the facts as a mirror for your own investigation and CAPA program.

The warning letter followed an inspection of a Medline drug manufacturing facility in Illinois in October 2025. FDA found that objectionable microorganisms had been isolated from finished product on roughly nine occasions between June 2023 and August 2025. Bacillus cereus, which FDA described as a significant opportunistic pathogen, was recovered from at least five environmental monitoring samples since January 2025. The issue was not new: it had already been cited on a Form 483 in January 2025 and discussed at a regulatory meeting in May 2025. Multiple investigations since 2023 had pointed to a root cause, yet the contamination kept recurring, and FDA concluded that earlier corrective actions had not succeeded.

FDA's investigation findings pointed to objectionable aseptic behaviours and repeated cleaning and disinfection deviations. The agency asked the firm for a risk assessment, a remediation plan, an assessment of whether it should move to terminal sterilization or aseptic processing, a retrospective review of three years of critical investigations, and an independent assessment of its corrective and preventive action program that analyzes investigation trends. In plain terms, FDA told Medline to stop treating each hit as a one-off and start looking across the whole pattern.

What FDA cited

Citation	What it requires	The finding
21 CFR 211.192	Thorough investigation of any unexplained discrepancy or failure of a batch to meet specifications	Investigations did not reach the true root cause, and earlier corrective actions did not work
21 CFR 211.42(c)	Defined areas or other control systems to prevent contamination	Controls did not keep objectionable organisms out of the environment and product
21 CFR 211.67(b)	Written procedures for cleaning and maintenance of equipment	Repeated cleaning and disinfection deviations
FD&C Act 501(a)(2)(B)	Drugs must be made under current good manufacturing practice	Products deemed adulterated

Why Bacillus cereus Is So Hard to Remove

What it is: a spore-forming bacterium found widely in soil, dust and water. Why it matters: its spores resist many routine cleaning and disinfection steps, so it can survive and re-seed a facility if the source is not removed. What to do: match your disinfectant programme and investigations to a spore-former, not to an easy-to-kill organism.

Bacillus cereus is an opportunistic pathogen that can cause illness and, in vulnerable patients, serious infection. It forms hardy spores that tolerate heat, drying and many common disinfectants. That is why a facility can clean a surface, test it, get a clean result, and still see the organism return weeks later. The spores sit in a niche the cleaning did not reach, a drain, a gasket, a piece of equipment, a water source, and release again. A disinfection programme that rotates in a sporicidal agent, and an investigation that hunts for the harbourage site rather than just re-cleaning, are what break the cycle.

This is also why FDA stressed that finished-product testing cannot be the sole basis for releasing a batch. Microbial contamination is rarely spread evenly through a lot. A sample can pass while contaminated units sit elsewhere in the same batch. Testing confirms the process worked. It does not create quality that the process failed to build in.

The Real Failure Was CAPA Effectiveness

What it is: the discipline of proving that a corrective action actually removed the cause. Why it matters: Medline detected the problem repeatedly, so detection was not the gap. The gap was that each investigation closed without fixing the source, and no one looked across the pattern. What to do: build effectiveness checks and trend review into every significant investigation.

A recurring deviation is the clearest sign a CAPA did not work. An investigation that ends at re-cleaning and retraining, without identifying why the organism entered and why it survived, is an investigation that will be reopened. FDA's request for a retrospective review of three years of critical investigations and a CAPA program assessment that analyzes trends is a direct response to that pattern. Our guides to getting 21 CFR 211.192 investigations right and to deviation and OOS procedures under Health Canada GMP set out how to run an investigation that actually closes the loop.

Three habits separate an effective CAPA program from a paper one. First, root cause analysis that reaches the true cause, not the nearest convenient one. Second, an effectiveness check scheduled after the action, with clear criteria for success. Third, trending across investigations, so that three similar deviations in a quarter are recognized as one systemic problem rather than three isolated events.

Building a Contamination Control Strategy That Holds

What to do: pull your microbial controls together into one documented strategy rather than a scatter of procedures. Modern expectations, reflected in Health Canada's adoption of the revised Annex 1 for sterile products, call for a holistic contamination control strategy that links facility design, environmental monitoring, cleaning and disinfection, personnel behaviour and investigations. The steps below apply whether your product is sterile or non-sterile, and they complement sound aseptic process validation.

Map your contamination risks. Identify where organisms could enter, survive and transfer to product, including water, air, surfaces, personnel and incoming materials.
Design monitoring to find the source, not just confirm cleanliness. Place environmental monitoring sites where harbourage is likely, and add sampling after any positive to locate the niche.
Match disinfection to the organism. Include a validated sporicidal agent on a defined rotation, and qualify the contact times and surfaces.
Set alert and action levels, and trend them. A single result rarely tells the story. The trend over weeks and months reveals whether a source is still live.
Investigate to root cause and verify the fix. For any objectionable organism, find why it entered and why it survived, act on both, then confirm the action worked.
Do not release on finished-product testing alone. Base release on an in-control process plus the full body of batch and monitoring data.

If the Problem Has Already Recurred

What to do: treat a repeat finding as a systemic signal and respond at the level of the system, not the single event. Why it matters: once an organism has returned, regulators will judge your response by how wide and honest your look-back is. A narrow re-clean will not satisfy them, and it will not protect patients.

Start with a risk assessment that asks the hard question: could product already on the market be affected? If the data cannot rule it out, a recall or a hold may be the right call, and it is far better to make that decision yourself than to have it made for you. Next, run a retrospective review across several years of related investigations, looking for the pattern the individual reports missed. FDA asked Medline for a three-year review of critical investigations for exactly this reason. Then rebuild the contamination control strategy around what the look-back reveals, and set objective criteria to prove the new controls work before you call the problem closed.

Independence helps here. A fresh set of eyes, whether an internal team not involved in the original investigations or an outside consultant, is more likely to find the harbourage site and the systemic gap than the people who signed off on the earlier corrective actions. That is also what an inspector expects to see: evidence that the firm stepped back, looked across the whole picture, and did not simply repeat the response that had already failed.

Contamination Control and CAPA Checklist

A written contamination control strategy links facility, monitoring, cleaning, personnel and investigations.
Environmental monitoring sites target likely harbourage, and positives trigger follow-up sampling to find the source.
The disinfection programme includes a validated sporicide on a defined rotation with qualified contact times.
Alert and action levels are set, and monitoring results are trended over time, not read one at a time.
Every objectionable-organism investigation identifies why the organism entered and why it survived.
Each significant CAPA has a scheduled effectiveness check with clear success criteria.
Investigations are trended, so repeat events are recognized as one systemic issue.
Batch release rests on a validated, in-control process, not on finished-product testing alone.

Common Mistakes

Closing an investigation at re-cleaning and retraining without finding the harbourage site. The organism returns because the source is still there.
Treating a repeat deviation as a new, unrelated event. Repetition is the signal that the previous CAPA failed.
Using a disinfectant that does not kill spores against a spore-forming organism, then expecting a clean result.
Releasing a batch on a single passing finished-product test when contamination may be uneven across the lot.
Reviewing monitoring results one at a time, so a slow upward trend is never recognized until product is affected.

Frequently Asked Questions

What is an objectionable microorganism?

An objectionable microorganism is one that, given the product, its route of administration and the patient, could cause harm or compromise the product. The determination depends on the organism, the dose and the population, not on a fixed list. Bacillus cereus in a drug product is treated as objectionable because it is an opportunistic pathogen.

Why is Bacillus cereus so difficult to eliminate?

It forms spores that resist heat, drying and many common disinfectants. If cleaning does not reach the niche where the spores live, the organism survives and re-seeds the area. Controlling it needs a sporicidal agent and an investigation that finds and removes the source.

Can we rely on finished-product testing to release a batch?

No. FDA was explicit that finished-product testing cannot be the sole justification to release, because contamination is not uniformly distributed. A sample can pass while contaminated units remain. Release should rest on a validated, in-control process, with testing as verification.

What does this mean for Canadian manufacturers?

The same principles apply under Health Canada's Good Manufacturing Practices guide (GUI-0001): control contamination, investigate deviations thoroughly, and prove corrective actions are effective. For sterile products, Canada's adoption of the revised Annex 1 expects a documented contamination control strategy. A site exporting to the United States also faces FDA oversight directly.

How do we show a CAPA was effective?

Define what success looks like before you act, schedule an effectiveness check after the action, and measure against that criterion. If the same deviation recurs, the CAPA was not effective and the investigation must be reopened with a wider root-cause view.

What is a contamination control strategy?

It is a single, documented plan that links every control that keeps contamination out of product: facility and equipment design, utilities, environmental monitoring, cleaning and disinfection, personnel practices, materials and investigations. It is a central expectation of the revised Annex 1 for sterile products and good practice for any GMP site.

How MFLRC Can Help

MF License and Regulatory Consultants helps pharmaceutical, cannabis, natural health product and sterile manufacturers build contamination control and CAPA systems that survive inspection. We develop and review contamination control strategies, environmental monitoring programmes, deviation and CAPA procedures, and we run mock inspections and gap assessments against Health Canada GMP and FDA expectations. When a recurring problem or a warning letter has already landed, we help with root-cause investigations, remediation planning and the kind of restart plan FDA will accept, and we build the trend review and annual product quality review that catch a pattern before an inspector does.

Facing a recurring contamination problem or want to test your CAPA program before FDA or Health Canada does? Contact MFLRC for an independent contamination control and CAPA effectiveness review.

Book a Consultation

Conclusion

The Medline letter is not really about one organism. It is about what happens when a quality system detects a problem for years and never truly fixes it. The antidote is not more testing. It is a contamination control strategy that finds the source, a disinfection programme matched to a spore-former, and a CAPA process that proves each action worked. Those same habits protect you whether the pressure comes from your own laboratory data, a Health Canada inspection or an FDA warning letter. Find the source, fix it, and prove it stayed fixed.