Botox Lot Number Tracking: Units Bought vs Units Charted After an FDA Warning Letter

On 1 April 2026 the FDA sent Warning Letter 723267 to a med spa in Southlake, Texas because the clinic's patient records showed more Botox administered than the clinic had bought. The agency wrote that the firm "dispensed significantly more Botox units than documented purchases from AbbVie (the manufacturer of Botox), thereby indicating a major discrepancy." That single piece of arithmetic, units purchased against units charted, is what turned an inspection into an enforcement action.

The compliance advice that followed the letter mostly told clinics to start recording lot numbers because the Drug Supply Chain Security Act requires it. Read the statute and it does not. 21 U.S.C. 360eee-1(d)(1)(A)(iii) requires a dispenser to capture lot level information only "if provided" by the supplier, and 360eee-1(d)(1)(D) says a recall response need not include the lot number unless the manufacturer or wholesale distributor gave it to you. There is a federal statute that does force a provider to write a lot number into the chart, and it covers vaccines, not neurotoxin.

Lot capture is still worth doing. It is worth doing for reasons that are more specific and more defensible than a compliance mandate that does not exist, and it does not do the one job most people believe it does, which is proving a vial is genuine.

This post does three things. It walks the reconciliation the FDA actually performed, in a form you can run on your own records. It separates what federal law requires from what is standard of practice, with the citation next to each row. And it sets out, in vendor-neutral terms, what a record system has to be able to answer when a recall notice or an adverse event lands on your desk.

Every source on this page was read on 19 August 2026. We make med spa software, so we have an obvious interest in how clinics keep product and treatment records. The statutory citations and the reconciliation below hold regardless of whose software you run them in.

What the FDA found at a Texas med spa in April 2026

Warning Letter 723267, dated 1 April 2026, went to Bridget M. Goddard, Manager, Pure Indulgence Aesthetics, 1695 East Southlake Boulevard Suite 150, Southlake, TX 76092, FEI 3041017461. It came from the Center for Drug Evaluation and Research, Office of Compliance, Office of Drug Security, Integrity, and Response, and was signed by Sangeeta Vaswani Chatterjee, Pharm.D., Director. FDA investigators inspected the facility on 2, 3 and 12 December 2025, issued a Form FDA 483 on 12 December 2025, and received the firm's response on 17 December 2025. The page was current as of 9 April 2026.

Two findings carried the letter. The first was the purchase-versus-dispensing gap. FDA concluded the firm "did not purchase enough Botox from AbbVie to supply patients with the quantity of authentic Botox indicated in patient records," and that "this discrepancy shows that your firm obtained product from unauthorized sources." That was cited as a violation of FD&C Act section 582(d)(3), the authorized trading partner requirement.

The second was physical. Investigators identified an unlabeled, clear vial containing a ring of white powder in the facility's trash, and laboratory analysis later confirmed it contained botulinum neurotoxin type A, the same active ingredient as Botox. FDA noted the shape of the unlabeled vial was not the same as an authentic AbbVie vial. The cited violation was section 582(d)(2), the product identifier requirement, because the firm provided no evidence the vial had come from a package or homogeneous case carrying a required product identifier. FDA did not make a counterfeit determination about product administered to patients. Its finding is narrower and harder to argue with: the firm could not produce the labelling that would identify what it had.

Every quantity in the published letter is redacted as (b)(4). The number of vials, the number of units, the number of patients and the size of the discrepancy are all withheld. No figure in this post is attributed to that letter, because no figure is public.

Why a med spa is a dispenser under the DSCSA

21 U.S.C. 360eee(3)(A), which is FD&C Act section 581(3), defines a dispenser as "a retail pharmacy, hospital pharmacy, a group of chain pharmacies under common ownership and control that do not act as a wholesale distributor, or any other person authorized by law to dispense or administer prescription drugs." The last clause is the one that catches aesthetic practices. FDA applied it directly in the warning letter, writing that Pure Indulgence "therefore operates as a 'dispenser' under section 581(3) of the DSCSA" and is subject to certain provisions of section 582(d). The only carve-out in 360eee(3)(B) is for animal-health dispensing.

One correction worth carrying, because it appears wrongly in a lot of secondary writing. 21 U.S.C. 360eee, FD&C 581, contains definitions only. The duties sit at 21 U.S.C. 360eee-1, FD&C 582, and the dispenser duties specifically at 582(d). The letter says so itself: section 582 of the FD&C Act "specifies the requirements."

FDA's page "Exemptions under the Drug Supply Chain Security Act," content current as of 6 August 2026, does grant small business dispensers an exemption from certain section 582 requirements until 27 November 2027. Two things about it. It addresses the enhanced drug distribution security requirements, not the baseline duties cited against Pure Indulgence, and FDA on that same page urges small dispensers to keep working toward the enhanced requirements anyway. And 27 November 2026 is not the end date, it is the eligibility snapshot: a dispenser counts as small if, as of that date, the owning company has 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians. Most med spas employ none. We found no FDA guidance resolving how that headcount test applies to a non-pharmacy dispenser, read 19 August 2026. FDA also asks small dispensers to complete its assessment survey by 22 September 2026.

The reconciliation: purchased, charted, wasted, and the gap

The arithmetic FDA ran is available to any clinic with invoices and treatment records. The table below is a blank worksheet with a worked hypothetical column. The figures in it are invented for illustration and are not drawn from the warning letter or from any published source.

The sign of line E is the whole point. A positive variance means product left your inventory without a chart entry, a waste entry or a vial on the shelf. A negative variance, where B plus C plus D exceeds A, is the Pure Indulgence pattern: more product went into patients than you can show you bought. FDA treated that direction as evidence that product came from somewhere other than an authorized trading partner.

Window alignment decides whether the number means anything, and it is the one methodological weakness in the published letter. FDA's purchase records covered 18 December 2024 to 1 December 2025. The patient treatment records covered 1 January 2025 to 1 December 2025. Those windows differ by two weeks at the front. The agency also noted that the only purchase order for the larger vial quantity was placed on 2 December 2025, after investigators arrived. Footnote 1 of the letter records that there was no discrepancy between the purchase records supplied by the firm and those supplied by AbbVie, which removes the obvious alternative explanation. When you run this on your own books, start both windows on the same date and carry opening inventory explicitly, or you will manufacture a variance out of calendar edges.

One operational practice will break line B before you start. FDA investigators were told of the firm's practice of drawing product identified as Botox into 10-unit syringes and holding a supply of pre-filled syringes at the facility for later administration. The agency was not satisfied by the firm's assurance, writing that without further detailed protocols it remained concerned the firm would continue removing product from manufacturer vials before administration. Once product lives in unlabelled syringes between patients, no chart entry can be tied back to a specific vial, and the reconciliation degrades from a per-vial check to a bulk estimate.

There is also a real tension in the FDA labelling that this post reports rather than resolves. The BOTOX Cosmetic prescribing information, label version effective 18 October 2024, describes single-dose vials. The same label directs that reconstituted product be stored at 2 to 8 degrees Celsius and administered within 24 hours. Both statements are in the approved labelling. This post prints both and leaves the question of multi-patient vial use to your medical director.

What DSCSA requires about lot numbers, and what it does not

The statutory reading matters because the wrong version of it gets repeated constantly. The table below sets out each obligation, whether it is a federal requirement, and the citation, all read on 19 August 2026.

The vaccine row is the sharpest contrast in the table. 42 U.S.C. 300aa-25(a)(2) tells every health care provider who administers a vaccine set out in the Vaccine Injury Table to record the vaccine manufacturer and lot number in the person's permanent medical record, or in a permanent office log a legal representative can access on request. Congress wrote that duty in 1986. Read on 19 August 2026, the text still reaches only vaccines set out in the Vaccine Injury Table rather than injectables generally, and botulinum toxin is not a vaccine.

The DSCSA rows show why the received wisdom is wrong. Lot level information travels with the transaction "if provided." If your wholesaler sends you lot data, you hold it for six years. If a recall arrives and the supplier never gave you lot data, 360eee-1(d)(1)(D) says your response need not include a lot number. Note also 360eee-1(d)(1)(B): you may contract a third party to hold these records, and doing so does not relieve you of the obligation.

Two rows carry a "we found no published" formulation rather than a flat negative, and that phrasing is deliberate. We searched for a federal wastage recordkeeping rule and a federal per-patient lot capture rule for this product class and did not find one as of 19 August 2026. State boards of nursing and medicine, malpractice carriers and payers set their own expectations, and those are cited to the state or the contract, not to Title 21.

Reconstituted toxin: vial expiry versus the in-use window

Two clocks run on every vial and clinics routinely track only the first. The BOTOX prescribing information, label version effective 18 November 2023, states that unopened vials stored at 2 to 8 degrees Celsius are good for up to 36 months, and that reconstituted BOTOX may be stored at 2 to 8 degrees Celsius for up to 24 hours until time of use. The BOTOX Cosmetic label, effective 18 October 2024, gives the same in-use window: store reconstituted product refrigerated and administer within 24 hours. Both labels are under BLA103000, U.S. License 1889.

The presentations are fixed and small in number, which is what makes unit arithmetic possible at all. BOTOX Cosmetic is supplied as 50 Units, NDC 0023-3919-50, and 100 Units, NDC 0023-9232-01. BOTOX is supplied as 100 Units, NDC 0023-1145-01, and 200 Units, NDC 0023-3921-02. Every line A in your worksheet resolves to some combination of those four.

Operationally, a vial record needs a reconstitution timestamp as well as an expiry date, because the 24-hour clock starts at reconstitution and has nothing to do with the printed expiry. A vial can be eleven months inside its labelled shelf life and still be outside its in-use window by lunchtime the following day.

Without product identification, recall and adverse event review break down

The strongest argument for capturing product detail is not a statute. It is the operational failure FDA described in its own words. On the firm's assurance that no adverse events had occurred, the agency wrote that it was "impossible for FDA to verify this statement since you did not provide any documentation or identify the products you dispensed and administered to patients at your facility, making a true evaluation of adverse events or potentially applicable recalls impossible." And more generally: "The ability to conduct a speedy and effective recall of drug products when necessary is critical to public health. When a facility obtains drug products from unauthorized sources and does not have safeguards in place to identify adverse events, effective recalls are not possible."

That is a records failure described as a public health failure, and it is the standard your own records get measured against.

Here is the finding that reframes the whole exercise. FDA's drug enforcement database returned exactly one Botox recall when we queried it on 19 August 2026: D-0747-2018, Kroger Specialty Pharmacy, Inc., Vicksburg, Mississippi, Class II, voluntary firm-initiated, reason "Lack of Processing Controls," initiated 3 April 2018, reported 16 May 2018, status Terminated, distributed in Mississippi, Louisiana, Arkansas, Illinois and Florida. Its scope is not a lot list. The code information reads: "All lots remaining within expiry dispensed 12/01/2017 through 02/12/2018." A clinic that captured every lot number but could not pull a list of patients by date of administration would fail that recall. Date-of-administration indexing deserves the same weight as lot capture, and it is the part almost nobody builds for.

This is also where the boundary between an operational record and a clinical record starts to matter, because the two are usually held in different systems and only one of them is searchable by the front desk. We wrote about where that line falls in the piece on whether a booking platform replaces your EMR.

Published counterfeit identifiers, and why a lot lookup is not authentication

Regulators in two countries have published specific batch identifiers for counterfeit botulinum toxin. The table lists them with the jurisdiction attached, because the jurisdiction changes what the row means.

The three Australian identifiers are border interceptions of product bought online from overseas websites and not obtained from an Australian pharmacy. They are not US-distributed lots and should not be read as such. The TGA advisories and the CDC advisory cited below were read on 19 August 2026 through Internet Archive captures, because tga.gov.au timed out and cdc.gov returned an HTTP 403 to direct requests.

Now the part that undoes the obvious workflow. The peer-reviewed account of the 2024 US cases, Thomas CM, McElroy R, Yackley J, et al., "Notes from the Field: Illnesses After Administration of Presumed Counterfeit Botulinum Toxin in Nonmedical Settings, Tennessee and New York City, March 2024," MMWR Morb Mortal Wkly Rep. 2024 Jul 11;73(27):609-611, reports that the batch number on the counterfeit vial label, C3709C3, belonged to a legitimate 100-unit strength batch that expired in August 2017. The counterfeit carried a real lot number cloned from a genuine batch, on a carton falsely showing a 150-unit strength. The report also notes the manufacturing location in Ireland was misspelled on the packaging. It covers seven women, median age 48, range 26 to 55; four were hospitalised, two in intensive care, and none died. Product identification depended on photographs the injector happened to supply, and for the three New York City patients the report records no product information.

The conclusion follows directly. A lot number lookup would have returned a valid lot. Lot capture supports recall response and adverse event traceability. It does not authenticate product. Authentication runs through the supplier relationship and the physical carton, and the misspelling, the wrong ingredient name and the 150-unit strength that FDA's alert says neither AbbVie nor Allergan makes did more work than the lot field ever could.

The supply side is documented too. FDA issued 18 warning letters dated 3 November 2025 to owners of websites illegally marketing unapproved and misbranded botulinum toxin products, announced in a news release on 5 November 2025. One of them, MARCS-CMS 718707 to Aesthetic Essentials Limited of Hong Kong SAR China, covers botulinum toxin type A marketed as "Rentox 200U" and cites FD&C Act sections 301(a), 301(d), 503(b) and 505(a). It is an internet-seller misbranding action and cites no DSCSA provision.

CDC Health Alert Network Health Advisory CDCHAN-00507, "Adverse Effects Linked to Counterfeit or Mishandled Botulinum Toxin Injections," distributed 23 April 2024, reported 22 people with adverse effects as of 18 April 2024 across what CDC counts as 11 US states, being ten states plus New York City. Of the 20 people with information available, 11, or 55 percent, were hospitalised. None met the case definition for botulism and none died. The scope statement matters: all reported receiving injections from unlicensed or untrained individuals or in non-healthcare settings including homes and spas. It is not a document about licensed clinical practice, and it makes no recommendation about lot numbers. Its only documentation point concerns dose.

Authorized trading partners and the six-year record

"Authorized" is a defined term, not an adjective, and 21 U.S.C. 360eee(2) sets out what it means for each kind of counterparty. For a manufacturer or repackager it means having a valid registration under section 360. For a wholesale distributor it means holding a valid license under state law or section 360eee-2 and complying with the licensure reporting requirements under section 353(e). Third-party logistics providers have their own clause. For a dispenser, it means having a valid license under state law.

Those are checkable facts about a supplier, and FDA expects to see that you checked. In rejecting the firm's remediation, the agency noted that the response named a "drug custodian" but included no documentation demonstrating who that individual is, and that the response lacked a description of how trading partner status will be verified. A named role with no evidence behind it was treated as no control at all.

The retention rule is 21 U.S.C. 360eee-1(d)(1)(A)(iii): capture transaction information, including lot level information if provided, transaction history and transaction statements, as necessary to investigate a suspect product, and maintain them for not less than six years after the transaction. Separate six-year clocks run on suspect product investigation records under (d)(4)(A)(iv) and on illegitimate product disposition records. If you contract that storage out, (d)(1)(B) is explicit that you are not relieved of the obligation.

One scope limit to keep straight. Footnote 6 of the warning letter records that a compounded drug is not a "product" for DSCSA purposes under section 581(13), because it does not meet the relevant compounding requirements under sections 503A and 503B. A reconciliation that swept compounded preparations into the same statutory analysis would misstate the law.

How to run this on your own records this month

Pick a closed calendar month that has already ended. Pull three things: every supplier invoice with a received date inside the window, every chart entry with units administered inside the window, and a physical count of unopened vials as at both the first and last day. Convert everything to units at label strength using the four NDC presentations listed above so you are never adding vials to units.

Fill in lines A through F of the worksheet. Then go straight to line E and write a sentence explaining it. If you cannot explain it, that is the finding. Repeat for the prior month before you conclude anything, because a single month of misaligned opening inventory produces a variance that means nothing.

Separately, run a recall drill. Pick an arbitrary date range of six weeks in the past and produce, within two business days, the list of patients who received product in that window, with the product and strength recorded for each. That is the D-0747-2018 test, and it is the one most clinics have never attempted. If you are running more than one location, run it across all of them at once, since stock moves between sites and the patient list has to be one list. We look at how the main platforms handle multiple sites in our review of med spa software, and at what changes structurally once a second site opens in our guide to multi-location med spa software.

What your system has to do

This is a requirements list, stated in the second person, with no vendor attached. Your system needs to hold supplier transaction information, transaction history and transaction statements for at least six years and let you retrieve them by supplier and by date. It needs a product record per vial that carries the manufacturer, the strength, the NDC, the expiry date, and the lot number when your supplier provided one, with the lot in a structured field rather than a free-text note.

It needs to record what was administered to whom, with units and date of administration, and it needs to be searchable by that date across your whole patient base, not only inside a single chart. It needs a place to record product discarded, with a date and the person who recorded it. It needs to identify the named individual accountable for product custody, and to show a documented step where a supplier's authorized status was checked before an order was placed. And it needs to export all of that in a form you could hand to an investigator inside two business days.

Grade whatever you run today against those eight items. Any of them you cannot do is a manual process you own until the software catches up, and a manual process with a name against it is still better than a gap.

Frequently asked questions

Do I have to record the Botox lot number in the patient chart?

Not under the Drug Supply Chain Security Act. 21 U.S.C. 360eee-1(d)(1)(A)(iii) requires a dispenser to capture lot level information only if the supplier provided it, and 360eee-1(d)(1)(D) says a recall response need not include the lot number unless the manufacturer or wholesaler gave it to you. We found no published federal rule requiring per-patient lot capture for botulinum toxin, read 19 August 2026. Your state board, your carrier or a payer contract may require it independently, and recording it is widely treated as standard of practice.

Is a med spa a dispenser under the DSCSA?

Yes. 21 U.S.C. 360eee(3)(A), FD&C Act section 581(3), defines a dispenser to include any person authorized by law to dispense or administer prescription drugs, beyond the named pharmacy categories. FDA applied that definition to an aesthetic practice in Warning Letter 723267 dated 1 April 2026, stating the firm operates as a dispenser under section 581(3) and is subject to provisions of section 582(d). The only exclusion in 360eee(3)(B) is for dispensing intended for animals.

How do I reconcile units purchased against units charted?

Take units received from your supplier in a fixed window, subtract units charted as administered in the same window, subtract units documented as discarded, then subtract unopened units counted on the shelf at the close. What is left is unexplained variance. Convert vials to units at label strength first. Start both the purchase window and the treatment window on the same date and carry opening inventory explicitly, otherwise calendar edges create a variance that is not real.

How do I check whether a Botox vial is counterfeit?

Not by lot number alone. FDA's alert of 16 April 2024, updated 1 May 2024, published counterfeit lot C3709C3, but MMWR reported on 11 July 2024 that C3709C3 was a genuine lot number from a legitimate 100-unit batch that expired in August 2017, cloned onto a fake carton. The carton gave better signals: the active ingredient written as "Botulinum Toxin Type A" instead of "OnabotulinumtoxinA", a 150-unit dose that FDA's alert says neither AbbVie nor Allergan makes, non-English text, and a misspelled Irish manufacturing location. Buying only from an authorized trading partner remains the primary control.

How long do I have to keep transaction records from my distributor?

Six years. 21 U.S.C. 360eee-1(d)(1)(A)(iii) requires a dispenser to capture transaction information, including lot level information if provided, transaction history and transaction statements as necessary to investigate a suspect product, and to maintain them for not less than six years after the transaction. That obligation took effect on 1 July 2015. You may contract a third party to hold the records, but 360eee-1(d)(1)(B) states that doing so does not relieve you of the obligation.

What happens if my charted units exceed what I bought?

FDA treats it as an indication that product came from somewhere other than an authorized trading partner. In Warning Letter 723267 of 1 April 2026, the agency found a firm dispensed significantly more Botox units than its documented purchases from AbbVie and concluded the firm obtained product from unauthorized sources, citing FD&C Act section 582(d)(3). All quantities in the published letter are redacted. Before treating a gap as real, check that your purchase and treatment windows cover the same dates and that opening inventory is accounted for.

Do I have to document wasted or discarded product?

We found no published federal recordkeeping mandate for discarded botulinum toxin, read 19 August 2026. Botulinum toxin carries no DEA schedule in its FDA labelling and there is no controlled substance section in the prescribing information, so controlled substance disposal and witnessing rules do not reach it. Waste documentation is a standard of practice, state board or payer matter. It is also the line that makes a reconciliation defensible, because without it every discarded unit reads as an unexplained variance.

How long is reconstituted botulinum toxin good for?

Twenty-four hours refrigerated, per both approved labels. BOTOX Cosmetic, label version effective 18 October 2024, directs that reconstituted product be stored at 2 to 8 degrees Celsius and administered within 24 hours. The BOTOX label, effective 18 November 2023, states reconstituted product may be stored at 2 to 8 degrees Celsius for up to 24 hours until time of use, and that unopened vials stored at the same temperature keep for up to 36 months. The in-use clock starts at reconstitution and is unrelated to the printed expiry date.