I have spent most of this year writing about what the FDA's peptide review does and does not permit — which substances are eligible, what a recommendation is worth before rulemaking, who is licensed to prescribe in Georgia. Those are the questions patients ask.
In August 2026, health-policy scholars writing in Health Affairs Forefront raised a different one, and it is sharper than anything I have written on this subject. Their argument, in short: section 503A of the Federal Food, Drug, and Cosmetic Act exempts qualifying compounded preparations from a set of core FDA requirements — and among the things that do not attach in the same way is systematic adverse-event reporting. Adding unapproved peptides to the 503A bulk drug substances list would substantially expand the number of people exposed to them, without a corresponding expansion in anyone's ability to detect harm.
I want to say plainly that I think this criticism is correct, and that it is not answerable by anything I do in my clinic. It is a structural problem. What follows is my attempt to describe it accurately and then to be specific about the much smaller thing a single practice can actually do.
What the surveillance system does for approved drugs
When a drug is approved, a reporting apparatus comes with it. The manufacturer is obligated to collect adverse-event reports and submit them to FDA on defined timelines, with expedited handling for events that are both serious and unexpected. Those reports flow into FAERS, the FDA Adverse Event Reporting System, where they are pooled with voluntary reports from clinicians and patients submitted through MedWatch. FDA analysts mine that pool for disproportionality — a particular event showing up with a particular drug more often than the background rate would predict.
It is an imperfect system, and every pharmacovigilance textbook says so. Reports are voluntary for clinicians, under-submitted, inconsistently detailed, and confounded. But it is a system, and it has caught real things. Its value is that it operates at a scale no individual prescriber can replicate: a signal that is invisible in one clinic's fifty patients can be visible across a hundred thousand.
What attaches to a compounded preparation
Considerably less, and the distinctions matter.
| Product type | Systematic adverse-event reporting to FDA |
|---|---|
| FDA-approved drug (manufacturer) | Yes — mandatory, defined timelines, expedited for serious and unexpected events |
| 503B outsourcing facility | Yes — serious adverse events must be reported |
| 503A patient-specific compounded preparation | Generally not — no equivalent mandatory federal reporting pathway |
| Any product — patient or clinician voluntary report | Always available — MedWatch accepts reports on compounded preparations |
Read that third row carefully, because it is the entire argument. The peptides under discussion — BPC-157, KPV, TB-500, MOTS-c, Semax, Epitalon — are, if they are ever lawfully compounded at all, overwhelmingly going to be dispensed as 503A patient-specific preparations. That is the pathway the July 2026 advisory committee was voting about. And that is the pathway with the thinnest surveillance.
This is worth sitting with. Section 503A's exemptions exist for a sensible reason: traditional compounding is small-scale, patient-specific, and derived from products that have already cleared FDA review. Requiring a community pharmacy to run a manufacturer-grade pharmacovigilance operation to make a dye-free suspension for one child would be absurd. The exemption fits that picture.
It fits poorly when the compounded substance is one FDA has never evaluated for safety and efficacy in the first place — where there is no approval-stage safety database to fall back on, and no postmarketing reporting stream to build one. That is the combination the Health Affairs authors are pointing at, and it is a real gap, not a rhetorical one.
Georgia found the same hole from the opposite direction
What makes this more than an academic dispute is that a state regulator, working from entirely different motives, landed on the same finding within weeks.
The Georgia Composite Medical Board began unannounced inspections of med spas, IV clinics, and wellness practices this summer. Among the deficiencies reported: unlicensed personnel delivering medical services, unlawful compounding, treatment administered with no prior medical examination, absent physician oversight — and operators failing to track adverse events.
Not failing to report them upward. Failing to track them at all. No register, no chart entry, no mechanism by which a clinic would know that three patients on the same batch had the same reaction.
So we have a federal health-policy critique saying the reporting obligation does not exist, and a state inspection program finding that where no obligation exists, many operators do nothing. Those two findings fit together in the obvious way. The absence of a requirement is not a neutral fact about paperwork. It predicts behavior.
What a single practice can honestly claim
Here is where I have to be careful, because this is exactly the point in an article like this where a clinic starts marketing.
I cannot close this gap. Neither can any other practice. Pharmacovigilance is a scale problem, and the scale required is national. A clinic that tells you its internal safety monitoring substitutes for a functioning surveillance system is telling you something false, and you should treat that claim the way you would treat any other overreach on this subject.
What a practice can do is refuse to take advantage of the gap, and be specific about what that means operationally. Ours:
The Limitless adverse-event commitments
- We ask, every time. Tolerance and side effects are a structured field at every check-in, not a question that gets asked when a patient looks unwell. Most adverse events are never volunteered; they are only ever elicited.
- We record the minor and the ambiguous. The register captures events we do not believe are drug-related, because relatedness is a judgment made in advance and judgments made in advance are how signals get filtered out before anyone can see them.
- We capture substance, pharmacy, lot, dose, and dates on every dispense. This is the operational core of the whole commitment. If a problem emerges with a specific batch from a specific pharmacy, we can identify every exposed patient the same day rather than reconstructing it from memory and shipping records.
- Serious events go to the dispensing pharmacy, in writing. The pharmacy is the only party positioned to see the same event across multiple prescribers.
- We report to FDA MedWatch voluntarily. For a 503A preparation the obligation generally does not attach. We submit anyway. A voluntary report enters the same pool as a mandatory one, and a gap that everyone declines to fill voluntarily stays empty.
- We tell you. If a safety signal emerges in a substance you are taking, you hear it from us, promptly, whether or not it changes your protocol — and whether or not it makes us look good.
None of that is heroic. It is roughly what any practice would do if the reporting obligation applied to it. That is the point: the standard we are holding to is not a higher one, it is the ordinary one, applied where it happens not to be compulsory.
What you should do
If you are taking a compounded peptide anywhere — here or elsewhere:
- Ask for the lot number and the dispensing pharmacy, and keep them. Photograph the label. If you ever need this information you will need it quickly, and reconstructing it later is unreliable.
- Report side effects to your prescriber even when you assume they are unrelated. You are not in a position to know, and neither am I on any single case. That is what aggregation is for.
- Know that you can report directly to FDA yourself. MedWatch accepts patient reports on compounded preparations. You do not need your clinic's permission or cooperation, and you should not need to ask for it.
- Ask any clinic what happens to a reported side effect. "We'd adjust your dose" is an answer about you. Ask what happens to the information — where it is recorded, who else sees it, and whether anyone could find every patient on the same lot.
What this article is not
It is not an argument that these peptides are unsafe. The honest position is narrower and less satisfying: for most of these substances the human safety data is thin enough that confident statements in either direction are unsupported, and the surveillance architecture that would eventually resolve the question is the specific thing that is missing.
It is also not an argument against compounding. Section 503A serves patients who genuinely need it every day. The problem is a mismatch between an exemption designed for traditional pharmacy practice and a market that has grown well past it.
The uncomfortable part
I prescribe some of these substances. This article describes a real weakness in the safety architecture surrounding what I do for a living, and I am publishing it on my own clinic's website, where prospective patients will read it.
I would rather do that than have you find it somewhere else and reasonably wonder why it was not here. A practice that only publishes the research that flatters its menu is not running a research library. It is running an advertisement with citations.
The Health Affairs authors and I would likely disagree about the conclusion — I think there are patients for whom a carefully monitored, indication-anchored, lawfully sourced protocol is the right call. But we do not disagree about the finding. They are right that nobody is counting. The correct response to being right about that is not to argue. It is to start counting.