"A distributor's failure to have systems in place to investigate and quarantine suspect and illegitimate products within their control is a violation of the law. But this is even more concerning given that we're in the midst of a widespread opioid crisis," FDA Commissioner Scott Gottlieb said in a statement.
The warning letter was dated Feb. 7.
McKesson in a statement said it takes this situation "very seriously."
"We have been in communication with the FDA over the past several months to respond to their questions and we are in the process of providing additional procedural detail and documentation, including enhancements recently made in response to the FDA's initial feedback," the company said in a statement Tuesday. "We are committed to the security of the supply chain and are taking steps to help ensure we comply fully with FDA's track-and-trace laws for all pharmaceutical products."
In its warning letter, the FDA cited three examples where McKesson shipped prescription drugs that were supposed to be opioids and pharmacies discovered the opioid pills were removed and replaced with other products.
"This is simply unacceptable," Gottlieb said.
In September and October 2016, three Rite Aid pharmacies in Michigan reported receiving bottles oxycodone hydrochloride that were instead filled with naproxen and in one case, a combination of naproxen and ciprofloxacin hydrochloride, the FDA said.
Though McKesson investigated the incidents, the FDA said the company did not demonstrate that it identified all illegitimate products and notified its other customers who might have received products from the same batch.
In December 2016, Albertsons pharmacy submitted illegitimate product notifications for divalproex and losartan potassium and hydrochlorothiazide it received from McKesson because the packages allegedly did not contain lot numbers or expiration dates, the agency said.
The FDA also said in June 2016, drugmaker GlaxoSmithKline notified McKesson that a pharmacy reported receiving two sealed bottles of a product labeled as Triumeq that actually contained gemfibrozil. In this case, McKesson was unable to provide records showing it identified illegitimate product or other requirements, the FDA said.
Warning letters serve as the first step in any regulatory action the FDA may take against a company. The FDA floated taking possible legal action, including seeking an injunction.
McKesson has 15 days from the time it receives the letter to outline the steps it has taken to correct the violations flagged by the FDA and to identify and conduct investigations related to other reports of suspicious or illegitimate shipments.
Correction: This story was revised to correct that it's the first time the FDA has issued a warning letter under the 2013 Drug Supply Chain Security Act.
WATCH: U.S. life expectancy drops as opioid deaths and suicide rates rise