Over the past seven weeks, 58 people in the U.S. and Canada were identified as ill from a dangerous strain of E. coli bacteria (0157:H7).  In the U.S., the infections have occurred in 13 states with five people hospitalized and one dying, according to the Centers for Disease Control and Prevention (CDC). Of the 41 confirmed victims in Canada, 17 have required hospitalization and one has died.  E. coli (0157:H7) produces a toxin that causes acute diarrheal illness and—in a small proportion of cases—can lead to serious illness, kidney failure, and even death.

On Dec. 28, the CDC released a statement saying that state and local public health officials are interviewing sick people to determine what they had eaten and were still collecting information to determine whether there was a food item in common. CDC investigators have confirmed through whole genome sequencing that the E. coli O157:H7 sickening people in Canada has the same DNA fingerprint as the pathogen infecting people in the United States. Officials in both countries say that makes it most likely that a common source food is involved, according to Food Safety News.

At this time, case investigations in both countries suggest an epidemiologic association with eating romaine lettuce, a leafy green that is typically served in fresh salads. Romaine-lettuce-associated illnesses have occurred in California, Connecticut, Illinois, Indiana, Michigan, Nebraska, New Hampshire, New York, Ohio, Pennsylvania, Virginia, Vermont, and Washington state. ​Romaine lettuce can have a shelf life of up to five weeks, so it is possible that some contaminated lettuce might still be in consumers’ refrigerators.

The Public Health Agency of Canada is therefore warning against consuming romaine lettuce, as is the U.S. magazine Consumer Reports. The CDC has declined to caution people against eating romaine lettuce until an infection source is identified. Government agencies in the two countries are being criticized because neither has released information about the suppliers, distributors or retailers that handled the lettuce, which is believed to remain in the supply chain.

That criticism may be unfair, says Dr. Stephanie Ostrowski, a former epidemiologist at CDC and an associate professor of public health as well as being a member of the Auburn University Food Systems Institute’s food defense working group. She said that CDC performs ongoing diarrheal disease surveillance to detect both individual and shared-source cases, as well as to recognize larger and more dispersed outbreaks. E. coli O157:H7 is a commonly-identified pathogenic strain found in nature, and determining a bacterial cause is not the same as being able to attribute blame.

Ostrowski cautioned that romaine lettuce is harvested from thousands of acres in multiple states, where cattle, deer, wild pigs or migratory waterfowl might all be sources of contamination in the field or at harvest. Because E. coli can’t be seen, smelled or tasted, laboratory testing of lettuce samples from each suspect lot is necessary to determine whether it is contaminated.  Original packaging (stamped with harvest dates) is usually disposed of quickly, making it difficult to recognize or identify possible harvest sites associated with cases. Modern molecular “fingerprinting” detection methods are used to recognize and confirm cases caused by the same or very closely related strains, even if they are widely dispersed over time and distances. Before the 21st century identifying such clusters could be very difficult. 

“CDC reports the science and the epidemiology but is not a food safety regulatory agency,” Ostrowski said. “The U.S. Food and Drug Administration (FDA) is the U.S. food safety regulatory agency, and as such has the authority to indicate attribution and take actions, if necessary—where the data leads it.”

FDA has the authority to seize, recall, and destroy foods that are proven to be tainted. Most of these actions are handled through positive working relationships with the food industry combined with the industry’s proactive voluntary compliance actions, rather than through less-timely enforcement actions, Ostrowski said. FDA has the authority to require cleaning and sanitation as well as re-inspection before reopening for business, to enter into compliance agreements with individual entities, and—when necessary—to issue fines or prosecute criminal misconduct.

FDA’s own internal guidance and established policies, however, require that it act only on the basis of evidence, and with care for due process, including notification of business owners and avoidance of unnecessary harm to their brand and corporate reputation.