On October 2, FDA closed its investigation into the largest Cyclospora outbreak in American history: 12,883 confirmed illnesses, 570 hospitalizations and two deaths in 21 states, linked to shredded iceberg lettuce from Taylor Farms de Mexico. Inspectors found the parasite in a wastewater tank at the processing plant and in a drainage ditch at a grower. As of September 15, CDC had counted 19,883 laboratory-confirmed cyclosporiasis cases in the United States this year. That is not a bad season. That is a public health failure.

The same day, FDA posted its post-outbreak response plan: ten things it says it will do before the 2027 growing and harvesting season. I read it twice. Most of it is good. Some of it is overdue. And a great deal of what would prevent the next outbreak is not there. Here is FDA’s list, followed by mine.

What FDA says it will do

Paraphrasing FDA’s ten commitments, with a word or two from me on each:

1. Publish an Outbreak Investigation Report on how Cyclospora got onto imported shredded iceberg lettuce, with recommendations. Good. But there is no date. It needs to be out well before the 2027 season, and it needs to include the water data.
2. Increase surveillance of commodities historically associated with Cyclospora. Good, if it means sampling and publishing results, not just more meetings.
3. Do more outreach at home and abroad on the Produce Safety Rule, the Preventive Controls Rule and the Food Traceability Rule. Outreach on a traceability rule that Congress has barred FDA from enforcing until 2028 is a curious use of time. More on that below.
4. Build laboratory capacity in Mexico so samples can be analyzed in-country, faster. Yes.
5. Use weather and environmental data to spot conditions that spread Cyclospora. Sensible, and cheap.
6. Expand training with Mexico’s agriculture ministry, COFEPRIS and SENASICA. Training is fine. Verification is better.
7. Convene expert panels on worker health and hygiene, water and wastewater monitoring, and gaps in growing and processing practices. This goes straight at the problem. These panels should meet in public and include consumer and public health voices, not only industry.
8. Align Cyclospora genotyping with CDC into a single standard for government, partner nations and industry. This is the most important item on the list for tracing outbreaks, and it needs real money behind it.
9. Expand Foreign Supplier Verification Program inspections so importers consider Cyclospora in their hazard analysis. Good. Publish what the inspections find.
10. Update the Cyclospora Prevention, Response and Research Action Plan with lessons learned. Fine, but an action plan is only as good as what it requires.

FDA also sent a letter to industry asking for collaboration. I am glad it did. But notice what all ten items have in common: they are surveillance, studies, training and panels. None of them requires anyone who grows, packs or imports produce to do anything differently next summer.

What FDA left out

Some of what follows FDA can do on its own. Some needs Congress. Some the produce industry could do tomorrow if it chose to. I have written about most of it before, here and in Reap What You Sow. It belongs in one place.

1. Unwind the traceability delay. FDA’s Food Traceability Rule was supposed to take effect January 20, 2026. FDA pushed compliance to July 20, 2028, and Congress then wrote the delay into the November 2025 appropriations act. The Safe Food Coalition asked Congress in August to rescind it. Congress should, and FDA should say publicly that it wants the authority back before the 2027 season. In the meantime, everyone who grows, packs or buys leafy greens and the other foods on the Food Traceability List should comply now. This summer, millions of heads of California lettuce that had nothing to do with the outbreak were plowed underbecause nobody could say quickly enough where the bad lettuce went. The innocent paid for the guilty.

2. Treat Cyclospora as the water problem it is. Both of FDA’s positive samples from Mexico were water. Yet in 2024 FDA replaced numeric water testing with “systems-based” assessments, and today no law requiresa farm to test its irrigation water or its produce for Cyclospora. The washes the industry relies on are validated against generic E. coli, not a parasite that chlorine does not kill. What is needed:

1. Enforceable, numeric microbial standards and routine testing for pre-harvest water used on high-risk produce eaten raw.
2. Cyclospora and other parasites added to testing of growing and processing water at operations producing Food Traceability List commodities, starting in regions with an outbreak history.
3. Processor wastewater controls that keep outgoing water away from fields, canals and product. FDA found the parasite in a Taylor Farms de Mexico wastewater tank. In 2013, after an earlier Cyclosporaoutbreak, Taylor Farms said it was testing water at that operation and FDA let it reopen on that promise. I have never found a public result.
4. Research funding for a validated kill step or water treatment that works against parasites.
5. Enforceable setbacks and watershed monitoring for animal feeding operations near produce fields and irrigation sources.
6. The same standards for imports, enforced through FSVP, with results made public.

3. Count the sick again. On July 1, 2025, CDC dropped Cyclospora from FoodNet surveillance. When the biggest outbreak in history arrived, nobody was counting in the system built to count. Restore it, along with the other dropped pathogens, and fund the state and local labs that find outbreaks.

4. Rebuild the trip wire. The USDA’s Microbiological Data Program sampled produce in commerce for pathogens for about $5 million a year and triggered dozens of recalls before it was zeroed out in 2012. Rebuild it. It is the cheapest insurance policy the produce industry will ever be offered.

5. Finish the job on the other outbreaks. FDA’s list is about the lettuce outbreak. But this season FDA also opened four other Cyclospora investigations that sickened at least 313 people, and every one of them still lists the source as “not yet identified.” The Outbreak Investigation Report should explain why, and what it would have taken to solve them.

6. Agree on data sharing before the next outbreak. A standing protocol, worked out now, for industry to hand shipping, sourcing and test data to CDC and FDA within hours, so nobody is arguing with epidemiologists in the middle of an outbreak.

7. Verify sanitation at the farms that feed us. Cyclospora comes from human feces. Toilets, handwashing, worker health and water at farms supplying U.S. buyers should be checked by auditors who are not paid to pass. Training, which is what FDA proposes, is not verification.

8. Publish root cause analyses, all of them. FDA has promised one report. Taylor Farms should publish its own water results, from this year and from 2013. After every traced outbreak, the whole supply chain should get to learn what went wrong and what changed.

9. Stop rolling back FSMA. Every “burden” removed in the name of deregulation this decade was a tool someone needed this summer.

Three petitions

I have also drafted three citizen petitions to FDA that grow out of what went wrong this summer and, in the outbreaks, before it. I have not filed them yet, because I want the produce industry’s input, and ideally its signatures, first.

Name the firms. FDA named Taylor Farms de Mexico this time. Too often it does not, and an outbreak with no named firm becomes an outbreak blamed on an entire commodity. The first petition asks FDA to stop treating the identity of a firm implicated in an outbreak as confidential.

Publish the consignee lists. The recalled lettuce went to restaurants, institutions and stores across dozens of states, and consumers had almost no way of knowing whether the salad they ate came from one of them. USDA has published retail consignee lists for meat and poultry recalls since 2008. The second petition asks FDA to do the same in Class I recalls.

Let FDA sample where the evidence points. The third petition asks FDA to use its communicable disease authority under section 361 of the Public Health Service Act to require entry and sampling at an animal feeding operation once the agency has determined it is implicated in a multistate outbreak. That petition is aimed at E. coli and the leafy greens outbreaks of the past decade, not Cyclospora, which comes from people, not cattle. But the principle is the same one running through this whole post: FDA cannot fix what it is not allowed to look at.

Anyone who wants the drafts can have them. My email is bmarler@marlerclark.com.

Before the 2027 season

FDA has given itself until the 2027 growing season. That is about seven months. Its ten points will make the next investigation faster and smarter. They will not, by themselves, keep the parasite off the lettuce. That takes water standards, traceability that is enforced, verification on the farm, and a surveillance system that counts the sick. I would be happy to sit down with FDA and the industry and work on any of it. The cheapest outbreak is the one that never happens.