(CNN) Twelve people in three states developed infections and were hospitalized after they got infusions or injections of stem cell products derived from umbilical cord blood that were contaminated with bacteria, according to a report published Thursday by the US Centers for Disease Control and Prevention.

The patients in Arizona, Florida and Texas received stem cell products processed by Genetech Inc. and distributed by Liveyon LLC, the report says, adding that the products are not FDA-approved or lawfully marketed.

The FDA sent a warning letter to San Diego-based Genetech in November about ReGen5, ReGen10 and ReGen30 for allogeneic use. The agency issued a statement about it Thursday and said it was sending letters to 20 other providers of stem cell treatments, reminding them of the agency's rules about regenerative medicine.

"We see a lot of promise from stem cell treatments, but we also have a lot of concern, and we started by sending these 20 letters singling out these firms that should be engaging with FDA but haven't been," FDA Commissioner Dr. Scott Gottlieb said.

"In addition, we are also stepping up our inspections this year. We are concerned that there are firms whose actions could be putting patients at risk and might be subject to additional action."

The only FDA-approved use for these umbilical cord blood-derived stem cell products is for hematopoietic or immunologic reconstitution, meaning for people with disorders that affect the part of the system involved in producing blood, the hematopoietic system. That can be for blood or bone marrow transplants in patients who have cancer or blood or immune system disorders.

Some practitioners believe that stem cells can "sense the environment into which they are introduced and address whatever functions require replacement or repair," FDA scientists wrote in the New England Journal of Medicine in March 2017, but that "is not based on scientific evidence." These stem cell treatments need to go through the appropriate clinical trials to prove that they work and are safe.

The FDA warned the public about the unapproved use of stem cell treatments in 2017, saying "unscrupulous providers" may promise that stem cells can be "miracle treatments" for just about any disease or medical condition, but not to believe "the hype." At the time, Gottlieb called them "dangerously dubious products."

The patients infected in this outbreak got the stem cell treatments for ailments that include general pain, osteoarthritis, back pain, a rotator cuff tear with a cyst and pain associated with rheumatoid arthritis.

According to Thursday's CDC Morbidity and Mortality Weekly Report, the first infections were reported to the Texas Department of State Health Services on September 17. Three people who got injections or infusions of umbilical cord blood-derived stem cell products at a Texas outpatient clinic on September 12 developed bloodstream infections.

On September 22, the Florida Department of Health was notified that four people had joint infections after getting injections from a Florida orthopedic clinic between February 15 and August 30. When scientists looked at some of the unopened products at that clinic, they found E. coli and E. faecalis bacteria.

The report does not offer details on the patient in Arizona. Dr. Kiran Perkins with the CDC's Outbreak and Response Team, who co-authored Thursday's report, said there is some lab work pending in the Arizona case.

"That clinic didn't have any of the product left," Perkins said. "That is part of the challenge of this investigation: A lot of the clinics don't have any of the product left."

Perkins added that the CDC is concerned about the severity of these infections, as all the patients mentioned in the report were hospitalized. "This particular outbreak has the potential for serious health risks and concerns," she said.

The distributor, Liveyon, issued a national recall of Regen series products in October and suspended shipment of all product pending the outcome of the FDA investigation, according to the agency.

The CDC believes that the bacterial contamination of the stem cell-derived products occurred before distribution. An investigation is taking a closer look at the manufacturing practices and at the safety practices at the clinics to determine whether there was proper infection control.

The FDA said Thursday that an inspection of the Genetech manufacturing facility in June found "significant deviations" that included "deficient donor eligibility practices; unvalidated manufacturing processes; uncontrolled environment; lack of control over the components used in production and a lack of defined areas or a control system to prevent contamination and mix-ups."

The CDC noted that stem cell clinics typically work in an outpatient setting, "which often have less robust oversight of infection control measures," and that's in part why the FDA recommends that patients avoid getting these treatments outside controlled clinical studies that will ensure that the appropriate manufacturing and safety reporting procedures were followed.

Get CNN Health's weekly newsletter Sign up here to get The Results Are In with Dr. Sanjay Gupta every Tuesday from the CNN Health team.

The CDC is still trying to determine whether other patients received the tainted product. Perkins credited the health departments in Texas and Florida with picking up on infections quickly.

The FDA urges health care professionals and consumers to report any adverse events related to treatments with Liveyon products, Genetech products or other stem cell treatments to its MedWatch Adverse Event Reporting program.

Gottlieb noted that the field is growing quickly. There's a lot of innovation and promise, and some companies have come in to work with the FDA, but others have "ignored our request for dialogue," he said, and are "putting patients at risk."

He said Thursday that dozens of firms are not taking the necessary steps to ensure patient safety.