Federal Register: March 18, 2005 (Volume 70, Number 52)
Rules and Regulations
Page 13293-13325
[[Page 13293]]
-----------------------------------------------------------------------
Part III
Department of Health and Human Services
-----------------------------------------------------------------------
42 CFR Parts 72 and 73
-----------------------------------------------------------------------
Office of Inspector General
42 CFR Part 1003
Possession, Use, and Transfer of Select Agents and Toxins; Final Rule
[[Page 13294]]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
42 CFR Parts 72 and 73
Office of Inspector General
42 CFR Part 1003
RIN 0920-AA09
Possession, Use, and Transfer of Select Agents and Toxins
AGENCY: Centers for Disease Control and Prevention, Office of Inspector
General, Department of Health Human Services (HHS).
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: This document establishes a final rule regarding possession,
use, and transfer of select agents and toxins. The final rule
implements provisions of the Public Health Security and Bioterrorism
Preparedness and Response Act of 2002 and is designed to protect public
health and safety.
In a companion document published in this issue of the Federal
Register, the United States Department of Agriculture has established
corresponding final rules designed to protect animal and plant health
and animal and plant products.
DATES: The final rule is effective April 18, 2005.
FOR FURTHER INFORMATION CONTACT: Mark Hemphill, Chief of Policy, Select
Agent Program, Centers For Disease Control and Prevention, 1600 Clifton
Rd., MS E-79, Atlanta, GA 30333. Telephone: (404) 498-2255.
SUPPLEMENTARY INFORMATION: This document establishes a final rule
regarding possession, use, and transfer of select agents and toxins.
The final rule is based on the interim final rule, as amended (amended
interim final rule). The initial interim final rule was published in
the Federal Register on December 13, 2002 (67 FR 76886). It was amended
by a second interim final rule published in the Federal Register on
November 3, 2003 (68 FR 62245). The initial interim final rule
established a comprehensive set of regulations that included
requirements concerning registration and security risk assessments. The
second interim final rule amended the first interim final rule by
allowing for the issuance of provisional certificates of registration
and provisional grants of access to select agents and toxins, subject
to completion of security risk assessments, and compliance with all of
the requirements of the initial interim final rule. The final rule,
which is set forth at 42 FR part 73, implements provisions of the
Public Health Security and Bioterrorism Preparedness and Response Act
of 2002 (the Act) and is designed to protect public health and safety.
In general, this final rule contains provisions that apply to
academic institutions and biomedical centers; commercial manufacturing
facilities; federal, state, and local laboratories, including clinical
and diagnostic laboratories; and research facilities.
For the initial interim final rule, we provided for a 60-day
comment period for written comments that ended February 11, 2003. We
also held a public meeting on December 16, 2002. Relevant issues raised
by the comments (oral comments made at the public meeting and 110
written comments) are discussed below. For the second interim final
rule, we provided for a 60-day comment period for written comments that
ended January 2, 2004. We received no comments in response to the
second interim final rule. Based on the rationale set forth in the
initial interim final rule, the second interim final rule, and this
document, we are affirming the provisions of the amended interim final
rule as a final rule with changes discussed below.
The final rule is designed to implement authorities under the Act
to protect public health and safety. The United States Department of
Agriculture (USDA) has established corresponding sets of regulations
designed to protect animal and plant health and animal and plant
products (9 CFR part 121 and 7 CFR part 331).
42 CFR Part 1003
The initial interim final rule amended 42 CFR part 1003 to
establish delegations of authority and other provisions involving the
Office of Inspector General (OIG) of HHS. In addition to adding a new
paragraph (b)(16) to Sec. 1003.102 to authorize the imposition of
civil money penalties for violations of the regulatory provisions, the
interim final rule also sought public comments on the possible
inclusion of specific factors that might be used to assess specific
penalty amounts. The amended interim final rule had no effect on the
OIG amendments and we received no comments regarding these amendments.
However, since amendatory language to the OIG regulations addressing
determinations regarding the amount of a penalty was not originally
included in the initial interim final rule, we are now revising Sec.
1003.106(a)(1) to reference the newly codified Sec. 1003.102(b)(16)
and the factors to be taken into account when the OIG assesses civil
money penalties. We are affirming all other amendments set forth in the
interim final rule.
42 CFR 72.6 and Its Accompanying Appendix A
The provisions of the final rule supersede all of the provisions at
42 CFR 72.6 (captioned ``Additional requirements for facilities
transferring or receiving select agents'') and its accompanying
Appendix A. However, the provisions of 18 U.S.C. 175b include
prohibitions that are based on the list of select agents in Appendix A
of 42 CFR part 72 and exemptions to such list in Sec. 72.6(h).
Accordingly, we have deleted the superseded provisions and in their
place have added language to indicate that for purposes of 18 U.S.C.
175b the list of select agents are set forth in Sec. Sec. 73.3 and
73.4 and the exemptions are set forth in Sec. Sec. 73.5 and 73.6.
Changes in Structure in Part 73
With respect to the sections in part 73, we changed the final rule
to make the structure and format of the HHS regulations and the USDA
regulations at 9 CFR part 121 more similar. The following chart shows
the changes.
------------------------------------------------------------------------
Amended interim final rule Final rule
------------------------------------------------------------------------
73.1 Definitions....................... 73.1 Definitions.
73.2 Purpose and scope................. 73.2 Purpose and scope.
73.3 General prohibition............... 73.3 HHS select agents and
toxins.
73.4 HHS select agents and toxins...... 73.4 Overlap select agents and
toxins.
73.5 Overlap select agents and toxins.. 73.5 Exemptions for HHS select
agents and toxins.
73.6 Exemptions from requirements under 73.6 Exemptions for overlap
this part. select agents and toxins.
73.71 Registration..................... 73.7 Registration and related
security risk assessments.
73.8 Security Risk Assessments......... 73.8 Denial, revocation, or
suspension of registration.
73.9 Responsible Official.............. 73.9 Responsible Official.
[[Page 13295]]
73.10 Safety........................... 73.10 Restricting access to
select agents and toxins;
security risk assessments.
73.11 Security......................... 73.11 Security.
73.12 Emergency response............... 73.12 Biosafety.
73.13 Training......................... 73.13 Restricted experiments.
73.14 Transfers........................ 73.14 Incident response.
73.15 Records.......................... 73.15 Training.
73.16 Inspections...................... 73.16 Transfers.
73.17 Notification for theft, loss, or 73.17 Records.
release.
73.18 Administrative review............ 73.18 Inspections.
73.19 Civil money penalties............ 73.19 Notification of theft,
loss, or release.
73.20 Criminal penalties............... 73.20 Administrative review.
73.21 Submissions and forms............ 73.21 Civil money penalties.
------------------------------------------------------------------------
Section 73.0 Applicability and Related Requirements
Under the provisions of Sec. 73.0 of the initial interim final
rule, a number of the provisions became applicable on February 7, 2003,
while other provisions became applicable at subsequent scheduled times
on or before November 12, 2003. A number of commenters requested that
different applicability dates be established, but no commenters
requested that applicability dates be later than November 12, 2003. As
noted above, the interim final rule was amended allowing, subject to
completion of security risk assessments and compliance with all other
requirements set forth in the initial interim final rule, for the
issuance of provisional certificates of registration and provisional
grants of access to select agents and toxins. These security risk
assessments have been completed.
Accordingly, we are removing all of the provisions of Sec. 73.0.
They have served their purpose by implementing the statutorily mandated
principles of protecting public health and safety while minimizing
disruption or termination of research or educational projects.
``Access'' and ``Area''
Commenters argued that the terms ``area'' and ``access'' are
unclear. In response, we have eliminated references to area and used it
in the regulations only when we believe it is clear in context. Also,
consistent with many suggestions by commenters, we have provided
language in Sec. 73.10(b) to clarify that ``An individual will be
deemed to have access at any point in time if the individual has
possession of a select agent or toxin (e.g., ability to carry, use, or
manipulate) or the ability to gain possession of a select agent or
toxin.'' In addition, we clarified the language that an individual with
``access approval from the HHS Secretary or Administrator'' is an
individual who has been granted access to select agents or toxins from
the HHS Secretary or Administrator following a security risk
assessment.
Section 73.1 Definitions
We added definitions of ``Administrator'', ``Animal and Plant
Health Inspection Service (APHIS)'', ``Attorney General'',
``Responsible Official'' and ``State'', made corrections to the
definitions of ``HHS Secretary'', ``Proficiency testing'', and ``United
States'', and deleted the definition of ``USDA Secretary.'' Also, we
changed the definitions of ``diagnosis'' and ``verification'' to more
fully reflect their common meanings in the regulated community.
Moreover, we added a definition of ``specimen'' to reflect its common
meaning in the regulated community. All terms not defined in this
section shall have the meaning that is commonly understood in the
scientific community based on the context in which those terms appear
in this part.
Entity
One commenter stated the definition of ``entity'' does not include
``person'' or ``individual.'' To prevent legal confusion and arguments,
the commenter recommended that in ``Sec. 73.1--Definitions the term
`entity' be redefined to include a `person' and/or an `individual' and
that the same defined term(s) be used in all section''. We made no
changes in the definition section based on this comment. However, for
clarification purposes, we have added ``individual or entity'' language
throughout the document.
Another commenter claimed that the term ``entity'' is subject to
interpretation. The commenter stated that it does not make sense for a
large multi-campus university to base cumulative limits on toxins or
the designation of the Responsible Official on the entity when the
actual labs are separated by hundreds of miles. We made no changes in
the definition section based on this comment. The issue is addressed
below in the registration section.
Responsible Official
Commenters recommended that CDC add the APHIS definition for
Responsible Official, which reads, ``The individual designated by an
entity to act on its behalf. This individual must have the authority
and control to ensure compliance with the regulations in this Part.''
We agreed with the commenters that CDC and APHIS adopt a common
definition for the term ``Responsible Official.'' Accordingly, we are
adding the definition for ``Responsible Official''.
Section 73.2 Purpose and Scope and Sec. 73.3 General Prohibition
We received no comments concerning Sec. Sec. 73.2 and 73.3. Since
the language in Sec. 73.3 is consistently addressed throughout the
document, we deleted this section.
Section 73.3 HHS Select Agents and Toxins and Sec. 73.4 Overlap Select
Agents and Toxins
Some of the select agents and toxins regulated by HHS under part 73
are also regulated by USDA under 9 CFR part 121. The select agents and
toxins subject to regulation by both agencies are identified as
``overlap select agents and toxins'' and those regulated solely by HHS
are identified as ``HHS select agents and toxins.''
General
Commenters recommended that the final rule include an appendix that
would provide a summary of the risk assessment data that supports the
listing of each select agent and toxin. Commenters argued that ``These
data will heighten the awareness of individuals who possess and use a
listed agent to the most important risk characteristics of the listed
agents' and ``This knowledge will promote safe practices and
proficiency in the handling of a listed agent.''
[[Page 13296]]
Commenters also argued that this will help affected entities make
assessments for the future. CDC did not include risk assessment data in
the regulations but did provide such information in the rule's
preamble. We do not believe it is necessary to provide a summary of the
risk assessment data that supports the listing of each select agent or
toxin in order to heighten awareness of the risk characteristics of
such agents and toxins and promote safe practice and proficiency in
handling of such agents and toxins. Information about the risk
characteristics of a select agent or toxin and safe handling practices
is available in scientific literature and other publications (e.g., the
CDC/NIH publication, ``Biosafety in Microbiological and Biomedical
Laboratories''). As noted in the preamble of the August 2002 interim
rule, the Act requires the HHS Secretary to consider the following
criteria in determining whether to list an agent or toxin: (1) The
effect on human health of exposure to the agent or toxin; (2) the
degree of contagiousness of the agent or toxin and the methods by which
the agent or toxin is transferred to humans; (3) the availability and
effectiveness of pharmacotherapies and immunizations to treat and
prevent any illness resulting from infection by the agent or toxin; and
(4) any other criteria, including the needs of children and other
vulnerable populations, that the Secretary considers appropriate. The
Secretary directed the CDC to convene an inter-agency working group to
determine which biological agents and toxins required regulation based
on the criteria noted above. In June 2002, CDC convened an interagency
working group to review the current list of select agents and toxins
and develop recommendations for a select agent list. Members of the
working group included representatives from the Department of Health
and Human Services/Office of the Secretary (DHHS/OS), the Centers for
Disease Control and Prevention (CDC), the National Institutes of Health
(NIH), the Food and Drug Administration (FDA), the Department of the
Army (DoD/Army), the Department of the Navy (DoD/Navy), the Department
of the Air Force (DoD/AF), the U.S. Department of Agriculture (USDA),
the Environmental Protection Agency (EPA), the Agency for Toxic
Substances and Disease Registry (ATSDR), the Department of Labor/
Occupational Safety and Health Administration (OSHA), the National
Institute of Occupational Safety and Health (CDC/NIOSH), the Department
of Transportation (DoT), the Department of Commerce (DoC), the
Department of Energy (DoE), the Department of Justice (DoJ), the
Federal Bureau of Investigation (FBI), the Central Intelligence Agency
(CIA), the Defense Intelligence Agency (DoD/DIA), and the U.S. Postal
Service (USPS). For these reasons, we are making no change based on
this comment.
Prion Agents
One commenter asserted that the Creutzfeldt-Jacob Disease and Kuru
agents should be added to the list of HHS select agents and toxins. The
commenter noted that the ``Arguments for omission include the
difficulty of obtaining these agents, the extreme difficulty of
replicating them, low infectivity by the oral route, and the absence of
person-to-person infectivity.'' The commenter then argued that they
should be included based on the conclusions ``that a single real or
claimed incident of contaminating a childhood vaccine with a prion
would cause indescribable anguish'' and that ``The difficulty of
confirming or refuting a claim that prions had been added to a vaccine
would cripple most legitimate public health programs and result in
epidemics of preventable diseases.'' The commenter concluded by stating
that ``In my judgment, the remote but extreme risk fully justifies the
cost of including prions that are infectious to humans.'' We made no
changes based on this comment. Based upon the criteria that the HHS
Secretary must consider, it was the consensus of the Secretary's Select
Agent and Toxin Working Group that Creutzfeldt-Jacob Disease (CJD) and
Kuru agents should not be added to the list because the degree of
contagiousness of prions are too low to pose a significant mass
casualty threat. While they are infectious under some circumstances,
such as cannibalism in New Guinea causing Kuru or Creutzfeldt-Jacob
Disease by the consumption of infected bovine central nervous system
tissue, there is no evidence of contact or aerosol transmission of
prions from one human to another.
Viruses
The amended interim final rule included Cercopithecine herpesvirus
1 (Herpes B virus) on the list of viruses designated as HHS select
agents and toxins. Commenters acknowledged that the virus naturally
infects many species of macaques and can produce a serious, often
fatal, infection in humans when not treated. Commenters argued that
Herpes B virus should not be included as a select agent based on the
following assertions:
``The inclusion of the virus on the list will produce no
significant improvements in safety for the American public.
Human infections are extremely rare--this is evidenced by
the finding that of the literally hundreds of thousands of people who
have worked with macaques over the past seventy years, there have been
at most 50 human cases establishing infections with 23 documented
deaths (one commenter argued that the low number of human cases may
reflect infrequent shedding in macaque hosts or difficulty in the
transmission of the agent to humans).
The virus is capable of being treated with several
available antiviral compounds.
The inclusion of the virus on the list will significantly
complicate transport for biomedical and biodefense research of macaques
that are healthy, but chronically infected with B virus.
The virus does not present a sufficient risk of infection
by the aerosol route.
The virus is a highly unlikely candidate for a
bioterrorism agent.''
Commenters further stated that if the intent of inclusion is to
monitor laboratories that cultivate large volumes of the virus in vitro
then the rule should only cover this aspect.
We made no changes based on these comments. We have concluded that
Cercopithecine herpesvirus 1 (Herpes B virus) has high morbidity, can
be replicated in large concentrations, and can cause infections via the
aerosol route. The regulations exclude ``any select agent or toxin that
is in its naturally occurring environment provided that it has not been
intentionally introduced, cultivated, collected, or otherwise extracted
from its natural source.'' This would include species of macaques that
have been naturally infected with Cercopithecine herpesvirus 1 (Herpes
B virus) as long as the virus has not been intentionally introduced,
cultivated, collected, or otherwise extracted from its natural source.
The amended interim final rule included Eastern Equine Encephalitis
virus on the list of viruses designated as overlap select agents and
toxins. One commenter asserted that the South/Central American subtypes
of the virus should be deleted from the list. This was based on the
finding that ``The Naval Medical Research Center Detachment (Lima,
Peru) has studied over 6,600 cases of febrile illness in Iquitos [sic]
and surrounding areas since 1994, but has never detected a single case
of human EEE despite repeated isolations of the virus (two of the three
[[Page 13297]]
South American subtypes) from mosquitoes in the same locations (Douglas
Watts, UTMB, unpublished).'' The commenters concluded that ``therefore,
the South/Central American subtypes are probably completely avirulent
for people and not a bioterrorism risk.'' We made no changes based on
this comment. There are no published data supporting the commenters'
assertion. Further, a literature search indicated that there are
examples of South American EEE strains that are lethal in humans and
studies of animal models have produced conflicting results.
Fungi
The list of select agents includes Coccidioides posadasii and
Coccidioides immitis. One commenter questioned whether either of these
should be included on the list of select agents and toxins. We made no
changes based on this comment. These agents cause high morbidity in
humans, are highly infectious via the aerosol route, and sporulate
easily in culture. Also, there is no vaccine available.
Toxins
One commenter recommended that Mistletoe lectin I, Modeccin, and
Volkensin be reviewed for inclusion in the list of select agents and
toxins. The commenter argued that ``These toxins are toxicologically
similar (LD50 and medical affect) to Ricin and Abrin [both are included
as select toxins] and are readily available since they freely grow
without cultivation.'' We made no changes based on this comment. Like
ricin, these toxins have only moderate toxicity compared to other
toxins on the list. However, unlike ricin, these toxins are not readily
available in partially purified forms in sufficient quantities to pose
a significant public health threat.
The amended interim final rule included Diacetoxyscirpenol and T-2
toxin on the list of select agents and toxins. One commenter asserted
that it is pointless to include them on the list because they can
easily be produced using readily available materials. The amended
interim final rule also included conotoxins, saxitoxin, and
tetrodotoxin on the list of select agents and toxins. One commenter
asserted that the list of select agents should not include ``chemically
fragile, small molecule/peptide neurotoxins (tetrodotoxin, saxitoxin,
end u-conotoxin [sic]), that exhibit limited stability at room
temperature.'' The commenter argued that ``conotoxins and agatoxins
are, for example, very rapidly degraded in water because they are
triple-disulfide bonded polypeptides that require reducing agents (beta
mercaptoethanol or dithicthreitol [sic] on the bench, glutethione [sic]
in the organism) to retain their proper folded, disulfide-bonded
structure.'' The commenter further argued that ``The disulfide bonds
are very readily oxidized and the oxidized toxin molecules have no
toxic activity whatsoever'' and that ``Indeed, one of our headaches
with these toxins is that shipments are sometimes useless because the
toxin has become oxidized.'' We made no changes based on these
comments. These toxins pose a significant public health threat because
they have acute toxicity, could be produced in large quantities, and
can be transferred by an aerosol method. We agreed with the commenter
that once those toxins have been degraded, oxidized, or in any other
form in which the toxic has become nonfunctional, they would be
excluded from regulation under this part.
The amended interim final rule included Staphylococcal enterotoxins
on the list of select agents and toxins. One commenter asserted that it
should be removed from the list based on the conclusion that even
though ``Staph. food intoxication can make you wish you were dead for
24 to 48 hours'' the ``general public death rate is only 0.03% and for
the very young and very old it is 4.4%.'' We made no changes based on
this comment. These toxins pose a significant public health threat
because they have acute toxicity, could be produced in large
quantities, and can be transferred by an aerosol method.
The amended interim final rule included Botulinum neurotoxins on
the list of select agents and toxins. However, under the amended
interim final rule, botulinum neurotoxins are not regulated if the
aggregate amount under the control of a principal investigator does
not, at any time, exceed 0.5 mg. One commenter asserted that there
should be no exemption for botulinum neurotoxins. The commenter argued
that ``based on primate studies, the human lethal amount of botulinum
toxin by intravenous exposure is 0.10 microgram, by aerosol exposure
(inhalation) is 0.75 microgram, and by oral exposure (ingestion) is
75.0 micrograms'' and concluded that ``the proposed 500 microgram
amount of unregistered and unregulated botulinum toxin represents,
respectively, 5000 intravenous lethal doses, 667 inhalational lethal
doses, and 6.7 oral lethal doses.'' The commenter further asserted that
Botulism Research Coordinating Committee and National Institute of
Allergy and Infectious Disease's Blue Ribbon Technical Advisory Panel
on Botulinum Toxin concluded without dissent that an exclusion should
not be in effect. The commenter also argued ``increased funding for
biodefense work may attract newcomers to the field, who lack previous
experience in working with botulinum toxin and therefore are at greater
risk of laboratory accident'' and that it might be possible for a
``front laboratory or institution to order just under 500 micrograms of
botulinum toxin from each of the several commercial vendors
simultaneously and accumulate a cache of toxin that a terrorist might
access.'' We made no changes based on this comment. This final rule
represents a legislative mandate to balance the regulatory oversight of
agents and toxins that have the potential to pose a severe threat to
public health and safety while maintaining availability of these agents
and toxins for research and educational activities. The amount of each
toxin that could be possessed without regulation by a principal
investigator, a treating physician or veterinarian, or a commercial
manufacture or distributor was determined on the basis of toxin potency
and how much one could safely possess without constituting a potential
threat to public safety or raising concerns about use as a weapon that
would have a widespread effect. The level specified in the rule was
determined after consultation with subject matter experts on this
toxin. The determination that a toxin posed a severe public health
threat was based on the ability for the mass distribution of the toxin
for mass casualty purposes.
To address the commenter's concerns, the lethal amounts cited
represent theoretical amounts extrapolated from primate studies based
upon optimal conditions. The value of ``5,000 intravenous lethal
doses'' requires a mode of delivery that is impractical for inflicting
mass casualties. The value of ``667 aerosol lethal doses'' assumes 100%
dissemination efficiency for a protein aerosol which is highly unlikely
and does not take into consideration that botulinum neurotoxin is not
very stable under ambient conditions. The public comment estimates that
there are less than 7 oral human lethal doses in 0.5 mg of botulinum
neurotoxin. However, the excluded amount of botulinum neurotoxin would
have to be optimally disseminated to cause the estimated number of
fatalities.
As noted above, with certain exceptions, the amended interim final
rule included Botulinum neurotoxins on the list of select agents and
toxins. One commenter questioned whether there are Botulinum toxins
that are not
[[Page 13298]]
neurotoxins and asserted that if the answer is yes the name should be
changed to ``Botulinum toxins'' and if the answer is no the name should
be changed to ``Botulinum neurotoxins only.'' We made no changes based
on this comment. We are regulating the neurotoxins and the organism
that produces the neurotoxin.
The amended interim final rule states that the list of HHS select
toxins subject to regulation ``does not include the following toxins
(in the purified form or in combinations of pure and impure forms) if
the aggregate amount under the control of a principal investigator does
not, at any time, exceed the amount specified: 100 mg of abrin; 100 mg
of conotoxins; 1,000 mg of diacetoxyscirpenol; 100 mg of ricin; 100 mg
of saxitoxin; 100 mg of shiga-like ribosome inactivating proteins; or
100 mg of tetrodotoxin.'' The amended interim final rule states that
the list of overlap select toxins subject to regulation ``does not
include the following toxins (in the purified form or in combinations
of pure and impure forms) if the aggregate amount under the control of
a principal investigator does not, at any time, exceed the amount
specified: 0.5 mg of botulinum neurotoxins; 5 mg of Staphylococcal
enterotoxins; 100 mg of Clostridium perfringens epsilon toxin; 100 mg
of shigatoxin; or 1,000 mg of T-2 toxin.''
One commenter asserted that the regulations should not provide
exemptions for any toxins based on an aggregate amount. We made no
changes based on this comment. The quantity amounts exempted have been
determined by subject matter experts and would not pose a significant
public health threat.
Also, as noted above, for toxins to be excluded they must be
``under the control of a principal investigator.'' The term ``principal
investigator'' is defined as ``the one individual who is designated by
the entity to direct a project or program and who is responsible to the
entity for the scientific and technical direction of that project or
program.'' We are retaining these provisions but are broadening the
list of those eligible to exercise such control to include not only
principal investigators, but also treating physicians and
veterinarians, and commercial manufacturers or distributors.
Although the language of the exclusion provisions in the amended
interim final rule focused on principal investigators, we did not
intend to cause the possession or transport of otherwise excluded
toxins to be covered by the amended interim final rule if the entity
has a legitimate use for the toxin such as would be the case for
treating physicians and veterinarians (including those providing off-
label use) or commercial manufacturers or distributors. In any event,
we believe that the specified toxins at levels below the threshold
levels do not meet the Act's criteria for inclusion as select agents or
toxins (having the potential to pose a severe threat to public health
and safety) regardless of whether they are under the control of a
principal investigator, a treating physician or veterinarian, or a
commercial manufacturer or distributor. To attempt to regulate these de
minimus quantities would impose an unreasonable regulatory burden on
the public. Accordingly, we changed the regulations to provide that the
exclusions would apply if under the control of a principal
investigator, a treating physician or veterinarian, or a commercial
manufacturer or distributor.
Genetic Elements, Recombinant Nucleic Acids, and Recombinant Organisms
The provisions of the amended interim final rule concerning genetic
elements, recombinant nucleic acids, and recombinant organisms include
as select agents and toxins:
(1) Select agent viral nucleic acids (synthetic or naturally
derived, contiguous or fragmented, in host chromosomes or in expression
vectors) that can encode infectious and/or replication competent forms
of any of the select agent viruses.
(2) Nucleic acids (synthetic or naturally derived) that encode for
the functional form(s) of any of the toxins listed in paragraph (d) of
this section if the nucleic acids:
(i) Are in a vector or host chromosome;
(ii) Can be expressed in vivo or in vitro; or
(iii) Are in a vector or host chromosome and can be expressed in
vivo or in vitro.
(3) Viruses, bacteria, fungi, and toxins listed in paragraphs (a)
through (d) of this section that have been genetically modified.
Commenters recommended that for purposes of clarity paragraph (1)
should state: ``Nucleic acids that can encode infectious and/or
replication competent forms of any of the select agent viruses.'' One
commenter recommended that the following should be added at the end of
paragraph (1) in both Sec. Sec. 73.3 (e) and 73.4 (e): ``or a nucleic
acid (synthetic or naturally derived) comprising at least 15% of the
genome of a select agent.'' We agreed that clarification was needed and
changed the language in paragraph (1) accordingly. The regulation now
states that only nucleic acids (regardless of size) or replication
competent forms of any select agent viruses that are subject to these
regulations are those nucleic acids that can produce infectious select
agent viruses.
One commenter asserted that subparagraphs (i), (ii), and (iii)
should be deleted from paragraph (2) based on the argument that nucleic
acids in paragraph (2) covers all forms that encode for the functional
forms. In response, we changed paragraph (2) to cover: ``Recombinant
nucleic acids that encode for the functional form(s) of any HHS or
overlap toxins listed in paragraph (b) of this section if the nucleic
acids:
(i) Can be expressed in vivo or in vitro; or
(ii) Are in a vector or recombinant host genome and can be
expressed in vivo or in vitro.''
We believe this covers all of the functional forms.
Commenters asserted that ``the government should require that
service providers test for Select Agent sequences'' before they are
made and transferred. The commenters argued that ``Although the Select
Agent program covers transfer and possession of Select Agents, if DNA
synthesis companies do not check the sequences they could inadvertently
synthesize and transfer a Select Agent.'' We made no changes based on
these comments. It is incumbent upon the entities that manufacture
substances to know what they are manufacturing and to ensure that they
comply with the provisions of the regulations in part 73 and 9 CFR part
121.
One commenter asserted that a database listing regulated genetic
sequences should be created for the regulated community. We made no
changes based on this comment. We believe that a database listing all
the genetic sequences that can produce infectious forms of any of the
select agent viruses or that can encode for the functional forms of any
of the toxins listed is not practicable. However, the National Center
for Biotechnology Information maintains a publicly available database
(http://www.ncbi.nlm.nih.gov/) of nucleic acid sequence information
that the regulated community could use as a resource in determining if
the genetic sequence to be created is subject to this regulation.
Exclusions
The amended interim final rule states that the list of select
agents and toxins does not include any select agent or toxin that is
``in its naturally occurring
[[Page 13299]]
environment provided it has not been intentionally introduced,
cultivated, collected, or otherwise extracted from its natural
source.'' One commenter requested clarification regarding what was
meant by ``natural environment.'' The commenter asked ``For example,
are milk samples that contain Coxiella burnetii, or macque [sic] tissue
with Herpes B virus a natural environment?'' and ``Is an entity
required to report the ``identification'' of a select agent from these
samples, or is the entity exempted based on natural environment?''
Consistent with this comment, commenters asserted that naturally
occurring wild-type shiga toxin-producing E. coli strains should not be
included in the list of select agents and toxins. We made no changes
based on these comments. Wild-type shiga toxin-producing E. coli
strains are not subject to this part. However, Shigatoxin and Shiga-
like ribosome inactivating proteins produced by this agent are subject
to this part. Select agents in their naturally occurring environment
could include animals that are naturally infected with a select agent
or toxin (e.g., macaques that are naturally infected with
Cercopithecine herpesvirus 1 or milk samples that contain Coxiella
burnetti). However, a select agent or toxin that has been intentionally
introduced, cultivated, collected, or otherwise extracted from its
natural source, including tissues from animals or agents or toxins
obtained from milk samples that have been naturally infected with a
select agent or toxin, is subject to this part and in such a case the
entity is required to report the select agent or toxin upon
identification.
One commenter asserted that the regulations should exclude fixed
tissues that are, bear, or contain select agents or toxins. We made no
changes based on this comment. The amended interim final rule excluded
non-viable select agents and nonfunctional toxins. This includes such
fixed tissues provided the agents that may be present are rendered non-
viable.
Under the amended interim final rule, non-viable select agents or
nonfunctional toxins are excluded from regulation. One commenter
requested that we add definitions of ``non-viable'' and
``nonfunctional'' based on the assertion that ``Some organisms can
survive in nature, others only with laboratory conditions, while others
will not grow under any conditions.'' We made no changes based on this
comment. Regardless of the environment in which an organism can or
cannot survive, the standard established by the regulations is whether
the organism is viable, or whether the toxin is functional, based on
the plain meaning of the words. Further, the regulations are clear in
that they exclude ``any select agent or toxin that is in its naturally
occurring environment provided that it has not been intentionally
introduced, cultivated, collected, or otherwise extracted from its
natural source.'' The regulations also exclude ``non-viable select
agents or nonfunctional toxins.''
The amended interim final rule excluded from the regulation certain
toxins (in the purified form or in combinations of pure and impure
forms) if the aggregate amount under the control of a principal
investigator does not, at any time, exceed specified amounts. One
commenter asserted that the term ``aggregate amount'' is unclear and
questioned whether it means ``weight of pure plus weight of impure'' or
``weight of pure plus weight of pure in impure''? The commenter
recommended that it be defined to mean the latter. For clarification
purposes, we have deleted the language ``in the purified form or in
combinations of pure and impure forms'' so that it is clear that the
regulations are dealing with the total amount of the toxins regardless
of the form.
The amended interim final rule provided that the HHS Secretary may
exclude attenuated strains of select agents or toxins upon a
determination that they do not pose a severe threat to public health
and safety. The amended interim final rule also provided that in
response to an application submitted to the HHS Secretary, the HHS
Secretary will provide a written decision granting the request, in
whole or in part, or denying the request. It further stated that an
exclusion will be effective upon notification to the applicant and that
exclusions would be published in the notice section of the Federal
Register and listed on the CDC Web site at http://www.cdc.gov/. In
addition, it stated that the list would be included in the rule.
After consultations with subject matter experts, review of relevant
published studies, and review of information provided by the
applicants, a number of attenuated strains have been excluded from the
list of select agents and toxins based on the criteria that these
agents do not pose a severe threat to public health and safety. One
commenter asserted that ``Given the cost of compliance with these
regulations, the appropriate list of select agents, including a list of
exempted [sic] strains, should be in place at the time the regulations
are implemented.'' In response, we note that a number of excluded
attenuated strains are identified on the CDC Web site. We also listed
them in the amended interim final rule. To minimize the potential
delays related to rulemaking, in this final rule we are providing that
excluded attenuated strains of select agents or toxins will be
periodically published in the Federal Register notice and maintained on
the Internet at http://www.cdc.gov. We believe these measures will
provide sufficient notice to the public. Therefore, we are making no
change based on this comment.
Commenters asserted that specific criteria for evaluating
exclusions for attenuated strains of select agents and toxins should be
added to the regulations and further asserted that the broad
microbiological community, not just government agency representatives,
must be involved in this process. We made no changes based on these
comments. The Act sets the criteria for excluding attenuated strains,
i.e., they may be excluded if they do not pose a severe threat to
public health and safety, (42 U.S.C. 262a(a)). We will consult with
appropriate Federal departments and agencies and with scientific
experts representing appropriate professional groups depending on the
attenuated strain being considered.
A number of commenters asserted that the government should ensure
that prompt determinations are made in response to applications for
exclusions. One commenter suggested that a timeline for responses be
established. We made no changes based on these comments. We will do our
best to make prompt determinations, but the highest priority is to
protect public health and safety.
For clarification, we added the language that if an excluded
attenuated strain is subjected to any manipulation that restores or
enhances its virulence, the resulting select agent or toxin will be
subject to the requirements of this part.
In addition, in this final rule, we are adding a new paragraph (f)
to 42 CFR 73.3 and 73.4 to address concerns raised by Federal law
enforcement agencies related to seizures (i.e., possession) of known
select agents or toxins. Paragraph (f) provides that any known select
agent or toxin seized by a Federal law enforcement agency will be
excluded from the requirements of the regulations during the period
between seizure of the agent or toxin and the transfer or destruction
of such agent or toxin provided that (1) as soon as practicable, the
Federal law enforcement agency transfers the seized agent or toxin to
an entity eligible to receive such agent or toxin or destroys
[[Page 13300]]
the agent or toxin by a recognized sterilization or inactivation
process; (2) the Federal law enforcement agency safeguards and secures
the seized agent or toxin against theft, loss, or release and reports
any theft, loss, or release of such agent or toxin; and (3) the Federal
law enforcement agency reports the seizure of the select agent or toxin
by submitting the APHIS/CDC Form 4.
This provision will allow Federal law enforcement agencies to
conduct certain law enforcement activities (e.g., collecting evidence
from a laboratory crime scene) without being in violation of the
regulations. We note, however, that this provision does not authorize
the seizure of a select agent or toxin by a Federal law enforcement
agency; rather, it establishes the conditions under which a Federal law
enforcement agency may seize a known select agent or toxin without
violating the regulations. Any seizure of a known select agent or toxin
by a Federal law enforcement agency must be conducted in accordance
with all applicable laws and regulations.
To address concerns raised by Federal law enforcement agencies
related to seizures (i.e., possession) of select agents or toxins, in
this final rule we are adding a new paragraph (f) to Sec. Sec. 73.6(a)
and 73.7(a) to address situations in which the select agents or toxins
have been identified prior to seizure. In the event that a Federal law
enforcement agency seizes a suspected select agent or toxin or unknown
material, this material will be regarded as a specimen presented for
diagnosis or verification and, therefore, will not be subject to the
regulations until it has been identified as a select agent or toxin.
Sections 73.5 and 73.6 Exemptions for HHS and Overlap Select Agents and
Toxins and Diagnosis, Verification, or Proficiency Testing
The amended interim final rule provided that an individual or
entity is exempt from the provisions of part 73, other than transfer
provisions, if the entity only conducted activities with select agents
or toxins that were contained in specimens presented for diagnosis,
verification, or proficiency testing. We clarified the language to
state ``Clinical or diagnostic laboratories and other entities that
possess, use, or transfer a select agent or toxin that is contained in
a specimen presented for diagnosis or verification will be exempt from
the requirements of this part for such agent or toxin contained in the
specimen''. This clarification was made in recognition that in certain
cases regulated individuals and entities may also be conducting non-
regulated activities.
The exemption provisions apply only if, among other things, the
individual or entity within specified time periods (seven calendar days
after identification of select agents and toxins used for diagnosis or
verification; within 90 calendar days after receipt of select agents or
toxins used for proficiency testing) submits a completed form regarding
the disposition of the select agents or toxins. We have added language
stating that less stringent reporting may be required based on
extraordinary circumstances, such as a widespread outbreak. This will
help prevent large numbers of reports in those instances when such
reports would not be useful for taking action to protect the public's
health and safety. In addition, CDC and APHIS have combined their
immediate notification list for overlap select agents and toxins
(Bacillus anthracis, Botulinum neurotoxins, Francisella tularensis,
Brucella melitensis, Hendra virus, Nipah virus, Rift Valley fever
virus, and Venezuelan equine encephalitis virus). Therefore, entities
will be able to immediately notify either agency.
One commenter asserted that the exemption provisions should not
exist based on the argument that select agents and toxins may be
obtained from the environment and those conducting diagnosis,
verification, or proficiency testing are capable of isolating and
growing them. The commenter further asserted that at the very least all
clinical and diagnostic laboratory employees should be subject to the
security risk assessments. We made no changes based on this comment.
Such changes would be contrary to the exemption provisions mandated by
the Act (42 U.S.C. 262a).
Commenters argued that the exemption provisions should contain
safeguarding requirements that would apply to select agents and toxins
from the time they are identified until they are transferred or
destroyed. One commenter argued that the safeguarding requirements
should be the same as those that would apply if they were not subject
to the exemption provisions. In response, we agree that the entity must
take measures to safeguard the select agents or toxins. Accordingly, we
have included a provision in the regulations to require the entity to
secure the specimens or isolates containing a select agent or toxin
during the period from identification until transfer or destruction. In
addition, we added the provisions that the individual or entity must
also meet the requirements of Sec. 73.19 (Notification of theft, loss,
or release). We believe that any theft, loss, or release of a select
agent or toxin must be reported to protect public health and safety.
Commenters opposed the exemption provisions concerning diagnosis or
testing that require an entity to transfer or destroy select agents or
toxins. The commenters opposed the destruction option by asserting that
by encouraging diagnostic laboratories such as state health facilities
to destroy all isolates, the ability to deal with future outbreaks and
terrorist events would be undermined. More specifically, they argued:
``Destruction will result in the loss of valuable
scientific material since much of our knowledge of the ecology and
epidemiology of emerging and select agents, and our future ability to
identify the source of a terrorist introduction, depend on having
collections of reference agents available for genetic and phenotypic
analyses.
If an agent is introduced by a terrorist group in a failed
attempt to cause an outbreak, and the samples are all destroyed,
retrospective analyses of activities preceding a significant
bioterrorist event will be hampered by the loss of information.''
One commenter also asserted that the final rule should require CDC
to consult with the state public health laboratory director or other
appropriate contact such as the state health officer before destroying
a select agent or toxin based on the conclusion that ``There may be
circumstances in which a state public health laboratory director would
want such specimens or isolates preserved to support epidemiologic
investigations in the state * * * such as isolated cases of Yersinia
pestis infection in the Southwest, but for which state-based infection
control activities must proceed.'' One commenter suggested that a team
from the Department of Justice could ``arrive and monitor the
situation, and safeguard the isolate.''
The regulations require that a diagnostic or testing entity
transfer or destroy a select agent or toxin if, and only if, such an
entity does not want to be registered pursuant to the Select Agent
regulations. If any entity has a legitimate need to keep possession of
a select agent or toxin it may do so once it has become registered. We
have added a provision to allow a diagnostic or testing entity to
retain possession of a select agent or toxin in situations where it has
been determined that such action is necessary to protect public health
and safety.
Commenters argued that the seven day requirement for transferring
or destroying select agents or toxins used for diagnosis or testing is
too short a
[[Page 13301]]
time limit. We made no changes based on these comments. Based on input
from technical experts and risks posed by select agents and toxins, we
believe seven calendar days provides a sufficient amount of time for
the entity to destroy or transfer the select agents or toxins after
identification. However, as noted above, we have included language for
special allowance of these provisions when necessary to protect public
health and safety.
One commenter asserted that the final rule should not require an
entity to submit to CDC a record of destruction of select agents or
toxins or as an alternative should require ``entities to maintain a
record of destruction, which would be subject to inspection by CDC and/
or APHIS.'' The commenter argued that ``This action would reduce the
associated paperwork burden and maintain consistency with the intent of
the regulations.'' The commenter further stated that ``Unlike transfers
from other regulated entities, a transfer record does not precede
isolation through diagnostic procedures.'' We made no changes based on
this comment. The Act requires a report of the identification of select
agents or toxins (42 U.S.C. 262a(g)(1)(a)). We need to be advised of
the disposition to ensure compliance with the requirements of the
regulations and to ensure the protection of public health and safety.
Exempted Products
The amended interim final rule provides for exemption from the
regulations under certain circumstances for products that are, bear, or
contain listed select agents or toxins that are cleared, approved,
licensed, or registered under any of the specified laws, insofar as
their use is only for the approved purpose and meets the requirements
of such laws. Commenters asserted that the requirement that the use be
limited to approved purposes be deleted because of the allowance of
off-label use. In response, we agree and have deleted the ``approved
purpose'' language. We see no reason to distinguish between products
that are used for off-label, but in a manner that doesn't violate the
law, and products that are used in accordance with the approved
labeling.
One commenter recommended that the regulations list the exempted
products. We made no changes based on this comment. The regulations
provide the criteria for determining which products are exempt and it
would be impracticable for the maintenance of such a list.
The amended interim final rule provided that the HHS Secretary on a
case-by-case basis may exempt from the requirements of the part 73
regulations an investigational product that is, bears, or contains a
select agent or toxin, when such product is being used in an
investigation authorized under any of four specified Federal acts and
additional regulation is not necessary to protect public health and
safety. The final rule allows such an exemption under any Federal act
since the statutory authority allows exemptions for investigational
products under any Federal act.
Section 73.7 Registration and Related Security Risk Assessments, Sec.
73.8 Denial, Revocation, or Suspension of Registration, and Sec. 73.10
Restricting Access to Select Agents and Toxins; Security Risk
Assessments
[These Subjects Are in Sec. Sec. 73.7 and 73.8 in the Amended Interim
Final Rule]
General
We have revised the provisions regarding registration and security
risk assessments and, as noted above, have placed these provisions in
three sections: Sec. 73.7 (Registration and related security risk
assessments), Sec. 73.8 (Denial, revocation, or suspension of
registration), and Sec. 73.10 (Restricting access to select agents and
toxins; security risk assessments). To conduct certain activities
regulated under part 73, the revised provisions, consistent with the
provisions of the amended interim final rule, require that the
individual or entity obtain a certificate of registration and that the
following must have an approval from the HHS Secretary or Administrator
following a security risk assessment by the Attorney General: the
individual or entity, any individual who owns or controls the entity,
the Responsible Official of the entity, and any individual who is to
access select agents or toxins under the entity's certificate of
registration.
One commenter, a private, non-profit organization that provides
medical research personnel to work at government entities for the
purpose of performing work covered by the regulations, requested that
the regulations be changed to state that such a private non-profit
organization would not be subject to any requirements imposed by the
regulations. We made no changes based on this comment. The entity
conducting regulated activities must obtain a certificate of
registration and otherwise comply with the Part 73 regulation. Also,
any individuals having access to select agents or toxins on behalf of
an entity must meet the requirements for such activities, regardless of
the type of entity.
One commenter asserted that the regulations should specifically
``prohibit HHS, USDA or other federal agencies from using the
information collected through the registration process to evaluate the
merit of proposals involving research on select agents or toxins.'' We
made no changes based on this comment. The regulations contain
provisions to implement the intent of the Act which is to provide
protection against the effects of misuse of select agents and toxins
whether inadvertent or the result of terrorist acts against the United
States homeland or other criminal acts. The part 73 regulations contain
no provisions for evaluating the merits of research proposals and are
not intended to cover such activities.
One commenter asserted that the approval process for security risk
assessments should include requirements for credit checks and random
drug screening. We made no changes based on this comment. With respect
to security risk assessments, the Act provides that the Attorney
General shall use criminal, immigration, national security, and other
electronic databases available to the Federal Government, as
appropriate for the purpose of identifying restricted persons and for
identifying those reasonably suspected of committing certain crimes,
being involved with an organization that engages in domestic or
international terrorism, or being an agent of a foreign power. The Act
does not provide for credit checks or random drug screening.
Commenters asserted that the regulations should explicitly provide
that the clearance process is confidential. We made no changes based on
these comments. Information obtained as a result of the security risk
assessment process will be protected in accordance with the provisions
of the Privacy Act.
Individual Who Owns or Controls the Entity
Commenters asserted that provisions requiring a security risk
assessment approval for an individual who ``owns or controls the
entity'' should not apply to educational institutions. One commenter
asserted that ``under most state laws governing the organization of
nonprofit entities such as a university, there are no owners of the
entity, i.e., no stockholders or partners, because the entity is
organized for the good of the public, not for the good of the
`stockholders' or `investors.' '' They expressed concern regarding
possible delays if these provisions were broadly interpreted to include
members of the board of trustees or other similar officials. One
commenter asserted that
[[Page 13302]]
``the interpretation of ``control'' should be limited to those
individuals who will have actual access to the select agents.'' One
commenter recommended that we define ``ownership or control'' to mean
the right to exercise control of an entity ``regardless whether such
right results from a substantial economic interest or contractual or
other right to manage an entity.''
In response, we have added the following language:
(2) Federal, State, or local governmental agencies, including
public institutions of higher education, are exempt from the security
risk assessments for the entity and the individual who owns or controls
such entity.
(3) An individual will be deemed to own or control an entity under
the following conditions: \1\
---------------------------------------------------------------------------
\1\ These conditions may apply to more than one individual.
---------------------------------------------------------------------------
(i) For a private institution of higher education, an individual
will be deemed to own or control the entity if the individual is in a
managerial or executive capacity with regard to the entity's select
agents or toxins or with regard to the individuals with access to the
select agents or toxins possessed, used, or transferred by the entity.
(ii) For entities other than institutions of higher education, an
individual will be deemed to own or control the entity if the
individual:
(A) Owns 50 percent or more of the entity, or is a holder or owner
of 50 percent or more of its voting stock, or
(B) Is in a managerial or executive capacity with regard to the
entity's select agents or toxins or with regard to the individuals with
access to the select agents or toxins possessed, used, or transferred
by the entity.
(4) An entity will be considered to be an institution of higher
education if it is an institution of higher education as defined in
section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)),
or is an organization described in 501(c)(3) of the Internal Revenue
Code of 1986, as amended (26 U.S.C. 501(c)(3)).''
We believe the language is consistent with the statutory language
in section 351 A(e)(6)(B) from the Act which exempts Federal, State, or
local governmental agencies including public institutions of higher
education from the security risk assessments for the entity and the
individual who owns or controls such entity. However, the Act does not
exempt other individuals or entities even those nonprofit entities from
the security risk assessment provisions. In addition, we believe those
individuals that own or control the entity relevant to the entity's
possession, use, or transfer of select agents or toxins should be
required to undergo a security risk assessment. However, we determined
that not all owners or controllers of an entity were relevant to an
entity's possession, use, or transfer of a select agent and added
language to identify those individuals who were in a ``managerial or
executive capacity with regard to the entity's select agents or
toxins'' such as laboratory directors.
One commenter asserted that the security risk assessment provisions
should apply to entities that own or control entities possessing or
transferring select agents. We made no changes based on this comment.
The Act requires a security risk assessment for an entity (at any
level) that conducts regulated activities and for individuals who own
or control such entity.
Coordination of Activities
Commenters recommended that CDC and APHIS coordinate their
activities regarding select agents and toxins through a single office.
The commenters argued that such coordination through one office would
decrease regulatory burdens, ensure consistency in agency decision
making, and ultimately promote compliance. They also argued that
without a single office, entities conducting activities regulated
solely by USDA and solely by HHS would be required to submit dual
registrations, obtain dual security risk assessments, and prepare other
dual packages, such as safety plans and security plans. One commenter
argued that such duplication is contrary to the statutory requirements.
In order to minimize the burden to the public required to register
to possess, use or transfer select agents and toxins, a single point of
contact has been developed. This single point of contact is responsible
for coordinating all activities and communications with respect to the
entity's registration, including coordination with both the non-lead
agency and with Federal Bureau of Investigations, Criminal Justice
Information Services Division. This single point of contact will retain
responsibility for the application for the life of the registration
certificate (2-3 years). In addition, a single shared web-based system
is under development that will allow the regulated community to conduct
transactions electronically via a single web portal. We envision that
this system will enable the entity to dynamically communicate in a
digitally secured environment using a single web portal. The web portal
will provide a platform for electronic exchange of information. It will
allow entities to access data related to their own registration data
and allow them to create, amend, and submit registration applications;
requests for approvals for transfers, exemptions, or exclusions; and
any other required forms without the need to print, mail, or e-mail
hard copies. Hard copy registration materials and other required forms
will still be accepted. The single web portal will be available in
winter 2005.
Changes
The amended interim final rule stated that the Responsible Official
must promptly notify the HHS Secretary if a change occurs in any
information submitted to the HHS Secretary in the application for the
certificate of registration or amendments. This included modifications
to the list of individuals with approvals for security risk
assessments, changes in area of work, or changes in protocols or
objectives of studies. Commenters recommended deleting the word
``protocol'' based on the argument that prior approval before
implementing the protocol change would hinder research. They also
argued that ``Protocols can change frequently in active research
programs without altering the relevant biosafety and laboratory
information or the objectives of the work.'' In response, we have
deleted the word ``protocol'' and clarified the regulations to state
that an entity may take regulated actions concerning select agents or
toxins, activities, locations, or personnel only to the extent that
such actions are specifically approved under a certificate of
registration, including any amendments.
Timely Decision-Making
Commenters expressed concern regarding the absence of time limits
for determinations of registration and security risk assessments and
recommended that the regulations include a process by which an entity
can begin or continue its research with select agents and toxins until
such time as the relevant government agencies complete their respective
reviews and respond to the entity's applications for security risk
assessments and registrations. Some commenters requested that the
regulations ``be amended to provide that if the person subject to the
background check suffers a delay in excess of 10 work days, that person
should be permitted to work with select agents under the direct
supervision of an approved person (provided that all other requirements
are met).'' Another commenter suggested
[[Page 13303]]
that the regulations should allow an individual access to select agents
and toxins if ``escorted'' during the waiting period. We made no
changes based on these comments. The amended interim final rule did
provide for a phase-in of the security risk assessment requirement to
allow ongoing research to continue pending the completion of a records
check by the FBI. However, as explained above, the phase-in provisions
have been removed because they have served their purpose. Entities and
individuals have had time to come into compliance without compromising
research or educational projects. The Act is clear that individuals
should not be allowed access to select agents and toxins until after
completion of the security risk assessment.
Under the registration provisions, a certificate of registration
concerning overlap agents will only be issued if both the HHS Secretary
and Administrator concur. One commenter suggested that language be
added to discuss ``what the entity is to do to assist or mitigate the
conflict between the two regulatory agencies or, for example, how to
appeal for resolution.'' We made no changes based on this comment. As
discussed above, a single point of contact has been implemented in
order to minimize the burden to the public required to register in
order to possess, use or transfer select agents and toxins. Therefore,
the responsibility for resolving such conflicts rests with CDC and
APHIS and the agencies are prepared to take action to resolve any
conflicts as quickly as possible.
Coverage of Certificate of Registration
The amended interim final rule provided that ``A certificate of
registration will cover activities at only one general physical
location (a building or a complex of buildings at a single mailing
address).''
Commenters recommended that an entity have the option to apply for
a single certificate of registration to cover activities at all
buildings on a campus or site under the control and authority of the
Responsible Official. The commenters indicated that this would include
both contiguous and dispersed sites within a local geographical area.
The commenters argued that separate registrations for each general
physical location (defined as ``a building or a complex of buildings at
a single mailing address'') is overly burdensome in terms of staffing,
training, and naming of Responsible Officials, and record keeping. They
also argued that the amended interim final rule ``authorizes the
Responsible Official to identify one or more alternate Responsible
Officials to provide coverage for and assist the Responsible Official
and that this nullifies the argument that separate registrations are
necessary to ensure against over-extending the Responsible Official.''
In addition, they argued that ``administrative and control functions at
research and academic institutions, including environmental health and
safety and security programs, are efficiently managed by a centralized
department responsible for more than one physical location.''
One commenter asserted that this provision should be changed to
state that a certificate of registration will cover activities of a
single administrative organization under a single Responsible Official
provided that all buildings are contained within a circle of 25 miles
diameter. The commenter noted that ``each building on a university
campus may have a different mailing address even though the campus is
under a single administration.'' The commenter asserted that this would
allow ``a university to include a detached medical school or research
park in its registration, simplifying paperwork for all concerned''
while still allowing ``full government inspection in a single visit''
and provide ``a realistic commuting distance for the Responsible
Official.''
One commenter indicated that a certificate of registration should
allow a Responsible Official to discharge his/her responsibilities at
several adjacent addresses. The commenter asserted that ``Addresses are
generally used to facilitate mail deliveries, not to establish areas of
responsibility.''
In response, we note that our goal is to set forth a standard to
ensure that the Responsible Official will not be overextended and will
be able to perform the activities required for that position. Moreover,
we believe that in some cases a Responsible Official may be able to
meet these criteria even if the area were larger than set forth in the
amended interim final rule. Therefore, we have changed the rule to
allow a certificate of registration to cover activities at one physical
location (room, building, or group of buildings) where the Responsible
Official will be able to perform the responsibilities required for that
position.
However, we made no changes concerning the responsibilities of
Responsible Officials and alternate Responsible Officials. The
regulations were designed to place responsibility for ensuring
compliance with the part 73 regulations in one position. Also, the
regulations provide that an alternate Responsible Official could act
only if the Responsible Official were unavailable. We believe that
placing responsibility in one position will help achieve a higher level
of compliance than would be obtained from a system of shared
responsibility.
Periods of Validity and Reapplication
The amended interim final rule provided, with exceptions, that a
certificate of registration is valid for up to three years. The amended
interim final rule also provided that an approval based on a security
risk assessment is valid for five years. Commenters recommended that
the certificate of registration be valid for up to five years. They
argued that this would make the registration provisions consistent with
the security risk assessment provisions and that this ``would simplify
paperwork logistics for the entity and reduce the cost to the
government for the registration process.'' One commenter asserted that
an approval based on a security risk assessment should be valid for the
same time period as the certificate of registration so that the
approval period would coincide with the timing for resubmittals of the
registration application package. We made no changes based on these
comments. We believe it is reasonable to provide that a certificate of
registration will be valid for a maximum of three years. A three year
registration period takes into consideration the burden on the public
and the risks posed by select agents and toxins. In addition, it is
consistent with APHIS' permit systems and other established programs
for laboratory certification or registration (e.g., Clinical Laboratory
Improvement Amendments (CLIA) and the College of American Pathologists
(CAP)), which are generally valid for two to three years. The validity
period of five years for an individual's security risk assessment was
established based on a Department of Justice determination that five
years was the appropriate period. Even though it appears that the two
different timeframes would increase the burden on the public, as a
practical matter the registration of an entity and the completion of
most individual security risk assessments are not connected, with the
exceptions being only the Responsible Official, Alternate Responsible
Official, and any individual who owns or controls the entity. Although
both seem to have happened at once as the Program became established
and the regulations became effective, in fact the Select Agent Program
has observed a significant ``turn over'' in the individuals from
registered entities. Therefore at the time an entity begins its
submissions for re-registration, it could have individuals
[[Page 13304]]
that have approved security risk assessments from anywhere from almost
three years to one day. Therefore, changing the validity of an
individual security risk assessment to be consistent with the
registration period would cause undue burden on the public.
With respect to reapplications, one commenter asserted that
resubmittal schedules should be ``well defined'' (e.g., resubmit at
least 90 calendar days prior to expiration). Although we cannot provide
a specific timeframe, we recommend the individual or entity reapply at
least eight weeks prior to the expiration date of the existing
certificate of registration.
Moreover, we have added provisions to help prevent an unnecessary
lapse in a certificate of registration when the Responsible Official of
an entity leaves and the entity is left with no individual to serve as
the Responsible Official. In this regard, we added provisions to allow
an entity to continue to possess or use select agents or toxins only if
it appoints as the Responsible Official another individual who has been
approved by the HHS Secretary or Administrator following a security
risk assessment by the Attorney General and who meets the requirements
of this part.
The amended interim final rule stated that an entity must provide
written notice at least five business days before destroying a select
agent or toxin, if the destruction would be for the purpose of
discontinuing activities with a select agent or toxin covered by a
certificate of registration. The amended interim final rule further
stated that ``This will allow the HHS Secretary and/or the USDA
Secretary to observe the destruction or take other action as
appropriate.'' We are deleting this provision. Under the registration
provisions, the Responsible Official must provide prompt notification
in writing, if a change occurs in any information submitted in the
application for the certificate of registration or amendments. If the
entity has not yet received a certificate of registration then the
Responsible Official must provide updated information in writing; if
the entity has received a certificate of registration then the
Responsible Official must promptly provide an amendment to their
certificate of registration. This would include adding or removing a
select agent or toxin. However, there is no need to impose a five-day
notification requirement.
In addition, in this final rule, we are adding the language that a
certificate of registration will be denied, revoked, or suspended if it
is determined that such action is necessary to protect public health
and safety. We are also clarifying the actions an entity must take in
the event that the certificate of registration is suspended or revoked.
Specifically, we are adding a paragraph to require that, upon
notification of revocation or suspension, the individual or entity
must: (1) Immediately stop all use of each select agent or toxin
covered by the revocation or suspension order; (2) immediately
safeguard and secure each select agent or toxin covered by the
revocation or suspension order from theft, loss, or release; and (3)
comply with all disposition instructions issued by the HHS Secretary
for each select agent or toxin covered by the revocation or suspension.
Security Risk Assessments
Commenters recommended that the Final Rule define the information
the entity must submit to the Attorney General for the security risk
assessments. Currently, the individual completes the FBI form (FD-961)
and then mails the FD-961 form and fingerprint cards as one package
directly to the Federal Bureau of Investigation (FBI), Criminal Justice
Information Services Division (CJIS). Since this process could change,
the specific information for submission was not included in the
regulatory text. Specific guidance on the process has been made
available on the Internet at http://www.cdc.gov.
Commenters asserted that the regulations should allow security risk
assessment approvals for individuals to be portable from entity to
entity, from location to location, and from project to project. One
commenter recommended that an individual's clearance remain valid if
the scientist moves to another institution as long as the scientist's
new employer amends its registration document promptly to include the
individual. The commenter also recommended ``that the Department
clarify that an individual's clearance will continue to be valid if his
or her laboratory is relocated among any of the facilities under the
oversight of the entity's Responsible Official'' and added that ``The
change in location should, of course, be reflected in a timely
amendment of the entity's registration.'' We made no changes based on
these comments. However, CDC, APHIS, and the Attorney General have
agreed to and have already implemented a policy that an additional
security risk assessment is not needed in cases where an individual has
a current security risk assessment and will be merely visiting another
entity. If a registered entity wants a visiting individual to have
access to select agents or toxins, the RO of home entity will have to
send to the RO of host entity a letter stating that the individual is
currently identified on the home entity's Select Agent registration and
that the individual has a current SRA approval. The host entity RO can
then submit this letter and an amendment to their registration. Once
the visit is complete, the host entity would then amend their
registration to remove the visiting individual's name. In some
circumstances the host entity may decide to leave the individual on the
registration, if the same individual will be visiting the entity again.
Specific guidance on the process has been made available to the public
on the Select Agent Program web site.
In addition, in this final rule, we have added the requirement that
an individual with access to select agents or toxins must have the
appropriate education, training, and/or experience to handle or use
such agents or toxins. We believe this requirement is necessary to
ensure that the individual has the appropriate education, training,
and/or experience to handle such agents or toxins.
One commenter in a discussion concerning national Department of
Energy (DOE) laboratories requested that language be added ``that would
allow the L or Q clearance granted in DOE laboratories (or equivalent)
to be considered synonymous with the security risk assessment process
for the purposes of this regulation and that individuals with a current
L or Q clearance be considered approved.'' We made no changes based on
this comment. The Act requires the Attorney General to determine
whether an individual is a restricted person; or reasonably suspected
of committing an act of terror, being involved in a terrorist
organization, or being an agent of a foreign power. The Attorney
General may not be able to make such a determination based solely on
the existence of an L or Q clearance.
One commenter asserted that we should take into consideration the
conclusion that ``It is unlikely that an entity can provide information
for a security risk assessment, other than the name of an individual,
since many institutions have privacy policies that preclude their
seeking certain personal information'' and ``Institutions are also
subject to state laws on privacy, which vary widely.'' We made no
changes based on this comment. Entity policy and State laws do not
preempt the Act and the part 73 regulations. Accordingly, an entity
must comply with the part 73 regulations to be eligible to conduct
regulated activities concerning select agents and toxins.
[[Page 13305]]
The amended interim final rule provided that the HHS Secretary will
deny or revoke access to any select agent or toxin to an entity or
individual identified by the Attorney General as a ``restricted
person'' under 18 U.S.C. 175b. Under this statutory provision, a
``restricted person'' is a person who:
Is under indictment for a crime punishable by imprisonment
for a term exceeding one year,
Has been convicted in any court of a crime punishable by
imprisonment for a term exceeding one year,
Is a fugitive from justice,
Is an unlawful user of any controlled substance (as
defined in section 102 of the Controlled Substances Act (21 U.S.C.
802)),
Is an alien illegally or unlawfully in the United States,
Has been adjudicated as a mental defective or has been
committed to any mental institution,
Is an alien (other than an alien lawfully admitted for
permanent residence) who is a national of a country as to which the
Secretary of State has made a determination (that remains in effect)
that such country has repeatedly provided support for acts of
international terrorism, or
Has been discharged from the Armed Services of the United
States under dishonorable conditions.
Commenters expressed concern ``that these broad classifications
will hinder legitimate research'' and are contrary to the requirement
in the Act to ``ensure the appropriate availability of biological
agents and toxins for research, education, and other legitimate
purposes.'' They argued that the term ``restricted person'' would cover
an individual who received a dishonorable discharge from the U.S.
military for homosexuality and could not understand how precluding such
individual from ever working on select agents would protect the
security of the United States. Commenters also argued that ``it is
predictable that some individuals who are currently productive,
respected members of the scientific community and who have performed
work with select agents or toxins meet one or more of the definitions
of a `restricted person.' '' We made no changes based on these
comments. The provisions regarding ``restricted persons'' restate
statutory requirements.
Commenters asserted that the regulations should contain a
description of the process for limited approvals. We made no changes
based on this comment. The Act and the part 73 regulations provide for
the application of a security risk assessment approval. An individual
or entity may obtain review of a decision denying or revoking a
security risk assessment approval. Based on this review the HHS
Secretary may, under certain circumstances, provide for a limited
approval for a specified time based upon the finding that circumstances
warrant such action in the interest of public health and safety or
national security.
The amended interim final rule set forth a mechanism for obtaining
an expedited review of an application for a security risk assessment.
One commenter asserted that the ``DOE clearance process parallels (and
in many cases exceeds) the efforts that will be reviewed by the
Attorney General.'' The commenter argued that ``Hence, DOE and DOE
subcontractor staff (or other federal agency staff) that have federal
clearances should be among those to be considered for expedited
review.'' We made no changes based on this comment. The Act allows for
such an expedited review based on ``good cause'' and we do not believe
that having a security clearance is relevant regarding whether the
``good cause'' standard would be met.
Section 73.9 Responsible Official
[This Subject Is in Sec. 73.9 in the Amended Interim Final Rule]
The APHIS interim final rule included provisions stating that the
Responsible Official is ``The individual designated by an entity to act
on its behalf'' and that ``This individual must have the authority and
control to ensure compliance with the regulations in this part.''
Commenters asserted that the part 73 regulations should include these
provisions. They argued that the APHIS provisions provide the ``clarity
needed in order to provide the expected accountability at sites
registered by the CDC Select Agent program.'' We agreed with commenters
and CDC and APHIS have included identical provisions for the
Responsible Official.
Also, to ensure that all of the requirements of the regulations are
met, we have clarified the language regarding the Responsible
Official's annual inspection. The language previously located in Sec.
73.10 Safety section of the amended interim final rule has been moved
to the Responsible Official (Sec. 73.9) section stating that the
Responsible Official must ensure that annual inspections are conducted
for each laboratory where select agents and toxins are stored or used
in order to determine compliance with requirements in this part.
Further, we have included provisions requiring that deficiencies be
corrected.
Commenters noted that the preamble to the initial interim final
rule ``recommended that that the Responsible Official and alternate
Responsible Officials are either biosafety officers or senior
management officials of the entity, or both.'' Commenters suggested
that we ``emphasize that it is the entity's responsibility to designate
the appropriate individual to be the responsible official (i.e., an
individual who has the authority and control to ensure compliance with
the regulations)'' and that ``To satisfy this requirement, a university
may choose to designate the Dean of Agriculture to be the responsible
official rather than the biosafety officer because the Dean of
Agriculture may have better oversight and authority to ensure
compliance with the regulations.'' Some suggested that duties may even
be separated by having the biosafety officer or an individual who has a
higher-level management position for ensuring overall compliance,
responsible for day-to-day operations. One commenter suggested that the
duties be shared between the Responsible Official and the Principal
Investigator with the Principal Investigator responsible for those
activities that required daily hands-on knowledge of the laboratory. We
made no changes based on these comments. The Responsible Official
should be an individual who can perform all of the duties required for
that position. As we noted above, the regulations were designed to
place responsibility for ensuring compliance with the part 73
regulations in one position because we believe that doing so will help
achieve a higher level of compliance than would be obtained from a
system of shared responsibility.
Commenters recommended revision of language throughout the
regulations to change the emphasis regarding Responsible Officials from
responsibility ``for'' complying with requirements to responsibility
``for ensuring'' compliance with requirements. They argued that the
amended interim final rule implies that only the Responsible Official
or alternate Responsible Official may perform actions intended to be
performed by others detailed under their supervision. In addition, one
commenter recommended that laboratory inspections be performed by a
Biosafety Officer designated by and reporting to the Responsible
Official rather than by the Responsible Official. In response, we have
made changes as necessary to state when the Responsible
[[Page 13306]]
Official must conduct activities and when the Responsible Official is
required to ``ensure'' compliance with requirements in the regulations.
This change will allow the Responsible Official the flexibility to
delegate certain responsibilities.
Since the reporting requirements of Sec. Sec. 73.5 and 73.6
(Exemptions for HHS and overlap select agents and toxins) may pertain
to regulated individuals and entities, we have clarified the language
by adding the reporting requirements to the RO section. This reporting
requirement will help us with monitoring activities related to select
agents and toxins.
Section 73.11 Security
[This Subject Is in Sec. 73.11 in the Amended Interim Final Rule]
Coordination With USDA
Commenters recommended that security plans established for
compliance with the CDC rule should be sufficient to meet the
requirements for a security plan under the APHIS regulations. They
argued that otherwise an entity must prepare two security plans. We
agreed with the commenters and CDC and APHIS made their language in the
security section identical to ensure consistency between the
regulations. In addition, we note that compliance inspections for
security will be based on the regulations and that the inspectors will
be looking for security that provides graded protection commensurate
with the risk of the select agent or toxin, given its intended use.
A commenter asserted that biological laboratory security should be
administered by only one Federal agency (e.g., Department of Homeland
Security) to ensure consistency. We made no changes based on this
comment. Section 201(b) of the Act requires the HHS Secretary to
establish and enforce safeguard and security measures to prevent the
access to select agents and toxins for use in domestic or international
terrorism or for any other criminal purpose. In addition, the Act
provides for the interagency coordination between the HHS Secretary and
Administrator regarding overlap select agents and toxins. CDC and APHIS
have established procedures to ensure consistent regulation of select
agents and toxins.
Performance Based
Some commenters asserted that the security requirements are too
stringent based on the argument that they could hamper research. We
made no changes based on this comment. Although the Act requires us to
do what we can to allow research, the first duty under the Act is to
protect public health and safety. The security requirements are
designed to prevent unauthorized access, theft, loss, or release of
select agents or toxins. The regulations require that an entity's
security plan be designed according to a site-specific risk assessment.
Such a risk assessment would take into consideration the security
needed for a select agent laboratory in an academic setting.
Some commenters asserted that the security provisions should be
prescriptive rather than performance based to prevent ``wide variation
in the evaluation of threats and consequences, and a wide
interpretation of what constitutes adequate security.'' Other
commenters asserted that the security provisions are highly
prescriptive and should be changed to provide only a general
performance standard. These commenters pointed out difficulties in the
amended interim final rule by arguing that requirements, such as a
requirement that freezers containing select agents and toxins be locked
may not always be appropriate (the whole room could be secure).
Because different select agents and toxins pose differing degrees
of risk, we believe it would be counterproductive to attempt to prepare
a detailed list of prescriptive requirements for entities (i.e., a
``one size fits all'' design standard). Therefore, the regulations
contain performance standards for biosafety, security, and incident
response that take into account the risks presented by a particular
select agent or toxin, given its intended use.
With regard to security, newly designated 42 CFR 73.11 requires
each individual or entity required to register under this part to
develop and implement a written security plan. This security plan must
be designed according to a site-specific risk assessment and must
provide graded protection in accordance with the risk of the select
agent or toxin, given its intended use. In addition, newly designated
42 CFR 73.11 requires the individual or entity to adhere to specified
security requirements or implement measures to achieve an equivalent or
greater level of security. We believe these security provisions provide
enough flexibility and specificity to allow an individual or entity to
develop and implement a security plan that will safeguard the select
agent or toxin against unauthorized access, theft, loss, or release.
However, in recognition of the commenters' concerns, we reiterate
that CDC and APHIS are working with interagency groups and security
experts to draft a document that will provide additional guidance about
the security required for select agents and toxins. This document will
be available in spring 2005. The 5th edition of the BMBL, which is
under development, will also provide additional guidance on laboratory
security.
The interim final rule stated that freezers containing select
agents and toxins must be locked or must be in the direct view of
approved staff. Commenters asserted that these provisions may not be
appropriate (the whole room could be secure). We agreed and have
changed the language to require the entity to ``Provide for the control
of select agents and toxins by requiring freezers, refrigerators,
cabinets, and other containers where select agents and toxins are
stored to be secured against unauthorized access (e.g., card access
system, lock boxes).''
One commenter stated the BMBL and NIH guidelines require labs to
post biohazard signs on access doors that list the agents present in
the laboratory, which may compromise laboratory security. We made no
changes based on this comment. In this final rule, 42 CFR 73.12
(Biosafety) provides that an individual or entity should consider the
BMBL and NIH Guidelines when developing a biosafety plan. However, it
is the entity's responsibility to determine if posting biohazardous
signs on access doors would compromise laboratory security.
A commenter pointed out that the terms ``risk assessment,''
``threat assessment,'' and ``vulnerability assessment,'' are confusing
to those with little experience in this area and should be clarified. A
commenter suggested that the phrase ``risks associated with those
vulnerabilities are mitigated'' be replaced with ``consequences
associated with those vulnerabilities are mitigated.'' We agreed with
the commenters and have deleted the text. In addition, we clarified the
language to state that an entity's security plan must be sufficient to
safeguard the select agent or toxin against unauthorized access, theft,
loss, or release; must be designed according to a site-specific risk
assessment; and must provide graded protection in accordance with the
risk of the select agent or toxin, given its intended use.
BMBL
One commenter asserted that the security provisions should mandate
compliance with the BMBL, specifically Appendix F. We made no changes
based on this comment. The security provisions contain guidelines
similar to
[[Page 13307]]
that published in Appendix F of the 4th edition of the BMBL.
Security and Individuals
Commenters asserted that the amended interim final rule incorrectly
indicated that special provisions would be required for all individuals
providing routine cleaning, maintenance, and repairs and objected to
such language based on the conclusion that some might obtain security
risk assessment approvals. In response, we note that these provisions
were intended to apply when the cleaning, maintenance, or repairs were
performed by individuals without security risk assessment approvals. We
have clarified the regulations accordingly.
Commenters asserted that the security provisions of the amended
interim final rule indicate that they ``must develop a security plan
that, among other requirements, establishes a procedure for reporting
and removing unauthorized persons'' and requested clarification as to
the meaning of the phrase ``unauthorized persons'' and the ``areas from
which they must be removed.'' We made no changes based on these
comments. In context, unauthorized persons are those unescorted
individuals who do not have access approval from the HHS Secretary or
Administrator and who are in areas where they could gain access to
select agents or toxins.
Commenters argued that security provisions of the amended interim
final rule would hinder collaboration among scientists. They asserted
that ``A productive research program likely includes many scientists
and technicians working collaboratively but with only a few actually
handling infectious agents'' and that ``Isolating scientists who handle
infectious agents will be detrimental to the program'' because ``The
security requirements must enable unauthorized individuals to work
together within the same physical space with [authorized] scientists.''
We made no changes based on these comments. We would defeat the purpose
of the Act if we were to waive the security provisions. Those with
access to select agents and toxins must meet the requirements of the
regulations, including those requirements concerning security risk
assessments. This would not prohibit escorted activities as long as the
escorted scientists and technicians do not have access to select agents
or toxins. We considered the potential cost of reduced collaboration
among scientists, along with other non-quantifiable costs, as discussed
in the section addressing ``Economic Impact.''
Commenters asserted that the security provisions should be changed
to ``allow people who are not approved * * * to enter the area without
escort provided that (1) All select agents and toxins have been secured
in locked cabinets, rooms or other containers, (2) The containers
cannot be forced open without tools and without visible signs of
damage; (3) Rooms are secure against entry by unauthorized personnel;
(4) Keys, combinations, etc. are controlled as presently required; (5)
Access to the area is limited to employees of the entity.'' Commenters
argued that this approach ``is consistent with requirements [such as
those in 10 CFR 95.25] for handling classified documents under which
people without clearance may enter rooms without escort provided the
documents are secured in cabinets. In addition, commenters argued that
this approach would ``also reduce the burden on the Attorney General's
office, allowing it to perform more extensive checks on a smaller
number of individuals.'' Similarly, commenters asserted that the final
rule should provide that when ``laboratories are used intermittently
for select agent research, free access [should] be permitted when
select agents and toxins are not in use and when the select agents and
toxins are secured in a safe or other secured storage. We made no
changes based on these comments. The security requirements are designed
to prevent unauthorized access, theft, loss, or release of select
agents and toxins. We believe the regulations already are consistent
with commenter's approach.
Commenters recommend the final rule distinguish between laboratory
security and entity security. One commenter argued that ``In large
academic settings it is possible for a fully secure laboratory facility
to coexist with a functioning educational and research laboratory
entity'' and ``Placing full security restrictions on a building
primarily devoted to educational functions compromises an educational
institution's ability to fulfill its primary functions.'' The commenter
further argued that ``This, in turn, may force laboratories working
with select agents to shut their biodefense studies or move
elsewhere.'' We made no changes based on these comments. As discussed
earlier, the security provisions are designed to prevent unauthorized
access, theft, loss, or release of select agents and toxins. In most
cases the security provisions would have little or no effect on the
educational activities. The regulations require that an entity's
security plan be designed according to a site-specific risk assessment.
Such a risk assessment would take into consideration the security
needed for a select agent laboratory in a large academic setting.
However, we would defeat the purpose of the Act if we were to waive the
security provisions to eliminate an impact on educational research
conducted in the same laboratory that contains select agents and
toxins.
Packages
The amended interim final rule required the inspection of all
packages upon entry to and exit from an area containing select agents
or toxins. Commenters asserted that such a requirement is not practical
because of the number of packages of laboratory supplies, autoclaved
waste, etc. that enter and exit a select agent laboratory every day.
Some argued that the inspection provisions should apply only for
packages received after shipment or transfer. Some commenters argued
that only random inspections should be conducted. Some commenters
argued that more detail should be provided. After further review, we
have determined that the security purpose would be met if entities were
required to inspect only suspicious packages. We have changed the rule
to reflect this determination.
Commenters questioned who should be responsible for conducting the
inspections of packages. Some commenters argued that the Responsible
Official should be the one responsible for the inspections. We made no
changes based on these comments. The final rule allows the entity to
determine who should conduct the inspections of packages since the
entity would be best able to determine the most appropriate and
qualified individual for this activity.
Intra-Entity Transfers
The amended interim final rule provided that an entity must
establish a protocol for intra-entity transfers, including provisions
for ensuring that the packaging, and movement from a laboratory to
another laboratory or from a laboratory to a shipping place, is
conducted under the supervision of an individual with a security risk
assessment approval. Based on questions by commenters, we have changed
this language to clarify that the requirements apply only to intra-
entity transfers of select agents and toxins. Commenters also argued
that these provisions are not sufficiently restrictive since they could
``allow an individual to leave a package of select agents temporarily
unattended in an open air
[[Page 13308]]
lock: that is not security.'' They further asserted that ``Intra-entity
movement of select agents, when outside access-controlled laboratory
areas, should follow a documented chain of custody process that
minimizes any possibility of diversion.'' In response, based on the
reasons provided by the commenters, we changed these provisions to
require that the select agents and toxins must be secured against
theft, loss, or release during intra-entity transfer and the entity
must provide for chain of custody documentation. The provisions of
renumbered Sec. 73.17 (Records) already require recordkeeping that
would establish the chain of custody.
Reporting
The amended interim final rule required that suspicious persons or
activities be reported to the Responsible Official. Commenters asserted
that the finding of suspicious persons or activities should be reported
to the local law enforcement agency, followed by notification to the
RO.'' They argued that ``Local law enforcement agencies are staffed 24/
7/365 and they are equipped to deal with potential criminal aspects of
suspicious activities.'' We made no changes based on this comment. We
agree with the commenters that law enforcement agencies should be
notified, but we believe the responsibility for reporting to the
appropriate law enforcement agencies should be maintained by the
Responsible Official.
Records
The amended interim final rule required the security plan to
describe cyber security. Commenters asserted that ``The data related to
the select agents, in many cases, are almost as valuable as the select
agents themselves'' and requested clarification regarding the assets
intended to be covered by the term ``cyber security.'' Commenters also
asserted that the term ``cyber security'' should be replaced with
``information and cyber security.'' In response, we changed the
language to require the security plan to contain procedures for
``information systems control'' and thereby more clearly indicate what
was intended.
Review
The amended interim final rule states that ``The security plan must
be reviewed by the RO at least annually and after any incident.''
Commenters recommended that this paragraph be revised to state ``The
security plan must be reviewed, performance tested, and updated
annually.'' We believe performance testing will help to ensure that the
plan works and have changed the regulations to include these concepts.
Pre-Clearance
A commenter expressed concerns that the regulations do not provide
for preclearance of security plans before an entity invests in a
security system. We made no changes based on the comment. The
provisions in the Final Rule clearly set forth what must be included
regarding the security requirements. However, those entities needing
additional technical assistance may reference the BMBL or contact the
Select Agent Program.
Administrative
Commenters asserted that the final rule should designate who in the
federal government is responsible for making determinations concerning
the adequacy of the security plans. We made no changes based on this
comment. The security plan must be sufficient to safeguard the select
agent or toxin against unauthorized access, theft, loss, or release.
The regulations allow for the delegation of authority of this function
to the Select Agent staff or other appropriate office.
Commenters argued that security plans, and all information related
to the security systems, be protected at the ``Official Use Only''
level. We made no changes based on this comment. The protection of all
information held by the Select Agent Program is an operational
responsibility and not a matter appropriate for inclusion in Part 73.
However, as a matter of both policy and practice, the information is
protected at the ``Sensitive But Unclassified'' level.
Section 73.12 Biosafety
[This Subject Is in Sec. 73.10 in the Amended Interim Final Rule]
The amended interim final rule provided that an entity subject to
the part 73 regulations must develop and implement a safety plan and in
developing a safety plan, an entity should consider:
``(1) The biosafety standards and requirements for BSL 2, 3, or 4
operations, as they pertain to the respective select agents, that are
contained in the CDC/NIH publication, ``Biosafety in Microbiological
and Biomedical Laboratories,'' including all appendices except Appendix
F.
(2) The specific requirements for handling toxins found in 29 CFR
part 1910.1450, ``Occupational Exposure to Hazardous Chemicals in
Laboratories'' and/or 29 CFR part 1910.1200, ``Hazard Communication,''
whichever applies and specific requirements for handling toxins found
in Appendix I in the CDC/NIH publication, ``Biosafety in
Microbiological and Biomedical Laboratories.''
(3) For provisions of the safety plan relating to genetic elements,
recombinant nucleic acids and recombinant organisms, the ``NIH
Guidelines for Research Involving Recombinant DNA Molecules,'' (NIH
Guidelines). This includes, among other things, provisions regarding
risk assessment, physical containment, biological containment, and
local review and applies to all recombinant DNA research, regardless of
funding.
Commenters argued that we should retain the provisions concerning
the safety plan without change. One commenter suggested that compliance
with the documents listed in the preceding paragraph should be made
mandatory for all entities subject to the rule. Other commenters
asserted that we should adopt performance-based standards. The safety
provisions were intended to avoid the creation of a ``one size fits
all'' set of safety standards due to the vast diversity of both
entities and the reasons why they possess, use, and transfer select
agents and toxins. However, we amended the language of the final rule
to establish performance-based safety provisions. Accordingly, under
the final rule, entities must not only develop and implement a safety
plan, but must develop a plan that is commensurate with the risk of the
agent or toxin, given its intended use. Further, the biosafety plan
must contain sufficient information and documentation to describe the
biosafety and containment procedures. These provisions are designed to
help ensure that the safety plan is effective.
Commenters recommended that safety plans established for compliance
with the HHS rule should be sufficient to meet the requirements for a
safety plan under the USDA regulations. They argued that otherwise an
entity must issue two safety plans. Commenters further asserted that
USDA and HHS should develop joint safety requirements for select agents
and toxins to supplant the BMBL and NIH Guidelines. We agreed with the
commenters and HHS and USDA made this section identical to ensure
consistency between the regulations.
Section 73.13 Restricted Experiments
[This Subject Is in Sec. 73.10 in the Amended Interim Final Rule]
The amended interim final rule stated that an entity may not
conduct certain experiments unless approved by the
[[Page 13309]]
HHS Secretary after consultation with experts. Commenters suggested
that the following be considered for providing such consultation: The
National Research Council, the NIH Recombinant DNA Advisory Committee,
and the Select Agent Advisory Committee. One commenter argued that ``It
is critical that this review committee comprise appropriate experts in
microbiology, highly pathogenic microorganisms and laboratory safety to
ensure the best possible science advice.'' We made no changes based on
these comments. We agree that we should obtain advice from experts as
needed for decision making and will consult with subject matter experts
as necessary.
One commenter expressed concern that the amended interim final rule
did not contain a process for expert review and oversight of
``dangerous experiments.'' We made no changes based on this comment.
Under the regulations, we will review applications to determine whether
the experiments can be safely conducted, will require whatever
conditions are necessary for safety, and will consult with subject
matter experts as necessary. Also, under the regulations, we have
authority to conduct inspections as necessary to ensure that the
conditions are met.
One commenter raised issues regarding the deliberate formation of
antibiotic resistance as a common research tool. The commenter asserted
that if strictly imposed, the restricted experiment provisions would
limit this standard research practice and provided an example
concerning antibiotic resistance application. The commenter stated
``Transposon insertion libraries are common experimental creations used
to generate gene knockouts and study the effect on expression and
phenotype'' and ``this often results in an array of genomes containing
antibiotic resistance markers used for selection and screening.'' The
commenter then argued that ``The method is common enough not to need
approval from a cabinet level position and too burdensome if approval
is needed for each of several thousand insertional mutants that would
be created for a single genome.'' We made no changes based on this
comment. It is important that researchers consider the possible
unintended effects from the deliberate formation of antibiotic
resistance. The restricted experiment provisions apply only if the
activities ``could compromise the use of the drug to control disease
agents in humans, veterinary medicine, or agriculture.'' We believe
that the majority of research involving antibiotic resistant markers
that are commonly used for selection and screening will not meet this
criteria and therefore, will not require additional approval. Further,
we believe that activities meeting this threshold should require such
approval as has been the case for those entities subject to the ``NIH
Guidelines for Research Involving Recombinant DNA Molecules''.
The preamble to the initial interim final rule stated that we
reserved a paragraph for possible future specification of additional
types of experiments that might warrant stringent scrutiny in the
interest of safety. One commenter argued that the following experiments
should be added to the reserved paragraph based on the conclusion that
they warrant such stringent scrutiny (i.e., should be allowed only if
approved by the HHS Secretary after consultation with experts):
(1) Experiments involving construction of vaccine-resistant select
agents or toxins.
(2) Experiments involving increasing the environmental stability of
select agents or toxins.
(3) Experiments involving powder or aerosol production of select
agents or toxins (other than preparation of lyophilized reference
specimen < 10 mg).
(4) Experiments involving powder or aerosol dispersal of select
agents or toxins.
We made no changes based on this comment. We are studying whether
these and other types of experiments should be added to Sec. 73.13.
Experiments will be proposed for addition to the listing of restricted
experiments, as warranted, through the publication of a proposed
amendment for public comment.
Commenters argued that the regulations should not list types of
experiments that require approval because of the difficulty of amending
regulations as needs change. Instead, commenters argued that the list
should be included in the NIH Guidelines. We made no changes based on
these comments. Publishing such information in the regulations will
ensure that the public, including affected entities, are provided
adequate notice concerning the list of experiments requiring approval
requirements.
Commenters questioned whether the HHS Secretary should be involved
in approving experiments. One commenter specifically questioned whether
HHS has authority to proscribe experiments. We made no changes based on
these comments. We believe we have such authority. In this regard, the
Act at 42 U.S.C. 262a(c) states that the ``Secretary shall by
regulation provide for the establishment and enforcement of standards
and procedures governing possession and use of listed agents and toxins
* * * in order to protect public health and safety.''
We added provisions for how applicants are to submit a written
request for approval.
Section 73.14 Incident Response
[This Subject Is in Sec. 73.12 in the Amended Interim Final Rule]
The amended interim final rule provided that an entity required to
register must develop and implement an emergency response plan that
meets the requirements of OSHA Hazardous waste operations and emergency
response standard at 29 CFR part 1910.120. With respect to these OSHA
standards, paragraph (a) addresses scope, application, and definitions
and paragraph (q) addresses emergency responses to hazardous substance
releases. The provisions of 40 CFR part 311 make 29 CFR part 1910.120
applicable to State and local government employees. The OSHA
regulations also reference 29 CFR part 1910.38 which concerns the
development and implementation of an emergency action plan.
In the final rule, we have eliminated references to the OSHA
provisions and have set forth the provisions from the OSHA regulations
that would apply for an incident response plan. The OSHA regulations at
29 CFR part 1910.120(q) include provisions for assisting in the
handling of an emergency. Although entities handling select agents and
toxins are subject to the OSHA regulations, our regulations are not
intended to cover clean up operations but rather to ensure that
entities are prepared to take whatever other action is necessary to
respond to an incident. Also, we note that an entity may use all or a
portion of a document prepared under other authorities as long as it
meets the requirements of the incident response provisions of the part
73 regulations.
Commenters recommended that the incident response section of the
final rule reference 29 CFR part 1910.1450 which concerns occupational
exposure to hazardous chemicals in a laboratory. We made no changes
based on this comment. Although entities may need to become familiar
with the provisions of this section, it does not provide the basis for
requirements under the part 73 regulations and we see no reason for
referencing it in this section.
One commenter asserted that the incident response provisions are
``too stringent for select agents and toxins not
[[Page 13310]]
mandated for control within maximum containment facilities.'' The
commenter asserted that ``These provisions are based in part on a GAO
report that promotes threat and risk assessments in the planning of
emergency responses to an actual domestic terrorist incident involving
weapons of mass destruction and on OSHA regulations relating to
hazardous waste sites'' and ``have little relevance to the inadvertent
release or theft of select agents and toxins from biomedical research
laboratories.'' We made no changes based on this comment. The commenter
did not provide any specifics to support the general comment. We
believe the incident response provisions are necessary to help ensure
that entities plan ahead to be ready to take appropriate action to
respond to any hazard that could arise.
Section 73.15 Training
[This Subject Is in Sec. 73.13 in the Amended Interim Final Rule]
The training section in the amended interim final rule provided
that a registered entity that falls outside of the OSHA Bloodborne
Pathogen Standard (29 CFR part 1910.1030(a)) must provide safety and
security information to any individual working in or visiting areas
where select agents and toxins are handled or stored. Also, this
section stated that: ``In lieu of initial training for those
individuals already involved in handling select agents, the Responsible
Official may certify in writing that the individual has the required
knowledge, skills, and abilities to safely carry out the duties and
responsibilities.'' Commenters argued against certification based on
the conclusion that each facility is different and facility specific
training must be required regardless of knowledge, skills, or ability.
Also, commenters argued that Bloodborne Pathogen training would not be
a suitable substitute for training specific to the use of select
agents. To address these issues, commenters recommended the following
wording: ``An entity required to register under this part must provide
information and training on safety and security for working with select
agents and toxins to each individual approved for access and each
individual not approved for access from the HHS Secretary or
Administrator working in or visiting areas where select agents and
toxins are handled or stored. The training may be modified according to
the needs of the individual, the work they will do and their potential
exposure. The training need not duplicate training provided under the
OSHA Bloodborne Pathogen Standard 29 CFR 1910.1030.'' We agree with the
substance of these comments, including the reasons given for them.
Accordingly, we made changes in Sec. 73.15 to clearly reflect the
intent of the regulations.
Section 73.16 Transfers
[This Subject Is in Sec. 73.14 in the Amended Interim Final Rule]
One commenter argued that ``receipt of select agents and toxins by
the Responsible Official is a valuable procedural control to ensure
that all required compliance measures are in place prior to final
delivery of the agent to the Investigator'' and further asserted that
``This procedure parallels the common and effective practice of
requiring receipt of radionuclides by the Radiation Safety Officer
prior to their distribution to the Principal Investigator.'' We made no
changes based on this comment. The Responsible Official must approve
the transfer and ultimately is responsible for compliance matters.
However, we do not believe that it is necessary to require the
Responsible Official to be the recipient. If a problem were to arise,
the person having access and receiving the select agents or toxins
would be the logical person to discover any issues or concerns related
to the receipt of the select agents or toxins and advise the
Responsible Official of such.
The part 73 regulations do not impose requirements on the
transportation in commerce or exportation of select agents or toxins.
However, requirements are imposed by the government on the
transportation in commerce and exportation of select agents and toxins,
including the following:
Agriculture (9 CFR parts 92, 94, 95 96, 121, 122 and 130),
Commerce (15 CFR parts 730 to 799),
Health and Human Services (42 CFR parts 71 and 72),
Occupational Health and Safety Administration (29 CFR part
1910.1030),
Transportation (49 CFR parts 171 through 180), and
Postal Service (39 CFR part 111).
Commenters asserted that Sec. 73.11 should ``address the security
of shipments while in transit between entities'' and that ``The current
DOT requirement for external labeling on select agent packages should
be eliminated.'' One commenter argued that ``transportation security
needs to be addressed and required to be just as rigorous as security
requirements for the labs.'' Another commenter argued that ``The fact
that registered entities must comply with all applicable laws
concerning packaging and labeling significantly increases the risk that
select agents could be easily identified and diverted for illegal
purposes during transportation by common carrier.'' Another commenter
argued that ``The absence of requirements for registration, security
risk assessments, and physical security for the common carriers that
will be handling and transporting select agents between registered
entities is cause for concern.'' Commenters also argued that ``Both the
shipping and receiving entities should document a chain of custody for
transfers of select agents'' and ``These chain of custody documents
should be securely stored with the EA-101 form at both the shipping and
receiving entities.'' Commenters also argued that ``tamper-indicating
procedures should be included in the packaging so that the recipient
would immediately know that the package he/she has received had been
tampered with; this event should trigger an immediate report to HHS.''
We made no changes based on these comments. These issues are outside
the scope of this rulemaking. However, we believe the provisions set
forth in Sec. 73.16, in addition to the other Federal laws regulating
the transportation of hazardous materials in commerce and exportation
of select agents and toxins, sufficiently protect public health and
safety.
One commenter asserted that ``Intra-entity movement of select
agents, when outside access-controlled laboratory areas, should follow
a documented chain of custody process that minimizes any possibility of
diversion.'' We made no changes based on this comment. The provisions
of renumbered Sec. 73.17 (Records) already require recordkeeping that
would establish the chain of custody.
One commenter asserted that the transfer provisions should allow a
non-registered entity to transfer a select agent or toxin to a
registered entity based on the need to prevent destruction of valuable
historical, archival or educational materials containing select agents
or toxins. We agreed. Accordingly, we have added provisions to allow,
on a case-by-case basis, the transfer of a select agent or toxin, not
otherwise eligible for transfer.
One commenter asserted that a unique identifier should be assigned
to each Transfer of Select Agent Form (APHIS/CDC Form 2) based on the
argument that they are necessary to track and audit transfers. We made
no changes based on this comment. We already add a unique authorization
number to each approved transfer form.
[[Page 13311]]
One commenter recommended that the final rule require a response to
a transfer request within an appropriate interval, e.g., 1-2 business
days. We made no changes based on these comments. It is impractical to
specify a time interval for the approval of a transfer request since
the authorization of the request is dependent upon the review of
appropriate records that confirm the individuals and entities currently
meet all the requirements to transfer the select agents or toxins.
The amended interim final rule provided that an entity must
maintain transfer records for three years. Commenters asserted that the
regulations should require that EA-101 forms be kept for five years. We
made no changes based on these comments. Entities may wish to retain
records for longer for three years. In keeping with the three year
registration period, we did not extend the required time to keep
records.
The amended interim final rule did not set a time limit for
transfers. We are adding a provision stating that a transfer
authorization is valid only for 30 calendar days. This is necessary to
efficiently manage the transfer authorization system and ensure timely
resolution of outstanding transfer activities.
The amended interim final rule stated that when the select agents
or toxins are consumed or destroyed after a transfer, an entity must
provide written notice within five business days of such action. We are
deleting this provision. As noted above, under the registration
provisions the Responsible Official must provide prompt notification in
writing if a change occurs in any information submitted in the
application for the certificate of registration or amendments. Since
this would include adding or removing a select agent or toxin, there is
no need for otherwise imposing a five-day notification requirement.
The amended interim final rule required the submission of an
immediate report by the recipient if ``the package received containing
select agents or toxins had been leaking or was otherwise damaged.'' We
clarified these provisions to require the submission of an immediate
report by the recipient if the package had ``been damaged to the extent
that a release of the select agent or toxin may have occurred'' because
leakin
