05-5063. Agricultural Bioterrorism Protection Act of 2002; Possession, Use, and Transfer of Biological Agents and Toxins

AGENCY:

Animal and Plant Health Inspection Service, USDA.

ACTION:

Final rule.

SUMMARY:

We are adopting as a final rule, with changes, an interim rule that established regulations governing the possession, use, and transfer of biological agents and toxins that have been determined to have the potential to pose a severe threat to public health and safety, to animal health, to plant health, or to animal or plant products. This action is necessary to protect animal and plant health, and animal and plant products.

DATES:

Effective Date: The amendments to the list of PPQ select agents and toxins in 7 CFR 331.3(b) are effective March 10, 2005. The remaining provisions of this final rule are effective April 18, 2005.

FOR FURTHER INFORMATION CONTACT:

For information concerning the regulations in 7 CFR part 331, contact Dr. Charles L. Divan, Senior Agricultural Microbiologist, Pest Permit Evaluations, Biological and Technical Services, PPQ, APHIS, 4700 River Road Unit 133, Riverdale, MD 20737-1236, [phone].

For information concerning the regulations in 9 CFR part 121, contact Dr. Lee Ann Thomas, Director, Animals, Organisms and Vectors, and Select Agents, VS, APHIS, 4700 River Road Unit 2, Riverdale, MD 20737-1231, [phone].

SUPPLEMENTARY INFORMATION:

Background

On June 12, 2002, the President signed into law the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Pub. L. 107-188). Title II of Pub. L. 107-188, “Enhancing Controls on Dangerous Biological Agents and Toxins” (sections 201 through 231), provides for the regulation of certain biological agents and toxins by the Department of Health and Human Services (subtitle A, sections 201-204) and the Department of Agriculture (subtitle B, sections 211-213), and provides for interagency coordination between the two departments regarding overlap agents and toxins (subtitle C, section 221). Subtitle D (section 231) provides for criminal penalties regarding certain biological agents and toxins. For the Department of Health and Human Services, the Centers for Disease Control and Prevention (CDC) has been designated as the agency with primary responsibility for implementing the provisions of the Act; the Animal and Plant Health Inspection Service (APHIS) is the agency fulfilling that role for the Department of Agriculture (USDA). The Criminal Justice Information Services (CJIS) Division of the Federal Bureau of Investigation has been designated as the agency with primary responsibility for implementing the Attorney General's responsibilities under the Act (i.e., the security risk assessments).

In subtitle B (which is cited as the “Agricultural Bioterrorism Protection Act of 2002” and referred to below as the Act ), section 212(a) provides, in part, that the Secretary of Agriculture (the Secretary) must establish by regulation a list of each biological agent and each toxin that the Secretary determines has the potential to pose a severe threat to animal or plant health, or to animal or plant products. The Act further requires (under section 213(b)) that all persons in possession of any listed biological agent or toxin must, within 60 days of the publication of that regulation, notify the Secretary of such possession.

In accordance with these statutory requirements, on August 12, 2002, we published in the Federal Register (67 FR 52383-52389, Docket No. 02-082-1) an interim rule that established the initial lists of biological agents and toxins and set out the manner in which persons in possession of listed agents and toxins were to provide notice of such possession.

Section 212 of the Act also required the Secretary to provide by regulation for the establishment and enforcement of standards and procedures governing the possession, use, and transfer of listed biological agents and toxins in order to protect animal and plant health, and animal and plant products. Specifically, sections 212(b) and (c) required that the Secretary:

• Establish and enforce safety procedures for listed agents and toxins, including measures to ensure proper training and appropriate skills to handle agents and toxins, and proper laboratory facilities to contain and dispose of agents and toxins;
• Establish and enforce safeguard and security measures to prevent access to listed agents and toxins for use in domestic or international terrorism or for any other criminal purpose;
• Establish procedures to protect animal and plant health, and animal and plant products, in the event of a transfer or potential transfer of a listed agent or toxin in violation of the safety procedures and safeguard and security measures established by the Secretary; and
• Ensure appropriate availability of biological agents and toxins for research, education, and other legitimate purposes.

In an interim rule published in the Federal Register on December 13, 2002 (67 FR 76908-76938, Docket No. 02-088-1) and effective on February 11, 2003, we established regulations in 7 CFR part 331 and 9 CFR part 121 governing the possession, use, and transfer of biological agents and toxins that have been determined to have the potential to pose a severe threat to both human and animal health, to animal health, to plant health, or to animal or plant products. These CFR parts are referred to below as the regulations. We solicited comments concerning the interim rule for 60 days ending February 11, 2003. We received 36 written comments. They were from academic institutions, professional associations, corporations, nonprofit organizations, individuals, and representatives of State and Federal Governments. These comments, as well as oral comments presented at a public meeting on December 16, 2002, are discussed by topic below.

Also on December 13, 2002, CDC published in the Federal Register (67 FR 76886-76905) an interim rule that established the standards and procedures governing the possession, use, and transfer of certain biological agents and toxins (referred to by CDC as select agents and toxins) (42 CFR part 73).

On November 3, 2003, APHIS and CDC published in the Federal Register (68 FR 62218-62221, Docket No. 02-088-3; and 68 FR 62245-62247) interim rules that amended both agencies' regulations in order to allow for the issuance of provisional registration certificates for individuals and entities and provisional grants of access to listed biological agents and toxins for individuals. These provisional measures provided additional time for the Attorney General to complete security risk assessments for those individuals and entities for which the Attorney General received, by November 12, 2003, all of the information required to conduct a security risk assessment. We solicited comments concerning the interim rules for 60 days ending January 2, 2004. We did not receive any comments by that date.

APHIS and CDC collaborated closely on the December 13, 2002, and November 3, 2003, interim rules, as well as on this final rule and CDC's final rule also issued in today's Federal Register. Below is a summary of the changes we are making to the regulations in this final rule. We refer to the regulations in place prior to the effective date of this final rule as the “interim” regulations, or “interim” 7 CFR 331.4, for example, when we need to distinguish between the regulations established by the interim rules of December 2002 and November 2003 and this final rule.

Summary of Changes Made in Final Rule

1. We are revising the format of the regulations in 7 CFR part 331 and 9 CFR part 121 so that the sections numbers and, to the extent possible, the section titles and the information contained in each section is the same in 7 CFR part 331, 9 CFR part 121, and 42 CFR part 73.

2. We are changing the terms “biological agents and/or toxins,” “listed agents and/or toxins,” and “high consequence livestock pathogens” to “select agents and toxins” or “select agents or toxins” throughout 7 CFR part 331 and 9 CFR part 121. In addition, in 9 CFR part 121, we are removing the term “overlap agents” each time it appears and adding “overlap select agents and/or toxins” in its place.

3. We are changing the title of 7 CFR part 331 and 9 CFR part 121 from “Possession, Use, and Transfer of Biological Agents and Toxins” to “Possession, Use, and Transfer of Select Agents and Toxins.”

4. We are removing Phakopsora pachyrhizi and plum pox potyvirus from the list of PPQ select agents and toxins.

5. We are removing Newcastle disease virus (VVND) from the list of VS select agents and toxins and adding Newcastle disease virus (velogenic) in its place to make it clear that we are regulating all of the velogenic strains.

6. We are removing Clostridium botulinum from the list of overlap select agents and toxins but we are continuing to list Botulinum neurotoxin producing species of Clostridium.

7. We are adopting CDC's approach for genetic elements and, therefore, we will consider the following to be select agents and toxins:

• Nucleic acids that can produce infectious forms of any of the select agent viruses listed in either 7 CFR part 331 or 9 CFR part 121;
• Recombinant nucleic acids that encode for the functional forms of any toxin listed in either 7 CFR part 331 or 9 CFR part 121 if the nucleic acids: (1) Can be expressed in vivo or in vitro; or (2) are in a vector or recombinant host genome and can be expressed in vivo or in vitro; and
• Select agents and toxins listed in either 7 CFR part 331 or 9 CFR part 121 that have been genetically modified.

8. We are broadening the scope of the overlap toxin exclusion to cover overlap toxins under the control of a principal investigator, treating physician or veterinarian, or commercial manufacturer or distributor.

9. We are amending the exemption provisions by requiring, as another condition of exemption, that the select agent or toxin be secured against theft, loss, or release during the period between identification of the agent or toxin and transfer or destruction of such agent or toxin.

10. We are amending the exemption provisions in 9 CFR part 121 by requiring immediate reporting after identification of specified select agents and toxins; identification of the other select agents and toxins must be reported within 7 calendar days after identification.

11. We are amending the exemption provisions to allow the Administrator to make exceptions to the timeframes for transfer or destruction of a select agent or toxin, as necessary.

12. We are amending the registration sections to set out a new framework for submitting registration applications to APHIS or CDC.

13. We are amending the registration sections in 7 CFR part 331 and 9 CFR part 121 to provide:

• Federal, State, or local governmental agencies, including public institutions of higher education, are exempt from the security risk assessment for the entity and the individual who owns or controls such entity.
• For a private institution of higher education, an individual will be deemed to own or control the entity if the individual is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.
• For entities other than institutions of higher education, an individual will be deemed to own or control the entity if the individual: (1) Owns 50 percent or more of the entity, or is a holder or owner of 50 percent or more of its voting stock; or (2) is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.
• An entity will be considered to be an institution of higher education if it is an institution of higher education as defined in section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)), or is an organization described in 501(c)(3) of the Internal Revenue Code of 1986, as amended (26 U.S.C. 501(c)(3)).

14. We are amending the registration sections to provide that a certificate of registration will be valid for one physical location (a room, a building, or a group of buildings) where the responsible official will be able to perform the responsibilities required in this part, for specific select agents or toxins, and for specific activities.

15. We are amending the registration sections to require that, prior to any change, the responsible official must apply for an amendment to a certificate of registration by submitting the relevant page(s) of the registration application.

16. We are amending the registration sections to provide that an entity must immediately notify APHIS or CDC if it loses the services of its responsible official. An entity may continue to possess or use select agents or toxins only if it appoints as the responsible official another individual who has been approved by the Administrator or the HHS Secretary following a security risk assessment by the Attorney General and who meets the requirements of the regulations.

17. We are amending the sections pertaining to denial, revocation, and suspension of registration by requiring that, upon notification of suspension or revocation, an individual or entity must:

• Immediately stop all use of each select agent or toxin covered by the revocation or suspension order;
• Immediately safeguard and secure each select agent or toxin covered by the revocation or suspension order from theft, loss, or release; and
• Comply with all disposition instructions issued by the Administrator for each select agent or toxin covered by the revocation or suspension.

18. We are amending the responsible official sections to require the responsible official to report the identification and final disposition of any select agent or toxin contained in a specimen presented for diagnosis or verification. We are also amending the responsible official section in 9 CFR 121.9 to require the responsible official to report the identification and final disposition of any select agent or toxin contained in a specimen presented for proficiency testing.

19. We are amending the provisions relating to access approvals to state that an individual will be deemed to have access at any point in time if the individual has possession of a select agent or toxin (e.g., carries, uses, or manipulates) or the ability to gain possession of a select agent or toxin.

20. We are amending the provisions pertaining to access approval to provide that an individual's access approval may be revoked if the individual is within any of the categories specified in the regulations.

21. We are amending the security sections to clarify that the security plan must be sufficient to safeguard the select agent or toxin against unauthorized access, theft, loss, or release.

22. We are adding the provisions for restricted experiments to 7 CFR part 331 and we are amending these provisions in 7 CFR part 331 and 9 CFR part 121 to indicate that these experiments must be conducted under any conditions prescribed by the Administrator.

23. We are amending the training sections to require that information and training on biocontainment/biosafety and security be provided to each individual with access approval from the Administrator or the HHS Secretary before he/she has access and to each individual not approved for access by the Administrator or the HHS Secretary before he/she works in or visits areas where select agents or toxins are handled or stored (e.g., laboratories, growth chambers, animal rooms, greenhouses, storage areas, etc.).

24. We are amending the transfer section in 9 CFR 121.16 to set out the requirements for transfer of a select agent or toxin contained in a specimen for proficiency testing.

25. We are amending the transfer sections to provide that, on a case-by-case basis, the Administrator may authorize a transfer of a select agent or toxin not otherwise eligible for transfer under the regulations under conditions prescribed by the Administrator.

26. We are amending the transfer sections to provide that an authorization for a transfer shall be valid only for 30 calendar days after issuance, except that such an authorization becomes immediately null and void if any facts supporting the authorization changes (e.g., change in the certificate of registration for the sender or recipient, change in the application for transfer).

27. We are amending the records sections to require the maintenance of an accurate, current inventory for each toxin held and for each select agent held in long-term storage (placement in a system designed to ensure viability for future use, such as in a freezer or lyophilized materials).

28. We are amending the section pertaining to notification of theft, loss, or release in 7 CFR part 331 to require that APHIS or CDC be notified immediately upon discovery of a release of a select agent or toxin outside of the primary barriers of the biocontainment area and we are amending this section in 9 CFR part 121 to require that APHIS or CDC be notified immediately upon discovery of a release of a select agent or toxin causing occupational exposure or a release outside of the primary barriers of the biocontainment area.

29. We are amending the administrative review sections to allow an individual to appeal revocation of access approval.

Format of the Regulations

APHIS and CDC are revising the format of the regulations in the final rules so that the section numbers and, to the extent possible, the section titles and the information contained in each section is the same in 7 CFR part 331, 9 CFR part 121, and 42 CFR part 73. These changes should make the regulations easier to use and facilitate compliance. The chart below sets out the format of 7 CFR part 331 and 9 CFR part 121 set by the interim rules (interim regulations) and the new format for the regulations in 7 CFR part 331 and 9 CFR part 121 (final rule).

Interim regulations	Final rule
331.0 Effective and applicability dates
121.0 Effective and applicability dates
331.1 Definitions	331.1 Definitions.
121.1 Definitions	121.1 Definitions.
331.2 Purpose and scope	331.2 Purpose and scope.
121.2 Purpose and scope	121.2 Purpose and scope.
331.3 List of biological agents and toxins	331.3 PPQ select agents and toxins.
121.3 List of biological agents and toxins	121.3 VS select agents and toxins.
331.4 Exemptions	331.4 [Reserved].
121.4 Exemptions for overlap agents or toxins	121.4 Overlap select agents and toxins.
331.5 Registration; who must register	331.5 Exemptions.
121.5 Exemptions for animal agents and toxins	121.5 Exemptions for VS select agents and toxins.
331.6 Registration; general provisions	331.6 [Reserved]
121.6 Registration; who must register	121.6 Exemptions for overlap select agents and toxins.
331.7 Denial, revocation, or suspension of registration	331.7 Registration and related security risk assessments.
121.7 Registration; general provisions	121.7 Registration and related security risk assessments.
331.8 Registration; how to register	331.8 Denial, revocation, or suspension of registration.
121.8 Denial, revocation, or suspension of registration	121.8 Denial, revocation, or suspension of registration.
331.9 Responsibilities of the responsible official	331.9 Responsible official.
121.9 Registration; how to register	121.9 Responsible official.
331.10 Restricting access to biological agents and toxins	331.10 Restricting access to select agents and toxins; security risk assessments.
121.10 Responsibilities of the responsible official	121.10 Restricting access to select agents and toxins; security risk assessments.
331.11 Biocontainment and security plan	331.11 Security.
121.11 Restricting access to biological agents and toxins	121.11 Security.
331.12 Training	331.12 Biocontainment.
121.12 Biosafety and security plan	121.12 Biosafety.
331.13 Transfer of biological agents and toxins	331.13 Restricted experiments.
121.13 Training	121.13 Restricted experiments.
331.14 Records	331.14 Incident response.
121.14 Transfer of biological agents and toxins	121.14 Incident response.
331.15 Inspections	331.15 Training.
121.15 Records	121.15 Training.
331.16 Notification in the event of theft, loss, or release of a biological agent or toxin	331.16 Transfers.
121.16 Inspections	121.16 Transfers.
331.17 Administrative review	331.17 Records.
121.17 Notification in the event of theft, loss, or release of a biological agent or toxin	121.17 Records.
121.18 Administrative review	331.18 Inspections.
	121.18 Inspections.
	331.19 Notification of theft, loss, or release.
	121.19 Notification of theft, loss, or release.
	331.20 Administrative review.
	121.20 Administrative review.

General Comments

A commenter suggested that APHIS and CDC adopt consistent terminology when referring to biological agents and toxins. The commenter pointed out that the regulations use the following terms: biological agents and toxins, select agents and toxins, overlap agents, and high consequence pathogens.

We agree that APHIS and CDC should use consistent terminology. Therefore, in this final rule, we are removing the terms “biological agents and/or toxins,” “listed agents and/or toxins,” and “high consequence livestock pathogens” each time they appear in 7 CFR part 331 and/or 9 CFR part 121 and adding “select agents and/or toxins” in their place. In addition, in 9 CFR part 121, we are removing the term “overlap agents” each time it appears and adding “overlap select agents and/or toxins” in its place. To reflect this change in terminology, we are also changing the title of both parts from “Possession, Use, and Transfer of Biological Agents and Toxins” to “Possession, Use, and Transfer of Select Agents and Toxins.” In accordance with these changes, we will be using the term “select agent and/or toxin” throughout the preamble of this rule. When it is necessary to specify the type of select agent or toxin, we will use the following terms: “PPQ select agent and/or toxin” (for the plant agents and toxins), “VS select agent and/or toxin” (for the animal agents and toxins), or “overlap select agent and/or toxin.” Unless otherwise specified, the term “select agent and/or toxin” will refer to all agents or toxins listed by APHIS.

One commenter stated that APHIS and CDC should harmonize the regulations and provide consistent guidance to entities. This commenter also recommended close collaboration between the agencies for registration, enforcement, and compliance assistance. Another commenter recommended that APHIS and CDC establish one regulatory and reporting mechanism and one office of compliance assistance and enforcement in order to enhance coordination between APHIS and CDC.

We agree that APHIS and CDC should harmonize the regulations and provide consistent guidance to entities. APHIS and CDC have worked closely together to identify and resolve differences between the regulations. This final rule is consistent with CDC's final rule in both structure and substance. APHIS and CDC have also established procedures that will allow an entity to interact with only one agency—either APHIS or CDC—with respect to most matters involving select agents and toxins. These changes will ensure the close coordination of APHIS and CDC and create a uniform and consistent approach to the regulation of select agents and toxins. APHIS and CDC are also developing a single shared web-based system that will allow the regulated community to conduct transactions electronically with APHIS and CDC via a single web portal. By providing a single web portal, APHIS and CDC will be able to interact efficiently and effectively with the regulated community while reducing the burden on the public. We envision that this system will enable the entity to dynamically communicate with APHIS and CDC in a digitally secured environment using a single web portal. The web portal will provide a platform for electronic exchange of information. It will allow entities to access data related to their own registration data and allow them to create, amend, and submit registration applications; requests for approvals for transfers, exemptions, or exclusions; and any other required forms without the need to print, mail, or e-mail hard copies. Hard copy registration materials and other required forms will still be accepted. The single web portal will be available in winter 2005.

A number of commenters expressed concern about the effect of the regulations on the scientific community. Several commenters stated that the regulations will limit the free exchange of scientific information and make it difficult to recruit foreign researchers and technical workers in areas of short supply in the United States. Several commenters asserted that the costs of the regulations (especially the security requirements) will result in the termination of important research projects and the destruction of specimens. One commenter stated that research programs will be terminated because researchers will not want to deal with the new regulatory requirements or their institutions will not want to be liable for violations of the regulations. This commenter also noted that the costs of adhering to the regulations will limit the money available for the research. Another commenter stated that scientists will end up spending more time dealing with bureaucratic requirements rather than working in the laboratory or supervising their employees.

The Act requires the Secretary to establish, by regulation, standards and procedures governing the possession, use, and transfer of listed biological agents and toxins in order to protect animal and plant health, and animal and plant products. In an interim rule published in the Federal Register on December 13, 2002, and effective on February 11, 2003, APHIS established the regulations required under the Act. To date, the commenters' concerns about the costs or difficulties of complying with the regulations have failed to materialize. Accordingly, we are making no changes in response to these comments.

Several commenters requested that APHIS and CDC create a grant program to assist entities with the costs of implementing the security requirements.

At this time APHIS is unable to assist entities with the costs of implementing the security requirements because Congress has not appropriated any funds to establish such a grant program. Accordingly, we are making no change based on these comments.

One commenter requested that APHIS specify in the final rule that it is the regulatory agency for the veterinary biologics industry.

An entity in the veterinary biologics industry may be regulated by APHIS and/or CDC, depending on the agent or toxin that it possesses, uses, or transfers—overlap select agents and toxins are regulated by both APHIS and CDC, while VS select agents and toxins are regulated only by APHIS. For this reason, we are making no change in response to this comment.

A commenter stated that the regulations should be revoked and replaced with prohibitions on owning, working with, or importing any of the agents or products. This commenter recommended that the penalty for possession of a select agent be a fine of $500,000 or imprisonment for up to 25 years.

The Act does not authorize APHIS to prohibit the possession, use, or transfer of biological agents and toxins. Rather, section 212 of the Act directs APHIS to establish, by regulation, standards and procedures governing the possession, use, and transfer of biological agents and toxins that have been determined to have the potential to pose a severe threat to both human and animal health, to animal health, to plant health, or to animal or plant products. The Act also sets forth the civil and criminal penalties for violations of the Act. For these reasons, we are making no changes based on this comment.

One commenter warned of the potential for international travelers to bring biological “suitcase bombs” into the United States from countries with bovine spongiform encephalopathy, foot-and-mouth disease, or other exotic animal disease pathogens.

This commenter appears to be concerned about the introduction of animal disease pathogens into the United States in the luggage of international travelers. This comment is outside the scope of this rulemaking. However, we note that VS select agents or toxins and overlap select agents or toxins may only be imported into the United States in accordance with 9 CFR parts 121 and 122. We are making no change based on this comment.

Protection of Information Collected by APHIS

Several commenters expressed concern about APHIS’ ability to protect the information collected under the regulations. One commenter asked how APHIS would store and protect the information collected. Another commenter stated that USDA should ensure that the information collected is not available through Freedom of Information Act requests.

Section 212(h) of the Act sets forth the requirements relating to the disclosure of information by APHIS and other Federal agencies. Specifically, section 212(h)(1) provides that the specified Federal agencies may not disclose under 5 U.S.C. 552 any of the following: (1) Any registration or transfer documentation, permits issued prior to the enactment of the Act, or information derived therefrom to the extent that it identifies the agent or toxin possessed, used, or transferred by a specific person or discloses the identity or location of a specific person; (2) the national database or any other compilation of the registration or transfer information to the extent that such compilation discloses site-specific registration or transfer information; (3) any portion of a record that discloses the site-specific or transfer-specific safeguard and security measures used by a registered person to prevent unauthorized access to agents and toxins; (4) any notification of a theft, loss, or release of an agent or toxin; and (5) any portion of an evaluation or report of an inspection of a specific registered person that identifies the agent or toxin possessed by a specific registered person if the agency determines that public disclosure of the information would endanger animal or plant health, or animal or plant products. We believe the Act provides sufficient protection for the information collected under the regulations. Accordingly, we are making no changes based on these comments.

A commenter stated the rule should explicitly state that the security risk assessment is confidential.

As previously noted, we believe the Act provides sufficient protection for the information collected under the regulations. We do not believe it is necessary to state in the regulations that the security risk assessment is confidential. Therefore, we are making no change based on this comment.

Another commenter asserted that the information collected by APHIS for the security risk assessment should not be used more broadly than to determine who is a “restricted person.” The commenter noted that California State law prohibits discrimination in employment based upon citizenship and prohibits the disclosure of citizenship information to a third party in a manner that links that information to the individual, except in limited and compelling circumstances. The commenter expressed concern that the data collected for registration or a security risk assessment might be used inappropriately by a Federal agency to assess a proposal for funding. The commenter recommended that APHIS, CDC, and the Department of Justice take steps to ensure the security and confidentiality of submitted information.

In accordance with the Act, the information submitted by an individual as part of a security risk assessment may only be used to determine if an individual is a restricted person under 18 U.S.C. 175b or is reasonably suspected by any Federal law enforcement or intelligence agency of (1) committing a crime set forth in 18 U.S.C. 2332b(g)(5), (2) knowing involvement with an organization that engages in domestic or international terrorism (as defined in 18 U.S.C. 2331) or with any other organization that engages in intentional crimes of violence, or (3) being an agent of a foreign power as defined in 50 U.S.C. 1801. We believe that the Act and other applicable Federal laws, such as the Privacy Act, are sufficient to ensure the confidentiality of the submitted information. We are making no change in response to this comment.

A commenter asked how APHIS inspectors will mark and protect their inspection reports. APHIS inspection reports and related documents will be protected in accordance with the Act and agency and departmental policies.

Economic Impact

Several commenters argued that the costs of compliance were grossly understated in the economic analysis for the December 2002 interim rule. One commenter stated that the one-time cost to retrofit existing facilities will easily exceed $1 million and that recurring annual costs could top $100,000.

Although the commenter didn't specify, we believe that the commenter is referring to the costs to upgrade security. In our December 2002 economic analysis, we provided estimates of the costs of the interim security requirements. However, we noted that these estimates may not apply to every entity due to the diversity in existing security levels and security needs, as well as the various methods of meeting the interim security requirements. In the economic analysis in this final rule, we reiterate that the costs to comply with the security requirements are site specific and will vary accordingly.

Another commenter stated that the interim rule ignored or grossly underestimated financial costs, including the costs of verifying the baseline inventory and the costs of responding to lost vial reports. The commenter estimated that the one-time cost to verify the baseline inventory will be $2 million with recurring costs of about $1 million per year. The commenter also estimated that it will cost about $5 million per year to respond to reports of lost vials of select agents because the response would require, at least, a verification of the inventory.

In response to this comment, the economic analysis in this final rule provides more information about the costs of the inventory recordkeeping requirements. In this final rule, we estimate that it would cost an entity $7,200 to create a baseline inventory (assuming an average of 10 freezers and 3 toxin containers per entity). Assuming that registered entities would have to re-inventory one-half of their freezers each year to maintain an accurate and current inventory, we estimate the total yearly inventory cost for all affected entities to be $274,000. Finally, in the event of a theft or loss, we expect an entity would conduct an inventory of the affected storage freezer or toxin container. We estimate that such an inventory would cost $560 per occurrence.

Effective and Applicability Dates

Interim 7 CFR 331.0 and 9 CFR 121.0 provided that the regulations in each part became effective on February 11, 2003. To minimize the disruption of research or educational projects, both sections also provided additional time for individuals and entities to reach full compliance with the regulations in each part (i.e., a phase-in period). Finally, as established in the November 3, 2003, interim rule, both sections provided for the issuance of provisional certificates of registration and provisional grants of access for individuals under certain conditions.

A number of commenters requested clarification of the provisions for the phase-in period and several commenters requested additional time to comply with certain provisions. Given that all of the dates in 7 CFR 331.0 and 9 CFR 121.0 have passed, the sections are no longer applicable and the issues raised by the commenters are moot. Accordingly, in this final rule, we are removing 7 CFR 331.0 and 9 CFR 121.0.

Definitions

In 7 CFR 331.1 and 9 CFR 121.1, we define the terms used in the regulations. We are adding definitions of diagnosis and verification in both sections in this final rule. Diagnosis is defined as “the analysis of specimens for the purpose of identifying or confirming the presence or characteristics of a select agent or toxin provided that such analysis is directly related to protecting the public health or safety, animal health or animal products, or plant health or plant products.” Verification is defined as “the demonstration of obtaining established performance (e.g., accuracy, precision, and the analytical sensitivity and specificity) specifications for any procedure used for diagnosis.” In addition, in 9 CFR 121.1, we are amending the definition of proficiency testing. Proficiency testing is defined as “the process of determining the competency of an individual or laboratory to perform a specified test or procedure.” Finally, we are deleting the definition for diagnostic laboratory in both sections and we are deleting the definition for clinical laboratory in 9 CFR 121.1. These changes will clarify the exemption provisions and help to ensure that APHIS and CDC consistently apply these provisions.

To be consistent with CDC's definitions, we are adopting CDC's definitions for HHS Secretary and HHS select agent and/or toxin in both sections in this final rule. HHS Secretary is defined as “the Secretary of the Department of Health and Human Services or his or her designee, unless otherwise specified.” HHS select agent and/or toxin is defined as “a biological agent or toxin listed in 42 CFR 73.3.”

A commenter suggested that APHIS and CDC adopt consistent terminology when referring to biological agents and toxins. As previously noted, in this final rule we are adopting the terms “select agents and/or toxins” and “overlap select agents and/or toxins.” To reflect this change in terminology, we are adding several additional definitions to the regulations.

In 7 CFR 331.1 and 9 CFR 121.1, we are adding a definition for the term select agent and/or toxin. However, due to differences between the plant-related regulations in 7 CFR part 331 and the animal-related regulations in 9 CFR part 121, the term select agent and/or toxin is defined differently in both parts. In 7 CFR 331.1, select agent and/or toxin is defined as “a biological agent or toxin listed in § 331.3” while in 9 CFR 121.1 it is defined as “unless otherwise specified, all of the biological agents and toxins listed in §§ 121.3 and 121.4.” The latter definition takes into account the fact that overlap select agents and toxins are also regulated under 9 CFR part 121.

In 9 CFR 121.1, we are removing the definition for overlap agent or toxin and adding a definition for overlap select agent and/or toxin in its place. Overlap select agent and/or toxin is defined as “a biological agent or toxin that is listed in 9 CFR 121.4 and 42 CFR 73.4.” We are also adding definitions for VS and VS select agent and/or toxin in § 121.1. VS is defined as “the Veterinary Services Programs of the Animal and Plant Health Inspection Service” and VS select agent and/or toxin is defined as “a biological agent or toxin listed in § 121.3.”

One commenter claimed that the term “entity” is subject to interpretation. The commenter stated that it does not make sense for a large multi-campus university to base cumulative limits on toxins or the designation of the responsible official on the entity when the actual labs are separated by hundreds of miles. Another commenter stated the definition of “entity” should be amended to permit a responsible official to discharge his or her responsibilities at several adjacent addresses.

These issues are addressed below in the registration section. We are making no change to the definitions section in 7 CFR 331.1 and 9 CFR 121.1 based on these comments.

One commenter recommended that APHIS and CDC adopt a common definition for the term “responsible official.” The commenter noted that APHIS defines the term “responsible official” but CDC does not. The commenter stated that APHIS indicates a responsible manager should be the responsible official for an entity, while CDC would allow a biosafety officer to assume this role. The commenter stated that, in general, a biosafety officer would not have direct control over either the affected staff or budgets in order to ensure compliance with the regulations.

We agree that APHIS and CDC should adopt a common definition for the term “responsible official.” Accordingly, we are amending the definition for responsible official in this final rule. In 7 CFR 331.1 and 9 CFR 121.1, we define responsible official as “the individual designated by an entity with the authority and control to ensure compliance with the regulations in this part.” CDC is adopting the same definition in its final rule.

A commenter stated that APHIS should clarify the term “facility.” The commenter said the term appears to refer to a complete building or complex in some parts of the rule but to an individual laboratory/room in other parts of the rule.

APHIS uses the term “facility” in the definition for diagnostic laboratory in 7 CFR 331.1 and in the definitions for clinical laboratory and diagnostic laboratory in 9 CFR 121.1. The term does not appear elsewhere in the regulations. Accordingly, we are making no change based on this comment.

A commenter recommended that APHIS define the term “access” to mean actual, physical contact with the agent or the realistic opportunity for same.

This issue is addressed below in the sections relating to security risk assessments and security. We are making no change to the definitions in 7 CFR 331.1 or 9 CFR 121.1 based on this comment.

One commenter stated that 9 CFR 121.1 should define the term “exotic” so that the term can be removed from the list of agents.

This issue is addressed below in the section relating to the lists of VS and overlap select agents and toxins. Therefore, we are making no change to the definitions in 9 CFR 121.1 in response to this comment.

Purpose and Scope

Interim 7 CFR 331.2 and 9 CFR 121.2 set out the purpose and scope of the regulations. Specifically, 7 CFR 331.2(a) stated that part 331 sets forth the requirements for possession, use, and transfer of biological agents or toxins that have been determined to have the potential to pose a severe threat to plant health or plant products, while 9 CFR 121.2(a) stated that part 121 sets forth the requirements for possession, use, and transfer of biological agents or toxins that have been determined to have the potential to pose a severe threat to both human and animal health, or to animal health or animal products. Both sections noted that the purpose of the regulations is to ensure the safe handling of such agents or toxins, and to protect against the use of such agents or toxins in domestic or international terrorism or for any other criminal purpose.

In this final rule, we are amending both sections to clarify that each part implements the provisions of the Agricultural Bioterrorism Protection Act of 2002. Furthermore, we are amending 9 CFR 121.2 to clarify that overlap select agents and toxins are subject to regulation by both APHIS and CDC.

In interim 7 CFR 331.2 and 9 CFR 121.2, paragraphs (b) and (c) summarized the regulatory requirements. Since these provisions are already set forth in other sections of the regulations, we believe it is unnecessary to summarize them in these sections. Therefore, in this final rule, we are removing paragraphs (b) and (c) in 7 CFR 331.2 and 9 CFR 121.2, and removing the paragraph designation for paragraph (a) in both sections since it is no longer necessary.

List of Biological Agents and Toxins

In accordance with the Act, interim 7 CFR 331.3 and 9 CFR 121.3 listed certain biological agents and toxins.

Section 212(a)(2) of the Act requires that the lists of biological agents and toxins be reviewed and republished biennially, or more often as needed, and revised as necessary. In addition, the Act requires that, when determining whether to include an agent or toxin, the Secretary shall consult with appropriate Federal departments and agencies and with scientific experts representing appropriate professional groups.

This final rule serves as APHIS’ republication of the lists of select agents and toxins in 7 CFR 331.3 and 9 CFR 121.3, and in newly designated 9 CFR 121.4. As part of APHIS' review of the lists of agents and toxins, we reviewed current scientific information and studies and consulted with other Federal agencies. We also reviewed and considered the comments to the December 2002 interim rule on the lists of agents and toxins.

As previously noted, in this final rule, we are amending the structure of both parts to be consistent with CDC's select agent regulations. In 9 CFR part 121, we are creating separate sections for the lists of VS select agents and toxins and overlap select agents and toxins—§§ 121.3 and 121.4, respectively. We are also adding a new paragraph (a) to 7 CFR 331.3, containing introductory text, so that the format of the section is consistent with the format in 9 CFR 121.3 and 9 CFR 121.4.

One commenter recommended that APHIS include in the regulations a summary of the risk assessment data that supports the listing of each agent and toxin. The commenter stated that the data will heighten awareness of the risk characteristics of the listed agents and will promote safe practice and proficiency in handling such agents.

APHIS does not include risk assessment data in the regulations; rather, such information is discussed in a rule's preamble. As noted in the preamble of the August 2002 interim rule, the Act requires APHIS to consider the following criteria in determining whether to list an agent or toxin: (1) The effect of exposure to the agent or toxin on animal or plant health, and on the production and marketability of animal or plant products; (2) the pathogenicity of the agent or the toxicity of the toxin and the methods by which the agent or toxin is transferred to animals or plants; (3) the availability and effectiveness of pharmacotherapies and prophylaxis to treat and prevent any illness caused by the agent or toxin; and (4) any other criteria the Secretary considers appropriate to protect animal or plant health, or animal or plant products.

We do not believe it is necessary to provide a summary of the risk assessment data that supports the listing of each select agent or toxin in order to heighten awareness of the risk characteristics of such agents and toxins and promote safe practice and proficiency in handling of such agents and toxins. Information about the risk characteristics of a select agent or toxin and safe handling practices is available in scientific literature and other publications (e.g., the CDC/NIH publication, “Biosafety in Microbiological and Biomedical Laboratories”). For these reasons, we are making no change based on this comment.

Interim 7 CFR 331.3(a) (newly designated § 331.3(b)) listed the biological agents and toxins that have been determined to pose a severe threat to plant health or to plant products (PPQ select agents and toxins).

In this final rule, we are removing Phakopsora pachyrhizi, also known as Asian soybean rust, from the list of PPQ select agents and toxins. Asian soybean rust has been introduced into the United States by natural means and now it would have virtually no impact if used as a weapon of terrorism. Asian soybean rust was detected in the United States in November 2004. All available evidence suggests that spores were blown into the United States during a series of hurricanes in 2004. Detection surveys indicate that it is present in at least nine southeastern States; however, USDA is conducting additional surveys to determine the full extent of the introduction. Because Asian soybean rust has a host range of more than 90 plant species and its spores disperse naturally on wind currents, this disease will continue to spread naturally and it cannot be controlled effectively. We expect that this disease will quickly reach the full extent of its ecological range in the United States. As a result, there is an urgent need for timely research on effective means to manage the disease in the United States. For all of these reasons, we are removing Phakopsora pachyrhizi from the list of PPQ select agents and toxins. However, we note that a permit will still be required for importation or interstate movement of Asian soybean rust (7 CFR part 330).

A commenter claimed that, pursuant to the rules of the International Code of Nomenclature of Bacteria, two bacteria have been renamed; thus, Liberobacter africanus should be Candidatus Liberobacter africanus, and Liberobacter asiaticus should be Candidatus Liberobacter asiaticus.

We agree. Therefore, in this final rule, we are replacing the entry for Liberobacter africanus with Candidatus Liberobacter africanus and replacing Liberobacter asiaticus with Candidatus Liberobacter asiaticus. In addition, we are placing Candidatus Liberobacter africanus and Candidatus Liberobacter asiaticus on separate lines in order to make it clear that each one is a select agent.

One commenter argued that plum pox potyvirus should not be listed as a select agent because it is only naturally transmitted by aphids, and, without the insect vector to transmit the disease from one plant to another, the possibility of the virus being used as a weapon of terrorism is extremely small. The commenter stated that laboratory research of this agent, in the absence of its natural vector and only known means of transmission, poses little to no risk to plant health or plant products.

We agree that plum pox potyvirus (PPV) has limited potential as a weapon of terrorism given its biological characteristics. PPV is not easily transmitted and does not spread easily. The natural host range is limited to plants in the genus Prunus (e.g., plums and other stone fruits). The natural spread of the disease requires insect vectors (aphids), and is a complex biological process, and artificial spread requires grafting, which is labor intensive and time-consuming. PPV is not spread by pollen or seed. While systemic treatments are not completely effective at mitigating the disease, destruction of infected trees mitigates the effects of the disease, removal of the diseased trees and other susceptible hosts removes the source of infection, and transmission can be halted by removing host material from the area. Furthermore, most strains of PPV attack only a few varieties of stone fruits, which limits the affect of an outbreak on the production and marketability of stone fruits. For these reasons, in this final rule, we are removing plum pox potyvirus from the list of PPQ select agents and toxins. However, we note that PPV continues to be a quarantine pest under the domestic plant regulations (7 CFR 301.74 through 301.74-5).

Another commenter asserted that Ralstonia solanacearum, race 3, biovar 2, should not be listed as a select agent. This commenter stated that the bacterium is unlikely to become established in the northern United States, where potatoes are commercially grown, because it is intolerant of freezing and does not generally survive winters in regions with sustained temperatures below 20 °F. The commenter claimed that, even if the bacterium became established, it is unlikely to cause an economically damaging disease outbreak in the climactic conditions characteristic of North America. The commenter went on to note that the bacterium has been repeatedly introduced into the United States without impact.

APHIS has determined that Ralstonia solanacearum, race 3, biovar 2, has the potential to pose a severe threat to plant health or plant products. The bacterium is known to attack a number of economically significant hosts (e.g., geraniums and tomatoes), not just potatoes. Some of the known hosts are grown in greenhouses (e.g., geraniums), which protect them from local climatic conditions, and some hosts are grown in fields throughout the United States (e.g., tomatoes and potatoes). With regard to potatoes, scientific data indicate the potential range of the bacterium would include the potato-growing regions in the United States. Ralstonia solanacearum, race 3, biovar 2, occurs in Europe as far north as the 56th parallel (southern Scandinavia), which parallels regions of Canada. Furthermore, there are a number of wild hosts that would contribute to the spread of the bacterium if it were introduced into the United States. For these reasons, we are making no changes based on this comment.

Interim 9 CFR 121.3(d) (newly designated § 121.3(b)) listed the biological agents and toxins that have been determined to have the potential to pose a severe threat to animal health or to animal products (VS select agents and toxins).

A commenter asserted that listing Japanese encephalitis virus (JEV) as a select agent will negatively impact research on this disease, as well as on West Nile virus and dengue virus. This commenter stated that there does not appear to be sufficient justification for making Japanese encephalitis virus a select agent.

We disagree that there is insufficient justification for listing Japanese encephalitis virus as a VS select agent. The virus can cause severe disease in horses and swine for which there is no effective treatment and no domestically available veterinary vaccine. While the select agent regulations may affect research on JEV, we expect it will have a negligible effect on associated research on West Nile virus and dengue virus. For these reasons, we are making no change in response to this comment.

Several commenters questioned the inclusion of malignant catarrhal fever virus (exotic) on the list of select agents. One commenter stated the disease malignant catarrhal fever virus is caused be a variety of herpes viruses, none of which is known as malignant catarrhal fever virus. The commenter stated that Alcelaphine herpesvirus type 1 infects most wildebeest and spreads to domestic cattle causing malignant catarrhal fever in Africa. The commenter argued that malignant catarrhal fever virus (exotic) should be replaced with Alcelaphine herpesvirus type 1. Another commenter argued that the biological features of malignant catarrhal fever viruses prevent them from being effective bioterror agents. The commenter noted that Alcelaphine herpesvirus type 1 can only be transmitted by parenteral injection and cow-to-cow transmission does not occur under natural conditions. This commenter also argued that it is misleading to label malignant catarrhal fever as “exotic” since it is present wherever there are wildebeests, from zoos to exotic game farms.

We agree that clarification is needed with regard to the term malignant catarrhal fever virus. Accordingly, in this final rule we are replacing the entry for malignant catarrhal fever virus with malignant catarrhal fever virus (Alcelaphine herpesevirus type 1). However, we disagree that the biological features of malignant catarrhal fever viruses prevent them from being effective bioterror agents. Malignant catarrhal fever virus (Alcelaphine herpesevirus type 1) causes severe disease in cattle, and it may be possible for the virus to be transmitted from cow to cow. Currently, this virus is not found in U.S. cattle populations, and a widespread outbreak of the disease would likely result in widespread animal movement restrictions that could be long term, at least with respect to exports. We are making no change in response to this comment.

One commenter suggested that Newcastle disease virus (VVND) be replaced with Newcastle disease virus (velogenic). The commenter stated the background information indicated that only velogenic strains are to be regulated; however, the acronym VVND indicates viscerotropic, velogenic Newcastle disease.

In the December 2002 interim rule, we replaced the entry for Newcastle disease virus (exotic) with Newcastle disease virus (VVND) to make it clear that we are regulating only velogenic strains. Viscerotropic, velogenic Newcastle disease (VVND) is a velogenic strain. To ensure that we are regulating all of the velogenic strains, in this final rule we are replacing the entry for Newcastle disease virus (VVND) with Newcastle disease virus (velogenic).

A commenter stated the distinction between domestic and exotic vesicular stomatitis virus cannot be justified scientifically. Therefore, it would be more logical to list all vesicular stomatitis viruses except specific viruses that are generally recognized as attenuated (e.g., the VSV-Indiana Lab strain).

We do not believe it is necessary to regulate all strains of vesicular stomatitis virus, especially those strains that have limited morbidity and mortality in the United States. Therefore, we are making no change based on this comment.

Interim 9 CFR 121.3(b) (newly designated § 121.4(b)) listed the biological agents and toxins that have been determined to have the potential to pose a severe threat to both human and animal health, to animal health, or to animal products (overlap select agents and toxins).

Several commenters pointed out that Clostridium botulinum is listed in the APHIS regulations but not in the CDC regulations.

APHIS inadvertently listed both Clostridium botulinum and Botulinum neurotoxin producing species of Clostridium as overlap agents in the December 2002 interim rule. We always intended to only list Botulinum neurotoxin producing species of Clostridium in order to be consistent with CDC. Accordingly, we are removing Clostridium botulinum from the list of overlap select agents and toxins in this final rule.

A number of commenters argued that overlap agents that are endemic, widespread, and easily isolated from natural sources should not be included in the list of overlap select agents. For these reasons, one commenter recommended that Francisella tularensis and Coxiella burnetii be removed from the list of overlap agents. Several commenters stated that Coccidioides immitis should not be included in the list of overlap select agents because it is endemic in California's Central Valley and is found in many areas of the southwest. Another commenter argued that Coxiella burnetii should be removed from the overlap list because “it is so ubiquitous in nature that its identification as a select agent is meaningless.” One commenter argued that Eastern equine encephalitis virus should be removed from the overlap list because it is endemic and even if it were intentionally introduced into people, horses, or other domestic animals, there would be little or no chance of spread to cause an adverse agricultural event.

We agree that Coxiella burnetii, Coccidioides immitis, and Francisella tularensis are endemic, widespread, and easily isolated from natural sources. However, these factors are not sufficient reason to remove these agents from the list of overlap select agents and toxins. Furthermore, we disagree that there is little risk of an adverse agricultural event involving Eastern equine encephalitis virus because it can cause high mortality in horses, and there is no mandatory vaccination program in the United States. We are making no changes based on this comment.

A commenter stated that it is pointless to regulate trichothecenes such as T-2 toxin as select agents if highly toxigenic strains of the toxin-producing organism are not also regulated.

We are regulating T-2 toxin, and not the organism that produces it, because we believe the toxin has the potential to pose a severe threat to public health and safety, to animal health, and to animal products. Accordingly, we are making no change in response to this comment.

Interim 7 CFR 331.3(c)(2), 9 CFR 121.3(c), and 9 CFR 121.3(f)(2) (newly designated 7 CFR 331.3, 9 CFR 121.3, and 9 CFR 121.4) set out the provisions for genetic elements.

One commenter stated there are differences between the APHIS and CDC regulations regarding genetic elements. For example, the regulations seem to imply that no bacterial sequences are regulated, except those from animal agents.

We agree. In the interim regulations, CDC provided that infectious viral sequences of HHS and overlap select agents are regulated, while APHIS provided that infectious viral sequences of overlap agents are regulated and infectious viral and bacterial sequences of PPQ and VS select agents are regulated. To resolve these differences, in this final rule we are adopting CDC's approach for genetic elements. Specifically, newly designated 7 CFR 331.3, 9 CFR 121.3, and 9 CFR 121.4 provide that the following will be considered select agents and toxins:

• Nucleic acids that can produce infectious forms of any of the select agent viruses listed in either 7 CFR part 331 or 9 CFR part 121;
• Recombinant nucleic acids that encode for the functional forms of any toxin listed in either 7 CFR part 331 or 9 CFR part 121 if the nucleic acids: (1) Can be expressed in vivo or in vitro; or (2) are in a vector or recombinant host genome and can be expressed in vivo or in vitro; and
• Select agents and toxins listed in either 7 CFR part 331 or 9 CFR part 121 that have been genetically modified.

Another commenter stated that interim 9 CFR 121.3(c) and 121.3(f) conflict—§ 121.3(c) seems to include fragments, while § 121.3(f) exempts them. The commenter pointed out that all genetic elements that cause disease can be fragmented into pieces that cannot cause disease, but that can be reconstituted simply and quickly.

We believe the changes in this final rule will address the differences identified by this commenter. Accordingly, we are making no change based on this comment. However, we note that fragments are not subject to the regulations until reconstituted.

One commenter asked if cDNA is regulated. This commenter also asked how sequence data of select agents will be protected, since it can be used to make a select agent.

A cDNA fragment will be subject to the regulations if it can produce either an infectious form of toxin or a select agent. Sequence data of select agents is already in the public domain, and APHIS cannot protect this information. However, we note that an individual or entity that uses sequence data to produce an infectious agent or toxin will be subject to the select agent regulations. We are making no changes based on this comment.

Interim 7 CFR 331.3(b) and 9 CFR 121.3(e) stated that any biological agent or toxin that is in its naturally occurring environment will not be subject to the requirements of either part, provided that the biological agent or toxin has not been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source.

To be consistent with CDC, we are adopting the phrase “excluded from the requirements of this part” in place of the phrase “will not be subject to the requirements of this part.” Thus, in this final rule, newly designated 7 CFR 331.3(d)(1), 9 CFR 121.3(d)(1), and 9 CFR 121.4(d)(1) state that a select agent or toxin that is in its naturally occurring environment is excluded from the requirements of the regulations, provided that the agent or toxin has not been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source.

One commenter stated that the naturally occurring environment of a virus is its host. The commenter pointed out that Coxiella burnetii can be found in milk samples and asked if the truck moving milk to a processing plant would be subject to the regulations or if the milk sample submitted to a laboratory for mastitis testing would be subject to the regulations as the milk sample is being collected.

Coxiella burnetii that is contained in milk in a truck or in a diagnostic sample is considered to be in its naturally occurring environment as long as it has not been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source. We are making no changes in response to these comments.

Another commenter stated that the regulations suggest that an agent found in the lymph node of a slaughtered animal (found on histopathology but not cultivated or extracted) is in its naturally occurring environment and, therefore, exempt from notification.

This comment appears to combine the requirements for exclusions and exemptions. A select agent or toxin that has not been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source is considered to be in its naturally occurring environment and, therefore, excluded from the requirements of the regulations. The exemption provisions for overlap select agents and toxins are set forth in newly designated 9 CFR 121.6. Histopathology alone is not a definitive identification of a select agent. However, a select agent that has been identified by a histopathology method that has been validated would need to be reported to APHIS or CDC in accordance with the regulations. We are making no changes in response to this comment.

A commenter stated that any naturally occurring organism expressing a Shigatoxin should be specifically excluded from the list of select agents and toxins.

As previously noted, we are regulating the toxin and not the organisms that produce the toxin. Therefore, it is not necessary to exclude from the requirements of the regulations any naturally occurring organism expressing a Shigatoxin. However, we note that Shigatoxin under the control of a principal investigator, treating physician or veterinarian, or commercial manufacturer or distributor is excluded from the requirements of 9 CFR part 121 if the aggregate amount does not, at any time, exceed 100 mg (newly designated 9 CFR 121.4(d)(3)).

Interim 7 CFR 331.3(c)(1) (newly designated 7 CFR 331.3(d)(2)) provided that nonviable agents that are, bear, or contain listed agents or toxins will not be subject to the requirements of the part because they do not have the potential to pose a severe threat to plant health or plant products. Similarly, interim 9 CFR 121.3(f) (newly designated 9 CFR 121.3(d)(2) and 121.4(d)(2)) provided that nonviable agents or fixed tissues that are, bear, or contain listed agents or toxins will not be subject to the requirements of the part because they do not have the potential to pose a severe threat to both human and animal health, or to animal health or animal products.

In this final rule, we are amending both sections to clarify that these provisions apply to nonviable agents and nonfunctional toxins. These changes will make the provisions in the APHIS and CDC regulations consistent.

A commenter requested clarification of the terms “nonviable” and “nonfunctional” select agents or toxins. The commenter noted that some organisms can survive in nature, others only under lab conditions, and others not under any conditions.

A nonviable agent is not capable of replicating, infecting a plant or animal, or causing disease, while a nonfunctional toxin is not able to produce a toxic effect. These terms are generally understood in the scientific community, and we do not believe that further clarification is needed in the regulations. Therefore, we are making no change in response to this comment.

Footnotes in interim 9 CFR 121.3 stated that the importation and interstate movement of nonviable agents and genetic elements are subject to the permit requirements under 9 CFR part 122.

One commenter asked why a permit is needed for nonviable agents and genetic elements that are excluded from regulation under 9 CFR part 121. The commenter argued that nonviable agents and genetic elements that are not capable of causing disease do not meet the definition of “organism” in part 122. Another commenter requested clarification of the permit requirement for nonviable agents or fixed tissues. The commenter stated that the provision seems to suggest that, for as long as you retain the tissues, you would need to get yearly interstate transport permits even though no further receipt/transport is taking place.

The regulations in 9 CFR part 122 pertain to the movement of organisms and vectors. A nonviable agent or genetic material could serve as a vector of a disease agent through ineffective or insufficient processing methods, and, therefore, require a permit for importation or interstate movement. However, since a permit may not always be required, in this final rule we are revising the footnotes so that, in newly designated 9 CFR 121.3 and 121.4, they state that a permit may be needed for nonviable agents and genetic elements. We note that permits may contain restrictions that extend beyond the expiration of the permit if the agent/genetic element is not destroyed. If so, an individual or entity would be required to obtain a new permit as long as the nonviable agent or genetic element is possessed by the permittee.

A commenter asked if a positive chain reaction (PCR) test done on formalin fixed tissue that detects Eastern equine encephalitis virus would be exempt because it is nonviable.

This comment is not entirely clear. We believe the commenter is asking about the reporting requirements for identifications of a select agent or toxin. If Eastern equine encephalitis virus is identified from formalin tissue, an individual or entity must report the identification to APHIS in accordance with either newly designated 9 CFR 121.6 or 121.9, whichever is applicable. However, nonviable overlap select agents or nonfunctional toxins are excluded from the regulations (newly designated 9 CFR 121.4(d)(2)). We are making no changes in response to this comment.

Interim 9 CFR 121.3(f)(3) provided an exclusion from the regulations for “[o]verlap toxins under the control of a principal investigator (or equivalent), if the total aggregate amount does not, at any time, exceed the following amounts: 0.5 mg of Botulinum neurotoxins (types A-G), 100 mg of Clostridium perfringens epsilon toxin, 100 mg of Shigatoxin, 5 mg of Staphylococcal enterotoxins, and 1,000 mg of T-2 toxin.

APHIS and CDC have determined that this exclusion is too narrow and has the unintended consequence of requiring treating physicians or veterinarians and commercial manufacturers or distributors that possess, use, or transfer otherwise excluded toxins to register. Accordingly, in this final rule, we are broadening the scope of the overlap toxin exclusion to cover overlap toxins under the control of a principal investigator, treating physician or veterinarian, or commercial manufacturer or distributor (newly designated § 121.4(d)(3)). To be consistent with CDC, we are also removing the words “(types A-G)” after Botulinum neurotoxins.

One commenter requested that APHIS clarify that there is no limit to the amount of overlap toxins an individual or entity may possess or use, as long as the amount of toxin under the control of each principal investigator does not exceed the specified amounts.

We believe that newly designated § 121.4(d)(3) clearly indicates that the exclusion is based upon the amount of overlap toxin under the control of a principal investigator, treating physician or veterinarian, or commercial manufacturer or distributor. Therefore, we are making no change based on this comment.

Another commenter asked if the toxin amounts refer to quantities of isolated toxin (i.e., toxin that has been extracted and is separate from the cell) or toxin that is in the process of being produced by living cells and may increase in quantity. The commenter stated that measuring the exact quantities of a toxin can only reasonably be achieved if the toxin has been isolated from the cell.

We agree that an exact measurement of a toxin can only reasonably be achieved if the toxin has been isolated from the cell. The amounts listed in newly designated § 121.4(d)(3) refer to the amount of toxin that has been isolated from the cell, not the amount of toxin that is being produced in living cells. We are making no change based on this comment.

Interim 9 CFR 121.3(g) (newly designated §§ 121.3(e) and 121.4(e)) provided a procedure by which an individual or entity may request a determination by the Administrator that an attenuated strain of a biological agent does not pose a severe threat to both human and animal health, or to animal health or animal products.

In this final rule, we are adding this provision to 7 CFR 331.3 so that the regulations in part 331 are consistent with the regulations in 9 CFR part 121. We are also amending both parts to clarify the requirements and streamline the process for excluding an attenuated strain of a select agent or toxin. Specifically, paragraph (e) in 7 CFR 331.3, 9 CFR 121.3, and 9 CFR 121.4 provides that an individual or entity may apply for an exclusion by submitting a written request and supporting scientific information. A written decision granting or denying the request will be issued and the exclusion will be effective upon notification of the applicant. Exclusions will be published periodically in the notice section of the Federal Register and will be listed on the Internet at http://www.aphis.usda.gov/​programs/​ag_​selectagent/​index.html. Paragraph (e) also provides that, if an excluded attenuated strain is subjected to any manipulation that restores or enhances its virulence, the resulting select agent or toxin will be subject to the requirements of each part. This has always been the way the exclusion for attenuated strains has been interpreted; however, we are adding this provision to both parts to facilitate compliance.

One commenter claimed that the microbiological community, not just government agency representatives, must be involved in the process for excluding attenuated strains. The commenter recommended the establishment of a broadly representative group to act as an advisory body to APHIS and CDC. This commenter also stated that the regulations should state that determinations regarding overlap agents require the concurrence of APHIS and CDC.

APHIS may exclude attenuated strains of select agents or toxins after consultation with subject matter experts, including those in the microbiology community. For overlap select agents and toxins, APHIS may exclude attenuated strains after consultation with subject matter experts and CDC. We do not believe it is necessary to include these administrative procedures in the regulations. Accordingly, we are making no change based on this comment.

A commenter stated that APHIS should specify the criteria for exclusion of attenuated strains because the current standard (“poses a severe threat”) is insufficiently specific.

The Act requires APHIS to regulate the possession, use, and transfer of biological agents and toxins that have been determined to pose a severe threat to public health and safety, to animal health, to plant health, or to animal or plant products. Thus, the Act establishes the standard by which APHIS may exclude an attenuated strain (i.e., the strain does not pose a severe threat). We are making no change to the regulations in response to this comment.

A commenter asserted that the excluded attenuated strains should be listed in the regulations so that an entity may be able to determine if an agent is excluded before registering the strain and installing any additional security.

APHIS is not including the lists of excluded attenuated strains of select agents or toxins in the regulations because any change to the lists of exclusions would require rulemaking. To minimize the potential delays related to rulemaking, in this final rule we are providing that exclusions will be published periodically in the notices section of the Federal Register and will be listed on the Internet at http://www.aphis.usda.gov/​programs/​ag_​selectagent/​index.html. We believe these measures will provide sufficient notice to the public.

A commenter stated that the exclusion for attenuated strains would not make agents such as the Sterne strain of Bacillus anthracis and the vaccine strain of Brucella abortus available for the critical need of quality control, without registration of the laboratory.

An attenuated strain of a select agent may be excluded from the requirements of regulations based upon a determination that the attenuated strain does not pose a severe threat to plant health or plant products (newly designated 7 CFR 331.3(e)) or to public health and safety, to animal health, or animal products (newly designated 9 CFR 121.3(e) and 121.4(e)). Once an attenuated strain of a select agent has been excluded, it may be used for quality control or for other purposes, as long as its virulence is not restored or enhanced. To date, a number of attenuated strains have been excluded, including Bacillus anthracis Sterne, pX01⁺ pX02⁻ and Brucella abortus strain RB51 (vaccine strain). For these reasons, we are making no change in response to this comment.

One commenter asked if the TC-83 vaccine strain of Venezuelan equine encephalitis is subject to the regulations. The commenter pointed out that the CDC regulations specifically exclude this strain from regulation but the APHIS regulations do not.

Both APHIS and CDC have excluded the TC-83 vaccine strain of Venezuelan equine encephalitis virus from the requirements of the regulations. We note that a current list of exclusions is available on the Internet at http://www.aphis.usda.gov/​programs/​ag_​selectagent/​index/​html. We are making no change based on this comment.

To address concerns raised by Federal law enforcement agencies related to seizures (i.e., possession) of select agents or toxins, in this final rule we are adding a new paragraph (f) to 7 CFR 331.3, 9 CFR 121.3, and 9 CFR 121.4 to address situations in which the select agents or toxins have been identified prior to seizure. In the event that a Federal law enforcement agency seizes a suspected select agent or toxin or unknown material, this material will be regarded as a specimen presented for diagnosis or verification and, therefore, will not be subject to the regulations until it has been identified as a select agent or toxin.

Paragraph (f) provides that any select agent or toxin seized by a Federal law enforcement agency will be excluded from the requirements of the regulations during the period between seizure of the agent or toxin and the transfer or destruction of such agent or toxin provided that:

• As soon as practicable, the Federal law enforcement agency transfers the seized agent or toxin to an entity eligible to receive such agent or toxin or destroys the agent or toxin by a recognized sterilization or inactivation process;
• The Federal law enforcement agency safeguards and secures the seized agent or toxin against theft, loss, or release and reports any theft, loss, or release of such agent or toxin; and
• The Federal law enforcement agency reports the seizure of the select agent or toxin to APHIS or CDC.

This provision will allow Federal law enforcement agencies to conduct certain law enforcement activities (e.g., collecting evidence from a laboratory crime scene) without being in violation of the regulations. We note, however, that this provision does not authorize the seizure of a select agent or toxin by a Federal law enforcement agency; rather, it establishes the conditions under which a Federal law enforcement agency may seize a select agent or toxin without violating the regulations. Seizure of a select agent or toxin by a Federal law enforcement agency would have to be in accord with that agency's statutory authority.

Exemptions

Interim 7 CFR 331.4, 9 CFR 121.4, and 9 CFR 121.5 (newly designated 7 CFR 331.5, 9 CFR 121.5, and 9 CFR 121.6) set out exemptions.

Interim 9 CFR 121.4(a) provided that clinical or diagnostic laboratories and other entities possessing, using, or transferring overlap agents or toxins that are contained in specimens presented for diagnosis or verification will be exempt from the requirements of part 121, provided that the identification of such agents or toxins is immediately reported to APHIS or CDC, and to other appropriate authorities when required by Federal, State, or local law; and, within 7 days after identification, such agents or toxins are transferred or inactivated, and APHIS Form 2040 is submitted to APHIS or CDC. Interim 7 CFR 331.4(a) and 9 CFR 121.5(a) contained similar exemption provisions for diagnostic laboratories (the term clinical laboratories is not applicable to the plant-related regulations in 7 CFR part 331 or the animal-related regulations in 9 CFR part 121). Exemption provisions for laboratories and other entities that perform proficiency testing were set out in interim 9 CFR 121.4(b) and 121.5(b).

In this final rule, we are amending both parts to clarify the exemption provisions related to clinical or diagnostic laboratories and other entities (for overlap select agents and toxins) and diagnostic laboratories and other entities (for PPQ and VS select agents and toxins). Specifically, paragraph (a) in newly designated 7 CFR 331.5 and paragraphs (a) and (b) in newly designated 9 CFR 121.5 and 121.6 make clear that laboratories and other entities must meet the exemption requirements for each select agent or toxin contained in a specimen that it possesses, uses, or transfers. This change takes into account situations in which a diagnostic laboratory or other entity could be registered for a select agent or toxin but still meet the exemption requirements for other select agents or toxins contained in specimens. We are also amending both parts to clarify that, as a condition of exemption, clinical or diagnostic laboratories and other entities must transfer a select agent or toxin in accordance with the transfer requirements in each part (newly designated 7 CFR 331.16 and 9 CFR 121.16, respectively) or destroy the agent or toxin on-site by a recognized sterilization or inactivation process.

In this final rule, we are also deleting in both parts the requirement that the identification of a select agent or toxin be reported to appropriate authorities when required by Federal, State, or local law (interim 7 CFR 331.4, 9 CFR 121.4, and 9 CFR 121.5). Because this provision merely indicates that additional reporting requirements may exist under Federal, State, or local law, it is not necessary to include this provision in the regulations. It is the entity's responsibility to be familiar with all legal requirements for select agents and toxins.

In addition, newly designated 9 CFR 121.5 and 121.6 require immediate reporting after identification for specified select agents and toxins; identification of the other select agents and toxins must be reported within 7 calendar days after identification. This change will reduce the reporting burden on the public while continuing to provide information that will help us to identify outbreaks and to monitor activities related to select agents and toxins.

Finally, we are deleting footnote 1 in interim 7 CFR 331.4 (newly designated 7 CFR 331.5) because this information is contained in the transfer section in this final rule (newly designated § 331.16). We are also deleting the application and contact information contained in footnotes in interim 7 CFR 331.4, 9 CFR 121.4, and 9 CFR 121.5 because addresses and telephone numbers are subject to change. Information about the submission of forms, notices, and requests for exemptions or exclusions is available on the Internet at http://www.aphis.usda.gov/​programs/​ag_​selectagent/​index/​html.

A commenter asserted that clinical or diagnostic laboratories should be required to secure the agent or toxin prior to transfer or destruction.

We agree. Taking into account the risks posed by select agents and toxins and the security requirements for registered entities, it is reasonable to require that a clinical or diagnostic laboratory or other entity secure the agent or toxin prior to transfer or destruction. Furthermore, we believe it is reasonable to require that a clinical or diagnostic laboratory or other entity report any theft, loss, or release of a select agent or toxin prior to transfer or destruction. Therefore, newly designated 7 CFR 331.5, 9 CFR 121.5, and 9 CFR 121.6 require, as another condition of exemption, that the select agent or toxin be secured against theft, loss, or release during the period between identification of the agent or toxin and transfer or destruction of such agent or toxin, and that any theft, loss, or release of such agent or toxin be reported.

Another commenter argued that the exemptions for clinical and diagnostic laboratories should require, at the very least, that employees of such labs be subject to security risk assessments by the Attorney General.

The Act does not require security risk assessments for employees of entities that are exempt from registration under the regulations (section 212(e)). We believe that the conditions for exemption in this final rule provide adequate safeguard and security measures to protect animal and plant health, and animal and plant products. Accordingly, we are making no change based on this comment.

One commenter requested that APHIS define the term “identification.” The commenter asked if a PCR positive reaction constituted identification or simply detection. This commenter also wondered if an entity must report an identification done on a nonviable organism.

If a PCR test is recognized in the scientific community as an identification method, then a result utilizing this test must be reported. If not, reporting is not required. An individual or entity must report an identification done on a nonviable organism in accordance with the regulations. We require this reporting in order to obtain surveillance information about select agents or toxins. We are making no changes in response to this comment.

Several commenters argued that the requirement to transfer an agent or toxin within 7 calendar days of identification was unrealistic. One commenter stated that delays in transfer approval by APHIS or CDC could result in delays in shipping the samples. Several commenters expressed concern about this deadline due to the unreliability of shippers. Another commenter stated that it is unreasonable and counterproductive to require diagnostic labs to destroy or transfer select agents within 7 days after identification. The commenter said that some labs may process hundreds or thousands of samples each week and generate large numbers of select agent isolates, and transferring these isolates to a qualified lab within 1 week will be very difficult and costly. The commenter claimed that most labs will simply destroy the isolates and that such destruction will result in the loss of valuable scientific material.

Based on information provided by CDC and APHIS' National Veterinary Services Laboratories (NVSL), and taking into consideration the risks posed by select agents and toxins, we believe that 7 days will provide ample time after identification to destroy the agent or toxin, or to make transfer arrangements and to transfer the agent or toxin. However, in this final rule, we are amending newly designated 7 CFR 331.5(a) and 9 CFR 121.5(a) to allow the Administrator to make exceptions to these timeframes, as necessary. We are also amending newly designated 9 CFR 121.6(a) to allow the Administrator or the HHS Secretary to make exceptions to these timeframes for overlap select agents or toxins, as necessary. Finally, we are making similar changes to newly designated 9 CFR 121.5(b) and 9 CFR 121.6(b) to allow for exceptions to the timeframes for proficiency testing, which require that an agent or toxin be transferred or destroyed within 90 calendar days of receipt.

Another commenter recommended a longer holding period for agents and toxins before mandatory inactivation—30 to 45 days instead of 7 days—because the destruction of isolates of select agents after only 7 days is counter to good quality control in labs, which often specifies that isolates and specimens be kept for 30 days, and labs often have cases pending for at least 30 days awaiting additional results. The commenter went on to note that it is good lab practice to maintain the original sample until a case is complete, and labs often maintain samples so that additional testing can be done as needed.

The exemption provisions in interim 7 CFR 331.4(a), 9 CFR 121.4(a), and 9 CFR 121.5(a) (newly designated 7 CFR 331.5(a), 9 CFR 121.5(a), and 9 CFR 121.6(a)) do not require mandatory inactivation of a select agent or toxin. To qualify for an exemption, an individual or entity must satisfy the conditions for exemption, including transferring or destroying the select agent or toxin within 7 calendar days of identification unless directed otherwise by the Administrator or HHS Secretary. However, an individual or entity could continue to hold a select agent or toxin if it registers with APHIS or, for overlap select agents and toxins, if it registers with APHIS and CDC. While we recognize that the select agent regulations may have an effect on internal quality assurance procedures, lengthening the time that a diagnostic laboratory or other entity can possess a sample without being registered is inconsistent with the intent of the Act. We are making no changes based on this comment.

One commenter asked if diagnostic facilities could preregister for potential isolates they might obtain from future diagnostic cases. The commenter stated the regulations suggest that a facility has to have the agent before it can register. The commenter stated that, once an agent is isolated, it appears that the facility would only have 7 days to become registered before it would have to destroy or transfer the agent. The commenter noted that even the process to amend a certificate of registration would likely take longer than 7 days.

The regulations do not preclude preregistration for a select agent or toxin. A certificate of registration may be issued to an entity as long as the entity meets the regulatory requirements for such agent or toxin, even if the entity does not currently possess that particular agent or toxin.

The regulations (interim 7 CFR 331.4(b) and 9 CFR 121.5(f); newly designated 7 CFR 331.5(b) and 9 CFR 121.5(f)) provide that the Administrator may grant exemptions from the requirements of 7 CFR part 331 and 9 CFR part 121 upon a showing of good cause and a determination that such an exemption is consistent with protecting animal or plant health or animal or plant products.

A commenter stated that APHIS should establish timelines for responding to requests for exemptions. APHIS is committed to processing requests for exemptions in a timely manner. We do not believe it is necessary to include in the regulations timelines for responding to requests for exemptions. Therefore, we are making no change based on this comment.

Interim 9 CFR 121.4(c) and 121.5(d) provided that, unless the Administrator by order determines that additional regulation is necessary to protect animal health, or animal products, an individual or entity possessing, using, or transferring products that are, bear, or contain agents or toxins will be exempt from the requirements of this part if the products have been cleared, approved, licensed, or registered pursuant to:

(1) The Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et seq.);

(2) Section 351 of the Public Health Service Act (42 U.S.C. 262);

(3) The Virus-Serum-Toxin Act (21 U.S.C. 151-159); or

(4) The Federal Insecticide, Fungicide, and Rodenticide Act (7 U.S.C. 131 et seq.).

In this final rule, newly designated §§ 121.5(d) and 121.6(c) clarify that the product is exempt from the requirements of the regulations. This change is designed to address those situations in which an entity produces an exempt product but conducts other activities that would require registration under this part.

A commenter requested that APHIS and CDC provide a list of agents exempted under the Federal laws listed in interim 9 CFR 121.4(c) so that investigators would know if the agents they possess or wish to study are exempt.

It is not administratively feasible for APHIS to maintain a list of select agents exempted under the Federal laws described above. The regulations provide sufficient information for an individual or entity to determine if the agents they possess or wish to study are exempt. Accordingly, we are making no changes based on this comment.

In interim 9 CFR 121.5(c), we provided that an individual or entity receiving diagnostic reagents and vaccines that are, bear, or contain select agents or toxins that are produced at USDA diagnostic facilities will be exempt from the requirements of part 121.

A commenter stated that agents approved by APHIS' Center for Veterinary Biologics for use in USDA licensed facilities should be exempt from the requirements of the rule.

We disagree. We included this provision in the regulations in order to exempt products, not agents, that would be cleared, approved, licensed, or registered pursuant to the Virus-Serum-Toxin Act (21 U.S.C. 151-159), but for the fact that they are produced by USDA. In order to clarify that this exemption applies to products, in this final rule, newly designated 9 CFR 121.5(c) provides that diagnostic reagents and vaccines that are, bear, or contain VS select agents or toxins that are produced at USDA diagnostic facilities will be exempt from the requirements of this part.

The regulations (interim 9 CFR 121.4(e); newly designated § 121.6(e)) provide that the Administrator may exempt an individual or entity from the requirements of the part for 30 days if it is necessary to respond to a domestic or foreign agricultural emergency involving an overlap agent or toxin. This exemption may be extended for an additional 30 days.

One commenter argued that the 30-day special exemption granted during an emergency is insufficient to deal with a foreign animal or outbreak emergency. This commenter stated that neither exotic Newcastle disease or the low pathogenic avian influenza outbreaks were resolved in 60 days.

Section 212(g)(1)(D) of the Act sets forth the exemption for agricultural emergencies involving overlap select agents and toxins. The Act specifies that such exemptions may not exceed 60 days. Accordingly, we are making no changes based on this comment.

Registration

Interim 7 CFR 331.5, 331.6, and 331.8 and 9 CFR 121.6, 121.7, and 121.9 (newly designated 7 CFR 331.7 and 9 CFR 121.7) set out registration requirements and procedures.

One commenter stated that the regulations do not contemplate or address a situation where an entity has employees that possess, use, or transfer select agents at locations owned and controlled by another entity. The commenter stated that it is a nonprofit organization that provides medical research personnel to Federal agencies. The commenter asserted that the regulations and the registration application should be revised to require registration for the entity that owns or controls the location where agents and toxins are used and stored.

This final rule requires that, unless exempted under the regulations, an individual or entity that possesses, uses, or transfers select agents or toxins must register with APHIS or, for overlap select agents or toxins, APHIS and CDC. The regulations provide for both individuals and entities, even though we expect that most registrants will be entities. Using the example given by the commenter, the Federal agency that possesses, uses, or transfers select agents or toxins would be required to register and restrict access to such agents or toxins to only those individuals approved by the Administrator or HHS Secretary following a security risk assessment by the Attorney General. We are making no change based on this comment.

One commenter requested that USDA and CDC consider a single clearinghouse for registration of select agents. The commenter said the rules require an entity that possesses only human and animal/plant agents (no overlaps) to register separately with each agency; however, this would place an undue burden on the entity by requiring dual registration packages and safety/security plans. Another commenter recommended that APHIS indicate what an entity can do to assist or mitigate conflict between APHIS and CDC on registration applications for overlap agents.

To simplify the registration process and minimize the burden on the public, APHIS and CDC have established a framework by which individuals and entities with various combinations of select agents and toxins may submit their registration applications to either APHIS or CDC. For instance, to apply for a certificate of registration for only PPQ or VS select agents or toxins, or for PPQ and VS select agents or toxins, an individual or entity must submit the registration application package to APHIS. However, to apply for a certificate of registration for overlap select agents or toxins, overlap select agents or toxins and any combination of PPQ or VS select agents or toxins, or HHS select agents or toxins and any combination of PPQ or VS select agents or toxins, an individual or entity must submit the registration application package to APHIS or CDC, but not both. In this final rule, we are amending both sections to set out this new framework for submitting registration applications (newly designated 7 CFR 331.7(d) and 9 CFR 121.7(d)).

As previously discussed, APHIS and CDC are also developing a single shared web-based system that will allow the regulated community to conduct transactions electronically with either agency via a single web portal. By providing a single web portal, APHIS and CDC will be able to interact efficiently and effectively with the regulated community while reducing the burden on the public. We envision that this system will enable the entity to dynamically communicate with APHIS and CDC in a digitally secured environment using a single web portal. The web portal will provide a platform for electronic exchange of information. It will allow entities to access data related to their own registration data and allow them to create, amend, and submit registration applications; requests for approvals for transfers, exemptions, or exclusions; and any other required forms without the need to print, mail, or e-mail hard copies. Hard copy registration materials and other required forms will still be accepted. The single web portal will be available in winter 2005.

Several commenters requested more information about the registration process. One commenter asked how long will it take to receive a certificate of registration after all the paperwork has been submitted. The commenter urged APHIS to promptly process registration applications so as not to disrupt valuable research and impede academic planning. Another commenter suggested that APHIS add information to the final rule to indicate when an entity should submit renewal applications (i.e., at least 90 days prior to expiration).

We are committed to promptly processing initial registration applications and renewal applications. The time needed to process a registration application and issue a certificate of registration depends on the complexity and completeness of the application. However, to provide more guidance about the submission of renewal applications, we recommend that the registration application and the information necessary to conduct the required security risk assessments be submitted at least 8 weeks prior to the expiration of the date of the certificate of registration.

Interim 7 CFR 331.6(b)(1) and 9 CFR 121.7(b)(1) (newly designated 7 CFR 331.7 and 9 CFR 121.7) indicated that, as one of the conditions of registration, the owner or controller of an entity must be approved by APHIS following a security risk assessment by the Attorney General.

A commenter asked who would be deemed to own or control the entity in the context of an academic institution. Another commenter thought the phrase “individual who controls the facility” meant the senior administrators to whom the responsible official reports and not the members of the Board of Trustees.

The determination of who is an owner or controller of an academic institution (i.e., institution of higher education) depends on whether it is a public or private institution of higher education. Federal, State, or local governmental agencies, including public institutions of higher education, are exempt from the security risk assessment for the entity and the individual who owns or controls such entity. However, for a private institution of higher education, an individual will be deemed to own or control the entity if the individual is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity. We consider an entity to be an institution of higher education if it is an institution of higher education as defined in the Higher Education Act of 1965 (20 U.S.C. 1001(a)) or an organization described in the Internal Revenue Code of 1986 (26 U.S.C. 501(c)(3)). Because entities that meet this criteria do not have an owner, the individual(s) in control of the entity must be approved by the Administrator or the HHS Secretary following a security risk assessment by the Attorney General. For all other entities, an individual will be deemed to own or control the entity if the individual: (1) Owns 50 percent or more of the entity, or is a holder or owner of 50 percent or more of its voting stock, or (2) is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.

To clarify the requirements for owners or controllers of an entity, we are making several changes to the registration sections in this final rule. We are making clear that the individuals must be approved by the Administrator or HHS Secretary based on a security risk assessment by the Attorney General (7 CFR 331.7(c)(1) and 9 CFR 121.7(c)(1)). We are also moving the information contained in footnote 4 in interim 7 CFR 331.6 and footnote 7 in interim 9 CFR 121.7 to a new paragraph in both sections, 7 CFR 331.7(c)(2) and 9 CFR 121.7(c)(2), which states that Federal, State, or local governmental agencies, including public institutions of higher education, are exempt from the security risk assessment for the entity and the individual who owns or controls such entity. In addition, we are adding the following paragraphs to both 7 CFR 331.7 and 9 CFR 121.7 to clarify who will be deemed to own or control an entity and to indicate the criteria by which an entity will be considered an institution of higher education:

• For a private institution of higher education, an individual will be deemed to own or control the entity if the individual is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.
• For entities other than institutions of higher education, an individual will be deemed to own or control the entity if the individual: (1) Owns 50 percent or more of the entity, or is a holder or owner of 50 percent or more of its voting stock; or (2) is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.
• An entity will be considered to be an institution of higher education if it is an institution of higher education as defined in section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)), or is an organization described in 501(c)(3) of the Internal Revenue Code of 1986, as amended (26 U.S.C. 501(c)(3)).

Finally, we are adding a footnote to 7 CFR 331.7 and 9 CFR 121.7 to clarify that more than one individual may meet the criteria for ownership or control of an entity.

Interim 7 CFR 331.6(b)(2) and 9 CFR 121.7(b)(2) provided that APHIS may issue a certificate of registration if, among other things, the Administrator approves an entity's biosafety, containment, and security.

In drafting this provision, we intended to stress to the regulated community the importance of the biosafety, containment, and security requirements. However, we did not intend to suggest that an individual or entity did not have to meet the other requirements of the regulations. Since the issuance of a certificate of registration is an administrative action taken by APHIS, it is not necessary to include this provision in the regulations. Accordingly, we are deleting this provision in both sections.

Interim 7 CFR 331.6(b)(3) and 9 CFR 121.7(b)(3) provided that APHIS may issue a certificate of registration if, among other things, the Administrator determines that the individual or entity seeking to register has a lawful purpose to possess, use, or transfer agents or toxins.

One commenter stated that it is unclear how APHIS will determine if the entity has an unlawful purpose to possess, use, or transfer select agents. The commenter asked what information APHIS will use to make this determination.

To determine whether an entity has a lawful purpose to possess, use, or transfer select agents or toxins, APHIS will consider the information contained in the registration application and any other information available to APHIS about the entity. This determination will be made on a case-by-case basis. However, since this is an administrative action taken by APHIS, it is unnecessary to include this provision in the regulations. Accordingly, we are deleting this provision in both sections. In addition, we are amending newly designated 7 CFR 331.7(f) and 9 CFR 121.7(f) to clarify that the issuance of a certificate of registration may be contingent upon inspection or submission of additional information, such as the security plan, biocontainment/biosafety plan, incident response plan, or any other documents required to be prepared under each part. These changes will make the APHIS and CDC regulations consistent.

In interim 7 CFR 331.5(b) and 9 CFR 121.6(b), we provided that each entity must designate an individual to be its responsible official and that this individual must have the authority and control to ensure compliance with the regulations. Furthermore, in interim 7 CFR 331.6(c) and 9 CFR 121.7(d), we provided that a certificate of registration will be valid for only the specific agents or toxins and specific activities and locations listed on the certificate.

One commenter stated an entity should be able to apply for a single certificate of registration to cover activities at all buildings on a campus or site under the control and authority of the responsible official, which would include both contiguous and dispersed sites within a local geographical area. The commenter stated that it is overly burdensome to require separate registrations for each general physical location (defined as a building or a complex of buildings at a single mailing address). The commenter claimed that the administrative and control functions at research and academic institutions are efficiently managed by a centralized department responsible for more than one physical location. Similarly, a commenter stated that the provisions concerning location should be amended to cover a single administrative organization under a single responsible official. Another commenter requested that the final regulations allow campuses to designate responsible officials with responsibility for an entire campus.

APHIS designed these provisions to ensure that the responsible official has the requisite authority and control to ensure compliance with the select agent regulations. We reasoned that a responsible official would be better able to ensure compliance with the regulations if he/she managed only one general physical location. While we still believe that to be true, we recognize that some responsible officials will be able to ensure compliance for an entire campus or business complex. Therefore, in this final rule, the registration sections (newly designated 7 CFR 331.7(g) and 9 CFR 121.7(g)) provide that a certificate of registration will be valid for one physical location (a room, a building, or a group of buildings) where the responsible official will be able to perform the responsibilities required in this part, for specific select agents or toxins, and for specific activities. We believe this change will provide more flexibility and guidance to entities seeking to register.

In interim 7 CFR 331.6(d) and 9 CFR 121.7(e), we provided that a certificate of registration may be amended to reflect changed circumstances and that the responsible official must immediately notify APHIS of such changes in circumstances that occur after submission of the application for registration or after receipt of a certificate of registration.

A commenter said that it is unclear how great a change would require notification of APHIS or CDC. The commenter suggested that investigators should instead submit annual reports of projects done and projects planned. Another commenter stated that there is no specific information in the regulations about what information must be reported and what constitutes immediately (i.e., within 24 hours). The commenter indicated that, if the entire registration application must be resubmitted, then APHIS should allow a minimum of 7 to 10 business days.

To clarify the requirements for amending a registration application and a certificate of registration, in this final rule we are deleting the provisions of interim 7 CFR 331.6(d) and 9 CFR 121.7(e). In their place, we are adding a new paragraph (e) in newly designated 7 CFR 331.7 and 9 CFR 121.7 that requires the responsible official to provide prompt notification of any changes in the registration application by submitting the relevant page(s) of the registration application. In addition, we are adding a new paragraph (h) in both sections to require that, prior to any change, the responsible official must apply for an amendment to a certificate of registration by submitting the relevant page(s) of the registration application. Finally, to clarify the requirements for when an entity loses the services of its responsible official, we are adding a new paragraph (i) in both sections to require an entity to immediately notify APHIS or CDC if it loses the services of its responsible official. These paragraphs also provide that an entity may continue to possess or use select agents or toxins only if it appoints as the responsible official another individual who has been approved by the Administrator or the HHS Secretary following a security risk assessment by the Attorney General and who meets the requirements of the regulations.

Interim 7 CFR 331.6(e) and 9 CFR 121.7(f) stated that a responsible official who wishes to discontinue possessing, using, or transferring an agent or toxin may inactivate the agent or toxin or he/she may transfer the agent or toxin to a registered entity. Both sections further provided that APHIS must be notified 5 business days prior to a planned inactivation so that APHIS may have the opportunity to observe the inactivation.

One commenter asked when APHIS will observe the destruction of a select agent. Another commenter asked if a responsible official for a diagnostic laboratory is required to notify APHIS 5 business days prior to destroying a select agent or toxin.

In the final rule, we are deleting these paragraphs and simply providing that a certificate of registration will be terminated upon the written request of the entity if the entity no longer possesses or uses any select agents or toxins and no longer wishes to be registered (newly designated 7 CFR 331.7(j) and 9 CFR 121.7(j)). This change should eliminate any confusion between this reporting requirement and the reporting requirements for diagnostic exemptions.

The regulations (interim 7 CFR 331.6(f) and 9 CFR 121.7(g); newly designated 7 CFR 331.7(k) and 9 CFR 121.7(k)) state that a certificate of registration will be valid for a maximum of 3 years.

A commenter recommended that certificates of registration be valid for 5 years to be consistent with the security risk assessments, simplify paperwork requirements for the entity, and reduce cost to government.

We believe it is reasonable to provide that a certificate of registration will be valid for a maximum of 3 years. A 3-year registration period takes into consideration the burden on the public and the risks posed by select agents and toxins. In addition, it is consistent with APHIS’ permit systems and other established programs for laboratory certification or registration (e.g., Clinical Laboratory Improvement Amendments (CLIA) and the College of American Pathologists (CAP)), which are generally valid for 2 to 3 years. Accordingly, we are making no change based on this comment.

Denial, Revocation, and Suspension of Registration

Interim 7 CFR 331.7(a)(3) and 9 CFR 121.8(a)(3) provided that APHIS may deny an application for registration or revoke registration if the responsible official does not have a lawful purpose to possess, use, or transfer listed agents or toxins. In addition, interim 7 CFR 331.7(a)(4) and 9 CFR 121.8(a)(4) provided that APHIS may deny an application for registration or revoke registration if the responsible official is an individual who handles or uses listed agents or toxins and he/she does not have the necessary training or skills to handle such agents or toxins. To be consistent with CDC, we are deleting these provisions in this final rule.

Interim 7 CFR 331.7(a)(5) provided that APHIS may deny an application for registration or revoke registration if the entity does not meet the containment and security requirements prescribed by the Administrator, while interim 9 CFR 121.8(a)(5) provided that APHIS may deny an application for registration or revoke registration if the entity does not meet the biosafety, containment, and security requirements prescribed by the Administrator. In addition, interim 7 CFR 331.7(a)(6) provided that APHIS may deny an application for registration or revoke registration if there are egregious or repeated violations of the containment or security requirements, while interim 9 CFR 121.8(a)(6) provided that APHIS may deny an application for registration or revoke registration if there are egregious or repeated violations of the biosafety, containment, or security requirements.

In drafting these provisions, we wished to stress to the regulated community the importance of the biosafety, containment, and security requirements. However, we never intended to suggest that an entity did not have to meet the other requirements of each part. Therefore, we are amending these provisions in this final rule to provide that an application may be denied or a certificate of registration revoked or suspended if the individual or entity does not meet the requirements of the applicable part (newly designated 7 CFR 331.8(a)(3) and 9 CFR 121.8(a)(3)). These changes will clarify the registration requirements and make both sections consistent with CDC's regulations.

In addition, in this final rule, we are clarifying the actions an entity must take in the event that APHIS suspends or revokes a certificate of registration. Specifically, we are adding a paragraph to require that, upon notification of suspension or revocation, an individual or entity must: (1) Immediately stop all use of each select agent or toxin covered by the revocation or suspension order; (2) immediately safeguard and secure each select agent or toxin covered by the revocation or suspension order from theft, loss, or release; and (3) comply with all disposition instructions issued by the Administrator for each select agent or toxin covered by the revocation or suspension (newly designated 7 CFR 331.8(b) and 9 CFR 121.8(b)).

In a footnote to interim 7 CFR 331.7(a)(5) and 9 CFR 121.8(a)(5), we indicated that APHIS may provide technical assistance and guidance on the biosafety, containment, and security requirements. A commenter requested information on when and to what degree APHIS will provide such assistance.

As discussed below in the biocontainment/biosafety and security sections, in this final rule we are providing a list of documents in each part that an entity should consider in developing a biocontainment/biosafety or security plan. We recommend that an entity review these documents before contacting APHIS for technical assistance. We will provide technical assistance and guidance upon request.

Interim 7 CFR 331.7(b) and 9 CFR 121.8(b) provided that APHIS may summarily revoke or suspend registration for any of the reasons set forth in each section.

To clarify the provisions for denial, suspension, and revocation of registration, in this final rule, we are deleting interim paragraph (b) in both sections and simply providing that an application may be denied or a certificate of registration revoked or suspended for the reasons set forth in each section (newly designated 7 CFR 331.8(a) and 9 CFR 121.8(a)).

Interim 7 CFR 331.7(d) and 9 CFR 121.9(d) provided that the denial of an application for registration, revocation of registration, and suspension of registration may be appealed under each part. In this final rule, newly designated 7 CFR 331.8(c) and 9 CFR 121.8(c) provide that the denial of an application for registration and revocation of registration may be appealed under each part. Furthermore, both paragraphs provide that any denial of an application for registration or revocation of a certificate of registration will remain in effect until a final agency decision has been rendered. These changes will clarify the status of an application for registration or a certificate of registration during the appeal process.

Responsibilities of the Responsible Official

To facilitate compliance with the regulations, the regulations (interim 7 CFR 331.9 and 9 CFR 121.10; newly designated 7 CFR 331.9 and 9 CFR 121.9) set out the responsibilities of the responsible official.

One commenter stated that the APHIS and CDC regulations should have the same responsibilities for the responsible official and that these responsibilities should be better defined.

We agree that the APHIS and CDC regulations should contain the same provisions for the responsible official. Therefore, in this final rule, we are amending newly designated 7 CFR 331.9(a) and 9 CFR 121.9(a) to require that an individual or entity required to register under each part designate an individual to be the responsible official. Paragraph (a) further requires that the responsible official:

• Be approved by the Administrator or the HHS Secretary following a security risk assessment by the Attorney General;
• Be familiar with the requirements of this part;
• Have the authority and responsibility to act on behalf of the entity;
• Ensure compliance with the requirements of this part; and
• Ensure that annual inspections are conducted for each laboratory where select agents or toxins are stored or used in order to determine compliance with the requirements of this part. The results of each inspection must be documented, and any deficiencies identified during an inspection must be corrected.

In addition, we are deleting the provision for the alternate responsible official(s) from the registration section and adding it to the responsible official section (newly designated 7 CFR 331.9(b) and 9 CFR 121.9(b)). These changes will make the APHIS and CDC regulations consistent.

A commenter recommended that APHIS add the following language to the regulations: “This does not preclude the assignment of activities in §§ 121.10(a)(1) through 121.10(a)(8) to other individuals, provided the activities are performed or supervised by a person approved under § 121.11 and the results are reviewed and approved by the Responsible Official or Alternate Responsible Official.” The commenter stated that it would be inappropriate for the responsible official to participate in the actual transferring of an agent or to perform data entry to maintain records.

In response to this comment, in this final rule we are amending the regulations to provide that the individual or entity required to register under each part, and not the responsible official, must provide training, maintain records, and provide notice of theft, loss, or release of select agents or toxins (newly designated 7 CFR 331.15 and 9 CFR 121.15, 7 CFR 331.17 and 9 CFR 121.17, and 7 CFR 331.19 and 9 CFR 121.19). This change will allow the responsible official to delegate certain responsibilities. For instance, interim 7 CFR 331.14(a) and 9 CFR 121.15(a) stated that the responsible official must maintain complete, up-to-date records of information necessary to give an accounting of all of the activities related to listed agents or toxins. In this final rule, we are amending the regulations to require the individual or entity to maintain such records (newly designated 7 CFR 331.17 and 9 CFR 121.17).

Interim 7 CFR 331.9(b) and 9 CFR 121.10(b) (newly designated 7 CFR 331.9 and 9 CFR 121.9) required the responsible official for a diagnostic laboratory, or other entity possessing, using, or transferring listed agents or toxins that are contained in specimens presented for diagnosis to immediately report the identification of such agents or toxins to the Administrator and to other appropriate authorities when required by Federal, State, or local law. Furthermore, both paragraphs provided that the Administrator may require less frequent reporting during agricultural emergencies or outbreaks, or in endemic areas.

In this final rule, we are amending newly designated 7 CFR 331.9(c) and 9 CFR 121.9(c) to require the responsible official to report the identification and final disposition of any select agent or toxin contained in a specimen for diagnosis or verification. In addition, we are adding a new paragraph (d) to 9 CFR 121.9 to require the responsible official to report the identification and final disposition of any select agent or toxin contained in a specimen presented for proficiency testing. This information will help us to identify outbreaks and to monitor activities related to select agents and toxins.

We are also amending newly designated 9 CFR 121.9(c) to require the responsible official to immediately report the identification of specified select agents and toxins with a report of the final disposition of the agent or toxin due within 7 calendar days after identification. The responsible official must report the identification and final disposition of the other select agents and toxins within 7 calendar days after identification. This will make the reporting requirements for registered entities consistent with those in the exemption sections (newly designated 9 CFR 121.5 and 121.6). Finally, we are deleting in both sections the requirement that the identification of a select agent or toxin be reported to appropriate authorities when required by Federal, State, or local law (interim 7 CFR 331.9(b) and 9 CFR 121.10(b)). This change corresponds to a similar change made in the exemption sections (interim 7 CFR 331.4, 9 CFR 121.4, and 9 CFR 121.5).

One commenter requested clarification of the diagnostic exemptions and the provisions of interim 9 CFR 121.10(b) requiring the responsible official for a diagnostic laboratory to report identifications. The commenter noted that exempt diagnostic laboratories are not required to have a responsible official.

The reporting requirements in interim 9 CFR 121.10(b) (newly designated 7 CFR 331.9(c) and 9 CFR 121.9(c)) pertain to registered diagnostic laboratories. The regulations require that both exempt and registered entities report the identification of a select agent or toxin. We adopted these reporting requirements because this information will help us to identify outbreaks and to monitor activities related to select agents and toxins. Accordingly, we are making no change in response to this comment.

Restricting Access/Security Risk Assessments

Interim 7 CFR 331.10 and 9 CFR 121.11 stated that an individual may not have access to listed agents and toxins unless approved by APHIS or, for overlap agents, APHIS or CDC. Both sections provided that APHIS will grant, limit, or deny access approval and, interim 9 CFR 121.11, provided that APHIS or CDC will make this determination for overlap agents or toxins. Interim 7 CFR 331.10 and 9 CFR 121.11 further provided that the responsible official is responsible for ensuring that only approved individuals within the entity have access to agents or toxins.

In this final rule, we are amending these sections to clarify that an individual must be approved for access by the Administrator or the HHS Secretary following a security risk assessment by the Attorney General (newly designated 7 CFR 331.10 and 9 CFR 121.10). In addition, we are deleting the provision that the responsible official is responsible for ensuring that only approved individuals have access to select agents or toxins. This change will make it clear that the registrant and the individual are responsible for ensuring that the individual does not have access to any select agent or toxin unless approved by the Administrator or the HHS Secretary.

Several commenters requested information about the security risk assessments conducted by the Attorney General.

To obtain a security risk assessment, an individual or entity must submit a completed FBI Form FD-961 and two legible fingerprint cards, printed by a local law enforcement agency, to the Criminal Justice Information Services (CJIS) Division of the Federal Bureau of Investigation. Fingerprint cards and FBI Form FD-961 may be obtained by calling [phone]. FBI Form FD-961 is also available on the Internet at http://www.fbi.gov/​terrorinfo/​bioterrorfd961.htm. It would be impractical to include this information in the regulations because the Attorney General determines the information and processes required for a security risk assessment. Accordingly, we are making no change based on these comments.

One commenter recommended that security risk assessments be completed within 2 weeks. Another commenter stated that a person should be permitted to work with select agents or toxins under the direct supervision of an approved person if the individual subject to the background check suffers a delay in excess of 10 working days.

Security risk assessments are conducted by the Attorney General, not APHIS. The time required to complete a security risk assessment depends on the completeness of the application and the results of the database search. In general, a security risk assessment may be completed in 45 days. However, in certain cases, additional time may be needed to verify the results of the database search. We are making no changes based on these comments.

A commenter asserted that personnel screening should include, at a minimum, a criminal background check, credit check, and random drug screening.

In accordance with the Act, each individual identified by the responsible official must undergo a security risk assessment. The Act does not require a credit check or random drug screening. However, this does not preclude an entity from having more stringent personnel screening for individuals with access to select agents or toxins. Accordingly, we are making no changes based on this comment.

Interim 7 CFR 331.10(b) and 9 CFR 121.11(b) required the responsible official to request access approval for only those individuals who have a legitimate need to handle or use listed agents or toxins, and who have the appropriate training and skills to handle such agents and toxins.

APHIS received a number of comments dealing with the term “access.” A commenter stated that judgments about an individual's need to handle agents and the adequacy of their training and skills is a matter for the responsible official, not APHIS. This commenter recommended that APHIS rely upon the responsible official to make informed judgments about an individual's need for access and their proficiency in handling select agents and toxins. One commenter noted the term “access” is used to describe two distinct situations—access to select agents and toxins by individuals who are authorized to handle and use them, and approved entry to an area where select agents or toxins are present by individuals who are not authorized to handle or use such agents or toxins. Several commenters recommended that APHIS define the term “access” as the “ability to gain physical control of select agents and toxins.” Another commenter suggested the word “access” be changed to “handle or use” throughout the regulations. The commenter noted that many people may have access to a containment space but never handle or use agents or toxins. Similarly, one commenter argued that the regulations are conceptually flawed because they focus on restricting access to the laboratory rather than to the select agent or toxin. The commenter said that numerous individuals need to access lab space for a variety of reasons and that it is unnecessary and burdensome to require that they be continually escorted or undergo security risk assessments. Another commenter recommended that APHIS define the term “entry,” which would refer to admission of unapproved individuals into an area where select agents and toxins are present.

In the December 2002 interim rule, we provided that an individual may not have access to listed agents or toxins unless approved by APHIS or, for overlap agents or toxin, APHIS or CDC. We required access approval for each individual with a legitimate need to handle or use agents or toxins, and the necessary training and skills to handle such agents or toxins. We continue to believe that individuals that handle or use select agents or toxins must be approved for such access. However, we agree with the commenters that access approval should also be required for individuals who have the ability to gain possession. Therefore, this final rule provides that an individual will be deemed to have access at any point in time if the individual has possession of a select agent or toxin (e.g., carries, uses, or manipulates) or the ability to gain possession of a select agent or toxin (newly designated 7 CFR 331.10(b) and 9 CFR 121.10(b)). In addition, we are requiring in both sections that each individual with access to select agents or toxins have the appropriate education, training, and/or experience to handle or use such agents or toxins (newly designated 7 CFR 331.10(c) and 9 CFR 121.10(c)). However, in this final rule, we are removing the requirement that the responsible official submit information about an individual's training and skills to APHIS (interim 7 CFR 331.10(e) and 9 CFR 121.11(e)). These changes will make it clear that the registered individual or entity, and not APHIS, is responsible for ensuring that an individual with access to select agents or toxins has the appropriate education, training, and/or experience to handle such agents or toxins.

Several commenters argued that access approval should be portable from entity to entity, from location to location, and from project to project for the duration of the valid period. A commenter stated that delays in access approval could be avoided if an individual's approval was portable. Another commenter asked if an individual will need a new security risk assessment if he or she has already been cleared at one entity but will visit another entity to conduct research.

We do not believe it is necessary to make an individual's access approval portable in order to avoid delays in such approval. The Administrator or the HHS Secretary may grant access approval to an individual following a security risk assessment by the Attorney General. A security risk assessment may be completed in 45 days unless additional time is needed to verify the database search results. However, in recognition of the need for flexibility for visiting researchers, APHIS, CDC, and the Attorney General have developed procedures by which an approved individual may visit another registered entity without having to undergo another security risk assessment by the Attorney General. Specific guidance on these procedures is available on the Internet at http://www.aphis.usda.gov/​programs/​ag_​selectagent/​index/​html. We note that an individual who ceases to be employed by the entity at which he/she originally received access approval must obtain new access approval through his/her new employer. We are making no changes to the regulations in response to these comments.

A commenter asserted that the L or Q clearances (or their equivalent) granted in Department of Energy laboratories should be considered synonymous with the security risk assessment, and, therefore, approved.

Section 212(e) of the Act requires that registered persons provide access to select agents and toxins to only those individuals that have a legitimate need to handle or use such agents and toxins, and that those individuals undergo a security risk assessment by the Attorney General. The Act provides no exemption for Federal clearances. Accordingly, we are making no change based on this comment.

The regulations (interim 7 CFR 331.10(f) and 9 CFR 121.11(f); newly designated 7 CFR 331.10(e) and 9 CFR 121.10(e)) provide that the access approval process for individuals may be expedited upon request by the responsible official and a showing of good cause.

Several commenters stated that APHIS and the Attorney General should establish timelines for responding to requests for expedited review for security risk assessments.

We do not believe it is necessary to establish timelines for responding to requests for expedited review for security risk assessments. In our experience, an expedited security risk assessment can be completed within a week, barring any complications. Therefore, we are making no change based on this comment.

Another commenter asked what constituted “good cause” for expedited review of access approval. This commenter asserted that Federal clearances should be a reason for expedited review.

This final rule cites several examples of good cause to expedite a security risk assessment (e.g., public health or agricultural emergencies, national security, a short-term visit by a prominent researcher). We do not believe that a Federal clearance alone is sufficient reason to expedite a security risk assessment. Thus, we are making no change in response to this comment.

Interim 7 CFR 331.10(h) and 9 CFR 121.11(h) provided that APHIS may deny or limit access of an individual to agents or toxins if:

• The Attorney General identifies the individual as a restricted person under 18 U.S.C. 175b;
• The Attorney General identifies the individual as reasonably suspected by any Federal law enforcement or intelligence agency of (1) committing a crime set forth in 18 U.S.C. 2332b(g)(5), (2) knowing involvement with an organization that engages in domestic or international terrorism (as defined in 18 U.S.C. 2331) or with any other organization that engages in intentional crimes of violence, or (3) being an agent of a foreign power as defined in 50 U.S.C. 1801;
• The Administrator determines that the individual does not have a legitimate need to handle listed agents or toxins;
• The individual does not have the necessary training and skills to handle listed agents or toxins; or
• The Administrator determines that such action is necessary to protect plant health or plant products, or animal health or animal products.

In this final rule, newly designated 7 CFR 331.10(f) and 9 CFR 121.10(f) provide that an individual's access approval may be denied, limited, or revoked if the individual is a restricted person under 18 U.S.C. 175b or is reasonably suspected by any Federal law enforcement or intelligence agency of committing a crime set forth in 18 U.S.C. 2332b(g)(5), knowing involvement with an organization that engages in domestic or international terrorism (as defined in 18 U.S.C. 2331) or with any other organization that engages in intentional crimes of violence, or being an agent of a foreign power as defined in 50 U.S.C. 1801. This has always been the way these provisions have been interpreted; however, we are making this change to both sections for clarification purposes.

To be consistent with a change made in the section pertaining to denial, revocation, or suspension of registration (newly designated 7 CFR 331.8 and 9 CFR 121.8), in this final rule we are deleting the provision that the Administrator may deny, limit, or revoke an individual's access approval if the individual does not have a legitimate need to handle select agents or toxins. In addition, we are deleting the provision pertaining to an individual's training and skills to be consistent with CDC's regulations.

A commenter stated that limited access, whereby the individual can only handle or use the agent or toxin under the direct supervision of an approved individual, is impractical. The commenter noted that each faculty member, postdoctoral fellow, or student who is a member of a research team is expected to make significant, independent contributions to research; also, it would be too burdensome for institutions to track whether individuals have full or limited access. The commenter stated that provisions for limited access would be unnecessary if the regulations included a precise definition of access.

Section 212(e)(2) of the Act provides for limited access approval. The Administrator will determine what constitutes limited access on a case-by-case basis. The determination will take into consideration all of the facts at hand and be commensurate with the risks posed by the select agent or toxin. We are making no change based on this comment.

One commenter argued that the Attorney General should allow the research community to comment on how the definition of “restricted person” will be interpreted and applied. This commenter stated that, while the Attorney General is bound by statutory language in the respective categories, interpretation will be required to make the definitions operational. For instance, the commenter asked if a scientist who has fled political persecution in another country, and who may therefore have an outstanding foreign arrest warrant, would be considered a restricted person. Another commenter recommended that the Administrator reserve the authority, in exceptional circumstances, to allow individuals deemed ineligible to have access to select agents and toxins for a limited time. The commenter stated that it is in the national interest to take a nuanced approach that takes into account the contributions the individual may be able to make to the country. This commenter stated there should be an opportunity for individuals and their sponsoring institutions to make the argument that an individual has exceptional talent and insight that should be used to advance research, and that an individual does not present a security risk, even if he or she meets the criteria for a restricted person.

The statutory requirements are clear, and it is not necessary for the research community to assist in the interpretation and application of the term ‘restricted person.’ In accordance with the Act, the Administrator may limit or deny access to PPQ and VS select agents and toxins to individuals whom the Attorney General has identified as a “restricted person” under 18 U.S.C. 175b. Furthermore, the Administrator must deny access to overlap select agents and toxins to individuals whom the Attorney General has identified as a “restricted person.” According to 18 U.S.C. 175b, “the term “restricted person” means an individual who:

• Is under indictment for a crime punishable for a term exceeding 1 year;
• Has been convicted in any court of a crime punishable by imprisonment for a term exceeding 1 year;
• Is a fugitive from justice;
• Is an unlawful user of any controlled substance (as defined in section 102 of the Controlled Substances Act (21 U.S.C. 802));
• Is an alien illegally or unlawfully in the United States;
• Has been adjudicated as a mental defective or has been committed to any mental institution;
• Is an alien (other than an alien lawfully admitted for permanent residence) who is a national of a country as to which the Secretary of State, pursuant to section 6(j) of the Export Administration Act of 1979 (50 U.S.C. App. 2405(j), section 620A of chapter 1 of part M of the Foreign Assistance Act of 1961 (22 U.S.C. 2371), or section 40(d) of chapter 3 of the Arms Export Control Act (22 U.S.C. 2780(d)), has made a determination (that remains in effect) that such country has repeatedly provided support for acts of international terrorism; or
• Has been discharged from the Armed Services of the United States under “dishonorable conditions.”

Based on the foregoing, we are making no change in response to this comment.

Interim 7 CFR 331.10(g) and 9 CFR 121.11(g) provided that APHIS will notify the responsible official if an individual is granted full or limited access, or denied access to listed agents or toxins. Both sections further provided that APHIS will notify the individual if he/she is denied access or is granted only limited access.

Several commenters recommended that any entities or individuals denied access to select agents and toxins be notified of the reasons for the denial; otherwise, they are unable to make a meaningful request for an administrative review.

APHIS will provide written notice of any denial, limitation, or revocation of access approval, including the reason(s) therefore. However, since this is an administrative action “taken” by APHIS, it is unnecessary to include this information in the regulations. Accordingly, we are deleting this paragraph in both sections in this final rule.

The regulations (interim 7 CFR 331.10(j) and 9 CFR 121.11(k); newly designated 7 CFR 331.10(h) and 9 CFR 121.10(i)) provide that access approval is valid for a maximum of 5 years.

One commenter recommended that APHIS reconsider the timeframes for renewal of registration packages (3 years) and access approval (5 years). The commenter stated that it would be easier for the regulated community if the renewals were concurrent and could be sent at one time.

In establishing the timeframe for registration, we took into consideration the risks of the select agents and toxins and the fact that APHIS’ permits are valid for a similar timeframe, while, in establishing the timeframe for access approvals, we took into consideration the burden on the public and the fact that the Act allows for approvals to be valid for up to 5 years. We believe that these timeframes are reasonable and consistent with the requirements of the Act. We do not believe that it will be easier for the regulated community if the renewals are concurrent and can be sent at one time. Access approvals are granted by the Administrator or the HHS Secretary on a rolling basis due to frequent staff changes at entities and variations in the time it takes for the Attorney General to conduct an individual's security risk assessment. If APHIS adopted the same timeframe for registration and access approval, it is likely that some individuals in an entity would have to renew their access approvals in a much shorter timeframe than other individuals in the same entity. We believe this would cause undue burden on the public. Accordingly, we are making no changes based on this comment.

The regulations (interim 7 CFR 331.10(k) and 9 CFR 121.11(l); newly designated 7 CFR 331.10(i) and 9 CFR 121.10(j)) require immediate notification when an individual's access to agents or toxins is terminated by the entity and the reasons therefore.

A commenter requested clarification as to what constitutes “immediately.” The commenter stated that large entities would find it difficult to provide written notices within 24 hours. The commenter recommended that APHIS require an initial notification by phone or fax within 72 hours that is followed up by a written notice within 7 business days.

The regulations do not require written notice of a termination of access. Notice of a termination of access may be provided by telephone, fax, or e-mail. We are making no change in response to this comment.

Security

Interim 7 CFR 331.11 required that an individual or entity develop and implement a Biocontainment and Security Plan. Interim 9 CFR 121.12 contained similar requirements for a Biosafety and Security Plan. In both sections, paragraph (a)(2) stated that the security systems and procedures must be designed according to a site-specific risk assessment and provide graded protection in accordance with the threat posed by the agent or toxin. Both sections also set out the types of information that should be contained in the security plan.

A commenter asserted that biological lab security should be administered by only one Federal agency (i.e, the Department of Homeland Security) to ensure consistency.

Section 212(b) of the Act requires APHIS to establish and enforce safeguard and security measure to prevent access to select agents and toxins for use in domestic or international terrorism or for any other criminal purpose. In addition, the Act provides for interagency coordination between APHIS and CDC regarding overlap select agents and toxins. As discussed below, APHIS and CDC have amended the regulations so that the security requirements are identical and APHIS and CDC have established procedures to ensure consistent regulation of select agents and toxins. For these reasons, we are making no change in response to this comment.

A commenter recommended that APHIS and CDC adopt identical security provisions. Several commenters asked whose security, inspection, and compliance standards will be used for overlap agents—APHIS' or CDC's. These commenters also asked what will happen if APHIS and CDC do not concur.

Both the APHIS and CDC select agent regulations apply to overlap select agents and toxins. To eliminate confusion about whose security standards will be used for overlap select agents and toxins, we are amending the security sections in this final rule so that the APHIS and CDC security requirements are identical (newly designated 7 CFR 331.11 and 9 CFR 121.11). These changes are discussed in detail below. We believe these changes will help to ensure consistent regulation of select agents and toxins by APHIS and CDC, including compliance inspections. We note that compliance inspections for security will be based on the regulations and that inspectors will be looking for security that provides graded protection commensurate with the risk of the select agent or toxin, given its intended use.

Several commenters expressed concern that the regulations do not provide for preclearance of security plans before an entity invests in a security system.

In this final rule, we recommend that an individual or entity consider the following document when developing a security plan—“Laboratory Security and Emergency Response Guidance for Laboratories Working With Select Agents,” in Morbidity and Mortality Weekly Report. An individual or entity should review this document before contacting APHIS for technical assistance. We will provide technical assistance and guidance upon request. However, in recognition of the commenters' concerns, we note that APHIS and CDC are working with interagency groups and security experts to draft a document that will provide additional guidance about the security required for select agents and toxins. This document will be available in spring 2005. We will provide this guidance document to the regulated community when it is available.

A commenter stated that the regulations should clearly distinguish between lab security and entity security, especially for large academic settings where a secure lab may coexist with educational and research labs.

We disagree. The security regulations are designed to prevent unauthorized access, theft, loss, or release of select agents and toxins. The regulations require that an entity's security plan be designed according to a site-specific risk assessment. Such a risk assessment would take into consideration the security needed for a select agent lab in a large academic setting. Therefore, we are making no change based on this comment.

One commenter asked what constituted an adequate description of safety and security in the required plans. Another commenter asked who will judge the adequacy of a security plan.

A security plan must be sufficient to safeguard the select agent or toxin against unauthorized access, theft, loss, or release. APHIS or CDC will determine if a security plan is adequate. We are making no changes in response to these comments.

The introductory text in interim 7 CFR 331.11(a)(2) and 9 CFR 121.12(a)(2) stated that the security systems and procedures must be designed according to a site-specific risk assessment and must provide graded protection in accordance with the threat posed by the agent or toxin. Both sections further provided that the site-specific risk assessment should involve a threat assessment and risk analysis in which threats are defined, vulnerabilities examined, and risks associated with those vulnerabilities identified. Both sections also stated that the security systems and procedures must be tailored to address site-specific characteristics and requirements, ongoing programs, and operational needs and must mitigate the risks identified.

A commenter suggested replacing the phrase “in accordance with the threat posed by the agent” with the phrase “in accordance with the consequences posed by the agent or toxin.” Another commenter pointed out that the terms “risk assessment,” “threat assessment,” “vulnerability assessment,” and “threats” are confusing to those with little experience in this area and should be clarified. A commenter suggested that APHIS replace the phrase “risks associated with those vulnerabilities are mitigated” with the phrase “consequences associated with those vulnerabilities are mitigated.”

In response to these comments, in this final rule we are deleting this text in both sections and adding in its place the requirement that an entity's security plan be sufficient to safeguard the select agent or toxin against unauthorized access, theft, loss, or release (newly designated 7 CFR 331.11(a) and 9 CFR 121.11(a)). In addition, we are amending both sections to require that the security plan be designed according to a site-specific risk assessment and provide graded protection in accordance with the risk of the select agent or toxin, given its intended use. We believe these changes will clarify the requirements and make the text in this section consistent with other sections in the regulations (e.g., biocontainment/biosafety).

One commenter recommended that entities be required to comply with Appendix F of the BMBL as well as the specific USDA manuals cited in the rule. The commenter stated that this would mandate the use of state-of-the-art approaches for safety and security. A commenter stated that the security regulations are inadequate (i.e., key locks and key control) and recommended that the pathogens be secured with a modern access control system. Another commenter stated that the regulations should specify minimum security standards. The commenter recommended the following: (1) A minimum of three levels of access control (e.g., access to the building, access to the wing of the building, and access to the laboratory); (2) a minimum of two levels of access control with video surveillance; (3) a minimum of one level of access control with security personnel; and (4) a minimum of one level of access control with an alarm system with off-site monitoring.

On the other hand, several commenters recommended a performance standard for compliance with the regulations. One commenter stated that Appendix F of the BMBL does not provide appropriate guidance for developing a performance-based security program because it implies the need for a rigorous security program applicable uniformly to all biosafety levels. The commenter noted that overly prescriptive requirements will impede the development of effective and affordable plans and will result in constraining the availability of select agents and toxins for the legitimate purposes specified in the Act. Another commenter stated that toxins should not be subject to the same biocontainment and security measures as viruses, bacteria, fungi, and plant pathogens (which are capable of replication). The commenter suggested a two-tiered approach, with a higher level of security and biocontainment for materials that can be propagated. Similarly, a commenter stated the security requirements should recognize that not all listed agents are equal from a weaponization perspective; therefore, a set of graded protection requirements should be established so that the most dangerous pathogens and the most likely to be weaponized are protected at higher levels than the majority of the select agents.

Because different select agents and toxins pose differing degrees of risk, we believe it would be counterproductive to attempt to prepare a detailed list of prescriptive requirements for entities (i.e., a “one size fits all” design standard). Therefore, the regulations contain performance standards for biocontainment/biosafety, security, and incident response that take into account the risks presented by a particular agent or toxin, given its intended use.

With regard to security, newly designated 7 CFR 331.11 and 9 CFR 121.11 require each individual or entity required to register under each part to develop and implement a written security plan. This security plan must be designed according to a site-specific risk assessment and must provide graded protection in accordance with the risk of the select agent or toxin, given its intended use. In addition, newly designated 7 CFR 331.11 and 9 CFR 121.11 require the individual or entity to adhere to specified security requirements or implement measures to achieve an equivalent or greater level of security. We believe these security provisions provide enough flexibility and specificity to allow an individual or entity to develop and implement a security plan that will safeguard the select agent or toxin against unauthorized access, theft, loss, or release.

However, in recognition of the commenters' concerns, we reiterate that APHIS and CDC are working with interagency groups and security experts to draft a document that will provide additional guidance about the security required for select agents and toxins. This document will be available in spring 2005. The 5th edition of the BMBL, which is under development, will provide additional guidance on laboratory security.

Interim 7 CFR 331.11(a)(2)(iii) and 9 CFR 121.12(a)(2)(iii) required that the security plan describe, among other things, cybersecurity.

One commenter recommended that the term cybersecurity be replaced with “information and cybersecurity.” The commenter also recommended spelling out the assets that should be protected and how they are to be protected.

In this final rule, we are amending these provisions by removing the word “cybersecurity” and adding in its place the words “information systems control” (newly designated 7 CFR 331.11(c)(1) and 9 CFR 121.11(c)(1)). This change is consistent with changes made throughout this final rule to ensure that information about select agents and toxins is protected.

Interim 7 CFR 331.11(a)(2)(iv) and 9 CFR 121.12(a)(2)(iv) provided that, with respect to areas containing listed agents or toxins, an entity or individual must adhere to the specified security requirements or implement measures to achieve an equivalent or greater level of security.

Two commenters requested clarification of the term “area” with regard to large multi-use laboratories. One commenter stated there is little benefit in terms of security to require access control, specialized training, and personnel background checks for individuals who are only sharing lab space with individuals working with select agents or toxins. Another commenter suggested that the regulations should be flexible enough to allow local solution of this issue (i.e., allowing the entity to designate a portion of the lab as a select agent area for which use and entry restrictions would be governed by the regulations). A commenter recommended that, where labs are used intermittently for select agent research, free access be permitted when select agents and toxins are not in use and when the agents/toxins are secured in a safe or other secured storage.

As previously noted, the security requirements are designed to prevent unauthorized access, theft, loss, or release of select agents and toxins. We believe the regulations provide enough flexibility for an entity to determine the best way to accomplish this goal. However, since the term “area” appears to be confusing, in this final rule we are deleting the phrase “with respect to areas containing listed agents or toxins” (newly designated 7 CFR 331.11(d) and 9 CFR 121.11(d)).

Interim 7 CFR 331.11(a)(2)(iv)(A) and 9 CFR 121.12(a)(2)(iv)(A) stated that an entity must allow unescorted access only to those approved individuals who are performing a specifically authorized function during hours required to perform that job.

In its final rule, CDC is amending the comparable provision in its rule in response to comments. To be consistent with CDC's regulations, we are making a corresponding change in this final rule. Specifically, we are amending both sections to provide that an entity may allow access only to individuals with access approval from the Administrator or the HHS Secretary (newly designated 7 CFR 331.11(d)(1) and 9 CFR 121.11(d)(1)).

Interim 7 CFR 331.11(a)(2)(iv)(B) and 9 CFR 121.12(a)(2)(iv)(B) required that individuals who are not approved under §§ 331.10 or 121.11, respectively, be allowed to conduct routine cleaning, maintenance, repairs, and other non-laboratory functions only when escorted and continually monitored.

A commenter requested clarification of the terms “escorting” and “continually monitored.”

These terms are commonly understood and do not require further clarification in the regulations. However, upon further review, we are amending these provisions to make it clear that an individual who is not approved for access by the Administrator or the HHS Secretary may conduct routine cleaning, maintenance, repairs, and other activities not related to select agents or toxins only when continuously escorted by an approved individual (newly designated 7 CFR 331.11(d)(2) and 9 CFR 121.11(d)(2)).

Interim 7 CFR 331.11(a)(2)(iv)(C) and 9 CFR 121.12(a)(2)(iv)(C) required entities and individuals to control access to containers where listed agents and toxins are stored by requiring that such containers be locked when not in the direct view of an approved individual and by using other monitoring measures, as needed.

One commenter stated that the phrase, “when not in direct view of an approved individual,” implies that these areas do not need to be secured when an authorized person is present, and that this is inappropriate. The commenter said that an area containing select agents should be secure at all times and that only authorized persons should have access to a freezer. The commenter stated that an individual should not bear the burden of being responsible for the security of the freezer. Another commenter argued that this requirement is unnecessarily stringent and is not feasible in many labs. This commenter recommended that the agent or toxin be under the direct control of an individual, meaning that an unauthorized person could approach the agent or toxin without coming into the view of approved staff. A commenter stated there is no need to require locked containers. The commenter noted that a freezer that is located outside an access-controlled area should be locked, while a freezer that is located inside such an area need not be locked.

We agree that containers where select agents and toxins are stored must be secured against unauthorized access at all times. Accordingly, we are amending both sections to state that an entity must control access to containers by requiring that freezers, refrigerators, cabinets, and other containers be secured against unauthorized access (newly designated 7 CFR 331.11(d)(3) and 9 CFR 121.11(d)(3)).

Interim 7 CFR 331.11(a)(2)(iv)(D) and 9 CFR 121.12(a)(2)(iv)(D) required the inspection of all packages upon entry and exit.

Several commenters stated that it is not practical to require inspection of all packages upon entry and exit, that doing so provides almost no security value, and that doing so may be unsafe. One commenter asked if the requirement applied to packages of agents being shipped/received or if it applied to briefcases, backpacks, etc. Another commenter asked if sharps containers or Petri dishes must be inspected.

We agree that it is not practical to require inspection of all packages upon entry and exit. Therefore, in this final rule, we are amending both sections to require that an entity inspect all suspicious packages before they are brought into or removed from an area where select agents or toxins are used or stored (newly designated 7 CFR 331.11(d)(4) and 9 CFR 121.11(d)(4)).

Interim 7 CFR 331.11(a)(2)(iv)(E) and 9 CFR 121.12(a)(2)(iv)(E) required an entity to establish a protocol for intra-entity transfers, including provisions for ensuring that the packaging and movement is conducted under the supervision of an approved individual.

A commenter stated that the requirement for a protocol for intra-entity transfers is vague and inadequate. The commenter suggested that intra-entity movement of select agents should follow a documented chain of custody process that minimizes any possibility of diversion.

We agree. Therefore, in this final rule, we are amending both sections to require entities to establish a protocol for intra-entity transfers, including chain of custody documentation and provisions for ensuring that packaging and movement is conducted under the supervision of an individual with access approval from the Administrator or the HHS Secretary, including chain-of-custody documents and provisions for safeguarding against theft, loss, or release (newly designated 7 CFR 331.11(d)(5) and 9 CFR 121.11(d)(5)). This change is consistent with the recordkeeping requirements in newly designated 7 CFR 331.17 and 9 CFR 121.17.

To be consistent with CDC's regulations, we are adding a new paragraph (d)(8) in 7 CFR 331.11 and 9 CFR 121.11 that requires an individual or entity to separate areas where select agents and toxins are stored or used from the public areas of the building.

One commenter stated that the BMBL and NIH Guidelines require labs to post biohazard signs on access doors that list the agents present in the lab, which may compromise lab security.

In this final rule, 9 CFR 121.12 (Biosafety) provides that an individual or entity should consider the BMBL and NIH Guidelines when developing a biosafety plan. However, it is the entity's responsibility to determine if posting biohazard signs on access doors would compromise lab security. We are making no change based on this comment.

Biocontainment/Biosafety

Interim 7 CFR 331.11 required individuals and entities to develop and implement a Biocontainment and Security Plan that is commensurate with the risk of the agent or toxin, given its intended use. It also required that the containment procedures be sufficient to contain the agent or toxin (e.g., physical structure and features of entity, and operational and procedural safeguards). Interim 9 CFR 121.12 contained similar requirements for a Biosafety and Security Plan.

In this final rule, newly designated 7 CFR 331.12 requires that an individual or entity develop and implement a written biocontainment plan that is commensurate with the risk of the select agent or toxin, given its intended use. Newly designated 9 CFR 121.12 contains similar requirements for a biosafety plan. The titles and provisions of the plans are different because the select agents and toxins listed in 7 CFR 331.3 do not pose a severe threat to human health and, therefore, it is unnecessary to require that the plant-related plan address personnel safety and health.

Several commenters stated that the biosafety section in the final rule should reference existing Department of Health and Human Services guidelines and current Occupational Safety and Health Administration (OSHA) regulations as authoritative codes of practice that entities should consider in developing and implementing a performance-based safety plan. On the other hand, several commenters urged APHIS and CDC to develop joint biosafety guidelines for select agents that would supplant the BMBL and NIH Guidelines.

In this final rule, we are retaining the existing performance standard but we are providing a list of references that an individual or entity should consider in developing its biocontainment/biosafety plan (newly designated 7 CFR 331.12(c) and 9 CFR 121.12(c)). This change should provide more guidance on acceptable biosafety practices.

Restricted Experiments

In interim 9 CFR 121.10(c), we provided that the responsible official must ensure that the following experiments are not conducted unless approved by the Administrator, after consultation with experts: (1) Experiments utilizing recombinant DNA that involve the deliberate transfer of a pathogenic trait or drug resistance trait to biological agents that are not known to acquire the trait naturally, if such acquisition could compromise the use of the drug to control disease agents in humans, veterinary medicine, or agriculture; and (2) experiments involving the deliberate formation of recombinant DNA containing genes for the biosynthesis of toxins lethal for vertebrates at an LD₅₀<100 ng/kg body weight.

We adopted this provision in the December 2002 interim rule in order to be consistent with CDC and to address concerns about laboratory manipulation of microbes that alter their characteristics (e.g., increased virulence, pathogenicity, or host range; alter mode of transmission or route of transmission) and increase the risks to human, animal, or plant health. At the time, we did not believe it was necessary to require approval for experiments involving recombinant DNA of PPQ select agents because these experiments are regulated under 7 CFR part 340. However, we are adding this provision to 7 CFR part 331 in this final rule to ensure that these experiments are covered and to provide consistency in the select agent regulations.

To facilitate compliance with these requirements, in this final rule we are moving these provisions to a new section in each part titled, “Restricted experiments” (7 CFR 331.13 and 9 CFR 121.13, respectively), and we are adding a footnote to both sections that indicates that guidance on the requirements for experiments involving recombinant DNA may be obtained from the publication, “NIH Guidelines for Research Involving Recombinant DNA Molecules.” Moreover, 7 CFR 331.13 provides that these experiments must be conducted under conditions prescribed by the Administrator, and that the Administrator may revoke approval to conduct these experiments, or suspend or revoke a certificate of registration, if the individual or entity fails to comply with the requirements of that part. A corresponding provision in 9 CFR 121.13 provides for consultation with the HHS Secretary. This has always been the way we have interpreted all of these requirements; however, we are adding these provisions to both sections for clarity.

One commenter stated that the inclusion of the words “pathogenic trait” establishes an additional class of experiments that require approval from the Administrator. The commenter recommended that the APHIS and CDC requirements be identical.

We agree. Accordingly, we are deleting the words “pathogenic trait” in both sections of this final rule (newly designated 7 CFR 331.13(a)(1) and 9 CFR 121.13(a)).

One commenter stated that the regulations should be amended to refer to the NIH Guidelines rather than list the types of experiments that are restricted in the regulations. The commenter noted that the NIH Guidelines are subject to change and the regulations would not be as current as the guidelines and more difficult to amend, if necessary.

One of the reasons APHIS included these provisions in the regulations was to ensure that these categories of experiments are conducted only if safe to do so. By including these provisions in the regulations, we are providing notice to the public and establishing enforceable regulatory requirements. APHIS would have difficulty enforcing the provisions of the NIH Guidelines. If it becomes necessary to revise the list of restricted experiments, we will initiate rulemaking and provide notice and opportunity for public comment. For these reasons, we are making no change based on this comment.

A commenter suggested that the NIH recombinant advisory committee be designated to review the restricted experiments.

We do not believe it is necessary to designate the NIH recombinant advisory committee to review applications to conduct restricted experiments. The Administrator of APHIS will approve such experiments after consultation with subject matter experts and, for overlap select agents and toxins, CDC. Accordingly, we are making no changes based on this comment.

One commenter stated that interim 9 CFR 121.10(c)(1) (newly designated § 121.13(a)) is open to interpretation and, therefore, needs to be more specific. This commenter also suggested that the restricted experiment provisions should contain an exception for small scale in vitro experiments.

We disagree that this provision needs to be more specific. However, we note that additional guidance on the requirements for experiments involving recombinant DNA may be obtained from APHIS or the NIH Guidelines. We also disagree that the restricted experiment provisions should contain an exemption for small scale in vitro experiments. APHIS included these provisions in the regulations to ensure that these experiments are conducted only if safe to do so. The commenter provided no information to indicate that small scale in vitro experiments are safe and, therefore, should be exempted from the restricted experiment provisions. Accordingly, we are making no changes in response to this comment.

A commenter stated that an entity utilizes the deliberate formation of antibiotic resistance as a common research tool and that the restricted experiments provisions will limit this standard research practice. The commenter noted that transposon insertion libraries are common experimental creations used to generate gene knockouts and study the effect on expression and phenotype; however, this often results in an array of genomes containing antibiotic resistance markers used for selection and screening. The commenter argued that this common practice should not need approval and that it is too burdensome on the entity to obtain approval for each of several thousand insertional mutants that would be created for a single genome.

As previously noted, APHIS included these provisions in the regulations to ensure that these experiments are conducted only if safe to do so. We believe the manipulation of a select agent in order to create antibiotic resistance increases the risks to human, animal, or plant health and, therefore, warrants APHIS’ approval. We are making no change based on this comment.

Incident Response

In interim 7 CFR 331.11(a)(3) and 9 CFR 121.12(a)(3), we required that the Biocontainment and Security Plan/Biosafety and Security Plan include incident response plans for containment breach, security breach, inventory violations, non-biological incidents such as workplace violence, and cybersecurity breach. These plans were required to address personnel safety and health, containment, inventory control, and notification of managers and responders. In addition, the plans were required to address bomb threats, severe weather (floods, hurricanes, tornadoes), earthquakes, power outages, and other natural disasters or emergencies.

A commenter stated that the requirements for APHIS' incident response plan and CDC's emergency response plan should be the same.

We agree. Therefore, the revised incident response sections in this final rule (newly designated 7 CFR 331.14 and 9 CFR 121.14) are consistent with the incident response section in CDC's final rule. In this final rule, we are adding the CDC requirement that an incident response plan must be coordinated with any entity-wide plans. To ensure that such plans are available for review by an entity's employees, we are also requiring that the plans be kept in the workplace and made available to employees for review. In addition, as described below in response to a request for clarification of the term “incidents,” we are clarifying the types of incidents and information that must be included in the plan. Finally, we are adding the CDC requirement that the response procedures account for the hazards associated with the select agent or toxin and appropriate actions to contain such agent or toxin.

A commenter requested clarification of the term “incidents.” In this final rule, newly designated 7 CFR 331.14 and 9 CFR 121.14 require that the incident response plan fully describe the entity's response procedures for theft, loss, or release of a select agent or toxin, inventory discrepancies, security breaches (including information systems), severe weather and other natural disasters, workplace violence, bomb threats and suspicious packages, and emergencies such as fire, gas leak, explosion, power outage, etc.

One commenter stated that the reference to “inventory control” is ambiguous and needs to be defined.

We agree that the term “inventory control” is not clear. Therefore, we are deleting the reference to inventory control in this final rule. However, we are retaining the requirement that an incident response plan describe the entity's response procedures for inventory discrepancies.

Training

Interim 7 CFR 331.12 (newly designated § 331.15) required the responsible official to provide appropriate training in containment and security procedures to all individuals with access to listed agents and toxins, while interim 9 CFR 121.13 (newly designated § 121.15) required the responsible official to provide appropriate training in biosafety, containment, and security procedures to all individuals with access to listed agents and toxins. Both sections required the responsible official to provide information and training to an individual at the time the individual is assigned to work with a listed agent and toxin, and to provide refresher training annually.

A commenter requested clarification about the training requirements. This commenter wondered what would be considered appropriate training, what qualifications an individual would need to train others, and who decides if the training is adequate. Another commenter recommended that APHIS revise the training provisions to require training for approved individuals working with select agents and toxins and unapproved individuals working in or visiting areas where select agents and toxins are handled or stored. The commenter suggested that such training may be modified according to the needs of the individual, the work they will do, and their potential exposure. A commenter noted that APHIS’ training requirements cover fewer staff than CDC's training requirements (i.e., only those individuals handling the agents or toxins). The commenter recommended that the APHIS and CDC requirements be consistent.

In response to these comments, in this final rule we are amending both sections to require that an individual or entity provide information and training on biocontainment/biosafety and security to each individual with access approval from the Administrator or the HHS Secretary before he/she has such access (newly designated 7 CFR 331.15(a) and 9 CFR 121.15(a)). We are also requiring that an individual or entity provide training to each individual not approved for access by the Administrator or the HHS Secretary before he/she works in or visits areas where select agents or toxins are handled or stored (e.g., laboratories, growth chambers, animal rooms, greenhouses, storage areas, etc.). The training must address the particular needs of the individual, the work they will do, and the risks posed by the select agents or toxins. Finally, refresher training must be provided annually (newly designated 7 CFR 331.15(b) and 9 CFR 121.15(b)). These changes will make the APHIS and CDC regulations consistent. We note the training should be provided by an individual who has the appropriate training and skills. APHIS will determine if an individual's training is adequate.

One commenter recommended that APHIS adopt the CDC provisions in interim 42 CFR 73.13(d) that allows an entity to certify that personnel have been trained.

In interim 42 CFR 73.13(d), CDC provided that, in lieu of initial training for those individuals already involved in handling select agents or toxins, the responsible official may certify that an individual has the required knowledge, skills, and abilities to safely carry out the duties and responsibilities. CDC included this provision to minimize the disruption of research or educational projects that were under way as of the effective date of the December 2002 interim rule. CDC is deleting this provision in its final rule. For this reason, we are making no change based on this comment.

Transfer of Biological Agents and Toxins

Interim 7 CFR 331.13 and 9 CFR 121.14 (newly designated 7 CFR 331.16 and 9 CFR 121.16) set out the transfer requirements and procedures. In this final rule, we are amending newly designated 7 CFR 331.16 and 9 CFR 121.16 to clarify the transfer provisions. Specifically, we are amending both sections by providing that, in addition to any permit required under the regulations, a transfer of a select agent or toxin may be authorized if: (1) The sender has a certificate of registration that covers the agent or toxin to be transferred and meets the requirements of each part, meets the exemption requirements for the select agent or toxin to be transferred, or is transferring the select agent or toxin from outside of the United States and meets all import requirements, and (2) at the time of transfer, the recipient has a certificate of registration that includes the select agent or toxin to be transferred and meets all of the requirements of each part (newly designated 7 CFR 331.16(b) and 9 CFR 121.16(b)). This information was contained in the interim rule but the final rule more clearly sets out the requirements for the sender and recipient. We are also amending the transfer provisions in 9 CFR 121.16 to provide that a select agent or toxin contained in a specimen for proficiency testing may be transferred without prior authorization from APHIS or CDC provided that, at least 7 calendar days prior to the transfer, the sender reports to APHIS or CDC the select agent or toxin to be transferred and the name and address of the recipient. This change, in conjunction with the reporting requirements for identifications of select agents or toxins in 9 CFR 121.5, 121.6, and 121.9, will allow us to more effectively monitor proficiency testing activities.

In addition, we are amending both sections to provide that the recipient must immediately notify APHIS or CDC if a package containing a select agent or toxin has been damaged to the extent that a release of the select agent or toxin may have occurred (newly designated 7 CFR 331.16(f) and 9 CFR 121.16(g)). These changes will make the APHIS and CDC regulations consistent.

Both sections (newly designated 7 CFR 331.16(g) and 9 CFR 121.16(h)) also provide that an authorization for a transfer shall be valid only for 30 calendar days after issuance, except that such an authorization becomes immediately null and void if any facts supporting the authorization change (e.g., change in the certificate of registration for the sender or recipient, change in the application for transfer). This change is intended to ensure timely transfers of select agents and toxins and provide notice to the public that APHIS may terminate a transfer authorization under certain circumstances.

One commenter stated that the regulations should provide for transfer of agents and toxins from an unregistered entity to a registered entity to prevent destruction of valuable historical, archival, and educational materials.

We agree. Accordingly, in this final rule, we are amending the transfer provisions in interim 7 CFR 331.13 and 9 CFR 121.14 to provide that, on a case-by-case basis, the Administrator may authorize a transfer of a select agent or toxin, not otherwise eligible for transfer under each part, under conditions prescribed by the Administrator (newly designated 7 CFR 331.16(c) and 9 CFR 121.16(c)).

One commenter maintained that APHIS should permit hand-carried transfers of select agents or toxins with the same reporting requirements already described in the regulations.

Given the risks posed by select agents and toxins, we do not believe that hand-carried transfers of such agents or toxins is consistent with the intent of the Act. By prohibiting hand-carried transfers, we ensure that select agents or toxins are packaged appropriately and that there is documentary evidence of the transfer (e.g., tracking numbers, confirmation of delivery, etc). We are making no changes based on this comment.

One commenter stated that the requirement that APHIS or CDC approve transfers between entities is highly likely to produce unreasonable delays. The commenter suggested that the regulations be revised to require that APHIS respond within an appropriate interval (e.g., 1 to 2 days).

We do not expect the transfer requirements in the regulations to produce unreasonable delays. The requirement for approval prior to a transfer of a select agent or toxin is not a new requirement, nor is it unreasonable given the risks posed by select agents or toxins. The transfer requirements for select agents and toxins incorporate the permit requirements under the plant pest regulations in 7 CFR part 330 and the organisms and vectors regulations in 9 CFR part 122, which require APHIS’ approval prior to transfer. We are making no changes based on this comment.

A commenter asserted that the transfer provisions are incompatible with biosecurity. The commenter stated that they require the principal investigator to prohibit access to the material up to the point of shipment, after which the package is handled by a host of individuals out of the control of the responsible official or the principal investigator. Several commenters expressed concern about the U.S. Department of Transportation's labeling requirements for packages containing select agents or toxins. These commenters pointed out that the labeling requirements clearly indicate which packages should be stolen. One commenter recommended eliminating the requirement for external labeling. This commenter also recommended adding tamper-indicating procedures in the packaging so that the recipient would know the package had been tampered with.

These issues are outside the scope of this rulemaking. Accordingly, we are making no changes based on these comments.

Records

Interim 7 CFR 331.14 and 9 CFR 121.15 required the responsible official to maintain complete, up-to-date records of information necessary to give an accounting of all of the activities related to listed agents and toxins. Such records must be maintained for 3 years and produced upon request to APHIS inspectors and appropriate Federal, State, and local law enforcement authorities.

A commenter stated that the requirements for inventory records of select agents are unclear. The commenter pointed out that research labs generate and destroy material on a daily, if not hourly, basis. The commenter wondered if the inventory requirement pertained to stock collections or to all infectious materials generated. Another commenter stated that keeping track of vials is a waste of Federal resources.

We agree that the requirements for inventory records are unclear. To provide clarification and to be consistent with CDC's approach, in this final rule the inventory recordkeeping requirements in both parts (newly designated 7 CFR 331.17 and 9 CFR 121.17) require the maintenance of an accurate, current inventory for each select agent held in long-term storage (placement in a system designed to ensure viability for future use, such as in a freezer or lyophilized materials) and for each toxin held. The provisions for select agents and toxins are different to account for the differences between select agents and toxins; we do not believe it is feasible to record quantities of replicating organisms (i.e., select agents). In addition, we are providing more information about the types of information that must be included in the inventory records for each select agent or toxin. For example, an inventory for a select agent must include the name and characteristics of the agent, the quantity acquired from another entity, where stored, when moved from storage and by whom, purpose of use, transfer records, etc., while an inventory for a toxin must include the name and characteristics of the toxin, the quantity acquired from another entity, the initial and current quantity, where stored, when moved from storage and by whom, transfer records, etc.

Interim 7 CFR 331.14(a)(4) and 9 CFR 121.15(a)(4) required an individual or entity to maintain accurate and current inventory records (including source and characterization data).

One commenter recommended that APHIS define the terms “characterization data” and “accurate.” To clarify the term “characterization data,” in this final rule we are providing examples of the characterization information that should be maintained by the entity for each select agent (e.g., strain designation, GenBank Accession number, etc.). The term “accurate” is commonly defined as free from mistakes or errors. We do not believe it is necessary to define this term in the regulations.

A commenter suggested that all records should be marked and protected at the “Official Use Only” level.

To be consistent with CDC's regulations, in this final rule newly designated 7 CFR 331.17 and 9 CFR 121.17 require an entity to implement a system to ensure that all records and databases created under each part are accurate, have controlled access, and can be verified for authenticity. We do not believe it is necessary to require that an entity mark and protect all of its records at the “Official Use Only” level to satisfy this requirement. Therefore, we are not implementing this suggestion.

One commenter suggested that all transfer forms be securely stored for 5 years, instead of 3 years. Taking into consideration the burden on the public and APHIS’ investigational needs, we believe that it is reasonable to require that all records, including transfer forms, be maintained for 3 years. Accordingly, we are making no change based on this comment.

Inspections

Interim 7 CFR 331.15(a) provided that any APHIS inspector must be allowed, without previous notification, to enter and inspect the entire premises, all materials and equipment, and all records required to be maintained by the regulations, while interim 9 CFR 121.16(a) contained a similar provision for APHIS or CDC inspectors.

To be consistent with CDC's regulations, newly designated 7 CFR 331.18(a) and 9 CFR 121.18(a) provide that APHIS, without prior notification, must be allowed to inspect any site at which activities regulated under each part are conducted and must be allowed to inspect and copy any records relating to the activities covered under each part.

Interim 7 CFR 331.15(b) provided that, prior to issuing a certificate of registration, APHIS may inspect and evaluate the premises and records to ensure compliance with the regulations and the biosafety, containment and security requirements. Interim 9 CFR 121.16(b) contained a similar provision for APHIS or CDC inspectors.

In this final rule, we are removing the phrase “and the containment and security requirements” (newly designated 7 CFR 331.18(b)) and removing the phrase “and the biosafety, containment, and security requirements” (newly designated 9 CFR 121.18(b)). These phrases are unnecessary since we already state in both sections that, prior to issuing a certificate of registration, APHIS may inspect and evaluate an entity's premises and records to ensure compliance with the regulations.

A commenter requested additional information about compliance inspections. In particular, the commenter asked what level of training and security clearances would be required for inspectors and whether there would be separate inspectors to assess the biosafety and security requirements. The commenter also asked what standards will be used by the inspectors to assess compliance with the regulations.

APHIS inspectors will have the appropriate training and security clearances (at least a security risk assessment) to inspect and evaluate an entity's premises and records to ensure compliance with the regulations. APHIS inspectors will use the standards established in the regulations and published guidelines (e.g., BMBL) to determine compliance. While we expect that, normally, only one inspector will be needed to conduct an inspection, occasionally more than one inspector may be needed to evaluate an entity's biosafety, containment, and security.

APHIS and CDC will coordinate inspections to minimize the burden on the entity. This coordination will ensure that inspections by APHIS and CDC are not duplicative. However, additional inspections may be required under certain circumstances. For instance, another inspection may be required for amendments to a certificate of registration (e.g., addition of a laboratory) or to satisfy APHIS’ permit requirements.

Notification in the Event of Theft, Loss, or Release

Interim 7 CFR 331.16(a) and 9 CFR 121.17(a) required the responsible official to orally notify APHIS and appropriate Federal, State, or local law enforcement agencies immediately upon discovery of a theft or loss of listed agents or toxins. We also required that the oral notification be followed by a written report within 7 days. In this final rule, newly designated 7 CFR 331.19(a) and 9 CFR 121.19(a) provide that thefts or losses must be reported to APHIS or CDC. In addition, these paragraphs clarify that thefts or losses must be reported even if the select agent or toxin is subsequently recovered or the responsible parties are identified. These changes will make the APHIS and CDC regulations consistent. Finally, we are specifying the information that must be reported to APHIS or CDC (newly designated 7 CFR 331.19(a) and 9 CFR 121.19(a)). We believe this change will clarify the requirements for notification of theft or loss of select agents and toxins.

Interim 7 CFR 331.16(b) and 9 CFR 121.17(b) provided that the responsible official must orally notify APHIS immediately upon discovery that a release of a listed agent or toxin has occurred outside the biocontainment area. We also required that the oral notification of a release be followed by a written report within 7 days. The regulations further provided that APHIS will notify relevant Federal, State, and local authorities, and the public, if necessary. In § 121.17(b), we additionally provided that, if the release involves an overlap agent or toxin, we will also notify the Secretary of Health and Human Services.

In this final rule, newly designated 7 CFR 331.19(b) requires that APHIS or CDC be notified immediately upon discovery of a release of a PPQ select agent or toxin outside the primary barriers of the biocontainment area while 9 CFR 121.19(b) requires that APHIS or CDC be notified immediately upon discovery of a release of a VS or overlap select agent or toxin causing occupational exposure or a release outside the primary barriers of the biocontainment area. The requirement for notification of a release outside of the primary barriers of the biocontainment area is a clarification. This is how we have always interpreted the provision regarding release outside the biocontainment area; however, we are making this change to make it clear to the public. In 9 CFR 121.19(b), we are adding the provision for occupational exposure to be consistent with CDC's regulations. We did not include this provision in 7 CFR 331.19 because PPQ select agents and toxins do not pose a severe threat to human health and, therefore, it is unnecessary to address personnel safety and health. In both sections, we are also specifying the information that must be reported to APHIS or CDC. We believe these changes will clarify the requirements for notification of a release.

Finally, we are deleting the provision that APHIS will notify relevant Federal, State, and local authorities, and the public in the event a release poses a threat to animal health or animal products. This is an administrative action taken by APHIS and it is unnecessary to include this information in the regulations.

A commenter requested clarification of the term “unintentional release.” The commenter stated that it can be interpreted to include any exposure or release at any biosafety level.

The term “unintentional release” is not used in either the interim regulations or this final rule. Therefore, we are making no change based on this comment.

Several commenters urged APHIS to exempt from notification those accidents (i.e., releases) that take place entirely within biosafety labs where the select agent is being handled at the appropriate biosafety level. One commenter went on to state that an exposed worker may be so concerned about needing to report an accident to APHIS that he or she may decide not to inform anyone of a potential exposure, resulting in an immediate risk to the person and a possible risk to the population.

Given the risks associated with select agents and toxins, we believe it is necessary to be notified of all occupational exposures. It is the entity's responsibility to ensure that its employees comply with these reporting requirements. For these reasons, we are making no changes based on these comments.

Administrative Review

Interim 7 CFR 331.17 and 9 CFR 121.18 provided that an individual or entity may appeal a denial or revocation of registration. In addition, these sections provided that an individual who has been denied access to listed agents or toxins or who has been granted only limited access to listed agents or toxins may appeal that decision. Both sections set out the process for an administrative review.

In this final rule, the administrative review sections also provide that an individual or entity may appeal the suspension of registration. This provision was included in the sections on denial, revocation, and suspension of registration (interim 7 CFR 331.7 and 9 CFR 121.8) but was inadvertently not included in interim 7 CFR 331.17 and 9 CFR 121.18 (newly designated 7 CFR 331.20 and 9 CFR 121.20). In addition, we are amending both sections to allow an individual to appeal revocation of access approval. This change corresponds to a change in newly designated 7 CFR 331.10 and 9 CFR 121.10 that allows revocation of an individual's access approval in the event that an individual becomes a restricted person under 18 U.S.C. 175b or is reasonably suspected by any Federal law enforcement or intelligence agency of committing a crime set forth in 18 U.S.C. 2332b(g)(5), knowing involvement with an organization that engages in domestic or international terrorism (as defined in 18 U.S.C. 2331) or with any other organization that engages in intentional crimes of violence, or being an agent of a foreign power as defined in 50 U.S.C. 1801.

A commenter stated that the final rule should include provisions for entities and individuals to appeal security risk assessment decisions or seek exemptions for legitimate research.

The regulations already allow an individual who has been denied access to select agents or toxins or who has been granted only limited access to such agents or toxins to appeal that decision (interim 7 CFR 331.17 and 9 CFR 121.18; newly designated 7 CFR 331.20 and 9 CFR 121.20). However, in accordance with the Act, an entity may not appeal the denial or limitation of an individual's access to select agents or toxins. The regulations do not provide exemptions for research. However, we note that an individual's access to PPQ select agents or toxins and VS select agents or toxins may be limited or denied if an individual is a restricted person under 18 U.S.C. 175b. In addition, an individual's access to PPQ select agents or toxins, VS select agents or toxins, or overlap select agents or toxins may be limited or denied if an individual is reasonably suspected by any Federal law enforcement or intelligence agency of committing a crime set forth in 18 U.S.C. 2332b(g)(5), knowing involvement with an organization that engages in domestic or international terrorism (as defined in 18 U.S.C. 2331) or with any other organization that engages in intentional crimes of violence, or being an agent of a foreign power as defined in 50 U.S.C. 1801. For these reasons, we are making no changes based on this comment.

Miscellaneous

We are also making minor, nonsubstantive changes to the regulations to correct misspellings and internal references, reflect changes to the form numbers, ensure a consistent format in both parts, and eliminate redundancy.

Therefore, for the reasons given in the interim rule and in this document, we are adopting the interim rule as a final rule, with the changes discussed in this document.

This final rule also affirms the information contained in the interim rule concerning Executive Orders 12372 and 12988.

Effective Date

For the reasons discussed in the Supplementary Information section of this rule, we have determined that it is no longer necessary to include Phakopsora pachyrhizi (Asian soybean rust) and plum pox potyvirus on the list of PPQ select agents and toxins. Therefore, this final rule amends 7 CFR 331.3(b) by removing P. pachyrhizi and plum pox potyvirus from that list. Making these amendments to 7 CFR 331.3(b) effective immediately will relieve restrictions we no longer find warranted and aid ongoing research into effective means of managing Asian soybean rust in the United States. Pursuant to the provisions of 5 U.S.C. 553, we have determined that this aspect of the final rule relieves restrictions and thus may be made effective less than 30 days after publication in the Federal Register. Accordingly, the Administrator of the Animal and Plant Health Inspection Service has determined that the amendments made to 7 CFR 331.3(b) in this rule should be effective upon signature. The remaining provisions of this final rule will become effective 30 days after date of the rule's publication in the Federal Register.

Executive Order 12866 and Regulatory Flexibility Act

This rule has been reviewed under Executive Order 12866. The rule has been determined to be significant for the purposes of Executive Order 12866 and, therefore, has been reviewed by the Office of Management and Budget.

For this rule, we have prepared an economic analysis. The economic analysis provides a cost-benefit analysis, as required by Executive Order 12866, as well as an analysis on the potential economic effects of this final rule on small entities, as required under 5 U.S.C. 603. The economic analysis is summarized below. Copies of the full analysis are available by contacting the person listed under FOR FURTHER INFORMATION CONTACT.

Background

Certain pathogens or toxins produced by biological organisms that are released intentionally or accidentally can result in disease, wide-ranging and devastating impacts on the economy, disruption to society, diminished confidence in public and private institutions, and large-scale loss of life.

The Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Pub. L. 107-188), provides for the regulation of certain biological agents ^[1] and toxins ^[2] that have the potential to pose a severe threat to public health and safety, to animal health, to plant health, or to animal and plant products. The Act also requires that the Secretary of Agriculture establish and enforce standards and procedures governing the possession and use of the listed biological agents and toxins, including the establishment and enforcement of safety requirements for the transfer of listed agents and toxins; the establishment and enforcement of safeguard and security measures to prevent access to listed agents and toxins for use in domestic or international terrorism or other criminal purpose; and the establishment of procedures to protect animal and plant health, and animal and plant products, in the event of a transfer in violation of the established safety and security measures. APHIS has the primary responsibility for implementing the provisions of the Act within USDA. VS select agents and toxins are those that have been determined to have the potential to pose a severe threat to animal health or animal products. PPQ select agents and toxins are those that have been determined to have the potential to pose a severe threat to plant health or plant products. Overlap select agents and toxins are those that have been determined to pose a severe threat to public health and safety, to animal health, or to animal products. Overlap select agents and toxins are subject to regulation by both APHIS and CDC, which has the primary responsibility for implementing the provisions of the Act for the Department of Health and Human Services.

Benefits of the Rule

This rule will require registration, biocontainment/biosafety, incident response and security measures for the possession, use, and transfer of the select agents and toxins listed in 7 CFR part 331 and 9 CFR part 121. This rule is intended to prevent the misuse of those select agents and toxins, and will therefore reduce the potential for those pathogens to harm humans, animals, animal products, plants or plant products in the United States. Should any select agent or toxin be intentionally introduced into the United States, the consequences would be significant. Some of these select agents have the potential to cause ailment and death in humans. Direct losses in agriculture could occur as a result of the exposure, such as death or debility of affected production animals, or yield loss in plants. Industry could also be affected through the imposition of domestic and foreign quarantines, which result in a loss of markets. The Federal and State Governments would also incur costs associated with eradication and quarantine enforcement to prevent further spread, and in the case of intentional introduction—law enforcement. In addition, there is the potential for a disruption in the domestic food supply, whether through contamination, consumer perception, or both. Past food safety incidents have shown that consumer perceptions (both domestic and international) about an implicated food product and about the producing country or sector's ability to produce safe food are slow to recover and can have a lasting influence on food demand and global trade.^[3] As such, the benefits associated with the rule are the avoided losses to the animals or plants that could be attacked by these organisms, and their products and markets.

The costs associated with outbreaks can be very high as is demonstrated by natural outbreaks associated with select agents that have occurred. For example, it has been estimated that the losses to agriculture and the food chain from the recent foot-and-mouth disease (FMD) outbreak in the United Kingdom (UK), including the costs compensated by the government, amount to about £3.1 billion ($4.7 billion). In 1999, it was estimated that the potential impacts of an FMD outbreak in California alone would be between $8.5 and $13.5 billion.^[4] Also, a bovine spongiform encephalopathy (BSE) crisis occurred in the UK (which has a cattle industry about one-tenth the size of that in the United States) in 1996. It has been estimated ^[5] that the total resource costs to the UK economy as a result of BSE in the first 12 months after the onset of the 1996 crisis were in the range of £740 million to £980 million ($1.2 billion to $1.5 billion), or just over 0.1 percent of the gross domestic product of the United Kingdom. In addition to these losses, the UK lost its entire export market for beef following the crisis.

The above cited consequences relate to natural or accidental introduction. Deliberate introduction greatly increases the probability of an agent or toxin becoming established and causing wide-ranging and devastating impacts on the economy, disruption to society, diminished confidence in public and private institutions, and possible loss of life. The perpetrators would have the advantage of controlling the time of introduction of the agent, introducing agents into remote or highly susceptible areas, multiple introductions of the same agent, or simultaneous release of different agents. Intentional introductions permit an increased probability of survival of a pathogen, the use of highly virulent strains and high concentrations of inoculum, and precise timing of release to coincide with maximal colonization potential.^[6]

Costs of the Rule

The rule is intended to ensure that any entity that possesses, uses or transfers a select agent or toxin is registered and has safeguard, containment, and disposal requirements that are commensurate with the risk of that agent or toxin. Affected entities vary widely, and therefore, the biosafety/biocontainment, incident response and physical security situation will vary widely from one entity to another, as will the specific changes that will need to occur at a given entity to comply with this rule.

Affected Entities

Entities that possess, use, or transfer VS, PPQ or overlap select agents or toxins will be affected by this rule. Because of the nature of some of these entities and some of the select agents or toxins they possess, APHIS and CDC share common regulatory authority. However, APHIS and CDC have established procedures that will allow an entity to interact with only one agency—either APHIS or CDC—with respect to all matters involving select agents and toxins. This analysis considers only those entities for which APHIS is considered the primary regulatory agency.^[7]

The affected entities are primarily research and diagnostic facilities. They include Federal, State, and university laboratories, and private commercial and non-profit enterprises. Currently, there are 76 ^[8] academic, commercial, State and Federal government facilities that have applied for a certificate of registration from APHIS for PPQ, VS, and/or overlap agents and toxins. Approximately 34 percent of these entities are academic, 37 percent are private commercial enterprises, 28 percent are government, and 1 percent are non-profit.

The level of security at the entities that possess, use or transfer select agents and toxins is currently very diverse, ranging from a locked freezer to a lock on the door to razor wire perimeter fencing, a guard post, locks or coded entry, and visitor escorts.

Exemptions and Exclusions From the Rule

A number of exclusions and exemptions from the rule exist that reduce the number of entities that otherwise might have been affected by this rule. For example, nonviable select agents and nonfunctional toxins are excluded from the requirements of this rule. Some attenuated strains of a select agent or toxin may be excluded based on a determination that the strain does not pose a severe threat to animal health or to animal products. In addition, overlap toxins are excluded if they are under the control of a principal investigator, treating physician or veterinarian, or commercial manufacturer or distributor and the aggregate amount does not, at any time, exceed certain amounts.

In addition, a number of exemptions also exist. In particular, exemptions cover diagnostic laboratories and others when select agents and toxins contained in a specimen are presented for diagnosis or verification and proficiency testing. Diagnostic reagents and vaccines that are, bear, or contain VS select agents or toxins that are produced at USDA diagnostic facilities are also exempt from the requirements. For the most part, products that are, bear, or contain VS or overlap select agents or toxins are exempt from the requirements if the products have been cleared, approved, licensed, or registered under a number of Federal statutes. Experimental products and investigational products can also be exempted.

In addition, the Administrator may grant exemptions from the applicability of the regulations as they apply to VS or PPQ select agents and toxins if the Administrator determines that such exemptions are consistent with protecting animal or plant health, or animal or plant products. While an entity will not be exempt if it keeps a positive control of a select agent or toxin, alternatives will exist. If an entity decides to keep a positive control of a select agent or toxin, it will have to register and may need to make changes to its operations in order to do so.

Those not specifically exempted have to submit an exemption application if they wish to become exempt. Thus far, APHIS has received 34 exemption applications, and anticipates receiving an additional one per year. It is estimated that applying for an exemption requires 1.17 hours (0.17 managerial hours at $86.09 per hour ^[9] , and 1 technical hour at $69.34 per hour), or $84 per exemption application. Based on the number of exemption applications received, the total initial cost is estimated to have been $2,900, while the yearly cost for new applicants would be about $100. Exemptions are valid for a maximum of 3 years; therefore the costs of applying for an exemption would recur every 3 years.

Remaining exempt under this rule will require the submission of the proper paperwork dealing with identifications and the transfer or destruction of select agents and toxins. Registered diagnostic laboratories will also be required to report identifications of select agents and toxins when presented for diagnosis. The number of these identifications can vary widely in a given year, climbing dramatically when outbreaks occur. However, during agricultural emergencies or outbreaks, or in endemic areas, the Administrator may require less frequent reporting. APHIS expects to receive an average of 1,000 notifications of identifications from diagnostic laboratories in a given year. It is estimated that complying with the notification requirements will require 1 hour (0.17 managerial hours and 0.83 technical hours), or $72 per notification. Based on 1,000 notifications, the estimated total cost is $72,000 per year.

Registration

Under this rule, unless exempted an individual or entity shall not possess, use, or transfer any select agent or toxin without a certificate of registration issued by APHIS or CDC. The registration process is designed to obtain critical information concerning individuals or entities in possession of certain agents or toxins, as well as the specific characteristics of the agents and toxins. Information to determine that individuals and entities seeking to register have a lawful purpose to possess, use, or transfer agents or toxins will also be required as part of the registration process. This will involve security risk assessments by the Criminal Justice Information Services (CJIS) Division of the Federal Bureau of Investigation, and collecting and providing the required information. The checks will require that individuals provide identifying information. In addition, this information will need to include fingerprints. It is estimated that this cost will be $5 to $30 per set for those done on paper. It may cost up to $50 per set for electronic prints, but these could be processed far more quickly. A given entity could expect to spend between $50 and $5000 obtaining and submitting fingerprints, with between 10 and 100 employees needing fingerprints per entity. To the extent that there is staff turnover at an entity, these costs could be recurring. With a total of 2,300 security risk assessments to be performed initially, and an average fingerprinting cost of $27.50 per individual, the total cost of obtaining fingerprints would be $63,250. With 1,300 new assessments to be performed yearly, the annual cost of obtaining fingerprints could be expected to be $37,750. APHIS may request the Attorney General to expedite an individual's security risk assessment upon request by the responsible official and a showing of good cause. APHIS expects to receive 20 of these requests initially and 13 a year thereafter. These requests are expected to take 0.5 managerial hours, or $43 per occurrence. This gives a total cost of $1,000 in the first year, and $560 a year thereafter.

It is estimated that it will take a total of 3 managerial hours and 0.75 technical hours for a complete form with one principal investigator (PI) plus 0.75 technical hours per additional PI. Affected entities have between 1 and 9 PIs.^[10] It is, therefore, estimated to take 3 managerial hours and between 0.75 and 6.75 technical hours to complete the registration package, at a cost of between $310 and $726 per entity. Based on the number of PIs at the 76 entities currently applying for registration, the total cost of registration is estimated to be $29,000. APHIS expects to receive 8 new applications for registration in a given year, with a total cost of $3,300 per year. It is estimated that 75 percent of entities will amend their registrations twice in a given year. These amendments are estimated to take 1 managerial hour, or $86 per amendment. Based on 76 registrations this gives a cost of $9,800. In addition, because registrations will be valid for up to 3 years, re-application will be required.^[11] It is estimated that re-applying for registration will require 3 hours with one PI (2.67 managerial hours and between 0.33 and 2.97 technical hours) or $253 to $436 per entity to collect and provide the required information. The total cost of re-application is estimated at $21,000 every 3 years based on the 76 entities currently applying for registration, and the number of PIs at the entities.

As a condition of registration, an individual or entity must develop and implement a written security plan that provides graded protection in accordance with the risk of the select agent or toxin, given its intended use. The plan must describe inventory control procedures, physical security and information systems control. The individual or entity must also develop and implement a written biosafety/biocontainment plan that is commensurate with the risk of the agent or toxin, given its intended use. It is estimated that the development of the biosafety/biocontainment plan may take 20 managerial hours and 40 technical hours at a given entity for a cost of $4,500. However, many entities will already have this type of plan in place and in writing. For example, under the plant pest permit system, standard operating procedures at an entity are already required to be submitted. Also, university safety officers generally require that safety requirements be in writing. If we conservatively assume that one-half of the 76 affected entities need to develop these plans the total cost would be $171,000. The development of the physical security plan would most likely take place as a part of the site-specific entity security assessment required under the rule (see Security).

As a further condition of registration, an individual or entity must develop and implement a written incident response plan. The incident response plan must fully describe the entity's response procedures for releases, theft or loss of a select agent or toxin, inventory discrepancies, security breaches (including information systems), severe weather and other natural disasters, workplace violence, bomb threats and suspicious packages, and emergencies such as fire, gas leak, explosion, power outage, etc. The response procedures must account for hazards associated with the select agent or toxin and appropriate actions to contain such agent or toxin. It is estimated that the development of the incident response plan may take 10 managerial hours and 25 technical hours at a given entity for a cost of $2,600. However, many entities will already have similar plans in place and in writing, i.e., as part of compliance with health and safety regulations. If we conservatively assume that one-half of the 76 affected entities need to develop these plans, the total cost would be $99,000.

Transfer

Under this rule, select agents and toxins may only be transferred to individuals or entities registered to possess, use, or transfer that particular agent or toxin. However, the sender may be an individual or entity exempt from the requirements of this rule, or an individual or entity located outside the United States. In addition, APHIS may authorize transfers for select agents or toxins that would not otherwise be eligible for transfer. Transfer must occur only with prior authorization, notification of receipt by the recipient, and notification of overdue or damaged shipments. APHIS expects there to be a total of 130 transfers in a given year. It is estimated that complying with the transfer requirements will require 1.75 hours (0.17 managerial hours and 1.58 technical hours), or $124 for each transfer. This gives a total cost of $16,000 per year.

Biosafety/Biocontainment

Biosafety and containment requirements ensure that the combination of work practices and physical containment are designed to reduce the risks of working with infectious material and the degree of protection is proportional to the risk associated with the agent. Higher biosafety levels (BSL) correspond to greater degrees of protection. For example, at a BSL-3 laboratory, more emphasis is placed on primary and secondary barriers to protect personnel in contiguous areas, the community, and the environment from exposure to potentially infectious aerosols. Also, because there is special concern for reducing the risk of environmental exposure to pathogens of concern to agriculture, BSL-3-Ag adds filtration of supply and exhaust air, sewage decontamination, exit personnel showers, and entity integrity testing. While the BSL terminology is not formally used in relation to laboratories working with plant agents or toxins, a parallel philosophy of matching pest risk to biocontainment is used in the plant pest permit system. Under this rule, the biosafety and containment procedures at an entity must be sufficient to contain the agent or toxin (e.g., physical structure and features of the entity, and operational and procedural safeguards).

Acquiring adequate biosafety and containment measures can be costly. For example, as a result of work related to anthrax testing at APHIS' National Veterinary Services Laboratories, a portion of the laboratories' air handling system had to be replaced at a cost of $75,000. However, the biosafety and containment requirements contained in this rule should require little change at affected entities. USDA permits ^[12] cover the importation and interstate movement of agents and toxins. Prior to the implementation of the December 2002 interim rule, these permits already required the biosafety and containment level to be commensurate with the risk associated with the pathogen covered in the permit. Therefore, to the extent that affected entities are already permittees, the biosafety and containment requirements in this rule will have already been required at those entities. Before the enactment of the Act, there may have been entities operating legally outside the permit system, but who are not exempt from this rule. The rule may involve additional biosafety or containment burdens for those entities, but the extent of these burdens cannot be estimated.

Security

The rule will require that any entity where select agents and toxins are held adequately provide for the physical security of the premises. These requirements are intended to ensure the appropriate levels of protection against, theft or loss of select agents or toxins, and other acts that may cause unacceptable adverse impacts on national security or on the health of the public or the environment. The security systems and standard operating procedures must be sufficient to safeguard the select agent or toxin against unauthorized access, theft, or loss. The security systems and standard operating procedures must be designed according to a site-specific risk assessment and must provide graded protection in accordance with the risk of the select agent or toxin, given its intended use.

The costs of providing security at entities where the select toxins and agents are held can be considerable. USDA has recently upgraded, or is currently upgrading, security at a number of its own entities, including laboratories. While these costs are not a result of this rule, they are illustrative of the spending that can be necessary to upgrade security. By department policy, all USDA biosafety level 3 (BSL-3) laboratories are required to meet physical security requirements. The level of security mandated in this policy meets or exceeds the levels required in this rule. For example, upgrades at NVSL in Ames, IA were completed in 2002 at a cost of $550,077 ($6.63/ft2, 83,000ft ² total area). Installations of electronic security components can include closed circuit television (CCTV) (cameras, VCR, and control equipment), intrusion detection system (IDS) (access-control card-readers, card-keys, operating computer and software), all cabling associated with the security system, and integrating the system with the off-site monitoring. Other security related expenses that could be needed at a given entity following an entity security assessment include entry control equipment (x-ray, metal detectors). Other features would entail yearly recurring costs (i.e., off-site monitoring, an equipment maintenance agreement, and guard service).

The security systems and standard operating procedures must be designed according to a site-specific risk assessment. This site-specific risk assessment is completed to determine the existing security status and needs of a specific entity. The cost of a security assessment of a laboratory is based largely on the required expertise and would be somewhat dependant on the size of the entity. At APHIS laboratories these assessments have ranged from $17,000 to $25,000 per location.^[13] Many affected entities will have had entity security assessments done in another context prior to the interim rule on select agents and toxins, or will need far less extensive and therefore expensive assessments.

Electronic security may need to be a major part an entity's physical security. Based on average actual security system installations for APHIS facilities, a cost per square foot for electronic security upgrades was developed.^[14] The security needs and existing systems at these entities varied. The matrix cost per square foot includes: CCTV; IDS; integration; perimeter protection; design; construction; and construction management, but not biometric technology. The cost per square foot assumes single story entities and has been adjusted for laboratory type entities. For buildings under 80,000 ft2 the average cost/ft ² is $8.71. In addition, there is an adjustment factor for retrofitting existing buildings. It should be noted that for very small entities, the cost/ft ² can be considerably higher.^[15] It should also be noted that these costs per ft ² are based on security installations of state-of-the-art technology. In addition to the entity security assessment and access control discussed above, a given entity could need none, some, or all of the following to maintain its physical security. Entry control equipment includes x-ray—small unit ($28,000 per unit), x-ray—large unit ($40,000 per unit), and metal detector(s) ($20,000 per unit). Other features would entail yearly recurring costs. Off-site monitoring ($10,000 to $45,000 per year); an equipment maintenance agreement ($12,000 to $30,000 per year); and guard service—unarmed ($30.00/hr per security post), armed ($35.00/hr per security post), and a supervisor ($40.00/hr).^[16] Following September 11, 2001, more comprehensive security packages have been (or will be) added to APHIS facilities including many of these additional features. There are, however, alternatives to the specific services that can greatly reduce costs and could be acceptable depending on the security needs of a given entity, e.g., remote monitoring and response to alarms instead of on-site guard service. Also, an entity may have some or all of the services already included in an overall facility operational and maintenance plan. An example would be a laboratory holding select agents or toxins that is part of an academic institution where support services are already incurred by the academic institution, e.g., campus police for security response.

Because security needs are site-specific and the rule allows for site-specific security solutions, the approaches and applications will be varied. The above physical security components, and others, may have to be added in various quantities (including none) to meet the specific security needs of an entity. The entities covered in this rule can and do vary from a small laboratory contained within a larger facility to large dedicated buildings to large groups of buildings and land. Small laboratories in larger buildings are unlikely to need access controlled gates, a security fence, or even guard service (although a university or commercial entity may already have a security force which would be considered in assessing security needs). Larger entities will inevitably have more and different security needs than small ones. These entities naturally have more points of access and are more likely to need features such as fences or gates to control access. In addition, the costs themselves are very site specific; there can be literally hundreds of variables that will influence cost at a specific site. The variation begins with the needs of the individual entity (views of which can differ from administration, scientist, and physical security points of view) and is influenced by the characteristics of the site—for example, linked areas are in different buildings, on opposite sides of a fire wall, etc. Generally labor for installation (approximately $96/hour in Washington, DC for installation work on electronic access control) ^[17] is the most expensive and variable cost of these systems.

A review of 20 security plans of registered entities gives an indication of the nature of security present at affected entities. It also gives an indication of the nature of improvements to security that have occurred since the implementation of the interim rule, or are planned, or will need to occur at affected entities. All showed a good base of security. In fact, a number require no improvement under this rule. Improvements that have already occurred or have been recommended include installing intrusion detection systems, installing or expanding CCTV surveillance, card-key access control and standard locks. Often an entity's standard operating procedures for security sufficiently serve in place of a limited number or lack of electronic controls. Because many of the affected entities deal with select agents or toxins in an area that is fully contained in a larger structure, the lack of entry control equipment may not affect the level of graded protection. It should also be noted that only that portion of a given entity affected by select agent or toxin operations is required to be secured under this rule. On average, academic entities had 5,560 square feet, commercial entities 2,894 square feet, and government entities 4,848 square feet to be secured.^[18]

This rule will require that all information resources related to select agents and toxins have an appropriate level of protection in the system that is used to acquire, store, manipulate, manage, move, control, display, switch, interchange, receive or transmit that information. Most affected entities have a variety of compelling reasons, including regulatory requirements,^[19] for already protecting information.

Other Costs

All individuals with access to select agents or toxins are required to have the appropriate education, training and/or experience to handle or use such agents or toxins. In addition, additional training may be needed to familiarize staff with changes resulting from the rule. This requirement may necessitate that affected entities provide additional training. It is not known the extent to which training may be needed at affected entities, and therefore the cost of providing that training is not known. However, the National Center for Import and Export (NCIE) within APHIS Veterinary Services has a laboratory biosafety class to train inspectors. In FY 2002, APHIS spent $35,480 on participant and speaker travel, speaker honoraria, and equipment and supplies to train 18 inspectors, or about $2,000 each. If we assume that each of affected entities will have similar expenditures, and must train 25 individuals ^[20] the training cost would be $50,000 per entity or $3.8 million for all 76 entities. It should be noted that most of the APHIS training cost is in travel. To the extent that training at affected entities can occur on-site, the cost per individual could be reduced.

The rule requires that a registered entity maintain complete records concerning activities related to select agents or toxins. This includes an accurate, current inventory for each select agent held in long-term storage. It is estimated that it would take eight technical hours to complete an inventory of a freezer containing select agents or a toxin container. Assuming that there are on average 10 freezers, and 3 toxin containers at a given registered entity, it would cost $7,200 per entity to create this baseline inventory. Based on 76 registered entities, the baseline inventory would cost a total of $548,000. The inventory will have to be verified periodically. Assuming that the registered entities would have to re-inventory one-half of their freezers each year to maintain an accurate and current inventory, yields a yearly inventory cost of $274,000.

Other record keeping includes copies of the biosafety/biocontainment, security and incident response plans, a list of individuals with access to select agents and toxins, training records, inventory records, permits and transfer documents, security records, and incident reports. It is estimated that complying with the record keeping requirements will require 10 hours per PI (3 managerial and 7 technical hours per PI), between 10 and 90 hours per entity per year or $745 to $6,700 per entity. The total cost of yearly record keeping is estimated to be $132,000 based on the current number of affected entities, and the number of PIs at those entities.

The rule also requires oral notification immediately upon discovery of the theft or loss of select agents or toxins, followed by a written report within 7 days. This is also the requirement for the discovery that a release of a select agent or toxin has occurred outside of the containment area of the entity. APHIS expects there to be two notifications of theft, loss or release in a given year. It is estimated that complying with these theft, loss and release notification requirements will require one hour (0.17 managerial hours and 0.83 technical hours), or $72 for each occurrence, for a total cost of $144 per year. It is assumed that an incident of theft or loss will also require a thorough inventory of the affected storage freezer or toxin container, at a cost of $560 per occurrence, for a yearly total of $1,120.

An individual or entity may appeal a denial, revocation, or suspension of registration under this part. An individual may appeal a denial, limitation, or revocation of access approval under this part. APHIS expects there to be one appeal in a given year. It is estimated that complying with the appeal requirements will require 2 managerial hours and 2 technical hours, or $311 for each occurrence.

Another potential cost of the rule is on the pace and quantity of research on select agents and toxins. If an entity chooses not to continue work with select agents or toxins to avoid the expenditures that will be required as a result of this rule, the impact on the progress of scientific knowledge is unknown and likely unknowable. However, the consequences of not securing select agents and toxins could be extreme.

Costs to APHIS

The rule will also involve costs to APHIS. The rule will require the government to process entity registrations, notifications of identification of agents and toxins, exemption applications, transfer applications, theft/loss notifications and appeals, perform inspection and compliance activities, provide technical assistance for compliance to affected entities, develop and maintain a database covering select agents and toxins, develop and maintain a secure space for the database, and obtain security clearances. The FY2004 budget for the APHIS select agent and toxin program is $4.3 million. User fees to offset government costs will not be collected by APHIS under this rule.

Potential Impact of This Rule

Approximately 70 percent of research & development (commercial and non-profit laboratories dealing with human, animal and/or plant agents), biological (except diagnostic) manufacturing, diagnostic manufacturing, pharmaceutical manufacturing, and other private establishments affected by this rule have fewer than 20 employees, and another 15 percent have between 20 and 49 employees.^[21] Plant laboratories (Federal, commercial, State, and academic) tend to be very small, with fewer than 10 individuals having access to select agents or toxins. Veterinary diagnostic laboratories (commercial, State or university) and university research laboratories likely have fewer than 100 employees.^[22] Federal entities covered by the rule will be affected by the registration requirements but should not have to make alterations due to the biosafety, containment and security requirements of the rule.

The portion of an affected entity where select agents or toxins are handled and that needs to be secure tends to be small. A review of 20 security plans of registered entities show an average of 4,449 ft² to be secured. Seventy percent of the entities have less than 5,000 ft² to be secured, 20 percent between 5,000 and 10,000 ft² to be secured, and 10 percent more than 10,000 ft² to be secured.^[23]

For the purpose of assessing the impact of the security requirements of the rule, we make the following assumptions based on the available information:

• 70 percent of affected entities have an area to be secured of approximately 5,000 ft²,
• 20 percent of affected entities have an area to be secured of approximately 7,500 ft²,
• 10 percent of affected entities have an area to be secured of approximately 15,000 ft², and
• Because entities will have varying levels of existing security, security needs, and methods of meeting those needs, the average security upgrades in APHIS facilities is used as a proxy for upgrades at these entities. (The proxy is based on upgrading to state-of-the-art equipment, which may or may not be used at a given entity).

Using an average budget estimate for upgrading the electronic portion of a security system and the average area to secure by type of entity, we get estimates of the budget necessary to make these upgrades. Based on a budget estimate of $10.25/square foot,^[24] an entity with 5,000 ft² to secure by installing electronic security countermeasures would need to budget $51,250, an entity with 7,500 ft² to secure would need to budget $76,875, and one with 15,000 ft² to secure would need to budget $153,750.

To obtain an aggregate cost estimate we apply these budget estimates based the size distribution of those entities. Applying a budget cost of $51,250 to the 70 percent of affected entities that have 5,000 ft² to secure gives a cost of $2.7 million. Applying a budget cost of $76,875 to the 20 percent of affected entities that have 7,500 ft² to secure gives a cost of $1.2 million. Applying a budget cost of $153,750 to the 10 percent of affected entities that have 15,000 ft² to secure gives a cost of $1.2 million.

It should be noted that as indicated above, utilizing APHIS” costs as a proxy implies that all entities have baseline levels of electronic security similar to that of APHIS facilities and will upgrade to state-of-the-art technology. However, a review of security plans at affected entities shows that an upgrade state-of-the-art systems is not necessary or likely in most cases. Therefore, this proxy likely overstates the true cost of electronic security at these entities.

In addition to electronic security, an entity could need none, some, or all of the following:

• Entity security assessment, including developing a security plan as per the rule. Assuming that the 70 percent of entities with less than 5,000 ft² to secure spend $17,000, the 20 percent with between 5,000 and 10,000 ft² to secure spend $21,000, and the 10 percent with more than 10,000 ft² to secure spend $25,000 on these assessments gives a total cost of $1.4 million.
• Entry control equipment; includes x-ray—small unit ($28,000 per unit), x-ray—large unit ($40,000 per unit), and metal detector(s) ($20,000 per unit). Based on available information, we assume that 8 affected entities would need to add entry control equipment as a result of this rule. We further assume that each of those entities would spend an average of $30,000 on that equipment for a total cost of $240,000.
• Off-site monitoring can range from $10,000 to $45,000 per year. Assuming that the 70 percent of entities with less than 5,000 ft² to secure spend $10,000, the 20 percent with between 5,000 and 10,000 ft² to secure spend $27,500, and the 10 percent with more than 10,000 ft² to secure spend $45,000 on this off-site monitoring gives a total cost of $1.3 million.
• Equipment maintenance agreements can range in cost from $12,000 to $30,000 per year. Assuming that the 70 percent of entities with less than 5,000 ft² to secure spend $12,000, the 20 percent with between 5,000 and 10,000 ft² to secure spend $21,000, and the 10 percent with more than 10,000 ft² to secure spend $30,000 on these maintenance agreements gives a total cost of $1.2 million.
• Guard Service. Unarmed ($30.00/hr per security post), armed ($35.00/hr per security post), and a supervisor ($40.00/hr). When the site-specific security needs call for guards, it is the presence of a guard that is the most important factor. Therefore, unarmed guards would most likely be used. At most, a given entity would need a single unarmed guard on duty 24 hours a day. The majority of affected entities will rely on off-site monitoring, campus or local police, or existing guard presence. Therefore, we assume that the 70 percent of entities with less than 5,000 ft² to secure would add no additional guard service, the 20 percent with between 5,000 and 10,000 ft² to secure would add an additional guard 12 hours per day at a cost of $135,050 per year, and the 10 percent with more than 10,000 ft² to secure would add an additional guard 24 hours per day at a cost of $270,100 per year, giving a total annual cost of $814,000.^[25]

This rule will involve other costs to the regulated community. It is estimated that complying with the exemption and notification requirements will have a total cost of $75,000 per year, $84 for each exemption application and $72 for each notification of identification. The rule will also involve the costs associated with the registration requirements. It is estimated that it will cost each entity $380 to collect and provide the required information, for a total cost of $29,000. Registration amendments are expected to cost $10,000 per year, $172 per occurrence. In addition, it is estimated that it will cost each entity $277 for a total of $21,000 to collect and provide the required information for re-application. Complying with the requirements concerning the transfer of select agents and toxins could cost $248 per occurrence or $16,000 per year. The rule could also entail costs for any needed upgrades to biosafety and containment, and information systems control. These costs are expected to be small. To the extent that affected entities are already permittees, the biosafety and containment requirements of the new act will have already been required at those entities. Affected entities have a variety of compelling reasons, including legislation, for already protecting information. The rule also requires that biosafety/biocontainment, security, and incident response plans be developed. It is estimated that the development of the biosafety/biocontainment plan could cost $4,500 per plan or a total of $171,000 if one-half of the affected entities need to develop new plans. The security plan would be developed as part of the entity security assessment discussed above. It is estimated that developing an incident response plan will cost $2,500 per plan for a total of $99,000 if one-half of the affected entities need to develop new plans. The cost to registrants associated with the individual security risk assessments is in obtaining fingerprints of individuals in the entity needing security screening. The average entity could expect to spend $825 obtaining fingerprints initially with a total for all entities of $63,250, and $470 annually for a total of $35,750. It is estimated that developing a baseline inventory of select agents and toxins at affected entities would cost $7,200 per entity for a total of $548,000, and the yearly inventory cost will be $3,600 per entity for a total of $274,000. Other recordkeeping is estimated at $1,742 per entity for a total of $132,000 per year. The estimated cost associated with training is $50,000 per entity for a total of $3.8 million. The estimated total cost associated with notifications of theft, loss and release of select agents or toxins is $72 per occurrence for a total of $144 per year. In addition, it is assumed that an incident of theft or loss will also require a thorough inventory of the affected storage freezer or toxin container, $560 per occurrence at a yearly total cost of $1,120. The estimated total cost associated with appeals under this rule is estimated to be $311 per year. The estimated cost associated with expedited reviews under this rule is estimated to be $43 per occurrence for a total of $1,000 initially and $560 per year thereafter.

The costs to APHIS include processing entity registrations, notifications of identification of agents and toxins, exemption applications, transfer applications, theft/loss notifications, appeals, performing entity inspections and providing technical assistance for compliance to affected entities, developing and maintaining a database covering select agents and toxins, developing and maintaining a secure space to house the database, and obtaining security clearances. The FY 2004 budget for the APHIS select agent and toxin program is $4.3 million.

Costs of the various components associated with the rule are summarized in the following table.

Table 1.—Summary of Potential Costs ¹

Costs	One-time costs	Recurring costs
Exemptions from the Rule:
Application	$2,900.
Re-application		$2,900.
Notifications of identification		$72,000/yr.
Registration:
Application	$29,000.
Re-application		$21,000 every 3 yrs.
Amendments		$10,000/yr.
Biosafety/Biocontainment Plan	$171,000.
Incident Response plan	$99,000.
Fingerprinting associated with SRAs	$63,250	$35,750/yr.
Security plan/entity security assessment	$17,000 to $25,000 per entity. $1.4 million.
Transfer		$16,000/yr.
Physical security procedures: 2
Electronic Security (cameras, card-readers, etc.)	$51,250 for 5,000 ft 2. $76,875 for 7,500 ft 2. $153,750 for 15,000 ft 2. $5.1 million.
Entry control (x-ray, metal detector)	$30,000 each. $240,000.
Off-site monitoring		$10,000 to $45,000 per entity. $1.3 million/yr.
Maintenance agreement		$12,000 to $30,000 per entity. $1.2 million/yr.
Guard service		$0 to $270,100 per entity. $814,000/yr.
Other costs:
Training	$3.8 million.
Baseline inventory	$548,000.
Periodic inventory		$274,000/yr.
Recordkeeping		$132,000/yr.
Theft/loss/release
Notification		$144/yr.
Additional inventory		1,120/yr.
Appeals		$311/yr.
Expedited reviews	$1,000	$560/yr.
Total	$11.5 million	$3.9 million.
Costs to APHIS:
Budget for select agent program		$4.3 million.
1 Unless otherwise noted, these are total costs for all affected entities.
2 Because security needs are site-specific and the rule allows for site-specific security solutions, the approaches and applications will be varied. Actual additional physical security measures added will vary (including none) based on the current level of security and the specific security needs of a given entity. The electronic security costs assumes 70 percent of facilities are 5,000 ft 2, 20 percent of facilities are 7,500 ft 2, and 10 percent of facilities are 15,000 ft 2. The entry control equipment cost assumes 8 entities need such equipment. The off-site monitoring and maintenance agreement costs assume all affected entities need some monitoring. The guard service cost assumes entities would need, on average, from 0 to 24 additional hours daily of unarmed guard service.

For all affected entities, estimates of the various one-time costs associated with this rule total $11.5 million and the estimates of the annual recurring costs total $3.9 million. The above is given to provide perspective on the magnitude of the potential costs associated with this rule. The costs shown here are likely overstated, however, due to conservative assumptions used in the absence of better information. The entities covered in this rule can and do vary from a small laboratory contained within a larger facility to large dedicated buildings to large groups of buildings and land. Because security needs are site-specific and the rule allows for site-specific security solutions, the approaches and applications will be varied. Physical security measures may have to be added in various quantities (including none) to meet the specific security needs of an entity. In fact, the security plans submitted under the December 2002 interim rule shows that the need for additional security measures is limited in many cases. Also, some of the impacts of the rule are somewhat offset by previous requirements, such as permit requirements in place prior to the implementation of the December 2002 interim rule. The flexibility in the rule also allows for site-specific needs to be met in the most cost effective manner possible.

Regulatory Flexibility Analysis

The Regulatory Flexibility Act requires that the Agency specifically consider the economic impact of rules on small entities. Those entities most likely to be impacted by the rule are those laboratories and other institutions conducting research and related activities that involve the use of select agents and toxins. Most affected entities (other than Federal or State governmental entities) would be considered part of NAICS code 541710, “Research and Development in the Physical, Engineering, and Life Sciences.” Some affected entities would be considered part of NAICS 541940, “Veterinary Services,” NAICS 611310, “Colleges, Universities and Professional Schools,” NAICS 325412 “Pharmaceutical Preparation Manufacturing,” NAICS 325413 “In-Vitro Diagnostic Substance Manufacturing,” and NAICS 325414, “Biological Product (except Diagnostic) Manufacturing.”

The Small Business Administration (SBA) has established guidelines for determining when establishments are to be considered small under the Regulatory Flexibility Act. An entity in NAICS 541710, 325413 or 325414 is considered small with 500 or fewer employees, in 325412 with 750 or fewer employees. An entity in NAICS 611310 is considered small with annual receipts/revenues of $6 million or less.

While the establishment size breakdown in the Economic Census does not precisely fit the SBA guidelines, it still shows that the vast majority (more than 90 percent) of life sciences research & development establishments can be considered small. More than 99 percent of biological (except diagnostic) manufacturing, more than 98 percent of diagnostic manufacturing, and at least 94 percent of pharmaceutical manufacturing are considered small. The economic census does not contain information on the establishment size of veterinary service entities. According to data from the U.S. Department of Education, about 31 percent of reporting postsecondary institutions had revenue of less than $6 million in fiscal year 1995-96.^[26]

Based on the available information, this rule is not anticipated to have a substantial impact on a significant number of small entities.

Alternatives Considered

This rule has been prompted by the need to prevent the misuse of select agents and toxins and thereby reduce the potential for those pathogens to harm humans, animals, animal products, plants or plant products in the United States. In assessing the need for this rule, we considered several alternatives to the chosen course of action.

One alternative would be to maintain the status quo, where we rely on our authority to issue permits for the importation and interstate movement of agents and toxins as a basis for any actions we take to regulate select agents and toxins. We rejected this option. The Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Pub. L. 107-188), requires that the Secretary of Agriculture establish and enforce standards and procedures governing the possession and use of the listed biological agents and toxins, including the establishment and enforcement of safety requirements for the transfer of listed agents and toxins; the establishment and enforcement of safeguard and security measures to prevent access to listed agents and toxins for use in domestic or international terrorism or other criminal purpose; and the establishment of procedures to protect animal and plant health, and animal and plant products, in the event of a transfer in violation of the established safety and security measures.

Another alternative would involve variations to the chosen regulatory scheme. For example, we could have chosen prescriptive requirements for meeting the need for security around select agents and toxins. We rejected this option. Because different agents and toxins pose differing degrees risk, depending on factors such as their escape potential and availability of a suitable habitat (for plant-related agents) and transmission and effect of exposure to the agent or toxin (for overlap and animal agents or toxins), we believe that it would be counterproductive to attempt to prepare a detailed list of prescriptive requirements for entities (i.e., a “one size fits all” design standard). Rather, we prepared a brief set of performance standards that we will consider to the degree to which they are appropriate to the risks presented by a particular agent or toxin, given its intended use and the location of the entity. In addition, these performance based standards allow for site-specific needs to be met in the most cost effective manner possible.

Conclusion

This rule is intended to prevent the misuse of select agents and toxins, and thereby reduce the potential for those pathogens to harm humans, animals, animal products, plants or plant products in the United States. Should any select agent or toxin be intentionally introduced into the United States, the consequences would be significant. Consequences could include disruption of markets, difficulties in sustaining an adequate food and fiber supply, and the potential spread of disease infestations over large areas. In any animal or plant disease outbreak, the government would incur the costs of eradication. Industry would be affected through the imposition of domestic and foreign quarantines, which would result in a loss of markets and destruction of animals/plants if commercial properties are found to be infected with the disease. Even though compensation can be paid for the destroyed property, repopulating (flocks, herds, fields, etc.) may be time consuming with additional losses from idle capital and lost markets. In addition, there is the potential for a disruption in the domestic food supply, whether through contamination, consumer perception, or both. Such a disruption can have a lasting influence on food demand and global trade.

While the costs associated with this rule could be considerable, some of those impacts are somewhat offset. For example, requirements such as USDA permit requirements for biosafety and containment and the mandate to update security at USDA facilities were in place prior to the implementation of the December 2002 interim rule. The flexibility in the rule also allows for site-specific needs to be met in the most cost effective manner possible. In addition, these costs are greatly outweighed by the benefits of preventing an unintentional or deliberate introduction of a select agent or toxin into the United States. The cost associated with outbreaks can be very high as is demonstrated by natural outbreaks that have occurred. Deliberate introduction greatly increases the probability of a select agent or toxin becoming established and causing wide-ranging and devastating impacts on the economy, disruption to society, diminished confidence in public and private institutions, and possible loss of life.

Paperwork Reduction Act

The December 2002 interim rule established regulations governing the possession, use, and transfer of biological agents and toxins that have been determined to have the potential to pose a severe threat to public health and safety, to animal health, to plant health, or to animal or plant products. This final rule includes certain regulatory provisions that differ from those included in the December 2002 interim rule. Some of those provisions involve changes from the information collection requirements set out in the December 2002 interim rule, which were approved by the Office of Management and Budget (OMB) under OMB control number 0579-0213 (expires May 31, 2005).

In a separate notice in today's issue of the Federal Register, APHIS is announcing that the information collection and recordkeeping requirements included in this final rule have been submitted for emergency approval to OMB.

Government Paperwork Elimination Act Compliance

The Animal and Plant Health Inspection Service is committed to compliance with the Government Paperwork Elimination Act (GPEA), which requires Government agencies in general to provide the public the option of submitting information or transacting business electronically to the maximum extent possible. For information pertinent to GPEA compliance related to this rule, please contact Mrs. Celeste Sickles, APHIS' Information Collection Coordinator, at [phone].

List of Subjects

7 CFR Part 331

• Agricultural research
• Laboratories
• Plant diseases and pests
• Reporting and recordkeeping requirements

9 CFR Part 121

• Agricultural research
• Animal diseases
• Laboratories
• Medical research
• Reporting and recordkeeping requirements

Accordingly, 7 CFR part 331 and 9 CFR part 121 are revised to read as follows:

Title 7—Agriculture

1. Revise part 331 to read as follows:

PART 331—POSSESSION, USE, AND TRANSFER OF SELECT AGENTS AND TOXINS

331.1

Definitions.

331.2

Purpose and scope.

331.3

PPQ select agents and toxins.

331.4

[Reserved]

331.5

Exemptions.

331.6

[Reserved]

331.7

Registration and related security risk assessments.

331.8

Denial, revocation, or suspension of registration.

331.9

Responsible official.

331.10

Restricting access to select agents and toxins; security risk assessments.

331.11

Security.

331.12

Biocontainment.

331.13

Restricted experiments.

331.14

Incident response.

331.15

Training.

331.16

Transfers.

331.17

Records.

331.18

Inspections.

331.19

Notification of theft, loss, or release.

331.20

Administrative review.

Authority: 7 U.S.C. 8401; 7 CFR 2.22, 2.80, and 371.3.

§ 331.1

Definitions.

Administrator. The Administrator, Animal and Plant Health Inspection Service, or any person authorized to act for the Administrator.

Animal and Plant Health Inspection Service (APHIS). The Animal and Plant Health Inspection Service of the U.S. Department of Agriculture.

Attorney General. The Attorney General of the United States or any person authorized to act for the Attorney General.

Biological agent. Any microorganism (including, but not limited to, bacteria, viruses, fungi, rickettsiae, or protozoa), or infectious substance, or any naturally occurring, bioengineered, or synthesized component of any such microorganism or infectious substance, capable of causing:

(1) Death, disease, or other biological malfunction in a human, an animal, a plant, or another living organism;

(2) Deterioration of food, water, equipment, supplies, or material of any kind; or

(3) Deleterious alteration of the environment.

Centers for Disease Control and Prevention (CDC). The Centers for Disease Control and Prevention of the U.S. Department of Health and Human Services.

Diagnosis. The analysis of specimens for the purpose of identifying or confirming the presence or characteristics of a select agent or toxin, provided that such analysis is directly related to protecting the public health or safety, animal health or animal products, or plant health or plant products.

Entity. Any government agency (Federal, State, or local), academic institution, corporation, company, partnership, society, association, firm, sole proprietorship, or other legal entity.

HHS Secretary. The Secretary of the Department of Health and Human Services or his or her designee, unless otherwise specified.

HHS select agent and/or toxin. A biological agent or toxin listed in 42 CFR 73.3.

Import. To move into, or the act of movement into, the territorial limits of the United States.

Interstate. From one State into or through any other State, or within the District of Columbia, Guam, the Virgin Islands of the United States, or any other territory or possession of the United States.

Permit. A written authorization by the Administrator to import or move interstate select agents or toxins, under conditions prescribed by the Administrator.

PPQ. The Plant Protection and Quarantine Programs of the Animal and Plant Health Inspection Service.

Responsible official. The individual designated by an entity with the authority and control to ensure compliance with the regulations in this part.

Select agent and/or toxin. A biological agent or toxin listed in § 331.3.

Specimen. Samples of material from humans, animals, plants, or the environment, or isolates or cultures from such samples, for diagnosis, verification, or proficiency testing.

State. Any of the several States of the United States, the Commonwealth of the Northern Mariana Islands, the Commonwealth of Puerto Rico, the District of Columbia, Guam, the Virgin Islands of the United States, or any other territory or possession of the United States.

Toxin. The toxic material or product of plants, animals, microorganisms (including, but not limited to, bacteria, viruses, fungi, rickettsiae, or protozoa), or infectious substances, or a recombinant or synthesized molecule, whatever their origin and method of production, and includes:

(1) Any poisonous substance or biological product that may be engineered as a result of biotechnology produced by a living organism; or

(2) Any poisonous isomer or biological product, homolog, or derivative of such a substance.

United States. All of the States.

USDA. The U.S. Department of Agriculture.

Verification. The demonstration of obtaining established performance (e.g., accuracy, precision, and the analytical sensitivity and specificity) specifications for any procedure used for diagnosis.

§ 331.2

Purpose and scope.

This part implements the provisions of the Agricultural Bioterrorism Protection Act of 2002 setting forth the requirements for possession, use, and transfer of select agents and toxins. The biological agents and toxins listed in this part have the potential to pose a severe threat to plant health or plant products.

§ 331.3

PPQ select agents and toxins.

(a) Except as provided in paragraphs (d) and (e) of this section, the Administrator has determined that the biological agents and toxins listed in this section have been determined to have the potential to pose a severe threat to plant health or to plant products.

(b) PPQ select agents and toxins:

Candidatus Liberobacter africanus;

Candidatus Liberobacter asiaticus;

Peronosclerospora philippinensis;

Ralstonia solanacearum, race 3, biovar 2;

Sclerophthora rayssiae var. zeae;

Synchytrium endobioticum;

Xanthomonas oryzae pv. oryzicola;

Xylella fastidiosa (citrus variegated chlorosis strain).

(c) Genetic elements, recombinant nucleic acids, and recombinant organisms:

(1) Nucleic acids that can produce infectious forms of any of the select agent viruses listed in paragraph (b) of this section.

(2) Recombinant nucleic acids that encode for the functional forms of any toxin listed in paragraph (b) of this section if the nucleic acids:

(i) Can be expressed in vivo or in vitro; or

(ii) Are in a vector or recombinant host genome and can be expressed in vivo or in vitro.

(3) Select agents and toxins listed in paragraph (b) of this section that have been genetically modified.

(d) Select agents or toxins that meet any of the following criteria are excluded from the requirements of this part:

(1) Any select agent or toxin that is in its naturally occurring environment, provided that the agent or toxin has not been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source.

(2) Nonviable select agents or nonfunctional toxins.

(e) An attenuated strain of a select agent or toxin may be excluded from the requirements of this part based upon a determination that the attenuated strain does not pose a severe threat to plant health or plant products.

(1) To apply for an exclusion, an individual or entity must submit a written request and supporting scientific information. A written decision granting or denying the request will be issued. An exclusion will be effective upon notification of the applicant. Exclusions will be published periodically in the notice section of the Federal Register and will be listed on the Internet at http://www.aphis.usda.gov/​programs/​ag_​selectagent/​index.html.

(2) If an excluded attenuated strain is subjected to any manipulation that restores or enhances its virulence, the resulting select agent or toxin will be subject to the requirements of this part.

(3) An individual or entity may make a written request to the Administrator for reconsideration of a decision denying an exclusion application. The written request for reconsideration must state the facts and reasoning upon which the individual or entity relies to show the decision was incorrect. The Administrator will grant or deny the request for reconsideration as promptly as circumstances allow and will state, in writing, the reasons for the decision.

(f) Any select agent or toxin seized by a Federal law enforcement agency will be excluded from the requirements of this part during the period between seizure of the agent or toxin and the transfer or destruction of such agent or toxin provided that:

(1) As soon as practicable, the Federal law enforcement agency transfers the seized agent or toxin to an entity eligible to receive such agent or toxin or destroys the agent or toxin by a recognized sterilization or inactivation process.

(2) The Federal law enforcement agency safeguards and secures the seized agent or toxin against theft, loss, or release, and reports any theft, loss, or release of such agent or toxin.

(3) The Federal law enforcement agency reports the seizure of the select agent or toxin to APHIS or CDC. The seizure must be reported within 24 hours by telephone, facsimile, or e-mail. This report must be followed by submission of APHIS/CDC Form 4 within 7 calendar days after seizure of the select agent or toxin. A copy of the completed form must be maintained for 3 years.

(4) The Federal law enforcement agency reports the final disposition of the select agent or toxin to APHIS or CDC by submission of APHIS/CDC Form 4. A copy of the completed form must be maintained for 3 years.

§ 331.4

[Reserved]

§ 331.5

Exemptions.

(a) Diagnostic laboratories and other entities that possess, use, or transfer a select agent or toxin that is contained in a specimen presented for diagnosis or verification will be exempt from the requirements of this part for such agent or toxin contained in the specimen, provided that:

(1) Unless directed otherwise by the Administrator, within 7 calendar days after identification, the agent or toxin is transferred in accordance with § 331.16 or destroyed on-site by a recognized sterilization or inactivation process;

(2) The agent or toxin is secured against theft, loss, or release during the period between identification of the agent or toxin and transfer or destruction of such agent or toxin, and any theft, loss, or release of such agent or toxin is reported; and

(3) The identification of the agent or toxin is immediately reported to APHIS or CDC by telephone, facsimile, or e-mail. This report must be followed by submission of APHIS/CDC Form 4 within 7 calendar days after identification. Less stringent reporting may be required during agricultural emergencies or outbreaks, or in endemic areas. A copy of APHIS/CDC Form 4 must be maintained for 3 years.

(b) In addition to the exemption provided in paragraph (a) of this section, the Administrator may grant a specific exemption upon a showing of good cause and upon his or her determination that such exemption is consistent with protecting plant health or plant products. An individual or entity may request in writing an exemption from the requirements of this part. If granted, such exemptions are valid for a maximum of 3 years; thereafter, an individual or entity must request a new exemption. If a request for exemption is denied, an individual or entity may request reconsideration in writing to the Administrator. The request for reconsideration must state all of the facts and reasons upon which the individual or entity relies to show that the exemption was wrongfully denied. The Administrator will grant or deny the request for reconsideration as promptly as circumstances allow and will state, in writing, the reasons for the decision.

§ 331.6

[Reserved]

§ 331.7

Registration and related security risk assessments.

(a) Unless exempted under § 331.5, an individual or entity shall not possess, use, or transfer any select agent or toxin without a certificate of registration issued by the Administrator.

(b) As a condition of registration, each entity must designate an individual to be its responsible official. While most registrants are likely to be entities, in the event that an individual applies for and is granted a certificate of registration, the individual will be considered the responsible official.

(c)(1) As a condition of registration, the following must be approved by the Administrator or the HHS Secretary based on a security risk assessment by the Attorney General:

(i) The individual or entity;

(ii) The responsible official; and

(iii) Unless otherwise exempted under this section, any individual who owns or controls the entity.

(2) Federal, State, or local governmental agencies, including public accredited academic institutions, are exempt from the security risk assessments for the entity and the individual who owns or controls such entity.

(3) An individual will be deemed to own or control an entity under the following conditions: ^[1]

(i) For a private institution of higher education, an individual will be deemed to own or control the entity if the individual is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.

(ii) For entities other than institutions of higher education, an individual will be deemed to own or control the entity if the individual:

(A) Owns 50 percent or more of the entity, or is a holder or owner of 50 percent or more of its voting stock; or

(B) Is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.

(4) An entity will be considered to be an institution of higher education if it is an institution of higher education as defined in section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)), or is an organization described in 501(c)(3) of the Internal Revenue Code of 1986, as amended (26 U.S.C. 501(c)(3)).

(5) To obtain a security risk assessment, an individual or entity must submit the information necessary to conduct a security risk assessment to the Attorney General.

(d) To apply for a certificate of registration for only PPQ select agents or toxins, or for PPQ and VS select agents or toxins, an individual or entity must submit the information requested in the registration application package (APHIS/CDC Form 1) to APHIS. To apply for a certificate of registration for overlap select agents or toxins, overlap select agents or toxins and any combination of PPQ or VS select agents or toxins, or HHS select agents or toxins and any combination of PPQ or VS select agents or toxins, an individual or entity must submit the information requested in the registration application package (APHIS/CDC Form 1) to APHIS or CDC, but not both.

(e) Prior to the issuance of a certificate of registration, the responsible official must promptly provide notification of any changes to the application for registration by submitting the relevant page(s) of the registration application.

(f) The issuance of a certificate of registration may be contingent upon inspection or submission of additional information, such as the security plan, biosafety plan, incident response plan, or any other documents required to be prepared under this part.

(g) A certificate of registration will be valid for one physical location (a room, a building, or a group of buildings) where the responsible official will be able to perform the responsibilities required in this part, for specific select agents or toxins, and for specific activities.

(h) A certificate of registration may be amended to reflect changes in circumstances (e.g., replacement of the responsible official or other personnel changes, changes in ownership or control of the entity, changes in the activities involving any select agents or toxins, or the addition or removal of select agents or toxins).

(1) Prior to any change, the responsible official must apply for an amendment to a certificate of registration by submitting the relevant page(s) of the registration application.^[2]

(2) The responsible official will be notified in writing if an application to amend a certificate of registration has been approved. Approval of an amendment may be contingent upon an inspection or submission of additional information, such as the security plan, biosafety plan, incident response plan, or any other documents required to be prepared under this part.

(3) No change may be made without such approval.

(i) An entity must immediately notify APHIS or CDC if it loses the services of its responsible official. In the event that an entity loses the services of its responsible official, an entity may continue to possess or use select agents or toxins only if it appoints as the responsible official another individual who has been approved by the Administrator or the HHS Secretary following a security risk assessment by the Attorney General and who meets the requirements of this part.

(j) A certificate of registration will be terminated upon the written request of the entity if the entity no longer possesses or uses any select agents or toxins and no longer wishes to be registered.

(k) A certificate of registration will be valid for a maximum of 3 years.

§ 331.8

Denial, revocation, or suspension of registration.

(a) An application may be denied or a certificate of registration revoked or suspended if:

(1) The individual or entity, the responsible official, or an individual who owns or controls the entity is within any of the categories described in 18 U.S.C. 175b;

(2) The individual or entity, the responsible official, or an individual who owns or controls the entity is reasonably suspected by any Federal law enforcement or intelligence agency of:

(i) Committing a crime set forth in 18 U.S.C. 2332b(g)(5); or

(ii) Knowing involvement with an organization that engages in domestic or international terrorism (as defined in 18 U.S.C. 2331) or with any other organization that engages in intentional crimes of violence; or

(iii) Being an agent of a foreign power as defined in 50 U.S.C. 1801;

(3) The individual or entity does not meet the requirements of this part; ^[3] or

(4) It is determined that such action is necessary to protect plant health or plant products.

(b) Upon revocation or suspension of a certificate of registration, the individual or entity must:

(1) Immediately stop all use of each select agent or toxin covered by the revocation or suspension order;

(2) Immediately safeguard and secure each select agent or toxin covered by the revocation or suspension order from theft, loss, or release; and

(3) Comply with all disposition instructions issued by the Administrator for each select agent or toxin covered by the revocation or suspension.

(c) Denial of an application for registration and revocation or suspension of registration may be appealed under § 331.20. However, any denial of an application for registration or revocation or suspension of a certificate of registration will remain in effect until a final agency decision has been rendered.

§ 331.9

Responsible official.

(a) An individual or entity required to register under this part must designate an individual to be the responsible official. The responsible official must:

(1) Be approved by the Administrator or the HHS Secretary following a security risk assessment by the Attorney General;

(2) Be familiar with the requirements of this part;

(3) Have authority and responsibility to act on behalf of the entity;

(4) Ensure compliance with the requirements of this part; and

(5) Ensure that annual inspections are conducted of each laboratory where select agents or toxins are stored or used in order to ensure compliance with the requirements of this part. The results of each inspection must be documented, and any deficiencies identified during an inspection must be corrected.

(b) An entity may designate one or more individuals to be an alternate responsible official, who may act for the responsible official in his/her absence. These individuals must have the authority and control to ensure compliance with the regulations when acting as the responsible official.

(c) The responsible official must report the identification and final disposition of any select agent or toxin contained in a specimen for diagnosis or verification.

(1) The identification of the select agent or toxin must be immediately reported by telephone, facsimile, or e-mail. The final disposition of the agent or toxin must be reported by submission of APHIS/CDC Form 4 within 7 calendar days after identification. A copy of the completed form must be maintained for 3 years.

(2) Less stringent reporting may be required during agricultural emergencies or outbreaks, or in endemic areas.

§ 331.10

Restricting access to select agents and toxins; security risk assessments.

(a) An individual or entity required to register under this part may not provide an individual access to a select agent or toxin, and an individual may not access a select agent or toxin, unless the individual is approved by the Administrator or the HHS Secretary following a security risk assessment by the Attorney General.

(b) An individual will be deemed to have access at any point in time if the individual has possession of a select agent or toxin (e.g., carries, uses, or manipulates) or the ability to gain possession of a select agent or toxin.

(c) Each individual with access to select agents or toxins must have the appropriate education, training, and/or experience to handle or use such agents or toxins.

(d) To apply for access approval, each individual must submit the information necessary to conduct a security risk assessment to the Attorney General.

(e) An individual's security risk assessment may be expedited upon written request by the responsible official and a showing of good cause (e.g., agricultural emergencies, national security, or a short-term visit by a prominent researcher). A written decision granting or denying the request will be issued.

(f) An individual's access approval may be denied, limited, or revoked if:

(1) The individual is within any of the categories described in 18 U.S.C. 175b;

(2) The individual is reasonably suspected by any Federal law enforcement or intelligence agency of committing a crime set forth in 18 U.S.C. 2332b(g)(5); knowing involvement with an organization that engages in domestic or international terrorism (as defined in 18 U.S.C. 2331) or with any other organization that engages in intentional crimes of violence; or being an agent of a foreign power as defined in 50 U.S.C. 1801; or

(3) It is determined that such action is necessary to protect plant health or plant products.

(g) An individual may appeal the Administrator's decision to deny, limit, or revoke access approval under § 331.20.

(h) Access approval is valid for a maximum of 5 years.

(i) The responsible official must immediately notify APHIS or CDC when an individual's access to select agents or toxins is terminated by the entity and the reasons therefore.

§ 331.11

Security.

(a) An individual or entity required to register under this part must develop and implement a written security plan. The security plan must be sufficient to safeguard the select agent or toxin against unauthorized access, theft, loss, or release.

(b) The security plan must be designed according to a site-specific risk assessment and must provide graded protection in accordance with the risk of the select agent or toxin, given its intended use. The security plan must be submitted upon request.

(c) The security plan must:

(1) Describe procedures for physical security, inventory control, and information systems control;

(2) Contain provisions for the control of access to select agents and toxins;

(3) Contain provisions for routine cleaning, maintenance, and repairs;

(4) Establish procedures for removing unauthorized or suspicious persons;

(5) Describe procedures for addressing loss or compromise of keys, passwords, combinations, etc. and protocols for changing access numbers or locks following staff changes;

(6) Contain procedures for reporting unauthorized or suspicious persons or activities, loss or theft of select agents or toxins, release of select agents or toxins, or alteration of inventory records; and

(7) Contain provisions for ensuring that all individuals with access approval from the Administrator or the HHS Secretary understand and comply with the security procedures.

(d) An individual or entity must adhere to the following security requirements or implement measures to achieve an equivalent or greater level of security:

(1) Allow access only to individuals with access approval from the Administrator or the HHS Secretary;

(2) Allow individuals not approved for access by the Administrator or the HHS Secretary to conduct routine cleaning, maintenance, repairs, and other activities not related to select agents or toxins only when continuously escorted by an approved individual;

(3) Provide for the control of select agents and toxins by requiring freezers, refrigerators, cabinets, and other containers where select agents or toxins are stored to be secured against unauthorized access (e.g., card access system, lock boxes);

(4) Inspect all suspicious packages before they are brought into or removed from an area where select agents or toxins are used or stored;

(5) Establish a protocol for intra-entity transfers under the supervision of an individual with access approval from the Administrator or the HHS Secretary, including chain-of-custody documents and provisions for safeguarding against theft, loss, or release; and

(6) Require that individuals with access approval from the Administrator or the HHS Secretary refrain from sharing with any other person their unique means of accessing a select agent or toxin (e.g., keycards or passwords);

(7) Require that individuals with access approval from the Administrator or the HHS Secretary immediately report any of the following to the responsible official:

(i) Any loss or compromise of keys, passwords, combinations, etc.;

(ii) Any suspicious persons or activities;

(iii) Any loss or theft of select agents or toxins;

(iv) Any release of a select agent or toxin; and

(v) Any sign that inventory or use records for select agents or toxins have been altered or otherwise compromised; and

(8) Separate areas where select agents and toxins are stored or used from the public areas of the building.

(e) In developing a security plan, an individual or entity should consider the document entitled, “Laboratory Security and Emergency Response Guidance for Laboratories Working with Select Agents,” in Morbidity and Mortality Weekly Report (December 6, 2002); 51 (No. RR-19):1-6. This document is available on the Internet at http://www.cdc.gov/​mmwr.

(f) The plan must be reviewed annually and revised as necessary. Drills or exercises must be conducted at least annually to test and evaluate the effectiveness of the plan. The plan must be reviewed and revised, as necessary, after any drill or exercise and after any incident.

§ 331.12

Biocontainment.

(a) An individual or entity required to register under this part must develop and implement a written biocontainment plan that is commensurate with the risk of the select agent or toxin, given its intended use.^[4] The biocontainment plan must contain sufficient information and documentation to describe the containment procedures.

(b) The biocontainment procedures must be sufficient to contain the select agent or toxin (e.g., physical structure and features of the entity, and operational and procedural safeguards).

(c) In developing a biocontainment plan, an individual or entity should consider the following:

(1) “Containment Facilities and Safeguards for Exotic Plant Pathogens and Pests” (Robert P. Kahn and S.B. Mathur eds., 1999); and

(2) “A Practical Guide to Containment: Greenhouse Research with Transgenic Plants and Microbes” (Patricia L. Traynor ed., 2001).

(d) The plan must be reviewed annually and revised as necessary. Drills or exercises must be conducted at least annually to test and evaluate the effectiveness of the plan. The plan must be reviewed and revised, as necessary, after any drill or exercise and after any incident.

§ 331.13

Restricted experiments.^[5]

(a) An individual or entity may not conduct the following experiments unless approved by and conducted in accordance with the conditions prescribed by the Administrator:

(1) Experiments utilizing recombinant DNA that involve the deliberate transfer of a drug resistance trait to select agents that are not known to acquire the trait naturally, if such acquisition could compromise the use of the drug to control disease agents in humans, veterinary medicine, or agriculture.

(2) Experiments involving the deliberate formation of recombinant DNA containing genes for the biosynthesis of toxins lethal for vertebrates at an LD₅₀<100 ng/kg body weight.

(b) The Administrator may revoke approval to conduct any of the experiments in paragraph (a) of this section, or revoke or suspend a certificate of registration, if the individual or entity fails to comply with the requirements of this part.

(c) To apply for approval to conduct any of the experiments in paragraph (a) of this section, an individual or entity must submit a written request and supporting scientific information to the Administrator. A written decision granting or denying the request will be issued.

§ 331.14

Incident response.^[6]

(a) An individual or entity required to register under this part must develop and implement a written incident response plan.^[7] The incident response plan must be coordinated with any entity-wide plans, kept in the workplace, and available to employees for review.

(b) The incident response plan must fully describe the entity's response procedures for the theft, loss, or release of a select agent or toxin; inventory discrepancies; security breaches (including information systems); severe weather and other natural disasters; workplace violence; bomb threats and suspicious packages; and emergencies such as fire, gas leak, explosion, power outage, etc. The response procedures must account for hazards associated with the select agent or toxin and appropriate actions to contain such agent or toxin.

(c) The incident response plan must also contain the following information:

(1) The name and contact information (e.g., home and work) for the individual or entity (e.g., responsible official, alternate responsible official(s), biosafety officer, etc.);

(2) The name and contact information for the building owner and/or manager, where applicable;

(3) The name and contact information for tenant offices, where applicable;

(4) The name and contact information for the physical security official for the building, where applicable;

(5) Personnel roles and lines of authority and communication;

(6) Planning and coordination with local emergency responders;

(7) Procedures to be followed by employees performing rescue or medical duties;

(8) Emergency medical treatment and first aid;

(9) A list of personal protective and emergency equipment, and their locations;

(10) Site security and control;

(11) Procedures for emergency evacuation, including type of evacuation, exit route assignments, safe distances, and places of refuge; and

(12) Decontamination procedures.

(d) The plan must be reviewed annually and revised as necessary. Drills or exercises must be conducted at least annually to test and evaluate the effectiveness of the plan. The plan must be reviewed and revised, as necessary, after any drill or exercise and after any incident.

§ 331.15

Training.

(a) An individual or entity required to register under this part must provide information and training on biocontainment and security to each individual with access approval from the Administrator or the HHS Secretary before he/she has such access. In addition, an individual or entity must provide information and training on biocontainment and security to each individual not approved for access by the Administrator or the HHS Secretary before he/she works in or visits areas where select agents or toxins are handled or stored (e.g., laboratories, growth chambers, animal rooms, greenhouses, storage areas, etc.). The training must address the particular needs of the individual, the work they will do, and the risks posed by the select agents or toxins.

(b) Refresher training must be provided annually.

(c) A record of the training provided to each individual must be maintained. The record must include the name of the individual, the date of training, a description of the training provided, and the means used to verify that the employee understood the training.

§ 331.16

Transfers.

(a) Except as provided in paragraph (c) of this section, a select agent or toxin may only be transferred to an individual or entity registered to possess, use, or transfer that agent or toxin. A select agent or toxin may only be transferred under the conditions of this section and must be authorized by APHIS or CDC prior to the transfer.^[8]

(b) In addition to any permit required under part 330 of this chapter, a transfer may be authorized if:

(1) The sender:

(i) Has at the time of transfer a certificate of registration that covers the particular select agent or toxin to be transferred and meets all the requirements of this part;

(ii) Meets the exemption requirements for the particular select agent or toxin to be transferred; or

(iii) Is transferring the select agent or toxin from outside of the United States and meets all import requirements.

(2) At the time of transfer, the recipient has a certificate of registration that includes the particular select agent or toxin to be transferred and meets all of the requirements of this part.

(c) On a case-by-case basis, the Administrator may authorize a transfer of a select agent or toxin not otherwise eligible for transfer under this part under conditions prescribed by the Administrator.

(d) To obtain authorization for a transfer, APHIS/CDC Form 2 must be submitted.

(e) The recipient must submit a completed APHIS/CDC Form 2 within 2 business days of receipt of a select agent or toxin.

(f) The recipient must immediately notify APHIS or CDC if the select agent or toxin has not been received within 48 hours after the expected delivery time or if the package containing the select agent or toxin has been damaged to the extent that a release of the select agent or toxin may have occurred.

(g) An authorization for a transfer shall be valid only for 30 calendar days after issuance, except that such an authorization becomes immediately null and void if any facts supporting the authorization change (e.g., change in the certificate of registration for the sender or recipient, change in the application for transfer).

(h) The sender must comply with all applicable laws governing packaging and shipping.

§ 331.17

Records.

(a) An individual or entity required to register under this part must maintain complete records relating to the activities covered by this part. Such records must include:

(1) An accurate, current inventory for each select agent (including viral genetic elements, recombinant nucleic acids, and recombinant organisms) held in long-term storage (placement in a system designed to ensure viability for future use, such as in a freezer or lyophilized materials), including:

(i) The name and characteristics (e.g., strain designation, GenBank Accession number, etc.);

(ii) The quantity acquired from another individual or entity (e.g., containers, vials, tubes, etc.), date of acquisition, and the source;

(iii) Where stored (e.g., building, room, and freezer);

(iv) When moved from storage and by whom and when returned to storage and by whom;

(v) The select agent used and purpose of use;

(vi) Records created under § 331.16 (Transfers);

(vii) For intra-entity transfers (sender and the recipient are covered by the same certificate of registration), the select agent, the quantity transferred, the date of transfer, the sender, and the recipient; and

(viii) Records created under § 331.19 (Notification of theft, loss, or release);

(2) An accurate, current inventory for each toxin held, including:

(i) The name and characteristics;

(ii) The quantity acquired from another individual or entity (e.g., containers, vials, tubes, etc.), date of acquisition, and the source;

(iii) The initial and current quantity amount (e.g., milligrams, milliliters, grams, etc.);

(iv) The toxin used and purpose of use, quantity, date(s) of the use and by whom;

(v) Where stored (e.g., building, room, and freezer);

(vi) When moved from storage and by whom and when returned to storage and by whom, including quantity amount;

(vii) Records created under § 331.16 (Transfers);

(viii) For intra-entity transfers (sender and the recipient are covered by the same certificate of registration), the toxin, the quantity transferred, the date of transfer, the sender, and the recipient;

(ix) Records created under § 331.19 (Notification of theft, loss, or release);

(x) If destroyed, the quantity of toxin destroyed, the date of such action, and by whom.

(3) A current list of all individuals that have been granted access approval by the Administrator or the HHS Secretary;

(4) Information about all entries into areas containing select agents or toxins, including the name of the individual, name of the escort (if applicable), and the date and time of entry;

(5) Accurate, current records created under § 331.9(c) (Responsible official), § 331.11 (Security), § 331.12 (Biocontainment), § 331.14 (Incident response), and § 331.15 (Training); and

(6) A written explanation of any discrepancies.

(b) The individual or entity must implement a system to ensure that all records and databases created under this part are accurate, have controlled access, and can be verified for authenticity.

(c) All records created under this part must be maintained for 3 years and promptly produced upon request.

§ 331.18

Inspections.

(a) Without prior notification, APHIS must be allowed to inspect any site at which activities regulated under this part are conducted and must be allowed to inspect and copy any records relating to the activities covered by this part.

(b) Prior to issuing a certificate of registration to an individual or entity, APHIS may inspect and evaluate their premises and records to ensure compliance with this part.

§ 331.19

Notification of theft, loss, or release.

(a) An individual or entity must immediately notify APHIS or CDC upon discovery of the theft or loss of a select agent or toxin. Thefts or losses must be reported even if the select agent or toxin is subsequently recovered or the responsible parties are identified.

(1) The theft or loss of a select agent or toxin must be reported by telephone, facsimile, or e-mail. The following information must be provided:

(i) The name of the select agent or toxin and any identifying information (e.g., strain or other characterization information);

(ii) An estimate of the quantity stolen or lost;

(iii) An estimate of the time during which the theft or loss occurred;

(iv) The location (building, room) from which the theft or loss occurred; and

(v) The list of Federal, State, or local law enforcement agencies to which the individual or entity reported, or intends to report, the theft or loss.

(2) A completed APHIS/CDC Form 3 must be submitted within 7 calendar days.

(b) An individual or entity must notify APHIS or CDC immediately upon discovery of a release of a select agent or toxin outside of the primary barriers of the biocontainment area.

(1) The release of a select agent or toxin must be reported by telephone, facsimile, or e-mail. The following information must be provided:

(i) The name of the select agent or toxin and any identifying information (e.g., strain or other characterization information);

(ii) An estimate of the quantity released;

(iii) The time and duration of the release;

(iv) The environment into which the release occurred (e.g., in building or outside of building, waste system);

(v) The location (building, room) from which the release occurred; and

(vi) The number of individuals potentially exposed at the entity;

(vii) Actions taken to respond to the release; and

(viii) Hazards posed by the release.

(2) A completed APHIS/CDC Form 3 must be submitted within 7 calendar days.

§ 331.20

Administrative review.

An individual or entity may appeal a denial, revocation, or suspension of registration under this part. An individual may appeal a denial, limitation, or revocation of access approval under this part.^[9] The appeal must be in writing, state the factual basis for the appeal, and be submitted to the Administrator within 30 calendar days of the decision. Where the denial, revocation, or suspension of registration or the denial, limitation, or revocation of an individual's access approval is based upon an identification by the Attorney General, the request for review will be forwarded to the Attorney General. The Administrator's decision constitutes final agency action.

Title 9—Animals and Animal Products

2. Revise part 121 to read as follows:

PART 121—POSSESSION, USE, AND TRANSFER OF SELECT AGENTS AND TOXINS

121.1

Definitions.

121.2

Purpose and scope.

121.3

VS select agents and toxins.

121.4

Overlap select agents and toxins.

121.5

Exemptions for VS select agents and toxins.

121.6

Exemptions for overlap select agents and toxins.

121.7

Registration and related security risk assessments.

121.8

Denial, revocation, or suspension of registration.

121.9

Responsible official.

121.10

Restricting access to select agents and toxins; security risk assessments.

121.11

Security.

121.12

Biosafety.

121.13

Restricted experiments.

121.14

Incident response.

121.15

Training.

121.16

Transfers.

121.17

Records.

121.18

Inspections.

121.19

Notification of theft, loss, or release.

121.20

Administrative review.

Authority: 7 U.S.C. 8401; 7 CFR 2.22, 2.80, and 371.4.

§ 121.1

Definitions.

Administrator. The Administrator, Animal and Plant Health Inspection Service, or any person authorized to act for the Administrator.

Animal and Plant Health Inspection Service (APHIS). The Animal and Plant Health Inspection Service of the U.S. Department of Agriculture.

Attorney General. The Attorney General of the United States or any person authorized to act for the Attorney General.

Biological agent. Any microorganism (including, but not limited to, bacteria, viruses, fungi, rickettsiae, or protozoa), or infectious substance, or any naturally occurring, bioengineered, or synthesized component of any such microorganism or infectious substance, capable of causing:

(1) Death, disease, or other biological malfunction in a human, an animal, a plant, or another living organism;

(2) Deterioration of food, water, equipment, supplies, or material of any kind; or

(3) Deleterious alteration of the environment.

Centers for Disease Control and Prevention (CDC). The Centers for Disease Control and Prevention of the U.S. Department of Health and Human Services.

Diagnosis. The analysis of specimens for the purpose of identifying or confirming the presence or characteristics of a select agent or toxin, provided that such analysis is directly related to protecting the public health or safety, animal health or animal products, or plant health or plant products.

Entity. Any government agency (Federal, State, or local), academic institution, corporation, company, partnership, society, association, firm, sole proprietorship, or other legal entity.

HHS Secretary. The Secretary of the Department of Health and Human Services or his or her designee, unless otherwise specified.

HHS select agent and/or toxin. A biological agent or toxin listed in 42 CFR 73.3.

Import. To move into, or the act of movement into, the territorial limits of the United States.

Interstate. From one State into or through any other State, or within the District of Columbia, Guam, the Virgin Islands of the United States, or any other territory or possession of the United States.

Overlap select agent and/or toxin. A biological agent or toxin that is listed in § 121.4 and 42 CFR 73.4.

Permit. A written authorization by the Administrator to import or move interstate select agents or toxins, under conditions prescribed by the Administrator.

Proficiency testing. The process of determining the competency of an individual or laboratory to perform a specified test or procedure.

Responsible official. The individual designated by an entity with the authority and control to ensure compliance with the regulations in this part.

Select agent and/or toxin. Unless otherwise specified, all of the biological agents or toxins listed in §§ 121.3 and 121.4.

Specimen. Samples of material from humans, animals, plants, or the environment, or isolates or cultures from such samples, for diagnosis, verification, or proficiency testing.

State. Any of the several States of the United States, the Commonwealth of the Northern Mariana Islands, the Commonwealth of Puerto Rico, the District of Columbia, Guam, the Virgin Islands of the United States, or any other territory or possession of the United States.

Toxin. The toxic material or product of plants, animals, microorganisms (including, but not limited to, bacteria, viruses, fungi, rickettsiae, or protozoa), or infectious substances, or a recombinant or synthesized molecule, whatever their origin and method of production, and includes:

(1) Any poisonous substance or biological product that may be engineered as a result of biotechnology produced by a living organism; or

(2) Any poisonous isomer or biological product, homolog, or derivative of such a substance.

United States. All of the States.

USDA. The U.S. Department of Agriculture.

Verification. The demonstration of obtaining established performance (e.g., accuracy, precision, and the analytical sensitivity and specificity) specifications for any procedure used for diagnosis.

VS. The Veterinary Services Programs of the Animal and Plant Health Inspection Service.

VS select agent and/or toxin. A biological agent or toxin listed in § 121.3.

§ 121.2

Purpose and scope.

This part implements the provisions of the Agricultural Bioterrorism Protection Act of 2002 setting forth the requirements for possession, use, and transfer of select agents and toxins. The biological agents and toxins listed in this part have the potential to pose a severe threat to public health and safety, to animal health, or to animal products. Overlap select agents and toxins are subject to regulation by both APHIS and CDC.

§ 121.3

VS select agents and toxins.

(a) Except as provided in paragraphs (d) and (e) of this section, the Administrator has determined that the biological agents and toxins listed in this section have the potential to pose a severe threat to animal health or to animal products.

(b) VS select agents and toxins:

African horse sickness virus;

African swine fever virus;

Akabane virus;

Avian influenza virus (highly pathogenic);

Bluetongue virus (exotic);

Bovine spongiform encephalopathy agent;

Camel pox virus;

Classical swine fever virus;

Cowdria ruminantium (Heartwater);

Foot-and-mouth disease virus;

Goat pox virus;

Japanese encephalitis virus;

Lumpy skin disease virus;

Malignant catarrhal fever virus (Alcelaphine herpesvirus type 1);

Menangle virus;

Mycoplasma capricolum/M. F38/M. mycoides capri (contagious caprine pleuropneumonia);

Mycoplasma mycoides mycoides (contagious bovine pleuropneumonia);

Newcastle disease virus (velogenic);

Peste des petits ruminants virus;

Rinderpest virus;

Sheep pox virus;

Swine vesicular disease virus;

Vesicular stomatitis virus (exotic).

(c) Genetic elements, recombinant nucleic acids, and recombinant organisms:

(1) Nucleic acids that can produce infectious forms of any of the select agent viruses listed in paragraph (b) of this section.^[1]

(2) Recombinant nucleic acids that encode for the functional forms of any toxin listed in paragraph (b) of this section if the nucleic acids:

(i) Can be expressed in vivo or in vitro; or

(ii) Are in a vector or recombinant host genome and can be expressed in vivo or in vitro.

(3) VS select agents and toxins listed in paragraph (b) of this section that have been genetically modified.

(d) VS select agents or toxins that meet any of the following criteria are excluded from the requirements of this part:

(1) Any VS select agent or toxin that is in its naturally occurring environment, provided that the agent or toxin has not been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source.

(2) Nonviable VS select agents or nonfunctional VS toxins.^[2]

(e) An attenuated strain of a VS select agent or toxin may be excluded from the requirements of this part based upon a determination that the attenuated strain does not pose a severe threat to animal health or to animal products.

(1) To apply for an exclusion, an individual or entity must submit a written request and supporting scientific information. A written decision granting or denying the request will be issued. An exclusion will be effective upon notification of the applicant. Exclusions will be published periodically in the notice section of the Federal Register and will be listed on the Internet at http://www.aphis.usda.gov/​programs/​ag_​selectagent/​index.html.

(2) If an excluded attenuated strain is subjected to any manipulation that restores or enhances its virulence, the resulting select agent or toxin will be subject to the requirements of this part.

(3) An individual or entity may make a written request to the Administrator for reconsideration of a decision denying an exclusion application. The written request for reconsideration must state the facts and reasoning upon which the individual or entity relies to show the decision was incorrect. The Administrator will grant or deny the request for reconsideration as promptly as circumstances allow and will state, in writing, the reasons for the decision.

(f) Any VS select agent or toxin seized by a Federal law enforcement agency will be excluded from the requirements of this part during the period between seizure of the agent or toxin and the transfer or destruction of such agent or toxin provided that:

(1) As soon as practicable, the Federal law enforcement agency transfers the seized agent or toxin to an entity eligible to receive such agent or toxin or destroys the agent or toxin by a recognized sterilization or inactivation process.

(2) The Federal law enforcement agency safeguards and secures the seized agent or toxin against theft, loss, or release, and reports any theft, loss, or release of such agent or toxin.

(3) The Federal law enforcement agency reports the seizure of the select agent or toxin to APHIS or CDC.

(i) The seizure of any of the following VS select agents and toxins must be reported within 24 hours by telephone, facsimile, or e-mail: African horse sickness virus, African swine fever virus, avian influenza virus (highly pathogenic), bovine spongiform encephalopathy agent, classical swine fever virus, foot-and-mouth disease virus, Newcastle disease virus (velogenic), rinderpest virus, and swine vesicular disease virus. This report must be followed by submission of APHIS/CDC Form 4 within 7 calendar days after seizure of the select agent or toxin.

(ii) For all other VS select agents or toxins, APHIS/CDC Form 4 must be submitted within 7 calendar days after seizure of the agent or toxin.

(iii) A copy of APHIS/CDC Form 4 must be maintained for 3 years.

(4) The Federal law enforcement agency reports the final disposition of the select agent or toxin by submission of APHIS/CDC Form 4. A copy of the completed form must be maintained for 3 years.

§ 121.4

Overlap select agents and toxins.

(a) Except as provided in paragraphs (d) and (e) of this section, the Administrator has determined that the biological agents and toxins listed in this section have the potential to pose a severe threat to public health and safety, to animal health, or to animal products.

(b) Overlap select agents and toxins:

Bacillus anthracis;

Botulinum neurotoxins;

Botulinum neurotoxin producing species of Clostridium;

Brucella abortus;

Brucella melitensis;

Brucella suis;

Burkholderia mallei;

Burkholderia pseudomallei;

Clostridium perfringens epsilon toxin;

Coccidioides immitis;

Coxiella burnetii;

Eastern equine encephalitis virus;

Francisella tularensis;

Hendra virus;

Nipah virus;

Rift Valley fever virus;

Shigatoxin;

Staphylococcal enterotoxins;

T-2 toxin;

Venezuelan equine encephalitis virus.

(c) Genetic elements, recombinant nucleic acids, and recombinant organisms:

(1) Nucleic acids that can produce infectious forms of any of the overlap select agent viruses listed in paragraph (b) of this section.^[3]

(2) Recombinant nucleic acids that encode for the functional forms of any overlap toxin listed in paragraph (b) of this section if the nucleic acids:

(i) Can be expressed in vivo or in vitro; or

(ii) Are in a vector or recombinant host genome and can be expressed in vivo or in vitro.

(3) Overlap select agents and toxins listed in paragraph (b) of this section that have been genetically modified.

(d) Overlap select agents or toxins that meet any of the following criteria are excluded from the requirements of this part:

(1) Any overlap select agent or toxin that is in its naturally occurring environment, provided that the agent or toxin has not been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source.

(2) Nonviable overlap select agents or nonfunctional overlap toxins.^[4]

(3) Overlap toxins under the control of a principal investigator, treating physician or veterinarian, or commercial manufacturer or distributor, if the aggregate amount does not, at any time, exceed the following amounts: 0.5 mg of Botulinum neurotoxins, 100 mg of Clostridium perfringens epsilon toxin, 100 mg of Shigatoxin, 5 mg of Staphylococcal enterotoxins, and 1,000 mg of T-2 toxin.

(e) An attenuated strain of an overlap select agent or toxin may be excluded from the requirements of this part based upon a determination that the attenuated strain does not pose a severe threat to public health and safety, to animal health, or to animal products.

(1) To apply for an exclusion, an individual or entity must submit a written request and supporting scientific information. A written decision granting or denying the request will be issued. An exclusion will be effective upon notification of the applicant. Exclusions will be published periodically in the notice section of the Federal Register and will be listed on the Internet at http://www.aphis.usda.gov/​programs/​ag_​selectagent/​index.html.

(2) If an excluded attenuated strain is subjected to any manipulation that restores or enhances its virulence, the resulting overlap select agent or toxin will be subject to the requirements of this part.

(3) An individual or entity may make a written request to the Administrator for reconsideration of a decision denying an exclusion application. The written request for reconsideration must state the facts and reasoning upon which the individual or entity relies to show the decision was incorrect. The Administrator will grant or deny the request for reconsideration as promptly as circumstances allow and will state, in writing, the reasons for the decision.

(f) Any overlap select agent or toxin seized by a Federal law enforcement agency will be excluded from the requirements of this part during the period between seizure of the agent or toxin and the transfer or destruction of such agent or toxin provided that:

(1) As soon as practicable, the Federal law enforcement agency transfers the seized agent or toxin to an entity eligible to receive such agent or toxin or destroys the agent or toxin by a recognized sterilization or inactivation process.

(2) The Federal law enforcement agency safeguards and secures the seized agent or toxin against theft, loss, or release, and reports any theft, loss, or release of such agent or toxin.

(3) The Federal law enforcement agency reports the seizure of the overlap select agent or toxin to APHIS or CDC.

(i) The seizure of any of the following overlap select agents and toxins must be reported within 24 hours by telephone, facsimile, or e-mail: Bacillus anthracis, Botulinum neurotoxins, Brucella melitensis, Francisella tularensis, Hendra virus, Nipah virus, Rift Valley fever virus, and Venezuelan equine encephalitis virus. This report must be followed by submission of APHIS/CDC Form 4 within 7 calendar days after seizure of the overlap select agent or toxin.

(ii) For all other overlap select agents or toxins, APHIS/CDC Form 4 must be submitted within 7 calendar days after seizure of the agent or toxin.

(iii) A copy of APHIS/CDC Form 4 must be maintained for 3 years.

(4) The Federal law enforcement agency reports the final disposition of the overlap select agent or toxin by submission of APHIS/CDC Form 4. A copy of the completed form must be maintained for 3 years.

§ 121.5

Exemptions for VS select agents and toxins.

(a) Diagnostic laboratories and other entities that possess, use, or transfer a VS select agent or toxin that is contained in a specimen presented for diagnosis or verification will be exempt from the requirements of this part for such agent or toxin contained in the specimen, provided that:

(1) Unless directed otherwise by the Administrator, within 7 calendar days after identification, the agent or toxin is transferred in accordance with § 121.16 or destroyed on-site by a recognized sterilization or inactivation process;

(2) The agent or toxin is secured against theft, loss, or release during the period between identification of the agent or toxin and transfer or destruction of such agent or toxin, and any theft, loss, or release of such agent or toxin is reported; and

(3) The identification of the agent or toxin is reported to APHIS or CDC.

(i) The identification of any of the following select agents and toxins must be immediately reported by telephone, facsimile, or e-mail: African horse sickness virus, African swine fever virus, avian influenza virus (highly pathogenic), bovine spongiform encephalopathy agent, classical swine fever virus, foot-and-mouth disease virus, Newcastle disease virus (velogenic), rinderpest virus, and swine vesicular disease virus. This report must be followed by submission of APHIS/CDC Form 4 within 7 calendar days after identification.

(ii) For all other VS select agents or toxins, APHIS/CDC Form 4 must be submitted within 7 calendar days after identification.

(iii) Less stringent reporting may be required during agricultural emergencies or outbreaks, or in endemic areas.

(iv) A copy of APHIS/CDC Form 4 must be maintained for 3 years.

(b) Diagnostic laboratories and other entities that possess, use, or transfer a VS select agent or toxin that is contained in a specimen presented for proficiency testing will be exempt from the requirements of this part for such agent or toxin contained in the specimen, provided that:

(1) Unless directed otherwise by the Administrator, within 90 calendar days of receipt, the agent or toxin is transferred in accordance with § 121.16 or destroyed on-site by a recognized sterilization or inactivation process;

(2) The agent or toxin is secured against theft, loss, or release during the period between identification of the agent or toxin and transfer or destruction of such agent or toxin, and any theft, loss, or release of such agent or toxin is reported; and

(3) The identification of the agent or toxin, and its derivative, is reported to APHIS or CDC. To report the identification of a select agent or toxin, APHIS/CDC Form 4 must be submitted within 90 days of receipt of the agent or toxin. A copy of the completed form must be maintained for 3 years.

(c) Diagnostic reagents and vaccines that are, bear, or contain VS select agents or toxins that are produced at USDA diagnostic facilities will be exempt from the requirements of this part.

(d) Unless the Administrator by order determines that additional regulation is necessary to protect animal health or animal products, products that are, bear, or contain VS select agents or toxins will be exempt from the requirements of this part if the products have been cleared, approved, licensed, or registered pursuant to:

(1) The Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et seq.);

(2) Section 351 of Public Health Service Act (42 U.S.C. 262);

(3) The Virus-Serum-Toxin Act (21 U.S.C. 151-159); or

(4) The Federal Insecticide, Fungicide, and Rodenticide Act (7 U.S.C. 131 et seq.).

(e) The Administrator may exempt from the requirements of this part an experimental product that is, bears, or contains a VS select agent or toxin if such product is being used in an investigation authorized by any Federal law and the Administrator determines that additional regulation under this part is not necessary to protect animal health or animal products. To apply for an exemption, an individual or entity must submit APHIS/CDC Form 5. A written decision granting or denying the exemption will be issued. The applicant must notify APHIS when an authorization for an investigation no longer exists. This exemption automatically terminates when such authorization is no longer in effect.

(f) In addition to the exemptions provided in paragraphs (a) through (e) of this section, the Administrator may grant a specific exemption upon a showing of good cause and upon his or her determination that such exemption is consistent with protecting animal health or animal products. An individual or entity may request in writing an exemption from the requirements of this part. If granted, such exemptions are valid for a maximum of 3 years; thereafter, an individual or entity must request a new exemption. If a request for exemption is denied, an individual or entity may request reconsideration in writing to the Administrator. The request for reconsideration must state all of the facts and reasons upon which the individual or entity relies to show that the exemption was wrongfully denied. The Administrator will grant or deny the request for reconsideration as promptly as circumstances allow and will state, in writing, the reasons for the decision.

§ 121.6

Exemptions for overlap select agents and toxins.

(a) Clinical or diagnostic laboratories and other entities that possess, use, or transfer an overlap select agent or toxin that is contained in a specimen presented for diagnosis or verification will be exempt from the requirements of this part for such agent or toxin contained in the specimen, provided that:

(1) Unless directed otherwise by the Administrator or the HHS Secretary, within 7 calendar days after identification, the agent or toxin is transferred in accordance with § 121.16 or 42 CFR 73.16 or destroyed on-site by a recognized sterilization or inactivation process;

(2) The agent or toxin is secured against theft, loss, or release during the period between identification of the agent or toxin and transfer or destruction of such agent or toxin, and any theft, loss, or release of such agent or toxin is reported; and

(3) The identification of the agent or toxin is reported to APHIS or CDC.

(i) The identification of any of the following overlap select agents and toxins must be immediately reported by telephone, facsimile, or e-mail: Bacillus anthracis, Botulinum neurotoxins, Brucella melitensis, Francisella tularensis, Hendra virus, Nipah virus, Rift Valley fever virus, and Venezuelan equine encephalitis virus. This report must be followed by submission of APHIS/CDC Form 4 within 7 calendar days after identification.

(ii) For all other overlap select agents or toxins, APHIS/CDC Form 4 must be submitted within 7 calendar days after identification.

(iii) Less stringent reporting may be required during agricultural emergencies or outbreaks, or in endemic areas.

(iv) A copy of APHIS/CDC Form 4 must be maintained for 3 years.

(b) Clinical or diagnostic laboratories and other entities that possess, use, or transfer an overlap select agent or toxin that is contained in a specimen presented for proficiency testing will be exempt from the requirements of this part for such agent or toxin contained in the specimen, provided that:

(1) Unless directed otherwise by the Administrator or the HHS Secretary, within 90 days of receipt, the agent or toxin is transferred in accordance with § 121.16 or 42 CFR 73.16 or destroyed on-site by a recognized sterilization or inactivation process;

(2) The agent or toxin is secured against theft, loss, or release during the period between identification of the agent or toxin and transfer or destruction of such agent or toxin, and any theft, loss, or release of such agent or toxin is reported; and

(3) The identification of the agent or toxin, and its derivative, is reported to APHIS or CDC. To report the identification of an overlap select agent or toxin, APHIS/CDC Form 4 must be submitted within 90 calendar days of receipt of the agent or toxin. A copy of the completed form must be maintained for 3 years.

(c) Unless the Administrator by order determines that additional regulation of a specific product is necessary to protect animal health or animal products, products that are, bear, or contain overlap select agents or toxins will be exempt from the requirements of this part if the products have been cleared, approved, licensed, or registered pursuant to:

(1) The Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et seq.);

(2) Section 351 of Public Health Service Act (42 U.S.C. 262);

(3) The Virus-Serum-Toxin Act (21 U.S.C. 151-159); or

(4) The Federal Insecticide, Fungicide, and Rodenticide Act (7 U.S.C. 131 et seq.).

(d) After consultation with the HHS Secretary, the Administrator may exempt from the requirements of this part an investigational product that is, bears, or contains an overlap select agent or toxin if such product is being used in an investigation authorized by any Federal law and the Administrator determines that additional regulation under this part is not necessary to protect animal health or animal products.

(1) To apply for an exemption, an individual or entity must submit APHIS/CDC Form 5.

(2) The Administrator will make a determination regarding an exemption within 14 calendar days after receipt of the application and notification that the investigation has been authorized under a Federal law. A written decision granting or denying the exemption will be issued.

(3) The applicant must notify APHIS or CDC when an authorization for an investigation no longer exists. This exemption automatically terminates when such authorization is no longer in effect.

(e) The Administrator may exempt an individual or entity from the requirements of this part for 30 calendar days if it is necessary to respond to a domestic or foreign agricultural emergency involving an overlap select agent or toxin. The Administrator may extend the exemption once for an additional 30 days. An individual or entity may apply for this exemption by submitting APHIS/CDC Form 5. A written decision granting or denying the exemption will be issued.

(f) Upon request of the Secretary of Health and Human Services, the Administrator may exempt an individual or entity from the requirements of this part for 30 calendar days if the Secretary of Health and Human Services has granted an exemption for a public health emergency involving an overlap select agent or toxin. The Administrator may extend the exemption once for an additional 30 days.

§ 121.7

Registration and related security risk assessments.

(a) Unless exempted under § 121.5, an individual or entity shall not possess, use, or transfer any VS select agent or toxin without a certificate of registration issued by the Administrator. Unless exempted under § 121.6 or 42 CFR 73.6, an individual or entity shall not possess, use, or transfer any overlap select agent or toxin without a certificate of registration issued by the Administrator and the HHS Secretary.

(b) As a condition of registration, each entity must designate an individual to be its responsible official. While most registrants are likely to be entities, in the event that an individual applies for and is granted a certificate of registration, the individual will be considered the responsible official.

(c)(1) As a condition of registration, the following must be approved by the Administrator or the HHS Secretary based on a security risk assessment by the Attorney General:

(i) The individual or entity;

(ii) The responsible official; and

(iii) Unless otherwise exempted under this section, any individual who owns or controls the entity.

(2) Federal, State, or local governmental agencies, including public accredited academic institutions, are exempt from the security risk assessments for the entity and the individual who owns or controls such entity.

(3) An individual will be deemed to own or control an entity under the following conditions: ^[5]

(i) For a private institution of higher education, an individual will be deemed to own or control the entity if the individual is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.

(ii) For entities other than institutions of higher education, an individual will be deemed to own or control the entity if the individual:

(A) Owns 50 percent or more of the entity, or is a holder or owner of 50 percent or more of its voting stock; or

(B) Is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.

(4) An entity will be considered to be an institution of higher education if it is an institution of higher education as defined in section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)), or is an organization described in 501(c)(3) of the Internal Revenue Code of 1986, as amended (26 U.S.C. 501(c)(3)).

(5) To obtain a security risk assessment, an individual or entity must submit the information necessary to conduct a security risk assessment to the Attorney General.

(d) To apply for a certificate of registration for only VS select agents or toxins, or for VS and PPQ select agents or toxins, an individual or entity must submit the information requested in the registration application package (APHIS/CDC Form 1) to APHIS. To apply for a certificate of registration for overlap select agents or toxins, overlap select agents or toxins and any combination of PPQ or VS select agents or toxins, or HHS select agents or toxins and any combination of PPQ or VS select agents or toxins, an individual or entity must submit the information requested in the registration application package (APHIS/CDC Form 1) to APHIS or CDC, but not both.

(e) Prior to the issuance of a certificate of registration, the responsible official must promptly provide notification of any changes to the application for registration by submitting the relevant page(s) of the registration application.

(f) The issuance of a certificate of registration may be contingent upon inspection or submission of additional information, such as the security plan, biosafety plan, incident response plan, or any other documents required to be prepared under this part.

(g) A certificate of registration will be valid for one physical location (a room, a building, or a group of buildings) where the responsible official will be able to perform the responsibilities required in this part, for specific select agents or toxins, and for specific activities.

(h) A certificate of registration may be amended to reflect changes in circumstances (e.g., replacement of the responsible official or other personnel changes, changes in ownership or control of the entity, changes in the activities involving any select agents or toxins, or the addition or removal of select agents or toxins).

(1) Prior to any change, the responsible official must apply for an amendment to a certificate of registration by submitting the relevant page(s) of the registration application.^[6]

(2) The responsible official will be notified in writing if an application to amend a certificate of registration has been approved. Approval of an amendment may be contingent upon an inspection or submission of additional information, such as the security plan, biosafety plan, incident response plan, or any other documents required to be prepared under this part.

(3) No change may be made without such approval.

(i) An entity must immediately notify APHIS or CDC if it loses the services of its responsible official. In the event that an entity loses the services of its responsible official, an entity may continue to possess or use select agents or toxins only if it appoints as the responsible official another individual who has been approved by the Administrator or the HHS Secretary following a security risk assessment by the Attorney General and who meets the requirements of this part.

(j) A certificate of registration will be terminated upon the written request of the entity if the entity no longer possesses or uses any select agents or toxins and no longer wishes to be registered.

(k) A certificate of registration will be valid for a maximum of 3 years.

§ 121.8

Denial, revocation, or suspension of registration.

(a) An application may be denied or a certificate of registration revoked or suspended if:

(1) The individual or entity, the responsible official, or an individual who owns or controls the entity is within any of the categories described in 18 U.S.C. 175b;

(2) The individual or entity, the responsible official, or an individual who owns or controls the entity is reasonably suspected by any Federal law enforcement or intelligence agency of:

(i) Committing a crime set forth in 18 U.S.C. 2332b(g)(5); or

(ii) Knowing involvement with an organization that engages in domestic or international terrorism (as defined in 18 U.S.C. 2331) or with any other organization that engages in intentional crimes of violence; or

(iii) Being an agent of a foreign power as defined in 50 U.S.C. 1801;

(3) The individual or entity does not meet the requirements of this part; ^[7] or

(4) It is determined that such action is necessary to protect animal health or animal products.

(b) Upon revocation or suspension of a certificate of registration, the individual or entity must:

(1) Immediately stop all use of each select agent or toxin covered by the revocation or suspension order;

(2) Immediately safeguard and secure each select agent or toxin covered by the revocation or suspension order from theft, loss, or release; and

(3) Comply with all disposition instructions issued by the Administrator for each select agent or toxin covered by the revocation or suspension.

(c) Denial of an application for registration and revocation of registration may be appealed under § 121.20. However, any denial of an application for registration or revocation of a certificate of registration will remain in effect until a final agency decision has been rendered.

§ 121.9

Responsible official.

(a) An individual or entity required to register under this part must designate an individual to be the responsible official. The responsible official must:

(1) Be approved by the Administrator or the HHS Secretary following a security risk assessment by the Attorney General;

(2) Be familiar with the requirements of this part;

(3) Have authority and responsibility to act on behalf of the entity;

(4) Ensure compliance with the requirements of this part; and

(5) Ensure that annual inspections are conducted for each laboratory where select agents or toxins are stored or used in order to determine compliance with the requirements of this part. The results of each inspection must be documented, and any deficiencies identified during an inspection must be corrected.

(b) An entity may designate one or more individuals to be an alternate responsible official, who may act for the responsible official in his/her absence. These individuals must have the authority and control to ensure compliance with the regulations when acting as the responsible official.

(c) The responsible official must report the identification and final disposition of any select agent or toxin contained in a specimen presented for diagnosis or verification.

(1) The identification of any of the following select agents or toxins must be immediately reported by telephone, facsimile, or e-mail: African horse sickness virus, African swine fever virus, avian influenza virus (highly pathogenic), Bacillus anthracis, Botulinum neurotoxins, bovine spongiform encephalopathy agent, Brucella melitensis, classical swine fever virus, foot-and-mouth disease virus, Francisella tularensis, Hendra virus, Newcastle disease virus (velogenic), Nipah virus, Rift Valley fever virus, rinderpest virus, swine vesicular disease virus, and Venezuelan equine encephalitis virus. The final disposition of the agent or toxin must be reported by submission of APHIS/CDC Form 4 within 7 calendar days after identification. A copy of the completed form must be maintained for 3 years.

(2) To report the identification and final disposition of any other select agent or toxin, APHIS/CDC Form 4 must be submitted within 7 calendar days after identification. A copy of the completed form must be maintained for 3 years.

(3) Less stringent reporting may be required during agricultural emergencies or outbreaks, or in endemic areas.

(d) The responsible official must report the identification and final disposition of any select agent or toxin contained in a specimen presented for proficiency testing. To report the identification and final disposition of a select agent or toxin, APHIS/CDC Form 4 must be submitted within 90 calendar days of receipt of the agent or toxin. A copy of the completed form must be maintained for 3 years.

§ 121.10

Restricting access to select agents and toxins; security risk assessments.

(a) An individual or entity required to register under this part may not provide an individual access to a select agent or toxin, and an individual may not access a select agent or toxin, unless the individual is approved by the Administrator or the HHS Secretary following a security risk assessment by the Attorney General.

(b) An individual will be deemed to have access at any point in time if the individual has possession of a select agent or toxin (e.g., carries, uses, or manipulates) or the ability to gain possession of a select agent or toxin.

(c) Each individual with access to select agents or toxins must have the appropriate education, training, and/or experience to handle or use such agents or toxins.

(d) To apply for access approval, each individual must submit the information necessary to conduct a security risk assessment to the Attorney General.

(e) An individual's security risk assessment may be expedited upon written request by the responsible official and a showing of good cause (e.g., public health or agricultural emergencies, national security, or a short-term visit by a prominent researcher). A written decision granting or denying the request will be issued.

(f) An individual's access approval for VS select agents or toxins may be denied, limited, or revoked if:

(1) The individual is within any of the categories described in 18 U.S.C. 175b;

(2) The individual is reasonably suspected by any Federal law enforcement or intelligence agency of committing a crime set forth in 18 U.S.C. 2332b(g)(5); knowing involvement with an organization that engages in domestic or international terrorism (as defined in 18 U.S.C. 2331) or with any other organization that engages in intentional crimes of violence; or being an agent of a foreign power as defined in 50 U.S.C. 1801; or

(3) It is determined that such action is necessary to protect animal health or animal products.

(g) For overlap select agents or toxins, an individual's access approval will be denied or revoked if the individual is within any of the categories described in 18 U.S.C. 175b. An individual's access approval may be denied, limited, or revoked for the reasons set forth in paragraphs (f)(2) through (f)(3) of this section.

(h) An individual may appeal the Administrator's decision to deny, limit, or revoke access approval under § 121.20.

(i) Access approval is valid for a maximum of 5 years.

(j) The responsible official must immediately notify APHIS or CDC when an individual's access to select agents or toxins is terminated by the entity and the reasons therefore.

§ 121.11

Security.

(a) An individual or entity required to register under this part must develop and implement a written security plan. The security plan must be sufficient to safeguard the select agent or toxin against unauthorized access, theft, loss, or release.

(b) The security plan must be designed according to a site-specific risk assessment and must provide graded protection in accordance with the risk of the select agent or toxin, given its intended use. The security plan must be submitted upon request.

(c) The security plan must:

(1) Describe procedures for physical security, inventory control, and information systems control;

(2) Contain provisions for the control of access to select agents and toxins;

(3) Contain provisions for routine cleaning, maintenance, and repairs;

(4) Establish procedures for removing unauthorized or suspicious persons;

(5) Describe procedures for addressing loss or compromise of keys, passwords, combinations, etc. and protocols for changing access numbers or locks following staff changes;

(6) Contain procedures for reporting unauthorized or suspicious persons or activities, loss or theft of select agents or toxins, release of select agents or toxins, or alteration of inventory records; and

(7) Contain provisions for ensuring that all individuals with access approval from the Administrator or the HHS Secretary understand and comply with the security procedures.

(d) An individual or entity must adhere to the following security requirements or implement measures to achieve an equivalent or greater level of security:

(1) Allow access only to individuals with access approval from the Administrator or the HHS Secretary;

(2) Allow individuals not approved for access by the Administrator or the HHS Secretary to conduct routine cleaning, maintenance, repairs, and other activities not related to select agents or toxins only when continuously escorted by an approved individual;

(3) Provide for the control of select agents and toxins by requiring freezers, refrigerators, cabinets, and other containers where select agents or toxins are stored to be secured against unauthorized access (e.g., card access system, lock boxes);

(4) Inspect all suspicious packages before they are brought into or removed from an area where select agents or toxins are used or stored;

(5) Establish a protocol for intra-entity transfers under the supervision of an individual with access approval from the Administrator or the HHS Secretary, including chain-of-custody documents and provisions for safeguarding against theft, loss, or release; and

(6) Require that individuals with access approval from the Administrator or the HHS Secretary refrain from sharing with any other person their unique means of accessing a select agent or toxin (e.g., keycards or passwords);

(7) Require that individuals with access approval from the Administrator or the HHS Secretary immediately report any of the following to the responsible official:

(i) Any loss or compromise of keys, passwords, combinations, etc.;

(ii) Any suspicious persons or activities;

(iii) Any loss or theft of select agents or toxins;

(iv) Any release of a select agent or toxin; and

(v) Any sign that inventory or use records for select agents or toxins have been altered or otherwise compromised; and

(8) Separate areas where select agents and toxins are stored or used from the public areas of the building.

(e) In developing a security plan, an individual or entity should consider the document entitled, “Laboratory Security and Emergency Response Guidance for Laboratories Working with Select Agents,” in Morbidity and Mortality Weekly Report (December 6, 2002); 51 (No. RR-19):1-6. This document is available on the Internet at http://www.cdc.gov/​mmwr.

(f) The plan must be reviewed annually and revised as necessary. Drills or exercises must be conducted at least annually to test and evaluate the effectiveness of the plan. The plan must be reviewed and revised, as necessary, after any drill or exercise and after any incident.

§ 121.12

Biosafety.

(a) An individual or entity required to register under this part must develop and implement a written biosafety plan that is commensurate with the risk of the select agent or toxin, given its intended use.^[8] The biosafety plan must contain sufficient information and documentation to describe the biosafety and containment procedures.

(b) The biosafety and containment procedures must be sufficient to contain the select agent or toxin (e.g., physical structure and features of the entity, and operational and procedural safeguards).

(c) In developing a biosafety plan, an individual or entity should consider the following:

(1) The CDC/NIH publication, “Biosafety in Microbiological and Biomedical Laboratories.” This document may be obtained from the U.S. Government Printing Office. It is also available on the Internet at http://www.aphis.usda.gov/​programs/​ag_​selectagent/​index.html.

(2) The Occupational Safety and Health Administration (OSHA) regulations in 29 CFR 1910.1200 and 1910.1450.

(3) The “NIH Guidelines for Research Involving Recombinant DNA Molecules.” This document is available on the Internet at http://www.aphis.usda.gov./​programs/​ag_​selectagent/​index.html.

(d) The plan must be reviewed annually and revised as necessary. Drills or exercises must be conducted at least annually to test and evaluate the effectiveness of the plan. The plan must be reviewed and revised, as necessary, after any drill or exercise and after any incident.

§ 121.13

Restricted experiments.^[9]

(a) An individual or entity may not conduct a restricted experiment with a VS select agent or toxin unless approved by and conducted in accordance with any conditions prescribed by the Administrator. In addition, an individual or entity may not conduct a restricted experiment with an overlap select agent or toxin unless approved by and conducted in accordance with any conditions prescribed by the Administrator and the HHS Secretary.

(b) Restricted experiments:

(1) Experiments utilizing recombinant DNA that involve the deliberate transfer of a drug resistance trait to select agents that are not known to acquire the trait naturally, if such acquisition could compromise the use of the drug to control disease agents in humans, veterinary medicine, or agriculture.

(2) Experiments involving the deliberate formation of recombinant DNA containing genes for the biosynthesis of toxins lethal for vertebrates at an LD₅₀ <100 ng/kg body weight.

(c) The Administrator may revoke approval to conduct any of the experiments in paragraph (b) of this section, or revoke or suspend a certificate of registration, if the individual or entity fails to comply with the requirements of this part.

(d) To apply for approval to conduct any of the experiments in paragraph (b) of this section, an individual or entity must submit a written request and supporting scientific information. A written decision granting or denying the request will be issued.

§ 121.14

Incident response.^[10]

(a) An individual or entity required to register under this part must develop and implement a written incident response plan.^[11] The incident response plan must be coordinated with any entity-wide plans, kept in the workplace, and available to employees for review.

(b) The incident response plan must fully describe the entity's response procedures for the theft, loss, or release of a select agent or toxin; inventory discrepancies; security breaches (including information systems); severe weather and other natural disasters; workplace violence; bomb threats and suspicious packages; and emergencies such as fire, gas leak, explosion, power outage, etc. The response procedures must account for hazards associated with the select agent or toxin and appropriate actions to contain such agent or toxin.

(c) The incident response plan must also contain the following information:

(1) The name and contact information (e.g., home and work) for the individual or entity (e.g., responsible official, alternate responsible official(s), biosafety officer, etc.);

(2) The name and contact information for the building owner and/or manager, where applicable;

(3) The name and contact information for tenant offices, where applicable;

(4) The name and contact information for the physical security official for the building, where applicable;

(5) Personnel roles and lines of authority and communication;

(6) Planning and coordination with local emergency responders;

(7) Procedures to be followed by employees performing rescue or medical duties;

(8) Emergency medical treatment and first aid;

(9) A list of personal protective and emergency equipment, and their locations;

(10) Site security and control;

(11) Procedures for emergency evacuation, including type of evacuation, exit route assignments, safe distances, and places of refuge; and

(12) Decontamination procedures.

(d) The plan must be reviewed annually and revised as necessary. Drills or exercises must be conducted at least annually to test and evaluate the effectiveness of the plan. The plan must be reviewed and revised, as necessary, after any drill or exercise and after any incident.

§ 121.15

Training.

(a) An individual or entity required to register under this part must provide information and training on biosafety and security to each individual with access approval from the Administrator or the HHS Secretary before he/she has such access. In addition, an individual or entity must provide information and training on biosafety and security to each individual not approved for access by the Administrator or the HHS Secretary before he/she works in or visits areas where select agents or toxins are handled or stored (e.g., laboratories, growth chambers, animal rooms, greenhouses, storage areas, etc.). The training must address the particular needs of the individual, the work they will do, and the risks posed by the select agents or toxins.^[12]

(b) Refresher training must be provided annually.

(c) A record of the training provided to each individual must be maintained. The record must include the name of the individual, the date of training, a description of the training provided, and the means used to verify that the employee understood the training.

§ 121.16

Transfers.

(a) Except as provided in paragraphs (c) and (d) of this section, a select agent or toxin may only be transferred to individuals or entities registered to possess, use, or transfer that agent or toxin. A select agent or toxin may only be transferred under the conditions of this section and must be authorized by APHIS or CDC prior to the transfer.^[13]

(b) In addition to any permit required under part 122 of this subchapter, a transfer may be authorized if:

(1) The sender:

(i) Has at the time of transfer a certificate of registration that covers the particular select agent or toxin to be transferred and meets all the requirements of this part;

(ii) Meets the exemption requirements for the particular select agent or toxin to be transferred; or

(iii) Is transferring the select agent or toxin from outside of the United States and meets all import requirements.

(2) At the time of transfer, the recipient has a certificate of registration that includes the particular select agent or toxin to be transferred and meets all of the requirements of this part.

(c) A select agent or toxin that is contained in a specimen for proficiency testing may be transferred without prior authorization from APHIS or CDC provided that, at least 7 calendar days prior to the transfer, the sender reports to APHIS or CDC the select agent or toxin to be transferred and the name and address of the recipient.

(d) On a case-by-case basis, the Administrator may authorize a transfer of a select agent or toxin not otherwise eligible for transfer under this part under conditions prescribed by the Administrator.

(e) To obtain authorization for a transfer, APHIS/CDC Form 2 must be submitted.

(f) The recipient must submit a completed APHIS/CDC Form 2 within 2 business days of receipt of a select agent or toxin.

(g) The recipient must immediately notify APHIS or CDC if the select agent or toxin has not been received within 48 hours after the expected delivery time or if the package containing the select agent or toxin has been damaged to the extent that a release of the select agent or toxin may have occurred.

(h) An authorization for a transfer shall be valid only for 30 calendar days after issuance, except that such an authorization becomes immediately null and void if any facts supporting the authorization change (e.g., change in the certificate of registration for the sender or recipient, change in the application for transfer).

(i) The sender must comply with all applicable laws governing packaging and shipping.

§ 121.17

Records.

(a) An individual or entity required to register under this part must maintain complete records relating to the activities covered by this part. Such records must include:

(1) An accurate, current inventory for each select agent (including viral genetic elements, recombinant nucleic acids, and recombinant organisms) held in long-term storage (placement in a system designed to ensure viability for future use, such as in a freezer or lyophilized materials), including:

(i) The name and characteristics (e.g., strain designation, GenBank Accession number, etc.);

(ii) The quantity acquired from another individual or entity (e.g., containers, vials, tubes, etc.), date of acquisition, and the source;

(iii) Where stored (e.g., building, room, and freezer);

(iv) When moved from storage and by whom and when returned to storage and by whom;

(v) The select agent used and purpose of use;

(vi) Records created under § 121.16 or 42 CFR 73.16 (Transfers);

(vii) For intra-entity transfers (sender and the recipient are covered by the same certificate of registration), the select agent, the quantity transferred, the date of transfer, the sender, and the recipient; and

(viii) Records created under § 121.19 or 42 CFR 73.19 (Notification of theft, loss, or release);

(2) An accurate, current inventory for each toxin held, including:

(i) The name and characteristics;

(ii) The quantity acquired from another individual or entity (e.g., containers, vials, tubes, etc.), date of acquisition, and the source;

(iii) The initial and current quantity amount (e.g., milligrams, milliliters, grams, etc.);

(iv) The toxin used and purpose of use, quantity, date(s) of the use and by whom;

(v) Where stored (e.g., building, room, and freezer);

(vi) When moved from storage and by whom and when returned to storage and by whom, including quantity amount;

(vii) Records created under § 121.16 or 42 CFR 73.16 (Transfers);

(viii) For intra-entity transfers (sender and the recipient are covered by the same certificate of registration), the toxin, the quantity transferred, the date of transfer, the sender, and the recipient;

(ix) Records created under § 121.19 or 42 CFR 73.19 (Notification of theft, loss, or release);

(x) If destroyed, the quantity of toxin destroyed, the date of such action, and by whom.

(3) A current list of all individuals that have been granted access approval by the Administrator or the HHS Secretary;

(4) Information about all entries into areas containing select agents or toxins, including the name of the individual, name of the escort (if applicable), and the date and time of entry;

(5) Accurate, current records created under § 121.9 or 42 CFR 73.9 (Responsible official), § 121.11 or 42 CFR 73.11 (Security), § 121.12 or 42 CFR 73.12 (Biosafety), § 121.14 or 42 CFR 73.14 (Incident response), and § 121.15 or 42 CFR 73.15 (Training); and

(6) A written explanation of any discrepancies.

(b) The individual or entity must implement a system to ensure that all records and databases created under this part are accurate, have controlled access, and that their authenticity may be verified.

(c) All records created under this part must be maintained for 3 years and promptly produced upon request.

§ 121.18

Inspections.

(a) Without prior notification, APHIS must be allowed to inspect any site at which activities regulated under this part are conducted and must be allowed to inspect and copy any records relating to the activities covered by this part.

(b) Prior to issuing a certificate of registration to an individual or entity, APHIS may inspect and evaluate the premises and records to ensure compliance with this part.

§ 121.19

Notification of theft, loss, or release.

(a) An individual or entity must immediately notify APHIS or CDC upon discovery of the theft or loss of a select agent or toxin. Thefts or losses must be reported even if the select agent or toxin is subsequently recovered or the responsible parties are identified.

(1) The theft or loss of a select agent or toxin must be reported by telephone, facsimile, or e-mail. The following information must be provided:

(i) The name of the select agent or toxin and any identifying information (e.g., strain or other characterization information);

(ii) An estimate of the quantity stolen or lost;

(iii) An estimate of the time during which the theft or loss occurred;

(iv) The location (building, room) from which the theft or loss occurred; and

(v) The list of Federal, State, or local law enforcement agencies to which the individual or entity reported, or intends to report, the theft or loss.

(2) A completed APHIS/CDC Form 3 must be submitted within 7 calendar days.

(b) An individual or entity must immediately notify APHIS or CDC upon discovery of a release of a select agent or toxin causing occupational exposure or a release of a select agent or toxin outside of the primary barriers of the biocontainment area.

(1) The release of a select agent or toxin must be reported by telephone, facsimile, or e-mail. The following information must be provided:

(i) The name of the select agent or toxin and any identifying information (e.g., strain or other characterization information);

(ii) An estimate of the quantity released;

(iii) The time and duration of the release;

(iv) The environment into which the release occurred (e.g., in building or outside of building, waste system);

(v) The location (building, room) from which the release occurred; and

(vi) The number of individuals potentially exposed at the entity;

(vii) Actions taken to respond to the release; and

(viii) Hazards posed by the release.

(2) A completed APHIS/CDC Form 3 must be submitted within 7 calendar days.

§ 121.20

Administrative review.

An individual or entity may appeal a denial, revocation, or suspension of registration under this part. An individual may appeal a denial, limitation, or revocation of access approval under this part.^[14] The appeal must be in writing, state the factual basis for the appeal, and be submitted to the Administrator within 30 calendar days of the decision. Where the denial, revocation, or suspension of registration or the denial, limitation, or revocation of an individual's access approval is based upon an identification by the Attorney General, the request for review will be forwarded to the Attorney General. The Administrator's decision constitutes final agency action.

Done in Washington, DC, this 10th day of March, 2005.

Bill Hawks,

Under Secretary for Marketing and Regulatory Programs.

Footnotes

1.  Any microorganism (including, but not limited to, bacteria, viruses, fungi, rickettsiae, or protozoa), or infectious substance, or any naturally occurring, bioengineered, or synthesized component of any such microorganism or infectious substance, capable of causing: (1) Death, disease or other biological malfunction in a human, an animal, a plant, or another living organism; (2) deterioration of food, water, equipment, supplies, or material of any kind; or (3) deleterious alteration of the environment.

2.  The toxic material or product of plants, animals, microorganisms (including, but not limited to, bacteria, viruses, fungi, rickettsiae, or protozoa), or infectious substances, or a recombinant or synthesized molecule, whatever their origin and method of production, and includes: (1) Any poisonous substance or biological product that may be engineered as a result of biotechnology produced by a living organism; or (2) any poisonous isomer or biological product, homolog, or derivative of such a substance.

3.  Buzby, J.C. Effects of food-safety perceptions on food demand and global trade. Changing Structure of Global Food Consumption and Trade/WRS-01-1. Economic Research Service/USDA.

4.  Ekboir, J.M. Potential impact of foot-and-mouth disease in California: the role and contribution of animal health surveillance and monitoring services. Davis, CA: Agricultural Issues Center, Division of Agriculture and Natural Resources, University of California, Davis, 1999.

5.  DTZ Pieda Consulting. Economic Impact of BSE on the UK economy. A Report commissioned by the UK Agricultural Departments and HM Treasury.

6.  National Research Council.

7.  Those entities for which the CDC is considered the primary regulatory agency are considered in conjunction with the CDC rule.

8.  Thus far, APHIS has received 148 applications for registration or exemption. Of those, 72 were exempt, have been shifted to CDC, been withdrawn, or denied.

9.  For purposes of this analysis we use estimates of an average hourly respondent labor rate (including fringe and overhead) of $86.09 for managerial staff, and $69.34 for technical staff. Based on the 2000 Occupational Employment Statistics Survey, Bureau of Labor Statistics.

10.  Based on information from the registration applications, 40 percent of the registered entities have 1 PI, 30 percent have 2 PIs, 11 percent have 3 PIs, 6 percent have 4 PIs, 3 percent have 5 PIs, 3 percent have 6 PIs, 3 percent have 7 PIs, and 1 percent have 9 PIs.

11.  To minimize the administrative burden associated with this new registration program, initially APHIS will assign expiration dates ranging from 24 to 36 months to stagger the dates for renewing registration. Upon renewal, it is expected that all certificates of registration will be valid for 3 years.

12.  Prior to the enactment of the Public Health Security and Bioterrorism Response Act of 2002, USDA issued permits for importation and interstate movement of agents and toxins, including those now listed in 7 CFR part 331 and 9 CFR part 121.

13.  Robert Rice, Security Manager, APHIS select agent program.

14.  Robert Rice, Security Manager, APHIS select agent program.

15.  Equivalent security needs at two buildings can have significant differences in cost per ft ². For example, the need for one $1000 video camera would add $1 to the ft ² cost of a 1000 ft ² facility, but only $0.1 to a 10,000 ft ² one.

16.  Robert Rice, Security Manager, APHIS select agent program.

17.  Christian Lee, Physical Security Specialist, USDA-APHIS-FMD-ESB. Personal communication.

18.  Based on a review of 20 security plans for select agents or toxins submitted to APHIS. The review covered a broad spectrum of security plans, and type of entity. Plans were reviewed at random. Robert Rice, Security Manager, APHIS select agent program.

19.  Among others: Presidential Decision Directive 63, Critical Infrastructure Protection; the Computer Security Act of 1987 (Public Law (PL) 100-235); the Computer Fraud and Abuse Act (18 U.S.C. Sec. 1030 [1993]); Office of Management and Budget (OMB) Circular No. A-123, Management Accountability and Control; Appendix III of OMB Circular No. A-130, Management of Federal Information Resources; FED-STD-1037A, “An Electronic Means for Communicating Information; and the Electronic Communications Privacy Act (18 U.S.C. 2701).

20.  The average number of individuals needing security risk assessments per entity.

21.  1997 Economic Census. Department of Commerce, Census Bureau.

22.  AAVLD provided information on 10 veterinary diagnostic laboratories. These laboratories ranged in size form 11 to 100 employees including faculty, staff (part- and full-time), and students. In addition, the AAVLD president estimated that diagnostic laboratories in general would likely have between 6 and 80 employees. According to Dr. Denise Spenser, USDA-APHIS, university research on select agents likely involves fewer than 100 individuals (3 to 5 principal investigators out of about 25 faculty members in each of 3 or 4 departments—microbiology (veterinary microbiology), chemistry, and physiology, 3 to 5 (20 at most) investigators, technicians, and students in each laboratory).

23.  Based on a review of 20 security plans of affected entities.

24.  The baseline estimated cost/ft² of $8.71/ft² for facilities less than 30,000 ft2 in size, plus an adjustment of 17.7% for retrofitting existing structures.

25.  Robert Rice, Security Manager, APHIS select agent program.

26.  IPEDS.

1.  These conditions may apply to more than one individual.

2.  Depending on the change, a security risk assessment by the Attorney General may also be required (e.g., replacement of the responsible official, changes in ownership or control of the entity, new researchers or graduate students, etc.).

3.  If registration is denied for this reason, we may provide technical assistance and guidance.

4.  Technical assistance and guidance may be obtained by contacting APHIS.

5.  For guidance, see the NIH publication, “NIH Guidelines for Research Involving Recombinant DNA Molecules.” This document is available on the Internet at http://www.aphis.usda.gov/​programs/​ag_​selectagent/​index.html.

6.  Nothing in this section is meant to supersede or preempt incident response requirements imposed by other statutes or regulations.

7.  Technical assistance and guidance may be obtained by contacting APHIS.

8.  The requirements of this section do not apply to transfers within a registered entity (i.e., the sender and the recipient are covered by the same certificate of registration).

9.  An entity may not appeal the denial or limitation of an individual's access to select agents or toxins.

1.  The importation and interstate movement of VS select agents or toxins listed in paragraphs (c)(1) through (c)(3) of this section may be subject to the permit requirements under part 122 of this subchapter.

2.  However, the importation and interstate movement of these nonviable select agents may be subject to the permit requirements under part 122 of this subchapter.

3.  The importation and interstate movement of overlap select agents or toxins listed in paragraphs (c)(1) through (c)(3) of this section may be subject to the permit requirements under part 122 of this subchapter.

4.  However, the importation and interstate movement of these nonviable overlap select agents may be subject to the permit requirements under part 122 of this subchapter.

5.  These conditions may apply to more than one individual.

6.  Depending on the change, a security risk assessment by the Attorney General may also be required (e.g., replacement of the responsible official, changes in ownership or control of the entity, new researchers or graduate students, etc.)

7.  If registration is denied for this reason, we may provide technical assistance and guidance.

8.  Technical assistance and guidance may be obtained by contacting APHIS.

9.  For guidance, see the NIH publication, “NIH Guidelines for Research Involving Recombinant DNA Molecules.” This document is available on the Internet at http://www.aphis.usda.gov/​programs/​ag_​selectagent/​index.html.

10.  Nothing in this section is meant to supersede or preempt incident response requirements imposed by other statutes or regulations.

11.  Technical assistance and guidance may be obtained by contacting APHIS.

12.  For guidance, see the CDC/NIH publication, “Biosafety in Microbiological and Biomedical Laboratories.” This document is available on the Internet at http://www.aphis.usda.gov/​programs/​ag_​selectagent/​index.html.

13.  The requirements of this section do not apply to transfers within a registered entity (i.e., the sender and the recipient are covered by the same certificate of registration).

14.  An entity may not appeal the denial or limitation of an individual's access to select agents or toxins.