05-5216. Possession, Use, and Transfer of Select Agents and Toxins

AGENCY:

Centers for Disease Control and Prevention, Office of Inspector General, Department of Health Human Services (HHS).

ACTION:

Final rule.

SUMMARY:

This document establishes a final rule regarding possession, use, and transfer of select agents and toxins. The final rule implements provisions of the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 and is designed to protect public health and safety.

In a companion document published in this issue of the Federal Register, the United States Department of Agriculture has established corresponding final rules designed to protect animal and plant health and animal and plant products.

DATES:

The final rule is effective April 18, 2005.

FOR FURTHER INFORMATION CONTACT:

Mark Hemphill, Chief of Policy, Select Agent Program, Centers For Disease Control and Prevention, 1600 Clifton Rd., MS E-79, Atlanta, GA 30333. Telephone: [phone].

SUPPLEMENTARY INFORMATION:

This document establishes a final rule regarding possession, use, and transfer of select agents and toxins. The final rule is based on the interim final rule, as amended (amended interim final rule). The initial interim final rule was published in the Federal Register on December 13, 2002 (67 FR 76886). It was amended by a second interim final rule published in the Federal Register on November 3, 2003 (68 FR 62245). The initial interim final rule established a comprehensive set of regulations that included requirements concerning registration and security risk assessments. The second interim final rule amended the first interim final rule by allowing for the issuance of provisional certificates of registration and provisional grants of access to select agents and toxins, subject to completion of security risk assessments, and compliance with all of the requirements of the initial interim final rule. The final rule, which is set forth at 42 FR part 73, implements provisions of the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (the Act) and is designed to protect public health and safety.

In general, this final rule contains provisions that apply to academic institutions and biomedical centers; commercial manufacturing facilities; federal, state, and local laboratories, including clinical and diagnostic laboratories; and research facilities.

For the initial interim final rule, we provided for a 60-day comment period for written comments that ended February 11, 2003. We also held a public meeting on December 16, 2002. Relevant issues raised by the comments (oral comments made at the public meeting and 110 written comments) are discussed below. For the second interim final rule, we provided for a 60-day comment period for written comments that ended January 2, 2004. We received no comments in response to the second interim final rule. Based on the rationale set forth in the initial interim final rule, the second interim final rule, and this document, we are affirming the provisions of the amended interim final rule as a final rule with changes discussed below.

The final rule is designed to implement authorities under the Act to protect public health and safety. The United States Department of Agriculture (USDA) has established corresponding sets of regulations designed to protect animal and plant health and animal and plant products (9 CFR part 121 and 7 CFR part 331).

42 CFR Part 1003

The initial interim final rule amended 42 CFR part 1003 to establish delegations of authority and other provisions involving the Office of Inspector General (OIG) of HHS. In addition to adding a new paragraph (b)(16) to § 1003.102 to authorize the imposition of civil money penalties for violations of the regulatory provisions, the interim final rule also sought public comments on the possible inclusion of specific factors that might be used to assess specific penalty amounts. The amended interim final rule had no effect on the OIG amendments and we received no comments regarding these amendments. However, since amendatory language to the OIG regulations addressing determinations regarding the amount of a penalty was not originally included in the initial interim final rule, we are now revising § 1003.106(a)(1) to reference the newly codified § 1003.102(b)(16) and the factors to be taken into account when the OIG assesses civil money penalties. We are affirming all other amendments set forth in the interim final rule.

42 CFR 72.6 and Its Accompanying Appendix A

The provisions of the final rule supersede all of the provisions at 42 CFR 72.6 (captioned “Additional requirements for facilities transferring or receiving select agents”) and its accompanying Appendix A. However, the provisions of 18 U.S.C. 175b include prohibitions that are based on the list of select agents in Appendix A of 42 CFR part 72 and exemptions to such list in § 72.6(h). Accordingly, we have deleted the superseded provisions and in their place have added language to indicate that for purposes of 18 U.S.C. 175b the list of select agents are set forth in §§ 73.3 and 73.4 and the exemptions are set forth in §§ 73.5 and 73.6.

Changes in Structure in Part 73

With respect to the sections in part 73, we changed the final rule to make the structure and format of the HHS regulations and the USDA regulations at 9 CFR part 121 more similar. The following chart shows the changes.

Amended interim final rule	Final rule
73.1 Definitions	73.1 Definitions.
73.2 Purpose and scope	73.2 Purpose and scope.
73.3 General prohibition	73.3 HHS select agents and toxins.
73.4 HHS select agents and toxins	73.4 Overlap select agents and toxins.
73.5 Overlap select agents and toxins	73.5 Exemptions for HHS select agents and toxins.
73.6 Exemptions from requirements under this part	73.6 Exemptions for overlap select agents and toxins.
73.71 Registration	73.7 Registration and related security risk assessments.
73.8 Security Risk Assessments	73.8 Denial, revocation, or suspension of registration.
73.9 Responsible Official	73.9 Responsible Official.
73.10 Safety	73.10 Restricting access to select agents and toxins; security risk assessments.
73.11 Security	73.11 Security.
73.12 Emergency response	73.12 Biosafety.
73.13 Training	73.13 Restricted experiments.
73.14 Transfers	73.14 Incident response.
73.15 Records	73.15 Training.
73.16 Inspections	73.16 Transfers.
73.17 Notification for theft, loss, or release	73.17 Records.
73.18 Administrative review	73.18 Inspections.
73.19 Civil money penalties	73.19 Notification of theft, loss, or release.
73.20 Criminal penalties	73.20 Administrative review.
73.21 Submissions and forms	73.21 Civil money penalties.

Section 73.0 Applicability and Related Requirements

Under the provisions of § 73.0 of the initial interim final rule, a number of the provisions became applicable on February 7, 2003, while other provisions became applicable at subsequent scheduled times on or before November 12, 2003. A number of commenters requested that different applicability dates be established, but no commenters requested that applicability dates be later than November 12, 2003. As noted above, the interim final rule was amended allowing, subject to completion of security risk assessments and compliance with all other requirements set forth in the initial interim final rule, for the issuance of provisional certificates of registration and provisional grants of access to select agents and toxins. These security risk assessments have been completed.

Accordingly, we are removing all of the provisions of § 73.0. They have served their purpose by implementing the statutorily mandated principles of protecting public health and safety while minimizing disruption or termination of research or educational projects.

“Access” and “Area”

Commenters argued that the terms “area” and “access” are unclear. In response, we have eliminated references to area and used it in the regulations only when we believe it is clear in context. Also, consistent with many suggestions by commenters, we have provided language in § 73.10(b) to clarify that “An individual will be deemed to have access at any point in time if the individual has possession of a select agent or toxin (e.g., ability to carry, use, or manipulate) or the ability to gain possession of a select agent or toxin.” In addition, we clarified the language that an individual with “access approval from the HHS Secretary or Administrator” is an individual who has been granted access to select agents or toxins from the HHS Secretary or Administrator following a security risk assessment.

Section 73.1 Definitions

We added definitions of “Administrator”, “Animal and Plant Health Inspection Service (APHIS)”, “Attorney General”, “Responsible Official” and “State”, made corrections to the definitions of “HHS Secretary”, “Proficiency testing”, and “United States”, and deleted the definition of “USDA Secretary.” Also, we changed the definitions of “diagnosis” and “verification” to more fully reflect their common meanings in the regulated community. Moreover, we added a definition of “specimen” to reflect its common meaning in the regulated community. All terms not defined in this section shall have the meaning that is commonly understood in the scientific community based on the context in which those terms appear in this part.

Entity

One commenter stated the definition of “entity” does not include “person” or “individual.” To prevent legal confusion and arguments, the commenter recommended that in “§ 73.1—Definitions the term ‘entity’ be redefined to include a ‘person’ and/or an ‘individual’ and that the same defined term(s) be used in all section”. We made no changes in the definition section based on this comment. However, for clarification purposes, we have added “individual or entity” language throughout the document.

Another commenter claimed that the term “entity” is subject to interpretation. The commenter stated that it does not make sense for a large multi-campus university to base cumulative limits on toxins or the designation of the Responsible Official on the entity when the actual labs are separated by hundreds of miles. We made no changes in the definition section based on this comment. The issue is addressed below in the registration section.

Responsible Official

Commenters recommended that CDC add the APHIS definition for Responsible Official, which reads, “The individual designated by an entity to act on its behalf. This individual must have the authority and control to ensure compliance with the regulations in this Part.” We agreed with the commenters that CDC and APHIS adopt a common definition for the term “Responsible Official.” Accordingly, we are adding the definition for “Responsible Official”.

Section 73.2 Purpose and Scope and § 73.3 General Prohibition

We received no comments concerning §§ 73.2 and 73.3. Since the language in § 73.3 is consistently addressed throughout the document, we deleted this section.

Section 73.3 HHS Select Agents and Toxins and § 73.4 Overlap Select Agents and Toxins

Some of the select agents and toxins regulated by HHS under part 73 are also regulated by USDA under 9 CFR part 121. The select agents and toxins subject to regulation by both agencies are identified as “overlap select agents and toxins” and those regulated solely by HHS are identified as “HHS select agents and toxins.”

General

Commenters recommended that the final rule include an appendix that would provide a summary of the risk assessment data that supports the listing of each select agent and toxin. Commenters argued that “These data will heighten the awareness of individuals who possess and use a listed agent to the most important risk characteristics of the listed agents' and “This knowledge will promote safe practices and proficiency in the handling of a listed agent.”

Commenters also argued that this will help affected entities make assessments for the future. CDC did not include risk assessment data in the regulations but did provide such information in the rule's preamble. We do not believe it is necessary to provide a summary of the risk assessment data that supports the listing of each select agent or toxin in order to heighten awareness of the risk characteristics of such agents and toxins and promote safe practice and proficiency in handling of such agents and toxins. Information about the risk characteristics of a select agent or toxin and safe handling practices is available in scientific literature and other publications (e.g., the CDC/NIH publication, “Biosafety in Microbiological and Biomedical Laboratories”). As noted in the preamble of the August 2002 interim rule, the Act requires the HHS Secretary to consider the following criteria in determining whether to list an agent or toxin: (1) The effect on human health of exposure to the agent or toxin; (2) the degree of contagiousness of the agent or toxin and the methods by which the agent or toxin is transferred to humans; (3) the availability and effectiveness of pharmacotherapies and immunizations to treat and prevent any illness resulting from infection by the agent or toxin; and (4) any other criteria, including the needs of children and other vulnerable populations, that the Secretary considers appropriate. The Secretary directed the CDC to convene an inter-agency working group to determine which biological agents and toxins required regulation based on the criteria noted above. In June 2002, CDC convened an interagency working group to review the current list of select agents and toxins and develop recommendations for a select agent list. Members of the working group included representatives from the Department of Health and Human Services/Office of the Secretary (DHHS/OS), the Centers for Disease Control and Prevention (CDC), the National Institutes of Health (NIH), the Food and Drug Administration (FDA), the Department of the Army (DoD/Army), the Department of the Navy (DoD/Navy), the Department of the Air Force (DoD/AF), the U.S. Department of Agriculture (USDA), the Environmental Protection Agency (EPA), the Agency for Toxic Substances and Disease Registry (ATSDR), the Department of Labor/Occupational Safety and Health Administration (OSHA), the National Institute of Occupational Safety and Health (CDC/NIOSH), the Department of Transportation (DoT), the Department of Commerce (DoC), the Department of Energy (DoE), the Department of Justice (DoJ), the Federal Bureau of Investigation (FBI), the Central Intelligence Agency (CIA), the Defense Intelligence Agency (DoD/DIA), and the U.S. Postal Service (USPS). For these reasons, we are making no change based on this comment.

Prion Agents

One commenter asserted that the Creutzfeldt-Jacob Disease and Kuru agents should be added to the list of HHS select agents and toxins. The commenter noted that the “Arguments for omission include the difficulty of obtaining these agents, the extreme difficulty of replicating them, low infectivity by the oral route, and the absence of person-to-person infectivity.” The commenter then argued that they should be included based on the conclusions “that a single real or claimed incident of contaminating a childhood vaccine with a prion would cause indescribable anguish” and that “The difficulty of confirming or refuting a claim that prions had been added to a vaccine would cripple most legitimate public health programs and result in epidemics of preventable diseases.” The commenter concluded by stating that “In my judgment, the remote but extreme risk fully justifies the cost of including prions that are infectious to humans.” We made no changes based on this comment. Based upon the criteria that the HHS Secretary must consider, it was the consensus of the Secretary's Select Agent and Toxin Working Group that Creutzfeldt-Jacob Disease (CJD) and Kuru agents should not be added to the list because the degree of contagiousness of prions are too low to pose a significant mass casualty threat. While they are infectious under some circumstances, such as cannibalism in New Guinea causing Kuru or Creutzfeldt-Jacob Disease by the consumption of infected bovine central nervous system tissue, there is no evidence of contact or aerosol transmission of prions from one human to another.

Viruses

The amended interim final rule included Cercopithecine herpesvirus 1 (Herpes B virus) on the list of viruses designated as HHS select agents and toxins. Commenters acknowledged that the virus naturally infects many species of macaques and can produce a serious, often fatal, infection in humans when not treated. Commenters argued that Herpes B virus should not be included as a select agent based on the following assertions:

• “The inclusion of the virus on the list will produce no significant improvements in safety for the American public.
• Human infections are extremely rare—this is evidenced by the finding that of the literally hundreds of thousands of people who have worked with macaques over the past seventy years, there have been at most 50 human cases establishing infections with 23 documented deaths (one commenter argued that the low number of human cases may reflect infrequent shedding in macaque hosts or difficulty in the transmission of the agent to humans).
• The virus is capable of being treated with several available antiviral compounds.
• The inclusion of the virus on the list will significantly complicate transport for biomedical and biodefense research of macaques that are healthy, but chronically infected with B virus.
• The virus does not present a sufficient risk of infection by the aerosol route.
• The virus is a highly unlikely candidate for a bioterrorism agent.”

Commenters further stated that if the intent of inclusion is to monitor laboratories that cultivate large volumes of the virus in vitro then the rule should only cover this aspect.

We made no changes based on these comments. We have concluded that Cercopithecine herpesvirus 1 (Herpes B virus) has high morbidity, can be replicated in large concentrations, and can cause infections via the aerosol route. The regulations exclude “any select agent or toxin that is in its naturally occurring environment provided that it has not been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source.” This would include species of macaques that have been naturally infected with Cercopithecine herpesvirus 1 (Herpes B virus) as long as the virus has not been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source.

The amended interim final rule included Eastern Equine Encephalitis virus on the list of viruses designated as overlap select agents and toxins. One commenter asserted that the South/Central American subtypes of the virus should be deleted from the list. This was based on the finding that “The Naval Medical Research Center Detachment (Lima, Peru) has studied over 6,600 cases of febrile illness in Iquitos [sic] and surrounding areas since 1994, but has never detected a single case of human EEE despite repeated isolations of the virus (two of the three South American subtypes) from mosquitoes in the same locations (Douglas Watts, UTMB, unpublished).” The commenters concluded that “therefore, the South/Central American subtypes are probably completely avirulent for people and not a bioterrorism risk.” We made no changes based on this comment. There are no published data supporting the commenters' assertion. Further, a literature search indicated that there are examples of South American EEE strains that are lethal in humans and studies of animal models have produced conflicting results.

Fungi

The list of select agents includes Coccidioides posadasii and Coccidioides immitis. One commenter questioned whether either of these should be included on the list of select agents and toxins. We made no changes based on this comment. These agents cause high morbidity in humans, are highly infectious via the aerosol route, and sporulate easily in culture. Also, there is no vaccine available.

Toxins

One commenter recommended that Mistletoe lectin I, Modeccin, and Volkensin be reviewed for inclusion in the list of select agents and toxins. The commenter argued that “These toxins are toxicologically similar (LD50 and medical affect) to Ricin and Abrin [both are included as select toxins] and are readily available since they freely grow without cultivation.” We made no changes based on this comment. Like ricin, these toxins have only moderate toxicity compared to other toxins on the list. However, unlike ricin, these toxins are not readily available in partially purified forms in sufficient quantities to pose a significant public health threat.

The amended interim final rule included Diacetoxyscirpenol and T-2 toxin on the list of select agents and toxins. One commenter asserted that it is pointless to include them on the list because they can easily be produced using readily available materials. The amended interim final rule also included conotoxins, saxitoxin, and tetrodotoxin on the list of select agents and toxins. One commenter asserted that the list of select agents should not include “chemically fragile, small molecule/peptide neurotoxins (tetrodotoxin, saxitoxin, end u-conotoxin [sic]), that exhibit limited stability at room temperature.” The commenter argued that “conotoxins and agatoxins are, for example, very rapidly degraded in water because they are triple-disulfide bonded polypeptides that require reducing agents (beta mercaptoethanol or dithicthreitol [sic] on the bench, glutethione [sic] in the organism) to retain their proper folded, disulfide-bonded structure.” The commenter further argued that “The disulfide bonds are very readily oxidized and the oxidized toxin molecules have no toxic activity whatsoever” and that “Indeed, one of our headaches with these toxins is that shipments are sometimes useless because the toxin has become oxidized.” We made no changes based on these comments. These toxins pose a significant public health threat because they have acute toxicity, could be produced in large quantities, and can be transferred by an aerosol method. We agreed with the commenter that once those toxins have been degraded, oxidized, or in any other form in which the toxic has become nonfunctional, they would be excluded from regulation under this part.

The amended interim final rule included Staphylococcal enterotoxins on the list of select agents and toxins. One commenter asserted that it should be removed from the list based on the conclusion that even though “Staph. food intoxication can make you wish you were dead for 24 to 48 hours” the “general public death rate is only 0.03% and for the very young and very old it is 4.4%.” We made no changes based on this comment. These toxins pose a significant public health threat because they have acute toxicity, could be produced in large quantities, and can be transferred by an aerosol method.

The amended interim final rule included Botulinum neurotoxins on the list of select agents and toxins. However, under the amended interim final rule, botulinum neurotoxins are not regulated if the aggregate amount under the control of a principal investigator does not, at any time, exceed 0.5 mg. One commenter asserted that there should be no exemption for botulinum neurotoxins. The commenter argued that “based on primate studies, the human lethal amount of botulinum toxin by intravenous exposure is 0.10 microgram, by aerosol exposure (inhalation) is 0.75 microgram, and by oral exposure (ingestion) is 75.0 micrograms” and concluded that “the proposed 500 microgram amount of unregistered and unregulated botulinum toxin represents, respectively, 5000 intravenous lethal doses, 667 inhalational lethal doses, and 6.7 oral lethal doses.” The commenter further asserted that Botulism Research Coordinating Committee and National Institute of Allergy and Infectious Disease's Blue Ribbon Technical Advisory Panel on Botulinum Toxin concluded without dissent that an exclusion should not be in effect. The commenter also argued “increased funding for biodefense work may attract newcomers to the field, who lack previous experience in working with botulinum toxin and therefore are at greater risk of laboratory accident” and that it might be possible for a “front laboratory or institution to order just under 500 micrograms of botulinum toxin from each of the several commercial vendors simultaneously and accumulate a cache of toxin that a terrorist might access.” We made no changes based on this comment. This final rule represents a legislative mandate to balance the regulatory oversight of agents and toxins that have the potential to pose a severe threat to public health and safety while maintaining availability of these agents and toxins for research and educational activities. The amount of each toxin that could be possessed without regulation by a principal investigator, a treating physician or veterinarian, or a commercial manufacture or distributor was determined on the basis of toxin potency and how much one could safely possess without constituting a potential threat to public safety or raising concerns about use as a weapon that would have a widespread effect. The level specified in the rule was determined after consultation with subject matter experts on this toxin. The determination that a toxin posed a severe public health threat was based on the ability for the mass distribution of the toxin for mass casualty purposes.

To address the commenter's concerns, the lethal amounts cited represent theoretical amounts extrapolated from primate studies based upon optimal conditions. The value of “5,000 intravenous lethal doses” requires a mode of delivery that is impractical for inflicting mass casualties. The value of “667 aerosol lethal doses” assumes 100% dissemination efficiency for a protein aerosol which is highly unlikely and does not take into consideration that botulinum neurotoxin is not very stable under ambient conditions. The public comment estimates that there are less than 7 oral human lethal doses in 0.5 mg of botulinum neurotoxin. However, the excluded amount of botulinum neurotoxin would have to be optimally disseminated to cause the estimated number of fatalities.

As noted above, with certain exceptions, the amended interim final rule included Botulinum neurotoxins on the list of select agents and toxins. One commenter questioned whether there are Botulinum toxins that are not neurotoxins and asserted that if the answer is yes the name should be changed to “Botulinum toxins” and if the answer is no the name should be changed to “Botulinum neurotoxins only.” We made no changes based on this comment. We are regulating the neurotoxins and the organism that produces the neurotoxin.

The amended interim final rule states that the list of HHS select toxins subject to regulation “does not include the following toxins (in the purified form or in combinations of pure and impure forms) if the aggregate amount under the control of a principal investigator does not, at any time, exceed the amount specified: 100 mg of abrin; 100 mg of conotoxins; 1,000 mg of diacetoxyscirpenol; 100 mg of ricin; 100 mg of saxitoxin; 100 mg of shiga-like ribosome inactivating proteins; or 100 mg of tetrodotoxin.” The amended interim final rule states that the list of overlap select toxins subject to regulation “does not include the following toxins (in the purified form or in combinations of pure and impure forms) if the aggregate amount under the control of a principal investigator does not, at any time, exceed the amount specified: 0.5 mg of botulinum neurotoxins; 5 mg of Staphylococcal enterotoxins; 100 mg of Clostridium perfringens epsilon toxin; 100 mg of shigatoxin; or 1,000 mg of T-2 toxin.”

One commenter asserted that the regulations should not provide exemptions for any toxins based on an aggregate amount. We made no changes based on this comment. The quantity amounts exempted have been determined by subject matter experts and would not pose a significant public health threat.

Also, as noted above, for toxins to be excluded they must be “under the control of a principal investigator.” The term “principal investigator” is defined as “the one individual who is designated by the entity to direct a project or program and who is responsible to the entity for the scientific and technical direction of that project or program.” We are retaining these provisions but are broadening the list of those eligible to exercise such control to include not only principal investigators, but also treating physicians and veterinarians, and commercial manufacturers or distributors.

Although the language of the exclusion provisions in the amended interim final rule focused on principal investigators, we did not intend to cause the possession or transport of otherwise excluded toxins to be covered by the amended interim final rule if the entity has a legitimate use for the toxin such as would be the case for treating physicians and veterinarians (including those providing off-label use) or commercial manufacturers or distributors. In any event, we believe that the specified toxins at levels below the threshold levels do not meet the Act's criteria for inclusion as select agents or toxins (having the potential to pose a severe threat to public health and safety) regardless of whether they are under the control of a principal investigator, a treating physician or veterinarian, or a commercial manufacturer or distributor. To attempt to regulate these de minimus quantities would impose an unreasonable regulatory burden on the public. Accordingly, we changed the regulations to provide that the exclusions would apply if under the control of a principal investigator, a treating physician or veterinarian, or a commercial manufacturer or distributor.

Genetic Elements, Recombinant Nucleic Acids, and Recombinant Organisms

The provisions of the amended interim final rule concerning genetic elements, recombinant nucleic acids, and recombinant organisms include as select agents and toxins:

(1) Select agent viral nucleic acids (synthetic or naturally derived, contiguous or fragmented, in host chromosomes or in expression vectors) that can encode infectious and/or replication competent forms of any of the select agent viruses.

(2) Nucleic acids (synthetic or naturally derived) that encode for the functional form(s) of any of the toxins listed in paragraph (d) of this section if the nucleic acids:

(i) Are in a vector or host chromosome;

(ii) Can be expressed in vivo or in vitro; or

(iii) Are in a vector or host chromosome and can be expressed in vivo or in vitro.

(3) Viruses, bacteria, fungi, and toxins listed in paragraphs (a) through (d) of this section that have been genetically modified.

Commenters recommended that for purposes of clarity paragraph (1) should state: “Nucleic acids that can encode infectious and/or replication competent forms of any of the select agent viruses.” One commenter recommended that the following should be added at the end of paragraph (1) in both §§ 73.3 (e) and 73.4 (e): “or a nucleic acid (synthetic or naturally derived) comprising at least 15% of the genome of a select agent.” We agreed that clarification was needed and changed the language in paragraph (1) accordingly. The regulation now states that only nucleic acids (regardless of size) or replication competent forms of any select agent viruses that are subject to these regulations are those nucleic acids that can produce infectious select agent viruses.

One commenter asserted that subparagraphs (i), (ii), and (iii) should be deleted from paragraph (2) based on the argument that nucleic acids in paragraph (2) covers all forms that encode for the functional forms. In response, we changed paragraph (2) to cover: “Recombinant nucleic acids that encode for the functional form(s) of any HHS or overlap toxins listed in paragraph (b) of this section if the nucleic acids:

(i) Can be expressed in vivo or in vitro; or

(ii) Are in a vector or recombinant host genome and can be expressed in vivo or in vitro.”

We believe this covers all of the functional forms.

Commenters asserted that “the government should require that service providers test for Select Agent sequences” before they are made and transferred. The commenters argued that “Although the Select Agent program covers transfer and possession of Select Agents, if DNA synthesis companies do not check the sequences they could inadvertently synthesize and transfer a Select Agent.” We made no changes based on these comments. It is incumbent upon the entities that manufacture substances to know what they are manufacturing and to ensure that they comply with the provisions of the regulations in part 73 and 9 CFR part 121.

One commenter asserted that a database listing regulated genetic sequences should be created for the regulated community. We made no changes based on this comment. We believe that a database listing all the genetic sequences that can produce infectious forms of any of the select agent viruses or that can encode for the functional forms of any of the toxins listed is not practicable. However, the National Center for Biotechnology Information maintains a publicly available database (http://www.ncbi.nlm.nih.gov/​) of nucleic acid sequence information that the regulated community could use as a resource in determining if the genetic sequence to be created is subject to this regulation.

Exclusions

The amended interim final rule states that the list of select agents and toxins does not include any select agent or toxin that is “in its naturally occurring environment provided it has not been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source.” One commenter requested clarification regarding what was meant by “natural environment.” The commenter asked “For example, are milk samples that contain Coxiella burnetii, or macque [sic] tissue with Herpes B virus a natural environment?” and “Is an entity required to report the “identification” of a select agent from these samples, or is the entity exempted based on natural environment?” Consistent with this comment, commenters asserted that naturally occurring wild-type shiga toxin-producing E. coli strains should not be included in the list of select agents and toxins. We made no changes based on these comments. Wild-type shiga toxin-producing E. coli strains are not subject to this part. However, Shigatoxin and Shiga-like ribosome inactivating proteins produced by this agent are subject to this part. Select agents in their naturally occurring environment could include animals that are naturally infected with a select agent or toxin (e.g., macaques that are naturally infected with Cercopithecine herpesvirus 1 or milk samples that contain Coxiella burnetti). However, a select agent or toxin that has been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source, including tissues from animals or agents or toxins obtained from milk samples that have been naturally infected with a select agent or toxin, is subject to this part and in such a case the entity is required to report the select agent or toxin upon identification.

One commenter asserted that the regulations should exclude fixed tissues that are, bear, or contain select agents or toxins. We made no changes based on this comment. The amended interim final rule excluded non-viable select agents and nonfunctional toxins. This includes such fixed tissues provided the agents that may be present are rendered non-viable.

Under the amended interim final rule, non-viable select agents or nonfunctional toxins are excluded from regulation. One commenter requested that we add definitions of “non-viable” and “nonfunctional” based on the assertion that “Some organisms can survive in nature, others only with laboratory conditions, while others will not grow under any conditions.” We made no changes based on this comment. Regardless of the environment in which an organism can or cannot survive, the standard established by the regulations is whether the organism is viable, or whether the toxin is functional, based on the plain meaning of the words. Further, the regulations are clear in that they exclude “any select agent or toxin that is in its naturally occurring environment provided that it has not been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source.” The regulations also exclude “non-viable select agents or nonfunctional toxins.”

The amended interim final rule excluded from the regulation certain toxins (in the purified form or in combinations of pure and impure forms) if the aggregate amount under the control of a principal investigator does not, at any time, exceed specified amounts. One commenter asserted that the term “aggregate amount” is unclear and questioned whether it means “weight of pure plus weight of impure” or “weight of pure plus weight of pure in impure”? The commenter recommended that it be defined to mean the latter. For clarification purposes, we have deleted the language “in the purified form or in combinations of pure and impure forms” so that it is clear that the regulations are dealing with the total amount of the toxins regardless of the form.

The amended interim final rule provided that the HHS Secretary may exclude attenuated strains of select agents or toxins upon a determination that they do not pose a severe threat to public health and safety. The amended interim final rule also provided that in response to an application submitted to the HHS Secretary, the HHS Secretary will provide a written decision granting the request, in whole or in part, or denying the request. It further stated that an exclusion will be effective upon notification to the applicant and that exclusions would be published in the notice section of the Federal Register and listed on the CDC Web site at http://www.cdc.gov/​. In addition, it stated that the list would be included in the rule.

After consultations with subject matter experts, review of relevant published studies, and review of information provided by the applicants, a number of attenuated strains have been excluded from the list of select agents and toxins based on the criteria that these agents do not pose a severe threat to public health and safety. One commenter asserted that “Given the cost of compliance with these regulations, the appropriate list of select agents, including a list of exempted [sic] strains, should be in place at the time the regulations are implemented.” In response, we note that a number of excluded attenuated strains are identified on the CDC Web site. We also listed them in the amended interim final rule. To minimize the potential delays related to rulemaking, in this final rule we are providing that excluded attenuated strains of select agents or toxins will be periodically published in the Federal Register notice and maintained on the Internet at http://www.cdc.gov. We believe these measures will provide sufficient notice to the public. Therefore, we are making no change based on this comment.

Commenters asserted that specific criteria for evaluating exclusions for attenuated strains of select agents and toxins should be added to the regulations and further asserted that the broad microbiological community, not just government agency representatives, must be involved in this process. We made no changes based on these comments. The Act sets the criteria for excluding attenuated strains, i.e., they may be excluded if they do not pose a severe threat to public health and safety, (42 U.S.C. 262a(a)). We will consult with appropriate Federal departments and agencies and with scientific experts representing appropriate professional groups depending on the attenuated strain being considered.

A number of commenters asserted that the government should ensure that prompt determinations are made in response to applications for exclusions. One commenter suggested that a timeline for responses be established. We made no changes based on these comments. We will do our best to make prompt determinations, but the highest priority is to protect public health and safety.

For clarification, we added the language that if an excluded attenuated strain is subjected to any manipulation that restores or enhances its virulence, the resulting select agent or toxin will be subject to the requirements of this part.

In addition, in this final rule, we are adding a new paragraph (f) to 42 CFR 73.3 and 73.4 to address concerns raised by Federal law enforcement agencies related to seizures (i.e., possession) of known select agents or toxins. Paragraph (f) provides that any known select agent or toxin seized by a Federal law enforcement agency will be excluded from the requirements of the regulations during the period between seizure of the agent or toxin and the transfer or destruction of such agent or toxin provided that (1) as soon as practicable, the Federal law enforcement agency transfers the seized agent or toxin to an entity eligible to receive such agent or toxin or destroys the agent or toxin by a recognized sterilization or inactivation process; (2) the Federal law enforcement agency safeguards and secures the seized agent or toxin against theft, loss, or release and reports any theft, loss, or release of such agent or toxin; and (3) the Federal law enforcement agency reports the seizure of the select agent or toxin by submitting the APHIS/CDC Form 4.

This provision will allow Federal law enforcement agencies to conduct certain law enforcement activities (e.g., collecting evidence from a laboratory crime scene) without being in violation of the regulations. We note, however, that this provision does not authorize the seizure of a select agent or toxin by a Federal law enforcement agency; rather, it establishes the conditions under which a Federal law enforcement agency may seize a known select agent or toxin without violating the regulations. Any seizure of a known select agent or toxin by a Federal law enforcement agency must be conducted in accordance with all applicable laws and regulations.

To address concerns raised by Federal law enforcement agencies related to seizures (i.e., possession) of select agents or toxins, in this final rule we are adding a new paragraph (f) to §§ 73.6(a) and 73.7(a) to address situations in which the select agents or toxins have been identified prior to seizure. In the event that a Federal law enforcement agency seizes a suspected select agent or toxin or unknown material, this material will be regarded as a specimen presented for diagnosis or verification and, therefore, will not be subject to the regulations until it has been identified as a select agent or toxin.

Sections 73.5 and 73.6 Exemptions for HHS and Overlap Select Agents and Toxins and Diagnosis, Verification, or Proficiency Testing

The amended interim final rule provided that an individual or entity is exempt from the provisions of part 73, other than transfer provisions, if the entity only conducted activities with select agents or toxins that were contained in specimens presented for diagnosis, verification, or proficiency testing. We clarified the language to state “Clinical or diagnostic laboratories and other entities that possess, use, or transfer a select agent or toxin that is contained in a specimen presented for diagnosis or verification will be exempt from the requirements of this part for such agent or toxin contained in the specimen”. This clarification was made in recognition that in certain cases regulated individuals and entities may also be conducting non-regulated activities.

The exemption provisions apply only if, among other things, the individual or entity within specified time periods (seven calendar days after identification of select agents and toxins used for diagnosis or verification; within 90 calendar days after receipt of select agents or toxins used for proficiency testing) submits a completed form regarding the disposition of the select agents or toxins. We have added language stating that less stringent reporting may be required based on extraordinary circumstances, such as a widespread outbreak. This will help prevent large numbers of reports in those instances when such reports would not be useful for taking action to protect the public's health and safety. In addition, CDC and APHIS have combined their immediate notification list for overlap select agents and toxins (Bacillus anthracis, Botulinum neurotoxins, Francisella tularensis, Brucella melitensis, Hendra virus, Nipah virus, Rift Valley fever virus, and Venezuelan equine encephalitis virus). Therefore, entities will be able to immediately notify either agency.

One commenter asserted that the exemption provisions should not exist based on the argument that select agents and toxins may be obtained from the environment and those conducting diagnosis, verification, or proficiency testing are capable of isolating and growing them. The commenter further asserted that at the very least all clinical and diagnostic laboratory employees should be subject to the security risk assessments. We made no changes based on this comment. Such changes would be contrary to the exemption provisions mandated by the Act (42 U.S.C. 262a).

Commenters argued that the exemption provisions should contain safeguarding requirements that would apply to select agents and toxins from the time they are identified until they are transferred or destroyed. One commenter argued that the safeguarding requirements should be the same as those that would apply if they were not subject to the exemption provisions. In response, we agree that the entity must take measures to safeguard the select agents or toxins. Accordingly, we have included a provision in the regulations to require the entity to secure the specimens or isolates containing a select agent or toxin during the period from identification until transfer or destruction. In addition, we added the provisions that the individual or entity must also meet the requirements of § 73.19 (Notification of theft, loss, or release). We believe that any theft, loss, or release of a select agent or toxin must be reported to protect public health and safety.

Commenters opposed the exemption provisions concerning diagnosis or testing that require an entity to transfer or destroy select agents or toxins. The commenters opposed the destruction option by asserting that by encouraging diagnostic laboratories such as state health facilities to destroy all isolates, the ability to deal with future outbreaks and terrorist events would be undermined. More specifically, they argued:

• “Destruction will result in the loss of valuable scientific material since much of our knowledge of the ecology and epidemiology of emerging and select agents, and our future ability to identify the source of a terrorist introduction, depend on having collections of reference agents available for genetic and phenotypic analyses.
• If an agent is introduced by a terrorist group in a failed attempt to cause an outbreak, and the samples are all destroyed, retrospective analyses of activities preceding a significant bioterrorist event will be hampered by the loss of information.”

One commenter also asserted that the final rule should require CDC to consult with the state public health laboratory director or other appropriate contact such as the state health officer before destroying a select agent or toxin based on the conclusion that “There may be circumstances in which a state public health laboratory director would want such specimens or isolates preserved to support epidemiologic investigations in the state * * * such as isolated cases of Yersinia pestis infection in the Southwest, but for which state-based infection control activities must proceed.” One commenter suggested that a team from the Department of Justice could “arrive and monitor the situation, and safeguard the isolate.”

The regulations require that a diagnostic or testing entity transfer or destroy a select agent or toxin if, and only if, such an entity does not want to be registered pursuant to the Select Agent regulations. If any entity has a legitimate need to keep possession of a select agent or toxin it may do so once it has become registered. We have added a provision to allow a diagnostic or testing entity to retain possession of a select agent or toxin in situations where it has been determined that such action is necessary to protect public health and safety.

Commenters argued that the seven day requirement for transferring or destroying select agents or toxins used for diagnosis or testing is too short a time limit. We made no changes based on these comments. Based on input from technical experts and risks posed by select agents and toxins, we believe seven calendar days provides a sufficient amount of time for the entity to destroy or transfer the select agents or toxins after identification. However, as noted above, we have included language for special allowance of these provisions when necessary to protect public health and safety.

One commenter asserted that the final rule should not require an entity to submit to CDC a record of destruction of select agents or toxins or as an alternative should require “entities to maintain a record of destruction, which would be subject to inspection by CDC and/or APHIS.” The commenter argued that “This action would reduce the associated paperwork burden and maintain consistency with the intent of the regulations.” The commenter further stated that “Unlike transfers from other regulated entities, a transfer record does not precede isolation through diagnostic procedures.” We made no changes based on this comment. The Act requires a report of the identification of select agents or toxins (42 U.S.C. 262a(g)(1)(a)). We need to be advised of the disposition to ensure compliance with the requirements of the regulations and to ensure the protection of public health and safety.

Exempted Products

The amended interim final rule provides for exemption from the regulations under certain circumstances for products that are, bear, or contain listed select agents or toxins that are cleared, approved, licensed, or registered under any of the specified laws, insofar as their use is only for the approved purpose and meets the requirements of such laws. Commenters asserted that the requirement that the use be limited to approved purposes be deleted because of the allowance of off-label use. In response, we agree and have deleted the “approved purpose” language. We see no reason to distinguish between products that are used for off-label, but in a manner that doesn't violate the law, and products that are used in accordance with the approved labeling.

One commenter recommended that the regulations list the exempted products. We made no changes based on this comment. The regulations provide the criteria for determining which products are exempt and it would be impracticable for the maintenance of such a list.

The amended interim final rule provided that the HHS Secretary on a case-by-case basis may exempt from the requirements of the part 73 regulations an investigational product that is, bears, or contains a select agent or toxin, when such product is being used in an investigation authorized under any of four specified Federal acts and additional regulation is not necessary to protect public health and safety. The final rule allows such an exemption under any Federal act since the statutory authority allows exemptions for investigational products under any Federal act.

Section 73.7 Registration and Related Security Risk Assessments, § 73.8 Denial, Revocation, or Suspension of Registration, and § 73.10 Restricting Access to Select Agents and Toxins; Security Risk Assessments

[These Subjects Are in §§ 73.7 and 73.8 in the Amended Interim Final Rule]

General

We have revised the provisions regarding registration and security risk assessments and, as noted above, have placed these provisions in three sections: § 73.7 (Registration and related security risk assessments), § 73.8 (Denial, revocation, or suspension of registration), and § 73.10 (Restricting access to select agents and toxins; security risk assessments). To conduct certain activities regulated under part 73, the revised provisions, consistent with the provisions of the amended interim final rule, require that the individual or entity obtain a certificate of registration and that the following must have an approval from the HHS Secretary or Administrator following a security risk assessment by the Attorney General: the individual or entity, any individual who owns or controls the entity, the Responsible Official of the entity, and any individual who is to access select agents or toxins under the entity's certificate of registration.

One commenter, a private, non-profit organization that provides medical research personnel to work at government entities for the purpose of performing work covered by the regulations, requested that the regulations be changed to state that such a private non-profit organization would not be subject to any requirements imposed by the regulations. We made no changes based on this comment. The entity conducting regulated activities must obtain a certificate of registration and otherwise comply with the Part 73 regulation. Also, any individuals having access to select agents or toxins on behalf of an entity must meet the requirements for such activities, regardless of the type of entity.

One commenter asserted that the regulations should specifically “prohibit HHS, USDA or other federal agencies from using the information collected through the registration process to evaluate the merit of proposals involving research on select agents or toxins.” We made no changes based on this comment. The regulations contain provisions to implement the intent of the Act which is to provide protection against the effects of misuse of select agents and toxins whether inadvertent or the result of terrorist acts against the United States homeland or other criminal acts. The part 73 regulations contain no provisions for evaluating the merits of research proposals and are not intended to cover such activities.

One commenter asserted that the approval process for security risk assessments should include requirements for credit checks and random drug screening. We made no changes based on this comment. With respect to security risk assessments, the Act provides that the Attorney General shall use criminal, immigration, national security, and other electronic databases available to the Federal Government, as appropriate for the purpose of identifying restricted persons and for identifying those reasonably suspected of committing certain crimes, being involved with an organization that engages in domestic or international terrorism, or being an agent of a foreign power. The Act does not provide for credit checks or random drug screening.

Commenters asserted that the regulations should explicitly provide that the clearance process is confidential. We made no changes based on these comments. Information obtained as a result of the security risk assessment process will be protected in accordance with the provisions of the Privacy Act.

Individual Who Owns or Controls the Entity

Commenters asserted that provisions requiring a security risk assessment approval for an individual who “owns or controls the entity” should not apply to educational institutions. One commenter asserted that “under most state laws governing the organization of nonprofit entities such as a university, there are no owners of the entity, i.e., no stockholders or partners, because the entity is organized for the good of the public, not for the good of the ‘stockholders’ or ‘investors.’ ” They expressed concern regarding possible delays if these provisions were broadly interpreted to include members of the board of trustees or other similar officials. One commenter asserted that “the interpretation of “control” should be limited to those individuals who will have actual access to the select agents.” One commenter recommended that we define “ownership or control” to mean the right to exercise control of an entity “regardless whether such right results from a substantial economic interest or contractual or other right to manage an entity.”

In response, we have added the following language:

(2) Federal, State, or local governmental agencies, including public institutions of higher education, are exempt from the security risk assessments for the entity and the individual who owns or controls such entity.

(3) An individual will be deemed to own or control an entity under the following conditions: ^[1]

(i) For a private institution of higher education, an individual will be deemed to own or control the entity if the individual is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.

(ii) For entities other than institutions of higher education, an individual will be deemed to own or control the entity if the individual:

(A) Owns 50 percent or more of the entity, or is a holder or owner of 50 percent or more of its voting stock, or

(B) Is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.

(4) An entity will be considered to be an institution of higher education if it is an institution of higher education as defined in section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)), or is an organization described in 501(c)(3) of the Internal Revenue Code of 1986, as amended (26 U.S.C. 501(c)(3)).”

We believe the language is consistent with the statutory language in section 351 A(e)(6)(B) from the Act which exempts Federal, State, or local governmental agencies including public institutions of higher education from the security risk assessments for the entity and the individual who owns or controls such entity. However, the Act does not exempt other individuals or entities even those nonprofit entities from the security risk assessment provisions. In addition, we believe those individuals that own or control the entity relevant to the entity's possession, use, or transfer of select agents or toxins should be required to undergo a security risk assessment. However, we determined that not all owners or controllers of an entity were relevant to an entity's possession, use, or transfer of a select agent and added language to identify those individuals who were in a “managerial or executive capacity with regard to the entity's select agents or toxins” such as laboratory directors.

One commenter asserted that the security risk assessment provisions should apply to entities that own or control entities possessing or transferring select agents. We made no changes based on this comment. The Act requires a security risk assessment for an entity (at any level) that conducts regulated activities and for individuals who own or control such entity.

Coordination of Activities

Commenters recommended that CDC and APHIS coordinate their activities regarding select agents and toxins through a single office. The commenters argued that such coordination through one office would decrease regulatory burdens, ensure consistency in agency decision making, and ultimately promote compliance. They also argued that without a single office, entities conducting activities regulated solely by USDA and solely by HHS would be required to submit dual registrations, obtain dual security risk assessments, and prepare other dual packages, such as safety plans and security plans. One commenter argued that such duplication is contrary to the statutory requirements.

In order to minimize the burden to the public required to register to possess, use or transfer select agents and toxins, a single point of contact has been developed. This single point of contact is responsible for coordinating all activities and communications with respect to the entity's registration, including coordination with both the non-lead agency and with Federal Bureau of Investigations, Criminal Justice Information Services Division. This single point of contact will retain responsibility for the application for the life of the registration certificate (2-3 years). In addition, a single shared web-based system is under development that will allow the regulated community to conduct transactions electronically via a single web portal. We envision that this system will enable the entity to dynamically communicate in a digitally secured environment using a single web portal. The web portal will provide a platform for electronic exchange of information. It will allow entities to access data related to their own registration data and allow them to create, amend, and submit registration applications; requests for approvals for transfers, exemptions, or exclusions; and any other required forms without the need to print, mail, or e-mail hard copies. Hard copy registration materials and other required forms will still be accepted. The single web portal will be available in winter 2005.

Changes

The amended interim final rule stated that the Responsible Official must promptly notify the HHS Secretary if a change occurs in any information submitted to the HHS Secretary in the application for the certificate of registration or amendments. This included modifications to the list of individuals with approvals for security risk assessments, changes in area of work, or changes in protocols or objectives of studies. Commenters recommended deleting the word “protocol” based on the argument that prior approval before implementing the protocol change would hinder research. They also argued that “Protocols can change frequently in active research programs without altering the relevant biosafety and laboratory information or the objectives of the work.” In response, we have deleted the word “protocol” and clarified the regulations to state that an entity may take regulated actions concerning select agents or toxins, activities, locations, or personnel only to the extent that such actions are specifically approved under a certificate of registration, including any amendments.

Timely Decision-Making

Commenters expressed concern regarding the absence of time limits for determinations of registration and security risk assessments and recommended that the regulations include a process by which an entity can begin or continue its research with select agents and toxins until such time as the relevant government agencies complete their respective reviews and respond to the entity's applications for security risk assessments and registrations. Some commenters requested that the regulations “be amended to provide that if the person subject to the background check suffers a delay in excess of 10 work days, that person should be permitted to work with select agents under the direct supervision of an approved person (provided that all other requirements are met).” Another commenter suggested that the regulations should allow an individual access to select agents and toxins if “escorted” during the waiting period. We made no changes based on these comments. The amended interim final rule did provide for a phase-in of the security risk assessment requirement to allow ongoing research to continue pending the completion of a records check by the FBI. However, as explained above, the phase-in provisions have been removed because they have served their purpose. Entities and individuals have had time to come into compliance without compromising research or educational projects. The Act is clear that individuals should not be allowed access to select agents and toxins until after completion of the security risk assessment.

Under the registration provisions, a certificate of registration concerning overlap agents will only be issued if both the HHS Secretary and Administrator concur. One commenter suggested that language be added to discuss “what the entity is to do to assist or mitigate the conflict between the two regulatory agencies or, for example, how to appeal for resolution.” We made no changes based on this comment. As discussed above, a single point of contact has been implemented in order to minimize the burden to the public required to register in order to possess, use or transfer select agents and toxins. Therefore, the responsibility for resolving such conflicts rests with CDC and APHIS and the agencies are prepared to take action to resolve any conflicts as quickly as possible.

Coverage of Certificate of Registration

The amended interim final rule provided that “A certificate of registration will cover activities at only one general physical location (a building or a complex of buildings at a single mailing address).”

Commenters recommended that an entity have the option to apply for a single certificate of registration to cover activities at all buildings on a campus or site under the control and authority of the Responsible Official. The commenters indicated that this would include both contiguous and dispersed sites within a local geographical area. The commenters argued that separate registrations for each general physical location (defined as “a building or a complex of buildings at a single mailing address”) is overly burdensome in terms of staffing, training, and naming of Responsible Officials, and record keeping. They also argued that the amended interim final rule “authorizes the Responsible Official to identify one or more alternate Responsible Officials to provide coverage for and assist the Responsible Official and that this nullifies the argument that separate registrations are necessary to ensure against over-extending the Responsible Official.” In addition, they argued that “administrative and control functions at research and academic institutions, including environmental health and safety and security programs, are efficiently managed by a centralized department responsible for more than one physical location.”

One commenter asserted that this provision should be changed to state that a certificate of registration will cover activities of a single administrative organization under a single Responsible Official provided that all buildings are contained within a circle of 25 miles diameter. The commenter noted that “each building on a university campus may have a different mailing address even though the campus is under a single administration.” The commenter asserted that this would allow “a university to include a detached medical school or research park in its registration, simplifying paperwork for all concerned” while still allowing “full government inspection in a single visit” and provide “a realistic commuting distance for the Responsible Official.”

One commenter indicated that a certificate of registration should allow a Responsible Official to discharge his/her responsibilities at several adjacent addresses. The commenter asserted that “Addresses are generally used to facilitate mail deliveries, not to establish areas of responsibility.”

In response, we note that our goal is to set forth a standard to ensure that the Responsible Official will not be overextended and will be able to perform the activities required for that position. Moreover, we believe that in some cases a Responsible Official may be able to meet these criteria even if the area were larger than set forth in the amended interim final rule. Therefore, we have changed the rule to allow a certificate of registration to cover activities at one physical location (room, building, or group of buildings) where the Responsible Official will be able to perform the responsibilities required for that position.

However, we made no changes concerning the responsibilities of Responsible Officials and alternate Responsible Officials. The regulations were designed to place responsibility for ensuring compliance with the part 73 regulations in one position. Also, the regulations provide that an alternate Responsible Official could act only if the Responsible Official were unavailable. We believe that placing responsibility in one position will help achieve a higher level of compliance than would be obtained from a system of shared responsibility.

Periods of Validity and Reapplication

The amended interim final rule provided, with exceptions, that a certificate of registration is valid for up to three years. The amended interim final rule also provided that an approval based on a security risk assessment is valid for five years. Commenters recommended that the certificate of registration be valid for up to five years. They argued that this would make the registration provisions consistent with the security risk assessment provisions and that this “would simplify paperwork logistics for the entity and reduce the cost to the government for the registration process.” One commenter asserted that an approval based on a security risk assessment should be valid for the same time period as the certificate of registration so that the approval period would coincide with the timing for resubmittals of the registration application package. We made no changes based on these comments. We believe it is reasonable to provide that a certificate of registration will be valid for a maximum of three years. A three year registration period takes into consideration the burden on the public and the risks posed by select agents and toxins. In addition, it is consistent with APHIS' permit systems and other established programs for laboratory certification or registration (e.g., Clinical Laboratory Improvement Amendments (CLIA) and the College of American Pathologists (CAP)), which are generally valid for two to three years. The validity period of five years for an individual's security risk assessment was established based on a Department of Justice determination that five years was the appropriate period. Even though it appears that the two different timeframes would increase the burden on the public, as a practical matter the registration of an entity and the completion of most individual security risk assessments are not connected, with the exceptions being only the Responsible Official, Alternate Responsible Official, and any individual who owns or controls the entity. Although both seem to have happened at once as the Program became established and the regulations became effective, in fact the Select Agent Program has observed a significant “turn over” in the individuals from registered entities. Therefore at the time an entity begins its submissions for re-registration, it could have individuals that have approved security risk assessments from anywhere from almost three years to one day. Therefore, changing the validity of an individual security risk assessment to be consistent with the registration period would cause undue burden on the public.

With respect to reapplications, one commenter asserted that resubmittal schedules should be “well defined” (e.g., resubmit at least 90 calendar days prior to expiration). Although we cannot provide a specific timeframe, we recommend the individual or entity reapply at least eight weeks prior to the expiration date of the existing certificate of registration.

Moreover, we have added provisions to help prevent an unnecessary lapse in a certificate of registration when the Responsible Official of an entity leaves and the entity is left with no individual to serve as the Responsible Official. In this regard, we added provisions to allow an entity to continue to possess or use select agents or toxins only if it appoints as the Responsible Official another individual who has been approved by the HHS Secretary or Administrator following a security risk assessment by the Attorney General and who meets the requirements of this part.

The amended interim final rule stated that an entity must provide written notice at least five business days before destroying a select agent or toxin, if the destruction would be for the purpose of discontinuing activities with a select agent or toxin covered by a certificate of registration. The amended interim final rule further stated that “This will allow the HHS Secretary and/or the USDA Secretary to observe the destruction or take other action as appropriate.” We are deleting this provision. Under the registration provisions, the Responsible Official must provide prompt notification in writing, if a change occurs in any information submitted in the application for the certificate of registration or amendments. If the entity has not yet received a certificate of registration then the Responsible Official must provide updated information in writing; if the entity has received a certificate of registration then the Responsible Official must promptly provide an amendment to their certificate of registration. This would include adding or removing a select agent or toxin. However, there is no need to impose a five-day notification requirement.

In addition, in this final rule, we are adding the language that a certificate of registration will be denied, revoked, or suspended if it is determined that such action is necessary to protect public health and safety. We are also clarifying the actions an entity must take in the event that the certificate of registration is suspended or revoked. Specifically, we are adding a paragraph to require that, upon notification of revocation or suspension, the individual or entity must: (1) Immediately stop all use of each select agent or toxin covered by the revocation or suspension order; (2) immediately safeguard and secure each select agent or toxin covered by the revocation or suspension order from theft, loss, or release; and (3) comply with all disposition instructions issued by the HHS Secretary for each select agent or toxin covered by the revocation or suspension.

Security Risk Assessments

Commenters recommended that the Final Rule define the information the entity must submit to the Attorney General for the security risk assessments. Currently, the individual completes the FBI form (FD-961) and then mails the FD-961 form and fingerprint cards as one package directly to the Federal Bureau of Investigation (FBI), Criminal Justice Information Services Division (CJIS). Since this process could change, the specific information for submission was not included in the regulatory text. Specific guidance on the process has been made available on the Internet at http://www.cdc.gov.

Commenters asserted that the regulations should allow security risk assessment approvals for individuals to be portable from entity to entity, from location to location, and from project to project. One commenter recommended that an individual's clearance remain valid if the scientist moves to another institution as long as the scientist's new employer amends its registration document promptly to include the individual. The commenter also recommended “that the Department clarify that an individual's clearance will continue to be valid if his or her laboratory is relocated among any of the facilities under the oversight of the entity's Responsible Official” and added that “The change in location should, of course, be reflected in a timely amendment of the entity's registration.” We made no changes based on these comments. However, CDC, APHIS, and the Attorney General have agreed to and have already implemented a policy that an additional security risk assessment is not needed in cases where an individual has a current security risk assessment and will be merely visiting another entity. If a registered entity wants a visiting individual to have access to select agents or toxins, the RO of home entity will have to send to the RO of host entity a letter stating that the individual is currently identified on the home entity's Select Agent registration and that the individual has a current SRA approval. The host entity RO can then submit this letter and an amendment to their registration. Once the visit is complete, the host entity would then amend their registration to remove the visiting individual's name. In some circumstances the host entity may decide to leave the individual on the registration, if the same individual will be visiting the entity again. Specific guidance on the process has been made available to the public on the Select Agent Program web site.

In addition, in this final rule, we have added the requirement that an individual with access to select agents or toxins must have the appropriate education, training, and/or experience to handle or use such agents or toxins. We believe this requirement is necessary to ensure that the individual has the appropriate education, training, and/or experience to handle such agents or toxins.

One commenter in a discussion concerning national Department of Energy (DOE) laboratories requested that language be added “that would allow the L or Q clearance granted in DOE laboratories (or equivalent) to be considered synonymous with the security risk assessment process for the purposes of this regulation and that individuals with a current L or Q clearance be considered approved.” We made no changes based on this comment. The Act requires the Attorney General to determine whether an individual is a restricted person; or reasonably suspected of committing an act of terror, being involved in a terrorist organization, or being an agent of a foreign power. The Attorney General may not be able to make such a determination based solely on the existence of an L or Q clearance.

One commenter asserted that we should take into consideration the conclusion that “It is unlikely that an entity can provide information for a security risk assessment, other than the name of an individual, since many institutions have privacy policies that preclude their seeking certain personal information” and “Institutions are also subject to state laws on privacy, which vary widely.” We made no changes based on this comment. Entity policy and State laws do not preempt the Act and the part 73 regulations. Accordingly, an entity must comply with the part 73 regulations to be eligible to conduct regulated activities concerning select agents and toxins.

The amended interim final rule provided that the HHS Secretary will deny or revoke access to any select agent or toxin to an entity or individual identified by the Attorney General as a “restricted person” under 18 U.S.C. 175b. Under this statutory provision, a “restricted person” is a person who:

• Is under indictment for a crime punishable by imprisonment for a term exceeding one year,
• Has been convicted in any court of a crime punishable by imprisonment for a term exceeding one year,
• Is a fugitive from justice,
• Is an unlawful user of any controlled substance (as defined in section 102 of the Controlled Substances Act (21 U.S.C. 802)),
• Is an alien illegally or unlawfully in the United States,
• Has been adjudicated as a mental defective or has been committed to any mental institution,
• Is an alien (other than an alien lawfully admitted for permanent residence) who is a national of a country as to which the Secretary of State has made a determination (that remains in effect) that such country has repeatedly provided support for acts of international terrorism, or
• Has been discharged from the Armed Services of the United States under dishonorable conditions.

Commenters expressed concern “that these broad classifications will hinder legitimate research” and are contrary to the requirement in the Act to “ensure the appropriate availability of biological agents and toxins for research, education, and other legitimate purposes.” They argued that the term “restricted person” would cover an individual who received a dishonorable discharge from the U.S. military for homosexuality and could not understand how precluding such individual from ever working on select agents would protect the security of the United States. Commenters also argued that “it is predictable that some individuals who are currently productive, respected members of the scientific community and who have performed work with select agents or toxins meet one or more of the definitions of a ‘restricted person.’ ” We made no changes based on these comments. The provisions regarding “restricted persons” restate statutory requirements.

Commenters asserted that the regulations should contain a description of the process for limited approvals. We made no changes based on this comment. The Act and the part 73 regulations provide for the application of a security risk assessment approval. An individual or entity may obtain review of a decision denying or revoking a security risk assessment approval. Based on this review the HHS Secretary may, under certain circumstances, provide for a limited approval for a specified time based upon the finding that circumstances warrant such action in the interest of public health and safety or national security.

The amended interim final rule set forth a mechanism for obtaining an expedited review of an application for a security risk assessment. One commenter asserted that the “DOE clearance process parallels (and in many cases exceeds) the efforts that will be reviewed by the Attorney General.” The commenter argued that “Hence, DOE and DOE subcontractor staff (or other federal agency staff) that have federal clearances should be among those to be considered for expedited review.” We made no changes based on this comment. The Act allows for such an expedited review based on “good cause” and we do not believe that having a security clearance is relevant regarding whether the “good cause” standard would be met.

Section 73.9 Responsible Official

[This Subject Is in § 73.9 in the Amended Interim Final Rule]

The APHIS interim final rule included provisions stating that the Responsible Official is “The individual designated by an entity to act on its behalf” and that “This individual must have the authority and control to ensure compliance with the regulations in this part.” Commenters asserted that the part 73 regulations should include these provisions. They argued that the APHIS provisions provide the “clarity needed in order to provide the expected accountability at sites registered by the CDC Select Agent program.” We agreed with commenters and CDC and APHIS have included identical provisions for the Responsible Official.

Also, to ensure that all of the requirements of the regulations are met, we have clarified the language regarding the Responsible Official's annual inspection. The language previously located in § 73.10 Safety section of the amended interim final rule has been moved to the Responsible Official (§ 73.9) section stating that the Responsible Official must ensure that annual inspections are conducted for each laboratory where select agents and toxins are stored or used in order to determine compliance with requirements in this part. Further, we have included provisions requiring that deficiencies be corrected.

Commenters noted that the preamble to the initial interim final rule “recommended that that the Responsible Official and alternate Responsible Officials are either biosafety officers or senior management officials of the entity, or both.” Commenters suggested that we “emphasize that it is the entity's responsibility to designate the appropriate individual to be the responsible official (i.e., an individual who has the authority and control to ensure compliance with the regulations)” and that “To satisfy this requirement, a university may choose to designate the Dean of Agriculture to be the responsible official rather than the biosafety officer because the Dean of Agriculture may have better oversight and authority to ensure compliance with the regulations.” Some suggested that duties may even be separated by having the biosafety officer or an individual who has a higher-level management position for ensuring overall compliance, responsible for day-to-day operations. One commenter suggested that the duties be shared between the Responsible Official and the Principal Investigator with the Principal Investigator responsible for those activities that required daily hands-on knowledge of the laboratory. We made no changes based on these comments. The Responsible Official should be an individual who can perform all of the duties required for that position. As we noted above, the regulations were designed to place responsibility for ensuring compliance with the part 73 regulations in one position because we believe that doing so will help achieve a higher level of compliance than would be obtained from a system of shared responsibility.

Commenters recommended revision of language throughout the regulations to change the emphasis regarding Responsible Officials from responsibility “for” complying with requirements to responsibility “for ensuring” compliance with requirements. They argued that the amended interim final rule implies that only the Responsible Official or alternate Responsible Official may perform actions intended to be performed by others detailed under their supervision. In addition, one commenter recommended that laboratory inspections be performed by a Biosafety Officer designated by and reporting to the Responsible Official rather than by the Responsible Official. In response, we have made changes as necessary to state when the Responsible Official must conduct activities and when the Responsible Official is required to “ensure” compliance with requirements in the regulations. This change will allow the Responsible Official the flexibility to delegate certain responsibilities.

Since the reporting requirements of §§ 73.5 and 73.6 (Exemptions for HHS and overlap select agents and toxins) may pertain to regulated individuals and entities, we have clarified the language by adding the reporting requirements to the RO section. This reporting requirement will help us with monitoring activities related to select agents and toxins.

Section 73.11 Security

[This Subject Is in § 73.11 in the Amended Interim Final Rule]

Coordination With USDA

Commenters recommended that security plans established for compliance with the CDC rule should be sufficient to meet the requirements for a security plan under the APHIS regulations. They argued that otherwise an entity must prepare two security plans. We agreed with the commenters and CDC and APHIS made their language in the security section identical to ensure consistency between the regulations. In addition, we note that compliance inspections for security will be based on the regulations and that the inspectors will be looking for security that provides graded protection commensurate with the risk of the select agent or toxin, given its intended use.

A commenter asserted that biological laboratory security should be administered by only one Federal agency (e.g., Department of Homeland Security) to ensure consistency. We made no changes based on this comment. Section 201(b) of the Act requires the HHS Secretary to establish and enforce safeguard and security measures to prevent the access to select agents and toxins for use in domestic or international terrorism or for any other criminal purpose. In addition, the Act provides for the interagency coordination between the HHS Secretary and Administrator regarding overlap select agents and toxins. CDC and APHIS have established procedures to ensure consistent regulation of select agents and toxins.

Performance Based

Some commenters asserted that the security requirements are too stringent based on the argument that they could hamper research. We made no changes based on this comment. Although the Act requires us to do what we can to allow research, the first duty under the Act is to protect public health and safety. The security requirements are designed to prevent unauthorized access, theft, loss, or release of select agents or toxins. The regulations require that an entity's security plan be designed according to a site-specific risk assessment. Such a risk assessment would take into consideration the security needed for a select agent laboratory in an academic setting.

Some commenters asserted that the security provisions should be prescriptive rather than performance based to prevent “wide variation in the evaluation of threats and consequences, and a wide interpretation of what constitutes adequate security.” Other commenters asserted that the security provisions are highly prescriptive and should be changed to provide only a general performance standard. These commenters pointed out difficulties in the amended interim final rule by arguing that requirements, such as a requirement that freezers containing select agents and toxins be locked may not always be appropriate (the whole room could be secure).

Because different select agents and toxins pose differing degrees of risk, we believe it would be counterproductive to attempt to prepare a detailed list of prescriptive requirements for entities (i.e., a “one size fits all” design standard). Therefore, the regulations contain performance standards for biosafety, security, and incident response that take into account the risks presented by a particular select agent or toxin, given its intended use.

With regard to security, newly designated 42 CFR 73.11 requires each individual or entity required to register under this part to develop and implement a written security plan. This security plan must be designed according to a site-specific risk assessment and must provide graded protection in accordance with the risk of the select agent or toxin, given its intended use. In addition, newly designated 42 CFR 73.11 requires the individual or entity to adhere to specified security requirements or implement measures to achieve an equivalent or greater level of security. We believe these security provisions provide enough flexibility and specificity to allow an individual or entity to develop and implement a security plan that will safeguard the select agent or toxin against unauthorized access, theft, loss, or release.

However, in recognition of the commenters' concerns, we reiterate that CDC and APHIS are working with interagency groups and security experts to draft a document that will provide additional guidance about the security required for select agents and toxins. This document will be available in spring 2005. The 5th edition of the BMBL, which is under development, will also provide additional guidance on laboratory security.

The interim final rule stated that freezers containing select agents and toxins must be locked or must be in the direct view of approved staff. Commenters asserted that these provisions may not be appropriate (the whole room could be secure). We agreed and have changed the language to require the entity to “Provide for the control of select agents and toxins by requiring freezers, refrigerators, cabinets, and other containers where select agents and toxins are stored to be secured against unauthorized access (e.g., card access system, lock boxes).”

One commenter stated the BMBL and NIH guidelines require labs to post biohazard signs on access doors that list the agents present in the laboratory, which may compromise laboratory security. We made no changes based on this comment. In this final rule, 42 CFR 73.12 (Biosafety) provides that an individual or entity should consider the BMBL and NIH Guidelines when developing a biosafety plan. However, it is the entity's responsibility to determine if posting biohazardous signs on access doors would compromise laboratory security.

A commenter pointed out that the terms “risk assessment,” “threat assessment,” and “vulnerability assessment,” are confusing to those with little experience in this area and should be clarified. A commenter suggested that the phrase “risks associated with those vulnerabilities are mitigated” be replaced with “consequences associated with those vulnerabilities are mitigated.” We agreed with the commenters and have deleted the text. In addition, we clarified the language to state that an entity's security plan must be sufficient to safeguard the select agent or toxin against unauthorized access, theft, loss, or release; must be designed according to a site-specific risk assessment; and must provide graded protection in accordance with the risk of the select agent or toxin, given its intended use.

BMBL

One commenter asserted that the security provisions should mandate compliance with the BMBL, specifically Appendix F. We made no changes based on this comment. The security provisions contain guidelines similar to that published in Appendix F of the 4th edition of the BMBL.

Security and Individuals

Commenters asserted that the amended interim final rule incorrectly indicated that special provisions would be required for all individuals providing routine cleaning, maintenance, and repairs and objected to such language based on the conclusion that some might obtain security risk assessment approvals. In response, we note that these provisions were intended to apply when the cleaning, maintenance, or repairs were performed by individuals without security risk assessment approvals. We have clarified the regulations accordingly.

Commenters asserted that the security provisions of the amended interim final rule indicate that they “must develop a security plan that, among other requirements, establishes a procedure for reporting and removing unauthorized persons” and requested clarification as to the meaning of the phrase “unauthorized persons” and the “areas from which they must be removed.” We made no changes based on these comments. In context, unauthorized persons are those unescorted individuals who do not have access approval from the HHS Secretary or Administrator and who are in areas where they could gain access to select agents or toxins.

Commenters argued that security provisions of the amended interim final rule would hinder collaboration among scientists. They asserted that “A productive research program likely includes many scientists and technicians working collaboratively but with only a few actually handling infectious agents” and that “Isolating scientists who handle infectious agents will be detrimental to the program” because “The security requirements must enable unauthorized individuals to work together within the same physical space with [authorized] scientists.” We made no changes based on these comments. We would defeat the purpose of the Act if we were to waive the security provisions. Those with access to select agents and toxins must meet the requirements of the regulations, including those requirements concerning security risk assessments. This would not prohibit escorted activities as long as the escorted scientists and technicians do not have access to select agents or toxins. We considered the potential cost of reduced collaboration among scientists, along with other non-quantifiable costs, as discussed in the section addressing “Economic Impact.”

Commenters asserted that the security provisions should be changed to “allow people who are not approved * * * to enter the area without escort provided that (1) All select agents and toxins have been secured in locked cabinets, rooms or other containers, (2) The containers cannot be forced open without tools and without visible signs of damage; (3) Rooms are secure against entry by unauthorized personnel; (4) Keys, combinations, etc. are controlled as presently required; (5) Access to the area is limited to employees of the entity.” Commenters argued that this approach “is consistent with requirements [such as those in 10 CFR 95.25] for handling classified documents under which people without clearance may enter rooms without escort provided the documents are secured in cabinets. In addition, commenters argued that this approach would “also reduce the burden on the Attorney General's office, allowing it to perform more extensive checks on a smaller number of individuals.” Similarly, commenters asserted that the final rule should provide that when “laboratories are used intermittently for select agent research, free access [should] be permitted when select agents and toxins are not in use and when the select agents and toxins are secured in a safe or other secured storage. We made no changes based on these comments. The security requirements are designed to prevent unauthorized access, theft, loss, or release of select agents and toxins. We believe the regulations already are consistent with commenter's approach.

Commenters recommend the final rule distinguish between laboratory security and entity security. One commenter argued that “In large academic settings it is possible for a fully secure laboratory facility to coexist with a functioning educational and research laboratory entity” and “Placing full security restrictions on a building primarily devoted to educational functions compromises an educational institution's ability to fulfill its primary functions.” The commenter further argued that “This, in turn, may force laboratories working with select agents to shut their biodefense studies or move elsewhere.” We made no changes based on these comments. As discussed earlier, the security provisions are designed to prevent unauthorized access, theft, loss, or release of select agents and toxins. In most cases the security provisions would have little or no effect on the educational activities. The regulations require that an entity's security plan be designed according to a site-specific risk assessment. Such a risk assessment would take into consideration the security needed for a select agent laboratory in a large academic setting. However, we would defeat the purpose of the Act if we were to waive the security provisions to eliminate an impact on educational research conducted in the same laboratory that contains select agents and toxins.

Packages

The amended interim final rule required the inspection of all packages upon entry to and exit from an area containing select agents or toxins. Commenters asserted that such a requirement is not practical because of the number of packages of laboratory supplies, autoclaved waste, etc. that enter and exit a select agent laboratory every day. Some argued that the inspection provisions should apply only for packages received after shipment or transfer. Some commenters argued that only random inspections should be conducted. Some commenters argued that more detail should be provided. After further review, we have determined that the security purpose would be met if entities were required to inspect only suspicious packages. We have changed the rule to reflect this determination.

Commenters questioned who should be responsible for conducting the inspections of packages. Some commenters argued that the Responsible Official should be the one responsible for the inspections. We made no changes based on these comments. The final rule allows the entity to determine who should conduct the inspections of packages since the entity would be best able to determine the most appropriate and qualified individual for this activity.

Intra-Entity Transfers

The amended interim final rule provided that an entity must establish a protocol for intra-entity transfers, including provisions for ensuring that the packaging, and movement from a laboratory to another laboratory or from a laboratory to a shipping place, is conducted under the supervision of an individual with a security risk assessment approval. Based on questions by commenters, we have changed this language to clarify that the requirements apply only to intra-entity transfers of select agents and toxins. Commenters also argued that these provisions are not sufficiently restrictive since they could “allow an individual to leave a package of select agents temporarily unattended in an open air lock: that is not security.” They further asserted that “Intra-entity movement of select agents, when outside access-controlled laboratory areas, should follow a documented chain of custody process that minimizes any possibility of diversion.” In response, based on the reasons provided by the commenters, we changed these provisions to require that the select agents and toxins must be secured against theft, loss, or release during intra-entity transfer and the entity must provide for chain of custody documentation. The provisions of renumbered § 73.17 (Records) already require recordkeeping that would establish the chain of custody.

Reporting

The amended interim final rule required that suspicious persons or activities be reported to the Responsible Official. Commenters asserted that the finding of suspicious persons or activities should be reported to the local law enforcement agency, followed by notification to the RO.” They argued that “Local law enforcement agencies are staffed 24/7/365 and they are equipped to deal with potential criminal aspects of suspicious activities.” We made no changes based on this comment. We agree with the commenters that law enforcement agencies should be notified, but we believe the responsibility for reporting to the appropriate law enforcement agencies should be maintained by the Responsible Official.

Records

The amended interim final rule required the security plan to describe cyber security. Commenters asserted that “The data related to the select agents, in many cases, are almost as valuable as the select agents themselves” and requested clarification regarding the assets intended to be covered by the term “cyber security.” Commenters also asserted that the term “cyber security” should be replaced with “information and cyber security.” In response, we changed the language to require the security plan to contain procedures for “information systems control” and thereby more clearly indicate what was intended.

Review

The amended interim final rule states that “The security plan must be reviewed by the RO at least annually and after any incident.” Commenters recommended that this paragraph be revised to state “The security plan must be reviewed, performance tested, and updated annually.” We believe performance testing will help to ensure that the plan works and have changed the regulations to include these concepts.

Pre-Clearance

A commenter expressed concerns that the regulations do not provide for preclearance of security plans before an entity invests in a security system. We made no changes based on the comment. The provisions in the Final Rule clearly set forth what must be included regarding the security requirements. However, those entities needing additional technical assistance may reference the BMBL or contact the Select Agent Program.

Administrative

Commenters asserted that the final rule should designate who in the federal government is responsible for making determinations concerning the adequacy of the security plans. We made no changes based on this comment. The security plan must be sufficient to safeguard the select agent or toxin against unauthorized access, theft, loss, or release. The regulations allow for the delegation of authority of this function to the Select Agent staff or other appropriate office.

Commenters argued that security plans, and all information related to the security systems, be protected at the “Official Use Only” level. We made no changes based on this comment. The protection of all information held by the Select Agent Program is an operational responsibility and not a matter appropriate for inclusion in Part 73. However, as a matter of both policy and practice, the information is protected at the “Sensitive But Unclassified” level.

Section 73.12 Biosafety

[This Subject Is in § 73.10 in the Amended Interim Final Rule]

The amended interim final rule provided that an entity subject to the part 73 regulations must develop and implement a safety plan and in developing a safety plan, an entity should consider:

“(1) The biosafety standards and requirements for BSL 2, 3, or 4 operations, as they pertain to the respective select agents, that are contained in the CDC/NIH publication, “Biosafety in Microbiological and Biomedical Laboratories,” including all appendices except Appendix F.

(2) The specific requirements for handling toxins found in 29 CFR part 1910.1450, “Occupational Exposure to Hazardous Chemicals in Laboratories” and/or 29 CFR part 1910.1200, “Hazard Communication,” whichever applies and specific requirements for handling toxins found in Appendix I in the CDC/NIH publication, “Biosafety in Microbiological and Biomedical Laboratories.”

(3) For provisions of the safety plan relating to genetic elements, recombinant nucleic acids and recombinant organisms, the “NIH Guidelines for Research Involving Recombinant DNA Molecules,” (NIH Guidelines). This includes, among other things, provisions regarding risk assessment, physical containment, biological containment, and local review and applies to all recombinant DNA research, regardless of funding.

Commenters argued that we should retain the provisions concerning the safety plan without change. One commenter suggested that compliance with the documents listed in the preceding paragraph should be made mandatory for all entities subject to the rule. Other commenters asserted that we should adopt performance-based standards. The safety provisions were intended to avoid the creation of a “one size fits all” set of safety standards due to the vast diversity of both entities and the reasons why they possess, use, and transfer select agents and toxins. However, we amended the language of the final rule to establish performance-based safety provisions. Accordingly, under the final rule, entities must not only develop and implement a safety plan, but must develop a plan that is commensurate with the risk of the agent or toxin, given its intended use. Further, the biosafety plan must contain sufficient information and documentation to describe the biosafety and containment procedures. These provisions are designed to help ensure that the safety plan is effective.

Commenters recommended that safety plans established for compliance with the HHS rule should be sufficient to meet the requirements for a safety plan under the USDA regulations. They argued that otherwise an entity must issue two safety plans. Commenters further asserted that USDA and HHS should develop joint safety requirements for select agents and toxins to supplant the BMBL and NIH Guidelines. We agreed with the commenters and HHS and USDA made this section identical to ensure consistency between the regulations.

Section 73.13 Restricted Experiments

[This Subject Is in § 73.10 in the Amended Interim Final Rule]

The amended interim final rule stated that an entity may not conduct certain experiments unless approved by the HHS Secretary after consultation with experts. Commenters suggested that the following be considered for providing such consultation: The National Research Council, the NIH Recombinant DNA Advisory Committee, and the Select Agent Advisory Committee. One commenter argued that “It is critical that this review committee comprise appropriate experts in microbiology, highly pathogenic microorganisms and laboratory safety to ensure the best possible science advice.” We made no changes based on these comments. We agree that we should obtain advice from experts as needed for decision making and will consult with subject matter experts as necessary.

One commenter expressed concern that the amended interim final rule did not contain a process for expert review and oversight of “dangerous experiments.” We made no changes based on this comment. Under the regulations, we will review applications to determine whether the experiments can be safely conducted, will require whatever conditions are necessary for safety, and will consult with subject matter experts as necessary. Also, under the regulations, we have authority to conduct inspections as necessary to ensure that the conditions are met.

One commenter raised issues regarding the deliberate formation of antibiotic resistance as a common research tool. The commenter asserted that if strictly imposed, the restricted experiment provisions would limit this standard research practice and provided an example concerning antibiotic resistance application. The commenter stated “Transposon insertion libraries are common experimental creations used to generate gene knockouts and study the effect on expression and phenotype” and “this often results in an array of genomes containing antibiotic resistance markers used for selection and screening.” The commenter then argued that “The method is common enough not to need approval from a cabinet level position and too burdensome if approval is needed for each of several thousand insertional mutants that would be created for a single genome.” We made no changes based on this comment. It is important that researchers consider the possible unintended effects from the deliberate formation of antibiotic resistance. The restricted experiment provisions apply only if the activities “could compromise the use of the drug to control disease agents in humans, veterinary medicine, or agriculture.” We believe that the majority of research involving antibiotic resistant markers that are commonly used for selection and screening will not meet this criteria and therefore, will not require additional approval. Further, we believe that activities meeting this threshold should require such approval as has been the case for those entities subject to the “NIH Guidelines for Research Involving Recombinant DNA Molecules”.

The preamble to the initial interim final rule stated that we reserved a paragraph for possible future specification of additional types of experiments that might warrant stringent scrutiny in the interest of safety. One commenter argued that the following experiments should be added to the reserved paragraph based on the conclusion that they warrant such stringent scrutiny (i.e., should be allowed only if approved by the HHS Secretary after consultation with experts):

(1) Experiments involving construction of vaccine-resistant select agents or toxins.

(2) Experiments involving increasing the environmental stability of select agents or toxins.

(3) Experiments involving powder or aerosol production of select agents or toxins (other than preparation of lyophilized reference specimen <10 mg).

(4) Experiments involving powder or aerosol dispersal of select agents or toxins.

We made no changes based on this comment. We are studying whether these and other types of experiments should be added to § 73.13. Experiments will be proposed for addition to the listing of restricted experiments, as warranted, through the publication of a proposed amendment for public comment.

Commenters argued that the regulations should not list types of experiments that require approval because of the difficulty of amending regulations as needs change. Instead, commenters argued that the list should be included in the NIH Guidelines. We made no changes based on these comments. Publishing such information in the regulations will ensure that the public, including affected entities, are provided adequate notice concerning the list of experiments requiring approval requirements.

Commenters questioned whether the HHS Secretary should be involved in approving experiments. One commenter specifically questioned whether HHS has authority to proscribe experiments. We made no changes based on these comments. We believe we have such authority. In this regard, the Act at 42 U.S.C. 262a(c) states that the “Secretary shall by regulation provide for the establishment and enforcement of standards and procedures governing possession and use of listed agents and toxins * * * in order to protect public health and safety.”

We added provisions for how applicants are to submit a written request for approval.

Section 73.14 Incident Response

[This Subject Is in § 73.12 in the Amended Interim Final Rule]

The amended interim final rule provided that an entity required to register must develop and implement an emergency response plan that meets the requirements of OSHA Hazardous waste operations and emergency response standard at 29 CFR part 1910.120. With respect to these OSHA standards, paragraph (a) addresses scope, application, and definitions and paragraph (q) addresses emergency responses to hazardous substance releases. The provisions of 40 CFR part 311 make 29 CFR part 1910.120 applicable to State and local government employees. The OSHA regulations also reference 29 CFR part 1910.38 which concerns the development and implementation of an emergency action plan.

In the final rule, we have eliminated references to the OSHA provisions and have set forth the provisions from the OSHA regulations that would apply for an incident response plan. The OSHA regulations at 29 CFR part 1910.120(q) include provisions for assisting in the handling of an emergency. Although entities handling select agents and toxins are subject to the OSHA regulations, our regulations are not intended to cover clean up operations but rather to ensure that entities are prepared to take whatever other action is necessary to respond to an incident. Also, we note that an entity may use all or a portion of a document prepared under other authorities as long as it meets the requirements of the incident response provisions of the part 73 regulations.

Commenters recommended that the incident response section of the final rule reference 29 CFR part 1910.1450 which concerns occupational exposure to hazardous chemicals in a laboratory. We made no changes based on this comment. Although entities may need to become familiar with the provisions of this section, it does not provide the basis for requirements under the part 73 regulations and we see no reason for referencing it in this section.

One commenter asserted that the incident response provisions are “too stringent for select agents and toxins not mandated for control within maximum containment facilities.” The commenter asserted that “These provisions are based in part on a GAO report that promotes threat and risk assessments in the planning of emergency responses to an actual domestic terrorist incident involving weapons of mass destruction and on OSHA regulations relating to hazardous waste sites” and “have little relevance to the inadvertent release or theft of select agents and toxins from biomedical research laboratories.” We made no changes based on this comment. The commenter did not provide any specifics to support the general comment. We believe the incident response provisions are necessary to help ensure that entities plan ahead to be ready to take appropriate action to respond to any hazard that could arise.

Section 73.15 Training

[This Subject Is in § 73.13 in the Amended Interim Final Rule]

The training section in the amended interim final rule provided that a registered entity that falls outside of the OSHA Bloodborne Pathogen Standard (29 CFR part 1910.1030(a)) must provide safety and security information to any individual working in or visiting areas where select agents and toxins are handled or stored. Also, this section stated that: “In lieu of initial training for those individuals already involved in handling select agents, the Responsible Official may certify in writing that the individual has the required knowledge, skills, and abilities to safely carry out the duties and responsibilities.” Commenters argued against certification based on the conclusion that each facility is different and facility specific training must be required regardless of knowledge, skills, or ability. Also, commenters argued that Bloodborne Pathogen training would not be a suitable substitute for training specific to the use of select agents. To address these issues, commenters recommended the following wording: “An entity required to register under this part must provide information and training on safety and security for working with select agents and toxins to each individual approved for access and each individual not approved for access from the HHS Secretary or Administrator working in or visiting areas where select agents and toxins are handled or stored. The training may be modified according to the needs of the individual, the work they will do and their potential exposure. The training need not duplicate training provided under the OSHA Bloodborne Pathogen Standard 29 CFR 1910.1030.” We agree with the substance of these comments, including the reasons given for them. Accordingly, we made changes in § 73.15 to clearly reflect the intent of the regulations.

Section 73.16 Transfers

[This Subject Is in § 73.14 in the Amended Interim Final Rule]

One commenter argued that “receipt of select agents and toxins by the Responsible Official is a valuable procedural control to ensure that all required compliance measures are in place prior to final delivery of the agent to the Investigator” and further asserted that “This procedure parallels the common and effective practice of requiring receipt of radionuclides by the Radiation Safety Officer prior to their distribution to the Principal Investigator.” We made no changes based on this comment. The Responsible Official must approve the transfer and ultimately is responsible for compliance matters. However, we do not believe that it is necessary to require the Responsible Official to be the recipient. If a problem were to arise, the person having access and receiving the select agents or toxins would be the logical person to discover any issues or concerns related to the receipt of the select agents or toxins and advise the Responsible Official of such.

The part 73 regulations do not impose requirements on the transportation in commerce or exportation of select agents or toxins. However, requirements are imposed by the government on the transportation in commerce and exportation of select agents and toxins, including the following:

• Agriculture (9 CFR parts 92, 94, 95 96, 121, 122 and 130),
• Commerce (15 CFR parts 730 to 799),
• Health and Human Services (42 CFR parts 71 and 72),
• Occupational Health and Safety Administration (29 CFR part 1910.1030),
• Transportation (49 CFR parts 171 through 180), and
• Postal Service (39 CFR part 111).

Commenters asserted that § 73.11 should “address the security of shipments while in transit between entities” and that “The current DOT requirement for external labeling on select agent packages should be eliminated.” One commenter argued that “transportation security needs to be addressed and required to be just as rigorous as security requirements for the labs.” Another commenter argued that “The fact that registered entities must comply with all applicable laws concerning packaging and labeling significantly increases the risk that select agents could be easily identified and diverted for illegal purposes during transportation by common carrier.” Another commenter argued that “The absence of requirements for registration, security risk assessments, and physical security for the common carriers that will be handling and transporting select agents between registered entities is cause for concern.” Commenters also argued that “Both the shipping and receiving entities should document a chain of custody for transfers of select agents” and “These chain of custody documents should be securely stored with the EA-101 form at both the shipping and receiving entities.” Commenters also argued that “tamper-indicating procedures should be included in the packaging so that the recipient would immediately know that the package he/she has received had been tampered with; this event should trigger an immediate report to HHS.” We made no changes based on these comments. These issues are outside the scope of this rulemaking. However, we believe the provisions set forth in § 73.16, in addition to the other Federal laws regulating the transportation of hazardous materials in commerce and exportation of select agents and toxins, sufficiently protect public health and safety.

One commenter asserted that “Intra-entity movement of select agents, when outside access-controlled laboratory areas, should follow a documented chain of custody process that minimizes any possibility of diversion.” We made no changes based on this comment. The provisions of renumbered § 73.17 (Records) already require recordkeeping that would establish the chain of custody.

One commenter asserted that the transfer provisions should allow a non-registered entity to transfer a select agent or toxin to a registered entity based on the need to prevent destruction of valuable historical, archival or educational materials containing select agents or toxins. We agreed. Accordingly, we have added provisions to allow, on a case-by-case basis, the transfer of a select agent or toxin, not otherwise eligible for transfer.

One commenter asserted that a unique identifier should be assigned to each Transfer of Select Agent Form (APHIS/CDC Form 2) based on the argument that they are necessary to track and audit transfers. We made no changes based on this comment. We already add a unique authorization number to each approved transfer form.

One commenter recommended that the final rule require a response to a transfer request within an appropriate interval, e.g., 1-2 business days. We made no changes based on these comments. It is impractical to specify a time interval for the approval of a transfer request since the authorization of the request is dependent upon the review of appropriate records that confirm the individuals and entities currently meet all the requirements to transfer the select agents or toxins.

The amended interim final rule provided that an entity must maintain transfer records for three years. Commenters asserted that the regulations should require that EA-101 forms be kept for five years. We made no changes based on these comments. Entities may wish to retain records for longer for three years. In keeping with the three year registration period, we did not extend the required time to keep records.

The amended interim final rule did not set a time limit for transfers. We are adding a provision stating that a transfer authorization is valid only for 30 calendar days. This is necessary to efficiently manage the transfer authorization system and ensure timely resolution of outstanding transfer activities.

The amended interim final rule stated that when the select agents or toxins are consumed or destroyed after a transfer, an entity must provide written notice within five business days of such action. We are deleting this provision. As noted above, under the registration provisions the Responsible Official must provide prompt notification in writing if a change occurs in any information submitted in the application for the certificate of registration or amendments. Since this would include adding or removing a select agent or toxin, there is no need for otherwise imposing a five-day notification requirement.

The amended interim final rule required the submission of an immediate report by the recipient if “the package received containing select agents or toxins had been leaking or was otherwise damaged.” We clarified these provisions to require the submission of an immediate report by the recipient if the package had “been damaged to the extent that a release of the select agent or toxin may have occurred” because leaking may not be apparent (e.g., toxins). In addition, a damaged secondary container may not result in a compromised container to the extent that a release of the select agent or toxin may not have occurred. This more clearly expresses the intent and will help prevent a reader from concluding that an innocuous dent in a package must be reported.

In addition, we have added the provisions that “A select agent or toxin that is contained in a specimen for proficiency testing may be transferred without prior authorization from CDC or APHIS provided that, within 7 calendar days prior to the transfer, the sender reports to CDC or APHIS the select agent or toxin to be transferred and the name and address of the recipient” for the tracking of select agents or toxins including those contained in a specimen presented for proficiency testing.

Section 73.17 Records

[This Subject Is Covered in § 73.15 in the Amended Interim Final Rule]

Commenters recommended that this section be revised to be performance based. We made no changes based on these comments. Performance-based requirements are appropriate when differing circumstances require flexibility in approach. The records section sets forth specific requirements which we believe apply fairly to all entities required to be registered.

Commenters asserted that “It is not feasible to record quantities (i.e., actual real-time numbers) of replicating organisms.” Commenters recommended “functional or performance based approaches to documenting replicating agents, such as using a logbook/data entry system to record information typically gathered during a research protocol as part of standard practice or GLP (i.e., quantity of material inoculated, quantity of media added during the work, quantity material used/destroyed, final cell count, etc).” In response to the comment, we clarified the language that “accurate, current inventory for each select agent (including viral genetic elements, recombinant nucleic acids, and recombinant organisms) held in long-term storage (placement in a system designed to ensure viability for future use, such as in a freezer or lyophilized materials)” must be maintained.

One commenter argued that “It will be difficult to maintain real time/current records * * * for internal transfers of select agents until badge readers or bar code readers (with data accessible by the RO) are installed for each laboratory and for each storage area” and stated further that “Until we are able to install these access controls, we request flexibility regarding access control.” We made no changes based on this comment. An accurate and current inventory must be maintained in order to ensure accuracy of records.

One commenter requested clarification regarding the phrase “certain records and databases.” For clarification purposes, we specified that the “certain records and databases” are those records and databases required to be created under this part.

The amended interim final rule stated “for access to the area where select agents are used or stored that a record of the date and time the individual entered and left the area must be maintained.” We are deleting the exiting record-keeping provision. We believe the requirements that entities maintain records of all entries into areas containing select agents or toxins, including the name of the individual, name of the escort (if applicable), the date and time of entry is sufficient in maintaining records of access into areas containing select agents and toxins.

Section 73.18 Inspections

[This Subject Is in § 73.16 in the Amended Interim Final Rule]

One commenter argued that for inspections “a background in financial auditing alone is insufficient to review and critique the scientific practices and procedures involved” and that “Biosafety and biosecurity inspection teams should include professionals who have been educated and trained in, and have significant experience in, these multidisciplinary fields.” We made no changes based on this comment. However, we agree with the commenter and our inspection teams include individuals who meet the criteria suggested by the commenter.

APHIS and CDC will coordinate inspections to minimize the burden on the entity. This coordination will ensure that inspections by APHIS and CDC are not duplicative. However, additional inspections may be required under certain circumstances. For instance, another inspection may be required for amendments to a certificate of registration (e.g., addition of a laboratory) or to satisfy APHIS’ permit requirements.

Section 73.19 Notification of Theft, Loss, or Release

[This Subject Is in § 73.17 in the Amended Interim Final Rule]

The amended interim final rule required reporting of theft, loss, or release of select agents or toxins. It required reporting of any “release of a select agent or toxin causing occupational exposure or release outside of the primary containment barriers.” Commenters asserted that reporting should not be required for a release unless there was an occupational exposure outside of the biocontainment area of a registered entity. Similarly, one commenter recommended that the term “release” be defined “as an escape of a select agent or toxin to the external environment (outside the building), outside of the select agent/toxin laboratory (or restricted area) or a spill or other exposure in the laboratory resulting in an OSHA recordable injury or illness.” Commenters argued that entities would have appropriate procedures for safely responding to and managing spills within biocontainment areas of a facility. They also argued that without such a change there would be a waste of resources, disruption of research, and avoidance of reporting. We believe that all occupational exposures should be reported since exposures have the potential to adversely affect the public health and safety. In addition, we clarified the language to require notification “upon discovery of a release of an agent or toxin causing occupational exposure or release of select agent or toxin outside of the primary barriers of the biocontainment area.”

One commenter opposed the reporting requirements for theft or loss of select agents and toxins based on the following assertions:

• Because of the improved recordkeeping requirements, illegal diversion of a select agent will most likely be done by subculturing an agent out of a vial without removing the vial or a detectable amount of material.
• It is likely that the unexplained disappearance of individual vials will not be noticed at the time of loss but days, weeks, months, years, or decades later making reconstruction of the circumstances virtually impossible.
• The unexplained absence of a vial of a select agent will most likely result from errors in the original inventory, or failure to adjust the inventory when vials are used legitimately.

We made no changes based on these assertions. To take no action when select agents or toxins are unaccounted for would reduce the ability of the HHS Secretary to respond in a timely matter to protect public health and safety.

One commenter noted that the amended interim final rule required safety and security “incident” reports but did not define events that constitute “incidents.” The commenter questioned “Is any failure to comply with the regulations an “incident”?” and indicated that an “incident” should be limited to “any occurrence or event which results, or threatens to result, in the unlawful transfer, possession, or use of a select agent or in the loss, theft, or other unauthorized transfer, use, or release of a select agent.” In response to this comment, we clarified the regulations to require reporting of thefts, losses, or releases.

An entity must notify immediately CDC, APHIS, and appropriate Federal, State, or local law enforcement agencies upon discovery of the theft or loss of a select agent or toxin. In addition to other information required to be submitted, we have added the requirement that advises the entity to report the list of Federal, State, or local law enforcement agencies that the entity reported or intends to report the theft or loss. This will help coordinate the response effort.

Section 73.20 Administrative Review

[This Subject Is in § 73.18 in the Amended Interim Final Rule]

Commenters argued that the appeal provisions should have more detail. We made no changes based on these comments. Any additional appeal procedures will be provided, as necessary at the time of an appeal.

Commenters argued that the regulations should impose timeframes for making appeal decisions. We made no changes based on these comments. We will act to make decisions as quickly as possible. However, our first concern must be to make appropriate decisions that help to protect public health and safety.

Commenters asserted that the part 73 regulations should contain an administrative appeals procedure for researchers to request review of a designation as a “restricted person” or provide an exemption process for legitimate research. Commenters asserted that “the absence of an appeals or exemption process is troubling given the possible inaccuracies in the information contained in the databases that are available to the Federal Government and others.” We made no changes based on these comments. The Act prohibits a person designated as a restricted person from obtaining approval to have access to select agents or toxins and we have no authority to act contrary to the Act. However, individuals may challenge factual mistakes as described in the administrative appeal process for Section 73.20 (Administrative review).

Submissions and Forms

[This Subject Is in § 73.21 in the Amended Interim Final Rule]

We received no comments concerning submissions and forms section. Since addresses and telephone numbers are subject to change, we deleted this section. Specific guidance on the submissions and forms is available to the public on the Select Agent Program web site.

In addition, we recognize that the different form numbers for identical forms may be confusing to the regulated community. Accordingly, CDC and APHIS will be adopting a shared numbering system for the identical forms that uses the prefix “APHIS/CDC Form”.

CDC form No.	APHIS form No.	Title of form	APHIS/CDC form No.
0.1319	2040	Application for Laboratory Registration for Possession, Use, and Transfer of Select Agents and Toxins	1
EA-101	2041	Report of Transfer of Select Agents and Toxins	2
0.1316	2043	Report of Theft, Loss, or Release of Select Agents and Toxins	3
0.1318	2044	Report of Identification of a Select Agents or Toxin in a Clinical or Diagnostic Laboratory	4
0.1317	2042	Request for Exemption of Select Agents and Toxins for Public Health or Agricultural Emergency or Investigational/Experimental Product	5

Section 73.21 Civil Money Penalties

[This Subject Is in § 73.19 in the Amended Interim Final Rule]

One commenter recommended that entities be subjected to much higher maximum civil money penalties than individuals. We made no changes based on this comment. The maximum amounts for civil monetary penalties, set by statute, are in fact higher for entities than for individuals. As indicated earlier, however, we are making one technical revision to 42 CFR part 1003 by adding amendatory language in the introductory paragraph for § 1003.106(a)(1) to reference OIG's newly codified penalty authority set forth in § 1003.102(b)(16).

Criminal Penalties

[This Subject Is in § 73.20 in the Amended Interim Final Rule]

We received no comments concerning criminal penalties. Since this section restates the provisions of the Act, we deleted this section.

Miscellaneous

We made nonsubstantive changes throughout the regulations for purposes of clarity. In addition, CDC and APHIS made the language similar to ensure consistency between the regulations.

Economic Impact

A dozen commenters addressed issues relevant to the rule's Regulatory Impact Analysis (RIA). Nearly all of these comments were submitted by universities or related organizations.

One commenter agreed with HHS's regulatory benefits analysis, i.e., that adequate security for select agents is crucial to protect health and safety, and that the potential costs of accidental or intentional release of a select agent or toxin could far exceed the costs institutions will incur to implement the new regulations.

Approximately eight commenters stated that the cost of the rule would be significantly greater than estimated by CDC. Several university commenters reported estimated costs higher than CDC's estimates. These comments reported first year costs ranging from $1 million to $4 million, with annual maintenance costs thereafter from nearly $100,000 to up to $700,000 (compared to CDC's estimated annualized cost of $153,000). One university reported an estimate of $300,000 in security improvements, including electronic card access, alarm systems, and security cameras, all of which are suggested in the rule, but excluding recordkeeping and other personnel requirements.^[2] For these same items, another university reported an estimate of $400,000 for a single university BSL-3 select agent lab, excluding other select agent labs at the same university. Another commenter reported that several large universities have estimated that their costs will greatly exceed CDC's estimates. Some commenters argued that the full cost of implementing the rule will not be known until CDC reviews and approves of individual safety and security plans.

One commenter stated that the rule would have been found to have a significant overall effect, far exceeding $100 million annually, if factors such as lost research productivity and indirect institutional costs had been considered. In addition, several commenters stated that the requirements would reduce the number of institutions and locations where select agent research will be performed. One stated that the requirements may be too costly and difficult for smaller entities and may cause them to forego work with select agents and toxins. One commenter cautioned against the loss of specimens, which comprise a “library of infectious diseases.” Several commenters felt that non-quantifiable impacts such as these, in turn, would impede the accumulation of knowledge, decrease the level of talent studying select agents, and shift knowledge outside of the U.S.

Several commenters questioned whether universities would be able to recover the costs of the rule given cost recovery practices, requirements, and caps. Other commenters asked or suggested that grant money be made available to cover the cost of the rule, either through current grant programs or new select agent infrastructure support grants. Others requested more generally that the final rule address mechanisms by which universities would recover the cost of compliance. One stated than an exemption of the minimum cost cap would be appropriate to ensure compliance. Some commenters (including State universities) cited already significant budget constraints. A few commenters stated that the costs of the rule represent an unfunded mandate unless a means of cost recovery is made available.

We carefully considered each of the comments that addressed the RIA, including the issues raised regarding non-quantifiable and indirect costs of the rule and the data presented. Based on this review, we determined that it was not necessary to revise the economic analysis to address the comments, although we did revise the RIA based on rule changes and newly-available data, as described later in this section. In passing the Public Health Security and Bioterrorism Preparedness and Response Act of 2002, Congress recognized that it was an important matter of national security to ensure that entities that possess, use, or transfer biological agents and toxins with the potential to pose a severe threat to humans met their responsibilities to keep these agents and toxins safe and secure. Development of both the amended interim final rule and the final rule took into consideration the potential economic impact of compliance with the biosecurity and physical security requirements. These costs and benefits were addressed in detail in the Regulatory Impact Analysis done for both the amended interim final rule and the final rule.

Although some commenters cited figures to support their assertion that the RIA understated the cost of the rule, the information provided within these comments generally did not contradict the conclusions presented in the RIA. For example, we believe the $4 million first-year cost and $700,000 annual maintenance cost that was reported by one of the commenters actually is consistent with the RIA, because the commenter represents a State-wide university system containing 10 schools; if the reported figures are divided across even five or six of the system's schools, then the reported costs are similar to those estimated in the RIA. Similarly, various comments estimated one-time costs at $400,000 for partial upgrades at one lab, and at $300,000 for partial upgrades at a different lab. Absent further details regarding the specific types of labs involved and the need for other upgrades, however, these figures appear to fall within the estimated RIA values.

The comments, in general, did not contain sufficient information to call the RIA's conclusions into questions. For example, one university estimated its one-time cost to be in excess of $1 million, which would appear to exceed the RIA's model facility estimate by 40 percent. In this case, however, the comment did not contain any additional information that would allow CDC to either validate the university's estimate or evaluate whether the particular lab might be an outlier with respect to costs.

We agree that the RIA has not attempted to quantify the value of lost research and other indirect institutional effects. We considered such effects, however, and for several reasons, we disagree with the contention that indirect effects would lead to overall impacts exceeding $100 million annually. First, based on our experience with the pre-notification and registration process, we believe there will be few instances where universities abandon lines of research in response to the rule. Out of the 200 or so entities that transferred or destroyed their select agents rather than registering under the rule, we believe that the majority did so for reasons that do not threaten future research, as suggested by the following three typical examples: (1) Researchers who already have completed efforts under past research grants; (2) universities that continue their select agent research but at fewer locations within the university system; and (3) hospitals that had used select agents for purposes other than research (e.g., quality assurance testing) but which can readily substitute other agents. Second, even if an institution did discontinue its research, we expect that this research would not be “lost.” Instead, other universities likely would pick up these research lines, particularly research efforts funded through grants. Therefore, any research effects are likely to be small including, in particular, any shift of knowledge on select agents to outside of the U.S. Third, to the extent that any net reduction in research or other negative institutional effects were to occur, quantification of these effects would be highly speculative.

In conjunction with the development of the revised final rule, we revised the RIA in a number of respects and reduced the estimated cost of the rule to an annualized total of $16 million. The economic analysis were estimated based on the actual costs incurred by registering entities implementing the interim final rule that became fully applicable on November 12, 2003. This estimate reflects the cost of all incremental activities required by the final rule, which for the most part are the same activities as were initially required by the 2002 interim final rule. (Very few of the changes made by the final rule have any bearing on cost relative to the interim final rule.) ^[3] Nevertheless, the $16 million cost represents a substantial decrease relative to the $41 million figure estimated in 2002 for the interim final rule. The decline is due almost entirely to the availability of new data showing that (1) fewer entities registered with CDC than had been estimated, (2) fewer individuals required security risk assessments, and (3) a smaller number of transfers occur each year than was estimated.

We considered the possibility that the smaller numbers reflected in the actual data (relative to earlier estimates) might be the result of indirect impacts of the rule (e.g., entities abandoning research rather than undertaking the registration process). Our experience during the pre-notification and registration process suggests, however, that this is not the case. Instead, we believe the original estimates were overstated as a result of the over-inclusive notification process we used to help ensure that all potentially affected entities would be made aware of the rule. Most of the overestimates reflect entities that have since notified us that they are not affected by the rule (e.g., users of Botox) or that they are exempt entities. Others possess agents that would be considered excluded from the regulation. While we believe that 200 or so entities did transfer or destroy their select agents rather than register under the rule, we believe that the majority did so for reasons that do not threaten future research, as discussed previously.

With respect to the comments concerning any “unfunded mandate” imposed by the rule, we note that while the rule imposes certain costs on the regulated community, to reduce the burden of these new regulations the biosecurity and physical security requirements contained in this rule are based on guidance provided by the “Biosafety in Microbioloical and Biomedical Laboratories,” 4th Edition, published jointly by the CDC and the National Institutes of Health. Whether the federal government should provide funding for enhanced biosafety and physical security at facilities using select agents and toxins is beyond the scope of the regulations mandated by the Public Health Security and Bioterrorism Preparedness and Response Act of 2002.

Paperwork Reduction Act

In accordance with section 3507(d) of the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.), the information collection or recordkeeping requirements included in this final rule have been approved by the Office of Management and Budget (OMB) under OMB control number 0920-0576. However, CDC is requesting an emergency clearance from OMB regarding this data collection with a 10 day public comment period. The emergency clearance is based on a revision of this data collection as a result of this final rule.

Please send written comments on the new information collection contained in this final rule to Seleda M. Perryman, CDC Assistant Reports Clearance Officer, 1600 Clifton Road, MS-D24, Atlanta, GA 30333. Written comments should be received within 10 days of this notice.

Copies of this information collection may be obtained from Seleda M. Perryman, CDC Assistant Reports Clearance Officer, at [phone].

CDC is requesting continued OMB approval to collect this information through the use of five separate forms. These forms are: (1) Application for Registration, (2) Transfer of Select Agent or Toxin Form, (3) Facility Notification of Theft, Loss, or Release Form, (4) Clinical and Diagnostic Laboratory Reporting Form, and (5) Request for Exemption.

Reductions in Burden of Data Collection

The amended interim final rule stated that an entity must provide written notice at least five business days before destroying a select agent or toxin, if the destruction would be for the purpose of discontinuing activities with a select agent or toxin covered by a certificate of registration. The amended interim final rule further stated that “This will allow the HHS Secretary and/or the USDA Secretary to observe the destruction or take other action as appropriate.” We are deleting this provision. Under the registration provisions, the Responsible Official must provide prompt notification in writing, if a change occurs in any information submitted in the application for the certificate of registration or amendments. This would include adding or removing a select agent or toxin and it was determined that to impose an additional five-day notification requirement was not necessary. Therefore, there is a decrease in burden that was previously reported by the estimated time of 30 minutes to gather the information and submit this notification.

The amended interim final rule stated that when the select agents or toxins are consumed or destroyed after a transfer, an entity must provide written notice within five business days of such action. We are deleting this provision. As noted above, under the registration provisions the Responsible Official must provide prompt notification in writing if a change occurs in any information submitted in the application for the certificate of registration or amendments. Since this would include removing a select agent or toxin from a registration due to it being consumed or destroyed after a transfer, it was determined that there is no need to impose this additional five-day notification requirement. Therefore, there is a decrease in burden that was previously reported by the estimated time of 15 minutes to gather the information and submit this notification.

Potential Increases in Burden of Data Collection

The amended interim final rule stated entities required to register under this part must immediately notify a theft, loss, or release of select agent or toxin. We added the provisions that exempted clinical or diagnostic laboratories and other entities that possess, use, or transfer a select agent or toxin that is contained in a specimen presented for diagnosis, verification, or proficiency testing must also meet the requirements of § 73.19 (Notification of theft, loss, or release). We believe that any theft, loss, or release of a select agent or toxin must be reported to protect public health and safety. Based upon the small number of reports received during the implementation of the Interim Final Rule, we believe that this would not result in a change in burden.

The amended interim final rule stated entities were required to report immediate notification to CDC for any of the following overlap select agents: Bacillus anthracis, Botulinum neurotoxins, and Francisella tularensis and immediately notify APHIS of all overlap select agents and toxins. In this final rule, CDC and APHIS have combined their immediate notification list for overlap select agents and toxins (Bacillus anthracis, Botulinum neurotoxins, Brucella melitensis, Francisella tularensis, Hendra virus, Nipah virus, Rift Valley fever virus, and Venezuelan equine encephalitis virus). Therefore, entities will be able to immediately notify either agency. Since entities were required to immediately notify both agencies in regards to overlap select agents and toxins and now only have to notify one agency, we believe that due to the small number of such reports received this would not result in a change in burden, but a change in process for the regulated community.

In addition, we have added the provisions in § 73.16 (Transfers) section that “A select agent or toxin that is contained in a specimen for proficiency testing may be transferred without prior authorization from CDC or APHIS provided that, within seven calendar days prior to the transfer, the sender reports to CDC or APHIS the select agent or toxin to be transferred and the name and address of the recipient” for the tracking of select agents or toxins including those contained in a specimen presented for proficiency testing. Due to the small number of the “Report of Identification of a Select Agents or Toxin in a Clinical or Diagnostic Laboratory” forms received regarding proficiency testing specimens that were required to report under the current Interim Final Rule, we believe that this notification requirement would not result in a change in burden.

Executive Order 12866 and Regulatory Flexibility Act

This document has been reviewed by the Office of Management and Budget under Executive Order 12866. In the course of developing the rule, CDC considered the rule's costs and benefits. CDC's analysis is summarized below.

Affected Entities. To date, 451 entities have submitted an application for registration and 350 have been determined by CDC to require registration. The remaining 101 applications were not processed primarily because CDC determined that the entities sought to register for something other than a select agent. The 350 registered entities fall within six groups:

• Academic/University: 105 (approximately 30 percent);
• Government—State/Local: 104 (approximately 30 percent);
• Government—Federal: 61 (approximately 17 percent);
• Commercial: 39 (approximately 11 percent);
• Private non-profit/Research Institutions: 35 (approximately 10 percent); and
• Other: 6 (approximately 2 percent).

Approximately 8,394 staff has received a security risk assessment approval since the requirement to submit information to the Attorney General became effective on April 12, 2003. The number of employees with access to select agents or toxins ranges from approximately five individuals at smaller facilities to one hundred or more at some large universities and commercial facilities.

Costs. The estimation of the long term cost of implementing the select agent regulations was based on the actual costs incurred by registering entities implementing the interim final rule that became fully applicable on November 12, 2003. Additionally, before the interim final rule was issued in December 2002, CDC contacted a number of entities to assess existing practices. Because many of the laboratories that will register under this rule are already substantially in compliance with the practices required, the costs of the rule are relatively limited.

In combining the estimated impact of the interim final rule with any new impacts in the final rule, CDC estimates the total annualized cost of the final rule at $16 million,^[4] with annualized costs per facility ranging from $15,300 to $170,000. CDC had originally estimated the total annualized cost of the interim final rule at $40 million. The revised estimate of $16 million incorporates improved estimates of the number of registered entities. We estimate that the costs of the rule will not exceed $100 million in any single year; therefore the rule is not economically significant under Executive Order 12866. We estimate the first-year costs of the rule for all affected entities to total $36 million (compared to the previous estimate for the interim final rule of $106 million), with subsequent annual costs totaling $14 million (compared to the previous estimate for the interim final rule of $30 million). On a per facility basis, the average costs of the rule range from $15,300 to $170,000 per facility, slightly higher on average than those estimated for the interim final rule ($9,000 to $198,000). This increase is due to the net effect of a few particular changes in the final rule,^[5] but the costs may be overstated due to conservative assumptions used in the absence of better information. These cost estimates exclude the cost of any indirect impacts resulting from the rule, although, as previously discussed, we believe that any indirect impacts are likely to be minimal.

Benefits. The benefits to public health and safety from implementation of the rule are clear, although difficult to quantify. The benefits of the final rule will be the decreased risk of accidental or intentional release of a select agent or toxin derived from the establishment of Federal standards for biosafety, security, training, and personnel surety. The cost of such an event in human life could be very high. The release of a select agent or toxin could result in a public health emergency requiring an extensive and expensive response. This effort could include extensive public health measures, such as quarantine, preventative treatment and health testing for large numbers of potentially exposed persons, and extensive decontamination. Substantial costs could be incurred by hospitals and other medical facilities and institutions of government at all levels. A release, or widespread fear of one, also would create significant secondary effects. It could disrupt business, transportation, and many other aspects of normal behavior, on both a short-term and potentially a long-term basis.

The impacts resulting from the October 2001 anthrax attacks provide an example of the costs that a release could incur. The anthrax attacks caused five fatalities and 17 illnesses, disrupted business and government activities, and caused widespread apprehension and changes in behavior. Costs included more than $23 million to decontaminate one Senate office building; approximately $2 billion in revenues lost to the postal service, and as much as $3 billion in additional costs to the postal service for cleanup of contamination and procurement of mailsanitizing equipment. Substantial costs due to lost productivity throughout the economy and from ongoing costs of the investigations into the incident are additional impacts.

Implementation of the final rule will continue to provide a means for the registration of those who possess select agents and toxins; ensure that their transfer, storage, and use can be tracked; provide for the screening of personnel with access to such agents or toxins; and require that entities in possession of such agents or toxins develop and implement effective means of biosafety and physical security. The benefit of these provisions is a reduced likelihood of either an accidental or intentional release of select agents and toxins and the consequent avoidance of costs associated with such a release.

Impacts resulting from the costs of the rule should not be significant. The annualized cost on small entities would not exceed one percent of sales or revenue stream and the initial cost would not exceed three percent of sales or revenue stream. A copy of the economic analysis, “Regulatory Impact Analysis, 42 CFR part 73, Possession, Use, and Transfer of Select Biological Agents and Toxins Final Rule,” is available from on the CDC Web site at http://www.cdc.gov. The HHS Secretary hereby certifies that the final rule will not have a significant economic impact on a substantial number of small entities.

One commenter stated the rule did not adequately address the cost of compliance and believed that the interim final rule had created an unfunded mandate. We made no changes based on this comment. In passing the Public Health Security and Bioterrorism Preparedness and Response Act of 2002, Congress recognized that it was an important matter of national security to ensure that entities that possess, use, or transfer biological agents and toxins with the potential to pose a severe threat to humans met their responsibilities to keep these agents and toxins safe and secure. Development of both the amended interim final rule and the final rule took into consideration the potential economic impact of compliance with the biosecurity and physical security requirements. These costs and benefits were addressed in detail in the Regulatory Impact Analysis done for both the amended interim final rule and the final rule. We do not believe that the select agent regulations created an unfunded mandate. Since each entity is unique depending on the select agents and toxins in its possession, use of those agents and toxins, and the laboratory facility and physical plants, we stated biosecurity and physical security requirements in performance standards that we believe were already industry standards. For example, the biosecurity standards rely on the guidance provided by the Biosafety in Microbiological and Biomedical Laboratories, 4th Edition jointly published by the CDC and the National Institutes of Health. Whether the federal government should provide funding for enhanced biosafety and physical security at facilities using select agents and toxins is beyond the scope of the regulations mandated by the Public Health Security and Bioterrorism Preparedness and Response Act of 2002.

Unfunded Mandates

The Unfunded Mandates Reform Act requires, at 2 U.S.C. 1532 that agencies prepare an assessment of anticipated costs and benefits before developing any rule that may result in an expenditure by State, local, or tribal governments, in the aggregate, or by the private sector of $100 million or more in any given year. This rule does not result in such an expenditure.

Executive Order 12988

This rule has been reviewed under Executive Order 12988, Civil Justice Reform. This rule: (1) Preempts all State and local laws and regulations that are inconsistent with this rule; (2) has no retroactive effect; and (3) does not require administrative proceedings before parties may file suit in court challenging this rule.

List of Subjects

42 CFR Part 72

• Biologics
• Packaging and containers
• Penalties
• Reporting and recordkeeping requirements
• Transportation

42 CFR Part 73

• Biologics
• Incorporation by reference
• Packaging and containers
• Penalties
• Reporting and recordkeeping requirements
• Transportation

42 CFR Part 1003

• Administrative practice and procedure
• Fraud
• Grant programs—health
• Health facilities
• Health professions
• Maternal and child health
• Medicaid
• Medicare
• Penalties
• Social security

Dated: March 10, 2005.

Michael O. Leavitt,

Secretary.

42 CFR Chapter I—Public Health Service, Department of Health and Human Services

§ 72.4

Notice of delivery; failure to receive.

For the reasons stated in the preamble, 42 CFR Chapter I is amended as follows:

PART 72—[AMENDED]

1. The authority citation for part 72 continues to read as follows:

Authority: 42 U.S.C. 264, 271; 31 U.S.C. 9701; 18 U.S.C. 3559, 3571; 42 U.S.C. 262 note.

2. Add the following sentence at the end of § 72.4: * * * This section does not apply to select agents and toxins that are subject to requirements under the provisions of 42 CFR 73.16 concerning transfers of select agents and toxins.

3. Revise § 72.6 to read as follows:

§ 72.6

Exemptions.

(a) through (g) [Reserved].

(h) For purposes of 18 U.S.C. 175b, the exemptions to the list referred to in Appendix A constitute the exemptions set forth at 42 CFR 73.5 and 73.6.

4. Revise Appendix A to part 72 to read as follows:

Appendix A to Part 72—Select Agents

For purposes of 18 U.S.C. 175b, the list of select agents constitutes the list of select agents and toxins set forth at 42 CFR 73.3 and 73.4.

5. For the reasons stated in the preamble, 42 CFR part 73 is revised to read as follows:

PART 73—SELECT AGENTS AND TOXINS

73.1

Definitions.

73.2

Purpose and scope.

73.3

HHS select agents and toxins.

73.4

Overlap select agents and toxins.

73.5

Exemptions for HHS select agents and toxins.

73.6

Exemptions for overlap select agents and toxins.

73.7

Registration and related security risk assessments.

73.8

Denial, revocation, or suspension of registration.

73.9

Responsible Official.

73.10

Restricting access to select agents and toxins; security risk assessments.

73.11

Security.

73.12

Biosafety.

73.13

Restricted experiments.

73.14

Incident response.

73.15

Training.

73.16

Transfers.

73.17

Records.

73.18

Inspections.

73.19

Notification of theft, loss, or release.

73.20

Administrative review.

73.21

Civil money penalties.

Authority: 42 U.S.C. 262a; sections 201-204, 221 and 231 of Title II of Public Law 107-188, 116 Stat. 637 (42 U.S.C. 262a).

§ 73.1

Definitions.

For purposes of this part:

Administrator means the Administrator, Animal and Plant Health Inspection Service, or any person authorized to act for the Administrator.

Animal and Plant Health Inspection Service (APHIS) means the Animal and Plant Health Inspection Service of the U.S. Department of Agriculture.

Attorney General means the Attorney General of the United States or any person authorized to act for the Attorney General.

Biological agent means any microorganism (including, but not limited to, bacteria, viruses, fungi, rickettsiae, or protozoa), or infectious substance, or any naturally occurring, bioengineered, or synthesized component of any such microorganism or infectious substance, capable of causing death, disease, or other biological malfunction in a human, an animal, a plant, or another living organism; deterioration of food, water, equipment, supplies, or material of any kind; or deleterious alteration of the environment.

CDC means Centers for Disease Control and Prevention of the Department of Health and Human Services.

Diagnosis means the analysis of specimens for the purpose of identifying or confirming the presence or characteristics of a select agent or toxin provided that such analysis is directly related to protecting the public health or safety, animal health or animal products, or plant health or plant products.

Entity means any government agency (Federal, State, or local), academic institution, corporation, company, partnership, society, association, firm, sole proprietorship, or other legal entity.

HHS means the Department of Health and Human Services.

HHS Secretary means the Secretary of the Department of Health and Human Services or his or her designee, unless otherwise specified.

HHS select agent and/or toxin means a biological agent or toxin included in § 73.3.

Overlap select agent and/or toxin means a biological agent or toxin listed in § 73.4 and 9 CFR part 121.4.

Principal investigator means the one individual who is designated by the entity to direct a project or program and who is responsible to the entity for the scientific and technical direction of that project or program.

Proficiency testing means the process of determining the competency of an individual or laboratory to perform a specified test or procedure.

Responsible Official means the individual designated by an entity with the authority and control to ensure compliance with the regulations in this part.

Select agent and/or toxin means unless otherwise specified, all of the biological agents or toxins listed in §§ 73.3 and 73.4.

Specimen means samples of material from humans, animals, plants or the environment or isolates or cultures from such samples for the diagnosis, verification, or proficiency testing.

State means any of the several States of the United States, the Commonwealth of the Northern Mariana Islands, the Commonwealth of Puerto Rico, the District of Columbia, Guam, the Virgin Islands of the United States, or any other territory or possession of the United States.

Toxin means the toxic material or product of plants, animals, microorganisms (including, but not limited to, bacteria, viruses, fungi, rickettsiae, or protozoa), or infectious substances, or a recombinant or synthesized molecule, whatever their origin and method of production, and includes any poisonous substance or biological product that may be engineered as a result of biotechnology, produced by a living organism; or any poisonous isomer or biological product, homolog, or derivative of such a substance.

United States means all of the States.

USDA means the United States Department of Agriculture.

Verification means the demonstration of obtaining established performance (e.g., accuracy, precision, and the analytical sensitivity and specificity) specifications for any procedure used for diagnosis.

§ 73.2

Purpose and scope.

This part implements the provisions of the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 setting forth the requirements for possession, use, and transfer of select agents and toxins. The biological agents and toxins listed in this part have the potential to pose a severe threat to public health and safety, to animal health, or to animal products. Overlap select agents and toxins are subject to regulation by both CDC and APHIS.

§ 73.3

HHS select agents and toxins.

(a) Except for exclusions under paragraphs (d) and (e) of this section, the HHS Secretary has determined that the biological agents and toxins listed in this section have the potential to pose a severe threat to public health and safety.

(b) HHS select agents and toxins:

Abrin

Cercopithecine herpesvirus 1 (Herpes B virus)

Coccidioides posadasii

Conotoxins

Crimean-Congo haemorrhagic fever virus

Diacetoxyscirpenol

Ebola viruses

Lassa fever virus

Marburg virus

Monkeypox virus

Ricin

Rickettsia prowazekii

Rickettsia rickettsii

Saxitoxin

Shiga-like ribosome inactivating proteins

South American Haemorrhagic Fever viruses (Junin, Machupo, Sabia, Flexal, Guanarito)

Tetrodotoxin

Tick-borne encephalitis complex (flavi) viruses (Central European Tick-borne encephalitis, Far Eastern Tick-borne encephalitis [Russian Spring and Summer encephalitis, Kyasanur Forest disease, Omsk Hemorrhagic Fever])

Variola major virus (Smallpox virus) and Variola minor virus (Alastrim)

Yersinia pestis

(c) Genetic Elements, Recombinant Nucleic Acids, and Recombinant Organisms:

(1) Nucleic acids that can produce infectious forms of any of the select agent viruses listed in paragraph (b) of this section.

(2) Recombinant nucleic acids that encode for the functional form(s) of any of the toxins listed in paragraph (b) of this section if the nucleic acids:

(i) Can be expressed in vivo or in vitro, or

(ii) Are in a vector or recombinant host genome and can be expressed in vivo or in vitro.

(3) HHS select agents and toxins listed in paragraph (b) of this section that have been genetically modified.

(d) HHS select agents or toxins that meet any of the following criteria are excluded from the requirements of this part:

(1) Any HHS select agent or toxin that is in its naturally occurring environment provided the select agent or toxin has not been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source.

(2) Non-viable HHS select agents or nonfunctional HHS toxins.

(3) HHS toxins under the control of a principal investigator, treating physician or veterinarian, or commercial manufacturer or distributor, if the aggregate amount does not, at any time, exceed the following amounts: 100 mg of Abrin; 100 mg of Conotoxins; 1,000 mg of Diacetoxyscirpenol; 100 mg of Ricin; 100 mg of Saxitoxin; 100 mg of Shiga-like ribosome inactivating proteins; or 100 mg of Tetrodotoxin.

(e) An attenuated strain of a HHS select agent or toxin may be excluded from the requirements of this part based upon a determination that the attenuated strain does not pose a severe threat to public health and safety.

(1) To apply for an exclusion, an individual or entity must submit a written request and supporting scientific information. A written decision granting or denying the request will be issued. An exclusion will be effective upon notification to the applicant. Exclusions will be published periodically in the notice section of the Federal Register and will be listed on the CDC Web site at http://www.cdc.gov/​.

(2) If an excluded attenuated strain is subjected to any manipulation that restores or enhances its virulence, the resulting select agent or toxin will be subject to the requirements of this part.

(3) An individual or entity may make a written request to the HHS Secretary for reconsideration of a decision denying an exclusion application. The written request for reconsideration must state the facts and reasoning upon which the individual or entity relies to show the decision was incorrect. The HHS Secretary will grant or deny the request for reconsideration as promptly as circumstances allow and will state, in writing, the reasons for the decision.

(f) Any HHS select agent or toxin seized by a Federal law enforcement agency will be excluded from the requirements of this part during the period between seizure of the select agent or toxin and the transfer or destruction of such agent or toxin provided that:

(1) As soon as practicable, the Federal law enforcement agency transfers the seized select agent or toxin to an entity eligible to receive such agent or toxin or destroys the agent or toxin by a recognized sterilization or inactivation process,

(2) The Federal law enforcement agency safeguards and secures the seized select agent or toxin against theft, loss, or release, and reports any theft, loss, or release of such agent or toxin, and

(3) The Federal law enforcement agency reports the seizure of the select agent or toxin to CDC or APHIS.

(i) The seizure of Ebola viruses, Lassa fever virus, Marburg virus, South American Haemorrhagic Fever virus (Junin, Machupo, Sabia, Flexal, Guanarito), Variola major virus (Smallpox virus), Variola minor (Alastrim), or Yersinia pestis must be reported within 24 hours by telephone, facsimile, or e-mail. This report must be followed by submission of APHIS/CDC Form 4 within seven calendar days after seizure of the select agent or toxin.

(ii) For all other HHS select agents or toxins, APHIS/CDC Form 4 must be submitted within seven calendar days after seizure of the agent or toxin.

(iii) A copy of APHIS/CDC Form 4 must be maintained for three years.

(4) The Federal law enforcement agency reports the final disposition of the select agent or toxin by submission of APHIS/CDC Form 4. A copy of the completed form must be maintained for three years.

§ 73.4

Overlap select agents and toxins.

(a) Except for exclusions under paragraphs (d) and (e) of this section, the HHS Secretary has determined that the biological agents and toxins listed in this section have the potential to pose a severe threat to public health and safety, to animal health, or to animal products.

(b) Overlap select agents and toxins:

Bacillus anthracis

Botulinum neurotoxins

Botulinum neurotoxin producing species of Clostridium

Brucella abortus

Brucella melitensis

Brucella suis

Burkholderia mallei (formerly Pseudomonas mallei)

Burkholderia pseudomallei (formerly Pseudomonas pseudomallei)

Clostridium perfringens epsilon toxin

Coccidioides immitis

Coxiella burnetii

Eastern Equine Encephalitis virus

Francisella tularensis

Hendra virus

Nipah virus

Rift Valley fever virus

Shigatoxin

Staphylococcal enterotoxins

T-2 toxin

Venezuelan Equine Encephalitis virus

(c) Genetic Elements, Recombinant Nucleic Acids, and Recombinant Organisms:

(1) Nucleic acids that can produce infectious forms of any of the overlap select agent viruses listed in paragraph (b) of this section.

(2) Recombinant nucleic acids that encode for the functional form(s) of any overlap toxins listed in paragraph (b) of this section if the nucleic acids:

(i) Can be expressed in vivo or in vitro, or

(ii) Are in a vector or recombinant host genome and can be expressed in vivo or in vitro.

(3) Overlap select agents and toxins listed in paragraph (b) of this section that have been genetically modified.

(d) Overlap select agents or toxins that meet any of the following criteria are excluded from the requirements of this part:

(1) Any overlap select agent or toxin that is in its naturally occurring environment provided that the select agent or toxin has not been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source.

(2) Non-viable overlap select agents or nonfunctional overlap toxins.

(3) Overlap toxins under the control of a principal investigator, treating physician or veterinarian, or commercial manufacturer or distributor, if the aggregate amount does not, at any time, exceed the following amounts: 0.5 mg of Botulinum neurotoxins; 100 mg of Clostridium perfringens epsilon toxin; 100 mg of Shigatoxin; 5 mg of Staphylococcal enterotoxins; or 1,000 mg of T-2 toxin.

(e) An attenuated strain of an overlap select agent or toxin may be excluded from the requirements of this part based upon a determination that the attenuated strain does not pose a severe threat to public health and safety, to animal health, or to animal products.

(1) To apply for an exclusion, an individual or entity must submit a written request and supporting scientific information. A written decision granting or denying the request will be issued. An exclusion will be effective upon notification to the applicant. Exclusions will be published periodically in the notice section of the Federal Register and will be listed on the CDC Web site at http://www.cdc.gov/​.

(2) If an excluded attenuated strain is subjected to any manipulation that restores or enhances its virulence, the resulting overlap select agent or toxin will be subject to the requirements of this part.

(3) An individual or entity may make a written request to the HHS Secretary for reconsideration of a decision denying an exclusion application. The written request for reconsideration must state the facts and reasoning upon which the individual or entity relies to show the decision was incorrect. The HHS Secretary will grant or deny the request for reconsideration as promptly as circumstances allow and will state, in writing, the reasons for the decision.

(f) Any overlap select agent or toxin seized by a Federal law enforcement agency will be excluded from the requirements of this part during the period between seizure of the select agent or toxin and the transfer or destruction of such agent or toxin provided that:

(1) As soon as practicable, the Federal law enforcement agency transfers the seized select agent or toxin to an entity eligible to receive such agent or toxin or destroys the agent or toxin by a recognized sterilization or inactivation process,

(2) The Federal law enforcement agency safeguards and secures the seized select agent or toxin against theft, loss, or release, and reports any theft, loss, or release of such agent or toxin, and

(3) The Federal law enforcement agency reports the seizure of the overlap select agent or toxin to CDC or APHIS.

(i) The seizure of Bacillus anthracis, Botulinum neurotoxins, Brucella melitensis, Francisella tularensis, Hendra virus, Nipah virus, Rift Valley fever virus, or Venezuelan equine encephalitis virus must be reported within 24 hours by telephone, facsimile, or e-mail. This report must be followed by submission of APHIS/CDC Form 4 within seven calendar days after seizure of the select agent or toxin.

(ii) For all other overlap select agents or toxins, APHIS/CDC Form 4 must be submitted within seven calendar days after seizure of the select agent or toxin.

(iii) A copy of APHIS/CDC Form 4 must be maintained for three years.

(4) The Federal law enforcement agency reports the final disposition of the overlap select agent or toxin by the submission of APHIS/CDC Form 4. A copy of the completed form must be maintained for three years.

§ 73.5

Exemptions for HHS select agents and toxins.

(a) Clinical or diagnostic laboratories and other entities that possess, use, or transfer a HHS select agent or toxin that is contained in a specimen presented for diagnosis or verification will be exempt from the requirements of this part for such agent or toxin contained in the specimen, provided that:

(1) Unless directed otherwise by the HHS Secretary, within seven calendar days after identification, the select agent or toxin is transferred in accordance with § 73.16 or destroyed on-site by a recognized sterilization or inactivation process,

(2) The select agent or toxin is secured against theft, loss, or release during the period between identification of the select agent or toxin and transfer or destruction of such agent or toxin, and any theft, loss, or release of such agent or toxin is reported, and

(3) The identification of the select agent or toxin is reported to CDC or APHIS and to other appropriate authorities when required by Federal, State, or local law.

(i) The identification of any of the following HHS select agents or toxins must be immediately reported by telephone, facsimile, or e-mail: Ebola viruses, Lassa fever virus, Marburg virus, South American Haemorrhagic Fever viruses (Junin, Machupo, Sabia, Flexal, Guanarito), Variola major virus (Smallpox virus), Variola minor (Alastrim), or Yersinia pestis. This report must be followed by submission of APHIS/CDC Form 4 within seven calendar days after identification.

(ii) For all other HHS select agents or toxins, APHIS/CDC Form 4 must be submitted within seven calendar days after identification.

(iii) Less stringent reporting may be required based on extraordinary circumstances, such as a widespread outbreak.

(iv) A copy of APHIS/CDC Form 4 must be maintained for three years.

(b) Clinical or diagnostic laboratories and other entities that possess, use, or transfer a HHS select agent or toxin that is contained in a specimen presented for proficiency testing will be exempt from the requirements of this part for such agent or toxin contained in the specimen, provided that:

(1) Unless directed otherwise by the HHS Secretary, within 90 calendar days of receipt, the select agent or toxin is transferred in accordance with § 73.16 or destroyed on-site by a recognized sterilization or inactivation process,

(2) The select agent or toxin is secured against theft, loss, or release during the period between identification of the select agent or toxin and transfer or destruction of such agent or toxin, and the theft, loss, or release of such agent or toxin is reported, and

(3) The identification of the select agent or toxin, and its derivative, is reported to CDC or APHIS and to other appropriate authorities when required by Federal, State, or local law. To report the identification of a select agent or toxin, APHIS/CDC Form 4 must be submitted within 90 calendar days of receipt of the select agent or toxin. A copy of the completed form must be maintained for three years.

(c) Unless the HHS Secretary issues an order making specific provisions of this part applicable to protect public health and safety, products that are, bear, or contain listed select agents or toxins that are cleared, approved, licensed, or registered under any of the following laws, are exempt from the provisions of this part insofar as their use meets the requirements of such laws:

(1) The Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et seq.),

(2) Section 351 of the Public Health Service Act pertaining to biological products (42 U.S.C. 262),

(3) The Act commonly known as the Virus-Serum-Toxin Act (21 U.S.C. 151-159), or

(4) The Federal Insecticide, Fungicide, and Rodenticide Act (7 U.S.C. 136 et seq.).

(d) The HHS Secretary may exempt from the requirements of this part an investigational product that is, bears, or contains a select agent or toxin, when such product is being used in an investigation authorized under any Federal Act and additional regulation under this part is not necessary to protect public health and safety.

(1) To apply for an exemption, an individual or entity must submit a completed APHIS/CDC Form 5.

(2) The HHS Secretary shall make a determination regarding the application within 14 calendar days after receipt, provided the application meets all of the requirements of this section and the application establishes that the investigation has been authorized under the cited Act. A written decision granting or denying the request will be issued.

(3) The applicant must notify CDC or APHIS when an authorization for an investigation no longer exists. This exemption automatically terminates when such authorization is no longer in effect.

(e) The HHS Secretary may temporarily exempt an individual or entity from the requirements of this part based on a determination that the exemption is necessary to provide for the timely participation of the individual or entity in response to a domestic or foreign public health emergency. With respect to the emergency involved, the exemption may not exceed 30 calendar days, except that one extension of an additional 30 calendar days may be granted. To apply for an exemption or an extension of an exemption, an individual or entity must submit a completed APHIS/CDC Form 5 establishing the need to provide for the timely participation of the individual or entity in a response to a domestic or foreign public health emergency. A written decision granting or denying the request will be issued.

§ 73.6

Exemptions for overlap select agents and toxins.

(a) Clinical or diagnostic laboratories and other entities that possess, use, or transfer an overlap select agent or toxin that is contained in a specimen presented for diagnosis or verification will be exempt from the requirements of this part for such agent or toxin contained in the specimen, provided that:

(1) Unless directed otherwise by the HHS Secretary or Administrator, within seven calendar days after identification, the select agent or toxin is transferred in accordance with § 73.16 or 9 CFR part 121.16 or destroyed on-site by a recognized sterilization or inactivation process,

(2) The select agent or toxin is secured against theft, loss, or release during the period between identification of the select agent or toxin and transfer or destruction of such agent or toxin, and any theft, loss, or release of such agent or toxin is reported, and

(3) The identification of the select agent or toxin is reported to CDC or APHIS and to other appropriate authorities when required by Federal, State, or local law.

(i) The identification of any of the following overlap select agents or toxins must be immediately reported by telephone, facsimile, or e-mail: Bacillus anthracis, Botulinum neurotoxins, Brucella melitensis, Francisella tularensis, Hendra virus, Nipah virus, Rift Valley fever virus, or Venezuelan equine encephalitis virus. This report must be followed by submission of APHIS/CDC Form 4 within seven calendar days after identification.

(ii) For all other overlap select agents or toxins, APHIS/CDC Form 4 must be submitted within seven calendar days after identification.

(iii) Less stringent reporting may be required based on extraordinary circumstances, such as a widespread outbreak.

(iv) A copy of APHIS/CDC Form 4 must be maintained for three years.

(b) Clinical or diagnostic laboratories and other entities that possess, use, or transfer an overlap select agent or toxin that is contained in a specimen presented for proficiency testing will be exempt from the requirements of this part for such agent or toxin contained in the specimen, provided that:

(1) Unless directed otherwise by the HHS Secretary or Administrator, within 90 calendar days of receipt, the select agent or toxin is transferred in accordance with § 73.16 or 9 CFR part 121.16 or destroyed on-site by a recognized sterilization or inactivation process,

(2) The select agent or toxin is secured against theft, loss, or release during the period between identification of the select agent or toxin and transfer or destruction of such agent or toxin, and the theft, loss, or release of such agent or toxin is reported, and

(3) The identification of the select agent or toxin, and its derivative, is reported to CDC or APHIS and to other appropriate authorities when required by Federal, State, or local law. To report the identification of an overlap select agent or toxin, APHIS/CDC Form 4 must be submitted within 90 calendar days of receipt of the select agent or toxin. A copy of the completed form must be maintained for three years.

(c) Unless the HHS Secretary issues an order making specific provisions of this part applicable to protect public health and safety, products that are, bear, or contain listed select agents or toxins that are cleared, approved, licensed, or registered under any of the following laws, are exempt from the provisions of this part insofar as their use meets the requirements of such laws:

(1) The Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et seq.),

(2) Section 351 of the Public Health Service Act pertaining to biological products (42 U.S.C. 262),

(3) The Act commonly known as the Virus-Serum-Toxin Act (21 U.S.C. 151-159), or

(4) The Federal Insecticide, Fungicide, and Rodenticide Act (7 U.S.C. 136 et seq.).

(d) The HHS Secretary, after consultation with Administrator, may exempt from the requirements of this part an investigational product that is, bears, or contains an overlap select agent or toxin, may be exempted when such product is being used in an investigation authorized under any Federal Act and additional regulation under this part is not necessary to protect public health and safety.

(1) To apply for an exemption, an individual or entity must submit a completed APHIS/CDC Form 5.

(2) The HHS Secretary shall make a determination regarding the application within 14 calendar days after receipt, provided the application meets all of the requirements of this section and the application establishes that the investigation has been authorized under the cited Act. A written decision granting or denying the request will be issued.

(3) The applicant must notify CDC or APHIS when an authorization for an investigation no longer exists. This exemption automatically terminates when such authorization is no longer in effect.

(e) The HHS Secretary may temporarily exempt an individual or entity from the requirements of this part based on a determination that the exemption is necessary to provide for the timely participation of the individual or entity in response to a domestic or foreign public health emergency. With respect to the emergency involved, the exemption may not exceed 30 calendar days, except that one extension of an additional 30 calendar days may be granted. To apply for an exemption or an extension of an exemption, an individual or entity must submit a completed APHIS/CDC Form 5 establishing the need to provide for the timely participation of the individual or entity in a response to a domestic or foreign public health emergency. A written decision granting or denying the request will be issued.

(f) Upon request of the Administrator, the HHS Secretary may exempt an individual or entity from the requirements of this part, for 30 calendar days if the Administrator has granted the exemption for agricultural emergency. The HHS Secretary may extend the exemption once for an additional 30 calendar days.

§ 73.7

Registration and related security risk assessments.

(a) Unless exempted under § 73.5, an individual or entity shall not possess, use, or transfer any HHS select agent or toxin without a certificate of registration issued by the HHS Secretary. Unless exempted under § 73.6 or 9 CFR part 121.6, an individual or entity shall not possess, use, or transfer overlap select agents or toxins, without a certificate of registration issued by the HHS Secretary and Administrator.

(b) As a condition of registration, each entity must designate an individual to be its Responsible Official. While most registrants are likely to be entities, in the event that an individual applies for and is granted a certificate of registration, the individual will be considered the Responsible Official.

(c)(1) As a condition of registration, the following must be approved by the HHS Secretary or Administrator based on a security risk assessment by the Attorney General:

(i) The individual or entity,

(ii) The Responsible Official, and

(iii) Unless otherwise exempted under this section, any individual who owns or controls the entity.

(2) Federal, State, or local governmental agencies, including public accredited academic institutions, are exempt from the security risk assessments for the entity and the individual who owns or controls such entity.

(3) An individual will be deemed to own or control an entity under the following conditions: ^[1]

(i) For a private institution of higher education, an individual will be deemed to own or control the entity if the individual is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.

(ii) For entities other than institutions of higher education, an individual will be deemed to own or control the entity if the individual:

(A) Owns 50 percent or more of the entity, or is a holder or owner of 50 percent or more of its voting stock, or

(B) Is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.

(4) An entity will be considered to be an institution of higher education if it is an institution of higher education as defined in section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)), or is an organization described in 501(c)(3) of the Internal Revenue Code of 1986, as amended (26 U.S.C. 501(c)(3)).

(5) To obtain a security risk assessment, an individual or entity must submit the information necessary to conduct a security risk assessment to the Attorney General.

(d) To apply for a certificate of registration that covers only HHS select agents or toxins, an individual or entity must submit the information requested in the registration application package (APHIS/CDC Form 1) to CDC. To apply for a certificate of registration that does not cover only HHS select agents or toxins (i.e., covers at least one overlap select agent and/or toxin, or covers any combination of HHS select agents and/or toxins and USDA select agents and/or toxins), an individual or entity must submit the information requested in the registration application package (APHIS/CDC Form 1) to CDC or APHIS, but not both.

(e) Prior to the issuance of a certificate of registration, the Responsible Official must promptly provide notification of any changes to the application for registration by submitting the relevant page(s) of the registration application.

(f) The issuance of a certificate of registration may be contingent upon inspection or submission of additional information, such as the security plan, biosafety plan, incident response plan, or any other documents required to be prepared under this part.

(g) A certificate of registration will be valid for one physical location (a room, a building, or a group of buildings) where the Responsible Official will be able to perform the responsibilities required in this part, for specific select agents or toxins, and for specific activities.

(h) A certificate of registration may be amended to reflect changes in circumstances (e.g., replacement of the Responsible Official or other personnel changes, changes in ownership or control of the entity, changes in the activities involving any select agents or toxins, or the addition or removal of select agents or toxins).

(1) Prior to any change, the Responsible Official must apply for an amendment to a certificate of registration by submitting the relevant page(s) of the registration application.

(2) The Responsible Official will be notified in writing if an application to amend a certificate of registration has been approved. Approval of the amendment may be contingent upon an inspection or submission of additional information, such as the security plan, biosafety plan, incident response plan, or any other documents required to be prepared under this part.

(3) No change may be made without such approval.

(i) An entity must immediately notify CDC or APHIS if it loses the services of its Responsible Official. In the event that an entity loses the services of its Responsible Official, an entity may continue to possess or use select agents or toxins only if it appoints as the Responsible Official another individual who has been approved by the HHS Secretary or Administrator following a security risk assessment by the Attorney General and who meets the requirements of this part.

(j) A certificate of registration will be terminated upon the written request of the entity if the entity no longer possesses or uses any select agents or toxins and no longer wishes to be registered.

(k) A certificate of registration will be valid for a maximum of three years.

§ 73.8

Denial, revocation, or suspension of registration.

(a) An application may be denied or a certificate of registration revoked or suspended if:

(1) The individual or entity, the Responsible Official, or an individual who owns or controls the entity is within any of the categories described in 18 U.S.C. 175b,

(2) The individual or entity, the Responsible Official, or an individual who owns or controls the entity as reasonably suspected by any Federal law enforcement or intelligence agency of:

(i) Committing a crime specified in 18 U.S.C. 2332b(g)(5),

(ii) Knowing involvement with an organization that engages in domestic or international terrorism (as defined in 18 U.S.C. 2331) or with any other organization that engages in intentional crimes of violence, or

(iii) Being an agent of a foreign power (as defined in 50 U.S.C. 1801).

(3) The individual or entity does not meet the requirements of this part, or

(4) It is determined that such action is necessary to protect public health and safety.

(b) Upon revocation or suspension of a certificate of registration, the individual or entity must:

(1) Immediately stop all use of each select agent or toxin covered by the revocation or suspension order,

(2) Immediately safeguard and secure each select agent or toxin covered by the revocation or suspension order from theft, loss, or release, and

(3) Comply with all disposition instructions issued by the HHS Secretary for the select agent or toxin covered by the revocation or suspension.

(c) Denial of an application for registration and revocation of registration may be appealed under § 73.20. However, any denial of an application for registration or revocation of a certificate of registration will remain in effect until a final agency decision has been rendered.

§ 73.9

Responsible Official.

(a) An individual or entity required to register under this part must designate an individual to be the Responsible Official. The Responsible Official must:

(1) Be approved by the HHS Secretary or Administrator following a security risk assessment by the Attorney General,

(2) Be familiar with the requirements of this part,

(3) Have authority and responsibility to act on behalf of the entity,

(4) Ensure compliance with the requirements of this part, and

(5) Ensure that annual inspections are conducted for each laboratory where select agents or toxins are stored or used in order to determine compliance with the requirements of this part. The results of each inspection must be documented, and any deficiencies identified during an inspection must be corrected.

(b) An entity may designate one or more individuals to be an alternate Responsible Official, who may act for the Responsible Official in his/her absence. These individuals must have the authority and control to ensure compliance with the regulations when acting as the Responsible Official.

(c) The Responsible Official must report the identification and final disposition of any select agent or toxin contained in a specimen presented for diagnosis or verification.

(1) The identification of any of the following select agents or toxins must be immediately reported by telephone, facsimile, or e-mail: Bacillus anthracis, Botulinum neurotoxins, Brucella melitensis, Francisella tularensis, Ebola viruses, Hendra virus, Marburg virus, Lassa fever virus, Nipah virus, Rift Valley fever virus, South American Haemorrhagic Fever viruses (Junin, Machupo, Sabia, Flexal, Guanarito), Variola major virus (Smallpox virus), Variola minor (Alastrim), Venezuelan equine encephalitis virus, or Yersinia pestis. The final disposition of the agent or toxin must be reported by submission of APHIS/CDC Form 4 within seven calendar days after identification. A copy of the completed form must be maintained for three years.

(2) To report the identification and final disposition of any other select agent or toxin, APHIS/CDC Form 4 must be submitted within seven calendar days after identification. A copy of the completed form must be maintained for three years.

(3) Less stringent reporting may be required based on extraordinary circumstances, such as a widespread outbreak.

(d) The Responsible Official must report the identification and final disposition of any select agent or toxin contained in a specimen presented for proficiency testing. To report the identification and final disposition of a select agent or toxin, APHIS/CDC Form 4 must be submitted within 90 calendar days of receipt of the agent or toxin. A copy of the completed form must be maintained for three years.

§ 73.10

Restricting access to select agents and toxins; security risk assessments.

(a) An individual or entity required to register under this part may not provide an individual access to a select agent or toxin, and an individual may not access a select agent or toxin, unless the individual is approved by the HHS Secretary or Administrator, following a security risk assessment by the Attorney General.

(b) An individual will be deemed to have access at any point in time if the individual has possession of a select agent or toxin (e.g., ability to carry, use, or manipulate) or the ability to gain possession of a select agent or toxin.

(c) Each individual with access to select agents or toxins must have the appropriate education, training, and/or experience to handle or use such agents or toxins.

(d) To apply for access approval, each individual must submit the information necessary to conduct a security risk assessment to the Attorney General.

(e) An individual's security risk assessment may be expedited upon written request by the Responsible Official and a showing of good cause (e.g., public health or agricultural emergencies, national security, or a short term visit by a prominent researcher). A written decision granting or denying the request will be issued.

(f) An individual's access approval will be denied or revoked if the individual is within any of the categories described in 18 U.S.C. 175b,

(g) An individual's access approval may be denied, limited, or revoked if:

(1) The individual is reasonably suspected by any Federal law enforcement or intelligence agency of committing a crime specified in 18 U.S.C. 2332b(g)(5), knowing involvement with an organization that engages in domestic or international terrorism (as defined in 18 U.S.C. 2331) or with any other organization that engages in intentional crimes of violence, or being an agent of a foreign power (as defined in 50 U.S.C. 1801), or

(2) It is determined such action is necessary to protect public health and safety.

(h) An individual may appeal the HHS Secretary's decision to deny, limit, or revoke access approval under § 73.20.

(i) Access approval is valid for a maximum of five years.

(j) The Responsible Official must immediately notify CDC or APHIS when an individual's access to select agents or toxins is terminated by the entity and the reasons therefore.

§ 73.11

Security.

(a) An individual or entity required to register under this part must develop and implement a written security plan. The security plan must be sufficient to safeguard the select agent or toxin against unauthorized access, theft, loss, or release.

(b) The security plan must be designed according to a site-specific risk assessment and must provide graded protection in accordance with the risk of the select agent or toxin, given its intended use. The security plan must be submitted upon request.

(c) The security plan must:

(1) Describe procedures for physical security, inventory control, and information systems control,

(2) Contain provisions for the control of access to select agents and toxins,

(3) Contain provisions for routine cleaning, maintenance, and repairs,

(4) Establish procedures for removing unauthorized or suspicious persons,

(5) Describe procedures for addressing loss or compromise of keys, passwords, combinations, etc. and protocols for changing access numbers or locks following staff changes,

(6) Contain procedures for reporting unauthorized or suspicious persons or activities, loss or theft of select agents or toxins, release of select agents or toxins, or alteration of inventory records, and

(7) Contain provisions for ensuring that all individuals with access approval from the HHS Secretary or Administrator understand and comply with the security procedures.

(d) An individual or entity must adhere to the following security requirements or implement measures to achieve an equivalent or greater level of security:

(1) Allow access only to individuals with access approval from the HHS Secretary or Administrator,

(2) Allow individuals not approved for access from the HHS Secretary or Administrator to conduct routine cleaning, maintenance, repairs, or other activities not related to select agents or toxins only when continuously escorted by an approved individual,

(3) Provide for the control of select agents and toxins by requiring freezers, refrigerators, cabinets, and other containers where select agents or toxins are stored to be secured against unauthorized access (e.g., card access system, lock boxes),

(4) Inspect all suspicious packages before they are brought into or removed from the area where select agents or toxins are used or stored,

(5) Establish a protocol for intra-entity transfers under the supervision of an individual with access approval from the HHS Secretary or Administrator, including chain-of-custody documents and provisions for safeguarding against theft, loss, or release,

(6) Require that individuals with access approval from the HHS Secretary or Administrator refrain from sharing with any other person their unique means of accessing a select agent or toxin (e.g., keycards or passwords),

(7) Require that individuals with access approval from the HHS Secretary or Administrator immediately report any of the following to the Responsible Official:

(i) Any loss or compromise of keys, passwords, combination, etc.,

(ii) Any suspicious persons or activities,

(iii) Any loss or theft of select agents or toxins,

(iv) Any release of a select agent or toxin, and

(v) Any sign that inventory or use records for select agents or toxins have been altered or otherwise compromised, and

(8) Separate areas where select agents and toxins are stored or used from the public areas of the building.

(e) In developing a security plan, an entity or individual should consider, the document entitled “Laboratory Security and Emergency Response Guidance for Laboratories Working with Select Agents. Morbidity and Mortality Weekly Report December 6, 2002; 51:RR-19:1-6.” The document is available on the Internet at: http://www.cdc.gov/​mmwr.

(f) The plan must be reviewed annually and revised as necessary. Drills or exercises must be conducted at least annually to test and evaluate the effectiveness of the plan. The plan must be reviewed and revised, as necessary, after any drill or exercise and after any incident.

§ 73.12

Biosafety.

(a) An individual or entity required to register under this part must develop and implement a written biosafety plan that is commensurate with the risk of the agent or toxin, given its intended use. The biosafety plan must contain sufficient information and documentation to describe the biosafety and containment procedures.

(b) The biosafety and containment procedures must be sufficient to contain the select agent or toxin (e.g., physical structure and features of the entity, and operational and procedural safeguards).

(c) In developing a biosafety plan, an individual or entity should consider:

(1) The CDC/NIH publication, “Biosafety in Microbiological and Biomedical Laboratories”, including all appendices. Copies may be obtained from the Superintendent of Documents, U.S. Government Printing Office, Post Office Box 371954, Pittsburgh, Pennsylvania, 75250-7954 or from the CDC Web site at http://www.cdc.gov/​. Copies may be inspected at the Centers for Disease Control and Prevention, 1600 Clifton Road, Mail Stop E-79, Atlanta, Georgia.

(2) The Occupational Safety and Health Administration (OSHA) regulations in 29 CFR parts 1910.1200 and 1910.1450.

(3) The “NIH Guidelines for Research Involving Recombinant DNA Molecules,” (NIH Guidelines). Copies may be obtained from the Centers for Disease Control and Prevention, 1600 Clifton Road, Mail Stop E-79, Atlanta, Georgia, 30333 or from the CDC Web site at http://www.cdc.gov/​. Copies may be inspected at the Centers for Disease Control and Prevention, 1600 Clifton Road, Mail Stop E-79, Atlanta, Georgia.

(d) The plan must be reviewed annually and revised as necessary. Drills or exercises must be conducted at least annually to test and evaluate the effectiveness of the plan. The plan must be reviewed and revised, as necessary, after any drill or exercise and after any incident.

§ 73.13

Restricted experiments.

(a) An individual or entity may not conduct a restricted experiment with a HHS select agent or toxin unless approved by and conducted in accordance with any conditions prescribed by the HHS Secretary. In addition, an individual or entity may not conduct a restricted experiment with an overlap select agent or toxin unless approved by and conducted in accordance with any conditions prescribed by the HHS Secretary, after consultation with Administrator.

(b) Restricted experiments:

(1) Experiments utilizing recombinant DNA that involve the deliberate transfer of a drug resistance trait to select agents that are not known to acquire the trait naturally, if such acquisition could compromise the use of the drug to control disease agents in humans, veterinary medicine, or agriculture.

(2) Experiments involving the deliberate formation of recombinant DNA containing genes for the biosynthesis of select toxins lethal for vertebrates at an LD₅₀ < 100 ng/kg body weight.

(c) The HHS Secretary may revoke approval to conduct any of the experiments in paragraph (b) of this section, or revoke or suspend a certificate of registration, if the individual or entity fails to comply with the requirements of this part.

(d) To apply for approval to conduct any of the experiments in paragraph (a) of this section, an individual or entity must submit a written request and supporting scientific information. A written decision granting or denying the request will be issued.

§ 73.14

Incident response.

(a) An individual or entity required to register under this part must develop and implement a written incident response plan.^[2] The incident response plan must be coordinated with any entity-wide plans, kept in the workplace, and available to employees for review.

(b) The incident response plan must fully describe the entity's response procedures for the theft, loss, or release of a select agent or toxin, inventory discrepancies, security breaches (including information systems), severe weather and other natural disasters, workplace violence, bomb threats, suspicious packages, and emergencies such as fire, gas leak, explosion, power outage, etc. The response procedures must account for hazards associated with the select agent and toxin and appropriate actions to contain such select agent or toxin.

(c) The incident response plan must also contain the following information:

(1) The name and contact information (e.g., home and work) for the individual or entity (e.g., responsible official, alternate responsible official(s), biosafety officer, etc.),

(2) The name and contact information for the building owner and/or manager, where applicable,

(3) The name and contact information for tenant offices, where applicable,

(4) The name and contact information for the physical security official for the building, where applicable,

(5) Personnel roles and lines of authority and communication,

(6) Planning and coordination with local emergency responders,

(7) Procedures to be followed by employees performing rescue or medical duties,

(8) Emergency medical treatment and first aid,

(9) A list of personal protective and emergency equipment, and their locations,

(10) Site security and control,

(11) Procedures for emergency evacuation, including type of evacuation, exit route assignments, safe distances, and places of refuge, and

(12) Decontamination procedures.

(d) The plan must be reviewed annually and revised as necessary. Drills or exercises must be conducted at least annually to test and evaluate the effectiveness of the plan. The plan must be reviewed and revised, as necessary, after any drill or exercise and after any incident.

§ 73.15

Training.

(a) An individual or entity required to register under this part must provide information and training on biosafety and security to each individual with access approval from the HHS Secretary or Administrator before he/she has such access.^[3] In addition, an individual or entity must provide information and training on biosafety and security to each individual not approved for access from the HHS Secretary or Administrator before he/she works in or visits areas where select agents or toxins are handled or stored (e.g., laboratories, growth chambers, animal rooms, greenhouses, storage areas, etc.). The training must address the particular needs of the individual, the work they will do, and the risks posed by the select agents or toxins.

(b) Refresher training must be provided annually.

(c) A record of the training provided to each individual must be maintained. The record must include the name of the individual, the date of the training, a description of the training provided, and the means used to verify that the employee understood the training.

§ 73.16

Transfers.

(a) Except as provided in paragraphs (c) and (d) of this section, a select agent or toxin may only be transferred to individuals or entities registered to possess, use, or transfer that agent or toxin. A select agent or toxin may only be transferred under the conditions of this section and must be authorized by CDC or APHIS prior to the transfer.^[4]

(b) A transfer may be authorized if:

(1) The sender:

(i) Has at the time of transfer a certificate of registration that covers the particular select agent or toxin to be transferred and meets all requirements in this part,

(ii) Meets the exemption requirements for the particular select agent or toxin to be transferred, or

(iii) Is transferring the select agent or toxin from outside the United States and meets all import requirements.

(2) At the time of transfer, the recipient has a certificate of registration that includes the particular select agent or toxin to be transferred and meets all of the requirements of this part.

(c) A select agent or toxin that is contained in a specimen for proficiency testing may be transferred without prior authorization from CDC or APHIS provided that, at least seven calendar days prior to the transfer, the sender reports to CDC or APHIS the select agent or toxin to be transferred and the name and address of the recipient.

(d) On a case-by-case basis, the HHS Secretary may authorize a transfer of a select agent or toxin, not otherwise eligible for transfer under this part under conditions prescribed by the HHS Secretary.

(e) To obtain authorization for transfer, APHIS/CDC Form 2 must be submitted.

(f) The recipient must submit a completed APHIS/CDC Form 2 within two business days of receipt of a select agent or toxin.

(g) The recipient must immediately notify CDC or APHIS if the select agent or toxin has not been received within 48 hours after the expected delivery time, or if the package containing select agents or toxins has been damaged to the extent that a release of the select agent or toxin may have occurred.

(h) An authorization for a transfer shall be valid only for 30 calendar days after issuance, except that such an authorization becomes immediately null and void if any facts supporting the authorization change (e.g., change in the certificate of registration for the sender or recipient, change in the application for transfer).

(i) The sender must comply with all applicable laws concerning packaging and shipping.

§ 73.17

Records.

(a) An individual or entity required to register under this part must maintain complete records relating to the activities covered by this part. Such records must include:

(1) Accurate, current inventory for each select agent (including viral genetic elements, recombinant nucleic acids, and recombinant organisms) held in long-term storage (placement in a system designed to ensure viability for future use, such as in a freezer or lyophilized materials), including:

(i) The name and characteristics (e.g., strain designation, GenBank Accession number, etc.),

(ii) The quantity acquired from another individual or entity (e.g., containers, vials, tubes, etc.), date of acquisition, and the source,

(iii) Where stored (e.g., building, room, and freezer),

(iv) When moved from storage and by whom and when returned to storage and by whom,

(v) The select agent used and purpose of use,

(vi) Records created under § 73.16 and 9 CFR 121.16 (Transfers),

(vii) For intra-entity transfers (sender and the recipient are covered by the same certificate of registration), the select agent, the quantity transferred, the date of transfer, the sender, and the recipient, and

(viii) Records created under § 73.19 and 9 CFR part 121.19 (Notification of theft, loss, or release),

(2) Accurate, current inventory for each toxin held, including:

(i) The name and characteristics,

(ii) The quantity acquired from another individual or entity (e.g., containers, vials, tubes, etc.), date of acquisition, and the source,

(iii) The initial and current quantity amount (e.g., milligrams, milliliters, grams, etc.),

(iv) The toxin used and purpose of use, quantity, date(s) of the use and by whom,

(v) Where stored (e.g., building, room, and freezer),

(vi) When moved from storage and by whom and when returned to storage and by whom including quantity amount,

(vii) Records created under § 73.16 and 9 CFR part 121.16 (Transfers),

(viii) For intra-entity transfers (sender and the recipient are covered by the same certificate of registration), the toxin, the quantity transferred, the date of transfer, the sender, and the recipient,

(ix) Records created under § 73.19 and 9 CFR part 121.19 (Notification of theft, loss, or release), and

(x) If destroyed, the quantity of toxin destroyed, the date of such action, and by whom,

(3) A current list of all individuals that have been granted access approval from the HHS Secretary or Administrator,

(4) Information about all entries into areas containing select agents or toxins, including the name of the individual, name of the escort (if applicable), and date and time of entry,

(5) Accurate, current records created under § 73.9 and 9 CFR part 121.9 (Responsible Official), § 73.11 and 9 CFR part 121.11 (Security), § 73.12 and 9 CFR part 121.12 (Biosafety), § 73.14 and 9 CFR part 121. 14 (Incident response), and § 73.15 and 9 CFR part 121.15 (Training), and

(6) A written explanation of any discrepancies.

(b) The individual or entity must implement a system to ensure that all records and data bases created under this part are accurate, have controlled access, and that their authenticity may be verified.

(c) All records created under this part must be maintained for three years and promptly produced upon request.

§ 73.18

Inspections.

(a) Without prior notification, the HHS Secretary, shall be allowed to inspect any site at which activities regulated by this part are conducted and shall be allowed to inspect and copy any records relating to the activities covered by this part.

(b) Prior to issuing a certificate of registration to an individual or entity, the HHS Secretary may inspect and evaluate the premises and records to ensure compliance with this part.

§ 73.19

Notification of theft, loss, or release.

(a) Upon discovery of the theft or loss of a select agent or toxin, an individual or entity must immediately notify CDC or APHIS and appropriate Federal, State, or local law enforcement agencies. Thefts or losses must be reported even if the select agent or toxin is subsequently recovered or the responsible parties are identified.

(1) The theft or loss of a select agent or toxin must be reported immediately by telephone, facsimile, or e-mail. The following information must be provided:

(i) The name of the select agent or toxin and any identifying information (e.g., strain or other characterization information),

(ii) An estimate of the quantity lost or stolen,

(iii) An estimate of the time during which the theft or loss occurred,

(iv) The location (building, room) from which the theft or loss occurred, and

(v) The list of Federal, State, or local law enforcement agencies to which the individual or entity reported, or intends to report the theft or loss.

(2) A completed APHIS/CDC Form 3 must submitted within seven calendar days.

(b) Upon discovery of a release of an agent or toxin causing occupational exposure or release of a select agent or toxin outside of the primary barriers of the biocontainment area, an individual or entity must immediately notify CDC or APHIS.

(1) The release of a select agent or toxin must be reported by telephone, facsimile, or e-mail. The following information must be provided:

(i) The name of the select agent or toxin and any identifying information (e.g., strain or other characterization information),

(ii) An estimate of the quantity released,

(iii) The time and duration of the release,

(iv) The environment into which the release occurred (e.g., in building or outside of building, waste system),

(v) The location (building, room) from which the release occurred,

(vi) The number of individuals potentially exposed at the entity,

(vii) Actions taken to respond to the release, and

(viii) Hazards posed by the release.

(2) A completed APHIS/CDC Form 3 must be submitted within seven calendar days.

§ 73.20

Administrative review.

An individual or entity may appeal a denial, revocation, or suspension of registration under this part. An individual may appeal a denial, limitation, or revocation of access approval under this part. The appeal must be in writing, state the factual basis for the appeal, and be submitted to the HHS Secretary within 30 calendar days of the decision. Where the denial, revocation, or suspension of registration or the denial, limitation, or revocation of an individual's access approval is based upon an identification by the Attorney General, the request for review will be forwarded to the Attorney General. The HHS Secretary's decision constitutes final agency action.

§ 73.21

Civil money penalties.

(a) The Inspector General of the Department of Health and Human Services is delegated authority to conduct investigations and to impose civil money penalties against any individual or entity in accordance with regulations in 42 CFR part 1003 for violations of the regulations in this part, as authorized by the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Pub. L. 107-188). The delegation of authority includes all powers contained in section 6 of the Inspector General Act of 1978 (5 U.S.C. App.).

(b) The administrative law judges in, assigned to, or detailed to the Departmental Appeals Board have been delegated authority to conduct hearings and to render decisions in accordance with 42 CFR part 1005 with respect to the imposition of civil money penalties, as authorized by the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Pub. L. 107-188). This delegation includes, but is not limited to, the authority to administer oaths and affirmations, to subpoena witnesses and documents, to examine witnesses, to exclude or receive and give appropriate weight to materials and testimony offered as evidence, to make findings of fact and conclusions of law, and to determine the civil money penalties to be imposed.

(c) The Departmental Appeals Board of the Department of Health and Human Services is delegated authority to make final determinations with respect to the imposition of civil money penalties for violations of the regulations of this part.

42 CFR Chapter V—Office of Inspector General—Health Care, Department of Health and Human Services

PART 1003—CIVIL MONEY PENALTIES, ASSESSMENTS AND EXCLUSIONS

1. The authority citation for part 1003 continues to read as follows:

Authority: 42 U.S.C. 262a, 1302, 1320-7,1320a-7a, 1320b-10, 1395u(j), 1395u(k), 1395cc(j), 1395dd(d)(1), 1395mm, 1395nn(g), 1395ss(d), 1396b(m), 11131(c), and 11137(b)(2).

2. Section 1003.106 is amended by revising introductory paragraph (a)(1) to read as follows:

§ 1003.106

Determinations regarding the amount of the penalty and assessment.

(a) Amount of penalty. (1) In determining the amount of any penalty or assessment in accordance with § 1003.102(a), (b)(1), (b)(4), and (b)(9) through (b)(16) of this part, the Department will take into account—

* * * * *

Footnotes

1.  These conditions may apply to more than one individual.

2.  Other requirements described as contributing significantly to costs include recordkeeping, additional staff, and cyber/information security and training.

3.  First, the final rule eliminates an interim final rule provision (along with the associated costs) requiring laboratories to notify the HHS Secretary when destroying select agents or toxins for the purpose of discontinuing activities with the select agent or toxin. Second, the final rule adds a provision that laboratories test and evaluate the effectiveness of their biosafety, security, and incident response plans annually.

4.  Costs are annualized over 20 years at a 7 percent discount rate.

5.  First, the final rule eliminates an interim final rule provision (along with the associated costs) requiring laboratories to notify the HHS Secretary when destroying select agents or toxins for the purpose of discontinuing activities with the select agent or toxin. Second, the final rule adds a provision that laboratories test and evaluate the effectiveness of their biosafety, security, and incident response plans annually.

1.  These conditions may apply to more than one individual.

2.  Nothing in this section is meant to supersede or preempt incident response requirements imposed by other statutes or regulations.

3.  The training need not duplicate training provided under the OSHA Bloodborne Pathogen Standard set forth at 29 CFR 1910.1030.

4.  This section does not cover transfers within an entity when the sender and the recipient are covered by the same certificate of registration.