2016-31426. Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act

AGENCY:

Environmental Protection Agency (EPA).

ACTION:

Final rule.

SUMMARY:

The Environmental Protection Agency (EPA), in response to Executive Order 13650, is amending its Risk Management Program regulations. The revisions contain several changes to the accident prevention program requirements including an additional analysis of safer technology and alternatives as part of the process hazard analysis for some Program 3 processes, third-party audits and incident investigation root cause analysis for Program 2 and Program 3 processes; enhancements to the emergency preparedness requirements; increased public availability of chemical hazard information; and several other changes to certain regulatory definitions and data elements submitted in risk management plans. These amendments seek to improve chemical process safety, assist local emergency authorities in planning for and responding to accidents, and improve public awareness of chemical hazards at regulated sources.

DATES:

This final rule is effective on March 14, 2017.

ADDRESSES:

The EPA has established a docket for this action under Docket ID No. EPA-HQ-OEM-2015-0725. All documents in the docket are listed on the http://www.regulations.gov Web site. Although listed in the index, some information is not publicly available, e.g., Confidential Business Information (CBI) or other information whose disclosure is restricted by statute. Certain other material, such as copyrighted material, is not placed on the Internet and will be publicly available only in hard copy form. Publicly available docket materials are available electronically through http://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT:

James Belke, United States Environmental Protection Agency, Office of Land and Emergency Management, 1200 Pennsylvania Ave. NW., (Mail Code 5104A), Washington, DC 20460; telephone number: [phone]; email address: [e-mail], or: Kathy Franklin, United States Environmental Protection Agency, Office of Land and Emergency Management, 1200 Pennsylvania Ave. NW., (Mail Code 5104A), Washington, DC, 20460; telephone number: [phone]; email address: [e-mail].

Electronic copies of this document and related news releases are available on EPA's Web site at http://www.epa.gov/​rmp. Copies of this final rule are also available at http://www.regulations.gov.

SUPPLEMENTARY INFORMATION:

The contents of this preamble are:

I. General Information

A. Executive Summary

B. Does this action apply to me?

II. Background

A. Events Leading to This Action

B. Overview of EPA's Risk Management Program Regulations

III. Additional Information

A. Agency's Authority for Taking This Action

B. List of Regulated Substances

IV. Prevention Program Requirements

A. Incident Investigation and Accident History Requirements

B. Third-Party Audits

C. Safer Technology and Alternatives Analysis (STAA)

D. Stationary Source Location and Emergency Shutdown

V. Emergency Response Preparedness Requirements

A. Emergency Response Program Coordination With Local Responders

B. Facility Exercises

VI. Information Availability Requirements

A. Disclosure Requirements to LEPCs or Emergency Response Officials

B. Information Availability to the Public

C. Public Meetings

VII. Risk Management Plan Streamlining, Clarifications, and RMP Rule Technical Corrections

A. Revisions to § 68.160 (Registration)

B. Revisions to § 68.170 (Prevention Program/Program 2)

C. Revisions to § 68.175 (Prevention Program/Program 3)

D. Revisions to § 68.180 (Emergency Response Program)

E. Technical Corrections

VIII. Compliance Dates

A. Summary of Proposed Rulemaking

B. Summary of Final Rule

C. Discussion of Comments

D. Compliance Date Examples

IX. Statutory and Executive Order Reviews

A. Executive Order 12866: Regulatory Planning and Review and Executive Order 13563: Improving Regulation and Regulatory Review

B. Paperwork Reduction Act (PRA)

C. Regulatory Flexibility Act (RFA)

D. Unfunded Mandates Reform Act (UMRA)

E. Executive Order 13132: Federalism

F. Executive Order 13175: Consultation and Coordination With Indian Tribal Governments

G. Executive Order 13045: Protection of Children From Environmental Health Risks and Safety Risks

H. Executive Order 13211: Actions That Significantly Affect Energy Supply, Distribution or Use

I. National Technology Transfer and Advancement Act (NTTAA)

J. Executive Order 12898: Federal Actions To Address Environmental Justice in Minority Populations and Low-Income Populations

K. Congressional Review Act (CRA)

I. General Information

A. Executive Summary

1. Purpose of the Regulatory Action

The purpose of this action is to improve safety at facilities that use and distribute hazardous chemicals. In response to catastrophic chemical facility incidents in the United States, including the explosion that occurred at the West Fertilizer facility in West, Texas, on April 17, 2013 that killed 15 people (on May 11, 2016, ATF ruled that the fire was intentionally set.) ^[1] President Obama issued Executive Order 13650, “Improving Chemical Facility Safety and Security,” on August 1, 2013.^[2]

Section 6(a)(i) of Executive Order 13650 requires that various Federal agencies develop options for improved chemical facility safety and security that identify “improvements to existing risk management practices through agency programs, private sector initiatives, Government guidance, outreach, standards, and regulations.” One existing agency program is the Risk Management Program implemented by EPA under section 112(r) of the Clean Air Act (CAA) (42 U.S.C. 7412(r)). Section 6(c) of Executive Order 13650 requires the Administrator of EPA to review the chemical hazards covered by the Risk Management Program and expand, implement and enforce the Risk Management Program to address any additional hazards.

EPA proposed changes to its Risk Management Program regulations (40 CFR part 68) on March 14, 2016 (81 FR 13637) after publishing a “Request for Information” notice or “RFI” that solicited comments and information from the public regarding potential changes to the Risk Management Program regulations (July 31, 2014, 79 FR 44604). While developing the proposed rulemaking, EPA convened a Small Business Advocacy Review (SBAR) panel to receive input from Small Entity Representatives (SERs). EPA also hosted a public hearing on March 29, 2016 to provide interested parties the opportunity to present data, views or arguments concerning the proposed action.

The Risk Management Program regulations have been effective in preventing and mitigating chemical accidents in the United States. However, EPA believes that revisions could further protect human health and the environment from chemical hazards through advancement of process safety management based on lessons learned.

2. Summary of the Major Provisions of the Regulatory Action

This action amends EPA's Risk Management Program regulations at 40 CFR part 68. These regulations apply to stationary sources (also referred to as “facilities”) that hold specific “regulated substances” in excess of threshold quantities. These facilities are required to assess their potential release impacts, undertake steps to prevent releases, plan for emergency response to releases, and summarize this information in a risk management plan (RMP) submitted to EPA. The release prevention steps vary depending on the type of process, but progressively gain granularity and rigor over three program levels (i.e., Program 1, Program 2, and Program 3).

The major provisions of this rule include several changes to the accident prevention program requirements, as well as enhancements to the emergency response requirements, and improvements to the public availability of chemical hazard information. Each of these revisions is introduced in the following paragraphs of this section and described in greater detail in sections IV through VI, later in this preamble.

Certain revised provisions would apply to a subset of the processes based on program levels described in 40 CFR part 68 (or in one case, to a subset of processes within a program level). A full description of these program levels is provided in section II of this preamble.

a. Accident Prevention Program Revisions

This action includes three changes to the accident prevention program requirements. First, the rule requires all facilities with Program 2 or 3 processes to conduct a root cause analysis as part of an incident investigation of a catastrophic release or an incident that could have reasonably resulted in a catastrophic release (i.e., a near-miss). This provision is intended to reduce the number of chemical accidents by requiring facilities to identify the underlying causes of an incident so that they may be addressed. Identifying the root causes, rather than isolating and correcting solely the immediate cause of the incident, will help prevent similar incidents at other locations, and will yield the maximum benefit or lessons learned from the incident investigation.

Second, the rule requires regulated facilities with Program 2 or 3 processes to contract with an independent third-party, or assemble an audit team led by an independent third-party, to perform a compliance audit after the facility has an RMP reportable accident. Compliance audits are required under the existing rule, but are allowed to be self-audits (i.e., performed by the owner or operator of the regulated facility). This provision is intended to reduce the risk of future accidents by requiring an objective auditing process to determine whether the owner or operator of the facility is effectively complying with the accident prevention procedures and practices required under 40 CFR part 68.

The third revision to the prevention program adds an element to the process hazard analysis (PHA), which is updated every five years. Specifically, owners or operators of facilities with Program 3 regulated processes in North American Industrial Classification System (NAICS) codes 322 (paper manufacturing), 324 (petroleum and coal products manufacturing), and 325 (chemical manufacturing) are required to conduct a safer technology and alternatives analysis (STAA) as part of their PHA, and to evaluate the practicability of any inherently safer technology (IST) identified. The current PHA requirements include consideration of active, passive, and procedural measures to control hazards. These revisions support the analysis of those measures and adds consideration of IST alternatives. The provision is intended to reduce the risk of serious accidental releases by requiring facilities in these sectors to conduct a careful examination of potentially safer technology and designs that they could implement in lieu of, or in addition to, their current technologies.

b. Emergency Response Enhancements

This action also enhances the rule's emergency response requirements. Owners or operators of all facilities with Program 2 or 3 processes are required to coordinate with the local emergency response agencies at least once a year to determine how the source is addressed in the community emergency response plan and to ensure that local response organizations are aware of the regulated substances at the source, their quantities, the risks presented by covered processes, and the resources and capabilities at the facility to respond to an accidental release of a regulated substance.

Additionally, all facilities with Program 2 or 3 processes are required to conduct notification exercises annually to ensure that their emergency contact information is accurate and complete. This provision is intended to reduce the impact of accidents by ensuring that appropriate mechanisms and processes are in place to notify local responders when an accident occurs. One of the factors that can contribute to the severity of chemical accidents is a lack of effective coordination between a facility and local emergency responders. Increasing such coordination and establishing appropriate emergency response procedures can help reduce the effects of accidents.

This action also requires that all facilities subject to the emergency response program requirements of subpart E of the rule (or “responding facilities”) conduct field exercises and tabletop exercises. The frequency of these exercises shall be established in consultation with local emergency response officials, but at a minimum, full field exercises will be conducted at least once every ten years and tabletop exercises conducted at least once every three years. Responding facilities that have an RMP reportable accident, and document the response activities in an after-action report comparable to the exercise evaluation reports may use that response to satisfy the field exercise requirements. Furthermore, owner and operators of responding facilities that conduct exercises to meet other Federal, state or local exercise requirements may satisfy the RMP exercise requirements provided that the scope of the exercise includes the objectives of an RMP exercise. The purpose of this provision is to reduce the impact of accidents by ensuring that emergency response personnel understand their roles in the event of an incident, that local responders are familiar with the hazards at a facility, and that the emergency response plan is up-to-date. Improved coordination with emergency response personnel will better prepare responders to respond effectively to an incident and take steps to notify the community of appropriate actions, such as shelter-in-place or evacuation.

c. Enhanced Availability of Information

This action includes various enhancements to the public availability of chemical hazard information. The rule requires all facilities to provide certain basic information to the public, upon request. The owner or operator of the facility shall provide ongoing notification of availability of information elements on a company Web site, social media platforms, or through some other publicly accessible means. The rule also requires all facilities to hold a public meeting for the local community within 90 days of an RMP reportable accident. This provision will ensure that first responders and members of the community have easier access to appropriate facility chemical hazard information, which can significantly improve emergency preparedness and their understanding of how the facility is addressing potential risks.

EPA proposed requirements for facilities to provide certain information to the Local Emergency Planning Committee (LEPC), Tribal Emergency Planning Committee (TEPC)^[3] or other local emergency response agencies. However, rather than prescribe information elements that must be provided upon request, EPA is requiring the owner or operator of a stationary source to share information that is relevant to emergency response planning as part of the coordination activities that occur annually between facility representatives and local emergency response agencies.

In addition to the major provisions described previously in this section, this action discusses comments received on other aspects of the proposed action including revisions to the list of regulated substances, location of stationary sources (related to their proximity to public receptors), requirements for emergency shutdown systems, compliance dates, technical corrections and revisions to the RMP requirements.

3. Costs and Benefits

a. Summary of Potential Costs

Approximately 12,500 facilities have filed current RMPs with EPA and are potentially affected by the revised rule. These facilities range from petroleum refineries and large chemical manufacturers to water and wastewater treatment systems; chemical and petroleum wholesalers and terminals; food manufacturers, packing plants, and other cold storage facilities with ammonia refrigeration systems; agricultural chemical distributors; midstream gas plants; and a limited number of other sources, including Federal installations that use RMP-regulated substances.

Table 1 presents the number of facilities according to the latest RMP reporting as of February 2015 by industrial sector and chemical use.

Table 1—Number of Affected Facilities by Sector

Sector	NAICS codes	Total facilities	Chemical uses
Administration of environmental quality programs (i.e., governments)	924	1,923	Use chlorine and other chemicals for treatment.
Agricultural chemical distributors/wholesalers	111, 112, 115, 42491	3,667	Store ammonia for sale; some in NAICS 111 and 115 use ammonia as a refrigerant.
Chemical manufacturing	325	1,466	Manufacture, process, store.
Chemical wholesalers	4246	333	Store for sale.
Food and beverage manufacturing	311, 312	1,476	Use—mostly ammonia as a refrigerant.
Oil and gas extraction	211	741	Intermediate processing (mostly regulated flammable substances and flammable mixtures).
Other	44, 45, 48, 54, 56, 61, 72	247	Use chemicals for wastewater treatment, refrigeration, store chemicals for sale.
Other manufacturing	313, 326, 327, 33	384	Use various chemicals in manufacturing process, waste treatment.
Other wholesale	423, 424	302	Use (mostly ammonia as a refrigerant).
Paper manufacturing	322	70	Use various chemicals in pulp and paper manufacturing.
Petroleum and coal products manufacturing	324	156	Manufacture, process, store (mostly regulated flammable substances and flammable mixtures).
Petroleum wholesalers	4247	276	Store for sale (mostly regulated flammable substances and flammable mixtures).
Utilities	221	445	Use chlorine (mostly for water treatment) and other chemicals.
Warehousing and storage	493	1,056	Use mostly ammonia as a refrigerant.
Total		12,542

Table 2 presents a summary of the annualized costs estimated in the regulatory impact analysis.^[4] In total, EPA estimates annualized costs of $131.2 million at a 3% discount rate and $131.8 million at a 7% discount rate.

Table 2—Summary of Annualized Costs

[Millions, 2015 dollars]

Provision	3 (percent)	7 (percent)
Third-party Audits	$9.8	$9.8
Incident Investigation/Root Cause	1.8	1.8
STAA	70.0	70.0
Coordination	16.0	16.0
Notification Exercises	1.4	1.4
Facility Exercises	24.7	24.7
Information Sharing with the Public	3.1	3.1
Public Meeting	0.4	0.4
Rule Familiarization	3.9	4.6
Total Cost *	131.2	131.8
* Totals may not sum due to rounding.

The largest average annual cost of the final rule is the STAA costs ($70.0 million), followed by the exercise costs ($24.7 million), coordination ($16 million), and third-party audits ($9.8 million). The remaining provisions impose average annual costs under $5 million each, including rule familiarization ($3.9-4.6 million), information sharing with the public ($3.1 million), incident investigation/root cause analysis ($1.8 million), notification exercises ($1.4 million), and public meetings ($0.4 million).

b. Summary of Potential Benefits

EPA anticipates that promulgation and implementation of this rule would result in a reduction of the frequency and magnitude of damages from releases. Accidents and releases from RMP facilities occur every year, causing fires and explosions; damage to property; acute and chronic exposures of workers and nearby residents to hazardous materials; and resulting in serious injuries and death. Although we are unable to quantify what specific reductions may occur as a result of these revisions, we are able to present data on the total damages that currently occur at RMP facilities each year. The data presented is based on a 10-year baseline period, summarizing RMP accident impacts and, when possible, monetizing them. EPA expects that some portion of future damages would be prevented through implementation of this final rule. Table 3 presents a summary of the quantified damages identified in the analysis.

Table 3—Summary of Quantified Damages

[Millions, 2015 dollars]

	Unit value	10-year total	Average/year	Average/accident
On-site
Fatalities	$8.6	$497.8	$49.8	$0.33
Injuries	0.05	105.2	10.5	0.69
Property Damage		2,054.9	205.5	1.4
On-site Total		2,657.9	265.8	1.8
Offsite
Fatalities	8.6	8.6	0.86	0.01
Hospitalizations	0.4	6.8	0.68	0.004
Medical Treatment	0.001	14.8	1.5	0.01
Evacuations *	0.0	7.0	0.70	0.004
Sheltering in Place *	0.0	40.9	4.1	0.03
Property Damage		11.4	1.1	0.007
Offsite Total		89.5	8.9	0.06
Total		2,747.3	274.7	1.8
* The unit value for evacuations is less than two hundred dollars and for sheltering in place is less than one hundred dollars so when expressed in rounded millions the value represented in the table is zero.

EPA monetized both on-site and offsite damages. EPA estimated total average annual on-site damages of $265.8 million. The largest monetized average annual on-site damage was on-site property damage, which resulted in average annual damage of approximately $205.5 million. The next largest impact was on-site fatalities ($49.8 million) and injuries ($10.5 million).

EPA estimated total average annual offsite damages of $8.9 million. The largest monetized average annual offsite damage was from sheltering in place ($4.1 million), followed by medical treatment ($1.5 million), property damage ($1.1 million), fatalities ($0.86 million), evacuations ($0.7 million), and hospitalizations ($0.68 million).

In total, EPA estimated monetized damages from RMP facility accidents of $274.7 million per year. The 10-year RMP baseline suggests that considering only the monetized impacts of RMP accidents would mean that the rule's costs may outweigh the portion of avoided impacts from improved prevention and mitigation that were monetized. The annualized cost of the final rule (approximately $142 million annually) is approximately 52% of the average annual monetized costs in the 10-year baseline. However, the monetized impacts omit many important categories of accident impacts including lost productivity, the costs of emergency response, transaction costs, property value impacts in the surrounding community (that overlap with other benefit categories), and environmental impacts. Also not reflected in the 10-year baseline costs are the impacts of non-RMP accidents at RMP facilities and any potential impacts of rare high consequence catastrophes. A final omission is related to the information provision. Reducing the probability of chemical accidents and the severity of their impacts, and improving information disclosure by chemical facilities, as the provisions intend, would provide benefits to potentially affected members of society.

Table 4 summarizes four broad social benefit categories related to accident prevention and mitigation including prevention of RMP accidents, mitigation of RMP accidents, prevention and mitigation of non-RMP accidents at RMP facilities, and prevention of major catastrophes. The table explains each and identifies ten associated specific benefit categories, ranging from avoided fatalities to avoided emergency response costs. Table 4 also highlights and explains the information disclosure benefit category and identifies two specific benefits associated with it: Improved efficiency of property markets and allocation of emergency resources.

When considering the rule's likely benefits that are due to avoiding some portion of the monetized accident impacts, as well as the additional non-monetized benefits described previously, EPA believes the costs of the rule are reasonable in comparison to its benefits.

Table 4—Summary of Social Benefits of Final Rule Provisions

Broad benefit category	Explanation	Specific benefit categories
Accident Prevention	Prevention of future RMP facility accidents	• Reduced Fatalities.
Accident Mitigation	Mitigation of future RMP facility accidents	• Reduced Injuries.
Non-RMP accident prevention and mitigation	Prevention and mitigation of future non-RMP accidents at RMP facilities	• Reduced Property Damage. • Fewer People Sheltered in Place.
Avoided Catastrophes	Prevention of rare but extremely high consequence events	• Fewer Evacuations. • Avoided Lost Productivity. • Avoided Emergency Response Costs. • Avoided Transaction Costs. • Avoided Property Value Impacts.* • Avoided Environmental Impacts.
Information Disclosure	Provision of information to the public	• Improved efficiency of property markets.
		• Improved emergency response resource allocation.
* These impacts partially overlap with several other categories such as reduced health and environmental impacts.

B. Does this action apply to me?

This rule applies to those facilities (referred to as “stationary sources” under the CAA) that are subject to the chemical accident prevention requirements at 40 CFR part 68. This includes stationary sources holding more than a threshold quantity (TQ) of a regulated substance in a process. Table 5 provides industrial sectors and the associated NAICS codes for entities potentially affected by this action. The Agency's goal is to provide a guide for readers to consider regarding entities that potentially could be affected by this action. However, this action may affect other entities not listed in this table. If you have questions regarding the applicability of this action to a particular entity, consult the person(s) listed in the introductory section of this action under the heading entitled FOR FURTHER INFORMATION CONTACT.

Table 5—Industrial Sectors and Associated NAICS Codes for Entities Potentially Affected by This Action

Sector	NAICS code
Administration of Environmental Quality Programs	924.
Agricultural Chemical Distributors:
Crop Production	111.
Animal Production and Aquaculture	112.
Support Activities for Agriculture and Forestry Farm	115.
Supplies Merchant Wholesalers	42491.
Chemical Manufacturing	325.
Chemical and Allied Products Merchant Wholesalers	4246.
Food Manufacturing	311.
Beverage Manufacturing	3121.
Oil and Gas Extraction	211.
Other 5	44, 45, 48, 54, 56, 61, 72.
Other manufacturing	313, 326, 327, 33.
Other Wholesale:
Merchant Wholesalers, Durable Goods	423.
Merchant Wholesalers, Nondurable Goods	424.
Paper Manufacturing	322.
Petroleum and Coal Products Manufacturing	324.
Petroleum and Petroleum Products Merchant Wholesalers	4247.
Utilities	221.
Warehousing and Storage	493.

II. Background

A. Events Leading to This Action

Recent catastrophic chemical facility incidents in the United States prompted President Obama to issue Executive Order 13650, “Improving Chemical Facility Safety and Security,” on August 1, 2013.^[6] The purpose of the Executive Order is to enhance the safety and security of chemical facilities and reduce risks associated with hazardous chemicals to owners and operators, workers, and communities. The Executive Order establishes the Chemical Facility Safety and Security Working Group (“Working Group”), co-chaired by the Secretary of Homeland Security, the Administrator of EPA, and the Secretary of Labor or their designated representatives at the Assistant Secretary level or higher, and composed of senior representatives of other Federal departments, agencies, and offices. The Executive Order requires the Working Group to carry out a number of tasks whose overall aim is to prevent chemical accidents. In addition to the tragedy at the West Fertilizer facility in West, Texas, on April 17, 2013,^[7] a number of other incidents have demonstrated a significant risk to the safety of American workers and communities. On March 23, 2005, explosions at the BP Refinery in Texas City, Texas, killed 15 people and injured more than 170 people.^[8] On April 2, 2010, an explosion and fire at the Tesoro Refinery in Anacortes, Washington, killed seven people.^[9] On August 6, 2012, at the Chevron Refinery in Richmond, California, a fire involving flammable fluids endangered 19 Chevron employees and created a large plume of highly hazardous chemicals that traveled across the Richmond, California, area.^[10] Nearly 15,000 residents sought medical treatment due to the release. On June 13, 2013, a fire and explosion at Williams Olefins in Geismar, Louisiana, killed two people and injured many more.^[11]

Section 6 of the Executive Order is entitled “Policy, Regulation, and Standards Modernization.” This section, among other things, requires certain Federal agencies to consider possible changes to existing chemical safety and security regulations. To solicit comments and information from the public regarding potential changes to EPA's Risk Management Program regulations (40 CFR part 68), on July 31, 2014, EPA published an RFI (79 FR 44604). Information collected through the RFI informed the proposed rulemaking that was published on March 14, 2016 (81 FR 13637).

EPA received a total of 61,716 public comments on the proposed rulemaking. Several public comments were the result of various mass mail campaigns and contained numerous copies of letters or petition signatures. Approximately 61,467 letters and signatures were contained in these several comments. The remaining comments include 235 submissions with unique content, 10 duplicate submissions, and 4 non-germane submissions. In addition to these public submissions, EPA also received 8 written comments and had 22 members of the public provide verbal comments at a public hearing on March 29, 2016. Discussion of public comments can be found in topics included in this final rule and in the Response to Comments document,^[12] available in the docket for this rulemaking.

B. Overview of EPA's Risk Management Program Regulations

Both EPA's 40 CFR part 68 RMP regulation ^[13] and Occupational Safety and Health Administration's (OSHA) 29 CFR 1910.119 Process Safety Management (PSM) standard were authorized in the CAA Amendments of 1990. This was in response to a number of catastrophic chemical accidents occurring worldwide that had resulted in public and worker fatalities and injuries, environmental damage, and other community impacts. OSHA published the PSM standard in 1992 (57 FR 6356, February 24, 1992), as required by section 304 of the 1990 CAAA, using its authority under 29 U.S.C. 653.

The 1990 CAA Amendments added accidental release provisions under section 112(r). The statute required EPA to develop a list of at least 100 regulated substances for accident prevention and related thresholds (CAA section 112(r)(3) through (5)), and authorized EPA to issue accident prevention regulations (CAA section 112(r)(7)(A)). The statute also required EPA to develop “reasonable regulations” requiring facilities with over a TQ of a regulated substance to undertake accident prevention steps and submit a “risk management plan” to various local, state, and Federal planning entities (CAA section 112(r)(7)(B)).

EPA published the RMP regulation in two stages. The Agency published the list of regulated substances and TQs in 1994 (59 FR 4478, January 31, 1994) (the “list rule”) ^[14] and published the RMP final regulation, containing risk management requirements for covered sources, in 1996 (61 FR 31668, June 20, 1996) (the “RMP rule”).^[15 16] Both the OSHA PSM standard and the EPA RMP rule aim to prevent or minimize the consequences of accidental chemical releases through implementation of management program elements that integrate technologies, procedures, and management practices. In addition to requiring implementation of management program elements, the RMP rule requires covered sources to submit (to EPA) a document summarizing the source's risk management program—called a Risk Management Plan (or RMP). The RMP rule required covered sources to comply with its requirements and submit initial RMPs to EPA by June 21, 1999. Each RMP must be revised and updated at least once every five years from the date the plan was initially submitted.

EPA later revised the list rule and the RMP rule. EPA modified the regulated list of substances by exempting solutions with less than 37% concentrations of hydrochloric acid (62 FR 45130, August 25, 1997). EPA also deleted the category of Department of Transportation Division 1.1 explosives, and exempted flammable substances in gasoline used as fuel and in naturally occurring hydrocarbon mixtures prior to initial processing (63 FR 640, January 6, 1998).

EPA subsequently modified the RMP rule five times. First, in 1999, EPA revised the facility identification data and contact information reported in the RMP (64 FR 964, January 6, 1999). Next, EPA revised assumptions for the worst case scenario analysis for flammable substances and clarified what the Agency means by chemical storage not incidental to transportation (64 FR 28696, May 26, 1999). After the Chemical Safety Information, Site Security and Fuels Regulatory Relief Act (CSISSFRRA) was enacted on August 5, 1999, EPA excluded regulated flammable substances when used as a fuel or held for sale as a fuel at a retail facility (65 FR 13243, March 13, 2000). Later, EPA restricted access to offsite consequence analysis (OCA) data for the public and government officials to minimize the security risks associated with posting the information on the Internet (65 FR 48108, August 4, 2000). Finally, EPA revised the RMP executive summary to remove a requirement to describe the OCA; revised reporting deadlines for RMP reportable accidents and emergency contact changes; and made other minor revisions to RMP facility contact information (69 FR 18819, April 8, 2004).

The RMP rule establishes three “program levels” for regulated processes:

Program 1 applies to processes that would not affect the public in the case of a worst-case release and that have had no accidents with specific offsite consequences within the past five years. Program 1 imposes limited hazard assessment requirements, requires coordination with local response agencies, and requires submission of an RMP.

Program 2 applies to processes not eligible for Program 1 or subject to Program 3, and imposes streamlined prevention program requirements, including safety information, hazard review, operating procedures, training, maintenance, compliance audits, and incident investigation elements. Program 2 also imposes additional hazard assessment, management, and emergency response requirements.

Program 3 applies to processes not eligible for Program 1 and either subject to OSHA's PSM standard under Federal or state OSHA programs or classified in one of ten specified industry sectors identified by their 2002 NAICS codes listed at § 68.10(d)(1). These industries were selected because they had a higher frequency of the most serious accidents as compared to other industry sectors. The ten NAICS codes and the industries they represent are 32211 (pulp mills), 32411 (petroleum refineries), 32511 (petrochemical manufacturing), 325181 (alkalies and chlorine manufacturing), 325188 (all other basic inorganic chemical manufacturing), 325192 (cyclic crude and intermediate manufacturing), 325199 (all other basic chemical manufacturing), 325211 (plastics material and resin manufacturing), 325311 (nitrogenous fertilizer manufacturing), or 32532 (pesticide and other agricultural chemicals manufacturing).^[17] Program 3 imposes elements nearly identical to those in OSHA's PSM standard as the accident prevention program. The Program 3 prevention program includes requirements relating to process safety information (PSI), PHA, operating procedures, training, mechanical integrity, management of change (MOC), pre-startup review, compliance audits, incident investigations, employee participation, hot work permits, and contractors. Program 3 also imposes the same hazard assessment, management, and emergency response requirements that are required for Program 2.

The RMP rule has been effective in preventing and mitigating chemical accidents in the United States and protecting human health and the environment from chemical hazards. However, major incidents, such as the West, Texas explosion,^[18] highlight the importance of reviewing and evaluating current practices and regulatory requirements, and applying lessons learned from other incident investigations to advance process safety where needed.

III. Additional Information

A. Agency's Authority for Taking This Action

The statutory authority for this action is provided by section 112(r) of the CAA as amended (42 U.S.C. 7412(r)). Each of the portions of the Risk Management Program rule we are amending in this document are based on EPA's rulemaking authority under section 112(r)(7) of the CAA (42 U.S.C. 7412(r)(7)). A more detailed discussion of the underlying statutory authority for the current requirements of the Risk Management Program rule appears in the action that proposed the Risk Management Program (58 FR 54190, 54191-93, October 20, 1993). The prevention program provisions discussed in this preamble (auditing, incident investigation, and safer technologies alternatives analysis) address the “prevention and detection of accidental releases.” The emergency coordination and exercises provisions in this rule modify existing provisions that provide for “response to such release by the owners or operators of the sources of such releases” (CAA section 112(r)(7)(B)(i)). This paragraph in the statute calls for EPA's regulations to recognize differences in “size, operations, processes, class and categories of sources.” In this document, we maintain the distinctions in prevention program levels and in response actions authorized by this provision. The information disclosure provisions discussed in this document generally assist in the development of “procedures and measures for emergency response after an accidental release of a regulated substance in order to protect human health and the environment.” This information disclosure ensures the emergency plans for impacts on the community are based on more relevant and accurate information than would otherwise be available and ensures that the public can become an informed participant in such emergency planning.

Various commenters suggested that particular provisions of the proposed rulemaking were not consistent with CAA section 112(r) or other relevant statutes. We address these comments in each relevant section of the preamble and in the Response to Comments document,^[19] available in the docket for this rulemaking. Some commenters also suggested that EPA has not complied with the requirements in CAA section 112(r)(7)(D) for the Administrator to “consult with the Secretary of Labor and the Secretary of Transportation” and “coordinate any requirements under this paragraph with any requirements established for comparable purposes by the Occupational Safety and Health Administration or the Department of Transportation.”

EPA disagrees with these comments. Under section 6 of Executive Order 13650, “Improving Chemical Facility Safety and Security,” the Executive Order Working Group, chaired by EPA, OSHA, and Department of Homeland Security (DHS), was tasked with enhancing safety at chemical facilities by identifying key improvements to existing risk management practices through guidance, policies, procedures, outreach, and regulations. As part of this task, the Working Group conducted extensive interagency coordination, and solicited public comment on potential options for improving chemical facility safety. EPA's coordination efforts included discussions with numerous Federal agencies, including OSHA and the Department of Transportation (DOT), on potential changes to the Risk Management Program rule. As EPA explained in the preamble to the proposed rulemaking, the OSHA PSM standard and EPA RMP regulation are closely aligned in content, policy interpretations, Agency guidance, and enforcement. Since the inception of these regulations, EPA and OSHA have coordinated closely on their implementation in order to minimize regulatory burden and avoid conflicting requirements for regulated facilities. This coordination has continued throughout the development of this rule and on OSHA's initial steps toward proposing potential changes to the PSM standard. EPA's coordination with DOT was less extensive because nothing in this rule changes its basic applicability provisions, which apply the rule only to stationary sources, and exclude transportation. However, EPA continues to coordinate with DOT through ongoing Executive Order activities, which includes updates on RMP regulatory development, and this coordination is sufficient to meet EPA's obligations under CAA section 112(r)(7)(D). As with OSHA, EPA has a long history of close coordination with DOT on implementation of the RMP, particularly where potential transportation-related issues arise, and the Agency fully intends for such coordination to continue.

B. List of Regulated Substances

As part of its work under Executive Order 13650, the Working Group solicited public comment on potential changes to the list of regulated substances for the Risk Management Program, including what actions to take to address ammonium nitrate (AN). EPA did not propose revisions to the list of regulated substances. Instead, EPA explained the actions other agencies in the Executive Order Working Group are considering to address AN and indicated that EPA will coordinate any potential changes to the list of substances in 40 CFR part 68 with the actions of these other agencies. EPA received several comments related to revising the list of regulated substances and whether to expand the list to include AN.

1. Discussion of Comments on the List of Regulated Substances

A couple of commenters expressed support for expanding the scope of regulated substances under the RMP rule. One private citizen stated that EPA should broaden the range of chemicals covered under RMP and account for effects on vulnerable populations including children and the elderly. A professional organization asserted that EPA should update the list of regulated substances and require facilities to “evaluate the risk of a reactive chemical accident and take appropriate measures, even if the chemicals in question are not on the list.”

However, multiple commenters supported EPA's decision not to revise the list of regulated substances in this action. These commenters opposed adding toxic or flammable substances to the list of regulated substances in a separate action. One industry commenter opposed the addition of combustible dust to the list, arguing that it is already regulated under OSHA and constitutes a low risk to the public.

EPA will consider these comments when determining whether to propose revisions to the list of substances.

2. Discussion of Comments on AN

Many commenters supported regulating AN in the RMP rule. Several commenters requested that EPA consider the danger to the public from AN, and other reactive chemicals, in its rulemaking. A state agency further asked EPA to ensure that calculations for the OCA consider the unique explosive characteristics of fertilizer grade ammonium nitrate (FGAN) and develop specific RMP guidance for regulated FGAN facilities. One commenter supported adding AN to the list of regulated substances but requested unique requirements for AN formulated as an explosive or blasting agent and FGAN. Another commenter claimed that EPA failed to address Executive Order 13650 by failing to address AN in the proposed rulemaking.

However, EPA also received comments opposed to adding AN to the list of regulated substances. One commenter stated that EPA didn't have authority to regulate FGAN under the CAA and urged the Agency against including FGAN under the RMP regulations. Another commenter supported EPA's decision not to change current threshold quantities and toxic endpoints.

An industry trade association requested EPA's support and recognition of its voluntary private sector comprehensive inspection and assessment organization and FGAN guidelines for fertilizer retail facilities.

EPA acknowledges that there is both support and opposition to regulating AN and will consider these comments when determining whether to take further action on this issue. In the interim, EPA encourages fertilizer retailers to review and use existing guidance. OSHA compiles several resources on their Fertilizer Industry Guidance on Storage and Use of Ammonium Nitrate Web page at https://www.osha.gov/​dep/​fertilizer_​industry/​.

EPA disagrees with the commenter that indicated that EPA failed to address Executive Order 13650 when we chose not to propose to list AN in the list of regulated substances for the RMP regulations. In the proposed rulemaking, EPA explained that other agencies, including OSHA and DHS, are considering modifications to their regulations, and EPA will coordinate any potential changes to the list of substances in 40 CFR part 68 with the actions of these other agencies.

IV. Prevention Program Requirements

A. Incident Investigation and Accident History Requirements

1. Summary of Proposed Rulemaking

a. Definitions, § 68.3

EPA proposed to revise the definition of “catastrophic release” in § 68.3 to include impact categories identical to the description of accidental releases required to be reported under the accident history reporting requirements in § 68.42. The proposed definition, in § 68.3, would replace the phrase “that presents imminent and substantial endangerment to public health and the environment” with impacts categories including impacts that resulted in:

• On-site: Deaths, injuries, or significant property damage; or
• Offsite: Known deaths, injuries, evacuations, sheltering in place, property damage, or environmental damage.

EPA proposed to define “root cause” in § 68.3 to mean a fundamental, underlying, system-related reason why an incident occurred that identifies a correctable failure(s) in management systems.

b. Incident Investigation Sections, §§ 68.60 and 68.81

EPA proposed a number of revisions to the incident investigation provisions. EPA proposed to revise § 68.60, which is applicable to Program 2 processes, and § 68.81, which is applicable to Program 3 processes, by revising paragraph (a) to add subparagraphs (a)(1) and (a)(2) to better clarify the scope of incidents that must be investigated. Proposed subparagraph (a)(1) applied to an incident that resulted in a catastrophic release and clarifies that the owner or operator must investigate the incident even if the process involving the regulated substance is destroyed or decommissioned. Proposed subparagraph (a)(2) applied to a near-miss, which is an incident that could reasonably have resulted in a catastrophic release. EPA also proposed removing the phrase “of a regulated substance” from paragraph (a) because it is duplicative. The definition of “catastrophic release” refers to releases of regulated substances.

EPA also proposed to add a new paragraph (c) to § 68.60 requiring that an incident investigation team be established and consist of at least one person knowledgeable in the process involved and other persons with appropriate knowledge and experience to thoroughly investigate and analyze the incident. This is similar to the existing requirement in § 68.81(c) for Program 3 processes. EPA proposed that current § 68.60(c) through (f) would become § 68.60(d) through (g).

EPA proposed to revise the redesignated paragraph (d) in § 68.60 and current paragraph (d) in § 68.81 to revise the incident investigation report requirements. EPA proposed to change the word “summary” to “report” and require facility owners or operators to complete incident investigation reports within 12 months unless the implementing agency approves, in writing, an extension of time.

In addition, EPA proposed to amend and add new subparagraphs in the redesignated paragraph (d) in § 68.60 and current paragraph (d) in § 68.81 requiring additional elements in an incident investigation report. Specifically, EPA proposed to:

• Revise paragraph (d)(1) to require the time and location of the incident in the investigation report;
• Revise paragraph (d)(3) to specify that the description of the incident be in chronological order and provide all relevant facts;
• Add paragraph (d)(4) to require that the investigation report include the name and amount of the regulated substance involved in the release or near miss and the duration of the event;
• Add paragraph (d)(5) to require a description of the consequences, if any, of the incident;
• Add paragraph (d)(6) to require a description of emergency response actions taken;
• Renumber current paragraph (d)(4) to (d)(7) and require additional criteria related to the factors contributing to the incident, including the initiating event, direct and indirect contributing factors, and root causes. EPA also proposed to add language to paragraph (d)(7) to require that root causes be determined through the use of a recognized method.
• Renumber the current paragraph (d)(5) to (d)(8) and add language to require a schedule for addressing recommendations resulting from the investigation to be included in the investigation report.

Finally, in the redesignated § 68.60(g), EPA proposed to add the word incident before investigation and change “summaries” to “reports” for consistency.

c. Accident History, § 68.42

EPA also proposed to amend the five-year accident history section to require reporting of categories of root causes identified in the root cause analysis proposed to be required in §§ 68.60(d)(7) and 68.81(d)(7).

d. Hazard Review, § 68.50

For the Hazard review section, EPA proposed to amend subparagraph (a)(2) by adding a phrase at the end to require the owner or operator to consider findings from incident investigations.

e. Process Hazard Analysis (PHA), § 68.67

In the PHA section, EPA proposed to add subparagraph (c)(2) to require the owner or operator to address findings from incident investigations, as well as any other potential failure scenarios (e.g., incidents that occurred at other similar facilities and or processes, failure mechanisms discovered in literature or from other sources of information).

f. Updates, § 68.190

In the Updates section, EPA proposed to amend paragraph (c) to require the owner or operator to report any accidents covered by § 68.42 and conduct incident investigations required under § 68.60 and/or § 68.81 prior to de-registering a process or stationary source that is no longer subject to the RMP rule.

2. Summary of Final Rule

EPA is not finalizing the proposed definition for catastrophic release and is instead maintaining the existing definition. Additionally, EPA is finalizing a modified version of the proposed definition of the term “root cause.” In the final definition EPA deleted the phrase “that identifies a correctable failure(s) in management systems.”

EPA is not finalizing the proposed revisions to the five-year accident history section in the final rule.

EPA is finalizing the following provisions as proposed:

• Hazard review section, § 68.50;
• Incident investigation section §§ 68.60 and 68.81;
• Process hazard analysis (PHA) section, § 68.67, to add subparagraph (c)(2).
• Updates section, § 68.190.

3. Discussion of Comments and Basis for Final Rule Provisions

EPA's rationale for modifying the accident investigation provisions to explicitly require root cause analysis for investigations of catastrophic releases and near miss events and to have the findings of these investigations integrated into the PHA remains generally the same as in the proposed rulemaking. In the discussion that follows and in the Response to Comment document, we explain the modifications to our approach and the basis for these modifications.^[20] The most significant change in approach is to retain the catastrophic release definition. As became apparent in the comments, our view that having a common definition of reportable accidental release and catastrophic release would simplify and clarify compliance was outweighed by the potential burden of inadvertently expanding the number of investigated accidental releases. We continue to require investigations of near misses, but have provided additional guidance as to what we intend by the term. Other changes from the proposal are similarly intended to clarify terms used in the rule. Identification of root cause categories in accident history reporting has been eliminated because identifying root cause categories only provides limited information for understanding the root cause which is best attained by reviewing the complete incident investigation report. Implementing agencies and/or local emergency planners may still obtain the investigation report through direct contact with the facility. The changes we adopt in this final rule strike a balance between ensuring facilities and planners learn about the causes of catastrophic releases and near misses while also better targeting the reporting to minimize burden.

a. Definitions

Catastrophic release. Although EPA received some support for the proposed definition of “catastrophic release,” many commenters were opposed to the revision. Many commenters, including government agencies, industry trade associations, and facilities, argued that EPA's proposed definition of “catastrophic release” (1) expands its scope, rather than clarifying it, (2) is redundant of OSHA's authority to regulate workplace safety by including on-site damage or injuries, and (3) exceeds the CAA authority to regulate only ambient air beyond a facility's property.

EPA also received some comments identifying other concerns with the proposed change to the definition of “catastrophic release.” Some commenters, including a few facilities, said that the proposed definition is too vague, and some commenters noted that terms such as “injuries,” “significant property damage,” “environmental damage,” and “major” are not defined. A facility and a private citizen commented that the wording of the definition implies that a “catastrophic release” could include a fire, regardless of whether an actual release of regulated material occurs due to the fire, and also implies that releases involving on-site environmental damage would not be considered catastrophic.

Many commenters, including a state government agency, facilities, and industry trade associations, argued that EPA's proposed definition of “catastrophic release” would regulate workplace safety concerns that are outside EPA's authority to regulate under the CAA. Commenters asserted that EPA has authority to address through regulation and enforcement offsite impacts of facility releases, not on-site impacts. A facility asserted that the proposed definition inappropriately expands the scope of EPA's reach into workplace safety by requiring investigations of releases that would also include impacts to on-site workers or property. An industry trade association stated that the definition ignores Congress's express prohibition against EPA “exercising statutory authority to prescribe or enforce standards or regulations affecting occupational safety and health.” This commenter further argued that on-site injuries should be excluded from the proposed definition because OSHA already has jurisdiction in this area and because these often do not pose any risk to public health or the environment.

A facility stated that the proposed revision directly contradicts EPA's long-held interpretation that the references in section 112(r)(2)(A) to “ambient” air limit the Agency's authority to activities with offsite consequences. The commenter asserted that in the proposed rulemaking the EPA does not acknowledge the contradiction from its previous position or explain what new statutory authority exists or why it now has the authority to regulate workplace incidents.

Due to the large number of comments opposing the proposed revision to the definition of “catastrophic release,” EPA has decided not to finalize the proposed language. EPA believed that providing a consistent trigger for accident investigations and reportable accidents under the accident history requirements of § 68.42 would simplify compliance for the regulated community. EPA acknowledges that the proposed revision may have inadvertently expanded the definition and therefore the type of accident that could trigger an investigation. Some reportable incidents under the accident history provision may not pose an imminent and substantial threat to public health and the environment (see 40 CFR 68.3 (Catastrophic release)). Due to EPA's decision to retain the existing “catastrophic release” definition and not go forward with the proposed revision, the authority issues raised in comments are moot. However, contrary to one commenter's claim, it has never been EPA's position that the references in section 112(r) to “ambient” air limit the Agency's authority to regulate only activities with offsite consequences. On the contrary, it has been the Agency's longstanding position that incidents that primarily or even exclusively impact on-site receptors are potentially relevant to protection of the public and the environment from the risks of an accidental release. As EPA explained in the Response to Comments document for the original RMP rule, certain on-site accident impacts are relevant because they “may reflect safety practices at the source” and because “accidental releases from covered processes which resulted in deaths, injuries, or significant property damage on-site, involve failures of sufficient magnitude that they have the potential to affect offsite areas.” ^[21]

For similar reasons, requiring investigation of accidents with on-site impacts is not redundant to OSHA's authority when such accidents have the potential to affect offsite areas.

Root cause. Many commenters opposed the proposed definition of “root cause.” These commenters, which included industry trade associations, facilities, and a private citizen, said that EPA should revise the definition of “root cause” to remove “system-related” and “management system,” reasoning that not all incidents are due to system failures. One commenter also stated that the definition assumes that there is only one root cause and that the failure is correctable, when there can be many causes and the investigators may not be able to determine what is “correctable.” An association of government agencies agreed that the investigation should identify all root causes of failure, regardless of whether they are deemed correctable or related to the management system. An industry trade association stated that EPA should not define “root cause” and instead should defer to facilities to rely on standard definitions from independent safety organizations. Another industry trade association also argued that EPA does not need to define “root cause” because current incident investigator requirements, which call for the investigator to uncover “the factors that contributed to the incident,” are sufficient. Other industry trade associations commented that it is very misleading and may lead to incorrect enforcement proceedings to require a facility to identify a management system failure as a root cause of incidents whose true root cause is a design deficiency, equipment failure, or misuse of equipment.

EPA agrees with some of the comments, and is finalizing the proposed definition of “root cause” with modifications. EPA deleted the language regarding identifying correctable failure(s) in management systems. In response to the comment that the definition assumes that there is only one root cause, EPA agrees that there are often multiple root causes. The final rule defines “root cause” in the singular, but does not preclude the possibility of more than one root cause. EPA agrees with the comments that support investigations identifying all root causes, and the Agency notes that the root cause requirements in the final rule require the owner or operator to identify “root causes.”

b. Accident History Reporting

Some government agencies, an industry trade association, and a professional association agreed that the RMP accident history should include the root causes of incidents. However, other commenters, including industry trade associations and a facility, stated that the existing reporting requirements in § 68.42 are sufficient, and that requiring root cause reporting in the five-year accident history is an additional burden that is not offset by improved performance.

Although EPA believes there could be some benefit to identifying root cause categories within a facility's accident history, in most cases, the Agency believes the incident investigation report must be reviewed in order to fully understand root causes attributed to that incident. Implementing agency officials can obtain investigation reports during inspections or by using the Agency's information gathering authorities when needed. Therefore, EPA did not finalize the proposed requirement.

c. Changes to Hazard Review (§ 68.50) and Process Hazard Analysis (PHA) (§ 68.67) Requirements

Hazard review and PHA. Some commenters, including several government agencies, a professional organization, and an industry trade association, supported the requirement to include incident investigation findings in the hazard review. Other commenters opposed the requirement. Some of these commenters stated that the OSHA PSM standard already requires PHAs to address previous incidents, and EPA's changes are therefore unnecessary. One industry trade association commented that, as written, the proposal would require facilities to include all findings from all investigations for the facility's entire history.

Another commenter argued that incident investigation findings should not be required for PHAs because PHA teams typically use established techniques and requiring the “findings from incident investigations” to be included would not be a good fit for these types of assessments.

EPA disagrees with commenters and is finalizing these requirements as proposed, so that findings from incident investigations are considered when hazard reviews are conducted. EPA notes that the basic purpose of a hazard review is to identify what process equipment malfunctions or human errors could potentially lead to accidental releases, and then to identify what safeguards are needed in order to prevent such malfunctions and errors from occurring. An obvious source of information about such malfunctions and errors is information gained from investigating incidents that have previously occurred within the covered process. For this reason, the Program 3 analog to the hazard review, the PHA, already requires the owner or operator to identify any previous incidents that had a likely potential for catastrophic consequences when conducting the PHA.

EPA therefore not only disagrees with the commenter who stated that including findings from incident investigations within the PHA “would not be a good fit” for the PHA (as the existing rule already contains this requirement), but also believes that this requirement should be incorporated into the hazard review. EPA also disagrees that widely-used PHA (or hazard review) techniques preclude consideration of prior incidents—all PHA and hazard review techniques that EPA is aware of are easily adapted to allow consideration of prior incident scenarios. The commenter provided the example of the Hazard and Operability Study (HAZOP) PHA technique as an example of a technique for PHAs that is widely accepted but does not consider prior incidents. EPA disagrees that the HAZOP may not be adapted to consider prior incident causes. In fact, this PHA technique, which EPA acknowledges is widely used, is specifically intended to identify process deviations that can lead to undesirable consequences, as well as the causes and consequences of such deviations, and safeguards necessary to protect against the deviation from occurring. Incident scenarios are a key source of knowledge for conducting this technique. According to the Center for Chemical Process Safety (CCPS) “Guidelines for Hazard Evaluation Procedures—Second Edition with Worked Examples” (AIChE/CCPS, 1992, pp 143) “the knowledge-based HAZOP Analysis study can help ensure that the company's practices, and therefore its experience, have indeed been incorporated in the design.” The CCPS Guidelines also provide a specific example of how incident information can be incorporated into the HAZOP:

As a more specific example, consider the discharge from a centrifugal pump. The guide-word HAZOP approach would apply the guide word “Reverse” to identify the need for a check valve. The knowledge-based HAZOP approach might also identify the need for a check valve because an actual problem was experienced with reverse flow. . . [emphasis added].

In response to the comment regarding the requirements of OSHA PSM, EPA notes that this final rule requirement is applicable to Program 2 covered processes, which are not subject to the OSHA PSM standard.

Other potential failure scenarios. Some commenters opposed including “other potential failure scenarios” in the process hazards analysis (PHA). A state agency and an industry trade association stated that it is unclear what “any other potential failure scenarios” means. The state agency also said that facilities may not have access to or knowledge of issues at similar facilities. A facility said that EPA should provide a clearinghouse of “potential failure scenarios” so that facilities will have access to them. An industry trade association commented that a literature review would not provide much information and would be costly to conduct.

In response, as stated in the preamble to the proposed rulemaking, other potential failure scenarios can include incidents that occurred at other similar facilities and or processes, failure mechanisms discovered in literature, or from other sources of information. EPA believes that it is appropriate to research information about other potential scenarios and consider these scenarios when conducting a (PHA). Regarding the comment to provide a clearinghouse of scenarios, given the variety of processes and stationary sources, and ongoing changes to technologies, it would be difficult to establish a one-stop resource that would identify all potential failure scenarios for all processes covered under the rule. However, EPA believes that owners and operators are in the best position to obtain incident information relevant to their own covered processes. In most cases, industry trade associations will be a useful source for this information. Such information is also commonly available in trade journals, at industry conferences, in industry newsletters, in the Chemical Safety Board's accident investigation reports, in reference publications (e.g., Lees' Loss Prevention in the Process Industries ^[22] ), and through other professional networks. EPA therefore believes that information about other potential failure scenarios that are potentially relevant to a covered process should not be costly for the owner or operator to conduct and will benefit both the regulated stationary sources and its surrounding community.

Regarding the comment that this provision will require the owner or operator to review findings from all incident investigations for the facility's entire history—EPA agrees that the owner or operator should review all available incident information, but notes that the rule does not require the owner or operator to retain incident investigation reports for more than five years. However, if the owner or operator has access to incident information beyond that period, they should incorporate it into their hazard review as appropriate.

d. Destroyed or Decommissioned Processes

EPA received various comments regarding the proposed rulemaking's requirement for investigation of incidents that resulted in destruction or decommissioning of a process. Several commenters, including local agencies, facilities, an advocacy group, and an association of government agencies, expressed support for the requirement that an incident investigation with a root cause analysis be performed for incidents involving processes units that were destroyed or will be decommissioned. A local agency and a facility explained that this information could improve safety for other processes at the same facility or at other facilities.

EPA also received comments opposing incident investigations for destroyed or decommissioned processes. A facility and industry trade associations commented that there is no benefit to requiring investigations in cases where a process is decommissioned or destroyed.

EPA also received comments in opposition to registration requirements for decommissioned processes. A facility and an industry trade association said that there is no incremental safety benefit to requiring a destroyed or decommissioned unit to remain registered under RMP until after the incident investigation is complete. The commenters argued that this requirement imposes additional paperwork burdens without any additional safety benefit.

EPA is finalizing this requirement as proposed. The Agency agrees with the commenters who support this requirement because it will ensure that when incidents occur, particularly incidents so severe that the owner or operator elects to decommission the process involved or where the process is destroyed in the incident, lessons are learned as a result, both for the benefit of the owner/operator, and potentially for other stationary sources with similar processes.

In response to the comments opposed to the registration requirements for decommissioned processes, EPA believes that the additional paperwork burden regarding such requirements is minimal, as the processes would have already been registered in the source's most recent RMP. New accident history information may be added to the RMP without performing a full update. Following that correction, if the affected process has been decommissioned or destroyed, and if the source has multiple covered processes, the owner or operator would update their RMP to reflect the loss of the affected process (this would be required whether or not the incident was investigated). If the affected process was the only process at the source, after completing the investigation and correcting the existing RMP, the owner or operator would submit a deregistration notice for the source to EPA. Deregistration is already required by § 68.190(c) when a source is no longer subject to Part 68. Therefore, from a paperwork standpoint, the primary effect of this change would be the timing of when deregistration occurs. EPA believes the potential benefits of the knowledge gained from the incident investigation warrant this delay in deregistering a source.

e. Near Misses

In the proposed rulemaking, EPA did not propose a definition for the term “near miss,” although EPA did include the term in proposed revisions to §§ 68.60 and 68.81, paragraph (a)(2), in the phrase: “Could reasonably have resulted in a catastrophic release (i.e., was a near miss).” EPA also sought public comment on whether to include a formal definition for the term. EPA received comments both supporting and opposing a definition of “near miss.”

Requests to define “near miss.” Several commenters, including government agencies, industry trade associations, facilities, and an advocacy group, recommended defining “near miss” to reduce vagueness, uncertainty around which incidents require investigation, and the reliance on owners and operators to define the term. A local agency and an industry trade association suggested providing examples of near misses in guidance. A local agency said that EPA should clarify whether a release is considered a “near miss” if it was a controlled release. Other commenters, including a state agency and an industry trade association, opposed a regulatory definition of the term, stating that facilities should be permitted to determine what qualifies as a “near miss” that requires investigation. A state agency also said that EPA should not define “near miss” because it would be challenging to provide a definition that is suitable for all industry sectors. An industry trade association stated that the rule raises constitutional due process concerns because the rule lacks specificity to define the “near miss” standard and fails to provide adequate notice to the regulated community as to what the RMP rule will require.

EPA is finalizing the language in paragraph (a)(2) of §§ 68.60 and 68.81 as proposed, and has elected not to finalize a regulatory definition of “near miss” to identify incidents that require investigation. The criteria for determining incidents that require investigation will continue to include events that “could reasonably have resulted in a catastrophic release.” Under the final rule, this criterion, rather than a definition of “near miss,” applies to determine which incidents require investigation. However, the rule makes clear that a “near miss” is an example of an event that “could reasonably have resulted in a catastrophic release.” EPA agrees with commenters who said it would be difficult to address in a single definition the various types of incidents that may occur in RMP-regulated sectors that should be considered near misses, and therefore be investigated. Instead, facility owners or operators will need to decide which incidents “could reasonably have resulted in a catastrophic release.” This may be based on the seriousness of the incident, the process(es) involved, and the specific conditions and circumstances involved. In the 1996 Response to Comments on the original rule, EPA acknowledged that the range of incidents that reasonably could have resulted in a catastrophic release is very broad and cannot be specifically defined.^[23] EPA decided to leave it up to the owner or operator to determine whether an incident could reasonably have resulted in a catastrophic release and to investigate such incidents.

EPA understands from the comments that there was some uncertainty about the term near miss. EPA's experiences with RMP facility inspections and incident investigations show there have been incidents that were not investigated, even though under slightly different circumstances, the incident could have resulted in a catastrophic release. While most of these events did not result in deaths, injuries, adverse health or environmental effects, or sheltering-in-place, the Agency believes that in some cases, if circumstances had been slightly different, a catastrophic release could reasonably have occurred.

As described in the preamble to the proposed rulemaking, and as noted by one commenter, there is a CCPS definition of “near miss.” CCPS defines a “near miss” as an event in which an accident causing injury, death, property damage, or environmental impact, could have plausibly resulted if circumstances had been slightly different.

For example, a runaway reaction that is brought under control by operators is a near miss that may need to be investigated to determine why the problem occurred, even if it does not directly involve a covered process both because it may have led to a release from a nearby covered process or because it may indicate a safety management failure that applies to a covered process at the facility. Similarly, fires and explosions near or within a covered process, any unanticipated release of a regulated substance, and some process upsets could potentially lead to a catastrophic release.

CCPS's “Process Safety Leading and Lagging Metrics—You Don't Improve What You Don't Measure” explains that a near miss has three essential elements.^[24] These include:

• An event occurs, or a potentially unsafe situation is discovered;
• The event or unsafe situation had reasonable potential to escalate; and
• The potential escalation would have led to adverse impacts.

The CCPS document and the CCPS “Guidelines for Investigating Chemical Process Incidents” contain many examples of near misses, which can be an actual event or discovery of a potentially unsafe situation.^[25] Examples of incidents that should be investigated include some process upsets, such as: excursions of process parameters beyond pre-established critical control limits; activation of layers of protection such as relief valves, interlocks, rupture discs, blowdown systems, halon systems, vapor release alarms, and fixed vapor spray systems; and activation of emergency shutdowns.

Near misses should also include any incidents at nearby processes or equipment outside of a regulated process if the incident had the potential to cause a catastrophic release from a nearby regulated process. An example would be a transformer explosion that could have impacted nearby regulated process equipment causing it to lose containment of a regulated substance. Near misses could also include process upsets such as activation of relief valves, interlocks, blowdown systems, or rupture disks.

The intent is not to include every minor incident or leak, but focus on serious incidents that could reasonably have resulted in a catastrophic release, although EPA acknowledges this will require subjective judgment. EPA will update existing RMP guidance to reflect the revised RMP requirements and will provide guidance to identify what types of incidents could be considered near misses.

The concept of “near miss” has a meaning in industry and in the chemical engineering profession. In this preamble and in guidance, EPA has explained the concept and has identified sources that explain the term, and EPA believes that this satisfies any due process concerns raised by commenters related to the definition of this term. These sources put the regulated community on notice of EPA's expectations under the rule and thus also address the due process concerns raised by commenters regarding notice to the regulated community as to what the RMP rule will require. EPA expects that by expanding the root cause analysis requirement to near misses that could have resulted in a catastrophic incident, some stationary sources will be able to take corrective actions before another similar, but catastrophic incident occurs in the future. For example, as discussed in the March 14, 2016 RMP proposed rulemaking (81 FR 13637), incidents at Tosco Refinery, Georgia Pacific, Shell Olefins, Morton International, BP Texas City Refinery and Millard Refrigerated Services all involved near-misses or less serious incidents involving the same cause as the later catastrophic release.

Industry suggestions for clarifying near misses. A few industry trade associations commented that the examples of near misses that EPA provided in the NPRM, such as excursions of process parameters and activation of protections devices such as relief valves, should not be considered “near misses.” The commenters said that many of these examples are safeguards that are designed to be used to prevent catastrophic releases. An industry trade association also proposed a definition of “near miss” that would be limited only to scenarios where the final safeguard or layer of protection is activated, such that a release would have occurred if not for that control.

In response to these comments, EPA agrees that not all excursions of process parameters outside control levels or all instances of protective device activation should necessarily be considered to be near misses. EPA expects that activation of protective devices should be investigated when the failure of such devices could have reasonably resulted in a catastrophic release. However, EPA does not agree that near miss investigations should only include situations that resulted in activation of a final safeguard or layer of protection. This may be appropriate in some cases, but in others, multiple layers of protection may quickly fail. EPA believes that owners and operators must use reasonable judgement to decide which incidents, if they had occurred under slightly different circumstances, could reasonably have resulted in a catastrophic release, and investigate those incidents.

f. Investigation Timeframe

EPA received many comments in support of a shorter investigation timeframe. Many commenters, including a local agency and a professional association, stated that 12 months is too long to complete most investigations, and some commenters said that the timeframe should be shortened to five or six months. Some commenters also stated there should be a shorter timeframe, but with the ability to request an extension.

Other commenters, including state and local agencies and industry trade associations, said that EPA should allow for 12 months to complete an investigation and also allow extensions for especially large or complex incidents. Some commenters also recommended requiring interim reports. An industry trade association asked EPA to clarify that the 12-month period is only for completing the investigation report, not for implementing the recommendations in the report.

Other commenters, including facilities and industry trade associations, said that EPA should not impose any deadline for completing incident investigations. A few commenters, including a facility and industry trade associations, commented that an arbitrary deadline does not account for the complexity of the incident, the types of process units involved, or the need to retain outside consultants or experts to complete the investigation.

After considering these comments, EPA has decided to finalize the requirement to complete incident investigations within twelve months as proposed. EPA believes that this timeframe will provide a reasonable amount of time to conduct most investigations, while also ensuring that investigation findings are available relatively quickly in order to assist in preventing future incidents. For very complex incident investigations that cannot be completed within 12 months, EPA is allowing an extension of time if the implementing agency approves such an extension, in writing. EPA encourages owners and operators to complete incident investigations as soon as practicable, and believes that 12 months is typically long enough to complete even complex incident investigations. However, EPA provided flexibility for facilities to request more time to complete investigations when they consult with their implementing agency and receive written approval for an extension.

g. Incident Investigation Team

Some commenters, including a Federal agency, local government agencies, an association of government agencies, and an industry trade association, supported the proposed requirements under § 68.60(c) for the owner or operator of a Program 2 process to establish an incident investigation team consisting of at least one person knowledgeable in the process involved and other persons with appropriate knowledge and experience to thoroughly investigate and analyze the incident. Other commenters opposed these requirements. A facility commented that the incident investigation team requirements are unnecessary because they are already covered by the OSHA PSM standard. A private citizen commented that the requirement assumes that all investigations will be conducted by a team, when it is possible for a competent individual to perform all aspects of the investigation if given access and support by the facility owner or operator. The commenter also stated that although the proposed rulemaking provides significant information on who may perform a third-party audit, it does not specify the qualifications of persons who may perform investigations and certify investigation reports.

EPA is finalizing the Program 2 incident investigation requirements, as proposed. The Agency agrees with the commenters who support requiring at least one person on the investigation team to be knowledgeable in the process involved and other persons with appropriate knowledge and experience in incident investigation techniques, as EPA believes these provisions are necessary to ensure that facilities thoroughly investigate and analyze incidents and their root causes.

EPA disagrees that these incident investigation team requirements are already covered by the OSHA PSM standard. The requirements for Program 3 processes in the current rule already include a provision for incident investigation teams; however, the incident investigation team requirements in this rule apply to Program 2 processes, which by definition are not covered by the OSHA PSM standard. EPA agrees that the requirement assumes that all investigations will be conducted by a team. EPA believes that all incident investigations, whether conducted on Program 2 or Program 3 processes, should involve a team of at least two people, particularly given the requirement under the final rule for investigations to include analysis of root causes. However, beyond the requirements specified in the final rule (i.e., to establish an investigation team consisting of at least one person knowledgeable in the process involved and other persons with appropriate knowledge and experience to thoroughly investigate and analyze the incident), the Agency does not believe it is necessary to specify additional qualification criteria for incident investigation team members.

h. Root Causes

Support for root cause requirements. Many commenters, including government agencies, advocacy groups, a facility, and others, expressed support for the requirements to determine root causes through the use of a recognized method and to include information on root causes in investigation reports. The commenters supported these provisions as a way to prevent future incidents. Most of these commenters also expressed support for applying the root cause analysis requirement to both catastrophic release incidents and to incidents that could reasonably have resulted in a catastrophic release (i.e. near misses). These commenters stated that conducting root cause analysis on near misses would allow the owner or operator to identify and make corrective actions before a catastrophic incident occurs. Some commenters also supported EPA's proposal to allow the use of any recognized method to complete a root cause analysis.

EPA agrees with these comments and believes that requiring root cause analyses for catastrophic releases and near misses, and including root cause information in incident investigation reports is vital for understanding the nature of these events. EPA is finalizing, as proposed, the requirements that root causes must be determined through the use of a recognized method and that information on root causes must be included in investigation reports. As previously noted, however, the final rule includes a modified version of the proposed definition of the term “root cause.” The phrase “that identifies a correctable failure(s) in management systems” from the proposed definition has been deleted.

Opposition for root cause requirements. EPA also received many comments opposing the proposed root cause analysis requirements. Some commenters, including industry trade associations and Federal agencies, said that requiring the owner or operator to conduct a root cause analysis versus other investigation methods is unnecessary. Some of these commenters also argued that root cause analysis assumes that there is an underlying management or system-related cause behind every incident, which may not be the case and which EPA has failed to prove. An industry trade association and a facility stated that EPA should not require facilities to select from a predetermined list of root causes so as to avoid forcing them to fit their findings into a category that may not be appropriate.

Regarding these comments, EPA agrees that root cause analysis may result in identifying causes that are not always an underlying management or system-related cause, but still believes that the analysis is necessary to understand why the accident occurred so that the causes can be addressed. Therefore, we have modified the definition of “root cause” to remove the phrase “that typically identifies a correctable failure(s) in management systems” in order to remove the implication that all incidents involve correctable management system failures. EPA also notes that the final rule does not require facilities to select from a predetermined list of root causes or force them to fit their findings into an inappropriate category.

Many commenters argued that EPA should not require root cause analyses for near misses. A Federal agency, industry trade associations, and some facilities stated that EPA should not require root cause analyses for near misses because the requirement would increase compliance burdens and costs on facilities and take attention away from other safety activities. A few industry trade associations also argued that the quality of safety reviews will be diluted by applying the requirement to low-consequence, high-frequency events. One industry trade association stated that requiring a root cause analysis for near misses creates a false equivalency between near misses and actual catastrophic releases.

While EPA acknowledges that requiring root cause analyses for near misses may impose some additional burden on facilities, the Agency disagrees that the burden is unwarranted or that it will take attention away from other safety activities. The Agency notes that catastrophic release near miss events are infrequent events, and therefore do not typically divert attention from other safety activities. However, EPA believes that investigation of such incidents, when they occur, should be a high priority safety activity for regulated stationary sources, because these investigations can lead to the correction of problems which could ultimately prevent much more serious and costly catastrophic release incidents.

EPA also disagrees that the final rule applies the root cause investigation requirement to low-consequence, high-frequency events. The final rule requires root cause investigations only for incidents that resulted in, or could reasonably have resulted in, a catastrophic release. Such incidents are unusual. Based on accident history information reported to EPA, most regulated sources have never experienced a catastrophic release incident, and the Agency also believes that near misses will also be relatively rare events. The final rule does not presume any “equivalency” between near misses and actual catastrophic releases. The Agency notes that actual catastrophic releases may be more difficult to investigate if the incident requires extensive cleanup, damage assessment, evidence collection, etc.—activities that are unlikely to be necessary for near miss events. However, lessons learned from catastrophic releases and near misses should both benefit the source and its surrounding community, whether or not such events are viewed as equivalent.

Root cause requirements for Program 2 facilities. Some commenters opposed requiring root cause analyses for Program 2 processes. An industry trade association said that since most incidents happen at facilities with Program 3 facilities, it is unnecessary to expand this requirement to Program 2 facilities. Another industry trade association said root cause analyses should only be required at Program 3 facilities because the methodology is most appropriate for complex incidents.

While it is true that most RMP-reportable incidents occur at Program 3 processes, EPA decided that there was little justification for limiting the root cause requirements to only Program 3 processes, because some serious accidents also occur at Program 2 processes. Also, the Agency notes that some of the accidents at Program 2 processes occur at publicly owned water and wastewater treatment facilities that are not in Program 3 only because they are not located in a state with an OSHA-approved State Plan. Unlike state and local government employees at facilities in states with OSHA-approved State Plans, state and local government employees at facilities in states under Federal OSHA authority are not covered by the OSHA PSM standard. This results in regulated processes at these sources being placed in Program 2, even though the processes generally pose the same risk as similar processes at publicly owned water or wastewater treatment processes that are located at sources in OSHA State Plan states.

Incident investigation methodology. One commenter argued that EPA does not have authority to specify a specific incident investigation and analysis methodology and should remove all references to or requirement for any named investigation or analysis method from its proposed rulemakings. The commenter cited various provisions of the CAA and the language within the Memorandum of Understanding between CSB and EPA and asserted that CSB is the lead entity for accident investigations and has the authority to specify a named investigation method. Other commenters, including a state agency and facilities, said that EPA has not provided examples of how to determine what is a recognized method or which consensus bodies are to be used to determine recognized methods.

EPA disagrees with these comments. While the final rule does not require use of a specific incident investigation or analysis method (the final rule allows the owner or operator to determine root causes using “a recognized method”), nothing in the CAA precludes EPA from requiring sources to conduct incident investigations. Contrary to the commenter's suggestion, the legislative history specifically contemplates EPA requiring accident investigations (see Senate Report at 242-43 ^[26] ). The Agency notes that the existing RMP rule already contains such a requirement applicable to Program 2 and Program 3 processes. Like other risk management provisions, CAA section 112(r)(7)(B)(i) requires investigation requirements to be reasonable, but nothing in the statute otherwise limits EPA from requiring the investigation to address the issue of the underlying root cause of the accident.

Nothing in this final rule interferes with the ability of the CSB to conduct its accident investigations. The incident investigation provision we adopt is designed to have the facility learn from its accidents and near misses in order to identify ways to improve the facility's prevention program. The root cause investigations in this rule serve a distinct purpose from the oversight purposes of the CSB.

EPA also disagrees that we should specify recognized investigation methods or point to specific governing bodies for such methods. Investigation methods evolve over time, and new methods may be developed, so any list promulgated by EPA in this rule may soon be obsolete. The Agency took a similar approach in the PHA requirements for the existing rule, where it listed several potential methods, but also included the option to use an appropriate equivalent methodology. EPA recommends that owners and operators consult available literature on root cause investigation. For example, CCPS has published Guidelines for Investigating Chemical Process Incidents, which provides extensive guidance on incident investigations, near miss identification, root cause analysis, and other related topics.^[27]

i. Other Incident Investigation Report Requirements

A few commenters, including a Federal agency, expressed support for the proposal to require additional information to be included in incident investigation reports. Several other commenters expressed opposition to various proposed incident investigation report requirements. A facility said that EPA's proposed changes are unnecessary because each of the proposed items is already required under the OSHA PSM standard. Some industry trade associations opposed requiring facilities to include the results of the root cause analysis in the incident investigation report, saying this could increase the likelihood of lawsuits against the facility if those reports are made public, or could result in the release of confidential business information.

EPA believes that providing the additional required information is vital for understanding the nature of the incident and should be included in the incident investigation report. Some facility owners or operators may already voluntarily include root cause information and other elements required under this rule (e.g., time and location of incident, name and amount of substance involved in the release, etc.) in incident investigation reports prepared to comply with the RMP rule. However, §§ 68.60 and 68.81 are being revised to require this information to ensure clarity and consistency among reports. While the OSHA PSM standard contains the same incident investigation reporting requirements as the existing RMP rule for Program 3 processes, prior to this rule, neither regulation required reporting of root cause information nor the other report elements required in this rule. EPA disagrees with the conjecture that there may be an increased possibility of lawsuits is a good reason not to include root causes and other factual incident information in incident investigation reports. We note that the current rule requires a report that discusses factors contributing to the incident and recommendations resulting from the investigation, so to the extent that litigants would seek to use reports to establish cause or preventability of an incident, the litigation risk is there already. To the extent that the root cause discussion contains CBI, the existing rule provides methods for asserting CBI claims. Identifying root causes can prevent future incidents, thereby reducing accidental release impacts.

B. Third-Party Audits

EPA proposed to require owners or operators of certain RMP facilities to perform third-party audits, in order to prevent accidents and ensure compliance with part 68 requirements. The third-party audits are similar to the compliance audits already required by §§ 68.58 and 68.79, but EPA expects that independent compliance audits will assist stationary sources to come fully into compliance with the applicable prevention program requirements. The details of these requirements are described further.

1. Summary of Proposed Rulemaking

a. Definitions

EPA proposed to define “third-party audit” in § 68.3 as a compliance audit conducted pursuant to the requirements of § 68.59 and/or § 68.80, by an entity (individual or firm) meeting the competency, independence and impartiality criteria in those sections.

b. Compliance Audit Requirements Under §§ 68.58 and 68.79

EPA proposed changes to §§ 68.58 and 68.79 to require third-party compliance audits for both Program 2 and Program 3 processes, under certain conditions and to clarify existing requirements for compliance audits. EPA proposed to edit §§ 68.58(a) and 68.79(a) to add the language “for each covered process” to clarify that all compliance audits, self and third-party, shall address compliance with the provisions of Subpart C or D for each covered process. EPA also added a sentence at the end of the paragraph to reference when a compliance audit must be a third-party audit.

EPA also proposed to add paragraphs (f) through (h) in §§ 68.58 and 68.79. Paragraph (f) identified third-party audit applicability. EPA proposed that the next required compliance audit for an RMP facility would be a third-party audit when one of the following conditions apply:

• An accidental release, meeting the criteria in § 68.42(a), from a covered process has occurred; or
• An implementing agency requires a third-party audit based on noncompliance with the requirements of this subpart, including when a previous third-party audit failed to meet the competency, independence, or impartiality criteria of § 68.59(b) or § 68.80(b).

Proposed paragraph (g) described the procedure when an implementing agency requires a third-party audit and proposed an internal appeals process. EPA proposed to require an implementing agency to provide written notice to the facility owner or operator stating the reasons for the implementing agency's preliminary determination that a third-party audit is necessary. The owner or operator would have an opportunity to respond by providing information to, and consulting with, the implementing agency. The implementing agency would then provide a final determination to the owner or operator. If the final determination requires a third-party audit, the owner or operator would have an opportunity to appeal the final determination. EPA proposed that the implementing agency would provide a written, final decision on the appeal to the owner or operator after considering the appeal.

Proposed paragraph (h) described the schedule for completing third-party audits. The proposed language required the audit and associated report to be completed, and submitted to the implementing agency within 12 months of when any third-party audit is required or within three years of completion of the previous compliance audit, whichever is sooner. The provision also allowed an implementing agency to specify a different schedule.

c. Third-Party Compliance Audit Requirements in §§ 68.59 and 68.80

EPA proposed new §§ 68.59 and 68.80, which included requirements for both third-party compliance audits and third-party auditors. In paragraph (a), EPA proposed that owners or operators engage a third-party auditor to evaluate compliance with the provisions of subpart C or D (as applicable) when the applicability criteria of § 68.58(f) or § 68.79(f) are met.

Auditor qualifications. In paragraph (b), EPA proposed third-party auditor qualifications and required facility owners and operators to document that the third-party auditor or audit team meets competency and independence criteria of the rule. Specifically, EPA proposed that facility owners or operators determine and document that the third-party auditors meet the competency criteria in paragraph (b)(1) and the independence criteria in paragraph (b)(2).

EPA proposed competency criteria for auditors, requiring third-party auditors to be:

• Knowledgeable with the requirements of part 68;
• Experienced with the facility type and processes being audited and the applicable recognized and generally accepted good engineering practices (RAGAGEP);
• Trained or certified in proper auditing techniques; and
• A licensed Professional Engineer (PE) or include a licensed PE on the audit.

EPA also proposed independence and impartiality criteria that would apply to the third-party auditor or auditing team, and to each audit team member, individually. Specifically, the criteria would have required the auditor/audit team to:

• Act impartially when performing all activities under this section;
• Receive no financial benefit from the outcome of the audit, apart from payment for the auditing services;
• Not have conducted past research, development, design, construction services, or consulting for the owner or operator within the last 3 years. For purposes of this requirement, consulting does not include performing or participating in third-party audits pursuant to § 68.59 or § 68.80;
• Not provide other business or consulting services to the owner or operator, including advice or assistance to implement the findings or recommendations in an audit report, for a period of at least 3 years following submission of the final audit report;
• Ensure that all personnel involved in the audit sign and date the conflict of interest statement in § 68.59(d)(8); and
• Ensure that all personnel involved in the audit do not accept future employment with the owner or operator of the stationary source for a period of at least 3 years following submission of the final audit report. For purposes of this requirement, employment does not include performing or participating in third-party audits pursuant to § 68.59 or § 68.80.

In addition, in paragraph (b)(3), the proposed rulemaking required the auditor to have written policies and procedures to ensure that all personnel comply with the applicable competency, independence, and impartiality requirements.

Audit report. EPA proposed requirements for the audit report in paragraph (c). In paragraph (c)(1) EPA specified the scope and content of these reports, including a statement to be signed by the third-party auditor certifying that the third-party audit was performed in accordance with the requirements of subpart C or D, as applicable. EPA also proposed to require that the final third-party audit reports identify any adjustments made by the third-party auditor to any draft third-party audit reports provided to the owners or operators for their review or comment.

Proposed paragraph (c)(2) included requirements for third-party auditors to retain reports and records. Proposed paragraph (c)(3) required the audit report to be submitted to the implementing agency at the same time, or before, it is provided it to the owner or operator. Proposed paragraph (c)(4) provided that the audit report and related records could not be claimed as attorney-client communications or as attorney work products, even if written for or reviewed by legal staff.

Third-party audit findings. EPA proposed in paragraph (d)(1), to require owners or operators, as soon as possible, but no later than 90 days after receiving the final audit report, to determine an appropriate response to each of the findings in the audit report, and develop and provide to the implementing agency a findings response report. EPA proposed that the findings response report would include:

• A copy of the final audit report;
• An appropriate response to each of the audit report findings;
• A schedule for promptly addressing deficiencies; and
• A statement, signed and dated by a senior corporate officer, certifying that appropriate responses to the findings in the audit report have been identified and deficiencies were corrected, or are being corrected, consistent with the requirements of subpart C or D of 40 CFR part 68.

EPA proposed in paragraph (d)(2), to require the owner or operator to implement the schedule to address deficiencies identified in the audit findings response report, and document the action taken to address each deficiency, along with the date completed.

Proposed paragraph (d)(3) required the owner or operator to provide a copy of documents required under paragraphs (d)(1) and (d)(2) to the owner or operator's audit committee of the Board of Directors, or other comparable committee, if one exists.

Recordkeeping. Finally, EPA proposed recordkeeping requirements for the owner or operator in paragraph (e). The proposal would have required the owner or operator to retain records at the stationary source, including: The two most recent third-party audit reports, related findings response reports, documentation of actions taken to address deficiencies, and related records; and copies of all draft third-party audit reports. Those sections would further have required the owner or operator to provide draft third-party audit reports, or other documents, to the implementing agency upon request. EPA proposed that requirements would not apply to any documents that are more than five years old.

2. Summary of Final Rule

Regulated entities must engage a third-party to conduct an independent compliance audit when they (1) have an RMP reportable accident or (2) have been notified by an implementing agency of a determination of either conditions that could lead to an accidental release or problems with a prior third-party audit.

EPA is finalizing the proposed requirements for third-party auditors with modifications that include:

• Revising the applicability criteria for third-party audits required by implementing agencies from noncompliance to conditions that could lead to an accidental release;
• Providing for a third-party audit team, led by an independent third-party, which may now include a wide variety of additional, non-independent personnel, including facility employees and other personnel;
• Eliminating the competency criterion that the auditor be a PE;
• Revising the third-party auditor independence criteria to increase the number and diversity of qualified and available auditors; and
• Removing the requirement that either or both draft and final audit reports be submitted to implementing agencies.

EPA believes these changes address many of the most significant public comments EPA received on the proposed third-party audit requirements.

a. Definitions

In the final rule, EPA revised the definition of “third-party audit” to reflect the changes in §§ 68.59 and 68.80, which, when applicable, require that an owner or operator must either engage a third-party auditor or assemble an auditing team led by a third-party auditor. EPA also deleted the reference to impartiality, because impartiality is a criterion under the independence criteria in §§ 68.59(c)(2) and 68.80(c)(2) and there is no need to highlight this term individually.

b. Compliance Audit Requirements Under §§ 68.58 and 68.79

EPA is finalizing paragraph (a) as proposed. This includes clarifying language “for each covered process” added to §§ 68.58(a) and 68.79(a).

EPA is finalizing the applicability requirements set forth in §§ 68.58(f)(1) and 68.79(f)(1) as proposed but modifies the criterion in §§ 68.58(f)(2) and 68.79(f)(2) to apply when an implementing agency requires a third-party audit due to conditions at the stationary source that could lead to an accidental release of a regulated substance, or when a previous third-party audit failed to meet the competency or independence criteria of § 68.59(c).

EPA is also finalizing the implementing agency notifications and appeals process in paragraph (g), as proposed. However, the final rule language includes minor editorial revisions. The language of subparagraph (g)(1) requires the implementing agency to provide written notice to the owner or operator that describes the basis for the determination. The language of §§ 68.58(g)(3) and 68.79(g)(3) was modified to delete the unnecessary phrase “of this section.”

EPA has modified and clarified the schedule for completing a third-party audit in paragraph (h) as follows:

• EPA deleted the language requiring the auditor to submit the audit report to the implementing agency.
• The final rule requires a third-party audit to be completed within 12 months, unless a different timeframe is specified by the implementing agency. However, EPA made changes to simplify and clarify the schedule requirements.

○ Subparagraph (h)(1) requires a third-party audit to be completed within 12 months of an RMP reportable accident.

○ Subparagraph (h)(2) requires a third-party audit to be completed within 12 months of the date of the implementing agency's final determination, or if appealed, within 12 months of the date of the final decision on the appeal.

c. Third-Party Compliance Audit Requirements in §§ 68.59 and 68.80

EPA is finalizing paragraph (a) as proposed but modified the language slightly to clarify that the owner or operator shall engage a third-party to conduct an audit to evaluate compliance with subpart C or D as applicable.

Third-party auditors and auditing teams. In the final rule, EPA added paragraph (b) to provide options for assembling a third-party auditor or an audit team. In addition to engaging a fully independent third-party auditing firm, owners or operators may assemble auditing teams that include competent and independent third-party auditor team leaders and other qualifying, non-independent personnel. The owner or operator shall either:

• Engage a third-party auditor meeting all of the competency and independence criteria of the rule (subparagraph (b)(1)); or
• Assemble an auditing team, led by a third-party auditor meeting all of the competency and independence criteria. The team may include:

○ Other employees of the third-party auditor firm meeting the independence criteria of the rule; and

○ Other personnel not employed by the third-party auditor firm (subparagraph (b)(2)).^[28]

Auditor qualifications. The final rule retains the third-party auditor qualification requirements in paragraph (b) of the proposed rulemaking but redesignated as paragraph (c). The qualification requirements set forth in this paragraph apply only to the third-party auditors. The third-party auditor qualifications are clarified and modified as described further in this preamble.

In the final rule, EPA simplified the introductory paragraph to indicate that the owner or operator shall determine and document that the third-party auditor(s) meets the competency and independence requirements set forth in the subparagraphs.

Subparagraph (c)(1) identifies competency criteria that apply to third-party auditors.^[29] EPA is finalizing the competency criteria as proposed, except to delete the requirement for a licensed PE to conduct the audit or participate on the audit team.

Subparagraph (c)(2) identifies independence criteria that apply to third-party auditors. EPA is amending and finalizing the proposed independence criteria as follows:

• EPA is deleting the phrase “and impartiality” from the title because the impartiality requirement is listed as one of several criteria, and it is unnecessary to highlight the term separately.
• EPA clarified that retired employees qualify as third-party auditors when financial attachments are limited to retirement and/or health plans.
• EPA revised the timeframe that limits third-party auditors past and future research, development, design, construction services, or consulting services to two years. EPA further clarified that if the firm employs personnel that did conduct these services within the prescribed timeframe, then these personnel may not participate in the audit.
• The final rule requires third-party audit personnel to sign and date a conflict of interest statement documenting that they meet the independence criteria.
• The limitation regarding future employment with the owner or operator has been modified to apply to only third-party personnel involved in the audit and the timeframe decreased to two years.

EPA is finalizing subparagraph (c)(3), as proposed, to require auditors to have written policies and procedures to ensure that all personnel comply with the qualification criteria—except to delete the word impartiality from the criteria description.

Third-party auditor responsibilities. EPA is adding requirements for the owner or operator to provide certain responsibilities to the third-party auditor.^[30] Paragraph (d) requires the owner or operator to ensure that the third-party auditor:

• Manages the audit and participates in audit initiation, design, implementation, and reporting;
• Determines appropriate roles and responsibilities for the audit team members based on the qualifications of each team member;
• Prepares the audit report and where there is a team, documents the full audit team's views in the final audit report;
• Certifies the final audit report and its contents as meeting the requirements of the rule; and
• Provides a copy of the audit report to the facility owner or operator.

Audit report. EPA is redesignating and finalizing audit report requirements under paragraph (e) of the final rule with modifications. EPA reorganized and added one report requirement to the proposed subparagraphs (c)(1)(i) to (c)(1)(v). These are subparagraphs (e)(1) to (e)(6) in the final rule.

EPA also amended the audit report provisions in the final rule to simplify the applicable provisions and simplify the requirements for preparing and handling the third-party audit reports:

• Subparagraph (e)(1) requires the report to identify all persons participating on the audit team, including their employers and/or affiliations. The report must also document that third-party auditors meet the competency criteria of the rule; ^[31]

• EPA added an additional requirement under subparagraph (e)(2) for the auditor to describe in the report, or incorporate by reference, policies and procedures to ensure all third-party personnel comply with the competency and independence criteria of the rule;
• Proposed subparagraphs (c)(ii) and (c)(iii) are finalized as proposed and redesignated as (e)(3) and (e)(4). The report must document the auditor's compliance evaluation for each covered process and document the findings of the audit, including any identified deficiencies;
• Subparagraph (e)(5) requires the report to summarize any significant revisions between draft and final versions of the report;
• Subparagraph (e)(6) requires the auditor or audit team leader to sign and date a certification. The certification is finalized as proposed except to remove the last sentence that acknowledges penalties for submitting false information;
• EPA deleted the provision that required the auditor to maintain copies of all reports and records; ^[32]

• EPA deleted the provision that required the auditor to submit the report to the implementing agency at the same time as it would be provided to the owner or operator; and
• EPA deleted the provision limiting attorney-client privilege.

Third-party audit findings. EPA is finalizing requirements for the owner or operator to prepare a findings response report; develop a schedule to address deficiencies; and submit the findings response report and schedule to the Board of Directors. These requirements are redesignated to paragraph (f) of the final rule with the following modifications to the findings response report:

• EPA deleted the proposed requirement to submit the findings response report to the implementing agency; and
• EPA amended the owner/operator certification in the findings response report to add a sentence indicating that the owner or operator has engaged a third-party to perform or lead an audit team to conduct a third-party audit in accordance with the requirements of 40 CFR 68.80. EPA also modified the final sentence of the certification to clarify that submitting false information includes making false material statements, representations, or certifications.^[33]

EPA is finalizing requirements in subparagraph (f)(2) to develop a schedule to address deficiencies as proposed, except to modify the title of the provision to schedule implementation and correct citations to redesignated paragraphs.

EPA is also finalizing the requirement in subparagraph (f)(3) to submit the findings response report and implementation schedule to the board of directors as proposed with minor modifications to update citations to redesignated paragraphs, and capitalize Board of Directors in the title. In addition, the end of the last sentence was changed to reference a comparable committee, or individual, if applicable.

Recordkeeping. EPA is finalizing the recordkeeping requirements as proposed in paragraph (d) with the following modifications:

• The paragraph has been redesignated as paragraph (g) in the final rule;
• EPA eliminated the proposed subparagraphs and moved the language of proposed subparagraph (e)(1) into the main paragraph with edits to clarify that the owner or operator shall retain at the stationary source the two most recent final third-party audit reports;
• EPA eliminated the proposed requirement for owners or operators to retain copies of all draft third-party audit reports (subparagraph (e)(2) of the proposed rulemaking); and
• EPA amended the recordkeeping provision for Program 3 processes in § 68.80(e) to delete the sentence that applied the recordkeeping provisions to any documents that were five-years old or less. This revision is consistent with current recordkeeping compliance audits under § 68.79(e) and corrects an error in the proposed rulemaking text.

3. Discussion of Comments and Basis for Final Rule Provisions

Several comments supported the proposed third-party audit requirements, including one stating that the commenter found that internal audits often fail to identify systemic process safety deficiencies. However, many commenters opposed the proposed third-party compliance audit provisions, including some who expressed general opposition, reasoning that existing requirements and mechanisms are working. Some comments argued that the costs outweigh the benefits associated with this provision or that audits by internal resources are more cost-effective and less disruptive, while still providing adequate assessment and encouraging compliance.

EPA has retained a third-party audit requirement in the final rule. We continue to rely on the rationale expressed in the proposed rulemaking. However, in the final rule, we have modified the requirements for the audit team to expand the potential membership while still retaining the critical role of the independent auditor in the review of the compliance program. In the discussion that follows and in the Response to Comment document, we explain the modifications to our approach and the basis for these modifications.^[34] While the RMP rule does not prohibit accidental releases, an accidental release can be an indication of a prevention program that both needs improvement and that may benefit from an audit by someone independent from the source's historic program and the management of the source. The requirements finalized in this rule are not based on a wide finding that the original compliance audit requirement of the RMP rule does not have value; instead, we promulgate this requirement to target a subgroup that have had indications of potential problems not detected and addressed by the traditional audit structure.

EPA believes it is appropriate to require a subset of RMP-regulated facilities to engage competent and independent third-party auditors following an RMP-reportable accident or identification of conditions at the stationary source that could lead to an accidental release of a regulated substance. The purpose of the third-party audit is to assist the owners and operators in determining whether facility procedures and practices to comply with subparts C and/or D of the RMP rule (i.e., the prevention program requirements) are adequate and being followed. Thus, EPA is finalizing requirements for third-party audits when required under § 68.58 and/or § 68.79, to require that owners and operators ensure that third-party auditors meet qualification criteria, audits are conducted and documented, and findings are addressed pursuant to the requirements of § 68.59 and/or § 68.80, as applicable. EPA notes that under part 68, sources with any Program 2 and/or Program 3 processes are already required to conduct compliance audits every three years. This rule does not change the requirement that RMP facilities regularly conduct RMP compliance audits but provides only that, in specific situations, those audits be performed by a third-party or a team led by a third-party, pursuant to the schedule in § 68.58(h) and/or § 68.79(h) of the rule.

EPA considered, but did not adopt, changes to the final rule that would establish additional processes or programs under which EPA or other regulatory agencies must first approve or credential third-party auditors before owners or operators can engage them. Nor did EPA modify the rule to establish or reference additional independent auditor accreditation programs or auditor accreditation oversight committees or otherwise require potential third-party auditors to be accredited by an independent auditing or accreditation body before owners or operators may engage the auditors under this rule. For some programs, external accreditation of third-party auditors adds additional rigor to the process of ensuring the competence and independence of the auditors but such external accreditation can be time-consuming and add financial costs. EPA believes that the level of effort and resources necessary to establish these programs would cause unnecessary delays in implementing third-party compliance audit requirements and are not warranted for the small universe of facilities that may be subject to these requirements. Comments on significant issues relating to third-party audits are summarized and discussed further in this preamble. The following also discusses EPA's basis for the third-party audit provisions adopted in this final rule.

a. Third-Party Auditing Constitutional Law and Agency Authority Issues

EPA's enforcement authority. Several commenters stated that EPA should rely on its existing enforcement authority, including the ability to require third-party audits in particular enforcement proceedings, rather than requiring third-party audits more generally. Another encouraged EPA to focus on enforcing existing audit requirements. Similarly, another recommended that EPA address facilities deemed to be incapable of performing objective self-auditing through EPA's enforcement authorities. One commenter argued that the proposed third-party audit requirements violate the U.S. Constitution's Fifth Amendment Due Process Clause because the proposal seeks to outsource EPA's inspectional duties to a third-party and force facility owners or operators to accept and implement the third-party's findings without processes to protect the due process rights of those subject to the audits. A few commenters stated that the proposed third-party auditing provisions are an unlawful and unconstitutional circumvention of Congressional appropriations limits on EPA's enforcement budget. Specifically, the commenters argued that the Anti-Deficiency Act prohibits EPA from augmenting its enforcement budget by mandating that third parties oversee the RMP program.

EPA disagrees with the commenters. Third-party audits do not constitute enforcement, nor do they substitute for inspections by implementing agencies, and as such, EPA believes that they do not violate either the Due Process Clause of the Fifth Amendment, or the Anti-Deficiency Act. In addition, as discussed further in this preamble, EPA believes that there is no violation of the Due Process Clause of the Fifth Amendment regarding implementation of third-party audit findings.

The third-party audits required in this final rule are compliance audits, similar to the current self-audit requirements, only conducted by a team led by a third-party auditor. The Senate Environment and Public Works Committee identified program audits “by company personnel . . . or outside consultants” as an element of prevention program rules within the range of authorities provided EPA. See Senate Report at 243.^[35] The findings of a third-party audit are intended to identify noncompliance that was not discovered by facility personnel during self-audits, and are not intended primarily to bring such findings to the attention of government regulators. In fact, the audits are designed primarily to benefit owners or operators by assisting them to identify both actual noncompliance as well as operational or equipment deficiencies, previously unidentified risk factors, and accident release and/or regulatory noncompliance precursor conditions which, if uncorrected, could lead to releases and/or enforcement actions. Proactively addressing deficiencies, risk factors, and precursor conditions to accidental releases and regulatory noncompliance will provide financial, regulatory, and environmental benefits for facility owners and operators and communities. EPA has reasonably targeted third-party audit requirements at facilities that have had RMP reportable incidents that may demonstrate weaknesses in prior self-assessments and at facilities of heightened concern for implementing agencies.

Furthermore, third-party compliance audits in no way constitute regulatory inspections of, or enforcement at, RMP-regulated facilities. This rule is clear that third-party auditors' or third-party audit teams' findings are not, in and of themselves, determinations of regulatory violations. Nor are the audit reports or related documentation required to be automatically submitted to implementing agencies. EPA believes there is no violation of the Due Process Clause of the Fifth Amendment regarding implementation of third-party audit findings. Owners or operators must address all third-party audit findings, the rule provides that addressing the audit findings may include, where appropriate, determining that some specific findings were based on incorrect factual assumptions or were otherwise inappropriate to implement. Thus, as described further in this preamble, the owner or operator of a stationary sources may determine an appropriate response to the findings in the audit report, and are not required to accept findings when they can justifiably decline to adopt them, and EPA believes that determining appropriate responses, and addressing of deficiencies, risk factors, and precursor conditions to accidental releases and regulatory noncompliance pursuant to the third-party audit regulatory requirements, do not constitute violations of the Due Process Clause of the Fifth Amendment.

Finally, nothing in this rule relieves the EPA of any of its responsibilities under the CAA or implies that EPA will not continue to use its enforcement authorities under the CAA or devote resources to monitoring and enforcing this rule. The third-party auditing regulatory requirements simply ensure that regulated entities will, in a carefully-defined subset of circumstances, take reasonable measures to assess and ensure their own compliance.

Security and CBI concerns. A few commenters expressed security concerns associated with third-party compliance audits. One commenter was concerned with ensuring proper treatment of confidential information by third-party auditors, and asserted that the proposed rulemaking does not address whether or not a facility will be able to limit the release of sensitive information once a third-party auditor is involved. Another comment was received stating that facility and process security are concerns for the commercial explosives industry, and recommended that EPA eliminate the third-party audit requirements. This commenter reasoned that internal staff at explosives sites would have undergone mandatory background checks but third-party auditors wouldn't necessarily be subject to the same security screening. A few commenters stated that attempts to find auditors with appropriate security clearances would further limit the pool of available qualified auditors. One commenter asserted that the third-party compliance audit requirements create legal concerns given that the third parties would be privy to potential CBI or information that should be protected under attorney-client privilege.

EPA acknowledges commenters concerns; however, facility owners or operators routinely obtain and review the internal policies, procedures, and qualifications of a wide range of consultants and contractors before engaging them in order to assess their qualifications to perform consulting or contractual services. EPA is confident owners and operators will be able to ensure that third-party auditor personnel meet applicable security criteria.

Regarding concerns that the third-party compliance audit requirements create legal concerns given that the third-parties would be privy to potential CBI, the contracts or other agreements between owner/operators and third-party auditors can address how any potential confidential business information is handled by the third-party.

With regard to information that arguably should be protected under evidentiary privileges, EPA's view is that the third-party audit reports and related records under this rule, like other documents prepared pursuant to part 68 requirements, such as process safety information, PHAs, operating procedures and others, are not documents produced in anticipation of litigation. With respect to the attorney-client communication privilege specifically, the third-party auditor is arms-length and independent of the stationary source being audited. The auditor lacks an attorney-client relationship with counsel for the audited entity. Therefore, in EPA's view, neither the audit report nor the records related to the audit report provided by the third-party auditor are attorney-client privileged (including documents originally prepared with assistance or under the direction of the audited source's attorney). Nevertheless, EPA recognizes that the ultimate decision maker on questions of evidentiary privileges are the courts. Therefore, this rule does not contain a specific regulatory provision prohibiting assertion of these privileges.

b. Requirement To Conduct Compliance Audit for Each Covered Process

EPA received several comments regarding the clarification in §§ 68.58(a) and 68.79(a) of the proposed rulemaking that all RMP audits must address “each covered process” at a facility. Some commenters opposed this clarification. A few commenters indicated that this would be a change, and asserted that EPA has endorsed guidance from the CCPS allowing facilities with a large number of covered processes to audit a representative sample of processes.

One commenter argued that it was punitive for an accidental release from one process to automatically trigger a third-party audit requirement for all covered processes. A few commenters stated that requiring that all RMP-covered processes at the facility be audited regardless of what process triggered the requirement to perform the third-party audit would result in duplication of efforts with little benefit where processes at multi-process facilities are on different auditing schedules and third-parties are required to audit processes that were recently audited and not related to the incident that triggered the third-party audit. One commenter stated that requiring audits of processes that are not part of an incident would tie-up plant resources for longer than needed, which was particularly notable to the commenter because these processes would very likely still be operating after the incident and at the time of the audit.

Finally, commenters asserted that it is unfair and more burdensome to require larger facilities with multiple processes to audit each covered process, arguing that they would essentially be auditing all the time, where small facilities with one or two processes would have a lesser auditing burden.

EPA disagrees with commenters that believe it is punitive or redundant to require an audit of all RMP-covered processes at the facility, including those not involved in an RMP-reportable accident. Under existing rules, each facility compliance audit must address each covered process at least every three years. The third-party audit required under this rule simply replaces the next scheduled self-compliance audit, which must address each covered process.

EPA has consistently maintained that, at least every three years, owners or operators must, under the RMP rule, certify that they have evaluated compliance with the prevention program requirements for each covered process. ”In EPA's General Risk Management Guidance, issued in 2004 and updated in 2009, in Chapter 6, “Prevention Program (Program 2)” Section 6.7 “Compliance Audits (§ 68.58)”, under the heading “What Do I Need to Do?” it states “At least every three years, you must certify that you have evaluated compliance with the prevention program requirements for each covered process” [emphasis added]. In addition, Chapter 7 of this guidance, “Prevention Program (Program 3)” Section 7.9 “Compliance Audits (§ 68.79),” states “You must conduct an audit of the process to evaluate compliance with the prevention program requirements at least once every three years.” While EPA does list the 1993 edition of CCPS Guidelines for Auditing Process Safety Management Systems as a reference source within this guidance, EPA disagrees that the CCPS guidelines endorse allowing large facilities to audit a representative sample of covered processes.

EPA has also clearly stated its position within the Notice of Proposed Rulemaking preamble for the initial RMP regulation, and in the Response to Comments for that rule. In response to a question concerning whether facilities could stagger compliance audits where there are multiple processes at a facility, EPA stated, in the Response to Comments document, that a source “may choose to audit different processes on different schedules (if) over each three-year period, all covered processes are audited.” ^[36] Furthermore, while OSHA's original PSM compliance audit guidelines may have allowed for auditing a sample of processes, the current guidelines are consistent with EPA's General Risk Management Guidance. See OSHA's “Appendix C to § 1910.119—Compliance Guidelines and Recommendations for Process Safety Management (Nonmandatory).” EPA's decision to retain, in §§ 68.59(e)(3) and 68.80(e)(3) of the final rule, the requirements for the third-party audit reports to document the auditor's evaluation, for each covered process, of the owner or operator's compliance with the prevention program provisions is thus consistent with both the initial RMP rule and EPA's longstanding interpretation of the scope of the rule.

EPA also disagrees with commenters' burden argument for larger companies and facilities with a larger number of processes. These larger facilities typically also have more personnel and resources, where smaller facilities with fewer processes may have fewer employees, so the burden of auditing is proportionate for these facilities. Furthermore, larger facilities with more processes, in general, are likely to have more potential opportunities for accidental releases due to their size, complexity, and scale of operations. Therefore, it is appropriate for such facilities' auditing responsibilities to be commensurate to their size, complexity, and scale of operations.

c. Third-Party Audit Applicability

Some commenters generally supported the proposed applicability requirements. However, many commenters opposed the requirements, requesting that EPA narrow, limit, or eliminate these requirements.

RMP-reportable accident criterion. A commenter encouraged EPA to develop a narrower range of circumstances that can trigger a third-party audit to ensure they will not become an overwhelming compliance function, and detract from the performance-based aspects of RMP. Other commenters recommended limiting the requirements to: Releases that result in offsite impacts, such as offsite deaths, serious injuries, or significant environmental contamination; Program 3 facilities; facilities with multiple releases or multiple major accidents; or incidents that result in significant impacts to workers, or to the community. Another commenter stated that third-party audits should not be required automatically, but should only be required if the facility has experienced an accidental release that meets the criteria in § 68.42(a) and EPA makes the determination that there is good cause for the audit, in light of the particular circumstances and facts surrounding the release in question. One commenter stated that the accidental release trigger was not an effective way to improve public safety and urged EPA to adopt a more proactive and targeted approach.

EPA disagrees with commenters that third-party compliance audits will become an overwhelming compliance function. EPA has limited applicability of third-party audits to circumstances in which an RMP reportable accident has occurred or where conditions exist at the source that could lead to a release. In responding to the previous comments, it is necessary to provide context for how infrequently third-party auditing will, in practice, be necessary under the final rule, both in absolute numbers of such audits and their number relative to the full universe of RMP-regulated stationary sources already subject to the RMP rule's self-auditing requirements.

Currently, there are approximately 12,000 stationary sources with Program 2 and/or Program 3 processes. The final rule requires third-party compliance audits only under the following two conditions:

• If there has been an RMP reportable accident (i.e., an accidental release from an RMP facility meeting the five-year accident history criteria as described in § 68.42(a)); or
• If an implementing agency makes a determination that a third-party audit at an RMP facility is necessary, based on conditions “that could lead to an accidental release of a regulated substance” or a prior third-party audit at the facility.

EPA does not expect these criteria to impact a large percentage of stationary sources with Program 2 and/or Program 3 processes. For example, comparing the number of facilities which in past years have had an RMP reportable accident (averages approximately 150/year), with the number of current stationary sources with Program 2 and/or Program 3 processes, would represent less than 2% of stationary sources subject to this requirement, due to an accident, on an annual basis. For more information on the number of RMP reportable accidents over a ten-year period see section IX.A of this preamble.

EPA also disagrees with suggestions to limit the applicability of third-party compliance audits to releases with offsite impacts, deaths, injuries, or significant environmental impacts. The purpose of the third-party audit is to help reduce the risk of future accidents by requiring an independent and objective audit to determine whether the owner or operator of the facility is effectively meeting the prevention program requirements of the RMP rule. Stationary sources that have had accidents and/or substantial noncompliance with Risk Management Program requirements may pose a greater risk to the surrounding communities. EPA agrees that releases with offsite impacts, deaths, injuries, or significant environmental impacts are potential indicators of noncompliance with RMP prevention program requirements. But so are accidental releases that involve significant property damage on-site, or known offsite evacuations, sheltering in place, property damage, or environmental damage of any degree.

The existing self-audit requirements under §§ 68.58 and 68.79 incorporate a proactive evaluation of prevention program requirements for Program 2 and Program 3 processes. However, when a facility has an accidental release or noncompliance that could lead to an accidental release of a regulated substance, EPA has determined that further self-auditing may be insufficient to prevent accidents and ensure safe operation. Therefore, we believe it is appropriate to require such stationary sources to undergo third-party auditing to better assist owners and operators and implementing agencies to determine whether the procedures and practices developed by the owner and/or operator under subparts C and/or D of the RMP rule (i.e., the prevention program requirements) are adequate and being followed. EPA believes this approach will improve public safety overall by preventing future accidents at the source.

Overlap between incident investigations and third-party audits. Many commenters recommended that EPA focus on incident investigations after accidental releases rather than third-party audits. Some commenters reasoned that incident investigations are the activities that are most likely to mitigate both the severity of future incidents and the potential for recurrence. Some commenters stated that third-party audits should not be required when an incident investigation is also required because both of these activities require substantial internal resources and the incident investigation is more responsive to health and safety concerns. Some commenters also stated that requiring a facility to conduct the third-party audit after an accidental release has the potential to dilute resources from the facility's efforts to complete a comprehensive incident investigation and implement associated improvements. One commenter suggested that an incident investigation be required immediately after a catastrophic release but not a third-party audit, and that EPA could then require the stationary source's next three-year compliance audit (after the completion of the incident investigation) to have some degree of independence to assess the effectiveness of the changes made in response to the incident investigation.

EPA disagrees with commenters. Following an accident, incident investigations often reveal that facilities have deficiencies in some prevention program requirements related to that process. Incident investigations generally only evaluate the affected process, and do not necessarily address all covered processes at a facility, or even all prevention program elements for the affected process. However, compliance audits entail a systematic evaluation of the full prevention program for all covered processes, and EPA expects that third-party audits should identify deficiencies in any other covered processes at such facilities.

EPA believes that conducting the third-party compliance audits immediately after an accidental release is necessary to identify and correct existing noncompliance at prevention program facilities that could lead to future releases. EPA acknowledges that conducting third-party audits at the same time as incident investigations may impact the availability of facility resources for these activities. However, this is not a sufficient argument to delay the independent audit. Facilities may hire personnel from different firms to conduct the two activities or, for some facilities with knowledgeable internal staff to conduct investigations, they may only need to hire the third-party.

Although we agree with the commenter that suggested that compliance audits assess the effectiveness of changes made in response to an incident investigation, we disagree that this assessment must be made by a third-party. The owner or operator will resume the three-year schedule to conduct self-compliance audits after the third-party audit and, at that time, the facility owner or operator may consider the findings of the incident investigation and the third-party compliance audit when assessing compliance with prevention program requirements.

Implementing agency criterion. Many commenters argued that the third-party audit trigger associated with implementing agency findings of noncompliance should either be eliminated or significantly revised. Commenters expressed concerns with allowing an implementing agency to require a third-party audit based on a noncompliance determination. Commenters were also concerned about the potential for inconsistent or arbitrary decisions by implementing agencies, and a few commenters were concerned about the potential for abuse of this mechanism by implementing agencies. One commenter expressed due process concerns related to the triggers for third-party compliance audits, stating that the proposed rulemaking fails to provide the regulated facility an opportunity to contest implementing agency allegations of noncompliance. Commenters also requested clarification on whether an implementing agency could require a third-party compliance audit following a site inspection by the implementing agency.

In response to comments, EPA has revised the third-party audit applicability criterion by requiring the implementing agency to base a determination on conditions at the stationary source that could lead to an accidental release of a regulated substance, rather than on noncompliance. An implementing agency may determine that a third-party audit is necessary following inspections, audits, or facility visits, if conditions are observed at the stationary source that could lead to an accidental release of a regulated substance. The implementing agency may choose to take other action following an inspection, as appropriate.

Conditions at a stationary source that could lead to an accidental release may include, but are not be limited to, significant deficiencies with process equipment containing regulated substances, such as unaddressed deterioration, rust, corrosion, inadequate support, and/or other lack of maintenance that could lead to an accidental release. The presence of small “pinhole” releases, that do not meet the criteria in § 68.42(a) for RMP-regulated accidental releases, could also constitute conditions that could lead to a larger accidental release of a regulated substance. The occurrence of several prior accidental releases that did not meet the reporting criteria in § 68.42(a) at or from a facility could also constitute conditions which could lead to potentially more severe accidental releases. These releases may be a potential indicator that an owner or operator is not complying with RMP prevention program requirements and would benefit from a third-party audit to prevent future accidental releases.

EPA believes that having the implementing agency evaluate whether conditions exist that could lead to an accidental release better addresses the types of situations where a third-party audit would be most effective and will minimize the potential for inconsistent or arbitrary decisions made by implementing agencies. EPA also believes that the revised criterion is responsive to commenters' requests to narrow the applicability of these requirements. The criterion focuses on conditions with the potential to lead to accidental releases, rather than authorizing implementing agencies to require third-party audits under a potentially wide range of circumstances, including minor noncompliance.

In the final rule, a facility owner or operator has an opportunity to challenge the underlying findings when an implementing agency requires a third-party audit. Sections 68.58(g) and 68.79(g) describe the notification and appeals process. The implementing agency must provide written notice to the facility owner or operator that describes the basis for the implementing agency's determination. Within 30 days, the owner or operator may consult with, and provide information and data to the implementing agency on the preliminary determination. The implementing agency will then consider this information and provide a final determination to the owner or operator. EPA believes this appeal process provides due process to the owner or operator and is sufficient to eliminate any potential inconsistent use or abuse of authority.

Previous third-party audit criterion. A few commenters suggested deleting the failure of a previous third-party audit to meet the competency, independence, or impartiality criteria as a criterion for potentially requiring a subsequent third-party audit. These commenters reasoned that EPA has not shown that the auditor criteria will necessarily lead to better outcomes. A commenter questioned whether it was reasonable for EPA to declare a previous audit that was otherwise conducted in good faith, to be null and void, arguing that stationary sources could find it burdensome and difficult to track auditor qualification criteria.

EPA disagrees with commenters' assertions that stationary sources will find it burdensome or difficult to apply the third-party auditor competency and independence criteria in this rule to identify qualified third-party auditors. See sections IV.B.3.i and IV.B.3.j of this preamble for a discussion of auditor qualifications in the final rule as well as an explanation for why EPA believes that independent auditors can provide a fresh perspective on compliance audits that will enable an owner or operator to improve the source's risk management program.

If the implementing agency has concerns about a previous third-party audit, which involved an auditor that failed to meet the qualification criteria for competency and independence, and the agency is concerned about the quality and/or adequacy of the audit and/or its findings, then the implementing agency may choose to require that another third-party audit be conducted. The final rule establishes a procedure for owners or operators to challenge the regulators' determinations.

Regarding the comment concerning auditor criteria leading to better outcomes, this issue was addressed in the preamble to the proposed rulemaking, and is also discussed extensively in section IV.B.3.h of this preamble.

Alternative criteria suggestions. EPA received a comment recommending that EPA require third-party compliance audits for all Program 2 and Program 3 facilities every three years, reasoning that this alternative option is a more preventative measure than the proposed applicability.

A few commenters, including a state government agency, suggested that EPA consider limiting the requirement to perform third-party audits to specific NAICs codes. Some of these commenters further recommended that certain types of facilities be excluded from the requirement, including water and wastewater treatment facilities and retail anhydrous ammonia facilities. A local government agency commented that EPA should consider limiting the requirement to perform third-party audits to the petroleum manufacturing, chemical manufacturing, and paper manufacturing industries only.

As part of the SBAR panel process for the proposed rulemaking, SERs suggested that EPA consider excluding or exempting small businesses from the rule's third-party auditing requirements or providing small businesses with special flexibility to use less-than-fully-independent third-party auditors such as retired facility employees not otherwise meeting all of the proposed rulemaking's independence criteria. The SERs noted that the requirements in the proposed rulemaking for every member of the third-party auditing team to individually meet all of the proposed rulemaking's competency and independence criteria would be especially costly and burdensome to small businesses.

EPA disagrees with the suggestion to require all facilities with Program 2 and/or Program 3 processes conduct third-party compliance audits every three years, because the Agency believes that this would impose a very large economic burden on the regulated industry. EPA is also concerned that there may not be a sufficient number of independent auditors available to perform third-party audits at the frequency that this approach would demand.

Upon review of these comments in the context of EPA's overall approach to this rule, EPA has determined that it is unnecessary to add an exceptions or exemptions process for third-party auditor competency and independence to the final RMP rule, or to exempt small facilities or facilities within select industry sectors from the third-party auditing requirements. First, EPA expects that the current approach to require third-party audits following an RMP reportable accident, or based upon an implementing agency's determination, will impact approximately 150 facilities per year. In the Initial Regulatory Flexibility Assessment (IRFA) ^[37] for the proposed rulemaking, EPA determined that relatively few small businesses have reportable accidents and therefore this provision will typically not apply to small facilities. Therefore, it is unnecessary to exempt small facilities or revise the auditor qualifications for small facilities.

Additionally, EPA believes that the revised third-party auditor qualifications in this final rule will make it easier for owners and operators to find suitable third-party auditors and third-party audit team leaders to comply with the third-party audit provisions, making it unnecessary to add additional exceptions or an exception process to the final rule. EPA agrees with commenters' requests to provide additional flexibility to allow retired facility employees to conduct a third-party audit and has revised the auditor qualification criteria to address this request (see section IV.B.3.j of this preamble for more information).

Finally, EPA disagrees with commenters that request EPA exclude facilities within specific sectors from third-party applicability. EPA based applicability of third-party audits on whether a source had an RMP reportable accident or whether conditions exist that could lead to an accidental release. EPA believes that these criteria are potential indicators for noncompliance with prevention program requirements and therefore warrant an evaluation by a third-party. If a specific industry sector does not typically have accidental releases, then this provision will not likely apply. Furthermore, EPA modified the third-party auditor qualification criteria to make it simpler for all businesses, small, medium, and large and in all sectors, to find qualified third-party auditors. Therefore, it is unnecessary to exclude or limit third-party audit applicability to specific industry sectors.

d. Implementing Agency Notification and Appeals

A few commenters asserted that the appeals process associated with third-party compliance audits is insufficient. One commenter stated that the proposed appeals process does not preclude the excessive or baseless use of the claim by agency staff nor detail the quality or quantity of information that a facility could present to overcome an agency's determination and the requirement to perform a third-party audit. Commenters also recommended adding an additional independent party to the appeals process. One commenter stated that EPA should clearly provide for judicial review of decisions on appeals by including regulatory language specifying that EPA's decision “constitutes final agency action for purposes of judicial review.” Another commenter stated that EPA should make the deadline for appeals at least 60 days and should expressly provide for extensions.

EPA disagrees with the comments requesting an independent party be added to the appeals process. This approach would create unacceptable delays while the implementing agency and the facility identifies an appropriate third-party. EPA believes the appeals process set out in the final rule provides sufficient opportunities for the owner or operator to challenge an implementing agency's determination.

Sections 68.58(g) and 68.79(g) describe the notification and appeals process for when an implementing agency requires a third-party audit. The implementing agency must provide written notice to the facility owner or operator that describes the basis for the implementing agency's determination. Within 30 days, the owner or operator may consult with, and provide information and data to, the implementing agency on the preliminary determination. The implementing agency will then consider this information and provide a final determination to the owner or operator. Then there is an appeals process, in which the owner or operator may appeal the final determination to the EPA Regional Administrator, or for determinations made by other implementing agencies, the administrator or director of such implementing agency.

It is important to note that the final determination regarding the applicability of these provisions is not an enforcement determination. It is a notification regarding the applicability of an existing regulatory requirement, a requirement that does not apply to all stationary sources, all the time, but when an agency determines that it would apply, the owner or operator is notified, given an opportunity to consult, and appeal further within the agency. Part 68 already includes final agency determinations regarding regulatory requirements in Section 68.220, and the process set out in this final rule for appeals of third-party audit determinations is similar.

In response to comments about the short time frames, EPA has determined that the 30-day timeframe to submit an appeal, which follows an initial 30-day time period for the owner or operator to provide information and data to, and consult with, the implementing agency, is adequate and will ensure timely consideration of the information presented. EPA believes there is sufficient time built into the initial notification and consultation process, and the subsequent appeals process, particularly considering that the provisions apply to third-party audits required due to accidents or conditions at the facility that could lead to an accidental release of a regulated substance, and taking into account the need, in these circumstances, to take prompt action to identify and correct deficiencies.

e. Schedule for Conducting a Third-Party Audit

One commenter supported the proposed 12-month timeframe to complete a third-party audit. However, a few commenters opposed the proposed schedule. One commenter said that it would not be reasonable or appropriate to require completion of an audit report within twelve months by default. Some comments suggested modifying the rule to allow extensions of time to conduct third-party audits. Some comments sought clarification concerning the timing of a third-party audit. One commenter stated that the proposal seems to include inconsistent requirements for the required timing of third-party audits. Another commenter stated that, although it seems that EPA intended to require the third-party audit to be completed within 12 months of a triggering event, the deadline would be even sooner if the next scheduled triennial compliance audit is fewer than 12 months away. A few commenters encouraged EPA to clarify that conducting a third-party audit would count as the scheduled compliance audit and reset the clock on the three-year compliance audit schedule.

In response to comments, EPA has revised the regulatory text to clarify that the schedule for conducting a third-party audit, unless a different timeframe is specified by the implementing agency, is within 12 months of an RMP reportable accident or within 12 months of the date of the implementing agency's final determination. If the final determination is appealed, the third-party audit is required within 12 months of the date of the final decision on the appeal. EPA believes that the 12-month timeframe in the final rule provides sufficient time for owners or operators to complete a third-party audit while avoiding unnecessary delays in identifying and addressing noncompliance. Additionally, the final rule allows the implementing agency to specify a different timeframe for conducting third-party audits. This allows flexibility for an implementing agency to grant an extension, or to specify a shorter timeframe, to complete the audit, as appropriate. For example, an implementing agency may grant an extension if a source can demonstrate that it has had difficulty finding a qualified third-party auditor to conduct or lead the audit team, or that the audit will require extra time due to the complexity or number of processes, due to extensive damage to the facility following an incident, or due to resource constraints. Alternatively, the implementing agency may specify a shorter timeframe to complete the audit after considering the severity of the release or determining that unsafe conditions exist at the source.

EPA acknowledges that in some cases, the default result of these timeframes may be that a gap of greater than three years may occur between completion of the previous compliance audit and a subsequent third-party audit (e.g., if an accident triggering a third-party audit occurs shortly before the facility's next regular compliance audit is due). In these cases, the owner or operator will still have 12 months to complete the third-party audit unless a different timeframe is specified by the implementing agency. Finally, stationary sources are required to audit compliance at least every three years, and a third-party compliance audit counts toward meeting this recurring requirement for purposes of determining the timing of the stationary source's next compliance audit.

f. Process by Which Owners or Operators Select Third-Party Auditors

In the preamble to the proposed rulemaking, EPA sought comment on potential alternative approaches to determining auditor competency and independence, such as requiring third-party auditors to be accredited by EPA or an independent auditing or accreditation body or board. EPA received a range of public comments on this issue. Commenters disagreed about whether facility owners and operators should be responsible for determining and documenting third-party auditor qualifications for competence and independence. A few commenters, including local agencies and industry trade associations, supported having the facility, rather than a regulatory agency, determine their third-party auditors' qualifications. Another industry trade association agreed that auditor competency should be determined and documented by individual owners and operators but asserted that it should be the auditors' responsibility to determine whether they qualify as independent. Other commenters, however, including a state agency, facilities, and industry trade associations, asserted that it is burdensome to the owners and operators to require them to self-select qualified auditors that they determined to be competent and independent. One commenter stated that a facility cannot easily obtain and review a third-party auditing firm's internal policies and procedures each time it engages a third-party auditor. Two commenters further questioned whether facility owners and operators would be sufficiently able to assess a third-party's qualifications to perform the required audits.

A few commenters expressed support for establishing an accreditation program for auditing firms while others stated that determinations of third-party auditor competency and independence are more properly performed by regulatory agencies. A state agency suggested, as an alternative, establishing an auditor oversight committee to include representatives from the facility, local agencies, and the community. Another state agency commented that an oversight committee would be needed to ensure that the process is truly independent if the auditor is hired by the owner or operator and not by the implementing agency. One commenter suggested that EPA approve third-party auditors based on technical and other qualifications and provide a list of those determined to be acceptable to industry. Some local agencies suggested that the implementing agency should approve or assist the facility in selecting a third-party auditor. One local agency stated that existing accreditation from a recognized auditing body should be allowed but not be the only prerequisite for being qualified to conduct a third-party audit. An advocacy group suggested that if an auditor failed to identify a crucial hazard that could have prevented a catastrophic event, the auditor should lose its accreditation until it corrects the problems that led to the failure.

EPA has considered these comments and believes that establishing an accreditation program for third-party auditors would add time and costs to the process of third-party auditor selection and engagement. Therefore, in this final rule EPA has elected, instead, to focus on streamlining the auditor competency and independence criteria. Owners and operators are responsible for determining and documenting that the third-party auditors are qualified pursuant to the rule's competency and independence criteria. EPA believes this approach is consistent with commenters' requests that the process for engaging the auditors should be straightforward and allow for reasonable judgement of the owner or operator in selecting third-party auditors. Owners and operators routinely obtain and review the internal policies, procedures, and qualifications of a wide range of consultants and contractors before engaging them in order to assess their qualifications to perform consulting or contractual services. EPA is confident that owners and operators will be able to assess third-party auditor qualifications in a similar manner.

g. Auditors and Audit Team Structure

In the preamble to the proposed rulemaking, EPA invited comment on how to determine the roles and responsibilities for third-party auditors and how to structure third-party audit teams. Many commenters, including a Federal government agency, a state government agency, facilities, and industry associations, stated that facilities should have the flexibility to utilize internal staff who are much more familiar with the facility and covered processes than outside consultants. A facility commented that in the past it has used third-party auditors and determined that the facility's existing internal audit process provided an audit of equal or greater value than that of the third-party. Industry trade associations also asserted that the use of facility staff was more effective than third-party auditors because crucial time is not lost in learning about the facility. Another industry trade association stated that, in addition to identifying deficiencies, the most effective audits identify opportunities for improvement, which the commenter asserted is why audits that are conducted by or overseen by corporate staff or staff from other facilities within a company with similar processes can be more effective than strictly third-party audits. A professional association stated that companies must determine their own policies, procedures, and programs for performing audits. Similarly, an industry trade association stated that owners and operators should be allowed to choose whether in-house personnel or a third-party auditor conduct the compliance audit, as long as the organization can demonstrate that the auditor is qualified.

Industry trade associations commented that EPA's proposed approach may have unintended consequences on the effectiveness of audits by setting up an adversarial relationship between the regulated facility and the third-party auditor and creating a scenario that discourages the free flow of information between the facility and the auditor. Furthermore, an industry trade association commented that this fundamental change to the RMP audit program will likely cause companies to separate RMP and PSM audits. The commenter argued that such a change would demonstrate that EPA had failed in this rulemaking to satisfy its statutory obligation to develop a coordinated approach with OSHA. An individual commenter recommended the Institute of Nuclear Power Operations evaluation team model, which is a hybrid of a self-audit and a third-party audit by well qualified individuals. An industry trade association suggested setting up an industry sharing option (similar to the Occupational Safety and Health Administration's Voluntary Protection Program, which uses qualified personnel from other regulated facilities or company employees from a different plant to perform audits at facilities being evaluated under the program) in lieu of third-party auditing firms.

A Federal government agency recommended that third-party auditors be required to consult with facility employees and their representatives when conducting audits, reasoning that this requirement would be consistent with the language in the CAA at 29 U.S.C. 651 et seq. and EPA guidance on worker participation during EPA audits and inspections. And although opposed to the proposed requirement for third-party audits, an industry trade association asserted that there can be value in having/adding a third-party individual on or in coordination with a self-audit team, reasoning that the addition of the third-party auditor contributes to the development of the internal experts and expertise.

In response to commenters' suggestions to allow more flexibility on the composition of the audit team, EPA is finalizing an approach that allows owners or operators to meet their third-party auditing obligations either by:

• Engaging third-party auditors meeting all applicable competency and independence criteria, as originally proposed, or
• By assembling an auditing team which is led by a third-party auditor but may include other audit team members. The audit team may be comprised of:

○ A team leader—this must be an employee of the third-party auditor firm who meets all of the competency and independence criteria of the rule;

○ Other employees of the third-party auditor firm—these personnel must meet the independence criteria of the rule; and

○ Other personnel not employed by the third-party auditor firm (e.g. facility personnel or employees of another consulting firm with specialized expertise). These personnel are not required to meet the competency and/or independence criteria of the rule.

EPA agrees with commenters who suggest that allowing facility personnel and other knowledgeable but non-independent contractors and consultants to participate in the audit would improve the audit teams' performance and outcomes. This change addresses, among other things, the commenters' concerns that requiring the audit team and all of its individual members to meet the full independence criteria would exclude too many potential team members with critical sector or facility-specific experience. This approach allows qualified personnel from other regulated facilities or company employees to participate in the audit and enables facility personnel to provide input during the compliance audit.

Although some commenters suggested that facility's existing internal audit process provided an audit of equal or greater value than that of a third-party, EPA believes that an independent, third-party perspective can provide insight on the facility's risk management program that may not otherwise be identified during an internal compliance audit. EPA further disagrees that this change to the RMP audit program will cause companies to separate RMP and PSM audits. EPA believes that the flexible approach for assembling a third-party audit that includes both independent and facility personnel will allow facilities to continue to conduct RMP and PSM audits simultaneously, as appropriate.

h. Auditor Qualifications and Responsibilities

General comments on qualification criteria. Many commenters stated that the requirements in the proposed rulemaking for every member of the third-party auditing team to individually meet all of the proposed rulemaking's competency and independence criteria will severely reduce the number of qualified auditors available and raise the costs of auditing for facilities. One facility argued that the auditor qualification requirements are arbitrary and should be withdrawn. Specifically, the commenter described the findings from the EPA-Wharton pilot study and concluded that this study undermines EPA's assertion in the proposal that rigid qualifications are necessary for a successful RMP third-party audit program. A professional association recommended that EPA require companies to develop, implement, and maintain effective policies, procedures, and programs for performing RMP audits. Such policies, procedures, and programs could themselves establish basic third-party auditor competency and independence criteria.

EPA agrees with commenters that the proposed qualification criteria could limit availability of qualified auditors and raise costs of audits. Therefore, EPA is finalizing an approach that allows owners or operators to comply with third-party auditing requirements either by engaging third-party auditors that meet all applicable competency and independence criteria, as originally proposed; or by assembling an auditing team, led by a third-party auditor, that includes other personnel (e.g., consultants or facility employees).

EPA disagrees with commenters who argue that auditor qualifications are unnecessary for a successful third-party audit program. EPA's goal, in proposing criteria for auditor qualifications, was to ensure clarity and objectivity as to the minimum expected standards third-party auditors must meet for competency and independence. Since EPA is not finalizing requirements for third-party auditors to be qualified or accredited by an outside independent accreditation board, nor to meet competency and independence criteria in external consensus standards or protocols, the final rule must necessarily specify third-party auditor competency and independence criteria. Such criteria are necessary to ensure that owners and operators are able to successfully identify and engage fully qualified, competent and independent third-party auditors.

Consensus standards. EPA did not propose that consensus standards apply to third-party audits or auditors. However, in the preamble to the proposed rulemaking, EPA sought comment regarding potentially relevant and applicable consensus standards and protocols that might apply to the third-party auditors or audits that could be incorporated into the rule. Some commenters recommended that EPA use existing guidelines and standards including the CCPS “Guidelines for Auditing Process Safety Management Systems” and National Fire Protection Association codes and standards. One commenter stated that establishing protocols for auditing would assist in ensuring that a third-party audit is being performed to some type of recognized standard. However, the commenter stated that it is not aware of the establishment of such a standard at this time and noted that EPA might be required to work with a standard setting organization to develop the standard, if such a standard was to be provided to facilities and auditors. One commenter stated that the International Code Council (ICC) administers exams for building, fire, plumbing, and many other trade inspectors. An industry trade association commented that it opposed a requirement that consensus standards and protocols be incorporated into compliance audits and asserted that such a requirement was not within the scope of Executive Order 13650.

A few commenters, including a local government agency, noted that consensus standards may result in the bar for acceptable procedures being set low. Although noting that consensus standards could offer some minimum criteria to follow, a commenter stated that applying consensus standards to third-party compliance audits could be problematic because they are the lowest high-bar industry has agreed to, which runs the risk of lowering the bar for select companies or the consultants hired to perform the audit.

EPA acknowledges that consensus standards and protocols are referenced in a range of Federal and state regulations and can play useful roles in third-party verification programs. California's Underground Storage Tank program is an example of a program that relies on consensus standards in which designated operators are required to pass an exam administered by the ICC in order to be certified to conduct audits.^[38] However, EPA has determined that reference to such standards and protocols is unnecessary for third-party compliance audits conducted under this rule because the final rule identifies qualification criteria for competency and independence for third-party auditors and third-party auditor team leaders.

EPA is also finalizing third-party auditor responsibilities in §§ 68.59(d) and 68.80(d). This provides the third-party auditor with minimum expectations for conducting the compliance audit. The owner or operator shall ensure that the third-party auditor:

• Manages the audit and participates in audit activities including: Initiation, design, implementation, and reporting;
• Determines appropriate roles and responsibilities for the audit team members;
• Prepares the audit report and ensures all audit team members' views are reflected in the final audit report;
• Certifies the final audit report and its contents as meeting the requirements of the rule and
• Provides a copy of the audit report to the facility owner or operator.

Third-party auditors must evaluate the audit team members' qualifications to determine appropriate audit roles and responsibilities in order to produce audit outcomes and final audit reports meeting the applicable rule requirements. This approach recognizes that audit team members may have varying levels of knowledge and experience with the RMP rule requirements, the stationary source being audited, the applicable or relevant engineering practices, and proper auditing techniques. EPA believes it is appropriate for the third-party auditor to be responsible for these determinations and that this approach allows the owners or operators and the third-party audit team leader to successfully collaborate to assemble an effective auditing team.

i. Third-Party Auditor Competency Criteria

Almost all of the public comments on the proposed third-party auditor competency criteria focused on the requirement for the auditor to be a licensed Professional Engineer (PE) or include a licensed PE on the audit team. PE organizations supported the proposed requirement arguing that many facilities that would require third-party audits are designed, constructed, and maintained by PEs, who are subject to professional ethical standards that require objectivity. Some of these commenters described the supply of PEs as being sufficient to meet the demand for the third-party auditors under the approach in the proposed RMP rule.

However, a large number of commenters opposed the proposed PE competency criterion. Many commenters stated that they saw no value in requiring a PE because PEs do not specifically have process safety or auditing skills. Several commenters questioned whether there are a sufficient number of PEs with appropriate experience to meet the need for RMP audits. As an industry trade association observed, even though the number of PEs may be large, there may be an insufficient number of PEs that have third-party audits as an area of expertise. A facility asserted that every PE cannot practice in every state, and if a PE is part of the audit team, he or she must be licensed in the state affected by the RMP incident.

As part of the feedback for the SBAR Panel for the proposed rulemaking, SERs suggested that EPA consider allowing other qualified, credentialed personnel besides PEs to qualify as third-party auditors. Such other personnel could, SERs suggested, be degreed chemists, degreed chemical engineers, Certified Safety Professionals (CSP), Certified Industrial Hygienists (CIH), Certified Fire Protection Specialists (CFPS), Certified Hazardous Materials Managers (CHMM), Certified Professional Environmental Auditors (CPEA) or Certified Process Safety Auditors (CPSA). SERs indicated that these credentials also include ethical obligations to provide sound independent advice. Many other commenters also suggested that professionals with process safety management experience who have other credentials subject to ethical standards should also be allowed to give facilities a larger choice for their third-party auditors. Another facility and an industry trade association commented argued that the owner or operator is in the best position to assess who is qualified to perform the audit. Two commenters characterized the EPA-Wharton Pilot Study on Third-Party Audits ^[39] as suggesting that relevant industry and process specific experience, training, and regulatory knowledge are the essential qualifications of RMP auditors and that the PE requirement should be withdrawn.

EPA agrees with commenters that stated it is unnecessary for third-party auditors to be PEs and that a variety of qualified personnel can potentially be effective third-party auditors or third-party audit team leaders. Consequently, EPA deleted the PE requirement from the final rule. EPA believes it is sufficient for the third-party auditor or third-party audit team leader to be:

• Knowledgeable with the requirements of the RMP rule;
• Experienced with the stationary source type and processes being audited and applicable recognized and generally accepted good engineering practices; and
• Trained or certified in proper auditing techniques.

Third-party auditors can meet the requirement to be knowledgeable with the RMP rule requirements, and the requirement to be experienced with the stationary source type and processes being audited and applicable recognized and generally accepted good engineering practices through a variety of ways, including prior experience and training. Third-party auditors can meet the requirement to be trained or certified in proper auditing techniques by completing courses in environmental or safety auditing, obtaining certifications from recognized professional bodies, or having prior process safety auditing experience.

EPA has also established third-party auditor responsibilities in §§ 68.59(d) and 68.80(d). If the third-party auditor believes that a necessary skill or expertise is lacking in the auditing team, the owner or operator and third-party auditor are responsible for augmenting the audit team with the additional team members needed to supply the missing skill or expertise. For example, an owner or operator may choose to designate an employee competent in using an infrared camera to participate on a third-party auditing team. Such an audit team member would be acceptable, even though the individual does not meet the independence criteria and lacks specific knowledge of the stationary source type and processes being audited, as long as the third-party audit team leader evaluates the employee's qualifications to perform the specific role the employee will perform in the audit. The same standard would also apply to the participation of any other personnel the owner or operator might choose to include when assembling the third-party audit team.

j. Third-Party Auditor Independence Criteria

A few commenters, including a Federal and two local government agencies, supported the proposed provisions for ensuring auditor independence. Some local government agencies agreed that the proposed requirement for auditors to have written policies and procedures to ensure that personnel comply with the proposed competency, independence, and impartiality requirements is appropriate. Several commenters, however, warned that the independence criteria would be difficult to monitor and enforce. Conversely, many commenters opposed the third-party auditor independence criteria, arguing that the criteria are too restricted and will limit the availability of third-party auditors and the quality of the audits.

Availability of third-party auditors. Some commenters warned that the proposed auditor independence criteria would have the unintended consequence of reducing the quality of the audits and/or the availability of sufficiently qualified auditors. A few commenters suggested that the lack of ability for employees to participate on the audit team could lead to an adversarial relationship, inhibiting the impartial fact-finding an audit is supposed to facilitate. Some commenters stated that the independence criteria would, in practice, discourage open and productive auditor-source dialog, that auditor unfamiliarity with the audited facilities could turn the audits into “check-the-box” exercises, and that new and unfamiliar auditors will feel pressure to be “trigger happy” on finding deficiencies. An industry trade association suggested that facilities should be allowed to petition for a relaxation of these requirements if auditors cannot be identified.

As part of the SBAR Panel process, some SERs raised concerns about the extent of the independence criteria and suggested this would limit the availability of qualified auditors. Specifically, these SERs were concerned that the independence criteria would rule out, as third-party auditors, all of the members of any auditing firm employing any personnel who previously worked for or otherwise engaged in consulting services with the owner or operator. This was deemed problematic because, in the SERs' experience, many, if not most, otherwise qualifying audit firms hire retired personnel specifically because the personnel have sector, company, and/or facility-specific experience with firms subject to the RMP rule. Numerous other commenters observed that consulting firms perform a wide variety of work for RMP facilities of which only a fraction is auditing but the new restrictions could cause those firms to exit the auditing market rather than risk losing their other business lines.

In order to address concerns about the availability of auditors, EPA modified the third-party auditor independence criteria in the final rule to enable more firms and individuals to qualify as third-party auditors or third-party audit team leaders. The final rule modifications provide additional flexibility while still ensuring that audit teams are managed and operated independently to produce the types of enhanced audit outcomes commonly associated with independent auditors per the literature and evidence described in the preamble to the proposed rulemaking and in this document.

EPA made many significant changes to the third-party independence criteria. The most significant modification to the third-party audit requirements is that only employees of the independent third-party audit firm must meet the independence criteria of § 68.59(c)(2) and/or § 68.80(c)(2). For third-party audit teams, the team leader must meet both the competency and independence criteria of § 68.59(c) and/or § 68.80(c) and all other employees of the third-party auditor firm that participate on the team need only meet the independence criteria. Third-party audit teams may also include other personnel, such as consultants or facility employees and these personnel are not subject to the third-party qualification criteria of the final rule.

EPA also revised the timeframe within which third-party auditors cannot provide business or consulting services to two years. EPA also added language indicating that if a third-party-firm employs personnel who have provided business or consulting services to the facility within the prescribed timeframe (i.e. within two years of the audit) then the third-party audit firm must ensure that these personnel do not participate on the audit team. Additionally, EPA clarified in regulatory language the circumstances in which a retired employee may participate in a third-party audit. Viewed as a whole, these changes serve to increase the types of personnel who may potentially serve as independent third-party auditors. Therefore, EPA believes it will be unnecessary for facility owners or operators to petition for a relaxation of auditor qualifications.

Criteria limiting past and future business or consulting services and future employment. A large number of commenters specifically opposed the proposed independence provisions, particularly the requirement that an auditor cannot have provided other consulting services to the owner or operator in the prior three years and cannot accept future employment for three years following submission of the final audit report. Some commenters stated that third-party auditing is entirely unnecessary for RMP facilities because there is no evidence to believe that internal auditors working for, or employed by, facility owners or operators would deliberately fail to conduct honest and complete audits because of their prior, current, or future financial or employment ties to the owners or operators. Many commenters stated that to disqualify auditors who have performed certain services for the owner or operator of a facility within the past three years would disqualify those auditors who are most familiar with a source's operations, and facilities would be forced to select auditors who are unfamiliar with the facility and its processes. Many commenters emphasized that audit teams should include personnel with direct, personal familiarity with the facility (including facility employees) to ensure effective RMP compliance audits. Commenters stated that this could be of concern particularly for plants with complex engineered processes requiring site-specific expertise.

In response to these comments, in the final rule EPA has modified the three-year prohibition on auditors providing prior consulting services to (other than auditing services) or subsequently being employed by the owner or operator to a two-year prohibition. This prohibition applies only to employees of the third-party auditor firm. Owners or operators can assemble a third-party audit team led by a third-party auditor that meets both the competency and independence criteria of the final rule. The third-party audit team can also include other non-independent personnel such as current or former employees of the facility or other persons with prior site-specific experience. This revision, itself, will enable a much broader and more diverse set of auditors to serve on the audit teams, including knowledgeable facility personnel, other personnel employed at different facilities owned by the regulated company, and a variety of second or third-party personnel such as consultants and contractors. Only employees of the third-party auditor firm leading the audit team are subject to the independence criteria of the final rule and only the individual leading the third-party audit team is subject to both the competency and independence criteria of the final rule.

Retired employees. Commenters and SERs supported allowing company retirees to participate on audit teams.

EPA agrees with commenters. EPA modified the final rule to clearly identify that retired employees who otherwise satisfy the third-party auditor independence criteria may still qualify as independent if their sole continuing financial attachments to the owner or operator are employer-financed or managed retirement and/or health plans. This revision clarifies that owners or operators can hire retired employees with specialized knowledge or experience with the source type or facility to participate in third-party audits.

Effectiveness of self-audits. Three trade associations stated that EPA failed to adequately demonstrate through statistical or other analyses that the RMP rule's self-auditing requirement was deficient or that independent auditor certification is necessary. Some commenters stated that the proposed third-party auditing requirements and criteria are unnecessary because the record does not demonstrate widespread RMP self-auditing-related fraud. One association referenced the CSB's report on the Texas City refinery accident as suggesting that management's failure to implement prior self-audit recommendations is of greater concern than self-audit inadequacy, per se.

While third-party auditing is useful for minimizing the potential for fraudulent behavior or reporting, EPA believes that helping to prevent or minimize fraud is but one positive independent third-party auditing outcome. In fact, the third-party auditing requirements are intended to improve auditing practices and outcomes by also correcting biases shown by the literature to be associated with self-auditing. These biases are compelling precisely because they are not the hallmark solely of fraudulent firms but are exhibited commonly by entities with no overt or covert malicious intent to be inaccurate or unfair in their auditing or reporting.^[40]

EPA's recent experience demonstrates that in some cases self-auditing is deficient. In the preamble to the proposed rulemaking, EPA referenced enforcement settlements requiring third-party auditing of settlement agreement implementation and compliance at facilities handling CAA section 112(r) chemicals. One such settlement is the administrative order on consent issued by Region 1, in 2015, to Mann Distribution LLC and 3134 Post Road LLC (Respondents) to address Resource Conservation and Recovery Act (RCRA) and CAA section 112(r)(1) (the “general duty clause”) violations found during an April 4, 2013 inspection at a chemical distribution facility in Warwick, Rhode Island. Like the Risk Management Program requirements, section 112(r)(1) of the CAA addresses safe operation and prevention of accidental releases. Unsafe conditions found during the inspection included, among other things, failure to have a fire suppression system, failure to inspect a fire alarm, co-location of incompatible chemicals, and many RCRA generator violations. The facility also had a prior history of noncompliance. The order required Respondents to, among other things, implement an independent third-party inspection program. The Respondents agreed to the program because they wanted to maximize the benefits of implementing the administrative order on consent by accelerating the improvement of the culture of compliance and safety at the facility.

Since the proposed rulemaking was published, EPA has received and reviewed the Mann independent third-party inspection team's audit reports. These reports state that the third-party team found several compliance and safety issues the facility owner and operator had not independently found or corrected. The suite of audits uncovered and tracked the correction of these deficiencies. EPA has also received feedback from a facility representative and its third-party auditor about the program. All of the involved parties—EPA, facility representative, and the third-party auditor—agreed that the new and independent third-party auditing required pursuant to the enforcement order was beneficial for both correcting specific deficiencies and improving a culture of compliance. The suite of four third-party inspections improved the company's hazardous materials management plan, plan implementation, and emergency response program. As of March 2016, corrections to issues identified by the third-party auditors produced results including safer storage of chemicals that are oxidizers, improved integrity testing and maintenance of chemical storage tanks; better emergency egress, training, and coordination with the fire department; and improvements in container storage (such as better labeling and more aisle space). After a year of audits, the audit team leader provided some constructive suggestions about how EPA could modify third-party audit requirements in the future. For example, she felt that one of the order's auditor independence criterion (a five-year ban on future work with the company) was excessive as such a requirement, in light of New England's contracting manufacturing/industrial market, might serve as a disincentive to the participation as third-party auditors by highly qualified professionals and firms. Also, although this order did not require that the audit team include a PE, the auditor said she was aware that EPA was considering requiring PEs for future audits and believed that such a requirement would be unnecessary because good practice suggests that team make-up and qualifications should be determined on a case-by-case basis.

EPA agrees with the commenters stating that auditors with facility-specific experience can contribute insights that independent auditors lacking such experience would be unlikely to contribute. EPA addressed this comment in the final rule by, among other things, modifying the final rule to allow owners or operators to include non-independent employees, contractors, or consultants with facility-specific experience on the third-party auditing teams.

EPA continues, however, to believe that the “fresh eyes” and perspectives that third-parties contribute to audit teams support the approach in this rule to third-party auditing for the small subset of RMP facilities that have RMP reportable accidents or conditions at their stationary sources that could lead to an accidental release of a regulated substance. In this context, EPA has assessed available empirical research suggesting why independent auditors lacking prior facility-specific experience can actually produce better audit outcomes than personnel with prior site-specific experience. This research suggests independent personnel can audit the facilities they monitor with “fresh eyes” and thus be more likely to identify issues of concern. While the research that follows primarily involves government inspectors, EPA believes that the findings correlate to designing effective third-party auditing programs.

One such study concerns the relationship of inspector experience and product recalls in the medical device industry.^[41] The study's authors explain:

Plant inspections enable supply chain partners to manage quality risk in global supply chains. However, surprisingly little research examines the behavioral aspects of inspectors' work. Drawing on insights from the experience, learning, and complacency literatures, we examine the how well plant inspection outcomes predict future recalls and analyze the effect of inspector experience on both the information content of plant inspections as well as the prevalence of product recalls. Using secondary data spanning a 7-year period in the medical device industry and a recurrent event Cox Proportional Hazard model, our results show that inspection outcomes contain information and hence predict future product recalls, and that this relationship is moderated by inspector experience. . . . [T]he hazard of recalls at a plant increases if the same inspector continues to inspect the plant, independent of the inspection outcome. Recall hazard increases by 48% the second time an inspector visits a plant, and 63% by the third visit. These results indicate the need to rotate inspectors among plants and have important implications for managers, regulatory agencies, and theory.

The authors' views on the drivers for these outcomes are informative. Although significant literature exists indicating that sending the same auditor or inspector to repeatedly inspect a facility can lead to familiarity, that weakens an auditor's independence and compromises audit outcomes,^[42] these were not the above study's primary findings. Rather, the authors found that the worsening inspection outcomes over time were likely primarily due to inspector complacency. In the authors' words,

The stale, routine nature of the job, and the familiarity which comes from repeat visits to a site, can lead to complacency and lower the information contained in an inspection, even when the investigator has no clear incentive to `go easier' on an inspection site.

These complacency effects “may outweigh the benefits [such repeat visits have on inspector] learning.” Another analysis of 426,831 unannounced inspections by state government inspectors from July 2003 through March 2010 found that new inspectors tend to have “fresher eyes” in their first visit to a restaurant, reporting 12.7-17.5% more violations than the second visit of a repeat inspector, and that this effect is more pronounced when the previous inspector had a longer relationship with the restaurant.^[43]

Findings such as these, and the policy implications that flow from such studies, address human behavioral and psychological influences that appear to be common to inspection and auditing regimes. Thus, although not expressly required by this rule, EPA encourages owners or operators, when assembling both third-party audit teams and conducting self-audits under the RMP rule, to include on their teams a mix of personnel previously familiar, and unfamiliar, with the specific facilities they are tasked with auditing.

Finally, EPA agrees with commenters that it is critical that facility owners and operators implement corrective actions to address findings from compliance audits. Therefore, the final rule requires the owner or operator to certify in the findings response report that deficiencies are being corrected. As an additional measure to ensure accountability, EPA is also requiring a copy of the findings response report and schedule to implement deficiencies to be submitted to the auditing committee of the Board of Directors or other comparable committee or individual, if applicable.

Validity of examples of third-party audits. Commenters sought to criticize the many examples of third-party auditing provided by EPA in the preamble to the proposed rulemaking, including mandatory and voluntary programs by regulators and industry trade associations, on the grounds that these other regulations and programs operate in a different context from that of the RMP rule (i.e., that the literature and empirical data on the effectiveness of third-party auditing cited by EPA do not specifically address regulatory compliance auditing at RMP facilities). These commenters stated that most or all of EPA's examples of other Federal, state, and voluntary or industry independent auditing do not relate to RMP rule compliance, and therefore limit the transferability of these programs' design features and outcomes to the RMP context. The associations further stated that there is no evidence showing:

• A systemic problem with RMP facilities' self-audits or that employees or contractors act unethically or are biased;
• A lack of auditor independence creates bias leading to accidents;
• Third-party audits would have successfully prevented past accidental releases; or
• The root causes of a significant number of past accidents at RMP facilities were deficient self-audits.

EPA disagrees with commenters. Because RMP facilities were not previously required to have third-party compliance audits, statistically valid outcome data specifically on RMP rule third-party auditing does not currently exist. As EPA has described, however, there is a considerable and growing body of literature and empirical data on the effectiveness of third-party auditing, generally. These literature and data occur in many contexts that involve a diverse set of statutes and voluntary standards. In fact, some of these contexts are similar to RMP auditing.

In the preamble to the proposed rulemaking, EPA presented many examples of Federal and state agencies and trade association third-party verification programs. Like the RMP rule, some of those programs are expressly described by their managers as designed to improve regulatory compliance, prevent or reduce risks, or improve safety at the same or similar facility types and operations as are regulated by the RMP rule. These programs reflect industry recognition that third-party auditing does, in fact, produce better outcomes relative to self-auditing in a variety of settings. Such programs include: ^[44]

• Responsible Care. This program is described by ACC as identifying, and acting to address potential hazards and risks associated with their products, processes, distribution and other operations.^[45] Responsible Care's Guiding Principles include “mak[ing] continual progress toward a goal of no accidents, injuries or harm to human health and the environment from products and operations and openly report health, safety, environmental and security performance.” ^[46] The Responsible Care management system process includes mandatory certification, by auditors described by ACC as accredited and independent, to ensure the program participants have a structure and system in place to measure, manage and verify performance.^[47] The Responsible Care Web site provides, “A key part of the Responsible Care Management System process is mandatory certification by an independent, accredited auditor.” ^[48]

• The API Process Safety Site Assessment Program (PSSAP). According to API, the PSSAP “is focused on higher risk activities in petroleum refining and petrochemical facilities. This program primarily involves the assessment of a site's process safety systems by independent and credible third-party teams of industry-qualified process safety expert assessors.” ^[49] Using industry-developed protocols, API describes the process safety site assessments as evaluating the quality of written programs and effectiveness of field implementation for the following process safety areas that will be evaluated: Process Safety Leadership; MOC; Mechanical Integrity (focused on fixed equipment); Safe Work Practices; Operating Practices; Facility Siting; Process Safety Hazards; and HF Alkylation/RP 751.^[50]

• Center for Offshore Safety (COS). This strategy for promoting safety and protection of the environment includes third-party auditing and certification of the COS member company's SEMS and accreditation of the organizations (Audit Service Providers) providing the audit services. The Center serves the U.S. offshore oil and gas industry with the purpose of adopting standards of excellence to ensure continuous improvement in safety and offshore operational integrity. The third-party audits are intended to ensure that COS member companies are implementing and maintaining Safety and Environmental Management Systems (SEMS) throughout their deepwater operations.^[51] COS states expressly that “the highest level of safety for offshore drilling, completions, and operations [is promoted through] independent third-party auditing and certification.” ^[52]

• ChemStewards®. ChemStewards is a SOCMA program intended to promote continuous performance improvement in batch chemical manufacturing. The program offers a three-tiered approach to participation. Each tier includes a third-party verified management system.^[53] On its Web site, SOCMA describes the environmental benefits of the program as including improving environmental performance, decrease releases and waste disposal costs, and positioning members to meet current and future compliance requirements.^[54] The associated training materials explain the on-site audit elements of the third-party verification program.^[55]

Additionally, the supporting literature and data described by EPA in the proposed rulemaking preamble remain relevant to RMP compliance auditing, notwithstanding the varied contexts they describe, because such literature addresses cross-cutting human biases and behaviors, common to all auditor and audit types, that can be addressed or corrected through independent third-party auditing.^[56] EPA thus finds that the state of the science, evidence, and data on the effectiveness of independent third-party auditing programs supports requiring independent third-party audits for RMP facilities with accidental releases or conditions that could lead to an accidental release of a regulated substance.

k. Third-Party Audit Report

Draft reports. EPA received numerous comments regarding the proposed third-party audit reporting requirements. While no commenters objected to the requirement to prepare an audit report, most commenters opposed the proposed requirements to submit draft and final reports to the implementing agency. Many commenters felt that a requirement to submit draft reports before they have been vetted by internal operations and management teams could have the unintended consequence of incomplete or inaccurate information being distributed. Some of the commenters added that the owner or operator should be able to ensure that the audit report does not contain confidential business information. Finally, some commenters stated that the proposed requirement to document all changes made by the owner or operator to audit report drafts would chill communications and information exchange during audits.

EPA agrees with commenters. The final rule requires the third-party auditor to prepare an audit report and provide it to the owner or operator, but does not require that the draft or final reports be submitted to the implementing agency. However, the third-party auditor must summarize in the audit report any significant revisions between draft and final versions of the report.

Submitting reports to the implementing agency. Many commenters, including industry trade associations and facilities, objected to the proposed requirement that third parties submit their reports to the implementing agency at the same time, or before, the reports are sent to the source. These commenters felt that this would prevent facilities from being allowed to correct factual errors or present evidence that the auditors either missed or were not aware of, which could markedly change the audit's recommendations. Some commenters who opposed distribution of audit reports to the implementing agency warned of the potential release of confidential business information.

EPA agrees with commenters and deleted provisions that require the third-party auditor to submit audit reports to the implementing agency.

Attorney-client communications. EPA received several comments regarding the proposed limitation on claiming the audit report and related records as attorney-client communications or attorney work products. One commenter agreed with EPA that the audit report should not be protected from disclosure under the attorney-client privilege. Many commenters opposed EPA's proposal to prohibit companies from asserting attorney-client privilege and attorney work product privilege over third-party audits and related documents. The commenters argued that EPA lacked authority to do this and that these privileges are essential for purposes of legal representation. One commenter stated that attorney-client privilege is a long-established common-law rule of evidence, and asserted that any attempt to abrogate it across the board is likely a violation of the Sixth Amendment. Similarly, another commenter stated that the proposed limitations on attorney-client privilege seem contrary to due process and legal rights that should be afforded the owner or operators of the facility.

It remains EPA's position, as stated in the preamble to the proposed rulemaking, that with respect to the attorney work product privilege, the audit report and related records are produced to document compliance. Audit reports and related records are similar to other documents prepared pursuant to RMP rule requirements (e.g., process safety information, PHAs, operating procedures) and are not produced in anticipation of litigation. They are analogous to work or management practice records that show a regulated operation was performed. With respect to the attorney-client communication privilege, the third-party auditor is arms-length and independent of the stationary source being audited. The auditor lacks an attorney-client relationship with counsel for the audited entity. Therefore, in EPA's view, neither the audit report nor the records related to the audit report provided to the third-party auditor, including documents originally prepared with assistance or under the direction of the audited source's attorney, should be considered attorney-client privileged. Nevertheless, EPA recognizes that the ultimate decision makers on questions of evidentiary privileges are the courts. Therefore, this rule does not contain a specific regulatory provision prohibiting assertion of these privileges.

l. Findings Response Report, Timeframe, and Response to Audit Findings

EPA received several comments relating to the proposed requirement for the owner or operator to develop a findings response report within 90 days of receiving the final audit report, and to provide the report to the implementing agency and the owner or operator's audit committee of the Board of Directors. EPA also received comments opposing various aspects of the proposed requirements for findings response reports.

Timeframe. Some commenters supported these proposed requirements. One commenter urged EPA to shorten the required reporting from 90 days to 30 days, arguing that deficiencies in compliance indicate a risk of a catastrophic release that could harm the facility, its employees, and the community. The commenter reasoned that 30 days is enough time to review the audit report and develop a schedule to address deficiencies.

Other commenters objected to the proposed timeframe for preparing and submitting the findings response report, stating that 90 days provides for an insufficient timeframe for preparing the report. A few commenters recommended a six-month timeframe. One commenter asserted that EPA has not demonstrated that a 90-day period to develop a findings response report is achievable. As an alternative to extending the timeframe for all facilities, a few commenters urged EPA to consider allowing facilities to obtain extensions as needed to adequately address the concerns raised by third-party auditors.

EPA is finalizing the requirement that the owner or operator prepare a findings response report as soon as possible, but no later than 90 days after receiving the final audit report as proposed. EPA believes this timeframe is appropriate for the owner or operator to consider the findings of the audit report and determine a response to each of the audit's findings. This approach allows the owner or operator an opportunity to establish a schedule to implement corrective actions that can extend beyond the 90-day period for developing the findings response report and balances the need to promptly respond to the audit findings. EPA notes that, in many instances, an owner or operator may receive prior information about the audit's findings before receiving a final audit report, particularly when the third-party audit team includes facility personnel. This will give the owner or operator additional time to consider its responses.

Submitting findings response report to implementing agency. Some commenters opposed the proposed requirement to submit a findings response report to the implementing agency. One such commenter stated that EPA has not demonstrated a need for universal submission of an action plan to respond to audit findings and schedule. Commenters also expressed legal concerns about the findings response report. These commenters raised concerns about not being able to dispute purported violations or deficiencies identified by third-party auditors. Some commenters asserted that refusing to afford companies the opportunity to dispute audit findings raises fundamental due process concerns.

EPA agrees with the commenters and has eliminated the requirement to submit findings response reports to the implementing agency in the final rule. The audit report, findings response report and related records must be retained at the stationary source in accordance with the recordkeeping requirements in §§ 68.59(g) and 68.80(g).

Eliminating the requirement to submit the findings response report to the implementing agency also responds to commenters legal concerns. The owner or operator can determine an appropriate response to each of the audit report findings. This is similar to existing self-compliance audit requirements for the owner or operator to promptly determine and document an appropriate response to each of the findings of the compliance audit.

In addition, there is no need for a process to dispute findings as the relevant requirement in the final rule for each of the findings in the audit report is to determine an appropriate response. In determining an appropriate response, owners or operators may follow EPA's existing guidance for addressing PHA team findings and recommendations, which is based on OSHA's 29 CFR 1910.119, Process Safety Management of Highly Hazardous Chemicals—Compliance Guidelines and Enforcement Procedures for resolving such findings.^[57] Under these guidelines, EPA considers an owner or operator to have resolved a finding or deficiency when the owner or operator either has adopted or implemented the associated recommendations or has justifiably declined to do so. An owner or operator can justifiably decline to adopt a recommendation where the owner or operator can document, in writing and based upon adequate evidence, that one or more of the following conditions is true:

• The analysis upon which the recommendation is based contains material factual errors;
• The recommendation is unnecessary to protect public health and safety or the health and safety of the owner or operator's employees, or the employees of contractors;
• An alternative measure would provide a sufficient level of protection; or
• The recommendation is infeasible.

Where a recommendation is rejected, the owner or operator must communicate this to the audit team and expeditiously resolve any subsequent recommendations of the team. Provided that the owner or operator addresses the audit report's findings by implementing the findings or by justifiably declining to do so, the owner or operator complies with the requirement. If an implementing agency concludes that a justification is inadequate and brings an enforcement action regarding this requirement, then the owner or operator may dispute the enforcement action through the normal adjudication process.

m. Owner or Operator Certification to Findings Response Report

Certification burden. EPA received comments regarding the certification to the findings response report. A few commenters opposed the proposed certification requirement. Some commenters argued that the certification requirement increases the regulated community's burden, but provides no corresponding benefit. Other comments urged EPA to incorporate the “reasonable inquiry” concept from Title V compliance certifications into the proposed certification framework. These commenters described the “reasonable inquiry” concept as requiring certification based on “information and belief formed after reasonable inquiry.” The commenters argued that this was necessary because a senior official signing a certification could not be expected to have or obtain personal knowledge of all the facts potentially relevant to the findings response report. Similarly, a facility encouraged EPA to coordinate the certification statement in this rule with the certification statement that is already required under CAA Title V. One commenter stated that EPA's rules regarding self-audits impose a less stringent certification requirement, and recommended that a less stringent standard may be appropriate here, too, if the third-party compliance audit provisions are finalized.

In this rule, EPA is requiring a senior corporate officer, or an official in an equivalent position, to certify in the findings response report that:

• He or she engaged a third-party to perform or lead an audit team to conduct a third-party audit in accordance with the requirements of 40 CFR 68.59 or 68.80,
• The attached RMP compliance audit report was received, reviewed, and responded to under the senior officer's direction or supervision by qualified personnel, and
• Appropriate responses to the findings have been identified and deficiencies were corrected, or are being corrected, consistent with the requirements of subparts C or D of 40 CFR part 68.

EPA believes these requirements and the associated certification are consistent with equivalent certification requirements in many EPA regulations, including in the CAA Title V regulations (40 CFR 70.5(d).^[58] )

EPA agrees that senior corporate officials do not necessarily have high levels of technical expertise; however, these officials and entities include key managers responsible for establishing internal corporate accountability and overseeing corporate prioritization, budgeting, and operations. Indeed, the Security and Exchange Commission (SEC) requires other specified documents to be provided to such individuals, committees, and boards for similar reasons.^[59] Finally, EPA believes that the certification will minimize corporate failures to properly address and implement compliance audit findings and recommendations. Adopting a less stringent standard would not be appropriate. EPA expects that the senior corporate official certification of the audit findings will improve facility and public confidence that third-party audit report findings and recommendations are promptly and properly addressed.

Senior corporate officer or equivalent official. Comments were received requesting clarification of the terms “senior corporate officer, or official in an equivalent position.” Some commenters recommended that EPA incorporate the “responsible official” definition from the CAA's Title V operating permit program for major stationary sources which allows for certification by corporate leadership or a “duly authorized representative” appointed by corporate officials.

One commenter stated that the certification requirement risks infringing on the senior corporate official's Fifth Amendment privilege against self-incrimination. The commenter stated that the Supreme Court has held that the privilege protects against compulsory disclosures to the government when those disclosures have “the direct and unmistakable consequences of incriminating” the disclosing party, and concluded that the proposed certification requirement may compel precisely those sorts of disclosures. The commenter went on to state that the certification necessarily admits the existence of “deficiencies” which can only be interpreted as violations of the CAA and which could certainly be a significant link in a chain of evidence tending to establish guilt in a criminal case. One commenter also argued that the certification requirement raises First Amendment concerns by compelling speech that does not serve a sufficient government interest to avoid running afoul of the right to free speech because it is unclear what government interest the certification advances and the relevant section of the rule is not narrowly tailored to that interest.

EPA disagrees with this recommendation to allow delegation of the certification to a duly authorized representative. The certification indicates that the compliance audit report was received, reviewed, and responded to under the senior corporate officer's direction or supervision by qualified personnel. Similar to the requirement to submit the findings response report to the audit committees of the Board of Directors, a senior corporate official ensures accountability and overseeing corporate prioritization, budgeting, and operations.

Furthermore, the language of the certification cites the actions that are taken by the owner or operator pursuant to these requirements, and includes, among other things, a statement that based on personnel knowledge and experience, or inquiry of personnel involved in evaluating the report findings and or inquiry of personnel involved in evaluating the report findings and determining appropriate responses to the findings, the information submitted herein is true, accurate, and complete. This language is equivalent to the language in certifications that support submissions under Title V of the CAA. EPA continues to believe that it is important for a senior corporate official, or an official in an equivalent position, sign such a certification, ensuring that the owner or operator is aware of the findings and responses, and will be correcting the deficiencies, pursuant to these requirements. For smaller entities without corporate officials, the official in an equivalent position for purposes of this requirement may include the owner or operator, or designated representatives of the owner or operator, including facility manager, operations manager, or another official at or above that level. Regarding comments concerning self-incrimination in connection with the certification requirement, the certification does not contain an acknowledgement of a violation. It merely describes the actions taken by the owner or operator pursuant to the third-party audit requirements, and states that the information submitted is true, accurate, and complete. The certification and report are not required to be automatically submitted to the implementing agency.

n. Schedule Implementation

EPA received comments supporting the proposed requirement for owners and operators to “promptly” address deficiencies noted in audit reports. A few commenters stated that there should be no specific timeframe for addressing deficiencies identified during a third-party audit, reasoning that there will be a wide variety of possible site-specific actions that an owner or operator may take to address audit findings. Another commenter believed it was appropriate to require “prompt” correction of deficiencies, but encouraged EPA to provide guidelines on what would be considered “prompt” action.

Some commenters recommended specific timeframes for addressing deficiencies. One commenter recommended that deficiencies be corrected “promptly” and no later than six months absent a written extension from EPA. A few commenters recommended that facilities be required to promptly implement corrective actions and that deficiencies be addressed within 18 months. However, some of these commenters stated that facilities should be given the opportunity to request an extension, if needed, from the implementing agency. Another commenter recommended that facilities be given 24 months to correct deficiencies after the facility has identified an appropriate response, with the deficiencies presenting the highest risk of injury being addressed first.

One commenter recommended that EPA allow stationary sources to develop a reasonable schedule for correcting audit findings that would be based on the types of audit findings and the resulting efforts to implement them appropriately, rather than at a pace that may impede sound and sustainable implementation processes. One commenter stated that the proposal does not account for the likelihood that plans and schedules for addressing deficiencies may need to change. To account for needed changes, the commenter recommended that EPA should clarify that the details of the schedule are not binding.

EPA disagrees with commenters that suggested incorporating a prescribed schedule for addressing findings in the final rule and we are finalizing the schedule implementation provision of §§ 68.59(f)(2) and 68.80(f)(2) as proposed. The owner or operator's third-party audit findings response report must include “a schedule for promptly addressing deficiencies” but does not prescribe a specific timeframe or due dates by which the deficiencies must be addressed. Thus, under the final rule, the owner or operator must exercise best judgement to determine how, and when, to prioritize and address actions, consistent with the normal definition of “promptly” as meaning quickly, without delay.^[60] EPA finds that this approach best provides the flexibility owners or operators will need to address a potentially very wide range of deficiencies and other findings noted in third-party audit reports. This allows the facility owner or operator to develop a reasonable schedule for correcting audit findings that would be based on the types of audit findings and the resulting efforts to implement them appropriately.

EPA also disagrees with commenters' suggestions to request a schedule extension from the implementing agency. The implementing agency will not receive a copy of the final audit report or findings response report and therefore it is inappropriate to request an extension to address deficiencies identified in the findings response report. In the event that a schedule must change due to unforeseen circumstances, EPA recommends that the owner or operator document the reasons for the change and update the schedule to reflect revised dates.

o. Submitting Reports to the Board of Directors

EPA received comments both supporting and opposing the proposed requirement to submit the audit report to the audit committee of the Board of Directors. Those in support reasoned that it will make the Board of Directors aware of the deficiencies, and noted that the requirement will allow the Board of Directors the opportunity to properly budget for corrective actions.

Several commenters, including facilities and industry trade associations, opposed the proposed requirement to submit the audit report to the Board of Directors, arguing that it is generally unnecessary or inappropriate to do so. These commenters stated that the requirement would unduly constrain facilities that may have other processes to involve facility leadership in responding to findings from third-party audits. Similarly, an industry trade association reasoned that this requirement subverts company policy established under the rule's management provisions and that the program would be most effective if each company is allowed to determine the most appropriate chain of command and reporting. The commenter also warned that such a requirement could set a precedent for other regulatory programs, which could result in Boards of Directors receiving a deluge of technical information that they do not have time to address and that they are in no position to interpret.

One commenter recommended that EPA provide definitions for Board of Directors and audit committee to avoid ambiguity. The commenter also recommended that EPA specify a timeframe for this report to be submitted to the Board's audit committee. Furthermore, the commenter urged EPA to address how this requirement would be documented as completed or what documentation would be required to demonstrate that the owner or operator does not have an audit committee or comparable committee.

Boards of Directors and their audit committees play an important role in establishing internal corporate accountability and overseeing corporate prioritization, budgeting, and operations. EPA believes that providing the audit committee of the Board of Directors with third-party audit findings will ensure the committees and their Boards of Directors are aware of any deficiencies and have the opportunity to properly budget for any required corrective actions in a timely manner. EPA expects that this approach will improve facility and public confidence that third-party audit report findings and recommendations are promptly and properly addressed.

Therefore, the final rule requires the owner or operator to immediately, upon its completion, provide to the audit committee of the Board of Directors, or other comparable committee or individual, if applicable a copy of the:

• Findings response report; and
• Implementation schedule to address deficiencies identified in the audit findings response report.

EPA does not agree that we should define “Board of Directors” and “audit committee.” Facility owners or operators should consider their corporate structure to determine if there is, in fact, a committee or individual that may serve to oversee auditing and compliance oversight. The closing clause in §§ 68.59(e)(3) and 68.80(e)(3), “if applicable,” replaces the corresponding language in the proposed rulemaking, “if one exists.” “If applicable,” in this context, is intended to clarify that owners or operators not otherwise required by law to have an audit committee of the Board of Directors or that have not, otherwise, established or designated a comparable committee or individual, are not subject to the requirements in §§ 68.59(e)(3) and 68.80(e)(3).

Finally, in response to concerns about demonstrating compliance with this requirement, EPA recommends that the facility document how the owner or operator complied with this requirement and maintain that documentation with the findings response report. This may include identifying who received a copy of the report and the date it was provided. If there is no audit committee of the Board of Directors or a comparable committee or individual, then the owner or operator should consider documenting that no committee or individual exists.

p. Third-Party Audit Recordkeeping

Some commenters supported the proposed third-party audit recordkeeping requirements. However, some commenters opposed the requirement to retain copies of the draft audit report. A few commenters opposed the requirement that records be retained at the stationary source.

EPA agrees with commenters that opposed maintaining draft audit reports. Therefore, EPA is not finalizing the proposed requirement in §§ 68.59(e)(2) and 68.80(e)(2) for owners or operators to retain copies of all draft third-party audit reports. The final rule requires that the owner or operator retain as records certain documents at the stationary source, including the two most recent final third-party audit reports, related findings response reports, documentation of actions taken to address deficiencies, and related records. The final audit report must include a summary of any significant revisions between draft (if any) and final versions of the report.

The final rule also requires the owner or operator to retain records at the stationary source in order to ensure that records are readily available to stationary source staff to review and utilize and for implementing agency inspectors to access during site inspections. These documents may be retained electronically as long as they are immediately and easily accessible to the owner or operator and the owner or operator retains the signed original documents, where appropriate.

q. Other Comments

One commenter encouraged EPA to correct what it described as a grammatical error within §§ 68.58(a) and 68.79(a). Specifically, the commenter urged EPA to correct the plural reference to the owner or operator by changing the word “they” to “it” to make it clear that only one of the entities needs to conduct an audit.

EPA is not making this recommended revision. Both the owner and operator are responsible to evaluate compliance with the prevention program requirements of the rule and we do not believe that this language has been confusing. However, to clarify, we do agree that as long as the audit is performed, only one of the entities needs to have conducted the audit.

C. Safer Technology and Alternatives Analysis (STAA)

1. Summary of Proposed Rulemaking

EPA proposed to modify the PHA provisions in § 68.67 by adding paragraph (c)(8) to require certain industry sectors to conduct a safer technology and alternatives analysis (STAA) and to evaluate the feasibility of any inherently safer technology (IST) identified. EPA proposed to limit the requirement to owners or operators of facilities with Program 3 regulated processes in North American Industrial Classification System (NAICS) codes 322 (paper manufacturing), 324 (petroleum and coal products manufacturing), and 325 (chemical manufacturing).

In the proposed rulemaking, EPA specified that the STAA would consider, in the following order of preference:

• IST or inherently safer design (ISD),
• Passive measures,
• Active measures, and
• Procedural measures.

EPA further indicated that the owner or operator would be able to evaluate a combination of these risk management measures to reduce risk at the process.

EPA also proposed to add several definitions that relate to an STAA in § 68.3. EPA proposed active measures to mean risk management measures or engineering controls that rely on mechanical, or other energy input to detect and respond to process deviations. Some examples of active measures included alarms, safety instrumented systems, and detection hardware (such as hydrocarbon sensors).

EPA proposed feasible to mean capable of being successfully accomplished within a reasonable time, accounting for economic, environmental, legal, social, and technological factors. EPA further clarified in the definition that environmental factors would include consideration of potential transferred risks for new risk reduction measures.

For inherently safer technology or design, the proposed definition meant risk management measures that:

• Minimize the use of regulated substances,
• Substitute less hazardous substances,
• Moderate the use of regulated substances, or
• Simplify covered processes in order to make accidental releases less likely or the impacts of such releases less severe.

The proposed definition of “passive measures” meant risk management measures that use design features that reduce the hazard without human, mechanical, or other energy input. EPA provided examples of passive measures that included pressure vessel designs, dikes, berms, and blast walls.

Finally, EPA proposed procedural measures to mean risk management measures such as policies, operating procedures, training, administrative controls, and emergency response actions to prevent or minimize incidents. EPA sought comment on these proposed revisions.

2. Summary of Final Rule

After review and consideration of public comments, EPA is finalizing the STAA provision in § 68.67(c)(8), and related definitions in § 68.3, as proposed, with the following modifications:

• EPA is substituting the term “practicability” for “feasibility” in proposed § 68.67(c)(8)(ii) of the PHA requirements;
• EPA is substituting the term “practicability” for “feasible” in the definition in § 68.3 and substituting the phrase “the capability” for “capable,” while retaining the remaining definition as proposed; and
• EPA is revising the definition of “passive measures” by clarifying that these measures not only reduce a hazard but reduce the frequency or consequence of a hazard.

Significant comments on the proposed STAA provisions and related definitions are discussed in section IV.C.3 of this preamble.

3. Discussion of Comments and Basis for Final Rule Provisions

Many commenters from environmental advocacy groups and some state agencies expressed support for the proposal to require an STAA to improve process safety. However, some believed that implementation of feasible safer alternatives, particularly IST, should be required and that STAA requirements should apply to a greater universe of facilities and not just those in the chemical manufacturing, petroleum refining and paper manufacturing industries. Many commenters, mostly from industry, requested that EPA remove IST and design requirements from the rule entirely for a variety of reasons, or requested significant clarifications to applicability if the STAA provision is finalized.

As noted previously, except for substituting the term “practicable” for “feasible” and some other definition changes, EPA is finalizing the STAA provisions as proposed. We continue to rely on the rationale expressed in the proposed rulemaking. In the discussion that follows and in the Response to Comment document, we explain our consideration of the comments and our analysis and response.^[61]

We recognize there may be multiple, rational approaches to STAA. We determined that it was reasonable to require STAA for sectors that have had a high per facility incidence of reportable accidental releases and where the complexity and variety of methods of chemical handling demonstrate the potential for process safety revisions. We do this in part to balance potential accidental release rate reduction and cost. There are some sectors, such as water treatment, with known ISTs that we do not require to evaluate or implement ISTs under this rule. In the water treatment sector in particular, the sector's lower accidental release rates do not demonstrate that requiring thousands of facilities to conduct STAA would result in a significant drop in accidental releases.^[62] In contrast, even if some of the sectors we have identified for the STAA requirement already may have voluntarily undertaken an STAA approach (at least at new facilities), accidental release rates remain higher for these industries, technologies advance over time, and ensuring a minimum level of application of the STAA approach limits the disincentives for sector members to be leaders in adoption of safer technologies. We do not mandate the adoption of any IST found to be practicable in part because we recognize that a passive measure or other approach on the STAA hierarchy may also be effective at risk reduction; we continue to leave the adoption of particular accident prevention approaches to owners' and operators' reasonable judgment. We discuss other factors that have led us to select particular industries for STAA and particular requirements in our STAA approach in response to particular comments.

a. Legal Issues

Various commenters raised potential legal issues or challenges regarding the STAA requirements based on CAA authority, Congressional intent, deficient analysis or substantiation, vagueness of requirements, and jurisdiction.

Several industry associations and individual companies commented that EPA lacked the legal authority to require assessment of STAA in general and IST/ISD in particular. One argued that the authority for RMPs rests in subparagraph (B) of CAA section 112(r)(7), while the authority for design and equipment changes rests in subparagraph (A). Several argued that EPA did not adequately explain its change of position from the one adopted in the 1996 final RMP rule, which did not require the assessment or implementation of IST. In light of EPA's position that the 1996 final RMP rule and EPA's program implementation provided incentives to adopt IST, some argued that requiring STAA analysis without requiring implementation of changes would offer no new benefit to public health and safety; these commenters suggested that IST had been informally used already for decades where it was feasible. Another commenter said the STAA requirement could effectively ban certain chemicals without the authority to do so. Others noted that IST consideration would lead to increased liability issues for facilities because, even if a source was not required to implement IST by rule, should an accident happen, plaintiffs could cite the failure to adopt the IST in a court case. A commenter criticized the requirement as too amorphous to be meaningfully implemented and enforced in a non-arbitrary manner. Other commenters said IST is more properly within the authority of OSHA, that EPA's record did not reveal consultations and coordination with OSHA as required by CAA section 112(r)(7)(D), and that subsequent to the enactment of the 1990 CAA Amendments, Congress had denied both EPA and DHS the authority to require IST when it rejected bills requiring or authorizing IST.

In contrast to the comments discussed previously, a coalition of environmental, labor, community and other public groups, as well as a mass mail campaign, commented that EPA must adopt STAA in its final rule not only for NAICS codes we proposed but for all facilities where STAA is feasible. In the commenters' view, the proposed amendments are inconsistent with the statute's prevention objectives and its preference for measures that completely eliminate potential hazards because only certain sectors are required to undertake STAA while others only have requirements imposed after accidental releases. Additionally, the commenters argue that the authority to “make distinctions” among classes of facilities in CAA section 112(r)(7)(A) and to “recognize differences” among types of sources in CAA section 112(r)(7)(B) does not include the authority to exempt entire sectors from STAA; even if the statute gave such authority, EPA failed to explain how it is relying on that authority. Finally, the commenters contended EPA's action was arbitrary and capricious by failing to account for the significant value STAA could provide to facilities, workers, and communities by not only removing hazards but by saving money through removing potential liability and sometimes improving industrial efficiency.

EPA disagrees with the comments that the CAA does not authorize the STAA provisions of this final rule. Both subparagraphs (A) and (B) of CAA section 112(r)(7) authorize STAA and IST in particular. EPA cited all of paragraph (7) as authority for “[e]ach of the portions of the Risk Management Program rule we propose to modify.” 81 FR 13646, March 14, 2016.^[63] The authority section for 40 CFR part 68 references CAA section 112(r) and is not limited to particular paragraphs and subparagraphs. The proposed rulemaking also noted that subparagraph (A) had been invoked in the rulemaking petition on IST. Therefore, EPA provided sufficient notice that we contemplated action under any authority under CAA section 112(r)(7). Nevertheless, we also view that our authority to require STAA assessments or an IST review is consistent with subparagraph (B). Under subparagraph (B), EPA has broad authority to develop “reasonable regulations . . . for the prevention of accidental releases.”

Further support for IST can be found in both the Conference Report accompanying the 1990 CAA Amendments and the Senate Report explaining the provisions of the Senate bill that closely mirrors enacted provisions. In discussing the “Hazard Assessments” required by section 112(r)(7)(B), the Conference Report specifies that such assessments “shall include . . . a review of the efficacy of various release prevention and control measures, including process changes or substitution of materials.” ^[64] Conference Report at 340-41. The STAA analysis is such a review.^[65] The Senate Report identifies as “release prevention measures” many of the techniques that are now known as IST—substitution of less hazardous materials, reduction in the severity of the conditions of processing and complexity of the process, and decreasing volumes of chemicals in storage.^[66] Senate Report at 242. That subsequent Congresses did not enact additional legislation on IST is irrelevant to what was enacted and intended at the time of enactment.

The proposed rulemaking, 81 FR 13646, March 14, 2016, provided an extensive discussion of developments concerning IST since the 1996 final RMP rule. As we explained, EPA adopted a rule in 1996 that provided incentives for IST without a specific mandate to either conduct studies of IST or implement IST measures. From 1996 on, EPA has recognized that good PHA techniques will often identify opportunities to make new and existing processes and operation inherently safer. However, in the 1996 rule and thereafter, we also recognized that IST is not the only way to prevent accidents, and that sometimes IST can be impractical, especially for existing sources.

The STAA approach we adopt in this action places IST in a hierarchy that allows for sources to choose non-IST approaches to accident prevention, such as passive mitigation, active mitigation, and administrative controls. While the EPA did not, in 1996, expressly require facilities to analyze and implement IST specifically, this rule places IST in a set of options to be studied. EPA relies on sources making rational decisions once presented with STAA studies and selecting prevention approaches that optimize the cost of the measures taken and costs avoided (e.g., liability, operational efficiency, image). Such an approach is similar to the approach to energy assessments recently taken in the major source and area source boiler rules under CAA section 112(d) and affirmed in U.S. Sugar Corp v. EPA.^[67]

We acknowledge that many sources have conducted STAA analyses already. For these sources, the cost of implementing the new STAA requirement should be lessened. The requirement we promulgate in this rule captures those slower in considering IST in high accident industries rather than harms leaders. There are no specific chemicals banned by this final rule. While we recognize that companies have moved away from certain processes, such as those that involve the storage of large quantities of methyl isocyanate, in order to make facilities safer, we leave process design decisions to the reasonable judgment of owners and operators under this action.

EPA disagrees with the comments concerning IST being more properly within the authority of OSHA. It is plain from the history of the 1990 Amendments that both agencies were given authority to prevent accidents, and that Congress contemplated EPA adopting some IST measures as appropriate. Furthermore, EPA has a history of prior coordination with OSHA to define and promote STAA when developing the EPA and OSHA, Chemical Safety Alert: Safer Technology and Alternatives (EPA 550-F-15-003; June 2015).^[68]

Not only for STAA, but also for other provisions of this final rule, the record adequately reflects EPA's coordination and consultation with Department of Labor (DOL)/OSHA and DOT. As an initial matter, both DOL and DOT were part of the Working Group under Executive Order 13650. That order and report of the Working Group reflect consultation and direction regarding the development of the this final rule. Second, we note that EPA's decision to not consider the regulation of AN at this time explicitly is based on an effort to coordinate any potential regulatory requirements for this substance with actions contemplated by other agencies, including OSHA. Third, while the content of interagency deliberations are not for the record for judicial review under CAA section 307(d), multiple agencies have an opportunity to review a draft rule under Executive Order 12866 Regulatory Planning and Review. Finally, OSHA had representatives attend the SBAR panel which discussed the development of the proposed rulemaking. All of this is a matter of public record in the docket for this rulemaking.

Consistent with the structure of the RMP rule, EPA has placed IST among the methods a facility may choose to adopt to prevent accidents. Commenters who argue that we have failed to require accident prevention by not mandating the adoption of IST measures for all facilities wherever feasible fail to acknowledge that non-IST methods for preventing accidents may be reasonable in some circumstances. To the extent that these regulations are imposed under subparagraph (B), these regulations have an overriding requirement to be reasonable. While it is true that similar quantities of chemicals under the same conditions present similar hazards regardless of sector, various sectors present different likelihood of release. Some sectors handle chemicals differently under conditions that are more likely to lead to severe releases. The record reflects that the likelihood of severe accidents is greater in the sectors that must conduct STAA analysis under this final rule. Thus, it is reasonable to have different requirements for these sectors than for others. Independent of whether any new IST/ISD is adopted, there is a cost to conducting an STAA analysis. EPA has reasonably limited STAA analysis requirements to sectors that we view as most likely to likely to have more frequent, severe releases that are most likely to be benefit from STAA review. Inherent in our approach is distinguishing among classes and types of facilities. We expect that the adoption of STAA analysis requirements in this final rule will advance IST not only in the sectors targeted by the rule, but also more generally as experience is gained and opportunities for technology transfer are developed.

b. Applicability

Limiting applicability of STAA provisions. While some commenters supported EPA's proposal to limit applicability of STAA provisions to the petroleum refining, chemical manufacturing, and paper manufacturing sectors, other commenters objected to this aspect of the proposal. Many commenters, including a mass mail campaign joined by approximately 300 commenters, expressed concern that the proposed rulemaking arbitrarily determined which industries have feasible and worthwhile alternatives, and which communities and facilities would benefit from STAAs. These commenters asserted that limiting the requirement to certain industry sectors would exempt other sectors that pose a significant threat to the public. Commenters argue that focusing on accident rate to target sectors for STAA was not a credible way to forecast and prevent rare catastrophic events that tend to fall out of existing patterns.

Some commenters urged EPA to apply the STAA requirement to all sources, or all Program 3 sources. Other commenters, including another mass mail campaign joined by approximately 17,250 commenters, recommended that EPA require assessment and implementation of STAA for industries where safer alternatives are feasible or well demonstrated, such as water supply, wastewater treatment, power generation, food and beverage manufacturing, and others. Several other commenters indicated that EPA should apply the STAA provisions to facilities with the largest worst case scenario populations, or to the 2,000 high-risk facilities cited in EPA's 2017-2019 National Enforcement Initiative (NEI). A few commenters suggested that EPA implement a pilot program requiring IST implementation for a subset of sectors considered extremely high risk, such as wastewater or drinking water treatment plants, bleach plants, refineries using hydrogen fluoride and for those facilities among the 2,000 high-risk facilities cited in the EPA's NEI 2017-2019 proposal. A few commenters believe that the proposed STAA requirements have failed to address the disproportionate health and safety threats in communities of color and low-income communities, and want the STAA provisions to apply to all RMP facilities.

In this rule, EPA is finalizing the STAA provisions as proposed, which limits applicability of the STAA requirements to Program 3 processes in the petroleum refining, chemical manufacturing, and paper manufacturing sectors. EPA does not believe that the final provisions have been limited arbitrarily, or that the Agency's decision to limit applicability of the STAA provisions to the petroleum refining, chemical manufacturing, and paper manufacturing sectors implies that other sectors do not have viable safer technology alternatives. In the proposed rulemaking, EPA acknowledged that most RMP-regulated sectors could identify safer technologies and alternatives. However, the Agency proposed to limit the applicability of the STAA provisions to facilities in complex manufacturing sectors with high accident rates. EPA took this approach in order to target these provisions to the industrial sectors with the potential to achieve the greatest safety improvements through consideration of safer technology alternatives. EPA explained that sources involved in complex manufacturing operations have the greatest range of opportunities to identify and implement safer technology, particularly in the area of inherent safety, because these sources generally produce, transform, and consume large quantities of regulated substances under sometimes extreme process conditions and using a wide range of complex technologies. Therefore, such sources can often consider the full range of inherent safety options, including minimization, substitution, moderation, and simplification, as well as passive, active, and procedural measures. Further, EPA noted that RMP facilities in the three selected sectors have been responsible for a relatively large number of accidents, deaths, and injuries, and the most costly property damage.^[69] Facilities in these sectors also have significantly higher accidents rates as compared to other sectors.^[70] EPA agrees that there is no way to forecast rare catastrophic events; however, we believe it is appropriate to target sectors that have had a large number of accidents and have the greatest opportunity to identify safer technologies.

While EPA does not believe it is necessary to require all sources, all Program 3 sources, or all sources in industry sectors where feasible safer technology alternatives have been identified to perform an STAA, the Agency encourages such sources to consider performing an STAA, and to determine practicability of IST or ISD considered, even if they are not subject to the STAA provisions of the final rule.

EPA does not agree that only sources with large worst-case scenario populations, or only sources on EPA's high risk facility list should be required to comply with the STAA provisions. EPA believes it is not appropriate to apply the STAA provisions only to sources with specified worst case scenario populations for several reasons. First, EPA's OCA requirements allow regulated facilities to use any commercially or publicly available air dispersion modeling techniques, provided the techniques account for the modeling conditions specified in the rule and are recognized by industry as applicable as part of current practices. This flexibility can result in two similar facilities obtaining significantly different endpoint distances (and vulnerable zone populations) simply through choosing different modeling techniques. By linking the STAA requirement to the worst case scenario, EPA could inadvertently cause some facilities to recalculate their OCA using a different modeling approach, simply to avoid the STAA requirement, and without actually implementing process changes that might reduce the facility's worst case scenario. Second, linking the STAA requirement to large worst case scenario populations would effectively bias the applicability of the requirement to facilities in densely populated areas, and potentially exempt equally hazardous facilities in or near less densely populated communities. Third, this application of the STAA requirement would disregard the criteria that EPA has used in the proposed rulemaking—accident history and facility complexity, which EPA believes provide a stronger rationale for limiting the applicability of the requirement. In addition, EPA believes that targeting the STAA requirements to the larger and more complex processes will benefit minority communities, who are located closer to larger facilities with more complex chemical processes and who bear a larger portion of risk from chemical accidents. Lastly, distribution of worst-case scenario population information is restricted under the CAA, and this would effectively prohibit the public from knowing which facilities are required to perform an STAA.

For similar reasons, EPA does not agree with commenters' suggestions to develop a pilot program to apply to a subset of high risk facilities or to apply the STAA requirement to facilities on EPA's high risk facility list. This list is generated, in part, using worst case scenario population information (chemical quantities and accident history are also considered, although sector accident frequency is not), and therefore the list may not be publicized by EPA.

Apply to facilities using different incident rate methodology. Several commenters objected to EPA's methodology for selecting industrial sectors subject to STAA requirements using an incident rate based on the number of RMP-reportable accidents per facility in the industry sector. These commenters expressed concern that the proposal to require STAAs from only three NAICS codes is based on an incorrect approach to, and interpretation of, incident rates. An industry trade association commented that looking at the number of accidents per facility does not allow for direct comparisons as it does not account for the relative number of employees at a facility. This commenter argued that EPA should recalculate this value using the number of accidents per hours worked or the number of accidents per full time worker, and reasoned that such a calculation would be more consistent with the incident rate calculations conducted by the Occupational Safety and Health Administration (OSHA) and the Bureau of Labor Statistics (BLS). Another industry trade association remarked that EPA's methodology ignores not only the size of the facility but also the quantity of chemicals and the number of covered process units at a given facility. According to this commenter, upon normalizing the petroleum refining sector's accident rate to account for the number of process units and the diversity of facilities being compared, the accident rate for this sector is lower than for most other sectors. The commenter also expressed concern that EPA's proposal to subject this sector to the STAA requirement ignores the industry's significant recent safety improvements that EPA itself has noted in the NPRM, and that industries such as poultry processing have higher incident rates than petroleum refining or chemical manufacturing, even though these industries are not subject to the STAA requirement.

A trade association representing the paper manufacturing industry urged EPA to remove the STAA requirement for that sector. The industry trade association stated that paper manufacturing should not be considered a “complex” manufacturing process, and cited EPA's Technical Background Document ^[71] which, according to the commenter, does not categorize paper manufacturing facilities as “complex.” Additionally, the commenter remarked that the paper manufacturing industry has a much lower level incident risk than other sectors based on injuries offsite, and stated that of the roughly 15,000 offsite injuries mentioned by EPA, the paper manufacturing industry was responsible for only two. Citing Exhibit 6-4 of EPA's Regulatory Impact Analysis for the proposed rulemaking, the commenter asserted that the entire U.S. paper manufacturing sector has been responsible for the fewest offsite injuries out of any industrial sector over the ten-year study period. This commenter concluded that implementing the requirement for the paper industry would not enhance public safety, and that the industry has made significant strides to increase safety procedures in recent years.

Another commenter stated that EPA's use of routine incident rates in selecting industry sectors to conduct STAAs was faulty because frequent smaller incidents cannot be used to reliably predict infrequent catastrophic events.

EPA acknowledges that there were other possible methods of selecting industry sectors that would be subject to STAA requirements. All of the methods offered by commenters—normalizing accident rates by FTE, number of process units, chemical quantities, etc.—were considered but ultimately rejected by the Agency. EPA does not believe normalizing accident rates by FTE or chemical quantity is appropriate because prior research has shown that the interaction between these factors and incident rates is complex, and that none of these variables, by itself, is a suitable proxy for the relative risk of a catastrophic chemical release incident at a facility.^[72] Likewise, selecting industry sectors for applicability of the rule's STAA provisions using an approach similar to that used for OSHA personal injury statistics (e.g., OSHA lost workday injury and illness rates) would not identify sectors with higher chemical process risks. These OSHA rate data generally scale directly with the number of employees because most of the incidents measured in these metrics involve single-person injuries (e.g., overexertion, sprains and strains, slips, trips, falls, injuries due to contact with objects and equipment, etc.).^[73] In other words, facilities with more employees are more likely to suffer higher amounts of these “lost workday” injuries, but not necessarily higher numbers of chemical release incidents.

Furthermore, EPA chose not to normalize accident rates by the number of process units for two reasons. First, regulated sources have significant discretion in determining covered process boundaries—some petroleum refineries and large chemical manufacturing facilities containing numerous unit process operations have chosen to consider their entire plant as a single covered process, while other similar plants have divided their stationary source into dozens of different covered processes. Therefore, normalizing accident rates by the number of processes could result in a less accurate reflection of a sector's historical accident propensity. More importantly, even if a higher accident rate at a large facility is due, in part, to the facility having more covered processes, that fact does not reduce its risk to the surrounding community. For the community, it is the frequency of accidents at its neighbor that matters, not the rate per process. In fact, the relatively higher likelihood of accidental releases at such sources further warrants their consideration, and potential application, of safer alternative technologies.

EPA disagrees that its approach ignores recent safety improvements on the part of the petroleum refining sector. The Agency views the application of safer technology alternatives as an approach to hazard control that can be applied throughout the life-cycle of a facility. A facility's recent implementation of a safer technology alternative does not foreclose consideration of additional safer technologies in the future. Facilities that have already implemented safer technology alternatives should document their implementation in their next PHA, determine whether there is additional information that should be considered in their STAA, and continue to consider additional safer alternatives during subsequent PHA re-validation cycles.

EPA agrees that the poultry processing sector, when that sector is considered separately from other food and beverage industry sectors, has a slightly higher RMP facility incident rate than the petroleum refining sector. However, EPA did not include the poultry processing sector under the final rule STAA provision because the poultry processing sector, by itself, does not delineate a meaningful technological subgrouping of RMP facilities. Poultry processing facilities are just one of many different types of food and beverage manufacturing and processing facilities covered under the RMP regulation. The common technology among these facilities that results in their coverage under the RMP regulation is ammonia refrigeration. While EPA is aware that some RMP facilities in the poultry processing sector have had serious chemical accidents, the Agency does not believe that these accidents are usually related to the fact that these facilities process poultry. Rather, they generally relate to the design, maintenance, or operation of the ammonia refrigeration system at the facility, and are similar to the causes of accidents involving ammonia refrigeration systems at other types of food and beverage processing facilities. Therefore, when considering the accident rates of RMP-covered poultry processing facilities, EPA believes the proper approach is to combine RMP facilities in this sector with RMP facilities in all other sectors in the food and beverage industry, as indicated in the RIA for the final rule.^[74] When this is done, the accident frequency for the food and beverage manufacturing sector is significantly lower than the accident frequency for the petroleum refining sector.

EPA disagrees with the commenter that argued the paper manufacturing sector should be exempt from the STAA provision of the final rule because the sector has had fewer accidents with offsite injuries, or because the sector was not characterized as “complex” by EPA's economic analysis. While it is true that the paper manufacturing sector has had fewer accidents with offsite injuries than other sectors, this is partly due to the relatively small number of RMP facilities (70) in the paper manufacturing sector. Additionally, the great majority of the offsite injuries reported by RMP facilities resulted from a single accident at the Chevron Richmond refinery, therefore it is inappropriate to compare offsite injuries from the paper manufacturing sector to the total of all offsite injuries that occurred during the ten-year period analyzed.^[75]

More importantly, offsite injury is only one of several types of accident consequences that require reporting under the RMP rule. Other reportable consequences include deaths, injuries, and significant property damage on-site, and known offsite deaths, evacuations, sheltering-in-place, property damage and environmental damage. When all RMP-reportable accident consequences for a sector are considered, and normalized by the number of sources in the sector, the paper manufacturing sector has the second highest accident rate among all sectors regulated under the RMP rule. EPA believes this approach is a better gauge of the historical accident propensity for a sector than considering only accidents with offsite injuries.

While it is also true that EPA did not characterize the paper manufacturing sector as “complex” in the Technical Background Document ^[76] and for estimating the costs of most rule provisions within the RIA, it did do so for purposes of the STAA provision, and arguably could have done so for all rule provisions. Paper manufacturing facilities, and particularly large integrated pulp and paper mills, are clearly more complex than most other RMP facilities, which only involve chemical storage (e.g., agricultural ammonia distribution facilities) or simple chemical processes (e.g., water treatment). The main purpose for EPA's broad characterization of certain sectors as “complex” and all others as “simple” for certain rule provisions within the RIA was because the Agency judged that the cost of implementing those rule provisions would vary primarily by the complexity of the processes involved, and that a rough two-tier division of regulated sources (e.g., simple vs. complex) would suffice to establish cost estimates for those rule provisions. However, EPA did not use this two-tier division for purposes of estimating the costs of the rule's STAA provision. For the STAA provision, EPA included paper manufacturing as a sector that involves “complex manufacturing operations.” EPA chose to apply the STAA requirement to sources involved in complex manufacturing operations because these sources have the greatest range of opportunities to identify and implement safer technology, particularly in the area of inherent safety. These sources generally produce, transform, and consume large quantities of regulated substances under sometimes extreme process conditions and using a wide range of complex technologies. For more information, see the preamble discussion in the proposed rulemaking at 81 FR 13688, March 14, 2016.

EPA disagrees that the agency used “routine” incident rates to select industry sectors covered by the STAA provision. Accidents meeting EPA reporting criteria include accidental releases from covered processes that result in deaths, injuries, and significant property damage on-site, and known offsite deaths, injuries, evacuations, sheltering-in-place, property damage and environmental damage. EPA believe that such accidents generally either resulted in, or could reasonably have resulted in, a catastrophic release of a regulated substance, and are therefore an appropriate criterion to consider when identifying industrial sectors that may benefit public safety the most by analyzing safer alternative technologies.

Eliminate or exempt batch toll chemical manufacturers. In the context of exempting batch toll processors from the STAA provision, some commenters recommended that processes governed by government agency specifications or through a contractual relationship with a customer should not be subject to the STAA provision because in these cases, the customer specifies the manufacturing process. According to one commenter, the customer is subject to regulation, often from the FDA or EPA. An industry trade association requested that EPA explicitly state in the body of the regulation that the STAA requirement would not apply to processes in whole or in part specified by a government agency or through any contractual obligation.

EPA disagrees with the suggestion to exempt batch toll manufacturers from the STAA requirement. Safer technology alternatives include many options beyond chemical substitution. For example, IST could involve minimization of stored raw material chemicals, making process changes that make it less likely to release the chemical (moderation), or reducing complexity in the process in order to make accidents less likely (simplification). Therefore, even where a contractual relationship or regulation requires a regulated batch toll manufacturing facility to use a particular regulated substance in specified quantities, owners and operators of batch toll manufacturing facilities should still consider other potential IST measures besides chemical substitution. The facility must also consider potential safer alternatives beyond IST, such as passive measures instead of or in combination with active measures, or active measures instead of procedural measures. Toll manufacturers may use RMP chemicals for purposes in addition to making a formulated product, such as for cleaning equipment, wastewater treatment or refrigeration, for which chemical substitution may not be prohibited by regulation or contractual relationship. Also, the final rule does not require regulated sources to implement IST or ISD considered, so there is no conflict between this final rule and other regulations that may apply to RMP-regulated facilities subject to STAA requirements. For example, an owner or operator would be in compliance with the STAA requirement to consider potential chemical substitution as part of the analysis if he or she determines that a chemical substitution is not practicable because the substitution is prohibited by another regulation The owner or operator would still need to consider other types of IST (minimization, moderation, or simplification), and passive, active, and procedural measures in the analysis.

Applicability to water treatment facilities. Some commenters, including professionals and a mass mail campaign joined by approximately 300 commenters, urged that water supply and wastewater treatment facilities should be subject to the proposed STAA provision. A number of commenters expressed concern about threats posed by water and wastewater facilities and related operations. Several commenters asserted that technologically and economically feasible alternatives are available for water supply and wastewater treatment facilities, and suggested that exploring the implementation of these alternatives would be beneficial for the safety of workers, personnel, and communities associated with the facilities. One commenter stated that the costs for water facilities to convert to safer alternatives are feasible, and remarked that it is possible to adopt IST without disrupting operations.

Alternatively, a few industry trade associations and government organizations stated that STAA should not be applied to water facilities citing that any STAA requirement would be repetitive and counterproductive and that drinking water utilities already have to consider a variety of public health and safety factors under the Safe Drinking Water Act (SDWA).

EPA disagrees with commenters who suggest subjecting water and wastewater treatment facilities to STAA requirements. EPA's approach to applying the STAA requirement was to identify industry sectors with the greatest accident frequency at RMP-regulated facilities within the sector, and with the greatest opportunity to apply STAA risk management measures. While EPA agrees that water supply and wastewater treatment facilities often have feasible alternatives available, according to RMP accident history data, the sector is among the least accident-prone sectors covered under the risk management program. Therefore, the final rule does not apply the STAA requirement to the water and wastewater treatment sector. EPA acknowledges that drinking water utilities already may have considered alternative technologies for their disinfection process while addressing safety and health considerations, risk tradeoffs and compliance with the SDWA.

Limit applicability to major process changes or after accidents. A few commenters want EPA to consider having a requirement similar to that required by Contra Costa County for facilities to conduct an STAA whenever major process changes are proposed and in the aftermath of accidents, when there are often significant opportunities for making process improvements as equipment is rebuilt or repaired. One commenter noted that the CCHS program requires an ISS analysis during the design of new processes, for PHA recommendations, or for major changes resulting from incident investigation recommendations, root cause analysis or MOC review that could reasonably result in a major chemical accident or release. This commenter noted that California's proposed refinery regulations are following the same requirements as the CCHS program. Other commenters recommended that instead of requiring STAA analyses at least every five years in conjunction with the a PHA revalidation, EPA should require the analysis only after accidents.

Another commenter recommended modifying the wording in section 68.67(c)(8) to limit the provisions to new processes or major modifications to existing processes. The commenter also remarked that stationary sources' management of change (MOC) programs should be updated to account for process changes and allow for reassessment of the IST analysis. The commenter concluded that this will ensure that existing IST components are not removed, replaced, or changed without revalidating the IST feasibility criteria.

EPA disagrees that the STAA requirement should be triggered only by a major process change. While the Agency acknowledges that a major process change could be an opportune time to evaluate safer technology alternatives, the Agency is concerned that requiring STAA reviews only after major process changes could result in some processes rarely or never being evaluated for safer technology alternatives. This could occur if few or no major changes occurred during the life of the process. Also, limiting the STAA to only major process changes could create a disincentive to upgrading processes if facilities chose not to make improvements to avoid having to perform an STAA. EPA is also concerned that there is no common definition or understanding of the term “major process change” that could easily be applied to the wide range of processes affected by the STAA requirement. Therefore, while EPA agrees that integrating STAA reviews into a facility's MOC program (and other prevention programs) may often be beneficial, the Agency believes it is appropriate to incorporate the STAA provision into the PHA section of § 68.67, rather than the MOC section of § 68.75. Nevertheless, EPA encourages owners and operator to also consider safer technology alternatives whenever major process changes are planned.

EPA is revising the PHA requirements in § 68.67 to require that the PHA address findings from incident investigations as well as any other potential failure scenarios. Other potential failure scenarios may include those introduced from major process changes or new designs or those discovered as a result of an accident investigation. Thus, EPA believes that the PHA with its requirement to encompass IST review as part of the PHA process, would cover the same process changes whether they result from an incident investigation, MOC action or other process change.

Finally, EPA disagrees that the STAA requirement should be triggered only by accidental releases. Although the Agency agrees that accidental releases may indeed signal to the owner or operator that safer technology alternatives should be considered, the Agency prefers that owners and operators evaluate safer technologies before accidents occur, with the aim of ultimately preventing such accidents. Also, similar to the Agency's objection to requiring STAA reviews only after major process changes, requiring an STAA only after an accident would mean that many processes subject to this provision may never undergo an STAA.

Limit applicability of STAA requirements to the design phase of a process. Several commenters, including industry trade associations suggested that EPA should not require STAAs for existing facilities or processes. Numerous commenters, including facilities, industry trade associations, local agencies, and a Federal agency, stated that an STAA is more appropriate during the design phase of a new process or facility, or during significant modifications. Some commenters, including a local agency, encouraged EPA to require STAAs to consider the highest level of hazard control (referring to the “hierarchy of controls”) that is feasible during the design phase or whenever a facility makes a change. Another commenter stated that adding a new regulatory requirement, particularly for existing operations, is unnecessary to address inherently safer design, and that safer technology reviews should not be part of a PHA.

In contrast, other commenters urged that safer technologies analyses are an ongoing need and should not be limited to new facilities. A state agency and an individual urged that IST should be performed for all new projects, processes, or stationary sources throughout various phases of a project's life cycle. According to the commenter, performing a separate IST analysis for the entire existing process approximately every five years allows evaluators to see the big picture rather than just the minute details associated with a typical PHA process.

EPA disagrees that STAA analyses should only be required during the initial design phase of a facility. While the greatest potential opportunities for using IST occur early in process design and development, many IST options may still be practicable after the initial design phase. Furthermore, STAA involves more than just IST. Safer technology alternatives also include passive measures, active measures, and procedural measures, and these measures can be modified and improved after the initial design of a facility. EPA notes that many RMP-regulated facilities were originally constructed decades ago, yet major enhancements have been reported in some plants that have been operating for many years.^[77] CCPS explains that inherently safer strategies can be evaluated throughout the lifecycle of a process, including operations, maintenance and modification, and EPA agrees with this approach.

Lastly, EPA disagrees that the PHA is not an appropriate risk management program element in which to integrate the STAA. EPA believes that safer technologies can and should be evaluated during the full life-cycle of a covered process, and the PHA is the fundamental and recurring risk management program element concerned with overall analysis and control of process hazards. By integrating the STAA with the PHA, every process subject to the provision will undergo an STAA, every five years. EPA believes that five-year revalidation will give the owner or operator the opportunity to identify new risk reduction strategies, as well as revisit strategies that were previously evaluated to determine whether they are now practicable.

Owners and operators of new construction facilities that will be subject to the RMP rule should consider performing the STAA portion of their initial PHA well enough in advance of facility construction so that the full range of inherently safer designs is considered, and include this evaluation in the initial PHA for the process.

c. Definitions

Feasible definition. Many commenters, including a facility, several trade associations and an environmental advocacy group, remarked that EPA did not sufficiently explain any of the five factors (“economic, environmental, legal, social and technological”) for facilities to consider in the proposed definition of “feasible,” and asserted that the examples provided by EPA are unhelpful and vague. The commenters argue that the proposed rulemaking does not provide sufficient guidance on the feasibility component of the STAA review. As such, the commenters conclude that these factors are so expansive and vague that they do not provide any clear guidance as to how feasibility of IST should be determined, and therefore have no place in the RMP rule. According to one commenter, even if the five measures are properly defined, they do not address the full range of issues in the operational life of a project rather than just the processing phase.

A mass mail campaign joined by approximately 300 commenters warned that “accounting for” these factors could be used as an excuse to avoid necessary implementation measures.

An industry trade association said that it does not want EPA to elaborate further on the proposed STAA requirement. One commenter stated that it would be very subjective and difficult to prescribe in regulations what is “feasible” for a facility and that any “one-size fits all” approach to process safety would limit employers' ability to react to real facts on the ground. In regards to incorporating ISTs into safety programs, the commenter asserted that only facility operators know whether IST is appropriate given the complexities of their unique operating environments, and no one program will work for all facilities.

EPA believes that the same tools and methods that facilities currently use for their PHA can be used to identify and measure hazards and risks of any safer alternative options. Further explanation of the economic, environmental, legal, social and technological factors included in the “practicability” definition of this final rule can be found in NJDEP's Guidance for Toxic Catastrophe Prevention Act (TCPA)-Inherently Safer Technology (IST) Review, Attachment 1 Feasibility guidance.^[78]

EPA did not define the various factors, such as “economic” or “social” used in the proposed definition of “feasible” or in the revised term “practicability.” The examples in the proposed rulemaking preamble are taken from the guidelines provided by CCPS, and are not exclusive of other situations. EPA believes that the definition of “practicability” in the final rule provides sufficient flexibility for the owner or operator to determine whether an IST or ISD considered could be successfully accomplished. EPA does not believe that we should further define “economic or social factors” in the rule because further specificity of these terms would likely be too prescriptive and would not encompass all the possible conditions and outcomes that might be encountered when determining the practicability of an IST or ISD considered in the STAA. EPA expects that facility owners and operators will use their expertise and make reasonable judgements when considering the appropriate meaning of economic or social factors so that any decisions regarding possible implementation of IST is not driven towards changes that would cause unintended adverse consequences.

Finally, EPA disagrees with commenters' assertion that accounting for the factors in the definition of “practicability” could be used as an excuse to avoid necessary implementation measures. EPA is not requiring IST or ISD implementation in the final rule and, therefore, further clarifying the practicability definition will not impact IST or ISD implementation.

Consistency of feasible definition with other programs. A commenter encouraged EPA to incorporate the definition of “feasibility” provided in the Contra Costa County Safety Program Guidance Document. Another commenter stated that the proposed definition of “feasibility” is consistent with California's proposed California Accidental Release Prevention (CalARP) regulations and the Contra Costa County and the City of Richmond's Industrial Safety Ordinances. However, a state agency, commented that there is an inconsistency with CalARP's definition of “feasible” in that the proposed EPA definition omits the terms “health” and “safety,” and the commenter encouraged EPA to add these terms to the list of factors to consider in a determination of feasibility.

EPA based the feasible definition on the CCHS definition of “feasible” but modified the definition to add language acknowledging that environmental factors include a consideration of the potential to transfer risks or introduce new risks to a process or source. The practicability definition in the final rule maintains this language.

EPA disagrees with the suggestion to add the terms “health” and “safety” to the definition. The primary reason for EPA to consider ISTs in a STAA is to reduce risks to health and safety of the public by mitigating the frequency and severity of accidental releases. EPA believes this is adequately addressed in the definition of “inherently safer technology or design” of this final rule and including these factors in the definition of “practicability” would be redundant.

Suggested revisions to feasible definition. One commenter argued that the term “within a reasonable time” in the definition of “feasible” could allow facilities to avoid implementation, and urged EPA to exclude a time based factor from the final definition. This commenter also argued that EPA should not make any level of cost, no matter how minimal, an excuse to not implement any IST measures, but rather should recognize that IST measures should be implemented unless doing so would cause an extremely serious adverse economic effect, such as a facility shutdown. A facility noted that the proposed feasibility analysis does not allow sufficient time to complete the necessary work and recommended that the timeframe be determined on a case by case basis. A state agency commented that the feasibility of an IST must consider factors such as timeliness of implementation and costs. This commenter expressed concern that the definition of “feasible” would allow for the implementation of IST options that may not be economically justifiable compared to other equally protective options.

Some commenters recommended deleting the explanation of environmental factors in the feasible definition. These commenters warned that this language is too specific in comparison with the general terms included in the definition. One commenter expressed concern that the language shows an industry bias and suggested using the following alternative definition: “Feasible means capable of being successfully accomplished within a reasonable time, accounting for economic, environmental, legal, social, and technological factors weighed against the immediate and long-term benefits to safety and health. A claim of infeasibility shall not be based solely on evidence of reduced profits.”

EPA disagrees with the commenters. Cost is a consideration when determining whether a risk management measure can be successfully accomplished and because EPA is not requiring implementation of any IST, we see no reason to exclude this factor from a practicability determination. EPA also disagrees with the suggestion to limit consideration of reduced profits when assessing a risk management measure because the Agency believes that cost is a valid consideration for practicability. Identifying an amount of an allowable cost for an IST is not something that can be prescribed in the regulation because cost decisions are highly dependent on the economics involving a particular process, facility and industry.

EPA also disagrees that incorporating consideration of a reasonable timeframe will allow facilities to avoid implementation. EPA is not requiring IST implementation and we acknowledge that there may exist practical limits on whether some projects or process designs can be done to enhance safety. If a risk management measure cannot be accomplished within a reasonable time, then the facility should ensure that other safeguards are in place to prevent accidents instead of relying on the uncertainty of completing a long-term project that is dependent on future conditions such as process design, operating budgets, etc.

Finally, as other commenters have noted, some ISTs involving chemical substitution or significant process redesign can result in new hazards or risks being introduced, and these should be considered when deciding the practicability of an IST. Thus, EPA is retaining the explanation of environmental factors in the practicability definition in this final rule.

Definition should be stronger than OSHA definition of “feasible.” One commenter urged EPA to adopt a definition that is stronger than or at least as protective of health and safety as the OSHA definition of “feasible” to provide an appropriate minimum level of protection under CAA—42 U.S.C. 7412(r)(7) that EPA should not go below. The commenter states that under the OSHA standard, a protective measure is technologically feasible if, using existing technology or technology that is reasonably expected to be developed, a typical facility could achieve the standard in most operations most of the time. Additionally, the protective measure is economically feasible if its costs do not threaten the existence or competitive structure of an industry. The commenter contends that OSHA's definition has been interpreted by courts to mean that the mere expense of a measure, alone, cannot trump the implementation of safety measures that are “capable of being done.” The commenter believes that EPA should not set a weaker definition that would make it less likely that IST or other prevention measures would be implemented under § 7412(r) than under OSHA's definition. Doing so would be both inconsistent with the objectives of § 7412(r) to protect the public and with the existing framework facilities follow under OSHA requirements, could lead to confusion for facilities and in the courts, and result in an overall reduction in safety measures.

EPA disagrees with the commenter and believes the approach in the final rule to consider the practicability of IST or ISD considered is consistent with the intent of CAA and will not lead to an overall reduction in safety measures. The current rule already requires the PHA to consider active, passive and procedural risk management measures in § 68.67; however, the requirements do not prescribe exactly which type or exactly what engineering and administrative controls must be implemented. The regulations allow facilities to use their specific knowledge and expertise of the process to meet the PHA requirement to “identify, evaluate and control the hazard” [emphasis added]. EPA is finalizing a requirement for certain sectors to conduct a STAA that also considers IST in the hierarchy of controls. However, requiring facilities to implement IST instead of using passive, active or procedural safeguards can involve extensive and very expensive changes to a facility's process, depending on the IST, especially if it involves substitution of alternative chemicals and/or major process redesign. EPA believes that a practicability consideration should address whether an IST or ISD can be accomplished technologically, is economically possible, does not result in an increase in hazards or other risks that cannot be controlled, or cannot be successfully accomplished because of other considerations. Therefore, EPA disagrees that the practicability definition should be stronger than (or even similar to) OSHA's interpretation of feasible.

Harmonize feasible definition with OSHA. A facility noted that the proposed definition of “feasible” in § 68.3 could cause the potential for confusion because the proposed rulemaking preamble states that OSHA has indicated that it would be unable to adopt the term feasible, as defined in this notice, under its PSM standard if OSHA considers similar revisions involving IST. This is an illustration of the need to harmonize the requirements of EPA RMP requirements with that of OSHA PSM.

A few commenters, including facilities and industry associations, urged harmonization with OSHA's definition of “feasibility” and requirements. A facility and an industry trade association warned of the confusion that could ensue if “feasibility” is defined inconsistently between EPA and OSHA, and encouraged EPA to use the term “practicability” instead. Similarly, an industry trade association urged EPA to use the term “practical” in place of “feasible.” The industry trade association argued that what is deemed feasible is often not practical for a number of reasons, and asserted that any decision to alter a technology involves a complex variety of factors such as operating costs, associated risk, energy consumption and greenhouse gas emissions. The commenter concluded that only facility owners should ultimately be able to define what is feasible or practical for their facility. In contrast, a state agency encouraged use of the term “feasible” rather than “practical.” An industry trade association asserted that neither term should be the basis for the analysis.

EPA agrees with commenters and is revising the rule to replace the term “feasible” with “practicability.” EPA proposed to use the term “feasibility” as part of the STAA analysis as it is already widely used in the technical literature discussing IST. However, because OSHA is considering similar revisions to its PSM standard involving IST and in order to eliminate the potential for confusion of different meanings of the term “feasible,” ^[79] EPA has decided to use the term “practicability” while retaining the same definition and meaning used for “feasible” in the proposed rulemaking.

Hierarchy of controls. A commenter noted that California's proposed regulations for refineries and EPA's proposed regulations would require that the facility look for inherently safer means to reduce the hazards, but if there is not a means to reduce the hazard, the facility would go through a hierarchy of prevention methods and select the highest level of prevention. This commenter and another requested that EPA use the term “Hierarchy of Control,” which is a term that is already understood, instead of adding a brand new term.

EPA does not use the term hierarchy of control (nor substitutes a new term for it) but instead explicitly explains the concept in the regulation by stating that the owner or operator shall consider risk management measures in the following order of preference:

• Inherently safer technology or design,
• Passive measures,
• Active measures, and
• Procedural measures.

EPA believes this is consistent with proposed CalARP regulations ^[80] for Hierarchy for Hazard Control Analysis, which require refineries to eliminate hazards using first order inherent safety measures; to reduce any remaining hazards using second order inherent safety measures; and to address any remaining risks in the following sequence and priority by using passive safeguards, active safeguards, and procedural safeguards.

Passive measures. A commenter recommended revising the definition of “passive measures” to “mean risk reduction measures designed to reduce the probability or the consequences of an accidental regulated chemical release without human intervention” to better reflect that EPA probably meant “reducing the hazard” as an aspect of risk management. The commenter views “hazard” as the inherent capacity of a substance to cause an adverse effect, while “risk” is the probability that an adverse effect will occur, if one uses OSHA's definition of the terms. In addition, the commenter said that the definition of “other energy inputs” needs revision, and suggested replacing the phrase “energy inputs” with “human intervention” to meet the intent of the definition. This commenter expressed concern that the word “other” in the phrase “other energy input” mischaracterizes pressure vessel designs, dikes, etc. as energy inputs. This commenter also suggested that passive “design features” could include mechanical or energy intervention measures and the commenter cited examples such as automatic fire suppression systems and automatic vapor ignition.

EPA agrees with the commenter's suggestion to revise the definition of “passive measures” to address the frequency and consequence of the hazard. EPA based the proposed definition of “passive measures” on the definition used by CCPS, which defined “passive” as “minimizing the hazard through process and equipment design features that reduce either the frequency or consequence of the hazard without the active functioning of any device, i.e., providing a dike wall around a storage tank of flammable liquids.” ^[81] Thus the intent of the CCPS definition appears to be on aspects of both hazard and risk reduction. EPA is modifying the “passive measures” definition in the final rule to clarify that passive measures reduce the frequency or consequence of the hazard.

EPA disagrees that the word “other” in “other energy inputs” characterizes pressure vessel designs and dikes as energy inputs and also disagrees that passive design features would include automatic fire suppression systems or automatic vapor ignition (in which a flare is ignited). These types of measures would most likely be considered to be active measures. CCPS, in their Guidelines for Hazard Evaluation Procedures,^[82] cites a fire protection system as an active safeguard because a fusible link or other engineered device must function to successfully trip the system.

IST/ISD. A number of commenters, requested clarification on the definition of IST, ISD or Inherently Safer Measures. A few wanted clarification as to what would qualify as “safer” in this context. One labor union expressed general support for the proposed definition of IST. One commenter asked EPA to ensure that there is a distinction between IST and less effective controls and management methods. This commenter argued that chemical substitution and process changes are the most effective methods to protect workers and the public from incidents and that these “inherently” safer options should be distinguished from less effective controls and management methods. The commenter cited lesser effective controls from the NJDEP IST compliance, such as safer extremely hazardous substance risk location, protection of storage vessels from weather conditions, changes in truck traffic patterns, addition of EHS leak detectors, use of closed circuit television systems, labeling of valves and equipment, revising procedures, installing a simulation training station, and adding light towers for EHS leak alarms. The commenter requested that EPA develop a precise definition for IST and Inherently Safer Design (ISD).

EPA disagrees with the commenters' suggestions to provide a distinction between IST and other controls and management methods. EPA believes that determining effective risk management strategies for a facility is a site-specific determination and EPA encourages any improvement that will could lead to inherently safer conditions. Therefore, EPA is finalizing the definition of IST/ISD as proposed.

EPA based its definition of inherently safer technologies (IST) or design (ISD) on the four inherently safer strategies as explained in the Inherently Safer Chemical Processes: A Life Cycle Approach by CCPS.^[83] These four types of strategies have been widely recognized by the industry and best encompass the concepts and principles of applying inherent safety, which focuses on eliminating or reducing the hazards associated with a set of conditions.

As the 2010 CCPS Final Report: Definition for Inherently Safer Technology (IST) in Production, Transportation, Storage and Use ^[84] states:

IST (Inherently Safer Technology), also known as Inherently Safer Design (ISD), permanently eliminates or reduces hazards to avoid or reduce the consequences of incidents. IST is a philosophy, applied to the design and operation life cycle, including manufacture, transport, storage, use, and disposal. IST is an iterative process that considers such options, including eliminating a hazard, reducing a hazard, substituting a less hazardous material, using less hazardous process conditions, and designing a process to reduce the potential for, or consequences of, human error, equipment failure, or intentional harm. [emphasis added]

The CCPS guidance is organized by these four strategies and provides many examples of each type of strategy. NJDEP also uses descriptions of the four strategies to identify available IST alternatives in their inherently safer technology review requirements.^[85] Although some NJ facilities may have reported some controls that others might not strictly view as IST, EPA does not believe that IST should be limited only to chemical substitution and process changes. Some changes such as better labeling of equipment are cited as examples of process simplification in CCPS' IST Checklist. Changes involving transportation of chemicals and storage location are also cited in the checklist because inherent safety can involve reduction of hazard, and does not require complete elimination of a hazard.

d. General Comments on STAA Requirements

Suggestions for minimal elements for STAA methodology. An environmental advocacy group noted that in the proposed rulemaking, EPA states that owners and operators may use “any available methodology or guidance” to conduct their STAA, but urged EPA to define the minimum basic elements that owners or operators must include in their STAA. The commenter believed the STAA should include an analysis of the technical, economic, legal/regulatory, social, and hazards implications of each major technology option, and noted that the sample methodologies and guidance listed in the proposed rulemaking may not include all of these elements. The commenter urged EPA to require the economic analysis to include potential liabilities, costs, avoided costs, and savings associated with each major STAA option evaluated.

EPA does not believe it should specify factors other than those already present in the PHA and STAA requirements, including the definition of “practicability.” EPA believes that various resources and guidance exist (as well as existing PHA methodologies, such as HAZOP, What-If? Method, or checklists or a combination of these as discussed in Chapter 8 of CCPS' book, Inherently Safer Chemical Processes: A Life Cycle Approach ^[86] ) that can assist facilities in understanding how IST can reduce hazards and risk and in determining practicability of IST or ISD considered in the STAA. Facilities can follow, for example, guidance for IS Review Documentation found in CCPS's Inherently Safer Chemical Processes, which suggests documenting the summary of the approach used for the IS review (i.e., methodology, checklist, etc.), names and qualifications of the review team, IS alternatives considered, as well as those already implemented or included in the design, results of each consideration including those not considered and why, documentation of feasibility and rationale for rejection of IS opportunities.

While some facilities may choose to conduct an economic analysis of potential liabilities, costs, avoided costs, and savings associated with each major STAA option evaluated, EPA is only requiring facilities to determine whether IST is practicable and document this determination. It may not be always be possible to estimate avoided costs and savings for a particular IST.

STAA is not a suitable replacement for other prevention program measures. An association of governments expressed concern that analyses will not prevent accidents because human factors such as operational bias towards production rather than safety, failures to manage changes, failures to provide adequate training for employees and failures to follow standards cannot be eliminated by a safer technology analysis. The association warned that the analysis could be used as a substitute for appropriate emergency preparedness and accident prevention programs. The commenter also believed that adoption of safer technology without a holistic review of risk transfers might be dangerous.

EPA does not believe or intend that a safer technology analysis as part of the exiting PHA would negate the need or requirements for facilities to follow other RMP rule provisions, such as training, managing change, and following RAGAGEP. Rather this analysis is designed to supplement or enhance the ways that hazards or risks of an accidental release can be eliminated or reduced by possibly more rigorous risk reduction measures. Facilities can evaluate the feasibility of potential safer technologies and this evaluation can and should take into account any known transfers of risk, as well as other considerations. For this reason, EPA is not prescribing that facilities adopt any particular safer alternative and is allowing any decision on implementation of IST to be made based upon a facility's judgement using accepted hazard analysis and their knowledge of their processes, hazards, risks and methods to control hazards. EPA does not believe the analysis could be used as a substitute for appropriate emergency preparedness and accident prevention programs—existing requirements in these areas are still in place and this final rule also provides more emphasis on emergency coordination and response (for more information see section V of this preamble).

STAA guidance, regulatory incentives and voluntary partnership programs. An industry trade association suggested the establishment of a working group to develop decision framework and guidance materials for STAAs. The commenter remarked that creation of a working group would be more effective than mandating RMP facilities to conduct STAAs with insufficient guidance. A commenter recommended that the working group should consider existing voluntary programs that include a safer alternatives assessment, and should consider the possibility of establishing a public-private partnership. The commenter further explained that the working group should explore how EPA could leverage these programs by providing regulatory incentives to those who participate in and fulfill the requirements of the voluntary programs. The commenter also suggested that a partnership could be created based on the core principles adopted by industry (i.e., stewardship) programs and the lessons learned from existing and past voluntary partnership programs. The commenter stated that such a program could provide technical assistance and tools to help create awareness and instill a quality culture of safety and security. The commenter provided a white paper with more detailed discussion on the potential purposes, components, incentives and requirements for a voluntary partnership program to improve chemical safety and security.

EPA appreciates the commenters' suggestions for developing guidance, regulatory incentives and partnership programs for STAAs. EPA is finalizing a regulatory provision requiring Program 3 industry sectors in NAICS codes 322, 324, and 325 to conduct an STAA as part of the PHA and determine the practicability of IST or ISD considered. EPA disagrees that STAA should be limited to a voluntary partnership program; however, EPA will further consider the merits of a potential voluntary partnership program with industry to engage in improved process safety practices.

EPA believes the STAA requirements are flexible and allow the use of industry expertise to best decide which safer technologies and alternatives to consider, and to determine the practicability of IST or ISD considered in the STAA. EPA will develop guidance for complying with RMP PHA and STAA requirements before sources must comply with the STAA provision required in this action. A draft of this guidance will be available for public comment.

Making STAA information available to LEPCs. A facility is concerned that the proposed requirement to share information pertaining to inherently safer technology or design with the local LEPC would require specific detailed information that the LEPC may not consider relevant. While the facility expressed willingness to share appropriate information with the LEPC, the facility does not believe the LEPC would be interested in the minute details of the changes in process units. An industry trade association stated that not requiring implementation while requiring facilities to provide LEPCs the date of implementation or planned implementation could cause confusion.

EPA agrees that providing LEPCs with detailed information regarding process changes involving IST or ISD may not always be relevant or necessary to community emergency preparedness or can be confusing. The final rule eliminates the proposed requirements under § 68.205 to provide information to the LEPC, upon request (including IST information). For more information about how the final rule addresses sharing information with LEPCs or emergency response officials, see section VI.A. of this preamble.

e. Including STAA as a PHA Requirement

Appropriateness of PHA techniques or process for STAA. A few local agencies expressed support for STAA measures being used as a method of addressing PHA recommendations. Commenters, including a local agency, encouraged the review of the STAA at least every five years.

However, several commenters opposed including STAA in the PHA. Two trade associations commented that requiring PHA teams to evaluate the feasibility of IST has the potential to undermine the effectiveness of the PHA process. The commenters argued that regulating IST is infeasible because there is no simple answer when it comes to managing risk. The same two trade associations and one facility asserted that a PHA review of an existing process considers the adequacy of the existing controls for that process while an IST review is entirely different. The commenters believe an IST review involves a comparison to a different technology and an operation-specific and site-specific evaluation based on engineering judgment, in which many variables are considered that include hazards, the location of the facility, surrounding populations, exposures, technical feasibility and economic feasibility. A state agency and an industry trade association warned that requiring STAA during the PHA would be inappropriate because the structure of a PHA does not facilitate such an analysis.

A facility expressed concern that none of the PHA methodologies described in the NPRM require this type of comparison, arguing that IST/ISD methodologies are similar, but not identical, to PHA analysis techniques. The facility stated that it would be wrong to assume that STAA can be directly incorporated into existing PHA methodologies. A trade association commented that in order to have PHA team members perform a comparative analysis on alternatives, the PHA team would be required to compile relevant process safety information for the alternatives in order to perform the IST analysis.

One commenter believes that IST needs to be evaluated outside of the PHA process because the node-to-node hazard and operability study (HAZOP) approach is minutely focused, does not look at the bigger picture and reduces the impact of IST to localized risk reduction measures rather than making the whole process inherently safer. The commenter stated that a separate IST analysis for the entire existing process is needed and could be performed every five years but separately from the PHA since different team participants (such as technical experts) are usually needed.

One trade association and a facility believed that IST analyses are not practical to conduct as part of a PHA for a defined process with defined chemicals. The commenters claimed that to consider a substitute, a facility operator would need to design the new process before being able to conduct the analysis. Some facility commenters reasoned that design and hazard reviews for new facilities can take place years before any PHA. An industry trade agency suggested that EPA should include appropriate lead-time and grandfathering provisions so as not to disrupt projects already in the design or construction phase. Finally, an industry trade association asserted that IST decisions are very complex and should not be determined by any government agency, and recommended that EPA delete the proposed STAA provisions.

EPA believes that IST analysis can be incorporated in the existing RMP PHAs by using PHA techniques such as HAZOP, What-If? Method, or checklists or a combination of these as discussed in Chapter 8 of CCPS' book, Inherently Safer Chemical Processes: A Life Cycle Approach.^[87] These techniques themselves are not requirements, but tools available to help the facility owner or operator to identify, evaluate and control the hazards involved in the process.

While developing the original RMP rule, EPA noted some commenters strongly opposed any requirement for safer technology analyses because PHA teams regularly suggest viable, effective (and inherently safer) alternatives for risk reduction. In the preamble to the original RMP rule, EPA agreed with these commenters, indicating that “application of good PHA techniques often reveals opportunities for continuous improvement of existing processes and operations without a separate analysis of alternatives.” ^[88] While these comments in 1996 led us to not require STAA in the original rule, further developments in STAA, and EPA's own experience with implementation of the rule, now indicate that a specific mandate to conduct STAA reviews as part of the PHA will encourage facilities who were performing PHAs that were of lower quality but legally compliant with the old rule, to perform better PHAs.

Therefore, EPA disagrees with commenters that argue it is not appropriate to include an STAA in the PHA. In fact, the RMP PHA requirements include other aspects of an analysis that is typically associated with process design. For example, the PHA must also address stationary source siting issues which involve the location and proximity of the source to local population and their numbers.

Nevertheless, EPA agrees that for situations where an IST would involve a new process that is entirely different from the current process, the process design would have to exist or be developed, and process safety information be compiled, to conduct a PHA for this new process. EPA does not expect facility owners or operators to research and create new process designs or conduct research into all possibilities for the use of new chemicals. Instead, the STAA should focus on the known and existing substitute processes and chemicals that have been demonstrated to be in use commercially.

If a facility is considering a chemical substitution or process change that involves a significant redesign of their process, such efforts involved with redesign and its evaluation may need to be undertaken as part of a practicability study.^[89] The definition of “practicability” allows for consideration of technological factors, which could include whether the potential safer alternative can be designed and operated to meet the process functions needed. However, not all IST involves substituting a chemical or an entirely new process and there are other types of other IST measures (minimization, moderation or simplification) that can be considered to address various points within the current process where hazards and risks exist. Furthermore, the final rule does not require the facility to implement IST measures.

Facilities may, if desired, conduct a separate IST analysis of each covered process, outside of the PHA, if desired, as long as it is done in same timeframe as the PHA and the results are documented. If a facility does not have staff capable to identify and evaluate alternatives, the facility owner or operator may require outside assistance from engineering firms or consultants.

The RMP PHA requirements require the facility owner or operator to identify risk management measures that eliminate or reduce the risks from the process hazards. If the facility has already performed such IST analysis in the past, then the owner or operator should consider these analyses when updating or revalidating their PHAs and determine whether there is new information that should be considered as part of conducting the current STAA.

Involvement and training of employees and team members. An industry trade association expressed concern about the potential experience limitations of the PHA team. The commenter stated that team members may lack the expertise required to assess all alternative technologies, and said that in the case of inadequate experience the STAA should be considered within the management of change element of the RMP and the facility's ongoing risk assessment analysis. Two trade associations commented that a PHA and an IST analysis serve two entirely different engineering functions and the teams that conduct these reviews are staffed differently. The two associations further commented that small facilities do not have staff design engineers to conduct an IST review, which means the facility would be required to absorb the cost of retaining them even though there is no requirement that their findings be implemented.

One Federal agency commented that throughout the SBAR panel process, SERs noted that this analysis would require additional staffing such as design engineers, in addition to the chemical and mechanical engineers already staffed for PHA analyses. The SERs added that most small facilities do not have design engineers on staff and as a result, would need to incur additional expenses to retain them.

Another commenter stated that conducting a full IST/ISD review based on yet-unproven technologies typically is an extremely complex endeavor (particularly for a chemical production process), and would require very different PHA teams that could adequately assess IST/ISD (e.g., to adequately study how the hypothetical use of new IST/ISD might create additional, unanticipated hazards throughout a process).

Another commenter suggested that the PHA/hazard review team should be properly educated in inherent safety analysis. A professional organization encouraged the participation of workers in the STAA process, but urged that these employees must have proper training and education to participate. Some commenters recommended engaging workers in the alternatives and feasibility assessment process and making sure they have the ability to report anonymously and hold whistleblower authority. One commenter urged EPA to explicitly state that union representatives and workers can participate fully in the STAA.

EPA believes that limiting the applicability of the STAA requirement to only those facilities in Program 3 in the petroleum and coal products manufacturing (NAICS code 324), chemical manufacturing (NAICS code 325) and paper manufacturing (NAICS codes 322) minimizes the burden of the requirement for many small businesses. Of those approximately 1,557 facilities that are subject to the STAA requirements, approximately 40% of them are owned by small entities, however, about 86% of these small entity-owned facilities have 20 or more full-time equivalent employees.^[90] EPA agrees that team members conducting an STAA should be properly trained and knowledgeable on how to conduct the analysis. The facility owner or operator is responsible for ensuring that facility personnel have the proper training to conduct STAAs or hire consultants with the appropriate qualifications. EPA expects that some facilities in NAICS codes 322, 324, and 325 will have staff qualified to conduct the analysis. If the facility owner or operator determines that two different teams should conduct the PHA and STAA, then they may choose to conduct a separate STAA of each entire process, outside of the PHA as long as it is done in same timeframe as the PHA and the results are documented.

As discussed in the RIA, the technical practicability assessment considers the extent of process redesign, its engineering implications, and possible costs. EPA estimates that most facilities except the large facilities in NAICS codes 322, 324, and 325 will seek help from consultants (i.e., engineering firms) to conduct STAA and determine the practicability of IST/ISD considered. However, EPA does not expect facilities to spend resources evaluating hypothetical untested alternatives that they believe are not proven within their industry.

Finally, the final rule provides facility owners or operators the flexibility to use facility personnel with expertise and experience with facility processes and their industry to conduct STAAs and determine the practicability of IST/ISD considered. However, EPA does not believe the RMP rule is the appropriate mechanism to address worker rights or whistleblower protections.

Overlap or conflict with PHA analysis. A few industry trade associations and a facility expressed concern that an IST analysis would detract from the goal and focus of the PHA process to identify hazards to be addressed and to identify opportunities for continuous improvement of operations. For example, one commenter was concerned that in an effort to ensure compliance with new safer alternative technology analysis regulations, PHA teams may be distracted from identifying and addressing the hazards of existing processes by spending too much time assessing potential alternative technologies with which they have no experience. Two commenters elaborated, stating that requiring IST or ISD “consideration” based on a laundry-list of “factors” would substantially increase the already extensive time that is required to complete a PHA, and favor subjective reviews over objective reviews of actual safety problems and the most direct and timely techniques required to resolve them.

EPA disagrees with the commenters. The RMP PHA requirements are not only to identify hazards but also to incorporate measures to reduce or mitigate those hazards. Under § 68.67(a), the rule requires the owner or operator to identify, evaluate and control the hazards involved in the process. Several commenters acknowledge that some companies already evaluate “safer alternatives” during their PHAs when it is efficient to consider fundamental process changes. EPA disagrees that consideration of additional inherently safer measures necessarily precludes addressing hazards and applying other risk reduction measures in the hierarchy of controls. If facility owners or operators are concerned that an IST assessment could preclude other aspects of the PHA, they may choose to conduct the STAA separately from the PHA, as long as it is performed on the same timeframe and documented.

IST already incorporated as part of PHA or otherwise considered. Another industry trade association remarked that STAA requirements are already a component of the PHA and concluded that costs of the new requirement would be redundant, but that these costs are incommensurate with the much lower risks faced by facilities in their industry. One trade association disagrees with requiring STAA as part of the PHA because currently approved PHA methodologies already provide for successful risk mitigation (reducing risks to personnel and the environment to ‘acceptable’ levels), including the consideration of inherently safer design technologies by the PHA team where appropriate. A commenter noted that some companies already evaluate “safer alternatives” during their PHAs when it is efficient to consider fundamental process changes. However, they consider available, proven technologies, not “potentially” safer technology that may be noted in literature, but not yet in use anywhere within their industry. Another industry trade association remarked on the importance of process safety information for alternatives and its availability to the PHA team. A process safety organization commented that they believe the existing provisions to conduct a PHA automatically includes the team to consider safer alternatives as appropriate and applicable. An industry trade association said that many of the activities being reported as IST in NJDEP's IST Implementation Summary, were activities that already occur as a matter of course in most facilities.

A facility and multiple industry trade associations remarked that other programs such as the Department of Homeland Security's Chemical Facility Anti-Terrorism Standards (CFATS) already provide incentives for facilities to promote safe practices, and implement safer alternatives and designs. Several commenters urged EPA to avoid burdensome requirements that overlap with the CFATS program at additional cost without added benefit. An industry trade association noted that CFATS allows facilities to move to a lower risk tier or out of the program if risk profiles are reduced and vulnerabilities are minimized, resulting in roughly 3,000 facilities that have changed processes or inventories in ways that have enabled them to be excluded from the program. This commenter notes that DHS's risk performance-based approach does not mandate solutions, recognizes the unique situation of each facility, and embraces a public-private sector effort for implementation of safer measures. The commenter further indicated that mandating the adoption of government-selected ISTs would be unduly burdensome, particularly for smaller chemical facilities, and could hinder their overall efforts at improving security.

While EPA recognizes that some facilities may already consider ISTs as part of a PHA, whether as part of a voluntary program or through other incentives, EPA believes that all facilities in NAICS 322, 324, and 325 industry sectors should consider IST to ensure that they are considering all the options to operate their facility safer. EPA expects that these regulatory requirements will raise industry awareness of IST possibilities and will reduce risk. EPA is not mandating implementation or adoption of any particular IST and will rely on facility expertise to reduce the hazard and mitigate risk without causing undesirable consequences such as reducing product quality or transferring risk to some other point in the supply chain.

Furthermore, EPA disagrees with commenters that asserted that the STAA requirements will overlap with other regulatory requirements and result in an increased burden with no corresponding benefit. In its 2007 Interim Rule for CFATS,^[91] DHS stated that Section 550 of the Homeland Security Appropriations Act of 2007 prohibited the Department from disapproving a site security plan “based on the presence or absence of a particular security measure,” including ISTs.^[92] DHS noted that, even so, covered chemical facilities are certainly free to consider IST options, and their use may reduce risk and regulatory burdens. Therefore, because DHS does not require IST or the assessment of IST, EPA does not believe there is an “overlap” in requirements. Furthermore, DHS requirements address site security measures, and not measures designed to reduce accidental releases.

Potential for risk tradeoff or risk transfer. Some commenters, including an association of government agencies and an industry trade association, encouraged a holistic review of IST to avoid or minimize risk transfers. A few commenters stated that, for example, a facility adopting a safer technology may increase transportation requirements of hazardous materials and increase risks of incidents outside of the facility, including necessitating more exotic emergency response equipment or preparation. One commenter noted that minimization frequently involves the decrease of on-site storage and could result in the potential for additional shutdowns and startups due to insufficient raw materials. The same commenter further indicated that substitution of a purportedly safer alternative may introduce environmental or safety risks that are not realized until much later.

In contrast, an advocacy group urged EPA to consider that the commenters citing risk transfer are often industry funded and, in the opinion of the commenter, overlook risk transfer that is caused by actions of the facilities themselves. A process safety organization stated that EPA should not require an STAA as part of a new prevention program, as part of the existing PHA/hazard review, or as a requirement under CAA section 112(r) because the definition of “inherently safer alternatives” has always been very debatable and use of these alternatives may not result in the overall reduction of the total quantitative risk of the facility. The organization expressed concerns that a verbatim statement of consideration and/or implementation of inherent safer options has the potential for unintended outcomes, such as risk transfer, risk accumulation, increased opportunities for terrorism, and other undesirable tradeoffs. This commenter recommended that EPA should not require the IST analysis because few technologies would be inherently safer with respect to all hazards, there may not be a clear implementation path for all situations, and facilities would have to address multiple tradeoffs in the decision making process. The commenter warned that improper implementation of a “safer” alternative may have negative consequences. Some commenters note that an absolute safer alternative is highly dependent on the hazard, the process, the technology and the facility. For every process there could be different type of alternative chemical use.

EPA recognizes the risk transfer concerns raised by the commenters. However, EPA believes that the final rule allows the owner or operator to consider the potential for quantitative risk reduction, risk transfers and tradeoffs when determining whether it is practicable to implement ISTs or ISDs considered. EPA agrees that some technologies may not be inherently safer with respect to all hazards, may not be implementable for all situations and may involve multiple tradeoffs in the decision making process. IST is a relative concept dependent on the hazard, the technology, and the facility. Therefore, EPA is requiring facilities to only consider IST as a possibility for addressing hazards rather than requiring ISTs be implemented. The final rule gives the facility owner or operator the flexibility to assess IST as well as passive, active, and procedural measures to reduce risk associated with a process and to determine the practicability of any IST considered based on various factors (including those involving risk transference).

Current PHA requirements and other risk reduction measures already adequate address risks. Several facilities and industry trade associations urged that existing requirements and principles, such as PHA and Layer of Protection Analysis (LOPA), are sufficient for determining if proper safeguards are in place in existing process units. Industry trade associations said that LOPA or similar risk-based analyses are more easily implemented and cost effective than IST, and stated that risk-based analyses also minimize risk shifting. A state agency urged EPA to require a LOPA but to ensure that it is clearly separated from the STAA.

Some facilities and an industry trade association remarked that industry has proven capable of reducing hazards from current operations by using active, passive, or procedural measures. A facility and an industry trade association asked why the proposed rulemaking is not specifically focused on STAAs for new or potential processes when, according to the commenters, nothing indicates that IST evaluations have become more beneficial or less expensive for existing process units since the 1996 RMP rule.

A facility asserted that current regulations that require compliance with RAGAGEP already ensure that appropriate controls are implemented in equipment and processes. One commenter expressed concerns that the STAA evaluation will become a paperwork exercise that will not result in any increase to safety. This commenter suggests that EPA require a review of safer technology or IST only when the PHA results show that a technology or design scenario does not meet the company's appropriate risk tolerance/reduction requirements.

EPA believes that where feasible, reducing or eliminating hazards through change in materials, chemistry, or process variables is preferable to adding layers of safety to a process. While layers of passive, active or procedural controls will reduce the risk, they will do nothing to reduce the nature of the hazard itself. Failure of control devices or human error can result in an accidental release. However, an inherent safer strategy seeks to preferentially remove the hazard at the source, as opposed to accepting the hazard and attempting to mitigate the effects.^[93] In addition to eliminating or reducing a hazard, IST can also minimize the impact of a release or terminate the accident sequence before there are major impacts on people, property or the environment.

EPA agrees with other commenters who have indicated that the PHA can and should consider IST as hazard reduction or risk management measures where feasible and appropriate. Opportunities for the application of the inherently safer strategy of simplification can be evaluated for each safety device or procedure during a PHA as well as in review of mechanical integrity program practices and procedures. CCPS provides examples for this.^[94] Although we agree that the general principles of PHA combined with LOPA may at times be appropriate to address the risk of an accidental release, EPA believes that facility owners or operators should consider IST first in the hierarchy of risk reduction measures to reduce and/or control the hazards of a process.

Consideration of untested and unproven technologies. One commenter was concerned that any potential IST considered should not have to include untested and unproven technologies. An industry trade association urged that technology takes time to mature and become acceptable and safe for widespread use. Concerns were that facilities might be encouraged to substitute novel and untested controls for existing controls and layers of protection that are in place at existing processes to control and manage risks, detracting from actual safety performance. One commenter was concerned that operators should not be required to update or replace technology on a year-in, year-out basis simply because new technologies are introduced into the marketplace. One commenter stated that any alternative considered should be easy to be applied and should have been properly tested.

EPA agrees that a facility owner or operator may conclude that IST measures that have not been tested or used commercially should not be considered. It may be difficult to evaluate the practicability of hypothetical technologies or those that are still undergoing research and testing.

f. General Opposition to STAA

Benefits and cost of STAA not adequately explained or justified. Commenters warned that analysis of existing facilities and processes is unlikely to provide significant insights or opportunities for safety improvement, but may be very costly. A facility and a number of trade associations asserted that IST analysis would not meaningfully increase safety. Stating that safer technology would have been adopted if it made business sense to do so, a facility remarked that the STAA requirement is unnecessary.

An industry trade association and a facility expressed concern that the process of retrofitting existing facilities would be expensive and could result in facilities shutting down. Several commenters agreed with EPA conclusions made in the 1996 RMP rule regarding an IST analysis mandate where the agency stated, “EPA does not believe that a requirement that sources conduct searches or analyses of alternative processing technologies for new or existing processes will produce additional benefits beyond those accruing to the rule already.” The commenters, including a facility and industry trade associations, warned that EPA changed its position on whether or not a mandatory IST analysis leads to any incremental benefits, without any clear rebuttal, analysis, explanation, or substantiation of benefits from the STAA and urged EPA to withdraw the STAA mandate from the proposed rulemaking. An industry trade association, agreeing with EPA's 1996 assessment, remarked that the new conclusion was made without regard for the nature of the reported accidents or any scientific support. Many commenters stated that requiring STAAs would create a burden for industries that would not produce any significant benefits if the existing process has already had risks addressed by a PHA. A few commenters asserted that, for most facilities, an IST analysis would likely produce limited options that would not justify the cost and effort of the exercise itself.

Two industry trade associations contend that there is no data to suggest that requiring an STAA analysis provides any measurable benefit or reduces the frequency or severity of incidents or any empirical studies showing that STAA effectively improves process safety. They believe that the analysis of the New Jersey data for facilities conducting IST analysis since 2008, shows no decrease in reportable accidents and that revising the RMP rule will likely have a negligible effect at great cost to covered facilities. Commenters asked whether or not EPA's analysis of the IST programs implemented by New Jersey and Contra Costa County has yielded any concrete data demonstrating that the programs have successfully reduced hazardous safety risks over voluntary adoption. One commenter urged EPA to withdraw the proposed IST requirement until EPA has conducted such an analysis.

Several trade associations commented that the regulatory burden of requiring costly IST reviews tends to stifle innovation. The commenters asserted that for those companies already looking to improve safety by implementing IST options, a formal IST review would add costs to a process by forcing them to document the activities they are already performing. They further indicated that small operations might not have the manpower or expertise to do this and lack the resources to hire it out cost effectively. The same commenters further stated that for companies that do not implement IST options, the IST review becomes a “paper exercise” where they document why it is “infeasible” to implement these options. Another commenter argued that if EPA only intends for an analysis to be conducted and not for the technologies to be implemented, then the proposal should be withdrawn on the basis that it provides no benefit to the public.

One trade association commented that there is no value in having a facility perform an IST assessment if one was already performed earlier in the lifecycle of the process or to repeat the same STAA every five years on the same process. The association asserts that nothing new will be learned from doing so.

According to a facility and some industry trade associations, the claim in the proposed rulemaking preamble that voluntary adoption of IST is becoming more prevalent indicates that the incremental benefits of mandatory adoption are decreasing, which the commenters remarked would be in line with the 1996 decision not to require IST analysis.

EPA believes that the STAA should identify potential process changes including IST that, if implemented, would result in owners or operators using less hazardous substances, minimizing the amount of regulated substances present in a process, moderating process conditions, reducing process complexity, or implementing passive, active, or procedural changes to make processes safer. Such changes help prevent accidents by either eliminating the possibility of an accidental release entirely, by making a process more fault-tolerant, such that a minor process upset or equipment malfunction does not result in a serious accidental release, and by reducing the severity of releases that do occur. The STAA provision does not actually require the owner or operator to implement any changes, so facilities will only incur additional costs beyond the analysis when the benefits of the change make adoption of the change reasonable for the facility.

IST is widely recognized as a concept or principle that can be used in process safety management along with other types of hazard reduction measures to eliminate or reduce the frequency and/or impact of accidents. As recognized in process safety technical literature, the benefit of using practicable IST as the first choice for accident prevention is more likely permanent risk reduction. Some trade associations agree that individual companies often consider inherently safer approaches or safer alternatives as a matter of course. In fact, one of the key elements under ACC's Responsible Care, Process Safety Code ^[95] requires ACC member companies to consider inherently safer approaches as one of many risk reduction measures when conducting a process safety risk assessment.

Since 1996, EPA has seen that advances in ISTs and safer alternatives are becoming more widely available and are being adopted by some companies. Voluntary implementation of some ISTs has been identified through surveys and studies and potential opportunities have been identified through EPA enforcement cases and CSB incident investigations.^[96] The Contra Costa County Health Services (CCHS) and New Jersey Department of Environmental Protection (NJDEP) IST regulations requirements to consider IST have resulted in some facilities adopting IST measures.^[97] The concept of IST is more widely understood and accepted within the chemical process industry than it was 20 years ago. Innovations and research in chemical process safety have evolved and continue to evolve. Industries change and update their processes over time for a variety of reasons and when possible, EPA believes that opportunities to improve chemical process safety using all available means—not only passive, active, and procedural measures—should also be considered.

EPA disagrees that increasing voluntary adoption of IST means that incremental benefits of mandatory adoption are decreasing. Benefits derived by those implementing IST do not negate any potential benefits from those who have not. As stated in the 1996 rule, “EPA encourages sources to continue to examine and adopt viable alternative processing technologies, system safeguards, or process modifications to make new and existing processes and operations inherently safer.” ^[98] For those facilities who have not considered adopting any IST or have only done so in limited fashion, EPA believes that there is value in requiring facilities with extremely hazardous substances to evaluate whether they can improve risk management of current hazards through potential implementation of ISTs or risk management measures that are more robust and reliable than ones currently in use at the facility. For those facilities who have already considered IST, EPA believe facilities should re-evaluate whether any improvements in hazard or risk reduction can be made and we believe the five-year re-validation timeframe of the PHA is an appropriate time period for such re-evaluation.

EPA did not perform any further analysis of the NJDEP or Contra Costa County IST data. The main purpose of providing these reports was to demonstrate that regulations involving IST in these two jurisdictions resulted in implementation of IST at some of their facilities and to explain what types of IST were implemented. NJDEP's 2010 IST Implementation Summary report ^[99] on IST reports submitted by NJ facilities since August 2008 is available in the docket and discusses 143 additional IST measures reported to have been implemented or scheduled to be implemented by 41 of the 85 facilities submitting reports. CCHS and Richmond CA annual performance review and evaluation reports on the Industrial Safety Ordinance include a summary of Inherently Safer Systems (ISS) results from their nine total facilities, as well as the actual ISS data reported by each facility. Three of these reports are in the docket for this rulemaking.^[100]

Because the requirements involve prevention of accidents before they occur, it is difficult to provide a quantitative assessment that the requirement would reduce a certain number of accidents. The assertion of increase in the number of NJ accidents reported cannot be explained as a result of implementation or non-implementation of IST because there are other factors involved. For example, the number of NJ facilities reporting over the years varies, which can affect the number of reportable accidents and not all NJ facilities may have implemented IST. In principle, because of the “inherentness” of any actual IST changes, there should be a hazard and risk reduction for a particular RMP chemical, because IST eliminates or minimizes the opportunities for a chemical release in a more rigorous fashion than relying on a device or human intervention. EPA recognizes that IST will not eliminate all hazard or risk and that reliance of other risk reduction measures will probably still be needed for other points in a process.

Contra Costa County commented that it has seen improvements at existing facilities with existing processes subject to its ISS requirements.^[101] The county indicated that facilities have eliminated unnecessary vessels, shortened piping and replaced chemicals with less toxic chemicals. CCHS has seen that by considering ISS, facilities have looked at the highest level of risk reduction such as using passive means (such as a change in metallurgy) instead of relying on administrative means (such as increased piping inspections).

As some commenters indicated, some facilities have been evaluating IST as a best practice for decades and, in most cases, have already taken steps to implement beneficial technologies where it is practicable and cost-effective to do so. In those situations, where IST was previously evaluated but not implemented, facilities should review the analysis to determine if new information is available that would affect the analysis. The facility should document the STAA and practicability of IST and ISD considered.

Inconsistent STAA implementation. A facility remarked that the lack of clarity and consensus about the methodology, definitions or standards for STAA would contribute to burden and could lead to inconsistent implementation of STAA across companies.

EPA does not expect to see “one-size-fits-all” implementation of STAA by sources. The STAA requirements are not prescriptive in nature, but more similar to a performance-based standard (like other provisions of the RMP regulations) that give facilities the flexibility and allow facility owners and operators to exercise reasonable judgement to determine what technology or risk reduction measures work best for their particular chemical use, process or facility. However, in an effort to ensure a consistent understanding of EPA's expectations for conducting an STAA and determining practicability of IST and IST considered, the rule defines several terms related to the STAA, such as practicability, inherently safer technology or design, passives measures, active measures and procedural measures. EPA has also cited various references and technical sources of information that explain the concepts and principles of STAA and provided examples.^[102]

Impact to agribusinesses. One commenter stated that the proposed mandate for regulated facilities to consider STAA as a part of the PHA, and to evaluate the feasibility of IST, will fail to generate tangible RMP outcomes in the fertilizer industry or with other ag-industry RMP regulated chemicals, beyond what the current PHA requirements and procedural measures can accomplish in controlling hazards. The commenter further asserted that the administrative and recordkeeping burden associated with this portion of the proposed rulemaking will undoubtedly increase costs on the agribusiness industry at a time when margins across the industry are thin to non-existent. The same commenter indicated that these requirements will cause many small agricultural fertilizer retail facilities to close.

EPA is not requiring agricultural fertilizer retail facilities to perform STAA and thus there should be no burden to this particular industry as a result of the STAA provision. The STAA requirement in the PHA will only apply to Program 3 facilities in chemical manufacturing (NAICS code 324), petroleum and coal products manufacturing (NAICS code 325) and paper manufacturing (NAICS code 322).

Feasibility costs. One trade association stated that the cost of determining feasibility was wholly underestimated by EPA because feasibility study costs can be quite large depending upon the type of project, but still be only a fraction of the cost of what it would take to implement any projects determined to be feasible. The commenter noted that a typical project consists of conceptual level design, feasibility level design, and then engineering and implementation. The association member's experience with hundreds of projects is that the cost of a conceptual level design is about 1% of the total project cost and the cost of a feasibility level design is 1% to 2% of the total project cost.

EPA acknowledges that for some industries, evaluation of chemical substitution and process redesign will involve a greater level of effort and resources to consider the practicability of such changes. EPA has revised the cost estimates in the RIA to reflect the greater effort involved in conducting such practicability studies.

g. Model STAA Provisions After Other Regulatory Programs

Several commenters suggested that the STAA requirement align with similar requirements by CCHS and NJDEP. Some of these comments are addressed under other STAA topic headings, as appropriate. Other specific comments are discussed further in this preamble.

Establish qualifications for IST review team. One commenter recommended expanding on the NJDEP requirement which specifies that an IST review team should be “a team of qualified experts, convened by the owner or operator, whose members shall have expertise in environmental health and safety, chemistry, design and engineering, process controls and instrumentation, maintenance, production and operations, and chemical process safety.” This commenter also wanted EPA to require the names, qualification, and experience of team members to be stated in the review report and to explicitly specify that workers and union representatives can fully participate in the STAA. Another commenter noted that the proposed STAA requirement does not require employee participation and stated that employees have deep experience and knowledge of the processes and are best equipped to determine inherently safer technology or design, but cautioned that workers must have adequate education and training to participate in STAAs.

EPA notes that § 68.67 requires the PHA to be performed by a team with expertise in engineering and process operations, and the team shall include at least one employee who has experience and knowledge specific to the process being evaluated. Also, one member of the team must be knowledgeable in the specific process hazard analysis methodology being used. These same qualifications apply to team members involved in conducting the STAA. EPA believes most PHA reports already include the names and qualifications of team members in the report, and we do not believe it is necessary to prescribe a regulatory requirement to address this issue. EPA already requires Program 3 facilities to consult with their employees and their representatives on the conduct and development of process hazard analysis and on the development of other elements of process safety management, and EPA believes it would be inappropriate to incorporate additional provisions related to worker participation in the PHA requirements of § 68.67.

Establishing goals. A Federal agency recommended incorporating a goal setting requirement similar to that of CCC's ISO, expressing concern that a lack of goal setting requirements could allow regulatory requirements to be satisfied even if analyses fail to identify or control major hazards. The commenter explains that there is no RMP requirement to reduce risks to “as low as reasonably practicable,” or “ALARP”, while CCHS ISO requires facilities to select and implement ISS to the greatest extent feasible and as soon as administratively practicable.

EPA disagrees with commenters. EPA did base some components of the STAA requirement on NJDEP and CCHS regulations (see discussion in section in IV.C.3.c Definitions of this preamble). Also see further discussion in section in IV.C.3.k of this preamble regarding documentation of feasibility. NJDEP and CCHS require a separate Inherently Safer Technology review or Inherently Safer Systems Analysis (ISSA), but NJ requires IST updates (covering both new and existing processes) on the same schedule as the PHA. CCHS requires an ISSA for existing and new processes every five years, but the analysis can be done as part of a PHA. CCHS also requires that an ISSA for any major changes (which could be result of accident investigation). EPA is requiring that the five-year PHA revalidation address the findings from all incident investigations required under section 68.81, as well as any other potential failure scenarios.

EPA did not propose to require any implementation of any IST. EPA proposed to require facilities to determine the feasibility of IST options, but the final rule allows flexibility for facility owners or operators to decide whether to implement an IST in order to allow them to balance the appropriateness of the technology for their process, costs, risk transfer and other requirements that would have to be met along with possible integration with the use of existing risk reduction measures in place. In the final rule, EPA also replaced the term “feasibility” with “practicability.”

Requiring risk reduction to be “as low as reasonably practicable (ALARP)” is a standard that can be seen as stricter than the “to the greatest extent feasible” requirement set by CCHS and could require implementation of risk reduction measures “except where they are ruled out because they involve grossly disproportionate sacrifices.” ^[103] EPA does not believe that adopting a requirement that facilities reduce risks to “ALARP” is advisable for the RMP program because there are no set standards to define what level of risk is reasonably practicable for the variety of chemicals, processes, and hazards involved.

h. Feasibility

Insufficient guidance and clarity for methodology for comparing risks. A facility, a local agency, and industry trade associations, among others, remarked that IST cannot be meaningfully and consistently implemented because there is no consensus in science or among the industry on its definition, how to implement it, or how to measure its effect. Stating that the concept of IST is vague, an industry trade association said that multiple factors are taken into account when making a determination of feasibility, including materials used for equipment.

One commenter stated that the feasibility factors in the proposed STAA provision also provide no guidance on how to measure or balance risks or hazards. This commenter notes that there is no simple way to measure whether one process is safer than another or when a process is “safe enough” as discussed in the July 2010 DHS report by CCPS. The commenter indicated that the proposed rulemaking does not address a multitude of critical questions: What does the PHA team measure? Does the team evaluate reduction in particular hazards or in overall risk? Is that reduction measured quantitatively or qualitatively? Who or what is the required beneficiary of that reduction—the employees, the adjacent community, the environment? What level of risk is tolerable? If EPA requires STAA analysis under the final RMP rule, it will necessarily need to become involved in measuring, evaluating, and determining the tolerable level of risk. It is unlikely that EPA has the expertise or bandwidth to take this on.

EPA based its definition of IST upon CCPS' descriptions of inherently safer strategies and its definition of “practicability” upon CCHS' definition of “feasible” in their Industrial Safety Ordinance. EPA has existing requirements under § 68.67 for facilities to evaluate and control hazards in the process and to establish a system to address the PHA's team findings and recommendations. Management response to hazard evaluation studies and recommended options involve risk management considerations that are developed based on a facility's risk tolerance criteria. EPA has not prescribed how facilities define or manage risk, whether it involves conforming to minimum standards such as codes or tries to reduce risk to as low as reasonably practical or whether it uses risk matrices or assesses qualitative or quantitative risk. EPA expects only that facilities consider IST as one of the types of risk management measures employed. Much of the structure of the RMP rule requires owners and operators to collect information and relies on them to make reasonable judgments in light of that information. The requirement here is no different. EPA only requires the analysis. There is no mandate to implement IST under this rule. For further information, EPA recommends consulting Chapter 9—Hazard Identification and Risk Analysis in the 2007 CCPS Guidelines for Risk Based Process Safety.^[104]

Efforts involved for determining feasibility. One commenter asserted that EPA has failed to consider the substantial complexity of the activities it is proposing to require, and the significant burden that will be placed on facilities with multiple or complex RMP regulated processes. The commenter cited issues involved with many chemical manufacturing processes that involve multiple optimizations of complicated reactions and integration of many processes with each other. The commenter cited as an example, the efforts involved by the National Academy of Sciences (NAS) to identify and evaluate the many individual alternative paths to methyl isocyanate (MIC) production for potential safer operations.^[105] The commenter stated that each alternative then had implications for the facility, the customer, the surrounding community and numerous other factors that needed to be identified, considered and weighed carefully. The commenter further explained that these factors included the costs of the chemicals, labor and energy requirements, new capital expenditures, quality of the product and revenues expected from its production, environmental impacts anticipated from the process, regulatory constraints, environmental policy and regulations and influence of local community on company decision making. The commenter indicated that many of these characteristics involve a substantial degree of uncertainty. The commenter also stated that the framework for decision-making discussed by NAS is akin to the proposed EPA requirement to perform a feasibility analysis for all ISTs considered. The commenter concluded that under the EPA proposal, complex chemical manufacturing RMP facilities would be required to go through this analysis multiple times for each and every regulated process.

EPA believes a practicability determination for any considered IST or ISD is necessary to ensure the facility owner or operator seriously considers whether IST or ISD modifications could further reduce risks and prevent accidents at the facility. EPA expects that facilities will only evaluate chemical substitutes that have already been shown to be commercially viable and does not expect facility owners or operators to expend a major effort on hypothetical or untested chemical substitutes or uses.

Insufficient time to complete a feasibility analysis. One commenter stated that when evaluating IST, a facility owner may at times be able to reject an alternative based on determining a single basis of infeasibility. The commenter asserted that if there is no known rationale for infeasibility, a facility may need to conduct lengthy and costly engineering studies, which would require a unit revamp on an existing process unit. The commenter further stated that under such circumstances, feasibility or practicality must consider unit congestion and constructability in addition to all of the issues associated with a new process. The commenter indicated that this need to perform detailed engineering study/design, in many cases, is indicative of impracticability. The commenter concluded that the proposed rulemaking allows four years after the rule become final for each PHA to consider IST/ISD alternatives for covered processes and, in the event the EPA decides to include this requirement in the final rule, facility owners should be allowed a second PHA cycle, following the four-year applicability, where the determination of feasibility or practicality requires engineering studies and design. Another commenter stated that the feasibility analysis outlined in the proposed regulation is ill-defined and doesn't allow sufficient time for the work to be properly completed.

EPA allows that where a practicability evaluation is complex and resource intensive and may not be completed within the four-year compliance timeframe from the final rule or within the five years between PHA reviews, a facility should document during their PHA review that the IST is under consideration and that the practicability of implementing the technology is unknown and still undergoing evaluation.

Practicability decisions made by facilities or outside parties. An environmental advocacy group argued that, if decisions are left up to facilities themselves, the economic interests of the facilities will outweigh considerations of public health. The advocacy group concluded that an independent body should be tasked with reviewing facilities' IST/ISD evaluations to determine whether or not such technologies are feasible and to prevent facility self-regulation. One local agency asserted that stationary sources rather than a regulatory body should determine the feasibility of ISD and document their decision.

EPA disagrees that practicability decisions should be made by outside parties. These decisions are based on site-specific circumstances that a third-party may not have the experience to evaluate. EPA believes it would not be practical for many reasons including: The delay that may result in finding a third-party to assess practicability; the variety of factors that must be considered in establishing a basis for choosing an outside party (e.g. there may not be enough qualified third-parties with the expertise and resources to evaluate the various options and processes for the number of facilities subject to this provision); and the need to protect CBI and sensitive information that could reveal security vulnerabilities.

Feasible definition does not take into account removal of existing safeguards. One commenter stated that the proposed definition for feasible precludes any reasonable basis for replacing existing controls and safeguards that have already been identified and implemented to address the risks. This commenter believes that since all the engineering and administrative controls necessary to address risk have already been identified and implemented in an operating plant, it is not appropriate to require a repeated analysis of alternatives that that are not feasible for an operating plant.

EPA disagrees with the commenter. The definition of “practicability” in the final rule is not intended to be used to judge the reasonableness or effectiveness of existing risk reduction measures, but whether new IST measures could be implemented. The STAA requirements allow a combination of risk measures to be used to achieve the desired risk reduction; therefore, they do not necessarily preclude the use of existing controls and safeguards.

Feasibility factors go beyond scope of a PHA. One commenter asserted that requiring consideration of the five factors mentioned in the proposed definition of “feasibility” goes beyond the scope of a PHA.

EPA disagrees. While the PHA identifies the hazards, the RMP PHA requirements require the facility to identify the risk management measures applicable to eliminating or reducing the risks from the process hazards. EPA believes that it is appropriate for a facility to consider the five feasibility (now practicability) factors (“economic, environmental, legal, social and technological”) for evaluating the appropriateness of implementing for potential IST measures because some IST can involve significant costs or involve impacts that go beyond the facility.

Feasibility does not take into account full supply chain. An industry trade organization and a facility warned that the proposed definition of “feasible” does not sufficiently consider costs and benefits and fails to take into account the full supply chain. Facilities pressured to take these measures, such as reducing inventories of products, would prevent companies from meeting customers' needs. For example, downstream users may not even be able to receive an alternative product.

EPA disagrees that the practicability determination does not allow facilities to take into account costs and benefits and the effect on the full supply chain. The STAA requirements do not require any implementation of any particular IST. EPA expects that facility owners or operators will seriously consider the merits and consequences of ISTs for their facilities and use their expertise and judgement to ensure safety while not severely affecting the economic viability of their businesses. Facilities can consider the effects in their supply chain (downstream and upstream) when evaluating potential IST options.

i. IST Implementation

Several industry trade associations and a facility expressed support for EPA's decision not to require implementation of feasible safer alternatives and noted that the best approach would be to allow operators to decide which measures, methods, or IST components would be feasible at their facilities. An industry trade organization requested that EPA include language stating that “the scope of the STAA for a regulated process will be based on the expert judgment of owners and operators” because only the facility is uniquely qualified to determine what types of changes are feasible and practical. The commenter cited an example where reducing the volume of chlorine dioxide on-site at a paper mill may not be practical because a minimum amount is needed to ensure that production of pulp and paper can continue when operation of the chlorine dioxide generator is momentarily disrupted due to maintenance or other issues. The commenter also cited another example in which eliminating the use of chlorine dioxide for bleaching may not provide the necessary characteristics of the finished product.

Many commenters, including multiple mass mail campaigns joined by approximately 24,610 commenters and advocacy groups, urged that upon identifying alternatives in an analysis, facilities should be required to switch to the safest cost-effective chemicals and technologies available. Among other reasons, one commenter cited the need to implement feasible alternatives because the NAS report on the Bayer CropScience accident stated that feasible alternatives should be attempted before moving on to specification of risk management equipment and procedures.^[106] This commenter notes that existing safeguards used have not prevented accidents from occurring and that CAA section 7412(r)(7)(B)(i), directs that regulations and guidance under this provision must “provide, to the greatest extent practicable, for the prevention and detection of accidental releases of regulated substances and for response to such releases.” [Emphasis added] In addition, this commenter states that not requiring implementation of IST also creates a competitive disadvantage for those facilities that do so voluntarily, as compared to other facilities who will avoid taking available preventative safety measures to maximize short-term profits. This commenter wants EPA to require a timeframe for implementation of IST for those facilities who plan to implement IST as this will prevent accidents from happening sooner. A commenter urged that required implementation of feasible alternatives would reduce the risks associated with a catastrophic release, including from terrorist attacks, and would be important for protection of public health.

One commenter wanted IST to be implemented wherever feasible because IST is likely to be more effective and less costly in the long run than other safeguards, noting that the existing rule requires that facilities implement the recommendations from a conventional PHA. This commenter also stated that EPA should model its implementation requirements on California's Contra Costa County Industrial Safety Ordinance, which directs companies to “select and implement each inherently safer system identified to the greatest extent feasible and as soon as administratively practicable” or consider California's Department of Industrial Relations current proposed requirements for refineries which directs each facility to “implement all recommendations” from inherent safety analyses, unless the facility can demonstrate that a recommendation is factually flawed or infeasible on grounds other than cost alone.

An industry trade association said that in their industry, operations are diverse and are constantly evolving, making it difficult to implement IST. A few industry trade associations warned that substitution is not a legitimate option for their industries, for manufacturing of agricultural products or in fragrance industry, for example. Stating that active ingredients in fragrances are extremely specific and non-fungible, an industry association commented that any substitution of fragrance ingredients should be done at the point of design to minimize the threat to fragrance businesses. The commenter requested that EPA provide a clear statement acknowledging the infeasibility of substitution in the fragrance industry. Some commenters stated that the analysis would be of no benefit for their facility because a Federal permit requires it to use certain processes.

EPA agrees that the facility is in the best position to decide what safeguards or risk reduction measure can be employed to eliminate or reduce process hazards. Facilities must consider safeguards, in the following order of preference: IST, passive, active or procedural measures; however, the rule does not automatically require the facility to implement the measures preferentially in that order. EPA recognizes that for any particular hazard point, any one of the four types of safeguards may not exist or may not be practicable for a variety of reasons. EPA also recognizes that facilities may wish to employ more than one safeguard.

The purpose of the STAA requirement is to ensure that facilities consider the available options and for them to find the best method for the facility to address accidental releases. The hierarchy of control methods in an STAA analysis—IST/ISD, passive, active, administrative—is consistent with the language of CAA section 112(r)(7)(B)(i) in that it systematically provides for the identification of practicable control methods while also recognizing that the regulation must be reasonable. This approach is consistent with the current PHA requirements which provide flexibility for the owner or operator to decide which safeguards are appropriate to prevent accidental releases. We expect STAA analyses to lead to new control approaches at sources where management finds such approaches to be reasonable and practicable.

EPA is not requiring implementation of IST at any facility because we believe that only the facility has the expertise and resources to determine whether implementation of any IST or ISD should be undertaken, taking into account that many factors must be considered when substituting a chemical or modifying a process, including cost, risk transfers, technological hurdles, etc. Facilities that choose to adopt the use of IST or ISD can eliminate or reduce hazards by using different materials and/or process conditions, which would make accidental releases less likely, or the impacts of such releases less severe. The results of the practicability determination must be documented as part of the current PHA requirements in § 68.67(e), which requires the owner or operator to document actions to be taken and resolution of recommendations.

Also EPA does not believe we should establish a required timeframe for any planned implementation of IST. Planning, design, equipment modification and cost to implement IST can vary tremendously depending on the technology and scope of the project and could only be best determined by the facility involved in such implementation.

EPA acknowledges that chemical substitution or whole design processes may be not practicable for some processes for a variety of reasons and that facilities should document these reasons for any particular IST that were considered by the facility for purposes of complying with the STAA requirements.

j. Security and Risk

Terrorism. A commenter cited an increased risk of global and domestic terrorism as a reason to broaden the applicability of STAA requirements to cover transportation and storage of liquid chlorine. Another commenter stated that the existing RMP provisions already require the PHA team to consider safer alternatives, and warned that explicitly stating consideration or implementation of IST can expose facilities to risks, such as increased opportunity for terrorism, risk transfer, and risk accumulation. The commenter remarked that chemicals handled are highly dependent on the processes employed, so it would be difficult or impossible to identify an absolute safer alternative. The commenter concluded that facilities should asses the total risk reduced by implementation and stated that any alternative considered should be easily applied and properly tested.

EPA acknowledges that transportation and storage of liquid chlorine can pose risks, not only from accidental releases, but from intentionally caused releases. However, EPA is limiting the scope of applicability of the STAA requirements in order to balance the regulatory and administrative burdens of assessing IST against the accident rate and possible opportunities to employ IST because of process complexity for various industries. EPA believes that the industries subject to the STAA provisions are also more likely than others to have the expertise and resources to properly assess and implement IST.

In response to the commenter's concern that explicitly stating consideration or implementation of IST can expose facilities to risks, EPA believes that the STAA provisions in the final rule provide enough flexibility for owners and operators to consider a hierarchy of risk management measures to minimize the hazard of a process without prescribing an approach that could compromise facility security or transfer or increase risks. The STAA requirement does not require IST implementation but instead allows the facility owner or operator to determine whether an IST considered would achieve a reduction in risk, specific to the hazard being addressed. More specifically, the STAA requirement allows for a combination of risk management measures to be used to achieve the desired risk reduction. This flexibility acknowledges that there is not always an absolute safer alternative to a chemical, which is highly dependent on the process or application and the chemical involved. EPA is also requiring the facility to evaluate the practicability of any IST or ISD considered to account for economic, environmental, legal, social, and technological factors. Environmental factors would include consideration of potential transferred risks for new risk reduction measures. This allows facilities to carefully consider whether an IST could create new risks or security concerns, including those involving terrorism.

Security concerns related to STAA documentation. An industry trade association urged that if (or when) IST becomes applicable to a certain process, methods should be available for additional review. For example, the commenter said that documentation of safer technology information should be considered from a homeland security and critical infrastructure perspective.

EPA agrees that documentation that could reveal vulnerabilities at an RMP-regulated facility must be secured. Therefore, although EPA is requiring facility owners and operators to document STAA and practicability determinations, EPA is not requiring this information to be submitted to implementing agencies, LEPCs or local emergency response officials. These entities have the ability to request documentation, at which point representatives of the facility and the requesting agency can discuss the security concern and involve security agencies as appropriate.

k. STAA Documentation

Extent of STAA documentation. Some commenters urged EPA to require sufficient, detailed documentation of feasibility and alternatives considered. One commenter asserted that requiring sufficient documentation of alternatives would facilitate the incorporation of safer design principles into the PHA and would enhance the integrity of the process and encouraged a more extensive documentation of feasibility similar to the program in Contra Costa County, California. An advocacy group suggested that entities should be required to document economic benefits as well and quantify specific economic benefits of adopting safer options, such as reduced liability and insurance costs, public benefits such as savings to municipalities for reduced emergency response, and savings to workers and affected residents for medical care, property damage, etc.

An industry trade association asserted that any requirement for entities to determine or document feasibility would be beyond EPA's authority and would be inappropriate because it does not provide sufficient detail of what would be required in a “determination” or information about how the determination was considered. An industry trade association expressed general opposition to a documentation requirement. A state agency requested clarification as to what type of documentation would be required in order to demonstrate compliance.

EPA is not specifying any particular form of documentation for STAA given the potential complexity of analysis, variety of risk reduction measures involved and the factors that may be considered for feasibility and/or implementation. Facilities should retain any reports, analysis, findings and recommendations used to comply with the STAA requirements for the life of the process as is required by § 68.67(g). For IST/ISD measures considered, facilities should document the analysis and methodology used to evaluate or consider IST, its feasibility and the recommendations of the review team. Facilities may follow, for example, guidance for IS Review Documentation found in CCPS's Inherently Safer Chemical Processes, which suggests documenting the summary of the approach used for the IS review (i.e., methodology, checklist, etc), names and qualifications of the review team, IS alternatives considered, as well as those already implemented or included in the design, results of each consideration including those not considered and why, documentation of feasibility and rationale for rejection of IS opportunities. Facilities must provide in their RMP, any inherently safer technology or design measures implemented since the last PHA, if any, and the technology category (substitution, minimization, simplification and/or moderation) (§ 68.175(e)(7)).

CBI. A facility contended that changes in process technology involving IST or ISD could be considered CBI, have a substantial impact on the strategic competitive nature of their operation and necessitates provisions to ensure that CBI claims can be asserted for IST or ISD implementation. An environmental advocacy group stated that facilities should have the ability to withhold CBI based on existing standards when they submit their STAA to EPA.

EPA is not requiring the STAA or its documentation within the PHA to be automatically submitted to EPA nor to anyone else, but such analysis or documentation must be kept as records under the recordkeeping requirements of § 68.200 and be available for inspection or review by EPA. Owners or operators may assert claims of CBI for information requested by EPA following the procedures in §§ 68.151 and 68.152 if the information meets the criteria set forth in 40 CFR 2.301.

l. Availability and/or Submission of STAA Documentation

Many commenters, including multiple mass mail campaigns joined by approximately 22,260 commenters, a Federal agency, and advocacy groups, stated that RMP facilities should be required to submit their STAA information to EPA. An environmental advocacy group suggested that the collection of STAAs is vital for the establishment of a clearinghouse of safer technology and alternatives and that EPA should certify STAAs for accuracy and completeness. One commenter suggested that by requiring the submission of STAAs to EPA, the Agency will enhance the quality of STAA assessments and feasibility analysis. This commenter also believed STAA submission would better inform enforcement under the CAA's General Duty Clause by providing the Agency with world class knowledge of feasible safer alternatives and effects taken under the EPA's 2017-2019 NEI approved on February 18, 2016.

Two local agencies stated that STAA information should be retained on-site at the facility for inspection or be submitted upon request to be reviewed by EPA and implementing agencies. One commenter said that information on IST should be maintained at the stationary source.

In contrast, other commenters, including multiple industry trade associations, remarked that EPA should not require RMP-regulated facilities to submit STAA information to EPA. Some industry trade associations argued that EPA or any other implementing agency will likely lack the required knowledge, resources, or expertise to evaluate an STAA or feasibility determination. An industry trade association asserted that EPA should have no role in analyzing or approving the plans. An industry association argued that any requirement for approval of STAAs by EPA would be too similar to a permitting program and would thus be against Congress' intent as per CAA section 112(r)(7)(F).

Some commenters suggested that the submitted STAA information should be included in the RMP National Database and facilities be allowed to withhold CBI based on current RMP CBI protections and facility-specific, element-specific, up-front substantiation of security claims. A professional organization encouraged EPA to use the STAA summary information provided in the RMPs to gather helpful data and incorporate lessons learned. One commenter reasoned that collection of STAA data is necessary for EPA and other regulatory agencies to carry out their regulatory responsibilities. Another commenter asserted that incorporating summary STAA information into RMPs will facilitate knowledge of successful practices as well as knowledge of barriers.

Two commenters suggested that EPA collect information from facilities that change program levels within RMP or deregister entirely in order to collect valuable lessons learned for future use about IST preventive measures and reducing on-site quantities. One commenter expressed concern that the current deregistration reason codes are not sufficient to allow EPA to collect basic information about lessons learned from deregistered facilities and suggested adding a code representing “implemented IST/ISO” paired with a field to indicate the nature of the change.

Some commenters wanted more detailed information about STAA to be provided in the RMP. Suggested additional information included: Descriptions of the alternatives evaluated; description of each option chosen for implementation and timeline; reasons for not implementing IST such as (1) cost; (2) technical feasibility; (3) conflicts with other regulatory requirements or good practices; (4) other hazards; (5) other (indicate reason) or by listing one of the factors included in the definition of “feasible:” time, economic, environmental, legal, social, or technological; and an attestation and checklist demonstrating a comprehensive accounting of potential benefits, savings, and avoided costs associated with each major option.

One commenter recommended that an independent body be in place to carefully review the facilities' IST/ISD evaluations to assist in determining whether or not such technologies are feasible and to prevent facilities from self-regulating.

Some commenters wanted STAA and documentation to be made publicly available, and allowed with reasonable protections, for genuine CBI and trade secrets. An advocacy group recommended allowing public comment and response on facilities' STAAs. A few commenters wanted STAA summaries to be available to at-risk communities and the public both online and offline, including at public meetings required at § 68.210.

Reasons given by commenters for providing public availability of STAA included:

• To hold companies accountable and facilitate significant process safety changes with appropriate public discussion and oversight from other stakeholders;
• To ensure right-to-know and transparency for affected workers and communities;
• To provide comments on the STAA and get implementing agency response;
• To have facilities that have adopted IST receive public credit for their positive steps; and
• To ensure opportunities for at-risk communities to engage with facilities about alternatives and prevention plans.

EPA is not requiring automatic submission of STAA information or documentation to EPA or requiring that it be made available to the public. EPA acknowledges there is much public interest in having STAA and documentation available to them, but STAA will be part of a PHA which can be a lengthy (e.g., the sectors subject to STAA requirements have multiple processes and some PHAs are hundreds of pages) technically complex document that could contain not only CBI, but sensitive security information involving process or equipment vulnerabilities. Some commenters' suggested solution of having facilities sanitize submitted documents and provide upfront justification of CBI claims would entail a significant level of burden upon industry and EPA. It would not be practical or good use of resources to have thousands of documents submitted to EPA, to any other body or with the RMP submission. EPA can inspect documents on-site or request their submission from facilities as needed.

EPA believes that primary utility of STAA information for the public is whether or not facilities are implementing IST and the nature of that change. EPA is requiring that basic information on IST being implemented be provided in the RMP submission in accordance with § 68.175(e)(7). Facilities must provide in their RMP any inherently safer technology or design measures implemented since the last PHA, if any, and the technology category (substitution, minimization, simplification and/or moderation). In the event of a public meeting held after an accident, EPA encourages facilities to provide information about any IST or other safer technology alternatives that the facility is using or could be using and suggests that the public use this forum to inquire about ISTs implemented at the facility.

EPA is not adopting an approval process for STAA analyses, either by an independent board, by the implementing agency, or by any emergency planning entity. We recognize nothing in the statute prohibits the adoption of an approval process. The language of CAA section 112(r)(7)(F) is directed towards the need for an operating permit under Title V of the CAA and therefore has no bearing on whether the underlying substantive rule may establish an approval process. In CAA section 112(r)(7)(B)(iii), the statute specifically requires EPA's rules to establish a system that provides for review and, if necessary revision of RMPs (see 40 CFR 68.220). Nevertheless, the approach we adopt in this final rule, which requires the owner or operator to conduct a STAA review and document its review in general and its reasoning for not adopting practicable IST/ISD, is consistent with the overall approach of the RMP rule to rely on the development and assessment of information to lead owners and operators to adopt reasonable measures to prevent accidents.

m. Clearinghouse

Some commenters, including a Federal agency, a state agency, environmental advocacy groups, and a local agency, supported the establishment of a publicly available online clearinghouse providing information about the feasibility and efficacy of safer substances and processes. A Federal agency commented that such a database would also be a useful resource for insurers, chemical process vendors, emergency responders, academic researchers, and other government agencies, such as OSHA.

One commenter remarked that such a clearinghouse should be dedicated to the topic of safer technology and alternatives and should be managed by either EPA, another Federal agency, or an independent third-party rather than industry-funded academics or institutions. One commenter suggested that a clearinghouse could be developed by EPA or a third-party such as CCPS or Texas A&M's Mary Kay O'Connor Process Safety Center.

A few industry trade associations remarked that the creation of a clearinghouse would be redundant with some resources already publicly available. For example, one trade association asserted that it has effectively created its own clearinghouse through the publication and maintenance of its own publicly available publications, semi-annual conferences, and regular member exchange forums. Additionally, this organization stated that it hosts a technology symposium every other year, where members can learn about new technologies, both from members sharing their experiences and directly from vendors and consultants. Another trade association suggested that the searchable database of all patents and patent applications available from the US Patent and Trademark Office can be used as a clearing house for safer technology and that information on unpatented technologies is readily available through the internet and other means.

Another industry trade association warned that a government clearinghouse would not reduce chemical accidents because each chemical process is highly complex and unique and it would be difficult to find value in a massive database of technologies. A commenter warned that any clearinghouse would be required to have many ground rules so as to clarify what factors were at play in the IST decision. The commenter expressed concern that the clearinghouse could be harmful or not useful if the information was selective in detail because an IST selected by a stationary source may be narrow in scope for a specific set of risks to be avoided or mitigated. The commenter also stated that it is possible companies would provide information lacking enough detail to be useful. Another commenter cautioned that one type of technology, system or design that works for one facility or process may not work for another facility or process, due to differing processes and other conditions.

EPA is not finalizing a provision to establish a clearinghouse in this rule. EPA will further consider the comments and suggestions on establishing a safer technologies and alternatives information clearinghouse should we pursue an effort to develop and establish such a clearinghouse in the future. Currently, industry and other stakeholders can share chemical safety and security best practices, including those involving safer technologies and alternatives, at the Executive Order 13650 best practices Web site.^[107] EPA encourages stakeholders to review information shared through this forum and to submit best practices on safer alternatives or other best practices that serve to improve chemical safety and security.

D. Stationary Source Location and Emergency Shutdown

EPA discussed the importance of location of stationary sources and their emergency shutdown capabilities in the preamble of the proposed rulemaking. However, EPA did not propose any provisions related to these issues.

1. Discussion of Comments on Stationary Source Location

The location of stationary sources, and the location and configuration of regulated processes and equipment within a source, can significantly affect the severity of an accidental release. The location of the stationary source in relation to public and environmental receptors may exacerbate the impacts of an accidental release, such as blast overpressures or concentrations of toxic gases, or conversely may allow such effects to dissipate prior to reaching receptors. EPA requested comments on whether to consider stationary source location requirements for future rulemakings, including the scope of such requirements, or whether the Agency should publish guidance. EPA received multiple comments on this issue.

Commenters indicated that EPA should use stricter standards for calculating blast radius areas for new and existing facilities to ensure that communities, schools, and hospitals are outside of the blast impact. One commenter stated that EPA should use information availability requirements to better inform and protect local communities from accidents. A Federal agency and state/local agency requested that EPA consider the stationary source location issue in future rulemakings. A professional organization requested that EPA consider a 2014 Fire Protection Research Foundation report in future requirements for stationary source location.

Several commenters argued that facilities should be located where no damage could occur to people and homes, asserting that the proposed rulemaking does not go far enough to ensure public safety. Some of these commenters specifically mentioned the Rancho LPG facility in San Pedro, California, and asked that EPA review the siting of this facility due to the danger it poses to the surrounding community.

A local agency and an advocacy group asked that EPA consider IST or risk reduction methodologies and the importance of buffer zones in siting of new stationary sources. Multiple state and local agencies and an association of government agencies requested new guidance and tools for localities to clarify additional requirements for stationary source location. One commenter stated that EPA should consider reverse 911 calls to public receptors in setting requirements.

However, numerous commenters opposed adding provisions to address stationary source location issues in the proposed rulemaking, citing OSHA's PSM regulations and the lack of authority in the CAA. One commenter stated that EPA should not propose any additional requirements on the location of stationary sources. Multiple comments indicated that states and localities, not EPA, should regulate the siting of facilities.

EPA will consider these comments when determining whether to develop guidance or propose stationary source location requirements in a future action.

2. Discussion of Comments on Emergency Shutdown

The RMP regulation requires owners and operators of stationary sources to develop and implement written operating procedures for the safe and timely emergency shutdown of Program 2 and Program 3 processes, to ensure operator training for these procedures, and for maintaining the mechanical integrity of emergency shutdown systems. However, the regulation does not explicitly require that all covered processes must include emergency shutdown systems.

EPA requested comment on whether emergency shutdown system requirements should be considered for future rulemakings, including the scope of such requirements, or whether the Agency should publish guidance.

Many commenters supported additional regulations and/or guidance on emergency shutdown systems regulations and/or guidance. Local agencies stated that EPA should issue regulations or guidance requiring that all processes be built such that they can be placed in a safe state during an emergency. Another local agency recommended that EPA publish guidance on emergency shutdown systems to assist regulated entities in evaluating various alternatives, but argued that including emergency shutdown systems in a future rulemaking would be infeasible for existing locations. One commenter stated that EPA should consider reverse 911 calls to public receptors in setting requirements. A state/local agency expressed support for emergency shutdown systems requirements in a future rulemaking, to include operating procedures and annual testing.

However, several commenters argued that EPA should not propose any additional requirements—regulations or guidance—on emergency shutdown systems. These commenters asserted that existing regulation and facility practices address emergency shutdown issues. One commenter supported EPA's decision to forgo an emergency shutdown system requirement, arguing that exclusion is consistent with RMP's performance-based nature, but opposed EPA's suggestion to issue a guidance document. Another commenter opposed a “one-size-fits-all” rule or guidance for emergency shutdown systems and argued that EPA should propose specific regulatory text in a future rulemaking should it decide to regulate emergency shutdown.

EPA will consider these comments when determining whether to develop guidance or propose emergency shutdown system requirements in a future action.

V. Emergency Response Preparedness Requirements

A. Emergency Response Program Coordination With Local Responders

1. Summary of Proposed Rulemaking

EPA proposed to require owners or operators of “responding” and “non-responding” stationary sources to coordinate response needs with local emergency planning and response organizations to ensure that resources and capabilities are in place to respond to an accidental release of a regulated substance. Responding stationary sources also would be required to comply with the emergency response program provisions of § 68.95 when the outcome of coordination activities demonstrated that local public emergency response capabilities were not adequate to appropriately respond to an accidental release at the stationary source, or when the LEPC or equivalent requested in writing that the owner or operator comply with the requirements of § 68.95. “Non-responding” stationary sources need not have complied with § 68.95 provided that the coordination activities indicated that adequate local public emergency response capabilities are available to appropriately respond to accidental releases at the source, appropriate mechanisms are in place to notify emergency responders when there is a need for a response, and the LEPC or equivalent has not requested in writing that the owner or operator comply with the requirements of § 68.95.

The proposed coordination provisions would have required coordination to occur at least annually, and more frequently if necessary to address changes at the source, in the source's emergency action plan, in local authorities' response resources and capabilities, or in the local community emergency response plan. The owner or operator would also have been required to document coordination activities, including the names of individuals involved and their contact information, dates of coordination activities, and the nature of coordination activities. The proposed coordination provisions of § 68.93 also would have required sources with regulated toxic substances to coordinate response actions with the LEPC or equivalent, and sources with only regulated flammable substances to coordinate with the local fire department. This language is similar to the language in § 68.90(b)(1) and (2) of the original rule, which requires that sources with toxic substances held above threshold quantities be included in the community emergency response plan developed under EPCRA, and sources with only regulated flammable substances held above threshold quantities coordinate response actions with the local fire department.

The proposed rulemaking retained all emergency response program provisions from § 68.95 of the original rule, and made two additions. The first was to modify § 68.95(a)(1)(i) to require that release notification procedures included procedures to notify Federal and state emergency response agencies, in addition to the existing rule's requirement to notify the public and local emergency response agencies. The second addition was to modify § 68.95(a)(4) to require the owner or operator to review and update the emergency response program annually, or more frequently if necessary, to incorporate recommendations and lessons learned from emergency response exercises, incident investigations, or other available information. The proposed rulemaking also would have replaced the phrase “local emergency planning committee” with the acronym “LEPC.”

2. Summary of Final Rule

In this rule, EPA has retained the proposed term “Responding stationary source” as a heading for § 68.90(a) and “Non-responding stationary source” as a heading for § 68.90(b), as an indication of whether or not a facility is required to comply with the emergency response program provisions of § 68.95. Section 68.90(a) is otherwise unchanged from the existing rule, as are § 68.90(b)(1), (2), and (3). EPA is also adopting as proposed paragraphs § 68.90(b)(4) and (5), which require the owner or operator of a non-responding stationary source to perform the annual coordination activities required under § 68.93, and the emergency notification exercises required under § 68.96(a), respectively.

The final rule adopts as proposed § 68.93, but with some changes, which are discussed in the following sections. Section 68.93 requires the owner or operator to coordinate response needs with local emergency planning and response organizations to determine how the source is addressed in the community emergency response plan and to ensure that local response organizations are aware of the regulated substances at the source, their quantities, the risks presented by covered processes, and the resources and capabilities at the facility to respond to an accidental release of a regulated substance.

Section 68.93(a) requires coordination to occur at least annually, and more frequently if necessary, to address changes at the source, in the source's emergency response and/or emergency action plans, and/or in the local community emergency response plan.

Section 68.93(b) requires coordination to include providing to the local emergency planning and response organizations, the facility's emergency response plan if one exists, emergency action plan, updated emergency contact information, and any other information that local emergency response planning and response organizations identify as relevant to local emergency planning. For responding stationary sources, § 68.93(b) also requires coordination to include consulting with local emergency response officials to establish appropriate schedules and plans for field and tabletop exercises required under § 68.96(b). Lastly, § 68.93(b) require the owner or operator to request an opportunity to meet with the LEPC (or equivalent) and/or local fire department as appropriate to review and discuss these materials.

Section 68.93(c) adopts as proposed the coordination documentation provisions without revision. Under § 68.93(c), the owner or operator is required to document coordination with local authorities, including the names of individuals involved in coordination and their contact information, dates of coordination activities, and the nature of coordination activities.

EPA is finalizing several modifications to § 68.95. EPA has adopted the proposed addition to § 68.95(a)(1)(i), which requires that release notification procedures include procedures to notify Federal and state emergency response agencies, in addition to public and local emergency response agencies. The final rule also adopts as proposed revisions to § 68.95(a)(4), with some modifications. The final rule requires the owner or operator to review and update the emergency response plan as appropriate based on changes at the source or new information obtained from coordination activities, emergency response exercises, incident investigations, or other available information, and ensure that employees are informed of the changes.

3. Discussion of Comments and Basis for Final Rule Provisions

Many commenters, including industry trade associations, advocacy groups, professional organizations, facilities, Federal and state agencies, and others supported EPA's efforts to increase emergency response program coordination between facilities and local responders. Other commenters including industry trade associations and regulated facilities stated the proposal would potentially duplicate other Federal or state requirements or voluntary efforts, or suggested that EPA should increase enforcement efforts rather than impose additional requirements in certain areas.

Although ATF ruled that the fire at West Fertilizer in West, Texas was intentionally set,^[108] the incident highlighted the need for better coordination between facility staff and local emergency responders. The approach EPA adopts in the final rule retains the proposed rulemaking's promotion of coordination between facilities and responders while recognizing the concerns of many of the commenters about LEPCs and owners and operators making determinations about the abilities and roles of owners and operators as well as LEPCs. We preserve local flexibility under our approach. Public comments on each proposed provision to the emergency response coordination and emergency response program provisions of Subpart E are discussed further in this preamble, along with EPA's responses and decisions for the final rule.

a. Designation of “Responding” and “Non-Responding” Stationary Sources

Some commenters objected to EPA's proposal to designate all sources as either responding or non-responding sources. These commenters pointed out these discrete categories do not accurately represent the realities of emergency response, which can include many different degrees of involvement by facilities and local communities in planning, preparing for and responding to accidental release events. One commenter stated that all facilities, regardless of whether they are responding or non-responding facilities, should have a partnership with the LEPC or local emergency responders. Another commenter stated that even facilities with full on-site emergency response capability would likely rely on local public responders to order and manage shelter-in-place actions or evacuations. Another commenter stated that all facilities are responsible for and must be prepared to deal with the regulated substances they handle and there should be no such thing as a “non-responding” stationary source, but this does not mean every facility needs a technician-level hazmat response team. This commenter stated that every facility must be able to immediately notify emergency response agencies when a release having the potential to impact the public occurs, take actions to protect the lives of employees and the public, minimize or contain the release, and coordinate with local response agencies who respond to the release.

EPA agrees there is a wide spectrum of planning, preparedness, and response arrangements available to facilities and local communities, and the two categories of “responding” and “non-responding” facilities do not fully capture this continuum. EPA also acknowledges there is some overlap between the obligations of non-responding and responding facilities. For example, both non-responding and responding facilities must have mechanisms or procedures in place to notify emergency responders about accidental releases, and both types of sources must coordinate emergency response activities with local responders (and under the final rule, these coordination activities must occur annually and be documented, as further described further in this preamble). Because the outcome of coordination activities may result in different types of response arrangements involving regulated facilities and communities, EPA understands that a facility's designation as “responding” or “non-responding” does not, by itself, explain all facets of emergency preparedness and response for the facility.

These designations are still useful, however, because “responding” facilities must meet certain requirements that “non-responding” facilities are not required to meet. Responding facilities must comply with all of the provisions of § 68.95, which include developing an emergency response plan, developing procedures for the use, inspection, and testing of emergency response equipment, conducting training for employees in relevant procedures, and updating the emergency response plan to reflect changes at the source. Any facility that plans to use its employees to take response actions beyond those specified in its emergency action plan under 29 CFR 1910.38 as a result of an accidental release at the source—which could include, for example, donning emergency air breathing apparatus in order to enter an area where a toxic gas leak has occurred with the intention of stopping or controlling the release—would be expected to have obtained appropriate equipment and training, and to address these activities in its emergency response program, even if the facility is also relying on local responders to supplement its own response, or to manage offsite response actions such as evacuations and sheltering-in-place. Therefore, in the final rule, EPA has retained the proposed terms “Responding stationary source” as a heading for § 68.90(a) and “Non-responding stationary source” as a heading for § 68.90(b), as an indication of whether or not a facility is required to comply with the emergency response program provisions of § 68.95.

b. Evaluating Resources and Capabilities of Local Responders

The proposed rulemaking would have made the owner or operator's decision to develop an emergency response program contingent on the outcome of local coordination activities. Under the NPRM, in order to be a non-responding facility, the owner or operator would have been required not only to coordinate with local responders and have appropriate notification mechanisms in place, but also to confirm that adequate local public emergency response capabilities are available to appropriately respond to any accidental release of the regulated substances at the stationary source.

EPA received numerous comments objecting to this provision. Many commenters, including industry trade associations, government agencies, an association of government agencies, facilities, and other commenters, expressed concern over ambiguity in the terms “adequate” response capabilities and “appropriate” response. One commenter noted that unless they are notified by the LEPC or fire department, facilities will not know when a change in community response capabilities or resources occurs. Another commenter pointed out there is no accepted standard for community emergency response capability applicable nationwide, and that response resources and capabilities can only be evaluated in the context of the overall community's response plan.

EPA has not adopted this provision in the final rule. While EPA believes it is important for regulated facilities and local responders to share information on response resources and capabilities, the Agency acknowledges the capabilities and resources of local response organizations are subject to numerous influences, including other potential demands within the community for local response resources, local government organization and budgets, Federal, state, and local regulations, and others. Few if any of these factors are within the purview of the owners and operators of individual regulated facilities, and therefore in many cases, owners and operators will not be in a position to judge the adequacy of local response capabilities and resources.

c. Developing an Emergency Response Program Upon Receiving a Written Request From the LEPC

The NPRM would also have required the owner or operator to develop an emergency response program in accordance with § 68.95 upon receiving a written request to do so from the LEPC or local response authorities. Numerous commenters objected to this provision. These commenters indicated that the provision would allow or incentivize LEPCs to absolve themselves of their emergency response obligations under EPCRA, even if this may not be in the best interest of the overall emergency response. Several commenters stated that allowing local authorities to “opt out” of their responsibilities would undermine the mission of those authorities, and that relying on facilities to fulfill emergency response obligations if an LEPC “opts out” may not be within these facilities' authority or capability. Several commenters also expressed concern that EPA's proposal did not include criteria LEPCs must meet before requesting a facility become a responding facility. One commenter representing an association of state government response commissions stated that this provision would cause the vast majority of LEPCs to request facilities become responding facilities.

EPA disagrees the proposed provision would have absolved local responders of their responsibilities under EPCRA or allowed them to disregard their other response obligations. The proposed provisions would have had no effect on local authorities' community emergency planning responsibilities under EPCRA. Also, even in situations where regulated sources maintain full emergency response capabilities, local responders would still be responsible for managing the aspects of the response external to the source, such as community evacuations and sheltering-in-place. Nevertheless, EPA has decided not to finalize this provision because of the objections raised by commenters, and because it would have allowed local governments to place emergency response program obligations on the owners or operators of regulated facilities without requisite knowledge of the facility's operations, business practices, financial condition, and other relevant factors. Also, commenters pointed out that many facilities—particularly small businesses—would as a practical matter simply be unable to manage all of their own response needs, which could include maintaining a full hazardous materials response team, as well as firefighting capabilities. In the preamble to the original rule, EPA acknowledged that small businesses would often be unable to manage these duties.

d. Emergency Response Coordination Activities

Many commenters, including industry trade associations, advocacy groups, facilities, government agencies, professional organizations, and others supported EPA's proposed requirements for improved emergency response coordination between facilities and local responders. Several commenters recommended EPA clarify what is meant by “coordination.” Some commenters opposed EPA's proposed coordination requirements on the basis that these activities were already required under other regulations, or were being carried out voluntarily. Other commenters expressed concerns about an historical lack of participation by LEPCs in emergency response coordination activities, or that the proposed coordination provisions would place increased burdens on local responders.

In the final rule, EPA has adopted as proposed the emergency response coordination provisions of § 68.93, with some changes. One significant change relates to the modified applicability provisions discussed previously. In addition to removing the two provisions from § 68.90 of the final rule that would have made the owner or operator's decision to develop an emergency response program contingent on the outcome of local coordination activities, and required the owner or operator to develop an emergency response program upon receiving a written request to do so from the LEPC or local response authorities, EPA has also removed the proposed language in § 68.93 that placed the focus of coordination on ensuring response resources and capabilities are in place. This language has been replaced with language that places the focus of coordination on sharing information related to emergency planning.

EPA has also clarified what coordination activities are required. In the final rule, under § 68.93 the owner or operator is required to provide local authorities with information about the regulated substances at the source, their quantities, the risks presented by covered processes, and the resources and capabilities at the facility to respond to an accidental release of a regulated substance. Section 68.93(a) requires coordination to occur at least annually, and under § 68.93(b), the owner or operator is also required to provide the facility's emergency response plan if one exists, the emergency action plan required under 29 CFR 1910.38, updated emergency contact information, and any other information local emergency planning and response organizations identify as relevant to local emergency planning. EPA notes that under 29 CFR 1910.38(b), OSHA requires emergency action plans to be kept in writing, unless an employer has 10 or fewer employees, in which case they may communicate the plan orally to employees. Under the final rule, if the owner or operator has a written emergency action plan, that written plan should be provided to local authorities, but if the plan is an oral plan, the owner or operator may also communicate the plan orally to local authorities.

In requiring “any other information that local emergency planning and response organizations identify as relevant to local emergency planning,” EPA is encouraging local emergency officials to consider what other facility information may aid them in preparing for emergencies at the source beyond those specific elements identified in § 68.93 and § 68.93(b), and request such information from the owner or operator when conducting annual coordination activities. Such information could include accident histories, portions of incident investigation reports relevant to emergency response, incident after-action reports, records of notification exercises, field and tabletop exercise evaluation reports, etc. The owner or operator is required to provide any information requested by local emergency planning and response organizations, to the extent the information is relevant to local emergency planning.

EPA disagrees with commenters who suggested not adopting the proposed emergency response coordination requirements on the basis that they are already required under other regulations, or are being carried out voluntarily. While it is true that in some cases, other Federal or state regulations contain emergency response coordination provisions similar to those in the final rule, many regulated sources are not subject to other regulations with requirements comparable to those in the final rule. Also, in locations without functional LEPCs, other local response authorities may be carrying out local emergency planning functions, and these organizations may be unable to rely on authorities granted to LEPCs under EPCRA to obtain needed information. Where regulated sources are already subject to other Federal or state emergency response coordination requirements comparable to those in the final rule, compliance with those regulations may be used to demonstrate compliance with the final rule, to the extent the activities meet the specific requirements of the rule. Similarly, while EPA agrees that some facilities may already voluntarily carry out the coordination activities required under the final rule, not all regulated facilities do so. Facilities that already carry out these activities voluntarily may also use them to demonstrate compliance with the final rule to the extent the activities meet the specific requirements of the rule.

EPA understands some communities do not have functional LEPCs, but has accounted for this possibility by requiring coordination to be with “local emergency planning and response organizations.” This term is intended to encompass all manner of local public emergency planning and response organizations. In many cases this will be the LEPC, but in other cases it may be a local emergency management agency, a local fire department, or another local response organization (or, if appropriate, multiple organizations). These non-LEPC planning entities can use this provision to obtain necessary planning information even when they lack the authority granted LEPCs under EPCRA 303(d)(3). Regardless of whether or not their community has an active LEPC, EPA expects owners and operators of regulated sources to make good faith efforts to carry out the coordination activities required in the final rule. If local emergency planning and response organizations decline to participate in coordination activities, or the owner or operator cannot identify any appropriate local emergency planning and response organization with which to coordinate, the owner or operator should document their coordination efforts, and continue to attempt to perform coordination activities at least annually.

EPA is also aware that increasing regulated facilities' emergency response coordination obligations will often place increased demands on local emergency planning and response organizations through increased coordination requests made by the owners or operators of regulated sources located in their communities. This is an unavoidable consequence of increasing the owner or operator's emergency response coordination obligations. However, the final rule's emergency response coordination requirements are intended to be a straightforward information exchange for both regulated sources and local response organizations, and therefore should not be highly burdensome for either party. Also, the regulatory requirements for coordination have been placed on the owner or operator, rather than local emergency planning and response organizations. Therefore, local response organizations are not obligated to participate in the coordination activities specified in the final rule. In our estimate of the burden of the rule, we have conservatively projected an estimate of the cost of coordination on local responders. EPA expects in most cases, local responders will participate in these coordination activities because it is in their best interest to have up-to-date information about the risks posed by regulated stationary sources in their community and sources' emergency response plans.

e. Frequency of Emergency Response Ccoordination Activities

Many commenters, including state or local agencies and industry trade associations, expressed support for EPA's proposal to require annual emergency response coordination activities between owners and operators and local emergency response officials. Commenters noted such ongoing coordination could help clarify roles and responsibilities and refresh contacts. Some commenters expressed concerns that annual coordination may be difficult or impractical if a source is remote or if local authorities refuse to participate. One commenter suggested that coordination activities should occur on a regular basis at an appropriate frequency determined by the facility and when there is a significant change to the source's emergency plan.

EPA has decided to finalize as proposed the requirement at § 68.93(a) for coordination to occur at least annually and more frequently if necessary. EPA agrees with the majority of commenters that believe that regular ongoing coordination is useful to address changes at the source and in the local community emergency plan. EPA believes most sources are located close enough to local responders to make annual coordination activities practical. Where necessary, owners and operators and local authorities may conduct coordination activities remotely (e.g., using conference calls, webinars, email, etc.). EPA does not agree the frequency of coordination should be left completely up to the source. Sources and local response organizations may choose to coordinate more frequently than annually, but the Agency believes annual emergency coordination between regulated sources and local responders is necessary to the development and maintenance of effective response plans,^[109] and unlikely to impose an undue burden on any source.

f. Annual Coordination Meetings

In the proposed rulemaking, EPA did not specifically propose to require that the owner or operator “meet with” local authorities to conduct annual coordination. However, in the preamble to the proposal, EPA did indicate that as part of the coordination, the owner or operator and the local response authorities should “work together” to determine who will respond if an incident occurs, and what would be an appropriate response. Additionally, in the information availability section of the preamble to the proposed rulemaking, EPA requested comment on whether the Agency should require owners and operators to meet with LEPCs and emergency responders. Several commenters recommended EPA clarify that coordination activities should include regular meetings between the owner or operator and local authorities. These commenters noted that such regular meetings would provide opportunities for both parties to exchange, update, and discuss information relating to emergency response planning. One commenter noted that annual meetings would allow the owner or operator to communicate potentially security-sensitive information needed for emergency preparedness and response. A few commenters noted that while they were in favor of coordination meetings, the owner or operator should not be held to a requirement for such meetings in situations where local authorities are unable or unwilling to participate. Another commenter stated that coordination meetings should occur, but the frequency of such meetings should be left up to the owner or operator and local authorities to decide.

In § 68.93(b) of the final rule, as part of the required annual coordination activities, EPA is requiring the owner or operator to request an opportunity to meet with the local emergency planning committee (or equivalent) and/or local fire department. The purpose of the annual coordination meeting is to allow the owner or operator to update and discuss the information being provided to local authorities, and to allow local authorities to provide the owner or operator with updated information on how the source is addressed in the community emergency response plan. The annual coordination meeting will also provide an opportunity for local authorities to request any other information that may be relevant to local emergency planning, and for the owner or operator to provide this information. In the final rule, EPA has worded the meeting requirement to only require the owner or operator to request such a meeting, so that the owner or operator would not be required to hold a meeting if local authorities are unable or unwilling to participate. The forum for coordination meetings is left up to the reasonable judgement of the owner or operator and local response authorities. They may choose to hold a meeting specifically for this purpose, or combine the coordination meeting with another appropriate meeting, such as a regularly scheduled LEPC meeting, if both parties agree to the arrangement. Where necessary, owners and operators and local authorities may hold meetings remotely (e.g., via conference call or webinar).

g. Coordination of Exercise Frequencies and Plans

In § 68.96(b) of the final rule the owner or operator of a responding stationary source is required, as part of their emergency response coordination activities, to consult with local emergency response officials to establish appropriate frequencies and plans for tabletop and field exercises. This provision was added because numerous commenters, including industry associations, facilities, government agencies, and others, objected to the potentially high burden associated with conducting field exercises every five years and tabletop exercises every year. An association of government agencies noted that requiring field exercises every five years and tabletop exercises every year would place substantial burdens on LEPCs and response agencies, particularly as these organizations are often composed of volunteers. This commenter recommended that the frequency and scope of field and tabletop exercises be determined as part of the coordination process. EPA adopted a modified form of this provision (which is discussed further in the following preamble section on Emergency Response Exercises) in the final rule, and therefore added language to § 68.93 (b) to also require that for responding stationary sources, coordination must include consulting with local emergency response officials to establish appropriate schedules and plans for field and tabletop exercises.

EPA understands there may be cases where local emergency response agencies are unable or unwilling to coordinate with a regulated stationary source on exercise frequencies and plans, or to participate in exercises. In such cases, the owner or operator may establish appropriate exercise frequencies and plans on their own, provided they meet the minimum requirements set forth in § 68.96. Also, the owner or operator should revisit their exercise schedules and plans at the next annual coordination opportunity with local response officials, so that these officials are given an opportunity for input on exercise schedules and plans, even if they remain unable to participate in the exercises.

h. Documentation of Coordination Activities

Many commenters, including state and local agencies and industry trade associations, expressed support for EPA's proposal to require documentation of coordination activities. Several commenters requested EPA clarify how facilities should document coordination activities when local responders are not available or responsive to a facility's attempts to coordinate. Some commenters suggested that EPA require facilities make a reasonable attempt to make arrangements to coordinate with local responders and document any failure to complete such arrangements. One commenter suggested facilities should be required to seek a written or electronic acknowledgement from local responders of coordination efforts, or, if unavailable, document any efforts made to coordinate. A few commenters expressed opposition to the requirement for documentation of coordination. One indicated that such documentation could “serve as a basis for mutual accusations or second-guessing between first responders and the RMP-regulated facility in the aftermath of an emergency.” Another indicated that fire departments in California have found CalARP requirements to document emergency coordination to be a large burden. A third commenter stated that if facilities are included in the community response plan, this should be all the documentation needed to demonstrate coordination.

EPA has decided to finalize the requirement at § 68.93(c) for coordination to be documented, as proposed (the final rule reverses the order that the coordination and documentation provisions appear in the regulatory text). The final rule does not specifically require the owner or operator to seek acknowledgement from local responders of coordination efforts. The owner or operator may seek such acknowledgement if desired, but local authorities are not required to provide it. EPA believes the required documentation elements, which include the names of individuals involved in coordination activities and their contact information, the dates of coordination activities, and the nature of coordination activities, should clearly demonstrate whether local responders were involved in coordination, without requiring any other specific acknowledgement from local responders. EPA agrees with commenters that suggested the owner or operator should document any unsuccessful attempts to coordinate with local response organizations. The final rule does not specifically require the owner or operator to document unsuccessful coordination attempts, but EPA believes it will be in the owner or operator's best interest to do so, and allow the owner or operator to demonstrate their good faith efforts to conduct coordination activities in the event an implementing agency requests this information.

EPA does not agree with commenters' objections to documentation of coordination activities. If response to an emergency goes badly, documentation of prior coordination is more likely to clarify deficiencies than obscure or exacerbate them. The objection that documentation could cause a large burden on fire departments is not applicable to this provision, as the requirement for documentation in this rule is placed on the owner or operator rather than local responders, and in any case, the Agency does not view the documentation requirement as highly burdensome. Most of the documents the final rule requires the owner or operator to provide to local authorities are either already required to exist (i.e., emergency response plan and emergency action plan), or should require minimal effort to produce (i.e., updated emergency contact information, names and contact information of individuals involved in coordination activities, dates of coordination activities, and the nature of coordination activities). EPA views these documentation requirements as straightforward and minimally burdensome.

During coordination meetings, EPA encourages owners and operators to provide local emergency response officials with additional documentation relating to emergency planning if those officials request it. The annual coordination provisions require the owner or operator to ensure local response organizations are aware of the regulated substances at the source, their quantities, the risks presented by covered processes, and the resources and capabilities at the facility to respond to an accidental release of a regulated substance. The final rule also requires the owner or operator to provide any other information local emergency planning and response organizations identify as relevant to local emergency planning. In most cases, the Agency believes the most efficient way for the owner or operator to provide such information is to not only discuss it during annual coordination meetings, but also to provide appropriate documentation to local authorities.

Lastly, EPA does not agree that a facility's inclusion in the community response plan is sufficient documentation to demonstrate annual coordination. EPA notes that community emergency response plans are not prepared or maintained by stationary sources, and that EPCRA does not require community emergency plans to be updated annually. Without regular emergency response coordination activities involving local authorities, the owner or operator could remain unaware of important changes in the community emergency plan, and local responders could remain unaware of changes at the source that could potentially affect the response to an accidental release.

EPA believes there is a wide range of potential outcomes from emergency response coordination activities, but the primary purpose of such coordination should be the regular sharing of information between the owner or operator and local response authorities. Both the owner or operator and local responders should benefit from this exchange by becoming more aware of each organization's response capabilities, resources, and procedures. Based on these increased coordination activities, both regulated sources and local response organizations will be better able to adapt their response plans and procedures to updated information. This information exchange could also prompt some facilities to enhance their existing response capabilities, and even to develop a full emergency response program where none previously existed. Conversely, such increased coordination could result in local authorities, in consultation with an owner or operator, deciding that local public responders are better positioned to respond to releases of regulated substances at the source than the facility itself. Additionally, coordination could lead to development of mutual aid agreements with neighboring facilities, arrangements with response contractors, or other means to improve community and/or facility response plans, procedures, and resources. Such measures could enhance both the community's and facility's ability to effectively respond to emergencies without necessarily requiring a facility to maintain its own hazardous materials response team and/or fire brigade, unless the owner or operator, after coordinating with local authorities, decides this is the most effective approach.

i. Changes to Emergency Response Program Provisions

The proposed rulemaking contained two substantive changes to the emergency response program provisions of § 68.95. The first change would have modified the emergency response plan provision in § 68.95(a)(1)(i) that requires the plan to include procedures for informing the public and local emergency response agencies about accidental releases, to also require these procedures to inform appropriate Federal and state emergency response agencies about accidental releases. EPA received no comments on this provision, and therefore is finalizing it as proposed.

The second change would have modified § 68.95(a)(4). Under the existing rule, this provision requires the emergency response program to include procedures to review and update the emergency response plan to reflect changes at the stationary source and ensure employees are informed of changes. The proposed change would have required the owner or operator to review and update the emergency response plan annually, or more frequently if necessary, to incorporate recommendations and lessons learned from emergency response exercises, incident investigations, or other available information.

Some commenters stated that requiring annual updates to the facility emergency response plan is unnecessary, and that EPA should allow updates to be performed less frequently, such as every three or five years, unless changes occur. Others stated that the proposed requirement was vague and should be clarified. A few commenters, including an industry trade association and a private citizen, commented that EPA's proposed requirement to require annual updates to emergency response plans incorrectly assumes the owner or operator will know when changes in community emergency response resources and capabilities occur. One facility requested EPA clarify in the final rule that facilities would not be deemed noncompliant if changes in local authorities' response plans or capabilities occur without notification to the facility. A private citizen suggested EPA add a requirement for local response authorities to provide a copy of the local community emergency response plan to the facility.

The final rule has adopted a modified version of the proposed emergency response plan update provision. Under the final rule, the owner or operator must review and update the emergency response plan as appropriate based on changes at the source or new information obtained from coordination activities, emergency response exercises, incident investigations, or other available information, and ensure that employees are informed of the changes. EPA agreed with commenters who stated that requiring annual emergency response plan updates is unnecessary. EPA is not finalizing a requirement to update the emergency response plan annually, because while coordination activities will occur annually, they may not always generate information that necessitates changes to the facility's emergency response plan. Other events that could trigger updates to the emergency response plan, such as incident investigations and field and tabletop exercises, may also occur less frequently than annually, and may or may not produce information that could affect the emergency response plan. Therefore, EPA has decided to finalize a more flexible update provision. Under the final rule, the owner or operator is required to update the emergency response plan, but only when changes at the source, or new information obtained from coordination activities, exercises, incident investigations, or other information sources make it appropriate to change the plan.

EPA disagrees with commenters who stated the owner or operator will be unaware of changes in community emergency response resources that could affect the source's emergency response plan. EPA believes the annual coordination provision should ensure the owner or operator is kept up to date on relevant changes in the community emergency response plan. EPA agrees with commenters that the owner or operator should not be held responsible for updating the facility emergency response plan to reflect changes in the local community emergency response plan if local response officials do not provide the necessary information. However, the Agency is not requiring local authorities to provide a complete copy of the local community emergency plan to the owner or operator. Local authorities may provide it if they choose, and in some cases the community emergency response plan may be publicly available information. However, the local community emergency response plan may also contain a significant amount of information that is not relevant to the owner or operator, so local response authorities may prefer to provide only the information from the community emergency response plan that relates to the stationary source.

In the final rule, the Agency has also included a requirement to ensure employees are informed of any changes to the emergency response plan. This requirement was already in § 68.95(a)(4) of the existing rule, but had inadvertently been omitted from the proposed rulemaking language that revised this section. One commenter noted this issue, and stated that workers should continue to be involved in reviewing the emergency response plan. EPA agrees, and therefore has restored this provision in the final rule.

Lastly, EPA is finalizing the proposal to replace the term “local emergency planning committee” with the acronym “LEPC.” EPA received no comments on this issue.

B. Facility Exercises

1. Summary of Proposed Rulemaking

In § 68.96 of the NPRM, EPA proposed to require three types of emergency response exercises under Subpart E of the RMP rule—notification, field, and tabletop exercises. Under § 68.96(a), EPA proposed to require all stationary sources with any Program 2 or Program 3 process to conduct annual notification exercises that would include contacting the Federal, Tribal, state, and local public emergency response authorities and other external responders that would respond to accidental releases at the source. EPA also proposed that these exercises be documented and written records maintained for a period of five years.

Under § 68.96(b), EPA proposed that responding stationary sources develop and implement an exercise program that includes field and tabletop exercises. Under § 68.96(b)(1), field exercises would have been required at least once every five years, and within one year of any accidental release meeting the accident history reporting requirements of § 68.42. Under § 68.96(b)(2), tabletop exercises would have been required annually, except during the calendar year when a field exercise was conducted. Also under these provisions, when planning field and tabletop exercises, EPA proposed to require the owner or operator to coordinate with local public emergency responders and invite them to participate in exercises.

Lastly, under § 68.96(b)(3), EPA proposed to require the owner or operator to prepare an evaluation report for both field and tabletop exercises, within 90 days of the exercise. The report would require a description of the exercise scenario, names and organizations of each participant, an evaluation of the exercise results including lessons learned, recommendations for improvement or revisions to the emergency response exercise program and emergency response program, and a schedule to promptly address and resolve recommendations. In the preamble to the proposed rulemaking, EPA indicated the report would also include an evaluation of the adequacy of coordination with local emergency response authorities, and other external responders, as appropriate.

2. Summary of Final Rule

EPA is finalizing the notification exercise provisions of § 68.96(a) as proposed but with modifications. Under § 68.96(b), the final rule requires responding stationary sources to develop and implement an exercise program that includes both field and tabletop exercises; however, EPA is modifying the exercise frequency to allow an owner or operator to establish a schedule in coordination with local officials, with minimum timeframes prescribed in the rule. Exercises must involve facility emergency response personnel and, as appropriate, emergency response contractors. When planning emergency response field and tabletop exercises, the owner or operator must coordinate with local public emergency response officials and invite them to participate in the exercise.

a. Field Exercises

Section 68.96(b)(1) requires the owner or operator to conduct field exercises involving a simulated accidental release of a regulated substance. Under § 68.96(b)(1)(i), as part of the coordination with local emergency response officials required by § 68.93, the owner or operator is required to consult with these local officials to establish an appropriate frequency for field exercises. However, in all cases, the owner or operator must conduct a field exercise at least once every ten years.

Section 68.96(b)(1)(ii) identifies the scope of the field exercises including tests of: Notification procedures; procedures and measures for emergency response actions (including evacuations and medical treatment); and communications systems. Field exercises must also involve: Mobilizing of facility emergency response personnel, including contractors, as appropriate; coordinating with local emergency responders; deploying emergency response equipment; and any other action identified in the emergency response program, as appropriate.

b. Tabletop Exercises

Section 68.96(b)(2) requires the owner or operator to conduct tabletop exercises involving the simulated accidental release of a regulated substance. Under § 68.96(b)(2)(i), as part of the coordination with local emergency response officials required by § 68.93, the owner or operator is required to consult with these officials to establish an appropriate frequency for tabletop exercises. However, in all cases, the owner or operator must conduct a tabletop exercise at least once every three years.

Section 68.96(b)(2)(ii) requires tabletop exercises to include discussions of: Procedures to notify the public and the appropriate Federal, state, and local emergency response agencies; procedures and measures for emergency response including evacuations and medical treatment; identification of facility emergency response personnel and/or contractors and their responsibilities; coordination with local emergency responders; procedures for equipment deployment; and any other action identified in the emergency response plan, as appropriate.

c. Documentation and Alternatives

EPA is finalizing the documentation provisions of § 68.96(b)(3) as proposed. The owner or operator must prepare an exercise evaluation report within 90 days of each field and tabletop exercise.

The final rule also adds § 68.96(c) to describe alternative means of meeting RMP exercise requirements. Under § 68.96(c)(1), the owner or operator may satisfy the requirement to conduct notification, field and/or tabletop exercises through exercises conducted to meet other Federal, state or local exercise requirements, provided such exercises meet the RMP exercise requirements of § 68.96(a) and/or (b), as appropriate.

Under § 68.96(c)(2), the owner or operator may satisfy the requirement to conduct notification, field and/or tabletop exercises by responding to an accidental release, provided the response includes the actions indicated in § 68.96(a) and/or (b), as appropriate. When response to an accidental release is used to meet field and/or tabletop exercise requirements, the final rule requires the owner or operator to prepare an after-action report comparable to the exercise evaluation report required in § 68.96(b)(3), within 90 days of the incident.

3. Discussion of Comments and Basis for Final Rule Provisions

Many commenters, including industry trade associations, facilities, government agencies, environmental advocates, private citizens, and others supported EPA's proposal to incorporate emergency response exercise requirements into the RMP rule. Most commenters supported EPA's proposal to require notification exercises. Many commenters also supported incorporating requirements for field and tabletop exercises into the RMP rule, but some of these commenters also recommended various changes to the proposed provisions. Other commenters, including industry trade associations, facilities, and others, recommended eliminating field and/or tabletop exercises. The approach adopted in this rule increases the flexibility for local responders and stationary source owners and operators to tailor their exercises to their communities and to their resources. Public comments on each proposed requirement within the emergency response exercise provisions of Subpart E are discussed further in this preamble, along with EPA's decisions for the final rule.

a. Notification Exercises

Almost all commenters that addressed EPA's proposed notification exercise requirements supported those requirements as proposed. Many of these commenters stated notification systems must be tested regularly to ensure they function successfully in the event of an emergency. A few commenters recommended changes to the notification exercise requirement. One commenter suggested notification exercises should occur every five years unless changes occur (e.g., management, operation, or physical changes), in which case they should occur within 60 days of the change. Another commenter supported a requirement to confirm emergency contact information but opposed a requirement to send an actual “test” notification, stating this would be an unnecessary burden on facilities and responding organizations. A different commenter requested EPA exempt RCRA-permitted facilities from annual notification exercise requirements, where the RMP-regulated process is also covered by a RCRA permit, stating the proposed requirements are duplicative of RCRA requirements.

EPA disagrees notification exercises should occur every five years unless changes occur, because the Agency believes five years is too long of a gap to confirm whether emergency notification information is correct and emergency notification systems function properly. For example, EPA notes that emergency contact information provided in RMPs frequently changes, particularly when facilities go several years between RMP updates. For this reason, in 2004 the Agency modified the RMP submission requirements to require emergency contact information provided in RMPs to be corrected within one month of any change in that information. EPA also disagrees management, operational, and physical changes at the facility necessarily represent appropriate triggers for verification of emergency response contact information. In some cases, such changes may affect emergency notification, but notification systems and procedures may also be affected by other changes, such as changes in the community emergency response plan. While EPA believes it would be beneficial for the owner or operator to update their emergency contact information and confirm the functionality of notification systems whenever relevant changes occur, in some cases changes that affect emergency contact information and notification systems may be infrequent, and result in facility personnel and local responders becoming unfamiliar with stationary source emergency notification procedures. EPA believes a requirement for annual notification exercises will ensure that emergency contact information and notification systems remain relatively current, and also provide regular training for facility personnel and local responders.

EPA also disagrees that requiring an actual test of the facility's notification system is unnecessary. Requiring annual testing of notification systems should prevent situations where emergency notification systems are only found to be ineffective when they are most needed. Short of actually using the emergency notification system during an accidental release, performing a test of the facility's emergency notification system is the most practical way to evaluate whether or not the system is functional.

EPA expects the notification exercise will involve testing of on-site notification equipment and procedures, including contacting each entity listed on the facility's notification list to verify the contact information and identify that the facility is conducting a notification exercise. Therefore, EPA does not believe testing notification mechanisms is unduly burdensome. EPA also disagrees with exempting RCRA-permitted facilities from the notification exercise requirement. However, in the final rule, EPA has added § 68.96(c) to clarify that exercises conducted to meet other Federal, state, or local exercise requirements will also satisfy the requirements of this rule, provided such exercises meet all of the applicable requirements of the RMP exercise provision.

Due to the significant support for and minimal opposition to the proposed notification exercise requirements of § 68.96(a), EPA is finalizing those requirements without modification. Therefore, under the final rule, all regulated sources with any Program 2 or Program 3 process must conduct an exercise of the source's emergency response notification mechanisms at least once each calendar year. During listening sessions conducted under Executive Order 13650, members of the public expressed significant concerns about ineffective emergency notification systems and procedures during accidental release events at regulated sources, and about receiving little or no information on procedures for evacuation and sheltering-in-place. In most cases, community notification, evacuation, and sheltering are managed by local authorities after receiving an emergency notification from the regulated source. EPA encourages owners and operators to work with local authorities to perform joint comprehensive testing of facility and community notification systems where possible, and to provide updated information to local communities on evacuation and sheltering procedures. In some cases, regulated facilities provide direct notification to nearby residents and other members of the community when an accident has occurred. These may include audible and/or visual alarms and sirens, reverse 911 calling systems, or other direct notification systems. Where such systems are in place, annual notification exercises should include tests of those systems during the exercise. In either case, EPA recommends regulated sources and communities work together after conducting notification exercises to evaluate the effectiveness of notification, evacuation, and sheltering systems and procedures, and make improvements to those systems and procedures as appropriate, based on lessons learned during exercises.

b. Field and Tabletop Exercises

EPA received numerous comments on the proposed field and tabletop exercise provisions. Most commenters, including industry trade associations, facilities, government agencies, environmental advocates, and others provided general support for including field and tabletop exercise requirements in part 68, although many also recommended changes to the required frequency of field and tabletop exercises, expressed concerns regarding any requirement for local public responders to be involved in exercises, or recommended other changes to the proposed requirements. Several other commenters entirely opposed adding field and tabletop exercise requirements to the rule. In general, these commenters stated that field and tabletop exercises were unduly burdensome on both facilities and local responders, and exercises are unnecessary because annual coordination activities would be sufficient to prepare facility employees and local responders to respond to accidental releases.

EPA disagrees with comments that recommend completely eliminating requirements for field and/or tabletop exercises in the final rule. The Agency views exercises as an important component of an emergency response program for responding stationary sources, because it allows these sources to implement their emergency response plans, test their actual response procedures and capabilities, identify potential shortfalls, and take corrective action. EPA also continues to believe both field and tabletop exercises will provide essential training for facility personnel and local responders in responding to accidental releases, and will ultimately mitigate the effects of such releases at RMP facilities. Therefore, in the final rule, EPA is requiring all responding stationary sources to perform field and tabletop exercises. However, in the final rule EPA has also modified some provisions of § 68.96 in order to address public comments. These changes are discussed in more detail in the following sections.

c. Frequency of Exercises

The greatest number of comments on the proposed field and tabletop exercise provisions related to the required frequency for exercises. While several commenters supported EPA's proposed requirements for annual tabletop exercises and field exercises every five years, some commenters recommended requiring more frequent field exercises, while others recommended requiring field and/or tabletop exercises less frequently, and still others argued that EPA should retain the requirement for field and tabletop exercises but allow owners and operators to have flexibility in the scheduling of exercises.

Support for more frequent field exercises. Commenters who argued for more frequent field exercises included non-governmental organizations, government agencies, and others. These commenters stated that EPA's proposed five-year frequency for field exercises was insufficient. One commenter argued a five-year timeframe for field exercises does not conform to CAA section 112(r)(7)(B)(i), which states “the Administrator shall promulgate reasonable regulations and appropriate guidance to provide, to the greatest extent practicable, for the prevention and detection of accidental releases of regulated substances and for response to such releases by the owners or operators of the sources of such releases.” This commenter also stated that more frequent exercises are necessary so that response personnel would gain more experience. Several other commenters who recommended more frequent exercises noted that sources subject to the New Jersey Toxic Catastrophe Prevention Act (TCPA) regulations are required to conduct annual field exercises. Other commenters argued more frequent field exercises are needed due to the potential for personnel turnover that results in the loss of institutional knowledge and collaborative relationships between covered facility owners/operators and community emergency responders.

EPA disagrees that CAA section 112(r)(7) requires EPA to establish a requirement for more frequent exercises. The statute itself in CAA section 112(r)(7)(B)(i) does not contain a requirement for emergency response exercises, therefore, nothing in the statute mandates a frequency for such exercises if the EPA decides some exercises may be reasonable. The requirement to conduct emergency response exercises derives from EPA's authority to set “reasonable regulations” that include “procedures and measures for emergency response after an accidental release of a regulated substance in order to protect human health and the environment.” CAA section 112(r)(7)(B)(ii) further requires owners and operators to prepare and implement a risk management plan that includes, among other things, “a response program providing for specific actions to be taken in response to an accidental release of a regulated substance so as to protect human health and the environment, including procedures for informing the public and local agencies responsible for responding to accidental releases, emergency health care, and employee training measures.” This statutory language provides the Administrator with discretion to decide what components of an emergency response program are reasonable to include in regulations.

EPA believes exercising emergency response plans is a reasonable requirement in order to ensure that emergency response programs will work well in the event of an accidental release. However, EPA is cognizant of the resources (e.g., staffing, cost, expertise) that exercises demand both from stationary sources and from local responders. To ensure the reasonableness of the exercise requirement, EPA has provided flexibility for stationary sources and local emergency responders to set schedules for such exercises. Given the differences among communities and stationary sources impacted by the national Risk Management Program rule, the reasonable minimum frequency for exercises will vary by locale from that which is appropriate under the NJ TCPA requirements.

EPA disagrees with commenters who recommended requiring field exercises more frequently than every five years. EPA notes that its own regulatory impact analysis for the NPRM projected the emergency response exercise provisions to be the costliest provision of the NPRM, and the Agency is concerned that a requirement for even more frequent field exercises could be prohibitively expensive for some facilities and local responders.

Regarding commenters' concerns about the potential that less frequent exercises may result in response personnel gaining less experience, and for personnel turnover to result in the loss of institutional knowledge and relationships between facility operators and community emergency responders, EPA shares such concerns, but must balance those concerns with the potentially higher burdens that more frequent exercises could place on facility response personnel and community responders. Also, EPA believes the annual emergency response coordination requirements of § 68.93 will foster strong ongoing relationships between facility personnel and local responders, and prevent the loss of institutional knowledge. Furthermore, the timeframes EPA is establishing in the final rule are minimum expectations and we encourage owners and operators to establish appropriate schedules for exercises, in consultation with local officials, considering factors such as hazards, organizations (including facility personnel training needs and personnel turnover), budgets, resource demands, regulations, or other factors.

Arguments for less frequent exercises. Commenters who argued for less frequent field and/or tabletop exercises included industry associations, government agencies, facilities, local responders, private citizens, and others. These commenters stated that requiring field exercises every five years and tabletop exercises every year would be overly burdensome on facilities and local responders. Some of these commenters submitted data to EPA to substantiate their burden estimates. One commenter recommended reducing the required exercise frequency because holding exercises as frequently as proposed by EPA would discourage regular participation by facility personnel and local responders. Several commenters recommended the frequency of field and tabletop exercises be left to the discretion of the source and/or local responders, so that the exercise schedule could be tailored to the individual circumstances of sources and local communities. These commenters also stated that exercises—and particularly field exercises—can be very costly for both sources and local responders. They also indicated that setting a single exercise frequency for all sources does not account for the differing situations faced by different sources and communities. In some cases, these commenters argued, requiring too-frequent exercises could potentially divert resources away from other important safety activities. One commenter representing an association of state emergency planning officials supported an exercise requirement, but recommended the frequency for both field and tabletop exercises be determined by collaboration between the source and local responders during the emergency response coordination process.

EPA found these comments compelling. EPA's own projections in the Regulatory Impact Analysis for the proposed rulemaking indicated that exercises would be the costliest provision of the proposed rulemaking, and in order to limit these costs, one alternative considered in the NPRM was to require only tabletop exercises. Additionally, the Agency is sympathetic to the concerns raised by emergency response officials and others that participation in exercises by local responders can be burdensome, particularly in smaller communities with volunteer responders and fewer response resources, as well as in communities where multiple RMP facilities are present—which would place proportionally greater demands on responders who desire to participate in the RMP facility exercises held within their jurisdiction. EPA is also mindful of the concerns raised by small business owners and their representatives both during SBAR panel process and in comments submitted to EPA, who pointed out that exercises could potentially place a relatively larger burden on small businesses.

For these reasons, in the final rule EPA has modified the provision for frequency of both field and tabletop exercises to allow sources and local responders to work together to establish an exercise frequency appropriate to their situation. However, as EPA continues to believe that both field and tabletop exercises are an important component of an emergency response program, the Agency does not believe any responding source should be allowed to reach an agreement that practically exempts the source from the exercise program requirements. This could happen if a source reached agreement with local responders to hold exercises extremely infrequently. Therefore, the Agency is also establishing a minimum required exercise frequency of ten years for field exercises, and three years for tabletop exercises. The Agency believes even the smallest sources will be able to hold field exercises at least once each decade, and in many cases EPA expects sources will hold field exercises more frequently. The Agency set the frequency for tabletop exercises to be more frequent than field exercises because tabletop exercises require less time and fewer resources to plan and conduct than field exercises, and therefore EPA believes sources will be able to perform tabletop exercises at least every three years.

Under the final rule, owners and operators are required to coordinate with local responders to establish an exercise frequency that works for both organizations. In establishing the exercise frequency, owners or operators and local responders may account for whatever factors they deem appropriate. Owners or operators and local authorities may also adjust exercise frequencies as needed to account for changes in hazards, organizations, budgets, resource demands, regulations, or other factors, provided that field exercises occur at least every ten years, and tabletop exercises occur at least every three years. The agency notes that some RMP facilities may be subject to a more frequent schedule for exercises under other (e.g., state or local) regulations. In such cases, the owner or operator should comply with the more stringent exercise frequency requirement. By doing so, they will ensure that they also meet the required exercise frequency for the RMP exercise requirements.

d. Local Responder Participation in Exercises and Exercise Planning

EPA proposed to require owners and operators to coordinate with local public emergency response officials when planning emergency response field and tabletop exercises, and invite them to participate in exercises. While most public comments on this issue supported the idea that local response officials should be involved in exercise planning and execution, many comments submitted by industry associations, facilities, government agencies, and others expressed concerns that local responders could easily become overburdened by any requirement to participate in planning or conducting exercises. These commenters pointed out that in many communities, local response organizations may be staffed with volunteers, or may have multiple RMP facilities within their jurisdiction, such that local response organizations could be significantly impacted by a requirement to participate in exercises. These commenters agreed that local responders should be invited to participate in exercises, but recommended that EPA not require local authorities to participate in planning or conducting exercises, and not hold facilities accountable if local response organizations decline to participate. Comments submitted by industry associations and facilities also recommended EPA address the possibility that exercises may sometimes need to be postponed if local response organizations are unable to participate due to actual emergencies or lack of resources. These commenters recommended that EPA allow extensions of the required timeframe for conducting the next exercise, or allow the owner or operator to meet the exercise requirement by conducting the exercise as soon as possible without participation by local responders, if necessary.

In addition to coordinating with local response authorities to establish an exercise frequency, the final rule also requires the owner or operator to coordinate with local public emergency response officials when planning field and tabletop exercises, and to invite local responders to participate in exercises. EPA agrees with the many commenters who stated that any requirement for local responders to participate in planning or conducting exercises could in some cases overburden local response organizations or make it difficult for regulated facilities to timely meet the exercise requirements. EPA is aware of, and various public comments have noted, the fact that in the past some sources have been unable to locate local response organizations who are able or willing to perform such coordination activities. Therefore, while the final rule requires the owner or operator to coordinate with local public responders to establish field and tabletop exercise frequencies and plan exercises, and invite local emergency responders to participate in exercises, the final rule does not require local responders to participate in any of these activities.

In most cases, the LEPC, fire department, or equivalent local emergency response authority would be the appropriate party for the owner or operator to conduct exercise planning and coordination. EPA believes these local response authorities will usually be willing to perform emergency response coordination activities, including exercise coordination activities, with regulated sources. In many cases, EPA expects that exercise planning can be included as part of the annual coordination meetings required under § 68.93. In other cases, the owner or operator and local responders may choose to hold separate exercise planning meetings. EPA also understands that in some cases local responders may elect to limit their participation in exercise coordination activities because of limitations on their available time and resources. However, if the owner or operator is unable to identify a local emergency response organization with which to coordinate field and tabletop exercise schedules and plans and participate in exercises, or the appropriate local response organizations are unable or unwilling to participate in these activities, then the owner or operator may unilaterally establish appropriate exercise frequencies and plans, and if necessary hold exercises without the participation of local responders. In these cases, the owner or operator must still ensure that field exercises occur at least every ten years, and tabletop exercises occur at least every three years. Additionally, the owner or operator should continue to make ongoing efforts to locate appropriate local public response officials for purposes of emergency response and exercise coordination and participation.

As EPA believes the final rule provides the owner or operator with ample flexibility to establish and modify exercise schedules, EPA sees no reason to provide for additional extensions of time for conducting exercises in the event that local responders cannot participate, or if for some other reason the exercise must be rescheduled. EPA recommends that owners and operators and local response organizations take such contingencies into account when establishing exercise schedules, so there is still time to complete the field or tabletop exercise within the allotted timeframe (i.e., at least every ten years for field exercises and at least every three years for tabletop exercises) in the event the exercise must be postponed.

e. Exercise Scope

Some commenters recommended EPA clarify the required scope of exercises. One commenter indicated that if EPA does require exercises, the Agency should allow some variation in the scope of exercises based on the needs and resources of the community.

In the preamble to the proposed rulemaking, EPA explained that field exercises involve the actual performance of emergency response functions during a simulated accidental release event. Field exercises involve mobilization of firefighters and/or hazardous materials response teams, activation of an incident command structure, deployment of response equipment, evacuation or sheltering of facility personnel as appropriate, and notification and mobilization of law enforcement, emergency medical, and other response personnel as determined by the scenario and the source's emergency response plan. Field exercises include tests of:

• Procedures for informing the public and the appropriate Federal, state, and local emergency response agencies about an accidental release;
• Procedures and measures for emergency response after an accidental release of a regulated substance including evacuations and medical treatment;
• Communications systems;
• Mobilization of facility emergency response personnel, including contractors as appropriate;
• Coordination with local emergency responders;
• Equipment deployment, and
• Other actions identified in the source's emergency response plan, as appropriate.

Tabletop exercises are discussion-based exercises without the actual deployment of response equipment. During tabletop exercises, responders typically assemble in a meeting location and simulate procedural and communications steps for response to a simulated accidental release, as determined by the scenario and the source's emergency response plan. Tabletop exercises include tests of:

• Procedures for informing the public and the appropriate Federal, state, and local emergency response agencies about an accidental release;
• Procedures and measures for emergency response after an accidental release of a regulated substance including evacuations and medical treatment;
• Identification of facility emergency response personnel and/or contractors and their responsibilities;
• Coordination with local emergency responders;
• Procedures for deploying emergency response equipment, and
• Other actions identified in the source's emergency response plan, as appropriate.

EPA believes these elements allow ample flexibility for the owner and operator, in consultation with local emergency response officials, to choose appropriate exercise scenarios. Involving local response officials in selecting exercise frequencies and in planning exercises should ensure that RMP facility exercises are consonant with the needs and resources of regulated facilities and local communities. By involving local public responders in the exercise scenario itself, responders may also be able to test or simulate important offsite emergency response actions that are usually managed by local public emergency response officials, such as community notification, public evacuations, and sheltering in place, and EPA encourages sources and local response officials to design exercise scenarios where these functions are also tested. Responding stationary sources that rely on response contractors to perform emergency response functions during accidental releases should also ensure that response contractors participate in field and tabletop exercises.

In preparing the exercise evaluation report required under § 68.96(b)(3), the owner or operator should evaluate all aspects of the exercise, including, to the extent possible, any offsite aspects of the exercise such as community notification, evacuation, and sheltering in place. In many cases, this will require the owner or operator to involve local response officials in the exercise evaluation.

f. Post-Accident Exercises

In the NPRM, in addition to requiring periodic field and tabletop exercises, EPA proposed to require the owner or operator to hold a field exercise within one year of any accidental release required to be reported under § 68.42. Many commenters objected to this requirement. These commenters stated that this provision could potentially overtax facility and local responders, who would be required to deploy once for the incident, and again for the exercise following the incident.

EPA agrees with these comments, and therefore has decided not to finalize the requirement to conduct a field exercise within one year of an accidental release.

g. Alternatives for Meeting RMP Exercise Requirements

Several commenters indicated EPA should allow sources to meet the periodic field exercise requirements through the actual deployment of emergency response resources and personnel during accidental release events. Other commenters indicated that many regulated facilities are already subject to exercise requirements under other Federal, state, or local regulations, or through an industry code of practice, and these exercises should suffice to meet the exercise requirements of the proposed rulemaking. Comments from state regulatory agencies indicated that one agency already requires more frequent field exercises under state law, and another state government agency is considering imposing more frequent exercise requirements.

EPA generally agrees with these comments. The Agency does not want to establish exercise requirements that conflict with other Federal, state, or local laws. Therefore, in the final rule, EPA has added § 68.96(c) to describe alternative means of meeting exercise requirements. This section allows the owner or operator to meet requirements for notification, field, and/or tabletop exercises either through exercises conducted to meet other Federal, state, or local exercise requirements (or under a facility's industry code of practice or another voluntary program) or by responding to an actual accidental release event, provided the exercise or response includes the actions required for exercises under § 68.96(a) and (b), as appropriate.

h. Joint Exercises

Several commenters, including industry associations and regulated facilities, indicated that some companies have formed mutual aid associations among several neighboring or nearby facilities so that participating facilities can share response personnel and resources in order to aid one another in responding to accidental release events at any member's facility. These commenters recommended that in such situations, or situations where there are clusters of regulated facilities located close together, EPA should not require each facility to conduct a field exercise, but rather allow these facilities to meet their periodic field exercise obligation by conducting a single joint exercise, where all participating facilities perform simulated response actions to an exercise scenario staged at one member-facility's site. These commenters indicated that this approach would reduce the exercise demands on small and medium-sized facilities, as well as local responders.

EPA agrees with these comments, and encourages owners and operators of neighboring RMP facilities to consider planning and conducting joint exercises. However, sources that participate in joint exercises must ensure that their participation meets all of the provisions of § 68.96(a) and/or (b), as appropriate. As commenters have noted, RMP facilities participating in mutual aid agreements with other nearby facilities already coordinate response actions and resources with those facilities, and EPA believes conducting joint exercises among these facilities will more accurately simulate their behavior in the event of an actual release event, and further enhance the ability of these facilities and surrounding communities to effectively respond to accidental releases. Even where such mutual aid agreements are not currently in place, EPA believes the owners and operators of neighboring regulated facilities should consider whether joint facility exercises may have benefits for participating facilities, local responders, and surrounding communities. Such benefits could include improved identification and sharing of response resources, enhanced training for facility personnel and local responders, improvements in facility procedures and practices resulting from information sharing, and others. EPA also agrees that joint exercises may be particularly beneficial for small businesses. While the Agency believes that even small sources can design and conduct field and tabletop exercises that are appropriate to the size, hazards, and capabilities of the source, joint exercises involving multiple neighboring small sources would allow these sources to pool resources together in order to carry out more extensive exercise scenarios that could better simulate serious accidental release events. In areas where multiple RMP facilities are located close together, joint exercises could also reduce the overall burden of exercises on local response organizations, who might otherwise be asked to participate in multiple separate exercises.

i. Exercise Documentation

While most commenters who addressed the issue of exercise documentation acknowledged the need for exercise evaluation reports to be prepared, some commenters expressed concerns about specific aspects of the proposed exercise documentation requirements. Some commenters objected to the proposed rulemaking's requirement to prepare the evaluation report within 90 days, stating that evaluation reports for large exercises could take longer than 90 days to prepare, and that EPA should allow extensions of the required timeframe where appropriate. Still other commenters objected to the possibility that exercise evaluation reports that indicate deficiencies outside the control of an owner or operator could potentially be used by EPA in an enforcement action against the owner or operator. Other commenters stated EPA should not require exercise reports to include the names and associations of exercise participants, because this information could be difficult to obtain and would risk the privacy of exercise participants without any benefit.

EPA is finalizing the exercise documentation requirements of § 68.96(b)(3) as proposed. EPA is also requiring in § 68.96(c)(2), documentation of a response to an accidental release in order for the response to be used to satisfy the RMP field exercise requirements. The owner or operator must prepare an after-action report comparable to (and in lieu of) the exercise evaluation report required in § 68.96(b)(3), within 90 days of the incident, when the owner or operator uses the response to an accidental release to meet their field or tabletop exercise requirement. This provision is necessary because documenting the response to an accidental release may differ from documenting the results of an exercise. For example, instead of documenting the “exercise scenario,” the owner or operator would document the nature of the accidental release prompting the response. Also, there may be additional aspects of the response to an accidental release that should be documented, such as any injuries, first aid and/or medical treatment that occurred. To the extent possible, the owner or operator should ensure that additional items such as these are documented in the after-action report, as well as information equivalent or comparable to that documented in an exercise evaluation report.

EPA disagrees with commenters who contend that 90 days is insufficient time to develop an exercise evaluation report (or after-action report), or that extensions of time should be granted for development of evaluation reports in certain circumstances. Unlike incident investigations, where report completion may require extensive and time-consuming evidence collection and forensic analysis, the basic elements required to be documented in an exercise evaluation report should be known relatively quickly after the conclusion of the exercise.

Regarding commenters concerns about the use of exercise evaluation reports in enforcement actions—an exercise report is like any other record required to be developed under 40 CFR part 68. Whether or not an exercise evaluation report would be used in an EPA enforcement action would depend on the specific facts and circumstances of the case.

EPA disagrees that exercise evaluation reports should not contain the names and associations of exercise participants. Under the final rule, the frequency of both field and tabletop exercises is mainly left to the reasonable judgement of the owner or operator and local response officials. In some cases, exercises may occur infrequently, and EPA believes that maintaining a written record including, among other things, the identification and affiliation of exercise participants will be useful in planning future exercises.

VI. Information Availability Requirements

EPA proposed requirements for making information available to LEPCs or emergency response officials, and the public in order to ensure that communities have the necessary chemical hazard information to protect the health and safety of first responders and residents. The following sections provide an overview of the proposed and final rule provisions, public comments received, and EPA's responses.

A. Disclosure Requirements to LEPCs or Emergency Response Officials

1. Summary of Proposed Rulemaking

EPA proposed that owners and operators of all RMP-regulated facilities provide certain information to LEPCs or local emergency response officials upon request. EPA stated that the facility should make this information available in a manner that is understandable and avoids technical jargon, convey it without revealing CBI or trade secret information, and adequately explain any findings, results, or analysis being provided.

EPA proposed that the owner or operator be required to develop the following chemical hazard information for all regulated processes and provide it, upon request, to the LEPC or local emergency response officials:

• Information on regulated substances. Information related to the names and quantities of regulated substances held in a process;
• Accident history information. The facility's five-year accident history information required to be reported under § 68.42;
• Compliance audit reports. Summaries of compliance audit reports developed in accordance with §§  68.58, 68.59, 68.79, or 68.80, as applicable;
• Incident investigation reports. Summaries of incident investigation reports developed in accordance with §  68.60(d) or §  68.81(d), as applicable;
• Inherently Safer Technologies (IST). For each process in NAICS codes 322, 324, and 325, a summary of the IST or ISD identified that the owner or operator has implemented or plans to implement;
• Exercises. Information on emergency response exercises required under § 68.96 including, at a minimum, schedules for upcoming exercises, reports for completed exercises, and other related information.

2. Discussion of Comments and Basis for Final Rule Provisions

Overall, commenters agreed that providing communities, local planners, and local first responders with appropriate chemical hazard-related information is critical to ensuring the health and safety of the first responders and local communities. Commenters that supported the proposed requirements provided general support and offered no suggested changes other than to expand the IST requirement to apply to all facilities; require facilities to submit IST analyses to the LEPC; and make IST analyses available to the public.

However, most commenters, including professionals (e.g., consultants or technical/process safety experts), state agencies, facilities, and industry trade associations, did not support the requirement for facilities to submit specific chemical hazard-related information to LEPCs and local emergency response agencies, as the appropriate mechanism to ensure that local responders and planners have the information they need to mitigate chemical risks. Commenters provided several reasons for their objections including:

• A lack of data supporting the Agency's concern that LEPCs are not receiving the information they need to develop local emergency response plans;
• Unnecessary redundancy with existing requirements, such as data reported under EPCRA;
• Data proposed is too broad and does not provide useful information pertinent to emergency response planning;
• The data may overwhelm LEPCs with technical information and the concern that most LEPCs lack the expertise needed to use this information to develop local emergency response plans; and
• Security concerns regarding how the information is maintained and handled by the LEPC or emergency response officials.

Of those commenters that did not support the proposed requirements, several stated that EPA provided no data supporting the Agency's concern that some LEPCs were not receiving the information they needed to develop local emergency response plans. These commenters pointed to EPA's 2008 National Survey of Local Emergency Planning Committees (LEPCs),^[110] which did not reveal any concerns about RMP facilities withholding information from LEPCs. According to these commenters, LEPCs indicated in the survey that they were able to obtain RMP data from EPA, the state, or RMP facilities and noted their greatest obstacle was lack of funding. In addition, commenters pointed out that the Executive Order 13650 Working Group report, Actions to Improve Chemical Facility Safety and Security—A Shared Commitment, May 2014 ^[111] contains no findings about facilities ignoring LEPC requests for information or that lack of information provided to the LEPCs was an issue, but rather the report stated that LEPCs had concerns about managing all of the information provided under various laws and regulations, understanding how each chemical is regulated, and how to properly respond to an emergency involving specific chemicals. In addition, these commenters stated that while some CSB investigations ^{[112 113 114]} highlighted a lack of emergency preparedness and recommended strengthening local infrastructures supporting LEPCs, they did not find that facilities refused to cooperate with the community or withheld chemical information from LEPCs.

Multiple commenters, including professionals, state and local government agencies, facilities, and industry trade associations, also stated that the information elements that EPA proposed to require facilities to share with LEPCs are already available to them through the EPCRA or reported in RMPs, which are also already available to the LEPCs. Several commenters noted that communication between LEPCs and facilities is satisfactory via the EPCRA process and stated that LEPCs were able to obtain RMP data from EPA. One commenter requested the EPA refocus its efforts into collecting required data from “outlier facilities who are not providing required chemical hazard information” rather than impose a duplicative requirement for the creation and distribution of data.

Many commenters also asserted that the scope of information required by the proposed provision was too broad. These commenters argued that incident investigation summaries, compliance audit summaries, and IST or ISD implementation summaries would not provide useful information for emergency planning and that the proposed information requirements were unnecessarily detailed. Several of these commenters also suggested that the type and format of the information should be determined by individual LEPCs. Furthermore, commenters expressed concern that the information in these summaries would be too technical and LEPC staff may not have the expertise to understand the information being submitted or extrapolate information that may be useful.

Multiple commenters raised concerns regarding the security of sensitive chemical and facility information that would be shared with LEPCs under the proposed requirements. These commenters indicated that LEPCs would be unable to keep the information secure because they lack procedures and resources to properly vet those who would have access to the information, and that the information would be considered “public information” once it is provided to the LEPC. These commenters indicated that there are multiple ways for the public to access sensitive information from LEPCs through information requests from the public. Commenters also suggested that these requirements to disclose information to LEPCs interfere with the Department of Homeland Security's (DHS) Chemical Facility Anti-Terrorism Standards (CFATS). Commenters further suggested that since much of this information might reveal security vulnerabilities at facilities, providing this information to LEPCs increases the risk of terrorism or criminal use of the information which could cause harm to first responders and the community.

EPA also received comments regarding how the information should be provided to LEPCs and the timeframe for providing that information. Many commenters suggested the information should be provided through existing systems in a format which is useful to LEPCs or local emergency responders for developing their local emergency plans. Several states and a state association suggested LEPCs and emergency response officials should determine what information is useful and necessary to developing preparedness and response plans. An industry trade association suggested that information should not be in an electronic format but should be communicated to LEPCs, local emergency officers, neighbor groups, and Community Advisory Panels at regular intervals. Two state agencies commented that RMP information should be incorporated into existing management systems and that providing information in a stand-alone single document was of little value to emergency planners. A few commenters suggested that the format of the information should be determined by the individual LEPC. Finally, several commenters proposed that the information be relayed during the annual coordination meeting between LEPCs and facility personnel.

In response to these comments, EPA maintains that it is very important to ensure that LEPCs or local emergency response officials have the chemical information necessary for developing local emergency response plans, however, EPA believes it is unnecessary to specify in the RMP rule the types or format of information that LEPCs or emergency response officials may request. EPCRA section 303(d)(3) already provides the necessary authority to allow LEPCs to request information needed to develop the local emergency response plan. Additionally, EPCRA requires facilities to provide Safety Data Sheets (SDSs) and inventory information to LEPCs to assist emergency planners and responders. Under EPCRA section 312(f), fire departments have the authority to inspect these facilities to better understand the risk associated with these chemicals and how to deal with those risks in the local emergency response plan.

As pointed out by the commenters, the proposed requirements could be perceived as limiting the flexibility of LEPCs and emergency response officials to collect the information they need to develop a local emergency response plan that addresses their community's specific chemical risks. Furthermore, the proposed requirements would have owners or operators preparing information summaries on an annual basis, regardless of whether the LEPC requests the information, and EPA agrees that this is overly burdensome for facility owners and operators. This could also result in reports being sent to the LEPCs or emergency response officials without the necessary context to help officials to understand the information contained within the reports and utilize it for planning purposes.

Without acknowledging any inconsistency with CFATS or other regulatory structure, EPA recognizes both the security concerns that commenters expressed and the challenges associated with securing arguably sensitive information. Therefore, EPA has decided not to finalize § 68.205 of the proposed rulemaking, and is instead adding language to the emergency response coordination provisions of § 68.93, which requires the owner or operator to provide “any other information that local emergency planning and response organizations identify as relevant to local emergency planning.” (For more information see section V.A. of this preamble.) Under this structure, assertions of Chemical-terrorism Vulnerability Information (CVI) status for certain information can be addressed on a case-by-case basis by the stationary source, the LEPC, DHS, and other appropriate entities.

EPA agrees with commenters that this approach will allow LEPCs and other local emergency officials to obtain the information they require to meet their emergency response planning needs. It will also allow local emergency planners and response officials to ask questions of facility personnel about the risks associated with the chemical hazards at the facility and about appropriate mitigation and response techniques to use in the event of a chemical release. It further allows the facility owner or operator and the LEPC to identify information that may need to be maintained securely and discuss strategies to secure the information or to provide only information that is pertinent to emergency response planning without revealing security vulnerabilities.

The LEPC or local emergency response officials may request information such as accident histories, portions of compliance audit reports relevant to emergency response planning, incident investigation reports, records of notification exercises, field and tabletop exercise evaluation reports, or other information relevant to community emergency planning. For example, this may include requesting information on changes made to the facility that affect risk such as incorporating safer alternatives. Furthermore, EPA directs commenters who indicated that the IST analyses should apply to all facilities and be submitted to the public to refer to sections IV. C. and VI. B. in this preamble.

B. Information Availability to the Public

1. Summary of Proposed Rulemaking

Under § 68.210(a), EPA proposed to add a reference to 40 CFR part 1400, which addresses the restrictions on disclosing “offsite consequence analysis” (OCA) information under the CSISSFRRA.

Under § 68.210(b), EPA proposed to require the owner or operator of a stationary source to distribute certain chemical hazard information for all regulated processes to the public in an easily accessible manner, such as on a company Web site. EPA proposed to require the owner or operator to distribute, as applicable:

• Names of regulated substances held in a process;
• SDSs for all regulated substances at the facility;
• The facility's five-year accident history required under § 68.42;
• Emergency responses program information concerning the source's compliance with § 68.10(f)(3) or the emergency response provisions of subpart E, including:

○ Whether the source is a responding stationary source or a non-responding stationary source;

○ Name and phone number of local emergency response organizations with which the source last coordinated emergency response efforts, pursuant to § 68.180; and

○ For sources subject to § 68.95, procedures for informing the public and local emergency response agencies about accidental releases.

• Information on emergency response exercises required under § 68.96, including schedules for upcoming exercises, reports for completed exercises as described in § 68.96(b)(3), and any other related information; and
• LEPC contact information, including LEPC name, phone number, and Web site address as available.

EPA proposed to add § 68.210(c), to require that the owner or operator update and submit information required under § 68.210(b) every calendar year, including all applicable information that was revised since the last update.

EPA also proposed to redesignate the current § 68.210(b), which addresses the non-disclosure of classified information by the Department of Defense or other Federal agencies or their contractors, as § 68.210(e). In new § 68.210(f), EPA proposed to require that an owner or operator asserting CBI provide a sanitized version of the information required under this section to the public. Assertion of claims of CBI and substantiation of CBI claims was proposed to be in the same manner as currently required in §§ 68.151 and 68.152 for information contained in the RMP required under subpart G.

2. Summary of Final Rule

EPA is finalizing § 68.210(b) with changes to address public comments. Under the final rule, § 68.210(b) requires the owner or operator to make certain chemical hazard information for all regulated processes at a stationary source available to the public upon request. The information that shall be provided is the same as proposed, except EPA is revising the exercise information element. Under § 68.210(b)(5) of the final rule, upon receiving a request for the information from a member of the public, the owner or operator is required to provide a list of scheduled exercises required under § 68.96, rather than summary information for those exercises, as proposed.

Section 68.210(c) is now titled “Notification of availability of information,” and it changes the manner by which the facility informs the public about what chemical hazard information is available upon request and how the public may obtain such information. The owner or operator shall provide the public with an ongoing notification of the following: (1) The required information elements in § 68.210(b)(1) through (6) that is available to the public upon request, (2) instructions for requesting the information elements and (3) where to access any other available information on community emergency preparedness.

Section 68.210(d) requires that the owner or operator provide the requested information listed under § 68.210(b) to the public within 45 days of receiving a request.

Finally, EPA is finalizing several sections as proposed, including:

• § 68.210(a), RMP availability;
• § 68.210(f), which addresses the non-disclosure of classified information by the Department of Defense or other Federal agencies or their contractors (this was formerly proposed as § 68.210(e)); and
• § 68.210(g), which relates to CBI, redesignated from § 68.210(f).

3. Discussion of Comments and Basis for Final Rule Provisions

a. Legal Issues

An industry trade association and a facility stated that legislation subsequent to the CAA narrowed EPA's authority to mandate public disclosure of RMP information. Relevant legislation described by the commenters includes (1) the 1999 CSISSFRRA, (2) the Critical Infrastructure Information Act (CIIA), (3) the Chemical Facilities Anti-Terrorism Standards Act of 2007, and (4) the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014.

Another industry trade association commented that requiring private companies to publish qualitative or quantitative environmental information inappropriately seeks to delegate EPA's own duties to communicate with and deal with public requests to the regulated entity.

A few industry trade associations argued that the proposed information disclosure requirements are compelled speech that may violate the first amendment. An industry trade association commented that EPA's proposal to require disclosure of RMP information and chemical hazard information raises constitutional issues, as it amounts to compelled commercial speech. The commenter described compelled commercial speech as subject to an intermediate-level of scrutiny, and asserted that, unless EPA can affirmatively prove that (1) its asserted interest is substantial, (2) the speech regulation directly and materially advances that interest, and (3) the regulation is narrowly tailored to that interest, then the compelled commercial speech will likely be found to be unconstitutional.

The information disclosures required by the final rule are fully consistent with the statutes and regulatory programs identified by the commenters as enacted after the 1990 CAA Amendments. CSISSFRRA specified that portions of RMPs containing OCA information, any electronic data base created from those portions, and any statewide or national ranking derived from such information is subject to restrictions on disclosure (CAA sections 112(r)(7)(H)(i)(III) and 112(r)(7)(H)(v)). Regulations promulgated jointly by EPA and the Department of Justice further define OCA information in 40 CFR 1400.2(j). The final rule does not require disclosure of release scenarios or rankings based on such scenarios, nor does it make available any information based on such scenarios. The CIIA restricts information “not customarily in the public domain.” CFATS creates a category of information, CVI, which further restricts certain information generated to implement CFATS (see 6 CFR 27.400). In promulgating CFATS, DHS announced its intent to preserve Federal release disclosure, emergency planning, and accident prevention statutes, including EPCRA and CAA section 112(r) (72 FR 17714, April 9, 2007). In this final rule, EPA has not promulgated the new mandatory disclosure of STAA and incident investigation information that we had proposed, thereby eliminating the tension between these after-enacted programs and modernization of the risk management program. The information required to be disclosed by this rule largely draws on information otherwise in the public domain and simplifies the public's access to it.

This final rule requires an owner or operator of a stationary source to alert the public, via any one of a wide variety of methods, of how to access information about the source that is publicly available. Other statutes and regulatory programs, or other provisions of the risk management program, require the stationary source to assemble the information that the rule would make available upon request (e.g., accident history, SDSs, and aspects of the emergency response program). The burden of making this information directly available from the source is minimal. The public's ability to participate in emergency planning and readiness is materially advanced by being better informed about accident history, types of chemicals present, and how to interact with the stationary source. EPA has been selective in identifying what information a source must make available; for example, we have not required the facility to provide an RMP to the public. Having the source provide the information set out in § 68.210 directly to the public promotes accident prevention by facilitating public participation at the local level.

b. RMP Availability (§ 68.210(a))

EPA did not receive any comments on this issue.

c. Chemical Hazard Information (§ 68.210(b))

Comments on making information available to the public. EPA received multiple comments that supported the proposed provisions. These comments generally indicated that the revisions would strengthen the community's “right to know.” A mass mail campaign joined by approximately 450 commenters provided general support for the disclosure of information to the public. EPA also received comments stating that the RMP and accompanying chemical hazard information would be valuable to communities in order to understand the risks involved.

Many commenters opposed the proposed information provisions. Multiple commenters, including state agencies, facilities, and industry trade associations, argued that the proposed provisions for public disclosure of information have the potential to create a security risk, with several commenters expressing opposition to the proposed provisions because they appear to conflict with CFATS or other existing information security requirements. Two diverse groups of commenters remarked that OCA data should remain accessible to the public only through Federal reading rooms, but an advocacy group remarked that keeping information solely in reading rooms would limit access by the public. Some commenters stated that the information requirement was already available through EPCRA or Freedom of Information Act (FOIA) requests, while others stated that EPA had not given enough reasoning for how the increase in information disclosure to the public would result in a safer community in proportion to the burdens imposed on facilities.

EPA continues to believe that providing chemical hazard information to the general public will allow people that live or work near a regulated facility to improve their awareness of risks to the community and to be prepared to protect themselves in the event of an accidental release. EPA believes that this information should be more easily accessible to the public than the existing approaches to access information under EPCRA or through FOIA requests. However, EPA acknowledges the security concerns raised by commenters and is committed to ensuring a balance between making information available to the public and safeguarding that information. Therefore, EPA is finalizing an approach that requires facility owners and operators to notify the public that certain information is available upon request. This allows community members ^[115] an opportunity to request chemical hazard information from a facility, so they can take measures to protect themselves in the event of an accidental release, while allowing facility owners and operators to identify who is requesting the information. EPA worked closely with Federal partners, including DHS, to develop information availability requirements that strike a balance between security concerns and the need for sharing chemical hazard information with the public. EPA believes that this approach is consistent with existing requirements to secure sensitive information under CSISSFRRA and CFATS. Furthermore, EPA is committed to safeguarding OCA information in accordance with requirements specified in CSISSFRRA, which allows for any member of the public to access paper copies of OCA information for a limited number of facilities. This OCA information remains accessible to the public only in Federal Reading Rooms.

EPA believes that the current approach to notify the public that information is available upon request strikes an appropriate balance between various concerns, including information availability, community right-to-know, minimizing facility burden, and minimizing information security risks.

Scope of information to be shared. Commenters provided suggestions on the scope of information to be disclosed. An advocacy group commented that information on chemical hazards, safer alternatives (such as information on ISTs), incidents, inspections, and training should all be made publically available. Some commenters remarked that the public should be given information on the schedules and types of emergency response drills performed; how to adequately protect oneself during a release; where to evacuate; how the decision to evacuate will be made and communicated; and how the all-clear signal will be given. However, several commenters objected to making exercise reports available to the public. These commenters stated that providing the public with information about potential weaknesses in a facility or community field response could reveal security vulnerabilities. A few other commenters stated that only information that could improve community awareness of risks should be made available to the public, such as names of regulated substances held in a process above threshold quantities, names and phone numbers of local emergency response organizations, and LEPC contact information.

Some commenters recommended making available to the public the same information elements proposed for disclosure to LEPCs (i.e. STAA/IST, incident investigation reports and third-party compliance audits), while several other commenters opposed these suggestions. For example, a mass mail campaign suggested that facilities disclose STAA directly to the public. However, one trade association opposed publicly disclosing STAA, citing that the information would be highly technical and potentially confusing to the general public and may involve the disclosure of confidential, proprietary or other sensitive information. The association further argued that facilities would be put in a position where they must publicly defend IST evaluations and decisions.

Some commenters stated that incident investigation reports should be included in the scope of information delivered to the general public, while others said that providing such reports would be burdensome and confusing to the public. Other commenters argued specifically against making root cause analyses available to the public indicating that this greatly increases the likelihood that facilities will have to respond to lawsuits. One commenter expressed concern that disclosing root cause analyses would discourage facilities from performing meaningful analyses.

A state agency commented that third-party compliance audit reports should be made publicly available to assure the public that appropriate investigation has been done and appropriate steps are being taken to avoid future incidents. A group of commenters argued that emergency contact information should not be shared publicly online because it will encourage unwanted telemarketing and email spam and solicitations.

EPA agrees with commenters that who suggested that only information that could improve community awareness of risks should be made available to the public. EPA disagrees with commenters that suggest making additional information available to the public, such as STAA reports, incident investigation reports (with root cause analyses), and third-party audit reports. As some commenters indicated, much of the information in these reports can be technically complicated and potentially confusing for the general public. Furthermore, this information is not always relevant to community emergency preparedness and could potentially reveal CBI or security vulnerabilities. Therefore, the Agency is finalizing the following chemical hazard information elements to be made available to the public, upon request:

• Names of regulated substances held in a process;
• SDS for all regulated substances located at the facility;
• Five-year accident history information required to be reported under § 68.42;
• The following summary information concerning the source's compliance with § 68.10(f)(3) or the emergency response provisions of subpart E:

○ Whether the source is a responding stationary source or a non-responding stationary source;

○ Name and phone number of local emergency response organizations with which the owner or operator last coordinated emergency response efforts, pursuant to § 68.180; and

○ For responding stationary sources (i.e., those subject to § 68.95), procedures for informing the public and local emergency response agencies about accidental releases;

• A list of scheduled exercises required under § 68.96; and
• LEPC contact information, including the LEPC name, phone number, and Web address as available.

EPA expects that making the information available upon request will minimize security vulnerabilities as well as unwanted telemarketing and email spam and solicitations.

EPA agrees with commenters that members of the public do not necessarily need access to exercise evaluation reports. Therefore, to address concerns that summary information of facility exercise may be confusing to the public and could reveal security vulnerabilities, EPA is revising § 68.210(b)(5) to remove the requirement to provide summary information about exercises and only require a list of scheduled exercises required under § 68.96. EPA believes that one benefit of sharing exercise schedules is to avoid unnecessary public alarm when exercises are conducted. However, EPA expects that facility owners and operators will use good security practices when revealing details about upcoming exercises.

d. Notification of Availability of Information (§ 68.210(c))

EPA proposed requiring the owner or operator to make chemical hazard information publicly available and update the information every calendar year. Many commenters supported the use of a streamlined, one-stop Web format for disseminating information to the public. Several commenters opposed posting information for the public on facility Web sites due to security concerns. Some commenters argued that EPA should utilize existing online public information resources (such as the Agency's Web site or available RMP*Info or Enforcement and Compliance History Online (ECHO) ^[116] databases) to share information, while a few commenters concluded that appropriate state level agencies should be responsible for making information available to the public.

Many other commenters remarked on the variety of options to disseminate information suggested by EPA, including local libraries, government buildings, or the Internet, and stated that this fragmented approach would not improve public access to information. One commenter cited that EPA should ensure availability of information to those without Internet or electronic media access, and another commenter suggested that hard copies should be made available for those without access to online resources, in addition to information published on an EPA Web site. Another commenter remarked that information should be made available only after an email request is made directly to the facility. An advocacy group commented that information on accidental releases should be reported, immediately, to the public through the Internet, radio, telephone, and television.

Commenters also provided suggestions on the format of the information. Some of these commenters suggested that a one to two-page summary of information would be sufficient for the public.

EPA is committed to ensuring that chemical hazard information is available to the public in an easily accessible manner; however, the Agency acknowledges commenters' security concerns associated with providing information to the public and the additional burden that may fall on owners or operators that do not have Web sites or other means to publicly and routinely post such information. In response to these concerns, EPA is requiring that owners and operators notify the public that certain information is available along with instructions on how to request the information. The facility owner or operator must ensure that the notification is ongoing through a publicly accessible means, such as a Web site or social media platform.

The facility owner or operator can notify the public that information is available in a variety of ways. For example, the owner or operator could make the notification of information availability by using free or low cost Internet platforms, file sharing services, and social media tools that are designed to be able to share information with the public. As another option, the facility could post hard copy notices at publicly accessible locations, such as at a public library, or a local government office. If the facility has the means to handle public visitors, it could choose to have notices available at the facility's public visitor location. The facility could also provide notices that information is available to the public by email. EPA encourages the facility owner or operator coordinate information distribution with the LEPC or local emergency response officials to determine the best way to reach public stakeholders in their communities. Facility owners and operators may also want to consider outreach efforts that would allow the public to provide input on the best way to make this notification available. The owner or operator shall document whatever method and the location of the notification in the RMP pursuant to § 68.160(b)(21).

EPA believes that providing this notification to the general public would allow people that live or work near a regulated facility to gather the information they need to improve their awareness of risks to the community and to prepare to protect themselves in the event of an accidental release. The notice shall specify what information is available and provide instructions for how to obtain the information. The facility owner or operator shall also identify where to access information on community preparedness, if available, including shelter-in-place and evacuation procedures. The facility should work with the LEPC and local emergency responders to distribute and convey relevant information on appropriate shelter-in-place and evacuation procedures.

e. Timeframe To Provide Information Following a Request (§ 68.210(d))

One commenter expressed concern that requiring public information to be updated annually would be an unnecessary burden on facilities. In contrast, another state agency reasoned that the public should not have to request information, it should be readily available. An advocacy group requested that a version of the chemical hazard information provided by the facility be made on an annual basis.

While EPA agrees that requiring facilities to annually update their information could be unnecessarily time-consuming, EPA encourages facilities to update their chemical hazard information as needed to ensure that accurate information can be made available to the requester within the required timeframe. Therefore, § 68.210(d) requires that the facility owner or operator provide the information under § 68.210(b) to the requester within 45 days of receiving a request. EPA selected 45 days because that timeframe is consistent with the requirement for public provision of facility chemical inventory information (i.e., “Tier II information”) under § 312(e)(3)(D) of EPCRA, which states, “a State emergency response commission or local emergency planning committee shall respond to a request for Tier II information under this paragraph no later than 45 days after the date of receipt of the request.”

f. Classified Information (§ 68.210(f))

EPA received no comments on this issue.

g. CBI (§ 68.210(g))

Several commenters stated that the public information disclosure requirement would place CBI at risk, and therefore EPA should eliminate this requirement. Other commenters requested that EPA clarify that CBI would still be protected from public dissemination. Many commenters requested that EPA require that certain information in STAA reports either may not be claimed as CBI or should require up-front substantiation of confidentiality claims. Some commenters suggested that CBI claims for STAA information include a certification by the owner or operator or a senior official. Other commenters recommended that EPA prohibit STAA reports from being claimed as CBI. Two commenters stated that it may not be practical or possible to provide the public with a useful STAA document after removing appropriate CBI.

EPA is finalizing § 68.210(f) relating to CBI as proposed, but renumbered the paragraph as § 68.210(g). EPA acknowledges and shares industry's concerns pertaining to protection of CBI information. By incorporating a CBI provision in the information availability section of the rule EPA is emphasizing the facility owner or operator's right to protect CBI. EPA has also limited the types of information to be disclosed to eliminate matters likely to contain CBI (e.g., names of regulated substances; SDSs) as well as to include information elements for which CBI cannot be claimed (e.g. five-year accident history information and emergency response program information). Section 68.151 clearly identifies what information cannot be claimed as CBI and § 68.152 identifies the procedure for how to protect CBI. EPA believes that the RMP rule adequately addresses CBI concerns. Furthermore, EPA is not requiring STAA reports to be submitted to LEPCs or the public in the final rule and therefore, no CBI concerns exist for these reports.

An owner or operator of a stationary source asserting that a chemical name is CBI shall provide a generic category or class name as a substitute. If an owner or operator has already claimed CBI for a portion of the RMP, then that claim still applies for the disclosure elements the information availability provisions of the rule. The owner or operator should provide a sanitized version as described in the RMP*eSubmit User's Manual. This policy is consistent with existing guidance and practices.^[117]

C. Public Meetings

1. Summary of Proposed Rulemaking

EPA proposed to require all facilities to hold public meetings within 30 days after any RMP reportable accident to share information concerning the accident with the public including: When the accident occurred; the nature of the accident; chemicals involved and quantities released; on-site and offsite impacts; notifications made to emergency responders; weather conditions (if known); initiating event and contributing factors (if known); and operational changes (if any) that have resulted from the investigation of the release. EPA also proposed that at this public meeting, facilities would provide other relevant chemical hazard information such as the names and SDSs for regulated substances at the facility; accident history information for the facility; information on the emergency response and exercise programs; and LEPC contact information.

2. Summary of Final Rule

In the final rule, EPA is requiring all facilities to hold a public meeting after an RMP-reportable accident, but is extending the timeframe for the public meeting to 90 days in response to comments. The public meeting provision proposed as § 68.210(d) is redesignated as § 68.210(e) in the final rule. The owner or operator shall document in the RMP whether a public meeting has been held following an RMP reportable accident, pursuant to § 68.160(b)(22).

3. Discussion of Comments and Basis for Final Rule Provisions

EPA received a wide range of comments on the proposed public meeting requirements—comments generally in support of or against the requirement for public meetings; concerns about sufficient attendance or availability of information at public meetings; comments on the appropriate timeframe for the meetings; and comments on alternative options.

a. Attendance at Public Meetings

Many commenters opposed requirements for public meetings. Some commenters opposed based on their experience that public meetings held under CSISSFRRA were not well attended. One commenter said the public would not attend a meeting after a minor incident, but a public meeting for an event with major offsite impacts should include a report summarizing the incident. Some commenters questioned the benefit of such a meeting if a facility is in compliance with regulatory requirements.

Other commenters offered ideas for improving or gauging public interest. For example, one commenter suggested that EPA establish minimum requirements for sources to notify the public of upcoming meetings but did not offer suggestions for what those requirements should be. Another commenter suggested that polls could be used to prescreen members of the public who would like to attend or participate in the public meeting, in order to establish effective participation.

EPA recognizes concerns about attendance at public meetings. When the CSISSFRRA was enacted in 1999, it required owners or operators of all facilities regulated under the RMP rule to hold a public meeting within 180 days of enactment.^[118] The purpose of the public meeting was to discuss the OCA information that was restricted under other portions of CSISSFRRA. Relatively few of these meetings were hosted by facilities that had recently suffered an RMP-reportable accident. The Agency expects that after a reportable accident occurs, attendance at public meetings will be higher than was the case at many public meetings held under CSISSFRRA because of interest generated by the accident itself (e.g., an emergency response or media reports). This public meeting requirement applies only following an RMP reportable accident, so this provision has a much lower burden than the CSISSFRRA public meeting requirement because of the relatively few number of RMP reportable accidents that occur annually. CSB highlighted in their comments that public meetings held shortly after accidents occur have the greatest level of participation.

EPA supports commenters' suggestions to find practical strategies to increase attendance and encourages public participation at public meetings; however, we are not incorporating these suggestions as mandatory requirements in the final rule. Facilities have the flexibility to encourage attendance at meetings by means that are appropriate and effective in their communities. This could include methods suggested by commenters, such as polling nearby residents to gauge interest.

b. Applicability Criteria and Timeframe

Comments on applicability criteria. One commenter requested clarification on the meaning of “reportable accident” that would trigger a public meeting. Another commenter remarked that multiple meetings may be necessary in certain circumstances, for instance if the investigation report has not been finalized. Commenters also suggested that public meetings should be required of all program level facilities while others indicated that a “one-size-fits-all” approach was not appropriate. Several commenters requested that public meetings be required only when an incident generated offsite impacts. Finally, another commenter suggested EPA require periodic public meetings regardless of accident history.

The term “reportable accident” refers to accidents required to be reported in the five-year accident history required under § 68.42 of the existing rule, which include accidental releases from covered processes that resulted in deaths, injuries, or significant property damage on site, or known offsite deaths, injuries, evacuations, sheltering in place, property damage, or environmental damage. EPA agrees that in some cases, multiple public meetings may help to fully describe the circumstances of an accident. While EPA is requiring the owner or operator to hold only one public meeting after an RMP-reportable accident, the Agency encourages owners and operators to hold additional meetings if appropriate. The final rule requires public meetings for regulated sources, regardless of program level, if the facility has an RMP-reportable accident. The Agency does not view the public meeting requirement as a “one-size fits all” requirement. Sources have flexibility to structure public meetings as appropriate to their circumstances and the needs of the surrounding community. EPA recommends that facility owners and operators engage in community outreach to determine how best to structure the public meetings. Involving the public in advance of the meeting will help to ensure public participation in meetings. EPA considered requiring public meetings only after accidents with offsite impacts but decided to apply the requirement to all RMP-reportable accidents because even though some RMP-reportable accidents have only on-site impacts, those accidents are often serious enough to raise safety concerns within the surrounding community.

Finally, EPA is not requiring periodic public meetings, regardless of accident history, in the final rule. EPA believes that public interest in a meeting is highest after an accident, and notes that many commenters indicated that public meetings required by CSISSFRA were not well attended.

Comments on timeframe. Several commenters expressed support for the proposed 30-day timeframe. Other commenters said that a 30-day timeframe would be too long, as the greatest need for a public meeting occurs within 2 weeks after an accident. However, many commenters stated the 30-day timeframe for a public meeting is too short, as a facility is unlikely to complete an incident investigation in that timeframe. Commenters warned that incomplete information would not be appropriate to share with the public and could breed distrust between the public and facilities over the lack of complete data. Some commenters cited the burden placed on facilities to schedule and prepare for a meeting, especially during an incident investigation and other post-incident actions. Commenters recommended alternative timeframes for public meetings after an accident including: 60 days, 90 days, 120 days, six months, nine months, and 12 months or after the investigation is completed. One commenter suggested that EPA provide an opportunity to extend the public meeting timeframe with reasonable justification. Another commenter suggested that EPA allow the LEPC to consult on or determine when to hold the public meeting after an RMP reportable accident.

EPA acknowledges concerns raised by commenters about diverting facility resources from post-accident investigations, and the potential for a facility to lack complete information about an accident if the investigation hasn't yielded sufficient information to share with the public within 30 days. Therefore, EPA has revised the timeframe in the final rule for the public meeting to be held no later than 90 days after an RMP reportable accident. EPA expects that sources will either have completed the incident investigation required under § 68.60 or § 68.81 prior to holding the public meeting, or will have developed sufficient information relevant to community members' concerns to allow a productive meeting. Even if the accident investigation is not complete, a 90-day timeframe should allow the owner or operator to share appropriate information about the accident with the local community. The facility could discuss the progress of the investigation so far and next steps planned.

Some comments expressed the view that attendance at a public meeting is higher when the meeting takes place very soon after an accident occurs. The 90-day timeframe in the final rule is a maximum timeframe, and EPA encourages facilities to take into consideration when public interest may be highest when scheduling the public meeting. EPA recognizes that in some cases, such as for complex, protracted investigations, the facility may need to hold the public meeting prior to completing the incident investigation. In such cases, the owner or operator should consider holding a second public meeting after completing the incident investigation, or sharing information about results of the investigation through another means, such as a Web site, social media, with the LEPC or local emergency response officials, or distributing information directly to people who attended the public meeting and expressed interest in the additional information.

EPA does not believe that it is necessary to add a provision that would allow an extension of the 90-day timeframe with reasonable justification. Such a provision would add complexity to the requirement. Furthermore, EPA believes that by extending the timeframe to 90 days this allows sufficient time for the facility to gather information to share with the public after an accident.

EPA is not finalizing any requirements for LEPCs or local emergency response officials with respect to post-accident public meetings. EPA received many comments that opposed increasing LEPC responsibilities in the final rule, citing resource limitations and significant existing responsibilities. While a facility should communicate closely with LEPCs or local emergency response officials after an RMP reportable accident, and may combine public meetings with LEPC meetings or other events as long as those events/meetings are available for public participation, the facility bears the responsibility for the public meeting. The final rule places no additional burden on LEPCs or local emergency response officials with respect to requirements for post-accident public meeting.

c. Scope of Information Provided at Public Meetings

Public commenters provided various recommendations regarding how much and what type of information should be provided at public meetings. One commenter asserted public meetings are useless since the local media relay information about incidents, such as when and where the incident occurred and emergency response information. Another commenter said public meetings after an accident would be redundant, as the information required to be shared would already be made available to the public for all reportable accident investigations. A few commenters said that completed STAAs should be covered in public meetings. One commenter stated that information about the nature of chemical risks within a community and emergency response protocols during an accidental release or another dangerous event would be the best information to share during a public meeting. Another commenter requested clarification about what information is required to be shared at a public meeting.

EPA disagrees with commenters who stated that public meetings are useless or redundant to other sources of information. EPA believes that public meetings, particularly when held after an accident, will often provide easier access for community members to appropriate facility chemical hazard information, which can significantly improve the community's emergency preparedness and understanding of how the facility is addressing potential risks. Public meetings also provide an opportunity for the public to ask questions or share their concerns with appropriate facility staff and local government officials in attendance.

Public meetings must address information about the incident as well as other relevant chemical hazard information such as that described in § 68.210(b) (i.e., names of regulated substances held in a process; SDSs; accident history information; emergency response program information; a list of scheduled exercises and LEPC contact information). The facility representative should describe the risks that are associated with the facility, and what the facility is doing to protect the public from those risks. In addition, the facility personnel should relay information that would assist the public to prepare for accidental releases. It would be extremely useful to have LEPC and local emergency response officials participate in the meeting to discuss the community emergency response plan and explain how the facility is incorporated into that plan. This would provide an opportunity for the facility representative and local officials to discuss the process for public emergency notification procedures, for sheltering in place or evacuating, and where to obtain further updates on the status of an emergency incident. The discussion should also address how the public can access community emergency response plans and identify what the community may expect to see during a field exercise.

In the final rule, EPA maintains the requirement for information in § 68.42 to be addressed at the public meeting. The facility will have the flexibility to structure the public meeting to focus on areas most relevant to a particular accident, considering the interests of the community. EPA is not requiring that completed STAAs be included, in part because this information is not pertinent to community emergency response planning and also in part because the opportunity for the public to engage in a completed STAA analysis, which may contain CBI or trade secret information, may compromise confidentiality and create security vulnerabilities at the facility.

d. Alternatives to Facility-Hosted Public Meetings

One commenter argued that a facility hosting a public meeting would be redundant when LEPCs already hold public meetings. EPA also received comments that EPA regions or LEPCs should host and facilitate a public meeting instead of the facility, or that facilities should be required to meet with LEPCs or local emergency responders instead of the public. Others requested that LEPCs be able to decline to facilitate a public meeting required by this rule because of their already substantial responsibilities, or that public meetings should be held only at the request of LEPCs or local emergency response agencies regardless of whether a regulated substance was involved, or that they should be held only at the request of the public. Commenters also indicated that small businesses should be allowed to post information that is required to be disclosed, in lieu of a public meeting.

EPA disagrees with the commenters. LEPCs hold meetings with the public to discuss issues related to community planning. The public meetings required by § 68.210(e) in the final rule are intended to be a venue for facility personnel to address questions and concerns raised by the public following an RMP reportable accident at a facility. While communication between the facility and the LEPC is essential, it cannot replace communication between knowledgeable facility staff and the public. LEPCs are encouraged to participate in public meetings, and may collaborate with the owner or operator to host the meeting in conjunction with an LEPC meeting if appropriate. However, LEPCs are not required to co-host or participate in public meetings.

Finally, EPA believes that small businesses should also host public meetings following an RMP reportable accident to allow community members an opportunity to talk with facility personnel. EPA encourages small businesses to find ways to reduce costs of public meetings such as by hosting the meetings at inexpensive venues, such as local schools, community centers, or churches.

VII. Risk Management Plan Streamlining, Clarifications, and RMP Rule Technical Corrections

A stationary source subject to the RMP rule is required to submit an RMP in a method and format specified by the EPA, pursuant to § 68.150(a). The CAA and 40 CFR subpart G require that the RMP indicate compliance with the regulations at 40 CFR part 68 and also include information regarding the hazard assessment, prevention program, and emergency response program. The RMP also includes stationary source registration information, such as name, location and contact information. The EPA may review RMPs for a variety of reasons, including information gathering, inspection preparation, errors in submissions, and changes requiring a correction or re-submission of the RMP. The CAA requires that RMPs be made available to states, local entities responsible for planning or responding to accidental releases at the source, the CSB, and the public. As a result, the information provided in an RMP is intended to be easily understood, thus encouraging the public, local entities, and governmental agencies to interact with stationary sources on issues related to accident prevention and preparedness.

EPA is deferring proposed revisions to delete or revise data elements in the current rule; however, EPA is adding several RMP data elements in subpart G based on the revised rule requirements discussed in this document. This includes data elements to address compliance with:

• Third-party audit requirements,
• IST analysis requirements in the PHA;
• Emergency response preparedness requirements including information on local coordination and emergency response exercises; and
• Information sharing provisions.

By adding these data elements to the RMP requirements in subpart G, EPA will be able to evaluate a stationary source's compliance with these rule requirements. EPA is also finalizing technical corrections as proposed.

A. Revisions to § 68.160 (Registration)

EPA is adding the following RMP data elements that relate to the information sharing provisions discussed in this document:

• § 68.160(b)(21) requires the method of the communication and location of the notification that chemical hazard-related information is available to the public, as set forth in § 68.210(c); and
• § 68.160(b)(22) requires the date of most recent public meeting, as set forth in § 68.210(e).

EPA revised § 68.160(b)(21) to clarify that when identifying how a notification is made, the owner or operator should describe both the method of the communication and the location. For example, if the owner or operator is modifying a Web site to identify that information is available upon request, then EPA expects that the owner or operator will identify in the RMP that the notification is being made through a Web site and then provide the Web address of the notification. Alternatively, if the notification is made via a printed notice, then the owner or operator should identify that a printed notice is available and explain how to obtain the printed materials. EPA received no comments on these provisions.

B. Revisions to § 68.170 (Prevention Program/Program 2)

EPA is revising:

• § 68.170(i) by adding a requirement that the owner or operator identify whether the most recent compliance audit was a third-party audit, pursuant to §§ 68.58 and 68.59; and
• § 68.170(j) by clarifying that the date of the most recent incident investigation be the completion date of the investigation. This would be the date on the final incident investigation report.

EPA received no comments on these provisions.

C. Revisions to § 68.175 (Prevention Program/Program 3)

EPA is revising:

• § 68.175(e) by amending the introductory sentence in paragraph (e) to apply to information on the PHA or PHA update and revalidation information. EPA is moving the date of completion of the most recent PHA or update and the requirement to identify the technique used to subparagraph (e)(1). EPA is deleting the requirement to identify the expected date of completion of any changes resulting from the PHA. Additional PHA information moves to subparagraph (e)(2) through (6) and a new requirement to address inherently safer technology or design measures implemented (if any) and the technology category is in subparagraph (e)(7). This is similar to the proposed revisions but reorganized to simplify the proposed subparagraph (e)(2) and move to a new subparagraph (e)(7);
• § 68.175(k) by adding a requirement that the owner or operator identify whether the most recent compliance audit was a third-party audit, pursuant to §§ 68.79 and 68.80; and
• § 68.175(l) by clarifying that the date of the most recent incident investigation be the completion date of the investigation. This would be the date on the final incident investigation report.

EPA received no comments on these provisions.

D. Revisions to § 68.180 (Emergency Response Program)

Subpart G § 68.180 contains the emergency response program data elements that must be included in the RMP. EPA proposed revisions to add emergency response exercises and revise local coordination provisions of the rule in order to improve coordination with local response authorities and bolster emergency response capabilities and preparedness for accidental releases.

1. Summary of Proposed Rulemaking

• In §  68.180(a) EPA proposed to delete the phrase “the following information.” The text in subparagraphs (a)(1) through (3) were reorganized and/or replaced and EPA proposed to delete subparagraphs (a)(4) through (6).

○ In subparagraph (a)(1), EPA proposed to require the RMP to identify the name, organizational affiliation, phone number, and email address of local emergency planning and response organizations with which the stationary source last coordinated emergency response efforts, pursuant to §  68.10(f)(3) or §  68.93.

○ Subparagraph (a)(2) included proposed requirements to identify whether coordination with the local emergency response organizations is occurring at least annually, pursuant to §  68.93(a).

○ Finally, in subparagraph (a)(3) EPA proposed to require the RMP to identify a list of Federal or state emergency plan requirements to which the stationary source is subject.

• In §  68.180(b), EPA proposed to replace the current text with a requirement to identify whether the facility is a responding or non-responding stationary source, pursuant to §  68.90. EPA proposed subparagraph (b)(1) to apply to non-responding stationary sources and subparagraph (b)(2) to apply to responding stationary sources.

○ Non-responding stationary sources. In subparagraphs (b)(1)(i) through (iii) the owner or operator would be required to identify whether the owner or operator has confirmed that local responders are capable of responding to accidental releases at the source, whether appropriate notification mechanisms are in place, and whether a notification exercise occurs at least annually.

○ Responding stationary sources. In subparagraphs (b)(2)(i) through (v) the owner or operator would be required to identify whether the LEPC or local response entity requested that the stationary source be a responding facility; whether the stationary source complies with requirements in §  68.95; whether a notification exercises occurs at least annually, as required in §  68.96(a); whether a field exercise is conducted every five years and after any RMP reportable accident, pursuant to §  68.96(b)(1)(i); and whether a tabletop exercise occurs at least annually, except during the calendar year when a field exercise is conducted, as required in §  68.96(b)(2)(i).

EPA proposed to delete §  68.180(c), which required the owner or operator to list other Federal or state emergency plan requirements to which the stationary source is subject.

2. Summary of Final Rule

EPA is completely revising and reorganizing subpart G § 68.180 into the following three parts: Requirements for all stationary sources under paragraph (a), requirements for non-responding stationary sources under paragraph (b)(1), and requirements for responding stationary sources under paragraph (b)(2). EPA believes that reorganizing subpart G § 68.180 will clarify the reporting requirements, reduce errors in submitted RMPs, and improve compliance with the RMP requirements. The revisions to subpart G § 68.180 will also improve EPA's ability to evaluate a facility's compliance with the Emergency Response Program requirements.

EPA is amending and finalizing the proposed revisions to require specific information rather than attestations of compliance. EPA is not finalizing the proposed provisions that pertain to LEPCs requesting a stationary source to comply with emergency response program requirements of § 68.95 so EPA is eliminating those requirements under § 68.180.

EPA is finalizing § 68.180(a) as proposed except that subparagraph (a)(2) requires the RMP to identify the date of the most recent coordination with the local emergency response organizations, pursuant to § 68.93(a) (rather than attesting that coordination occurs annually).

EPA is finalizing § 68.180(b) introductory paragraph as proposed. In the final rule subparagraph (b)(1) applies to non-responding stationary sources and subparagraph (b)(2) applies to responding stationary sources. EPA is amending and finalizing the subparagraph as follows:

• Non-responding stationary sources. In subparagraphs (b)(1)(i) through (iii) the owner or operator is required to identify whether the stationary source is included in the community emergency response plan developed under EPCRA (for stationary sources with any regulated toxic substance); the date of the most recent coordination with the local fire department (for stationary sources with only regulated flammable substances); what notification mechanisms are in place; and the date of the most recent notification exercise.
• Responding stationary sources. In subparagraphs (b)(2)(i) through (iv) the owner or operator is required to identify the date of the most recent review and update of the emergency response plan required in § 68.95(a)(4); the date of the most recent notification, as required in § 68.96(a); the date of the most recent field exercise, pursuant to § 68.96(b)(1)(i); and the date of the most recent tabletop exercise, as required in § 68.96(b)(2)(i).

3. Discussion of Comments and Basis for Final Rule Provisions

EPA received one comment indicating that the revision to § 68.180 is unclear and that the `data elements' of the proposal do not distinguish between responding and non-responding stationary sources.

EPA believes that the data elements do distinguish between responding and non-responding stationary sources. A stationary source will be required to identify whether they are “responding” or “non-responding” and responding stationary sources and will answer questions accordingly. EPA will revise its online RMP submission system, RMP*eSubmit, to include the additional data elements, and expects that the submission system will provide clarity for stationary source owners and operators on how to submit responses.

E. Technical Corrections

1. Revisions to § 68.10 (Applicability)

EPA is correcting a typographical error in § 68.10(b)(2). Section 68.10(b)(2) uses the term public receptor and indicates that public receptor is defined in § 68.30; however, the term public receptor is defined in § 68.3, not § 68.30. The revised rule language corrects this typographical error. EPA received no comments and is finalizing this provision as proposed.

2. Revisions to § 68.48 (Safety Information)

EPA proposed to remove the word “material” from the term Material Safety Data Sheet in § 68.48(a)(1) to conform with OSHA's revised terminology for SDS.

Discussion of comments on safety information provisions. A commenter recommended that EPA's revision to § 68.48 should not require facilities to ensure that safety data sheets meet OSHA's hazard communication standard requirements. This commenter argued that operators are given their safety data sheets by vendors and do not have control over their content.

EPA disagrees with the commenter. The current rule requires the owner or operator to maintain Material Safety Data Sheets (MSDS) that meets the OSHA hazard communication standard requirements of 29 CFR 1910.1200(g). In 2012, OSHA made changes to its Hazard Communication Standard at 29 CFR 1910.1200 in order to align with the U.N. Globally Harmonized System of Classification and Labelling of Chemicals (GHS), Revision 3 (77 FR 17574, March 26, 2012). One change was in nomenclature from “Material Safety Data Sheets” to “Safety Data Sheets.” Consequently, OSHA revised the name of the MSDS to Safety Data Sheets (SDS) in the PSM standard at 1910.119(d)(1)(vii) (78 FR 9311, February 8, 2013). Chemical producers and users had to comply with SDS requirements by June 1, 2015.^[119] EPA's technical correction is solely to be consistent with the revised OSHA requirements and EPA is finalizing this amendment as proposed.

3. Revisions to §§ 68.54 and 68.71 (Training)

The RMP rule requires initial and refresher training for employees operating a Program 2 or Program 3 covered process. Since the inception of the rule, however, there has been confusion on the types of employees that are considered workers operating a covered process. Although “employee” is not defined in § 68.3, EPA has traditionally interpreted an employee to be any worker that is involved in operating a process, including supervisors. This is consistent with the OSHA definition of “employee” set forth at 29 CFR 1910.2(d). EPA proposed amendments to clarify that employees “involved in” operating a process are subject to the training requirements of the rule. EPA further proposed a provision to clarify that the term employee includes supervisors responsible for directing process operations. EPA is finalizing these amendments as proposed.

Discussion of comments on training provisions. Several commenters suggested that the proposed revisions to § 68.54 are unclear. These commenters indicated that EPA should provide greater clarification regarding the length of time employers should train their employees, which employees need training, and the distinction between employees “operating” a process and employees “involved in operating” a process.

EPA directs readers to review the Guidance for Facilities on Risk Management Programs for Chemical Accident Prevention (40 CFR part 68) (or General Risk Management Program Guidance), which clarifies expectations for training requirements.^[120] The guidance does not specify a specific amount or type of training and allows the owner or operator to develop a training approach that is facility-specific and tailored to the needs of the facility's employees. The revised language to require training for employees “involved in” operating a process is intended to include employees that operate a process, as well as supervisors of those employees, and other employees that may occasionally be involved in process operations, such as process engineers and maintenance technicians. For employees other than operators and supervisors, EPA expects that initial and refresher training will be appropriate to the employee's responsibilities in operating the process.

If a supervisor is involved in decision-making for process operations, such as making changes to operating parameters, developing or approving operating procedures, or conducting emergency operations, then EPA expects that the supervisor receives initial and refresher training appropriate to the supervisor's responsibilities. In such cases, the training of a supervisor might not need to be as extensive as that of an operator, but EPA expects that the supervisor training will include process operations for which the supervisor might have decision-making authority.

4. Revisions to § 68.65 (PSI)

EPA is revising § 68.65(a) in order to remove irrelevant text regarding the timeframe for initial development of PSI and to more clearly demonstrate that PSI must be kept up-to-date. EPA is revising § 68.65(a) to remove the phrase “In accordance with the schedule set forth in § 68.67” and is adding the phrase: “and shall keep PSI up-to-date.” EPA expects that revising § 68.65(a) in this manner will help Program 3 facilities to better comply with PSI requirements and further clarifies the requirement that PSI must be completed prior to conducting a PHA.

Finally, in order to be consistent with OSHA and the GHS, EPA is replacing “Material Safety Data Sheet” with “Safety Data Sheet” in the note to § 68.65(b). EPA received no comments and is finalizing these revisions as proposed.

5. Revisions to § 68.130—List of Substances

EPA is revising Tables 1 and 4 in § 68.130 as follows:

Table 1 to § 68.130—List of Regulated Toxic Substances and TQs for Accidental Release Prevention. EPA is correcting a typographical error in the Chemical Abstracts Service (CAS) number (no.) for allyl alcohol in Table 1 in § 68.130. The incorrect CAS no. of 107-18-61 for allyl alcohol is corrected to 107-18-6.

Table 4 to § 68.130—List of Regulated Flammable Substances and TQs for Accidental Release Prevention. EPA is correcting a typographical error to the CAS no. for 1, 3-Butadiene, to read 106-99-0, instead of 196-99-0, revising to right justify the first CAS nos. column and deleting the second CAS nos. column because it is redundant. EPA received no comments on these provisions and is finalizing the revisions as proposed.

6. Revisions to § 68.200 (Recordkeeping)

EPA is revising § 68.200 to clarify that records must be maintained at the stationary source. EPA received no comments on this provision and is finalizing the revision as proposed.

VIII. Compliance Dates

The initial Risk Management Program rule applied 3 years after promulgation of the rule on June 20, 1996, which is consistent with the last sentence of CAA section 112(r)(7)(B)(i). The statute does not directly address when amendments should become applicable. The provisions of this action modify terms of the existing rule, and, in some cases, clarify existing requirements.

A. Summary of Proposed Rulemaking

EPA proposed modifications to § 68.10 to establish compliance dates for an owner operator to comply with the revised rule provisions as follows:

• Require compliance with emergency response coordination activities within one year of an effective date of a final rule;
• Provide up to three years for the owner or operator of a non-responding stationary source to develop an emergency response program in accordance with § 68.95 following an LEPC or equivalent's written request to do so;
• Comply with new provisions (i.e., third-party compliance audits, root cause analyses as part of incident investigations, STAA, emergency response exercises, and information availability provisions), unless otherwise stated, four years after the effective date of the final rule; and
• Provide regulated sources one additional year (i.e., five years after the effective date of the final rule) to correct or resubmit RMPs to reflect new and revised data elements.

B. Summary of Final Rule

EPA is finalizing the compliance dates as proposed, except that EPA is deleting language requiring the owner or operator of a non-responding stationary source to develop an emergency response program following an LEPC's written request to do so. Instead, the final provides three years for the owner or operator of a non-responding stationary source to develop an emergency response program in accordance with § 68.95 when the owner or operator determines that they meet the applicability criteria for responding stationary sources in § 68.90.

C. Discussion of Comments

Some commenters provided support for one or more of the compliance dates; however, many commenters were concerned that the timeframes were too long or in some cases too short.

1. General Comments

One commenter argued that the compliance dates should be set at one to two years after the effective date of the rule because the rule provisions are procedural and do not involve capital expenditures. A facility requested that EPA clarify that annual compliance dates and required reoccurring tasks have flexible yearly due dates to allow facilities to perform thorough evaluations without the pressure of tight yearly deadlines.

EPA agrees with commenters that annual compliance dates and required reoccurring tasks should have flexible yearly due dates. This will allow the facility owner or operator and local emergency response officials to schedule coordination activities or exercises based on availability of personnel and minimize unnecessary pressure to comply with a rigid timeframe.

However, EPA disagrees that the compliance dates for all provisions should be shortened to one or two years. EPA believes that additional time is necessary for facility owners and operators to understand the revised rule; train facility personnel on the revised provisions, learn new investigation techniques, as appropriate; research safer technologies; arrange for emergency response resources and response training; incorporate change into their risk management programs; and establish a strategy to notify the public that certain information is available upon request. Furthermore, EPA intends to publish guidance for certain provisions, such as STAA, root cause analysis, and emergency response exercises. Once these materials are complete, owners and operators will need time to familiarize themselves with the new materials and incorporate them into their risk management programs.

2. Third-Party Compliance Audits

One commenter expressed concern that the lack of qualified auditors would result in compliance delays and the three-year timeframe could result in an excessive burden on facilities if there is a limited availability of qualified auditors. The commenter further cited the inability to plan for a third-party audit based on the applicability criteria as a reason for the owner or operator to be unable to comply within the timeframe.

Other commenters urged for shorter timeframes with one commenter pointing out that this provision is triggered by an accident and should therefore be under an accelerated compliance date. Two commenters suggested a three-year compliance date, with the one commenter arguing that there already enough people to perform third-party audits.

EPA disagrees with commenters and is finalizing a four-year compliance date for third-party audits. This means that for any RMP reportable accident occurring later than four years after the effective date of the rule, the owner or operator of a source must conduct a third-party audit. The four-year compliance timeframe will allow potential auditors enough time to establish internal protocols and identify personnel that meet the competency and independence criteria necessary to serve as a third-party auditor. These auditors will also need time to advertise their availability to conduct third-party audits so facility owners and operators can identify potential auditors before there is a need to conduct a third-party compliance audit.

3. Incident Investigations and Root Cause Analysis

Many commenters argued that the proposed four-year compliance date is too long. Commenters offered alternative timeframes such as 12 months, 18 months, and three years. A local agency suggested a one-year compliance date, arguing that many complex facilities are already conducting root cause analyses. One commenter argued that provisions that are triggered by an accident should be required in an accelerated timeframe. Other commenters argued that the compliance date should be required as soon as possible.

EPA disagrees with the commenters and is finalizing a four-year compliance date for incident investigations involving root cause analyses. For any incident that occurs four years after the effective date of the final rule and results in (e.g. an RMP reportable accident) or could reasonably have resulted in a catastrophic release, the owner or operator must investigate the incident and conduct a root cause analysis. This will allow facility owners and operators sufficient time to establish training and program development activities. EPA encourages facility owner or operators that are already conducting root cause analyses to continue to do so for any incident that resulted in (e.g. an RMP reportable accident) or could reasonably have resulted in a catastrophic release during the compliance timeframe.

4. STAA

A local agency supported the four-year compliance timeframe but numerous commenters argued that the proposed timeframe is too long. Many commenters, including mass mail campaigns joined by approximately 14,000 commenters and multiple advocacy groups, requested that EPA expedite compliance with STAA requirements. A mass mail campaign joined by approximately 300 commenters stated that the proposed compliance period is unlawful and arbitrarily long. The commenter argued that EPA has no lawful legal basis to extend the STAA compliance date beyond three years. Another commenter suggested that EPA should consider following the NJ model to implement IST requirements and require an initial review report within 120 days of the rule's effective date.

However, other commenters thought the proposed timeframe was too short. One commenter cited the complexity of the IST/ISD analysis as a reason to extend the compliance date into a second PHA cycle to allow more time for engineering studies and design. Another commenter supported the U.S. Small Business Administration (SBA) recommendation to defer the STAA requirement for three years for small facilities so that EPA can gather information on their experience and assess how often safer alternatives were identified and at what cost.

EPA disagrees with commenters and is establishing a four-year compliance date for STAA. EPA believes that in many cases sources will prefer to perform a full PHA update when implementing the STAA requirements. Sources subject to this provision are among the largest and most complex sources regulated under 40 CFR part 68, and therefore PHAs and PHA updates at these sources typically require a significant level of effort. Since PHA updates are normally done at five year intervals, EPA believes it would be appropriate to allow most sources to adopt these provisions in their normal PHA update cycle if they so choose. Sources that performed their most recent PHA update immediately prior to this rule's effective date will have up to four years to perform their next PHA update and adopt the STAA provisions. Most sources could schedule their PHA updates to incorporate the new STAA provisions on their normal PHA update schedule. EPA also intends to publish guidance on STAA and once complete, facility owners and operators will need time to familiarize themselves with the new materials and incorporate them into their risk management programs.

EPA disagrees with the recommendation to defer the STAA requirement for three years for small facilities in order to allow EPA to gather information. STAA for a source is a site-specific determination and would be difficult to compare among facilities. EPA believes it would be impractical to gather/analyze information on STAA implementation to determine the utility of the provision for small facilities.

5. Emergency Response Coordination

EPA received comments supporting the proposed one-year compliance date for emergency response coordination activities. One commenter requested clarification on how to calculate the annual coordination activities, recommending that it be based on a calendar year.

EPA agrees with commenters and is finalizing a one-year compliance date for emergency response coordination activities. EPA believes that a flexible schedule is appropriate for scheduling annual coordination and agrees with the recommendation to base the coordination on a calendar year timeframe.

6. Emergency Response Program

One commenter suggested that EPA should allow a minimum timeframe of 12 months for a non-responding facility to transition to a responding facility. The commenter further suggested incorporating an extension request to local agencies in the event of compliance delays that fall outside the owner/operator's control (such as budget constraints or inability to procure response resources). Another commenter expressed support for the timeframe to develop an emergency response program; however, expressed concerns with the ongoing costs associated with that requirement.

EPA is finalizing a three-year compliance date for a facility owner or operator to develop an emergency response program once he or she determines a need for a program. EPA is not incorporating an extension request to address compliance delays that may fall outside the owner or operator's control. EPA notes that the two provisions from § 68.90 of the proposed rule that would have made the owner or operator's decision to develop an emergency response program contingent on the outcome of local coordination activities, and required the owner or operator to develop an emergency response program upon receiving a written request to do so from the LEPC or local response authorities, were not included in the final rule. EPA believes that by making these changes, the regulatory provisions that would potentially have caused many sources to convert from being non-responding sources to responding sources have been removed from the final rule. However, as the emergency coordination provisions of the final rule require regulated sources to coordinate annually with local responders and to document coordination activities, EPA acknowledges that it is possible that these more frequent coordination activities may still prompt some sources to implement an emergency response program (i.e., for a non-responding source to become a responding source). In such cases, EPA believes a three-year timeframe is appropriate to establish a program that meets the requirements of § 68.95.

7. Facility Exercises

One commenter objected to the proposed four-year compliance date for emergency response exercises arguing that exercises should be required within one year of when coordination activities must begin.

EPA disagrees with the commenter and is finalizing a four-year compliance date for conducting emergency response exercises. This means that the owner or operator has four years after the effective date of this rule to conduct a notification exercise, consult with local emergency response officials to establish a schedule for conducting tabletop and field exercises, and complete at least one tabletop or field exercise. EPA believes that this timeframe will allow owners and operators to develop an exercise program that is appropriate for their facility, train personnel, and coordinate with local emergency response officials. EPA also expects to develop guidance on emergency response exercises and facility owners and operators will require time to familiarize themselves with the guidance.

8. Information Availability

A professional organization stated that the proposed timeline for information sharing should be shortened to three years for information that is shared with the public. The commenter recommended that information sharing with facility workers should begin immediately after the implementation of the rule. Another commenter asserted that the proposed rulemaking provisions and compliance dates are inappropriate for the sharing of information, arguing that provisions triggered by an accident should be required in an accelerated timeframe.

EPA disagrees with commenters and is finalizing a four-year compliance date for information availability provisions. This means that four years after the effective date of the rule, the facility owner or operator must have notifications in place to inform the public that information specified in § 68.210(b) is available upon request. For any RMP reportable accident occurring later than four years after the effective date of the rule, the owner or operator of a source must hold a public meeting within 90 days of the accident. EPA believes that this timeframe is sufficient to allow facility staff an opportunity to determine the best method for providing notifications to the public and to assemble and format information to prepare to respond to information requests.

9. Update and Resubmit RMP

EPA received no comments on the proposed five-year compliance date for owners or operators to update RMPs to reflect the new and revised data elements in subpart G of the rule. EPA is finalizing a five-year compliance date for this provision, as proposed. This timeframe will allow owners and operators an opportunity to begin to comply with revised rule provisions prior to certifying compliance in the RMP. Additionally, the Agency will revise its online RMP submission system, RMP*eSubmit, to include the additional data elements, and sources will not be able to update RMPs with new or revised data elements until the submission system is ready. Also, once it is ready, allowing an additional year for sources to update RMPs will prevent potential problems with thousands of sources submitting updated RMPs on the same day.

D. Compliance Date Examples

The following examples demonstrate the compliance dates for the final rule as described in Table 6: Final Rule Provisions and Corresponding Compliance Dates.

Table 6—Final Rule Provisions and Corresponding Compliance Dates

Rule provision	Compliance date	Initiated after an RMP reportable accident?
Third-party audit	March 15, 2021	Yes.
Root cause analysis	March 15, 2021	Yes (also required after near misses).
STAA	March 15, 2021	No.
Emergency response coordination activities	March 14, 2018	No.
Owner/operator determines that the facility is subject to the emergency response program requirements of § 68.95	Within three years of the determination	No.
Emergency response exercises	March 15, 2021	No.
Information sharing	March 15, 2021	Partially-public meeting within 90 days.
Update RMP	March 14, 2022	No (but previously existing correction requirements of § 68.195 still apply).

Example 1: Provisions That Apply to a Non-Responding Stationary Source

Source A (see Table 7) is a non-responding stationary source with a regulated process subject to Program 2 requirements. Source A's owner submitted the latest RMP update to EPA on January 20, 2015 and completed its latest compliance audit on August 11, 2017. The source is not in NAICS 322, 324, or 325, and therefore is not subject to the STAA provisions. The source has not had any RMP reportable accidents since the effective date of the final rule.

Table 7—Example 1, Source A

Source A—Program 2, non-responding stationary source
Date of last RMP update	Last compliance audit	Last accident
January 20, 2015	August 11, 2017	N/A.

In this example, the following provisions apply:

• Annual emergency response coordination activities in accordance with § 68.93;
• Notification exercises (§ 68.96(a)); and
• Information availability provisions (§ 68.210).

The owner or operator must coordinate response needs with local emergency planning and response organizations as described in § 68.93 (i.e., to determine how the source is addressed in the community emergency response plan and to ensure that local response organizations are aware of the regulated substances at the source, their quantities, the risks presented by covered processes, and the resources and capabilities at the facility). Coordination activities must occur annually and be documented.

Source A is a non-responding facility, and the owner or operator is required to conduct annual notification exercises. The owner or operator is also required to provide ongoing public notification that certain information is available to the public upon request.

Finally, beginning five years after the rule effective date, the owner or operator must update the RMP to include all revised data elements specified in subpart G. In this case, the owner or operator would update their RMP no later than January 20, 2020 (the source's next scheduled five-year update), and again by March 14, 2022 (the required resubmission date for the final rule).

Table 8: Summary of provisions that apply to a non-responding stationary source summarizes the provisions that apply to Source A.

Table 8—Summary of Provisions That Apply to a Non-Responding Stationary Source

Applicable provisions	Additional information	When to complete *
Emergency response coordination activities	Occurs annually	Complete coordination activities before March 14, 2018 and document coordination.
Notification exercise	Occurs annually	Complete first notification exercise by March 15, 2021.
Information availability provisions
Information to the public	Ongoing. Includes notification that specifies the information that is available and provides instructions on how to obtain, and links to community preparedness information	Complete first calendar year notification by March 15, 2021.
Update RMP	Owner's next five-year resubmission date occurs prior to effective date for provision, so owner must update RMP twice	Update RMP on regular schedule (by January 20, 2020) and again to include new information by March 14, 2022.

If the Source A's owner or operator determines that the facility is subject to the emergency response program requirements (i.e., the facility has toxic substances and is not included in the community emergency response plan or the facility has flammable substances and has not coordinated response actions with the local fire department), then he or she would have three years from the determination date to develop and implement an emergency response plan, obtain equipment, and train personnel in relevant procedures.

Once the owner has developed an emergency response program, the source is a responding facility and must also comply with tabletop and field exercise requirements for responding facilities.

Example 2A: Provisions That Apply to a Responding Stationary Source

Source B (see Table 9) is a responding stationary source with a process subject to Program 3 requirements. Its latest RMP update was submitted June 30, 2020. Its latest compliance audit was performed on April 6, 2020. The source is not in NAICS 322, 324, or 325, and therefore is not subject to the STAA provisions, and the source has not had any RMP reportable accidents since the effective date of a final rule.

Table 9—Example 2A, Source B

Source B—Program 3, responding stationary source
Date of last RMP update	Last compliance audit	Last accident
June 30, 2020	April 6, 2020	N/A.

In this example, the following provisions apply:

• Annual emergency response coordination activities in accordance with § 68.93;
• Emergency response exercises (§ 68.96); and
• Information availability provisions (§ 68.210).

The owner or operator must coordinate response needs with local emergency planning and response organizations as described in § 68.93. Coordination activities must occur annually and be documented.

Additionally, since Source B is a responding facility, the owner or operator is required to conduct annual notification exercises and tabletop and field exercises. The frequency of the tabletop and field exercises will be determined in consultation with local emergency response officials, but at a minimum, shall be every three years for tabletop exercises and every ten years for field exercises. EPA expects that within four years of the effective date of the final rule, that the owner or operator will consult with local emergency response officials to establish a schedule for conducting at least one tabletop and/or field exercise.

The owner or operator is also required to provide ongoing public notification that certain information is available the public upon request.

Finally, by five years after the rule effective date, the owner or operator must update the RMP to include all revised data elements specified in subpart G. Table 10: Summary of provisions that apply to Source B summarizes the provisions that apply in this example.

Table 10—Summary of Provisions That Apply to Source B

Applicable provisions	Additional information	When to complete *
Emergency response coordination activities	Occurs annually	Complete coordination activities before March 14, 2018.
Emergency response exercises (§ 68.96)
Notification exercise	Occurs annually	Complete first notification exercise by March 15, 2021.
Field and tabletop exercises	Tabletop exercise every three years, field exercise once every ten years	Complete first tabletop or field exercise by March 15, 2021.
Information availability provisions
Information to the public	Ongoing. Includes notification that specifies the information that is available, provides instructions on how to obtain, and links to community preparedness information	Complete first calendar year notification by March 15, 2021.
Update RMP		Update RMP to include new information by March 15, 2021.

Example 2B: Additional Provisions That Apply to a Responding Stationary Following an RMP Reportable Accident.

See Table 11.

Table 11—Example 2B, Source B

Source B—Program 3, responding stationary source
Date of last RMP update	Last compliance audit	Last accident
June 30, 2020	April 6, 2020	July 5, 2021.

In this example, Source B has an accidental release on July 5, 2021 that meets the reporting requirements of § 68.42. As a result of the accident, Source B's owner is required to comply with the following additional provisions:

• Third-party audit provisions of § 68.80;
• Incident investigation and root cause analysis requirements of § 68.81; and
• Public meeting within 90 days of an RMP reportable accident, pursuant to § 68.210(e).

Chronologically, the first provision that applies is the requirement to host a public meeting. Section 68.210(e) requires the owner or operator to hold a public meeting within 90 days after the accident to inform the public about the accident, including information required under § 68.42, and other relevant information.

An incident investigation must be initiated promptly, but no later than 48 hours following the incident. The incident investigation provisions require the owner or operator to complete an incident investigation that includes a root cause analysis and other elements specified in § 68.81(d), and an incident investigation report, within 12 months of the incident, unless the implementing agency approves an extension of time.

The third-party audit provisions require the owner or operator to hire a third-party auditor to perform a third-party compliance audit and complete an audit report within 12 months of the accident (unless the implementing agency approves an extension). The owner or operator must also complete an audit findings response report within 90 days of receiving the audit report from the third-party auditor. The owner or operator must also provide the audit findings response report, as well as a schedule to address deficiencies identified in the audit findings response report and documentation of actions taken to address deficiencies, to the owner or operator's audit committee of the Board of Directors, or other comparable committee or individual, if applicable.

By five years after the rule effective date, the owner or operator must update the RMP to include all revised data elements specified in subpart G and § 68.42. Finally, if the owner or operator's response to the incident utilizes the facility's emergency response plan, tested the objectives of an exercise as described in § 68.96(b)(1)(ii), and documents response actions as described in § 68.96(b)(3), then the owner or operator may use the response to satisfy the field exercise requirements of the final rule.

Table 12 summarizes the additional provisions that apply to Source B following an RMP reportable accident (in addition to complying with new requirements triggered by an RMP reportable accident, the owner or operator must annually coordinate response needs with local emergency planning and response organizations, document coordination activities, and comply with the other information disclosure provisions as previously described).

Table 12—Summary of Additional Provisions That Apply to Source B Following an RMP Reportable Accident

Applicable provisions following an RMP reportable accident:	Compliance date	Additional information	When to complete *
Public meeting	March 15, 2021	The accident occurred after the compliance date for this provision, therefore, schedule a meeting within 90 days after the RMP reportable accident	Hold public meeting by October 3, 2021.
Incident investigations	March 15, 2021	The accident occurred after the compliance date for this provision, therefore, initiate within 48 hours, complete investigation and root cause analysis within 12 months	Complete report by July 5, 2022.
Third-party audit	March 15, 2021	The accident occurred after the compliance date for this provision, therefore, complete within 12 months of the RMP reportable accident	Complete third-party audit by July 5, 2022 Complete findings response report within 90 days of completing audit.
Field exercise	March 15, 2021	May use the response to satisfy the field exercise requirements of the rule when all objectives of the exercise are tested and the response is documented	Document the response within 90 days of the incident (i.e., by October 3, 2021), if using response to satisfy field exercise requirements.
Accident history information in RMP		Correct RMP within 6 months of accident (existing requirement)	Correct RMP by January 5, 2022.

Example 3: Compliance Date Example for Sources Subject to STAA Requirements

Source C (see Table 13) is a petroleum refinery in NAICS 32411. Its latest RMP update was submitted on March 31, 2018. Its latest PHA revalidation was completed on March 7, 2017.

Table 13—Example 3, Source C

Source C—Program 3, NAICS 32411
Date of last RMP update	Last PHA revalidation
March 31, 2018	March 7, 2017.

Because the source is in NAICS 32411, it is subject to the STAA provisions of § 68.67(c)(8). Therefore, March 15, 2021, the owner or operator must complete a PHA revalidation that addresses safer technology and alternative risk management measures, and determine the practicability of the ISTs and ISDs considered.

By March 14, 2018 the owner or operator of Source C must comply with the emergency response coordination provisions, and by March 15, 2021, the owner or operator must also comply with other applicable rule provisions including: Third-party audits; incident investigations; emergency response exercises; and information availability (including public meetings).

By March 14, 2022, the owner or operator of Source C must update the RMP to include all revised data elements specified in subpart G. Table 14: Compliance date example for sources subject to STAA requirements, summarizes the STAA provisions that apply to Source C.

Table 14—Compliance Date Example for Sources Subject to STAA Requirements

Applicable provisions	Additional information	When to complete *
STAA	Occurs every five years as part of PHA revalidation	By March 15, 2021.
Update RMP		By March 14, 2022.

IX. Statutory and Executive Order Reviews

Additional information about these statutes and Executive Orders can be found at https://www.epa.gov/​laws-regulations/​laws-and-executive-orders.

A. Executive Order 12866: Regulatory Planning and Review and Executive Order 13563: Improving Regulation and Regulatory Review

This action is an economically significant regulatory action that was submitted to the Office of Management and Budget (OMB) for review. Any changes made in response to OMB recommendations have been documented in the docket. The EPA prepared a Regulatory Impact Analysis (RIA) of the potential costs and benefits associated with this action. This RIA is available in the docket and is summarized here (Docket ID Number EPA-HQ-OEM-2015-0725).

1. Why EPA Is Considering This Action

In response to catastrophic chemical facility incidents in the United States, President Obama issued Executive Order 13650, “Improving Chemical Facility Safety and Security,” on August 1, 2013. The Executive Order establishes the Chemical Facility Safety and Security Working Group (Working Group), co-chaired by the Secretary of Homeland Security, the Administrator of EPA, and the Secretary of Labor or their designated representatives at the Assistant Secretary level or higher, and comprised of senior representatives of other Federal departments, agencies, and offices. The Executive Order requires the Working Group to carry out a number of tasks whose overall goal is to prevent chemical accidents.

Section 6(a)(i) of Executive Order 13650 requires the Working Group to develop options for improved chemical facility safety and security that identify “improvements to existing risk management practices through agency programs, private sector initiatives, Government guidance, outreach, standards, and regulations.” Section 6(c) of Executive Order 13650 requires the Administrator of EPA to review the Risk Management Program. As part of this effort to solicit comments and information from the public regarding potential changes to EPA's RMP regulations (40 CFR part 68), on July 31, 2014, EPA published an RFI (79 FR 44604).

EPA believes that the RMP regulations have been effective in preventing and mitigating chemical accidents in the United States; however, EPA believes that revisions could further protect human health and the environment from chemical hazards through advancement of PSM based on lessons learned. These revisions are a result of a review of the existing Risk Management Program and information gathered from the comments on the proposed rulemaking, SBAR panel, public hearing, RFI, and Executive Order listening sessions, and are finalized under the statutory authority provided by CAA section 112(r) as amended (42 U.S.C. 7412(r)).

2. Description of Alternatives to the Final Rule

EPA analyzed in the RIA the requirements finalized in this action as well as several alternatives for each.

a. Third-Party Audits (Program 2 §§ 68.58 and 68.59 and Program 3 §§ 68.79 and 68.80)

The existing rule requires Program 2 and Program 3 processes to conduct a compliance audit at least once every three years. The revised rule requires facilities to contract with an independent third-party, or assemble an audit team led by an independent third-party, to conduct the next scheduled compliance audit following an RMP reportable accident or after an implementing agency determines that certain circumstances exist that suggest a heightened risk for an accident. The third-party would have to be someone with whom the facility does not have an existing or recent relationship and who meets specific qualification criteria. The low cost alternative applies only for Program 2 and Program 3 processes after an RMP reportable accident or at the request of the implementing agency. The medium cost alternative applies every three years for all compliance audits conducted for all Program 3 processes. The high cost alternative applies every three years for all compliance audits conducted for Program 2 and Program 3 processes.

b. Incident Investigations/Root Cause Analysis (§§ 68.60 and 68.81)

The rule requires facilities to conduct a root cause analysis as part of an incident investigation following an RMP reportable accident or an incident that could reasonably have resulted in an RMP reportable accident (i.e., “near miss”). A root cause analysis is a formal process to identify underlying reasons for failures that lead to accidental releases. These analyses usually require someone trained in the technique. The low cost alternative applies the provision only to RMP reportable accidents or near misses in Program 3 processes. The medium/high cost alternative applies to RMP reportable accidents or near misses involving Program 2 and Program 3 processes.

c. STAA (§ 68.67)

Under the final rule, facilities in NAICS codes 322 (paper manufacturing), 324 (petroleum and coal products manufacturing), and 325 (chemical manufacturing) with Program 3 processes are required to conduct a STAA for each process as part of their PHA, which occurs every five years. The STAA includes two parts: The initial analysis to identify alternatives, and a practicability study to determine the costs and assess the reasonableness of implementing technology alternatives. The final rule is the low cost alternative, which applies to all facilities with Program 3 processes in NAICS codes 322, 324, and 325. The medium cost alternative applies the requirement to all Program 3 processes. The high cost alternative applies the requirement to all Program 3 processes and require facilities to implement practicable IST/ISD.

d. Emergency Response Program Coordination With Local Responders (§§ 68.90, New 68.93, and 68.95)

Under the final rule, all facilities with Program 2 or Program 3 processes are required to coordinate with local response agencies annually to determine how the source is addressed in the community emergency response plan and to ensure that local response organizations are aware of the regulated substances at the source, their quantities, the risks presented by covered processes, and the resources and capabilities at the facility to respond to an accidental release of a regulated substance. The owner or operator must document coordination activities.

Alternatives to this provision are similar to the finalized requirements. One alternative that imposes the same costs as the final rule option includes an option for local officials to request that a facility owner or operator comply with the emergency response program requirements of § 68.95. This would be analogous to the requirements under the Oil Pollution Prevention regulation (40 CFR part 112) where all facilities subject to the FRP provisions at § 112.20 are required to prepare and implement an emergency response plan for oil discharges into navigable waters or adjoining shorelines.

e. Facility Exercises (§ 68.96)

Notification exercises. All facilities with Program 2 or Program 3 processes are required to conduct a notification exercise annually to ensure that the contact list to be used in an emergency is complete, accurate, and up-to-date.

Tabletop and field exercises. The rule requires responding facilities to conduct exercises of their emergency response plans and invite local emergency response officials to participate. Under the low cost alternative, facilities would conduct tabletop exercises every three years. Under the final rule, which is the medium cost alternative, facilities will establish the frequency of exercises in consultation with local emergency response officials, but at a minimum, full field exercises will be conducted at least once every ten years and tabletop exercises conducted at least once every three years. Responding facilities that have an RMP reportable accident, and document the response activities in an after-action report comparable to the exercise evaluation reports may use that response to satisfy the field exercise requirements. Furthermore, owner and operators of responding facilities that conduct exercises to meet other Federal, state or local exercise requirements may satisfy the RMP exercise requirements provided that the scope of the exercise includes the objectives of an RMP exercise. Under the high cost alternative, facilities would conduct full field exercises annually.

f. Information Availability (§ 68.210)

The rule requires all facilities to provide certain basic chemical hazard information to the public, upon request. The owner or operator of the facility shall provide ongoing notification of availability of information elements on a company Web site, social media platforms, or through some other publicly accessible means. The information to be disclosed includes names of regulated substances at the facility; SDS; accident history information; emergency response program information; and LEPC or local response agency contact information.

EPA proposed requirements for facilities to provide certain information to the LEPC, Tribal Emergency Planning Committee (TEPC) or other local emergency response agencies. However, rather than prescribe information elements that must be provided upon request, EPA is requiring the owner or operator of a stationary source to share information that is relevant to emergency response planning as part of the coordination activities that occur annually between facility representatives and local emergency response agencies.

Finally, the rule requires facilities to hold a public meeting for the local community within 90 days of an RMP reportable accident. The medium cost alternative would require Program 2 and Program 3 facilities to hold a public meeting at least once every five years and within 90 days of an RMP reportable accident. The high cost alternative would require all facilities (i.e., including Program 1 facilities) to hold a public meeting at least once every five years and immediately following an RMP reportable accident.

3. Summary of Costs

Approximately 12,500 facilities have filed current RMPs with EPA and are potentially affected by the revised rule. These facilities range from petroleum refineries and large chemical manufacturers to water and wastewater treatment systems; chemical and petroleum wholesalers and terminals; food manufacturers, packing plants, and other cold storage facilities with ammonia refrigeration systems; agricultural chemical distributors; midstream gas plants; and a limited number of other sources that use RMP-regulated substances.

Table 15 presents the number of facilities according to the latest RMP reporting as of February 2015 by industrial sector and chemical use.

Table 15—Number of Affected Facilities by Sector

Sector	NAICS codes	Total facilities	Chemical uses
Administration of environmental quality programs (i.e., governments)	924	1,923	Use chlorine and other chemicals for treatment.
Agricultural chemical distributors/wholesalers	111, 112, 115, 42491	3,667	Store ammonia for sale; some in NAICS 111 and 115 use ammonia as a refrigerant.
Chemical manufacturing	325	1,466	Manufacture, process, store.
Chemical wholesalers	4246	333	Store for sale.
Food and beverage manufacturing	311, 312	1,476	Use mostly ammonia as a refrigerant.
Oil and gas extraction	211	741	Intermediate processing (mostly regulated flammable substances and flammable mixtures).
Other	44, 45, 48, 54, 56, 61, 72	248	Use chemicals for wastewater treatment, refrigeration, store chemicals for sale.
Other manufacturing	313, 326, 327, 33	384	Use various chemicals in manufacturing process, waste treatment.
Other wholesale	423, 424	302	Use (mostly ammonia as a refrigerant).
Paper manufacturing	322	70	Use various chemicals in pulp and paper manufacturing.
Petroleum and coal products manufacturing	324	156	Manufacture, process, store (mostly regulated flammable substances and flammable mixtures).
Petroleum wholesalers	4247	276	Store for sale (mostly regulated flammable substances and flammable mixtures).
Utilities	221	445	Use chlorine (mostly for water treatment) and other chemicals.
Warehousing and storage	493	1,056	Use mostly ammonia as a refrigerant.
Total		12,542

Table 16 presents a summary of the annualized costs estimated in the RIA. In total, EPA estimates annualized costs of $131.2 million at a 3% discount rate and $131.8 million at a 7% discount rate.

Table 16—Summary of Annualized Costs

[Millions, 2015 dollars]

Provision	3%	7%
Third-party Audits	$9.8	$9.8
Incident Investigation/Root Cause	1.8	1.8
STAA	70.0	70.0
Coordination	16.0	16.0
Notification Exercises	1.4	1.4
Facility Exercises	24.7	24.7
Information Sharing (Public)	3.1	3.1
Public Meeting	0.4	0.4
Rule Familiarization	3.9	4.6
Total Cost *	131.2	131.8
* Totals may not sum due to rounding.

The largest average annual cost of the final rule is the STAA costs ($70.0 million), followed by the exercise costs ($24.7 million), coordination ($16 million), and third-party audits ($9.8 million). The remaining provisions impose average annual costs under $5 million each, including rule familiarization ($3.9 to 4.6 million), information sharing (public) ($3.1 million), incident investigation/root cause analysis ($1.8 million), notification exercises ($1.4 million), and public meetings ($0.4 million).

The rule includes three prevention program provisions—third-party audits, root cause analysis, and STAA—involving information collection and analysis activities that can lead to a wide range of outcomes, and therefore costs, if and when the owner acts upon the findings and/or recommendations generated by the audit, investigation, or analysis. Although resolving audit and investigation findings is required under the existing rule provisions, and the rule does not require implementation of practicable IST alternatives, EPA believes it is possible that there may be costs associated with resolving findings from the third-party audit and root cause analysis provisions that go beyond the costs of the existing provisions, and that some owners or operators may have additional costs due to voluntary implementation of IST. EPA acknowledged the wide range of outcomes from these provisions and the significant uncertainties associated with their costs, and requested information in the proposed rulemaking on whether these costs should accrue to the rule. EPA did not receive any data from commenters that illustrates the: Types of costs that result from independent audits (other than the cost of the audit) that are different from self-audit costs; the types of costs that result from root cause investigations as compared to non-root-cause investigations; and for the STAA provisions, information to project what changes facilities are likely to voluntarily undertake (e.g., cost data or studies for implementation of IST changes).

4. Summary of Potential Benefits

EPA anticipates that implementation of this rule will result in a reduction of the frequency and magnitude of damages from releases. Accidents and releases from RMP facilities occur every year, resulting in fires and explosions, property damage, acute and chronic exposures of workers and nearby residents to hazardous materials, and resultant damages to health. Although we are unable to quantify what specific damage reductions may occur as a result of these revisions, we are able to present data on the total damages that currently occur at RMP facilities each year. The data presented are based on a 10-year baseline period, summarizing RMP accident impacts and, when possible, monetizing them. EPA expects that some portion of future damages would be prevented through implementation of this rule. Table 17 presents a summary of the quantified damages identified in the analysis.

Table 17—Summary of Quantified Damages

[Millions, 2015 dollars]

	Unit value	10-Year total	Average/year	Average/accident
On-site
Fatalities	$8.6	$497.8	$49.8	$0.33
Injuries	0.05	105.2	10.5	0.69
Property Damage		2,054.9	205.5	1.4
On-site Total		2,657.9	265.8	1.8
Offsite
Fatalities	8.6	8.6	0.86	0.01
Hospitalizations	0.4	6.8	0.68	0.004
Medical Treatment	0.001	14.8	1.5	0.01
Evacuations *	0.0	7.0	0.70	0.004
Sheltering in Place *	0.0	40.9	4.1	0.03
Property Damage		11.4	1.1	0.007
Offsite Total		89.5	8.9	0.06
Total		2,747.3	274.7	1.8
* The unit value for evacuations is less than two hundred dollars and for sheltering in place is less than one hundred dollars so when expressed in rounded millions the value represented in the table is zero.

EPA monetized both on-site and offsite damages. EPA estimated total average annual on-site damages of $265.8 million. The largest monetized average annual on-site damage was on-site property damage, which resulted in average annual damage of approximately $205.5 million. The next largest impact was on-site fatalities ($49.8 million) and injuries ($10.5 million).

EPA estimated total average annual offsite damages of $8.9 million. The largest monetized average annual offsite damage was from sheltering in place ($4.1 million), followed by medical treatment ($1.5 million), property damage ($1.1 million), fatalities ($0.86 million), evacuations ($0.7 million), and hospitalizations ($0.68 million).

In total, EPA estimated monetized damages from RMP facility accidents of $274.7 million per year. However, the monetized impacts omit many important categories of accident impacts including lost productivity, the costs of emergency response, transaction costs, property value impacts in the surrounding community (that overlap with other benefit categories), and environmental impacts. Also not reflected in the 10-year baseline costs are the impacts of non-RMP accidents at RMP facilities and any potential impacts of rare high consequence catastrophes. A final omission is related to the information provision. Reducing the probability of chemical accidents and the severity of their impacts, and improving information disclosure by chemical facilities, as the provisions intend, would provide benefits to potentially affected members of society.

Table 18 summarizes four broad social benefit categories related to accident prevention and mitigation including prevention of RMP accidents, mitigation of RMP accidents, prevention and mitigation of non-RMP accidents at RMP facilities, and prevention of major catastrophes. The table explains each and identifies ten associated specific benefit categories, ranging from avoided fatalities to avoided emergency response costs. Table 18 also highlights and explains the information disclosure benefit category and identifies two specific benefits associated with it: Improved efficiency of property markets and allocation of emergency resources.

Table 18—Summary of Social Benefits of Final Rule Provisions

Broad benefit category	Explanation	Specific benefit categories
Accident Prevention	Prevention of future RMP facility accidents	• Reduced Fatalities.
Accident Mitigation	Mitigation of future RMP facility accidents	• Reduced Injuries.
Non-RMP accident prevention and mitigation	Prevention and mitigation of future non-RMP accidents at RMP facilities	• Reduced Property Damage. • Fewer People Sheltered in Place.
Avoided Catastrophes	Prevention of rare but extremely high consequence events	• Fewer Evacuations. • Avoided Lost Productivity.
		• Avoided Emergency Response Costs.
		• Avoided Transaction Costs.
		• Avoided Property Value Impacts.*
		• Avoided Environmental Impacts.
Information Disclosure	Provision of information to the public	• Improved efficiency of property markets. • Improved emergency response resource allocation.
* These impacts partially overlap with several other categories such as reduced health and environmental impacts.

5. Discussion of Comments on Estimated Costs and Benefits

a. General Comments

EPA costs underestimated or based on outdated information. Several commenters stated that EPA's cost estimates in the RIA for the proposed rulemaking were generally inaccurate and underestimated the true costs that facilities will face. Some commenters indicated that EPA's estimated labor rates were based on outdated (2014) information. Several commenters representing industry trade associations and regulated facilities expressed specific concerns about the estimated costs of each individual proposed rulemaking element, as well as EPA's estimate of the costs of rule familiarization. Some of these commenters provided specific cost information or estimates to support their claims.

EPA considered this information and made substantial adjustments to the cost estimates for every rule provision, including rule familiarization. In addition to adjusting the cost estimate for the final rule to incorporate cost information submitted by commenters, EPA also adjusted the estimate to delete costs associated with proposed rulemaking provisions that were not included in the final rule (e.g., Information availability to LEPCs), and to account for structural changes between proposed and final rule provisions for certain rule elements (e.g., the final rule requires emergency field and tabletop exercises to be conducted less frequently than EPA had proposed). EPA also updated its estimated labor rates to the most recent (2015) values available from the Bureau of Labor Statistics.

Benefit concerns. Several commenters also addressed EPA's assessment of benefits in their public comment submissions. While some commenters indicated that the proposed requirements would improve safety and prevent chemical releases, other commenters stated that the proposed requirements would not provide any benefits, or that the costs associated with the rule would severely outweigh any benefits. Other commenters indicated that EPA had failed to quantify any benefits of the rule, making a cost-benefit comparison impossible. Other commenters stated that EPA overestimated benefits or inappropriately counted benefits that actually accrue from OSHA's PSM standard as benefits of the proposed rulemaking. One commenter also stated that EPA's benefit categories would be offset by unstated additional costs, including losses in reputation or brand value, higher insurance premiums, and difficulty hiring and retaining workers that facilities may incur as a result of an accident.

EPA disagrees that the proposed rulemaking would not provide benefits or that the costs of the rule would necessarily outweigh its benefits. As EPA explains in the RIA for the final rule, the benefits of the final rule include reductions in the number of people killed, injured, and evacuated or otherwise inconvenienced by sheltering in place; reductions in the damage caused to property on-site and offsite including product, equipment, and buildings; reductions in damages to the environment and ecosystems; and reductions in resources diverted to extinguish fires and clean up affected areas. The final rule also provides other benefits, such as increased public information, which in addition to helping to minimize the impacts of accidents on the offsite public, may also lead to more efficient property markets in areas near RMP facilities.

EPA acknowledges that it is not possible to estimate quantitative benefits for the final rule. EPA has no data to project the specific impact on accidents made by each final rule provision. The accidents themselves have highly variable impacts that are difficult to predict. However, it is clear from the RMP accident data and other available data that chemical accidents can impose substantial costs on firms, employees, emergency responders, the community, and the broader economy. Reducing the risk of such accidents and the severity of the impacts when accidents occur, and improving information provision, as the final rule intends, provides benefits to the potentially affected members of society.

EPA disagrees that the final rule takes credit for benefits that should accrue to the OSHA PSM standard. None of the provisions contained in the final rule are duplicated in the OSHA PSM standard. EPA also disagrees that regulated facilities will suffer losses in reputation or brand value, higher insurance premiums, or have difficulty hiring and retaining workers as a result of the final rule. If, as EPA expects, the final rule results in the prevention of accidents, then it should have the opposite of these effects, to the extent they relate to chemical accidents.

b. Estimate of Rule Familiarization Costs

Several industry trade associations stated that EPA's estimate of the costs of rule familiarization were too low. These commenters stated that EPA's estimate only included time spent by management level employees but should be expanded to include the cost of training all relevant facility employees. Some of these commenters recommended alternate approaches to estimating the costs of rule familiarization that included estimates of time spent by additional labor categories (e.g., attorneys, engineers, production staff, etc.). One commenter also recommended that EPA consider adjusting its rule familiarization estimate to better track with the estimate used by the NJ DEP for revisions to the NJ TCPA regulations.

EPA agrees with these comments, and adjusted its rule familiarization estimate accordingly, resulting in an increase of the estimated costs of rule familiarization.

c. Third-Party Audit Costs

Many commenters including industry trade associations and facilities stated that EPA's estimate of the costs of third-party audits was too low. Many commenters also stated that third-party auditor fees will be much higher than EPA's estimate, partially due to the low availability of qualified auditors. Several commenters submitted cost information from external audits to support their estimates.

EPA generally agrees with these comments. Shortly after the proposed rulemaking was published, EPA received cost information relating to a series of third-party audits conducted by a facility as a result of an enforcement action taken by EPA under CAA section 112(r). The average cost of these audits was approximately double EPA's estimate in the proposed rulemaking, and comparable to cost estimates submitted by commenters. Therefore, EPA adjusted its cost estimate for this provision of the final rule accordingly, resulting in the estimated costs of third-party audits under the final rule nearly doubling. EPA notes that the third-party audit provisions of the final rule also relaxed, to some extent, the independence and competency criteria for third-party auditors. The Agency believes that these changes will increase the availability of qualified auditors, and therefore make such audits less costly than might otherwise have been the case.

d. Incident Investigation/Root Cause Costs

Several commenters stated that EPA's estimate of costs of incident investigations and root cause analysis was inaccurately low. Some of these commenters suggested that the required number of investigations will increase significantly as a result of EPA's proposal to re-define the term “catastrophic release,” and that this would cause the cost of this rule element to increase substantially. Other commenters stated that incident investigations require more labor hours than were accounted for in EPA's cost estimate, and that the Agency needs to significantly raise its estimate in order to account for these issues. Some of these commenters submitted cost information to support their estimates.

Although EPA disagrees that its proposed changes to the definition of “catastrophic release” would have increased the number of investigations required under the rule, the Agency elected not to finalize the proposed changes to that definition, so no increase in incident investigation costs will result from it. Regarding commenters' concerns that EPA had not accounted for enough labor hours for investigations in the RIA for the proposed rulemaking, after considering these comments, the Agency generally agrees that its estimate was too low. EPA incorporated the cost information submitted by commenters into its estimate for the final rule. EPA also notes that unlike the estimate for the proposed rulemaking, the final rule economic estimate did not assume that investigations of near misses would require fewer labor hours than investigations of actual release events. This change also accounted for some of the increase in the estimated cost of this rule element. Overall, these changes resulted in the estimated cost of this rule element approximately doubling for the final rule.

e. STAA Costs

STAA costs too low. EPA received several comments stating that the Agency's estimate of costs for the proposed STAA provisions was too low. Most of these comments addressed both EPA's estimate of the cost of the initial study of safer technology options, as well as the Agency's estimate of costs for the required evaluation of the practicability of IST considered during the STAA.^[121] Some commenters submitted alternate cost estimate information for both the initial analysis of options and the practicability study.

EPA notes that in general, commenter's cost estimates for the initial analysis were higher than EPA's estimates, although not in every case. EPA incorporated these estimates into the RIA as appropriate—the Agency assumed that cost estimates for the STAA initial analysis submitted by trade associations representing a particular category of facilities (e.g., refineries, complex chemical manufacturers, etc.) were the best representation of estimated costs for those categories of facilities, and adjusted its own estimate accordingly. In most cases, this cause the estimated costs for the STAA initial analysis to increase.

Practicability study costs. For the practicability study, several commenters stated that EPA's estimate was far too low, and indicated that EPA should adopt an alternate approach that estimated the cost of the practicability study as a fixed fraction of the cost of the project being considered.

After reviewing these comments, EPA conducted additional research on this subject which confirmed that these commenters were generally correct on this point. EPA therefore adjusted its approach to estimating the costs of practicability studies accordingly, which resulted in a significant increase for the cost of this provision. EPA's research on this topic and the resulting cost estimation approach is explained in detail in Appendix D to the RIA for the final rule.

STAA implementation. EPA also received several comments stating that the Agency should assume that the STAA provision will result in some facilities implementing safer technologies, and include the costs associated with such implementation in its economic estimate.

EPA disagrees with these comments. While the Agency agrees that some facilities may elect to implement IST, the final rule does not require facilities to do so. Therefore, the Agency believes that implementation of IST will result from the owner or operator's own judgement that it is beneficial for the source, after considering all relevant factors. The STAA required under this rule may facilitate such decision making, but does not require it.

f. Emergency Response Program Coordination With Local Responders' Costs

Emergency response program costs. The Agency received several comments relating to the proposed emergency coordination provisions. Some of the comments on this topic related to the Agency's projected estimate of the cost for some sources to develop an emergency response program, stating that EPA's estimate of these costs was too low.

EPA is not finalizing the proposed rulemaking provisions that it believes would have resulted in many sources developing emergency response programs. Therefore, these “new responder” costs were not included in the RIA for the final rule.

Annual coordination burden. EPA also received comments that stated its estimate of burden for the annual coordination provision, a modified form of which is included in the final rule, were too low. One commenter provided emergency coordination cost information for large complex facilities, which was substantially higher than EPA's estimate for the category of facilities.

EPA incorporated the emergency coordination cost information into the revised economic estimate in the RIA for the final rule. EPA also revised its estimate for this element to account for the fact that changes to the annual coordination provision in the final rule, as well as the Agency's decision not to finalize a portion of the information availability provisions of the proposed rulemaking, may result in greater information exchange occurring during annual coordination meetings than was estimated under the proposed rulemaking. Under the information availability provisions of the proposed rulemaking, the owner or operator would have been required to annually provide certain information to local emergency responders. The final rule does not include this provision; however, the annual coordination provisions in the final rule require the owner or operator to provide local response officials with information relevant to emergency planning upon request. The net effect of these changes was to more than double the estimated costs of the annual emergency response coordination provision of the final rule.

g. Facility Exercise Costs

Several commenters disagreed with EPA's approach to estimating the costs of emergency response exercises, and in general, characterized EPA's estimate as too low. Two of these commenters submitted alternate cost estimates for this provision. However, the cost estimate provided by one commenter did not appear to apply to facilities represented by the commenter's industry association. The information submitted by the other commenter appeared credible, but projected costs for large complex facilities that were lower than EPA's estimate.

As a result of these comments EPA determined that its NPRM cost estimate for large complex facilities was inflated, and lowered its estimate to better reflect industry experience. The Agency also notes that the final rule requires emergency exercises to be conducted less frequently than was proposed in the NPRM. The net effect of the structural changes to the final rule and EPA's adjustment of its cost estimation approach resulting from public comments was to substantially reduce the estimated costs of this rule provision.

h. Information Availability Costs

EPA received some comments stating that EPA's estimate of costs for the proposed rulemaking's information availability provisions was too low. These commenters indicated that EPA underestimated the time required for facilities to prepare information required to be disclosed to the public, and that EPA underestimated the cost of holding public meetings. One commenter indicated that renting space for a public meeting would cost as much as $10,000 per day.

Based on these comments, EPA increased its cost estimate for the public information availability provision for large complex facilities. EPA did not change its cost estimate for public meetings because commenter's high estimates of the costs of public meeting space did not comport with EPA's research and prior experience with the costs of public meetings.

B. Paperwork Reduction Act (PRA)

The information collection activities in this rule have been submitted for approval to the OMB under the PRA. The Information Collection Request (ICR) document that the EPA prepared has been assigned EPA ICR number 2537.02 and OMB Control Number 2050-0216. You can find a copy of the ICR in the docket for this rule, and it is briefly summarized here.

This ICR amends a previously approved ICR (1656.15), OMB Control No. 2050-0144. That ICR covers the risk management program rule, originally promulgated on June 20, 1996; the current rule, including previous amendments, is codified as 40 CFR part 68. This ICR addresses the following information requirements that are part of the revised rule:

(1) Make certain information related to the risk management program available to the public, upon request;

(2) Hold a public meeting within 90-days of an accident subject to reporting under § 68.42 (i.e., an RMP reportable accident);

(3) Hire a third-party to perform or lead a compliance audit after an RMP reportable accident or after an implementing agency determines that conditions at the stationary source could lead to an accidental release of a regulated substance or identifies problems with the prior third-party audit;

(4) Conduct and document a root cause analysis after an RMP reportable accident or a near miss;

(5) Conduct and document a STAA for a subset of Program 3 facilities in North American Industrial Classification System (NAICS) codes 322 (paper manufacturing), 324 (petroleum and coal products manufacturing), and 325 (chemical manufacturing);

(6) Meet and coordinate with local responders annually to exchange emergency response planning information;

(7) Conduct an annual notification drill to verify emergency contact information; and

(8) Responding facilities conduct and document emergency response exercises including:

• A field exercise at least every ten years, and
• A tabletop exercise at least every three years.

EPA believes that the RMP regulations have been effective in preventing and mitigating chemical accidents in the United States. However, EPA is revising the rule to further protect human health and the environment from chemical hazards through advancement of PSM based on lessons learned—resulting in better coordination between facilities, LEPC's, and the public. State and local authorities will use the information in RMPs to modify and enhance their community response plans. The agencies implementing the RMP rule will use RMPs to evaluate compliance with part 68 and to identify sources for inspection because they may pose significant risks to the community. Citizens may use the information to assess and address chemical hazards in their communities and to respond appropriately in the event of a release of a regulated substance. These revisions are a result of a review of the existing Risk Management Program and are finalized under the statutory authority provided by section 112(r) of the CAA as amended (42 U.S.C. 7412(r)).

Some of the elements mandated in the regulation for the RMP may require the submittal of data viewed as proprietary, trade secret, or confidential. As described previously, EPA has adopted procedures for sources to claim certain information as confidential business information. EPA encourages facilities that have CBI claims to submit substantiation with the RMP.

Respondents/affected entities: Manufacturers, utilities, warehouses, wholesalers, food processors, ammonia retailers, and gas processors.

Respondent's obligation to respond: Mandatory (CAA sections 112(r)(7)(B)(i) and (ii), CAA section 112(r)(7)(B)(iii), 114(c), CAA 114(a)(1)).

Estimated number of respondents: 14,280.

Frequency of response: On occasion.

Total estimated burden: 1,778,244 hours (per year). Burden is defined at 5 CFR 1320.3(b).

Total estimated cost: $130,578,842 (per year), includes $8,285,600 annualized capital or operation & maintenance costs.

An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number. The OMB control numbers for the EPA's regulations in 40 CFR are listed in 40 CFR part 9. When OMB approves this ICR, the Agency will announce that approval in the Federal Register and publish a technical amendment to 40 CFR part 9 to display the OMB control number for the approved information collection activities contained in this final rule.

C. Regulatory Flexibility Act (RFA)

Pursuant to section 603 and 609(b) of the RFA the EPA prepared an initial regulatory flexibility analysis (IRFA) for the proposed rulemaking and convened a Small Business Advocacy Review (SBAR) Panel to obtain advice and recommendations from small entity representatives that potentially would be subject to the rule's requirements. Summaries of the IRFA and Panel recommendations are presented in the proposed rulemaking at 81 FR 13637, March 14, 2016.

As required by section 604 of the RFA, the EPA prepared a final regulatory flexibility analysis (FRFA) for this action. The FRFA addresses the issues raised by public comments on the IRFA for the proposed rulemaking. The complete FRFA is available for review in the docket and is summarized here.

1. Statement of Need and Rule Objectives

The purpose of this action is to improve safety at facilities that use and distribute hazardous chemicals. In response to catastrophic chemical facility incidents in the United States, including the explosion that occurred at the West Fertilizer facility in West, Texas, on April 17, 2013 that killed 15 people (on May 11, 2016, ATF ruled that the fire was intentionally set),^[122] President Obama issued Executive Order 13650, “Improving Chemical Facility Safety and Security,” on August 1, 2013. Section 6(a)(i) of Executive Order 13650 requires that various Federal agencies develop options for improved chemical facility safety and security, including modernizing regulations. As a result, EPA is finalizing revisions to the Risk Management Program (40 CFR part 68).^[123]

EPA believes that the RMP regulations have been effective in preventing and mitigating chemical accidents in the United States; however, EPA believes that revisions could further protect human health and the environment from chemical hazards through the advancement of process safety based on lessons learned. These revisions are a result of a review of the existing Risk Management Program and information gathered from the comments on the proposed rulemaking, SBAR panel, public hearing, RFI, and Executive Order listening sessions, and are finalized under the statutory authority provided by CAA section 112(r) as amended (42 U.S.C. 7412(r)). For more information on the proposed rulemaking, SBAR panel and outreach efforts for this action, see the docket for this rulemaking (Docket ID Number EPA-HQ-OEM-2015-0725).

2. Significant Comments on the IRFA

a. General Comments

A Federal elected official, Federal agency, facility, and multiple industry trade associations commented that EPA is not fulfilling its obligations under the Regulatory Flexibility Act because the Agency did not provide itself with enough time to consider the comments of either the SBAR panel report or the SERs in the proposed rulemaking. Many of these commenters asked that the SBAR panel recommendations be incorporated in the final rule.

A facility stated that the proposed rulemaking will be burdensome to small facilities. An association of government agencies expressed concern that the costs of a more prescriptive risk management program will fall on small communities. An industry trade association and Federal agency claimed that the proposed rulemaking imposes a disproportionate burden on small facilities and asserted that EPA should eliminate impractical, unjustifiable, or non-cost-effective requirements. Several industry trade associations and a facility commented that the proposed rulemaking will result in more facilities being required to become responders, which will be costly and difficult for small businesses.

Multiple facilities commented that EPA should withdraw its proposed rulemaking and coordinate more closely with OSHA's PSM rulemaking. An industry trade association stated that OSHA's PSM program and EPA's RMP proposal is creating confusion for small entities in the water sector. The commenter asked that EPA update guidance documents and delay further development of RMP revisions until OSHA'S PSM SBAR panel process is complete.

EPA disagrees that the Agency did not fulfill its obligations under the Regulatory Flexibility Act or that the Agency did not consider the comments of the SBAR panel and SERs in the proposed or final rules. In many locations throughout the proposed rulemaking, EPA discussed SBAR panel recommendations and requested public comments on regulatory alternatives recommended by the SBAR panel. EPA also made numerous adjustments to the final rule to incorporate regulatory alternatives that were suggested by SERs where those alternatives were also supported by public comments and were consistent with the Agency's policy goals. For example, EPA incorporated SBAR panel recommendations by relaxing the competency and independence criteria for third-party auditors; reducing the frequency for conducting facility exercises; and not finalizing the proposed revision to the definition of “catastrophic release.”

EPA also disagrees that the final rule is disproportionately burdensome on small entities. In fact, the costliest final rule provisions—STAA and facility exercises—affect relatively few small entities. EPA minimized the effect of the STAA provisions on small entities by applying these requirements to a narrowly-defined set of facilities in three select industry sectors. EPA minimized the impact of the exercise requirements on small entities by applying these requirements only to responding facilities, which tend to more often be large facilities. EPA also removed language from the final rule that would potentially have required numerous small entities to become responding facilities.

Regarding comments requesting that EPA withdraw its rulemaking and coordinate more closely with OSHA, EPA notes that it did coordinate with OSHA in the development of the proposed and final rules, and that OSHA has also completed a SBAR panel as an initial step toward proposing potential changes to the PSM standard, which may include some changes that are similar to those in this rule. However, EPA does not believe it is necessary for the Agency to conduct its rulemaking on exactly the same timeline as OSHA. The 1990 CAA Amendments contained separate timelines for the initial OSHA and EPA rulemakings and has no provisions restricting timeframes for either agency amending its rules.

b. Third-Party Audits

A facility and an industry trade association stated that EPA's assertion that the proposed requirements for third-party audits will have “fairly low impact on small businesses” is false and the requirement should be withdrawn entirely. Another industry trade association commented that third-party audits will be especially costly to small facilities. An industry trade association commented that the requirement for third-party audits will lead to a lack of auditor availability, a particularly difficult problem for small businesses.

EPA disagrees that the final rule's third-party audit requirements have a disproportionately high impact on small businesses. EPA notes that the third-party audit provisions will only affect facilities that experience an RMP reportable accident. Over the last ten years, RMP facilities reported approximately 150 accidents per year, and over 75% of these accidents occurred at large businesses.^[124] Based on comments expressed by SERS and others, EPA also relaxed the final rule's independence criteria to allow the owner or operator to use third-party audit teams that include some non-independent members, including employees of the stationary source being audited. Also, the final rule allows a third-party audit team to include retired employees of the facility being audited, if their sole continuing financial attachments to the owner or operator are employer-financed or managed retirement and/or health plans. The audit team can also include other persons who previously provided consulting services as an employee or contractor of the owner or operator, provided those services were not provided within the last two years (whereas the proposed rulemaking would have required a three-year prohibition on previous employment). EPA believes these changes will increase the availability of auditors and therefore make third-party audits more cost-effective for small business owners.

c. Facility Exercises

Multiple state agencies, facilities and a Federal agency commented that the increase in mandatory field exercises for Program 2 and Program 3 facilities would adversely affect small RMP facilities and small communities. An industry trade association stated that the proposed rulemaking for facility coordination with local responders should be more flexible based on the size of the community and its existing local response capabilities.

A consultant/engineer stated that small utilities who lack a local emergency agency with first responder capabilities will have difficulty meeting the proposed requirements. The commenter requested that EPA exempt small entities from the emergency response program requirement and offer increased assistance to LEPCs in small communities.

A Federal agency stated that LEPC concerns should be addressed in a guidance document instead of a rulemaking.

EPA notes that the final rule includes significant changes to the exercise requirements to address concerns expressed by the SBAR panel, individual SERs and other commenters. First, the final rule allows owners and operators to work with local response officials to establish an exercise schedule that works for both parties, provided the owner or operator holds a field exercise at least once every ten years, and a tabletop exercise at least once every three years. Second, the field and tabletop exercise requirements only apply to responding facilities, so non-responding facilities, which include the majority of small businesses regulated under the RMP rule, are not required to comply with them. Lastly, EPA did not finalize proposed rulemaking provisions that would have required many small businesses to become responding facilities.

d. Public Meetings and Information Disclosure

A Federal agency stated that the public meeting requirement should include small business flexibility, allowing small business to post the required information to be disclosed instead of organizing a public meeting.

While EPA did not implement the recommendation to allow small businesses to post required information in lieu of holding a public meeting, EPA notes that the public meeting requirement, like the third-party audit requirement, only applies to facilities after an RMP-reportable accident, which minimizes its impact on small businesses. Also, EPA revised the public meeting requirements to extend the timeframe within which the meeting must be held (from 30 to 90 days after an RMP reportable accident).

3. SBA Office of Advocacy Comments and EPA Response

The SBA Office of Advocacy comments urged EPA to consider small business concerns and provide flexibility to reduce the impact of the proposed rulemaking on small businesses. The following sections describe SBA recommendations and how EPA has revised the rule to provide additional flexibility that benefits small businesses.

a. Third-Party Audits

Duplicative of existing requirements. SBA suggested that third-party audits are too burdensome for small businesses and should be eliminated or reduced significantly in scope. SBA argued that the requirements are duplicative of the existing requirements for self-audits and incident investigations and suggested that EPA waive the requirements if an implementing agency conducts an inspection as a result of a reportable release or facility noncompliance.

EPA disagrees that third-party audits are duplicative of existing requirements. Following an accident, incident investigations often reveal that facilities have deficiencies in some prevention program requirements related to that process. Incident investigations generally only evaluate the affected process, and do not necessarily address all covered processes at a facility, or even all prevention program elements for the affected process. However, compliance audits entail a systematic evaluation of the full prevention program for all covered processes, and EPA expects that third-party audits should identify deficiencies in any other covered processes at such facilities.

Additionally, EPA does not agree that third-party audits should be waived if EPA conducts an inspection. Third-party audits do not constitute enforcement, nor do they substitute for inspections by implementing agencies. The audits are designed primarily to benefit owners or operators by assisting them to identify both actual noncompliance as well as operational or equipment deficiencies, previously unidentified risk factors, and accident release and/or regulatory noncompliance precursor conditions which, if uncorrected, could lead to releases and/or enforcement actions. Proactively addressing deficiencies, risk factors, and precursor conditions to accidental releases and regulatory noncompliance will provide financial, regulatory, and environmental benefits for facility owners and operators, including small businesses, and communities.

Finally, EPA has reasonably targeted third-party audit requirements at facilities that have had RMP reportable incidents that may demonstrate weaknesses in prior self-assessments and at facilities of heightened concern for implementing agencies. Most small businesses do not have RMP reportable releases and the implementing agency criterion focuses on conditions with the potential to lead to accidental releases, rather than authorizing implementing agencies to require third-party audits under a potentially wide range of circumstances, including minor noncompliance. Therefore, EPA does not expect that this provision will be burdensome for small facilities.

Applicability. SBA recommended that EPA limit the requirement to Program 3 facilities with major accidents with offsite impacts.

EPA disagrees with this approach. EPA based applicability of third-party audits on whether a source had an RMP reportable accident or whether conditions exist that could lead to an accidental release. EPA believes that these criteria are potential indicators for noncompliance with prevention program requirements and therefore warrant an evaluation by a third-party.

Auditor qualifications. SBA expressed concerns with the auditor qualifications in the proposed rulemaking arguing that it would be difficult to find auditors with no financial connection to the facility (such as retirees). SBA recommended that EPA allow small businesses with less than 250 employees to submit a waiver request of the independence criteria based on limited availability of independent auditors. SBA also expressed concern over the PE criterion for third-party auditors and recommended that EPA consider other accreditations^[125] to satisfy the competency criterion for third-party auditors. SBA recommended EPA consider other criteria in place of the PE criterion to allow additional flexibility such as years of experience, number of audits conducted at a specific facility type, and active involvement in developing industry standards.

In order to address concerns about the availability of auditors, EPA modified the third-party auditor qualification criteria in the final rule to enable more firms and individuals to qualify as third-party auditors or third-party audit team leaders. The most significant modification to the third-party auditor qualification criteria is that only employees of the independent third-party audit firm must meet the independence criteria of § 68.59(c)(2) and/or § 68.80(c)(2). For third-party audit teams, the team leader must meet both the competency and independence criteria of § 68.59(c) and/or § 68.80(c) and all other employees of the third-party auditor firm that participate on the team need only meet the independence criteria. Third-party audit teams may also include other personnel, such as consultants or facility employees and these personnel are not subject to the third-party qualification criteria of the final rule.

EPA also revised the timeframe within which third-party auditors cannot provide business or consulting services to two years. EPA added language indicating that if a third-party-firm employs personnel who have provided business or consulting services to the facility within the prescribed timeframe (i.e. within two years of the audit) then the third-party audit firm must ensure that these personnel do not participate on the audit team. Additionally, EPA clarified in regulatory language the circumstances in which a retired employee may participate in a third-party audit and deleted the PE requirement from the final rule. Viewed as a whole, these changes serve to increase the types of personnel who may potentially serve as independent third-party auditors. Therefore, EPA believes it will be unnecessary for facility owners or operators to petition for a relaxation of auditor qualifications.

b. Incident Investigations and Root Cause Analysis

SBA recommended that EPA limit the scope of this requirement to apply only to reportable releases in order to reduce the burden on small businesses. SBA further recommended that EPA retain the existing definition of “catastrophic release.”

EPA is finalizing the scope of the incident investigation requirement to apply to an incident that resulted in a catastrophic release or could reasonably have resulted in a catastrophic release (i.e. a near miss). However, EPA is not finalizing the proposed definition for catastrophic release and is instead maintaining the existing definition. In the final rule, EPA is clarifying what we mean by near miss to address uncertainty about the term.

c. STAA

SBA recommended mandating an IST analysis only at the design stage of new processes. Alternatively, to reduce the burden for small entities, SBA recommended delaying the provision for small firms (with less than 250 employees) until three years after the rule's compliance date for larger firms in order to allow EPA a chance to review the utility of the provision. SBA also recommended that EPA exclude processes that are governed by specifications established by a government agency or by a customer through a contractual relationship.

EPA is finalizing the STAA provision as proposed. EPA disagrees that STAA analyses should only be required during the initial design phase of a facility. While the greatest potential opportunities for using IST occur early in process design and development, many IST options may still be practicable after the initial design phase. Furthermore, STAA involves more than just IST. Safer technology alternatives also include passive measures, active measures, and procedural measures, and these measures can be modified and improved after the initial design of a facility. EPA notes that many RMP-regulated facilities were originally constructed decades ago, yet major enhancements have been reported in some plants that have been operating for many years.^[126] CCPS explains that inherently safer strategies can be evaluated throughout the lifecycle of a process, including operations, maintenance and modification, and EPA agrees with this approach.

EPA also disagrees with the suggestion to exempt certain groups (such as batch toll manufacturers) from the STAA requirement. Safer technology alternatives include many options beyond chemical substitution or minimization. Therefore, even where a contractual relationship or regulation requires a regulated batch toll manufacturing facility to use a particular regulated substance in specified quantities, owners and operators of batch toll manufacturing facilities may still consider other potential safer alternatives, such as passive, active, or procedural measures. Also, the final rule does not require regulated sources to implement IST or ISD considered, so there is no conflict between this final rule and other regulations that may apply to RMP-regulated facilities subject to STAA requirements. For example, an owner or operator would be in compliance with this rule if he or she determines that a chemical substitution is not practicable if the substitution is prohibited by another regulation.

Finally, EPA is not delaying compliance dates for small businesses to allow time for evaluating the provision at large facilities. STAA for a source is a site-specific determination and would be difficult to compare among facilities. EPA believes it would be impractical to gather/analyze information on STAA implementation to determine the utility of the provision for small facilities.

d. Emergency Response Program Coordination With Local Responders

SBA recommended that EPA adopt compliance flexibility for small businesses by limiting their responsibility to making good faith efforts to coordinate with local responders. SBA further suggested that EPA remove the provision to allow LEPCs to require sources to develop emergency response programs. SBA also suggested that EPA provide guidance to local responders, rather than expand existing regulations, and focus on implementing and enforcing emergency planning requirements for LEPCs. Finally, SBA recommended providing guidance on expectations for coordination between a facility and local responders as well as clarifying a facility's obligations for preparing an emergency response program.

EPA is not finalizing the provision that would have required the source to develop an emergency response program following a written request from the LEPCs or local response authorities. Furthermore, the final rule clarifies requirements for coordination activities between facility personnel and local responders. EPA understands some communities do not have functional LEPCs, but has accounted for this possibility by requiring coordination to be with “local emergency planning and response organizations.” This term is intended to encompass all manner of local public emergency planning and response organizations. In many cases this will be the LEPC, but in other cases it may be a local emergency management agency, a local fire department, or another local response organization. These non-LEPC planning entities can use this provision to obtain necessary planning information even when they lack the authority granted LEPCs under EPCRA 303(d)(3). Regardless of whether or not their community has an active LEPC, EPA expects owners and operators of regulated sources to make good faith efforts to carry out the coordination activities required in the final rule. If local emergency planning and response organizations decline to participate in coordination activities, or the owner or operator cannot identify any appropriate local emergency planning and response organization with which to coordinate, the owner or operator should document their coordination efforts, and continue to attempt to perform coordination activities at least annually.

The rule also clarifies requirements for facilities that must develop an emergency response program in accordance with § 68.95. Responding facilities must comply with all of the provisions of § 68.95, which include developing an emergency response plan, developing procedures for the use, inspection, and testing of emergency response equipment, conducting training for employees in relevant procedures, and updating the emergency response plan to reflect changes at the source. Any facility that plans to use its employees to take response actions beyond those specified in its emergency action plan under 29 CFR 1910.38 as a result of an accidental release at the source—which could include, for example, donning emergency air breathing apparatus in order to enter an area where a toxic gas leak has occurred with the intention of stopping or controlling the release—would be expected to have obtained appropriate equipment and training, and to address these activities in its emergency response program, even if the facility is also relying on local responders to supplement its own response, or to manage offsite response actions such as evacuations and sheltering-in-place.

e. Exercises

SBA recommends requiring small businesses to only conduct tabletop exercises and eliminate the field exercises requirement of the proposed rulemaking.

EPA is requiring that responding facilities conduct both tabletop and field exercises; however, we have revised the frequency to reduce the burden on all facilities. The rule requires the owner or operator to conduct both tabletop and field exercises involving a simulated accidental release of a regulated substance. As part of the coordination with local emergency response officials required by § 68.93, the owner or operator is required to consult with these local officials to establish an appropriate frequency for tabletop and field exercises. However, in all cases, the owner or operator must conduct a field exercise at least once every ten years and a tabletop exercises at least once every three years. Additionally, EPA encourages several nearby or adjacent facilities to conduct joint exercises, and this may prompt small facilities to pool their response resources, thereby reducing the exercise and emergency response burden on each facility.

f. Information Availability

Availability of information for LEPCs. SBA suggests that EPA require a one-page summary of information relevant for emergency response to an accident at the facility. SBA also expressed concern with the recordkeeping requirement of the proposed provision and suggested that EPA require the information be provided within a reasonable time period after receiving a request to allow the facility time to develop the information.

EPA maintains that it is very important to ensure that LEPCs or local emergency response officials have the chemical information necessary for developing local emergency response plans, however, EPA believes it is unnecessary to specify in the RMP rule the types or format of information that LEPCs or emergency response officials may request. Therefore, EPA has eliminated this provision in the final rule. EPCRA section 303(d)(3) already provides the necessary authority to allow LEPCs to request information needed to develop the local emergency response plan. Additionally, EPCRA requires facilities to provide SDSs and inventory information to LEPCs to assist emergency planners and responders. Under EPCRA section 312(f), fire departments have the authority to inspect these facilities to better understand the risk associated with these chemicals and how to deal with those risk in the local emergency response plan.

EPA added language to the emergency response coordination provisions of § 68.93, which requires the owner or operator to provide “any other information that local emergency planning and response organizations identify as relevant to local emergency planning.” This approach will allow LEPCs and other local emergency officials to obtain the information they require to meet their emergency response planning needs. It will also allow local emergency planners and response officials to ask questions of facility personnel about the risks associated with the chemical hazards at the facility and about appropriate mitigation and response techniques to use in the event of a chemical release.

Availability of information for the public. SBA recommends that EPA improve public awareness of existing sources of information through its own Web site or other public forums rather than requiring small businesses to repackage existing information. Alternatively, SBA suggests requiring facilities to indicate where this information can be obtained.

The final rule requires the owner or operator to make certain chemical hazard information for all regulated processes at a stationary source available to the public upon request. The facility must provide ongoing notification to the public about what chemical hazard information is available upon request, how the public may obtain such information, and where to access any other available information on community emergency preparedness. The facility owner or operator must provide information to the requester within 45 days of receiving a request.

Public meetings. SBA recommends allowing small businesses to post information that would be disclosed at a public meeting rather than require them to host meetings. Furthermore, SBA suggests that EPA should provide a longer time period for holding a public meeting to allow the owner or operator more time to gather information and adequately prepare for the meeting.

In the final rule, EPA is requiring all facilities to hold a public meeting after an RMP-reportable accident, but is extending the timeframe for the public meeting to 90 days in response to comments. EPA believes that small businesses should host public meetings following an RMP reportable accident to allow community members an opportunity to talk with facility personnel. EPA encourages small businesses to find ways to reduce costs of public meetings such as by hosting the meetings at inexpensive venues, such as local schools, community centers, or churches.

4. Estimate of the Number of Small Entities to Which the Final Rule Applies

The RMP rule affects a broad range of sectors (296 separate NAICS codes are listed in RMP filings; 240 of these are associated with small entities). The RMP data include facility and parent company name, as well as the number of full time equivalents (FTE) for the facility and the NAICS codes. To develop an estimate of the number of small entities, the analysis required a series of reviews of the data to identify the large entities and the small entities that were part of small firms owning multiple facilities. For more information on the analysis to estimate the number of small entities, see section 7.2 of the RIA.

5. Projected Reporting, Recordkeeping and Other Compliance Requirements of the Final Rule

Under the final rule, all facilities are required to make certain information available to the public upon request. Program 2 and Program 3 facilities are also required to provide information upon request to local response officials during annual coordination meetings. Program 1 facilities will likely not have to spend more than an hour per year on this disclosure because the information disclosed to the public is information every facility should have readily available and because the additional information that will be provided, upon request, to local responders relates to provisions that do not apply to Program 1 facilities. Therefore, the FRFA has not considered Program 1 small facilities in the analysis of impacts.

Program 2 and Program 3 facilities will incur the same costs for the other provisions except for the STAA. Each facility will be required to update information to be disclosed annually, coordinate with the local responders, and conduct a notification drill annually. If the facility is a responder, it will have to hold exercises every three to ten years, including at least one full field exercise every ten years. Program 3 facilities in NAICS codes 322, 324, and 325 will have to conduct an STAA as part their PHA every five years.

If a facility has an accident, it will incur costs to hold a public meeting within 90 days of an RMP reportable accident. The facility will also incur costs for obtaining an independent third-party to conduct their next scheduled compliance audit and to conduct a root cause analysis as part of the incident investigation. In the event of a near miss, facilities will also be required to conduct a root cause investigation. Section 7.3.1 of the RIA describes the costs of the final rule for small entities.

6. Steps Taken To Minimize Economic Impact to Small Entities

The RIA analyzed the proposed new requirements and revisions to existing requirements as well as several alternatives for each. In most cases, EPA chose regulatory alternatives that had reduced impacts on small businesses relative to other alternatives that EPA considered. In this section, we discuss each final rule provision and explain how the provision minimizes impacts on small businesses and which of the SBAR Panel recommendations were implemented.

a. Third-Party Audits (Program 2 §§ 68.58 and 68.59 and Program 3 §§ 68.79 and 68.80)

EPA is finalizing a requirement for the owner or operator to engage a third-party auditor to conduct a compliance audit when required by an implementing agency due to conditions at the stationary source that could lead to an accidental release of a regulated substance or following an RMP reportable accident. Limiting the applicability of this provision to sources that have had RMP reportable accidents minimizes its impact to the overall universe of RMP facilities, and particularly to small businesses. As indicated in Exhibit 5-18 of the RIA, the estimated cost of the high option ($196 million annualized) is nearly 20 times higher than the estimated costs of the preferred option ($9.9 million annualized). Furthermore, a majority of the costs for the option would likely be borne by large businesses as historically, most RMP accidents have occurred at facilities that do not meet SBA small business criteria. Table 19 shows the number of accidents from 2004—2013 that occurred at small and large facilities.

Table 19—Percentage of Accidents at Small and Large RMP facilities, 2004-2013

Sector	Program 1		Program 2		Program 3		Total
	Small	Large	Small	Large	Small	Large
NAICS 325—Chemical Manufacturing	0	6	1	5	53	465	530
NAICS 311, 312—Food/Beverage Manufacturers	0	0	2	0	58	210	270
NAICS 322—Paper Manufacturing	0	0	0	0	9	37	46
NAICS 331, 332, 333, 334, 336, 339—Other Manufacturing	0	0	4	0	12	27	43
NAICS 11, 12, 15, 42491—Agricultural Chemical Distributors	0	0	0	0	91	65	156
NAICS 4246, 4247—Chemical/petroleum wholesale	0	2	0	0	7	29	38
NAICS 4244, 4245—Other wholesale	0	0	0	0	7	13	20
NAICS 493—Warehouse	0	1	0	0	18	53	72
NAICS 324—Petroleum and Coal Products Manufacturing	2	6	0	0	15	146	169
NAICS 22131, 22132—Water/POTW	0	0	14	20	17	24	75
NAICS 211—Oil/Gas exploration	4	4	1	0	10	34	53
Other	3	7	7	4	7	17	45
Total	9	26	29	29	304	1,120	1,517

While the third-party audit provision should have a fairly low impact on small businesses, the SBAR Panel made additional recommendations to further minimize the impacts of this provision on small businesses, which EPA considered for this final rule. Of the suggested recommendations, EPA revised the provision to require that only a third-party leading the audit team must meet the independence and competency criteria of the rule, and also by allowing that a retired employee of the source can participate in the audit. EPA also did not finalize the competency criterion that required a PE to participate in the audit.

b. Incident Investigation/Root Cause Analysis (§§ 68.60 and 68.81)

In the final rule, EPA is requiring a root cause investigation for any P2 or P3 reportable accident or near miss. Although the Agency chose the higher cost option, this provision is estimated to be one of the least costly provisions of the final rule. In fact, the costs for both options considered were nearly indistinguishable—as indicated in Exhibit 5-18 of the RIA, both the low and preferred options are estimated to cost approximately $1.8 million annually. Therefore, EPA believes that the additional safety benefit of requiring owners and operators of Program 2 processes to also conduct root cause analyses after incidents and near misses is warranted. Of the suggested SBAR recommendations, EPA clarified that near miss investigations are not intended to cover minor accidents or minor near misses that could not reasonably have resulted in a catastrophic release. EPA also chose not to finalize the proposed definition of “catastrophic release,” which some SERs had indicated could increase the number of investigations required.

c. STAA (§ 68.67)

For STAA, EPA is finalizing the least costly option. The final rule, which applies the STAA requirement to P3 processes in NAICS 322 (paper manufacturing), 324 (petroleum and coal products manufacturing), and 325 (chemical manufacturing), costs $80.0 million annually and is approximately $40 million less costly than the medium option ($120.4 million annually), which would have applied the requirement to all P3 processes, and likely far less costly than the high option, which would require implementation of practicable safer alternatives for all P3 processes. Although the SBAR panel provided recommendations, EPA finalized this provision as proposed, and estimates that it will affect relatively few small businesses given the narrow focus of the provision's applicability.

d. Emergency Response Program Coordination With Local Responders (§§ 68.90, 68.93, and 68.95)

The final rule requires all facilities with P2 or P3 processes to coordinate with local response agencies annually and document coordination activities. This provision does not have alternatives, but the SBAR panel did provide recommendations on streamlining the provision. In response to these and other recommendations, EPA modified the extent of required coordination, removed the requirement for the outcome of coordination to dictate whether a source must implement an emergency response program, and eliminated the ability for LEPCs to mandate sources' response capabilities.

e. Facility Exercises (§ 68.96)

Notification Exercises. The final rule requires all facilities with P2 or P3 processes to annually conduct an emergency notification exercise to ensure that their emergency contact list is complete, accurate, and up-to-date. This provision is expected to be one of the least costly rule provisions at $1.4 million annually (only the public meetings provision is estimated to cost less). Therefore, EPA did not consider any alternatives to reduce the impact of this provision on small businesses, nor did the SBAR panel make any such recommendations.

Tabletop and Field Exercises. The final rule requires responding facilities to conduct a full field exercise at least once every ten years and tabletop exercises triennially. As this provision only affects responding facilities, which tend to more often be large facilities (see Exhibit 3-7 in the RIA), EPA has implemented a rule that mitigates the impact on small entities. EPA also considered a low option that would only require triennial tabletop exercises. This option would have saved approximately $8 million annually. EPA did not implement the low option because the Agency believes that periodic field exercises are an important component of a comprehensive emergency response program. In response to SBAR panel recommendations, EPA reduced the required frequency of exercises to minimize the impact of this provision on small businesses.

f. Information Availability (§ 68.210)

Under the final rule requirements, all facilities are required to make certain chemical hazard information available to the public, upon request. The owner or operator must provide an ongoing notification to the public that such information is available as well as instructions on how to request the information. Facilities are also required to hold public meetings within 90 days of any RMP reportable accident. Although EPA has not identified specific alternatives to minimize the impact of the information disclosure provisions on small businesses, the Agency believes that in general, smaller facilities will bear lower costs to comply with these provisions.

In response to the SBAR recommendations, EPA eliminated the proposed provision that would have had required specific information to be disclosed to LEPCs and extended the timeline for public meetings from 30 days to 90 days after an RMP reportable accident. In addition, information to be provided to the public is only required to be disclosed to the public upon request.

7. Small Business Compliance Guides

EPA is preparing a Small Entity Compliance Guide to help small entities comply with this rule. EPA expects that this guide will be made available on the EPA Web site prior to March 15, 2021, when facilities will have to comply with new and revised data elements for the final rule.

D. Unfunded Mandates Reform Act (UMRA)

This action contains a Federal mandate under UMRA, 2 U.S.C. 1531-1538, that may result in expenditures of $100 million or more for state, local, and tribal governments, in the aggregate, or the private sector in any one year. Accordingly, the EPA has prepared a written statement required under section 202 of UMRA. The statement is included in the docket for this action and briefly summarized here.

Over the 16 years of implementing the RMP program and, most recently through Executive Order 13650 listening sessions, webinars, consultations, and a public hearing, EPA has engaged states and local communities to discuss chemical safety issues. In the nine Executive Order 13650 Improving Chemical Facility Safety and Security listening sessions and webinars, held between November 2013 and January 2014, states and local communities identified lack of chemical facility participation and coordination in local emergency contingency planning as a key barrier to successful local community preparedness. Additionally, EPA has had consultations with states and local communities through participation in the National Association of SARA Title III Program Officials (NASTTPO) annual meetings to discuss key issues related to chemical facility and local community coordination and what areas of the RMP regulations need to be modernized to facilitate this coordination and improve local emergency preparedness and prevention. Key priority options discussed with NASTTPO states and local communities included: improving emergency response coordination between RMP facilities and LEPCs/first responder and requiring emergency response exercises of the RMP facility plan to involve LEPCs, first responders and emergency response personnel.

This action may significantly or uniquely affect small governments. The EPA consulted with small governments concerning the regulatory requirements that might significantly or uniquely affect them. Through the July 31, 2014, RFI (79 FR 44604), EPA sought feedback from governmental entities while formulating the proposed revisions in this action. Additionally, EPA participated in ongoing consultations with affected SERs (including small governmental entities) through the SBAR panel. EPA convened an SBAR panel in accordance with the requirements of the RFA, as amended by the Small Business Regulatory Enforcement Fairness Act (SBREFA). Finally, EPA hosted a public hearing on March 29, 2016 to provide interested parties the opportunity to present data, views or arguments concerning the rule.

Discussion of comments. EPA received comments concerning unfunded mandates. Several commenters, including state agencies and a professional organization, said that the proposed rulemaking adds to the unfunded mandate for LEPCs, which were never provided with any source of Federal funding. A few state agencies said that the proposed field exercises in particular will be a significant unfunded cost for LEPCs that choose to participate. A state agency, an industry trade association, and an association of government agencies commented that these additional costs will adversely affect smaller RMP facilities and smaller communities with municipal-owned RMP facilities. The industry trade association also suggested that EPA should consult with these municipal governments on the impact these proposed requirements will have on their operating budgets. A professional organization stated that very few LEPCs are able to support themselves with fees or other taxes on regulated facilities.

EPA disagrees that this final rule adds to the burden to LEPCs and local emergency response organizations. EPA believes that the amendments to the local coordination requirements clarifies existing requirements. LEPCs are required to develop community emergency response plans and the revisions to the RMP rule are intended to ensure that facility representatives coordinate with LEPC and local emergency response officials in developing those plans. Furthermore, EPA provided flexibility in the final rule to allow LEPC and local emergency response officials to participate as their schedules allow. LEPC and local emergency response officials are encouraged, but not required, to participate in facility exercises.

EPA agrees that the final rule will bear costs for small facilities and small governments; however, EPA has built flexibility into the rule provisions to allow facility owners and operators to tailor their risk management programs to their facility specific circumstances. Third-party compliance audits, and public meetings apply only following an RMP reportable accident, root cause analysis applies only after a catastrophic release (e.g. an RMP-reportable accident) or after an incident that could reasonably have resulted in a catastrophic release. STAA analyses are limited to specific NAICS codes, and exercises apply only to responding facilities. EPA has further revised information availability requirement to be provided only upon request by a member of the public. These provisions should minimize costs of the final rule for small facilities.

E. Executive Order 13132: Federalism

This action does not have Federalism implications. The EPA believes, however, that these regulatory revisions may be of significant interest to local governments. Consistent with the EPA's policy to promote communications between the EPA and state and local governments, and to better understand the concerns of local governments, EPA sought feedback through the July 31, 2014, RFI (79 FR 44604), through the SBREFA process, and a public hearing on March 29, 2016. EPA also hosted a conference call with governmental entities on May 4, 2016. A copy of the presentation and notes from the meeting are available in the docket for this action.^[127]

EPA received comments pertaining to Federalism implications for this action. An industry trade association asserted that EPA's proposal to allow local authorities to request that the owner or operator assume emergency response obligations, which the commenter argues divorces these organizations from their Federal, state, and/or local legal obligations, raises Federalism issues by undermining the fundamental mission of those entities and state delegations of more (or less) authority to local emergency response organizations. Similarly, other industry trade associations commented that EPA's proposed delegation of authority to LEPCs to designate facilities as responding stationary sources raises significant separation of powers and federalism concerns. As the basis for this argument, the commenters relied primarily on the Supreme Court decisions in Printz v. United States (521 U.S. 898 (1997)) and New York v. United States (505 U.S. 144 (1992)), in which the court held that Federal agencies cannot “commandeer” local governments to implement Federal regulatory programs.

A few commenters, including an associations of government agencies and an industry trade association, commented that the Agency had missed a valuable opportunity to engage local governments prior to the rule's publication, which the commenter described as counter to EPA's internal “Guidance on Executive Order 13132: Federalism” (Nov. 2008) that specifies that States and local governments must be consulted on rules if they impose substantial compliance costs, preempt state or local laws, and/or have substantial direct effects on state and local governments. Because the commenter does not believe that EPA has adequately engaged local government agencies, an association of government agencies requested that EPA delay advancing the proposed rulemaking and perform a local government impact analysis and consultation with the nation's cities, counties, and mayors before finalizing the rule.

EPA is finalizing requirements for the stationary source owner or operator to coordinate annually with local emergency planning and response officials to ensure that the stationary source is included in the community emergency response plan (for toxic substances) and/or to coordinate response activities with local emergency responders (for flammable substances). However, after considering concerns raised by commenters related to providing LEPCs with the authority to require a stationary source to develop an emergency response program in accordance with § 68.95, EPA has eliminated this provision from the final rule. EPA did not intend this provision to undermine the fundamental mission of response agencies nor as a delegation of Federal authority. EPA expects that some stationary source owners or operators will self-identify a need to develop an emergency response program if the result of local coordination indicates that the stationary source is not included in the community emergency response plan (e.g., when an LEPC is inactive and there is no community emergency response plan or the existing plan is outdated).

EPA disagrees with comments that suggest that EPA did not engage local governments prior to the rule's publication. EPA followed the agency's internal guidance on Executive Order 13132 when determining whether to initiate consultation with state and local governments. Furthermore, through Executive Order 13650 listening sessions, webinars, consultations, and a public hearing, EPA has engaged states and local communities to discuss chemical safety issues. Additionally, EPA has consulted with states and local communities through participation in the NASTTPO annual meetings to discuss key issues related to chemical facility and local community coordination and what areas of the RMP regulations need to be modernized to facilitate this coordination and improve local emergency preparedness and prevention.

F. Executive Order 13175: Consultation and Coordination With Indian Tribal Governments

This action has tribal implications. However, it will neither impose substantial direct compliance costs on federally recognized tribal governments, nor preempt tribal law. There are approximately 260 RMP facilities located on tribal lands. Tribes could be impacted by the final rule either as an owner or operator of an RMP-regulated facility or as a Tribal government when the Tribal government conducts emergency response or emergency preparedness activities under EPCRA.

The EPA consulted with tribal officials under the EPA Policy on Consultation and Coordination with Indian Tribes early in the process of developing this regulation to permit them to have meaningful and timely input into its development. EPA hosted a public hearing on March 29, 2016 that was open to all interested parties and hosted a total of two conference calls for interested tribal representatives on April 20, 2016 and April 26, 2016. A summary of each conference call is available in the docket for this action.^[128] EPA did not receive any written comments from tribal representatives.

As required by section 7(a), the EPA's Tribal Consultation Official has certified that the requirements of the executive order have been met in a meaningful and timely manner. A copy of the certification is included in the docket for this action.

G. Executive Order 13045: Protection of Children From Environmental Health Risks and Safety Risks

This action is not subject to Executive Order 13045 because the EPA does not believe the environmental health risks or safety risks addressed by this action present a disproportionate risk to children. The EPA believes that the proposed revisions to the Risk Management Program regulations would further protect human health, including the health of children, through advancement of process safety. EPA did not receive any comments associated with this issue.

H. Executive Order 13211: Actions That Significantly Affect Energy Supply, Distribution or Use

This action is not a “significant energy action” because it is not likely to have a significant adverse effect on the supply, distribution, or use of energy. This action is not anticipated to have notable impacts on emissions, costs or energy supply decisions for the affected electric utility industry. EPA did not receive any comments associated with this issue.

I. National Technology Transfer and Advancement Act (NTTAA)

This action involves technical standards. The EPA is requiring third-party auditors to be experienced with applicable RAGAGEP, which include Voluntary Consensus Standards as well as other measures, for regulated processes being audited. Numerous different standards apply to processes regulated under the final rule and their application will vary depending on the particular process and chemicals involved. EPA is not listing all the various codes, standards and practices that would apply to the wide variety of chemical processes covered by this rule as doing so would be impracticable, given that this rule affects sectors across many industries and listing the applicable RAGAGEP measures would require the EPA to update that list every time there was a change in the industry standards or best practices. The final rule requires third-party auditors to be familiar with standards applicable to processes they audit, and to obtain their own copies of applicable standards where needed. Auditors must be knowledgeable of applicable consensus standards because the accident prevention program provisions of the existing rule (subparts C and D) require owners or operators to comply with RAGAGEP. Therefore, auditors must be knowledgeable of those practices in order to perform an effective audit. EPA did not receive any comments associated with this issue.

J. Executive Order 12898: Federal Actions To Address Environmental Justice in Minority Populations and Low-Income Populations

The EPA believes the human health or environmental risk addressed by this action will not have potential disproportionately high and adverse human health or environmental effects on minority, low income, or indigenous populations. The results of this evaluation are included in the RIA, located in the docket. EPA received multiple comments relating to environmental justice concerns.

Discussion of comments on access to information. Several groups stated that communities need better transparency and access to information on hazards and investigations, training on response plans, and access to inspection and incident reports. A few advocacy groups commented that the rule should include specific elements to address disproportionate impacts. A few advocacy groups said that EPA should create a centralized database available through a Web site and local community centers and libraries that provides this information. A facility commented that a Web site is a poor method to communicate information to individuals in poor or rural communities that may not have access to computers or the Internet. The commenter also said that LEPCs already hold public meetings to discuss emergency plans.

A couple advocacy groups stated that the RMP rule fails to ensure that at-risk communities near RMP facilities have the information they need to participate effectively in engagement with facilities. The groups also argued that the rule does not improve access to summaries of incident investigation reports, safety audits, and STAA, among other things, which are essential to ensuring fair treatment. Further, the groups commented that at-risk communities are not given access to information on prevention opportunities, and are not invited to participate in prevention analysis and planning. Another advocacy group said that the RMP rule should facilitate partnerships and interactions between facilities, local governments, and the community. A different group said that EPA should require a community meeting within 30 days of an incident, require publication of response and evacuation plans for affected areas, and establish an appeals process for communities to report when information and engagement opportunities are not provided as required, among other proposals.

EPA agrees with commenters that have requested better access to chemical hazard information at facilities in their communities and improved public transparency. EPA is finalizing a requirement for facility owners and operators to share information with the public that will assist neighboring communities to understand the hazards in their communities. Facility owners and operators must notify the public that specific information is available and provide instructions on how to request that information as well as how to access evacuation and shelter-in-place procedures for the community. Additionally, following an RMP reportable accident, facility owner and operators are required to host a public meeting within 90 days to communicate information about the accident. This allows sufficient time for facilities to gather information about the incident to share with the public. EPA believes that these provisions provides the public with more information that they can use to protect themselves and their families in the event of an accidental release at an RMP-regulated facility.

EPA has included other elements in the final rule that are intended to address disproportionate impacts of a release to surrounding communities. For example, EPA is requiring paper manufacturing, petroleum and coal products manufacturing, and chemical manufacturing facilities with Program 3 processes to analyze safer technologies for each process in order to consider ways to reduce and remove hazards. EPA is also encouraging better coordination between local emergency response organizations and facility representatives annually and during facility exercises which will lead to more effective community emergency response plans and mitigate the impacts of an accidental release to the surrounding community. EPA encourages facility representatives to attend LEPC meetings along with the public to facilitate partnerships among these representatives.

EPA disagrees with commenters that suggest creating a centralized database available through a Web site and local community centers and libraries to provide this information. Establishing such a centralized database would be costly, difficult to maintain, information would quickly become outdated, and a centralized database could create security vulnerabilities. See section VI.B of this preamble for more information on information availability to the public.

EPA recognizes that some community residents want to participate in prevention planning and have access to incident investigation reports, safety audits, and STAA. However, community input can be effective in other ways that relate to community planning. EPA encourages community residents to become active in their LEPCs who are already working to reduce hazards for local communities. Providing access to facility reports outside of existing community planning activities could result in duplicative work and increased burden for communities, emergency responders, and facility staff.

Furthermore, developing a risk management program involves process hazards analyses and hierarchies of controls developed by trained professionals. Investigation reports, safety audits and STAA are often complicated and contain technical jargon, which can be difficult to understand without the proper training. Information in these reports can also reveal security vulnerabilities which may put communities in greater danger of terrorism if released.

Discussion of comments on meaningful involvement. A few commenters, including advocacy groups, said that the only meaningful involvement EPA has facilitated included collecting input to shape the proposed rulemaking. The commenters said that there is no analysis in the rule on whether or how the rule would facilitate meaningful involvement by at-risk or environmental justice (EJ) communities.

EPA believes there were numerous opportunities for the public to provide meaningful input on this final rule. This final rule was developed following extensive public feedback through Executive Order 13650 listening sessions, public comments on the RFI and the proposed rulemaking, and the public hearing held on March 29, 2016. EPA has incorporated requirements in the final rule to prevent accidental releases, mitigate the impacts of releases that do occur, and share chemical hazard information with the public.

K. Congressional Review Act (CRA)

This action is subject to the CRA, and the EPA will submit a rule report to each House of the Congress and to the Comptroller General of the United States. This action is a “major rule” as defined by 5 U.S.C. 804(2).

List of Subjects in 40 CFR Part 68

• Environmental protection
• Administrative practice and procedure
• Air pollution control
• Chemicals
• Hazardous substances
• Intergovernmental relations
• Reporting and recordkeeping requirements

Dated: December 21, 2016.

Gina McCarthy,

Administrator.

For the reasons set out in the preamble, title 40, chapter I, part 68, of the Code of Federal Regulations is amended as follows:

PART 68—CHEMICAL ACCIDENT PREVENTION PROVISIONS

1. The authority citation for part 68 continues to read as follows:

Authority: 42 U.S.C. 7412(r), 7601(a)(1), 7661-7661f.

2. Amend § 68.3 by adding in alphabetical order the definitions “Active measures”, “CBI”, “Inherently safer technology or design”, “LEPC”, “Passive measures”, “Practicability”, “Procedural measures”, “Root cause”, and “Third-party audit” to read as follows:

§ 68.3

Definitions.

* * * * *

Active measures mean risk management measures or engineering controls that rely on mechanical, or other energy input to detect and respond to process deviations. Examples of active measures include alarms, safety instrumented systems, and detection hardware (such as hydrocarbon sensors).

* * * * *

CBI means confidential business information.

* * * * *

Inherently safer technology or design means risk management measures that minimize the use of regulated substances, substitute less hazardous substances, moderate the use of regulated substances, or simplify covered processes in order to make accidental releases less likely, or the impacts of such releases less severe.

* * * * *

LEPC means local emergency planning committee as established under 42 U.S.C. 11001(c).

* * * * *

Passive measures mean risk management measures that use design features that reduce either the frequency or consequence of the hazard without human, mechanical, or other energy input. Examples of passive measures include pressure vessel designs, dikes, berms, and blast walls.

* * * * *

Practicability means the capability of being successfully accomplished within a reasonable time, accounting for economic, environmental, legal, social, and technological factors. Environmental factors would include consideration of potential transferred risks for new risk reduction measures.

Procedural measures mean risk management measures such as policies, operating procedures, training, administrative controls, and emergency response actions to prevent or minimize incidents.

* * * * *

Root cause means a fundamental, underlying, system-related reason why an incident occurred.

* * * * *

Third-party audit means a compliance audit conducted pursuant to the requirements of § 68.59 and/or § 68.80, performed or led by an entity (individual or firm) meeting the competency and independence described in § 68.59(c) or § 68.80(c).

* * * * *

3. Amend § 68.10 by:

a. Revising paragraph (a);

b. Redesignating paragraphs (b) through (f) as paragraphs (f) through (j);

c. Adding new paragraphs (b) through (e); and

d. Revising the newly designated paragraph (f)(2).

The revisions and additions read as follow:

§ 68.10

Applicability.

(a) Except as provided in paragraphs (b) through (e) of this section, an owner or operator of a stationary source that has more than a threshold quantity of a regulated substance in a process, as determined under § 68.115, shall comply with the requirements of this part no later than the latest of the following dates:

(1) June 21, 1999;

(2) Three years after the date on which a regulated substance is first listed under § 68.130;

(3) The date on which a regulated substance is first present above a threshold quantity in a process; or

(4) For any revisions to this part, the effective date of the final rule that revises this part.

(b) By March 14, 2018 the owner or operator of a stationary source shall comply with the emergency response coordination activities in § 68.93.

(c) Within three years of when the owner or operator determines that the stationary source is subject to the emergency response program requirements of § 68.95, pursuant to § 68.90(a), the owner or operator must develop and implement an emergency response program in accordance with § 68.95.

(d) By March 15, 2021, the owner or operator shall comply with the following provisions promulgated on January 13, 2017:

(1) Third-party audit provisions in §§ 68.58(f), 68.58(g), 68.58(h), 68.59, 68.79(f), 68.79(g), 68.79(h), and 68.80;

(2) Incident investigation root cause analysis provisions in §§ 68.60(d)(7) and 68.81(d)(7);

(3) Safer technology and alternatives analysis provisions in § 68.67(c)(8);

(4) Emergency response exercise provisions of § 68.96, and;

(5) Availability of information provisions in § 68.210(b) through (e).

(e) By March 14, 2022, the owner or operator shall comply with the risk management plan provisions of subpart G of this part promulgated on January 13, 2017.

(f) * * *

(2) The distance to a toxic or flammable endpoint for a worst-case release assessment conducted under subpart B and § 68.25 is less than the distance to any public receptor, as defined in § 68.3; and

* * * * *

4. Amend § 68.12 by:

a. Revising paragraphs (c)(4) and (5), and adding paragraph (c)(6); and

b. Revising paragraphs (d)(4) and (5), and adding paragraph (d)(6).

The revisions and additions read as follows:

§ 68.12

General requirements.

* * * * *

(c) * * *

(4) Coordinate response actions with local emergency planning and response agencies as provided in § 68.93;

(5) Develop and implement an emergency response program, and conduct exercises, as provided in §§ 68.90 to 68.96; and

(6) Submit as part of the RMP the data on prevention program elements for Program 2 processes as provided in § 68.170.

(d) * * *

(4) Coordinate response actions with local emergency planning and response agencies as provided in § 68.93;

(5) Develop and implement an emergency response program, and conduct exercises, as provided in §§ 68.90 to 68.96; and

(6) Submit as part of the RMP the data on prevention program elements for Program 3 processes as provided in § 68.175.

5. Amend § 68.48 by revising paragraph (a)(1) to read as follows:

§ 68.48

Safety information.

(a) * * *

(1) Safety Data Sheets (SDS) that meet the requirements of 29 CFR 1910.1200(g);

* * * * *

6. Amend § 68.50 by revising paragraph (a)(2) to read as follows:

§ 68.50

Hazard review.

(a) * * *

(2) Opportunities for equipment malfunctions or human errors that could cause an accidental release, including findings from incident investigations;

* * * * *

7. Amend § 68.54 by revising paragraphs (a), (b), and (d); and adding paragraph (e) to read as follows:

§ 68.54

Training.

(a) The owner or operator shall ensure that each employee presently involved in operating a process, and each employee newly assigned to a covered process have been trained or tested competent in the operating procedures provided in § 68.52 that pertain to their duties. For those employees already operating a process on June 21, 1999, the owner or operator may certify in writing that the employee has the required knowledge, skills, and abilities to safely carry out the duties and responsibilities as provided in the operating procedures.

(b) Refresher training. Refresher training shall be provided at least every three years, and more often if necessary, to each employee involved in operating a process to ensure that the employee understands and adheres to the current operating procedures of the process. The owner or operator, in consultation with the employees operating the process, shall determine the appropriate frequency of refresher training.

* * * * *

(d) The owner or operator shall ensure that employees involved in operating a process are trained in any updated or new procedures prior to startup of a process after a major change.

(e) For the purposes of this section, the term employee also includes supervisors responsible for directing process operations.

8. Amend § 68.58 by revising paragraph (a) and adding paragraphs (f) through (h) to read as follows:

§ 68.58

Compliance audits.

(a) The owner or operator shall certify that they have evaluated compliance with the provisions of this subpart for each covered process, at least every three years to verify that the procedures and practices developed under the rule are adequate and are being followed. When required as set forth in paragraph (f) of this section, the compliance audit shall be a third-party audit.

* * * * *

(f) Third-party audit applicability. The next required compliance audit shall be a third-party audit when one of the following conditions apply:

(1) An accidental release meeting the criteria in § 68.42(a) from a covered process at a stationary source has occurred; or

(2) An implementing agency requires a third-party audit due to conditions at the stationary source that could lead to an accidental release of a regulated substance, or when a previous third-party audit failed to meet the competency or independence criteria of § 68.59(c).

(g) Implementing agency notification and appeals. (1) If an implementing agency makes a preliminary determination that a third-party audit is necessary pursuant to paragraph (f)(2) of this section, the implementing agency will provide written notice to the owner or operator that describes the basis for this determination.

(2) Within 30 days of receipt of such written notice, the owner or operator may provide information and data to, and may consult with, the implementing agency on the determination. Thereafter, the implementing agency will provide a final determination to the owner or operator.

(3) If the final determination requires a third-party audit, the owner or operator shall comply with the requirements of § 68.59, pursuant to the schedule in paragraph (h) of this section.

(4) Appeals. The owner or operator may appeal a final determination made by an implementing agency under paragraph (g)(2) of this section within 30 days of receipt of the final determination. The appeal shall be made to the EPA Regional Administrator, or for determinations made by other implementing agencies, the administrator or director of such implementing agency. The appeal shall contain a clear and concise statement of the issues, facts in the case, and any relevant additional information. In reviewing the appeal, the implementing agency may request additional information from the owner or operator. The implementing agency will provide a written, final decision on the appeal to the owner or operator.

(h) Schedule for conducting a third-party audit. The audit and audit report shall be completed as follows, unless a different timeframe is specified by the implementing agency:

(1) For third-party audits required pursuant to paragraph (f)(1) of this section, within 12 months of the release; or

(2) For third-party audits required pursuant to paragraph (f)(2) of this section, within 12 months of the date of the final determination pursuant to paragraph (g)(3) of this section. However, if the final determination is appealed pursuant to paragraph (g)(4) of this section, within 12 months of the date of the final decision on the appeal.

9. Section 68.59 is added to subpart C to read as follows:

§ 68.59

Third-party audits.

(a) Applicability. The owner or operator shall engage a third-party to conduct an audit that evaluates compliance with the provisions of this subpart in accordance with the requirements of this section when either criterion of § 68.58(f) is met.

(b) Third-party auditors and auditing teams. The owner or operator shall either:

(1) Engage a third-party auditor meeting all of the competency and independence criteria in paragraph (c) of this section; or

(2) Assemble an auditing team, led by a third-party auditor meeting all of the competency and independence criteria in paragraph (c) of this section. The team may include:

(i) Other employees of the third-party auditor firm meeting the independence criteria of paragraph (c)(2) of this section; and

(ii) Other personnel not employed by the third-party auditor firm, including facility personnel.

(c) Third-party auditor qualifications. The owner or operator shall determine and document that the third-party auditor(s) meet the following competency and independence requirements:

(1) Competency requirements. The third-party auditor(s) shall be:

(i) Knowledgeable with the requirements of this part;

(ii) Experienced with the stationary source type and processes being audited and applicable recognized and generally accepted good engineering practices; and

(iii) Trained and/or certified in proper auditing techniques.

(2) Independence requirements. The third-party auditor(s) shall:

(i) Act impartially when performing all activities under this section;

(ii) Receive no financial benefit from the outcome of the audit, apart from payment for auditing services. For purposes of this paragraph, retired employees who otherwise satisfy the third-party auditor independence criteria in this section may qualify as independent if their sole continuing financial attachments to the owner or operator are employer-financed or managed retirement and/or health plans;

(iii) Not have conducted past research, development, design, construction services, or consulting for the owner or operator within the last two years. For purposes of this requirement, consulting does not include performing or participating in third-party audits pursuant to § 68.59 or § 68.80. An audit firm with personnel who, before working for the auditor, conducted research, development, design, construction, or consulting services for the owner or operator within the last two years as an employee or contractor may meet the requirements of this subsection by ensuring such personnel do not participate in the audit, or manage or advise the audit team concerning the audit;

(iv) Not provide other business or consulting services to the owner or operator, including advice or assistance to implement the findings or recommendations in an audit report, for a period of at least two years following submission of the final audit report;

(v) Ensure that all third-party personnel involved in the audit sign and date a conflict of interest statement documenting that they meet the independence criteria of this paragraph; and

(vi) Ensure that all third-party personnel involved in the audit do not accept future employment with the owner or operator of the stationary source for a period of at least two years following submission of the final audit report. For purposes of this requirement, employment does not include performing or participating in third-party audits pursuant to § 68.59 or § 68.80.

(3) The auditor shall have written policies and procedures to ensure that all personnel comply with the competency and independence requirements of this section.

(d) Third-party auditor responsibilities. The owner or operator shall ensure that the third-party auditor:

(1) Manages the audit and participates in audit initiation, design, implementation, and reporting;

(2) Determines appropriate roles and responsibilities for the audit team members based on the qualifications of each team member;

(3) Prepares the audit report and where there is a team, documents the full audit team's views in the final audit report;

(4) Certifies the final audit report and its contents as meeting the requirements of this section; and

(5) Provides a copy of the audit report to the owner or operator.

(e) Audit report. The audit report shall:

(1) Identify all persons participating on the audit team, including names, titles, employers and/or affiliations, and summaries of qualifications. For third-party auditors, include information demonstrating that the competency requirements in paragraph (c)(1) of this section are met;

(2) Describe or incorporate by reference the policies and procedures required under paragraph (c)(3) of this section;

(3) Document the auditor's evaluation, for each covered process, of the owner or operator's compliance with the provisions of this subpart to determine whether the procedures and practices developed by the owner or operator under this rule are adequate and being followed;

(4) Document the findings of the audit, including any identified compliance or performance deficiencies;

(5) Summarize any significant revisions (if any) between draft and final versions of the report; and

(6) Include the following certification, signed and dated by the third-party auditor or third-party audit team member leading the audit:

I certify that this RMP compliance audit report was prepared under my direction or supervision in accordance with a system designed to assure that qualified personnel properly gather and evaluate the information upon which the audit is based. I further certify that the audit was conducted and this report was prepared pursuant to the requirements of subpart C of 40 CFR part 68 and all other applicable auditing, competency, independence, impartiality, and conflict of interest standards and protocols. Based on my personal knowledge and experience, and inquiry of personnel involved in the audit, the information submitted herein is true, accurate, and complete.

(f) Third-party audit findings— (1) Findings response report. As soon as possible, but no later than 90 days after receiving the final audit report, the owner or operator shall determine an appropriate response to each of the findings in the audit report, and develop a findings response report that includes:

(i) A copy of the final audit report;

(ii) An appropriate response to each of the audit report findings;

(iii) A schedule for promptly addressing deficiencies; and

(iv) A certification, signed and dated by a senior corporate officer, or an official in an equivalent position, of the owner or operator of the stationary source, stating:

I certify under penalty of law that I have engaged a third-party to perform or lead an audit team to conduct a third-party audit in accordance with the requirements of 40 CFR 68.59 and that the attached RMP compliance audit report was received, reviewed, and responded to under my direction or supervision by qualified personnel. I further certify that appropriate responses to the findings have been identified and deficiencies were corrected, or are being corrected, consistent with the requirements of subpart C of 40 CFR part 68, as documented herein. Based on my personal knowledge and experience, or inquiry of personnel involved in evaluating the report findings and determining appropriate responses to the findings, the information submitted herein is true, accurate, and complete. I am aware that there are significant penalties for making false material statements, representations, or certifications, including the possibility of fines and imprisonment for knowing violations.

(2) Schedule implementation. The owner or operator shall implement the schedule to address deficiencies identified in the audit findings response report in paragraph (f)(1)(iii) of this section and document the action taken to address each deficiency, along with the date completed.

(3) Submission to Board of Directors. The owner or operator shall immediately provide a copy of each document required under paragraphs (f)(1) and (2) of this section, when completed, to the owner or operator's audit committee of the Board of Directors, or other comparable committee or individual, if applicable.

(g) Recordkeeping. The owner or operator shall retain at the stationary source, the two most recent final third-party audit reports, related findings response reports, documentation of actions taken to address deficiencies, and related records. This requirement does not apply to any document that is more than five years old.

10. Amend § 68.60 by:

a. Revising paragraph (a);

b. Redesignating paragraphs (c) through (f) as paragraphs (d) through (g);

c. Adding a new paragraph (c); and

d. Revising the newly designated paragraphs (d) and (g).

The revisions and additions read as follows:

§ 68.60

Incident investigation.

(a) The owner or operator shall investigate each incident that:

(1) Resulted in a catastrophic release (including when the affected process is decommissioned or destroyed following, or as the result of, an incident); or

(2) Could reasonably have resulted in a catastrophic release (i.e., was a near miss).

* * * * *

(c) An incident investigation team shall be established and consist of at least one person knowledgeable in the process involved and other persons with appropriate knowledge and experience to thoroughly investigate and analyze the incident.

(d) A report shall be prepared at the conclusion of the investigation. The report shall be completed within 12 months of the incident, unless the implementing agency approves, in writing, an extension of time. The report shall include:

(1) Date, time, and location of incident;

(2) Date investigation began;

(3) A description of the incident, in chronological order, providing all relevant facts;

(4) The name and amount of the regulated substance involved in the release (e.g., fire, explosion, toxic gas loss of containment) or near miss and the duration of the event;

(5) The consequences, if any, of the incident including, but not limited to: injuries, fatalities, the number of people evacuated, the number of people sheltered in place, and the impact on the environment;

(6) Emergency response actions taken;

(7) The factors that contributed to the incident including the initiating event, direct and indirect contributing factors, and root causes. Root causes shall be determined by conducting an analysis for each incident using a recognized method; and

(8) Any recommendations resulting from the investigation and a schedule for addressing them.

* * * * *

(g) Incident investigation reports shall be retained for five years.

11. Amend § 68.65 by revising the first sentence of paragraph (a) and the note to paragraph (b) to read as follows:

§ 68.65

Process safety information.

(a) The owner or operator shall complete a compilation of written process safety information before conducting any process hazard analysis required by the rule, and shall keep process safety information up-to-date. * * *

(b) * * *

Note to paragraph (b):

Safety Data Sheets (SDS) meeting the requirements of 29 CFR 1910.1200(g) may be used to comply with this requirement to the extent they contain the information required by paragraph (b) of this section.

* * * * *

12. Amend § 68.67 by:

a. Revising paragraph (c)(2);

b. Amending paragraph (c)(6) by removing the word “and;”

c. Amending paragraph (c)(7) by removing the period at the end of the paragraph and adding “; and” in its place; and

d. Adding paragraph (c)(8).

The revisions and additions read as follows:

§ 68.67

Process hazard analysis.

* * * * *

(c) * * *

(2) The findings from all incident investigations required under § 68.81, as well as any other potential failure scenarios;

* * * * *

(8) For processes in NAICS 322, 324, and 325, safer technology and alternative risk management measures applicable to eliminating or reducing risk from process hazards.

(i) The owner or operator shall consider, in the following order of preference inherently safer technology or design, passive measures, active measures, and procedural measures. A combination of risk management measures may be used to achieve the desired risk reduction.

(ii) The owner or operator shall determine the practicability of the inherently safer technologies and designs considered.

* * * * *

13. Amend § 68.71 by adding paragraph (d) to read as follows:

§ 68.71

Training.

* * * * *

(d) For the purposes of this section, the term employee also includes supervisors with process operational responsibilities.

14. Amend § 68.79 by revising paragraph (a) and adding paragraphs (f) through (h) to read as follows:

§ 68.79

Compliance audits.

(a) The owner or operator shall certify that they have evaluated compliance with the provisions of this subpart for each covered process, at least every three years to verify that the procedures and practices developed under the rule are adequate and are being followed. When required as set forth in paragraph (f) of this section, the compliance audit shall be a third-party audit.

* * * * *

(f) Third-party audit applicability. The next required compliance audit shall be a third-party audit when one of the following conditions apply:

(1) An accidental release meeting the criteria in § 68.42(a) from a covered process at a stationary source has occurred; or

(2) An implementing agency requires a third-party audit due to conditions at the stationary source that could lead to an accidental release of a regulated substance, or when a previous third-party audit failed to meet the competency or independence criteria of § 68.80(c).

(g) Implementing agency notification and appeals. (1) If an implementing agency makes a preliminary determination that a third-party audit is necessary pursuant to paragraph (f)(2) of this section, the implementing agency will provide written notice to the owner or operator that describes the basis for this determination.

(2) Within 30 days of receipt of such written notice, the owner or operator may provide information and data to, and may consult with, the implementing agency on the determination. Thereafter, the implementing agency will provide a final determination to the owner or operator.

(3) If the final determination requires a third-party audit, the owner or operator shall comply with the requirements of § 68.80, pursuant to the schedule in paragraph (h) of this section.

(4) Appeals. The owner or operator may appeal a final determination made by an implementing agency under paragraph (g)(2) of this section within 30 days of receipt of the final determination. The appeal shall be made to the EPA Regional Administrator, or for determinations made by other implementing agencies, the administrator or director of such implementing agency. The appeal shall contain a clear and concise statement of the issues, facts in the case, and any relevant additional information. In reviewing the appeal, the implementing agency may request additional information from the owner or operator. The implementing agency will provide a written, final decision on the appeal to the owner or operator.

(h) Schedule for conducting a third-party audit. The audit and audit report shall be completed as follows, unless a different timeframe is specified by the implementing agency:

(1) For third-party audits required pursuant to paragraph (f)(1) of this section, within 12 months of the release; or

(2) For third-party audits required pursuant to paragraph (f)(2) of this section, within 12 months of the date of the final determination pursuant to paragraph (g)(3) of this section. However, if the final determination is appealed pursuant to paragraph (g)(4) of this section, within 12 months of the date of the final decision on the appeal.

15. Section 68.80 is added to subpart D to read as follows:

§ 68.80

Third-party audits.

(a) Applicability. The owner or operator shall engage a third-party to conduct an audit that evaluates compliance with the provisions of this subpart in accordance with the requirements of this section when either criterion of § 68.79(f) is met.

(b) Third-party auditors and auditing teams. The owner or operator shall either:

(1) Engage a third-party auditor meeting all of the competency and independence criteria in paragraph (c) of this section; or

(2) Assemble an auditing team, led by a third-party auditor meeting all of the competency and independence criteria in paragraph (c) of this section. The team may include:

(i) Other employees of the third-party auditor firm meeting the independence criteria of paragraph (c)(2) of this section; and

(ii) Other personnel not employed by the third-party auditor firm, including facility personnel.

(c) Third-party auditor qualifications. The owner or operator shall determine and document that the third-party auditor(s) meet the following competency and independence requirements:

(1) Competency requirements. The third-party auditor(s) shall be:

(i) Knowledgeable with the requirements of this part;

(ii) Experienced with the stationary source type and processes being audited and applicable recognized and generally accepted good engineering practices; and

(iii) Trained or certified in proper auditing techniques.

(2) Independence requirements. The third-party auditor(s) shall:

(i) Act impartially when performing all activities under this section;

(ii) Receive no financial benefit from the outcome of the audit, apart from payment for auditing services. For purposes of this paragraph, retired employees who otherwise satisfy the third-party auditor independence criteria in this section may qualify as independent if their sole continuing financial attachments to the owner or operator are employer-financed or managed retirement and/or health plans;

(iii) Not have conducted past research, development, design, construction services, or consulting for the owner or operator within the last two years. For purposes of this requirement, consulting does not include performing or participating in third-party audits pursuant to § 68.59 or § 68.80. An audit firm with personnel who, before working for the auditor, conducted research, development, design, construction, or consulting services for the owner or operator within the last two years as an employee or contractor may meet the requirements of this subsection by ensuring such personnel do not participate in the audit, or manage or advise the audit team concerning the audit;

(iv) Not provide other business or consulting services to the owner or operator, including advice or assistance to implement the findings or recommendations in an audit report, for a period of at least two years following submission of the final audit report;

(v) Ensure that all third-party personnel involved in the audit sign and date a conflict of interest statement documenting that they meet the independence criteria of this paragraph; and

(vi) Ensure that all third-party personnel involved in the audit do not accept future employment with the owner or operator of the stationary source for a period of at least two years following submission of the final audit report. For purposes of this requirement, employment does not include performing or participating in third-party audits pursuant to § 68.59 or § 68.80.

(3) The auditor shall have written policies and procedures to ensure that all personnel comply with the competency and independence requirements of this section.

(d) Third-party auditor responsibilities. The owner or operator shall ensure that the third-party auditor:

(1) Manages the audit and participates in audit initiation, design, implementation, and reporting;

(2) Determines appropriate roles and responsibilities for the audit team members based on the qualifications of each team member;

(3) Prepares the audit report and where there is a team, documents the full audit team's views in the final audit report;

(4) Certifies the final audit report and its contents as meeting the requirements of this section; and

(5) Provides a copy of the audit report to the owner or operator.

(e) Audit report. The audit report shall:

(1) Identify all persons participating on the audit team, including names, titles, employers and/or affiliations, and summaries of qualifications. For third-party auditors, include information demonstrating that the competency requirements in paragraph (c)(1) of this section are met;

(2) Describe or incorporate by reference the policies and procedures required under paragraph (c)(3) of this section;

(3) Document the auditor's evaluation, for each covered process, of the owner or operator's compliance with the provisions of this subpart to determine whether the procedures and practices developed by the owner or operator under this rule are adequate and being followed;

(4) Document the findings of the audit, including any identified compliance or performance deficiencies;

(5) Summarize any significant revisions (if any) between draft and final versions of the report; and

(6) Include the following certification, signed and dated by the third-party auditor or third-party audit team member leading the audit:

I certify that this RMP compliance audit report was prepared under my direction or supervision in accordance with a system designed to assure that qualified personnel properly gather and evaluate the information upon which the audit is based. I further certify that the audit was conducted and this report was prepared pursuant to the requirements of subpart D of 40 CFR part 68 and all other applicable auditing, competency, independence, impartiality, and conflict of interest standards and protocols. Based on my personal knowledge and experience, and inquiry of personnel involved in the audit, the information submitted herein is true, accurate, and complete.

(f) Third-party audit findings— (1) Findings response report. As soon as possible, but no later than 90 days after receiving the final audit report, the owner or operator shall determine an appropriate response to each of the findings in the audit report, and develop a findings response report that includes:

(i) A copy of the final audit report;

(ii) An appropriate response to each of the audit report findings;

(iii) A schedule for promptly addressing deficiencies; and

(iv) A certification, signed and dated by a senior corporate officer, or an official in an equivalent position, of the owner or operator of the stationary source, stating:

I certify under penalty of law that I have engaged a third-party to perform or lead an audit team to conduct a third-party audit in accordance with the requirements of 40 CFR 68.80 and that the attached RMP compliance audit report was received, reviewed, and responded to under my direction or supervision by qualified personnel. I further certify that appropriate responses to the findings have been identified and deficiencies were corrected, or are being corrected, consistent with the requirements of subpart D of 40 CFR part 68, as documented herein. Based on my personal knowledge and experience, or inquiry of personnel involved in evaluating the report findings and determining appropriate responses to the findings, the information submitted herein is true, accurate, and complete. I am aware that there are significant penalties for making false material statements, representations, or certifications, including the possibility of fines and imprisonment for knowing violations.

(2) Schedule implementation. The owner or operator shall implement the schedule to address deficiencies identified in the audit findings response report in paragraph (f)(1)(iii) of this section and document the action taken to address each deficiency, along with the date completed.

(3) Submission to Board of Directors. The owner or operator shall immediately provide a copy of each document required under paragraphs (f)(1) and (2) of this section, when completed, to the owner or operator's audit committee of the Board of Directors, or other comparable committee or individual, if applicable.

(g) Recordkeeping. The owner or operator shall retain at the stationary source the two most recent final third-party audit reports, related findings response reports, documentation of actions taken to address deficiencies, and related records.

16. Amend § 68.81 by revising paragraphs (a), (d) introductory text, (d)(1), (d)(3) through (5), and adding paragraphs (d)(6) through (8) to read as follows:

§ 68.81

Incident investigation.

(a) The owner or operator shall investigate each incident that:

(1) Resulted in a catastrophic release (including when the affected process is decommissioned or destroyed following, or as the result of, an incident); or

(2) Could reasonably have resulted in a catastrophic release (i.e., was a near miss).

* * * * *

(d) A report shall be prepared at the conclusion of the investigation. The report shall be completed within 12 months of the incident, unless the implementing agency approves, in writing, an extension of time. The report shall include:

(1) Date, time, and location of incident;

* * * * *

(3) A description of the incident, in chronological order, providing all relevant facts;

(4) The name and amount of the regulated substance involved in the release (e.g., fire, explosion, toxic gas loss of containment) or near miss and the duration of the event;

(5) The consequences, if any, of the incident including, but not limited to: injuries, fatalities, the number of people evacuated, the number of people sheltered in place, and the impact on the environment;

(6) Emergency response actions taken;

(7) The factors that contributed to the incident including the initiating event, direct and indirect contributing factors, and root causes. Root causes shall be determined by conducting an analysis for each incident using a recognized method; and

(8) Any recommendations resulting from the investigation and a schedule for addressing them.

* * * * *

17. Revise § 68.90 to read as follows:

§ 68.90

Applicability.

(a) Responding stationary source. Except as provided in paragraph (b) of this section, the owner or operator of a stationary source with Program 2 and Program 3 processes shall comply with the requirements of §§ 68.93, 68.95, and 68.96.

(b) Non-responding stationary source. The owner or operator of a stationary source whose employees will not respond to accidental releases of regulated substances need not comply with § 68.95 of this part provided that:

(1) For stationary sources with any regulated toxic substance held in a process above the threshold quantity, the stationary source is included in the community emergency response plan developed under 42 U.S.C. 11003;

(2) For stationary sources with only regulated flammable substances held in a process above the threshold quantity, the owner or operator has coordinated response actions with the local fire department;

(3) Appropriate mechanisms are in place to notify emergency responders when there is a need for a response;

(4) The owner or operator performs the annual emergency response coordination activities required under § 68.93; and

(5) The owner or operator performs the annual notification exercises required under § 68.96(a).

18. Section 68.93 is added to subpart E to read as follows:

§ 68.93

Emergency response coordination activities.

The owner or operator of a stationary source shall coordinate response needs with local emergency planning and response organizations to determine how the stationary source is addressed in the community emergency response plan and to ensure that local response organizations are aware of the regulated substances at the stationary source, their quantities, the risks presented by covered processes, and the resources and capabilities at the stationary source to respond to an accidental release of a regulated substance.

(a) Coordination shall occur at least annually, and more frequently if necessary, to address changes: At the stationary source; in the stationary source's emergency response and/or emergency action plan; and/or in the community emergency response plan.

(b) Coordination shall include providing to the local emergency planning and response organizations: The stationary source's emergency response plan if one exists; emergency action plan; updated emergency contact information; and any other information that local emergency planning and response organizations identify as relevant to local emergency response planning. For responding stationary sources, coordination shall also include consulting with local emergency response officials to establish appropriate schedules and plans for field and tabletop exercises required under § 68.96(b). The owner or operator shall request an opportunity to meet with the local emergency planning committee (or equivalent) and/or local fire department as appropriate to review and discuss these materials.

(c) The owner or operator shall document coordination with local authorities, including: The names of individuals involved and their contact information (phone number, email address, and organizational affiliations); dates of coordination activities; and nature of coordination activities.

19. Amend § 68.95 by:

a. Revising paragraph (a)(1)(i);

b. Adding a sentence to the end of paragraph (a)(4); and

c. Revising paragraph (c).

The revisions and addition read as follows:

68.95

Emergency response program.

(a) * * *

(1) * * *

(i) Procedures for informing the public and the appropriate Federal, state, and local emergency response agencies about accidental releases;

* * * * *

(4) * * * The owner or operator shall review and update the plan as appropriate based on changes at the stationary source or new information obtained from coordination activities, emergency response exercises, incident investigations, or other available information, and ensure that employees are informed of the changes.

* * * * *

(c) The emergency response plan developed under paragraph (a)(1) of this section shall be coordinated with the community emergency response plan developed under 42 U.S.C. 11003. Upon request of the LEPC or emergency response officials, the owner or operator shall promptly provide to the local emergency response officials information necessary for developing and implementing the community emergency response plan.

20. Section 68.96 is added to subpart E to read as follows:

§ 68.96

Emergency response exercises.

(a) Notification exercises. At least once each calendar year, the owner or operator of a stationary source with any Program 2 or Program 3 process shall conduct an exercise of the stationary source's emergency response notification mechanisms required under § 68.90(a)(2) or § 68.95(a)(1)(i), as appropriate. Owners or operators of responding stationary sources may perform the notification exercise as part of the tabletop and field exercises required in paragraph (b) of this section. The owner/operator shall maintain a written record of each notification exercise conducted over the last five years.

(b) Emergency response exercise program. The owner or operator of a stationary source subject to the requirements of § 68.95 shall develop and implement an exercise program for its emergency response program, including the plan required under § 68.95(a)(1). Exercises shall involve facility emergency response personnel and, as appropriate, emergency response contractors. When planning emergency response field and tabletop exercises, the owner or operator shall coordinate with local public emergency response officials and invite them to participate in the exercise. The emergency response exercise program shall include:

(1) Emergency response field exercises. The owner or operator shall conduct field exercises involving the simulated accidental release of a regulated substance (i.e., toxic substance release or release of a regulated flammable substance involving a fire and/or explosion).

(i) Frequency. As part of coordination with local emergency response officials required by § 68.93, the owner or operator shall consult with these officials to establish an appropriate frequency for field exercises, but at a minimum, shall conduct a field exercise at least once every ten years.

(ii) Scope. Field exercises shall include: Tests of procedures to notify the public and the appropriate Federal, state, and local emergency response agencies about an accidental release; tests of procedures and measures for emergency response actions including evacuations and medical treatment; tests of communications systems; mobilization of facility emergency response personnel, including contractors, as appropriate; coordination with local emergency responders; emergency response equipment deployment; and any other action identified in the emergency response program, as appropriate.

(2) Tabletop exercises. The owner or operator shall conduct a tabletop exercise involving the simulated accidental release of a regulated substance.

(i) Frequency. As part of coordination with local emergency response officials required by § 68.93, the owner or operator shall consult with these officials to establish an appropriate frequency for tabletop exercises, but at a minimum, shall conduct a field exercise at least once every three years.

(ii) Scope. The exercise shall include discussions of: Procedures to notify the public and the appropriate Federal, state, and local emergency response agencies; procedures and measures for emergency response including evacuations and medical treatment; identification of facility emergency response personnel and/or contractors and their responsibilities; coordination with local emergency responders; procedures for emergency response equipment deployment; and any other action identified in the emergency response plan, as appropriate.

(3) Documentation. The owner/operator shall prepare an evaluation report within 90 days of each exercise. The report shall include: A description of the exercise scenario; names and organizations of each participant; an evaluation of the exercise results including lessons learned; recommendations for improvement or revisions to the emergency response exercise program and emergency response program, and a schedule to promptly address and resolve recommendations.

(c) Alternative means of meeting exercise requirements. The owner or operator may satisfy the requirement to conduct notification, field and/or tabletop exercises through:

(1) Exercises conducted to meet other Federal, state or local exercise requirements, provided the exercise meets the requirements of paragraphs (a) and/or (b) of this section, as appropriate.

(2) Response to an accidental release, provided the response includes the actions indicated in paragraphs (a) and/or (b) of this section, as appropriate. When used to meet field and/or tabletop exercise requirements, the owner or operator shall prepare an after-action report comparable to the exercise evaluation report required in paragraph (b)(3) of this section, within 90 days of the incident.

21. Amend § 68.130 by:

a. In Table 1, “List of Regulated Toxic Substances and Threshold Quantities for Accidental Release Prevention”, under second column entitled “CAS No.”, removing the number “107-18-61” adding “107-18-6” in its place; and

b. Revising Table 4, “List of Regulated Flammable Substances and Threshold Quantities for Accidental Release Prevention”.

The revisions read as follows:

§ 68.130

List of substances.

* * * * *

Table 4 to § 68.130—List of Regulated Flammable Substances ¹ and Threshold Quantities for Accidental Release Prevention

[CAS Number Order—63 Substances]

CAS No.	Chemical name	Threshold quantity (lbs)	Basis for listing
60-29-7	Ethyl ether [Ethane, 1,1′-oxybis-]	10,000	g
74-82-8	Methane	10,000	f
74-84-0	Ethane	10,000	f
74-85-1	Ethylene [Ethene]	10,000	f
74-86-2	Acetylene [Ethyne]	10,000	f
74-89-5	Methylamine [Methanamine]	10,000	f
74-98-6	Propane	10,000	f
74-99-7	Propyne [1-Propyne]	10,000	f
75-00-3	Ethyl chloride [Ethane, chloro-]	10,000	f
75-01-4	Vinyl chloride [Ethene, chloro-]	10,000	a, f
75-02-5	Vinyl fluoride [Ethene, fluoro-]	10,000	f
75-04-7	Ethylamine [Ethanamine]	10,000	f
75-07-0	Acetaldehyde	10,000	g
75-08-1	Ethyl mercaptan [Ethanethiol]	10,000	g
75-19-4	Cyclopropane	10,000	f
75-28-5	Isobutane [Propane, 2-methyl]	10,000	f
75-29-6	Isopropyl chloride [Propane, 2-chloro-]	10,000	g
75-31-0	Isopropylamine [2-Propanamine]	10,000	g
75-35-4	Vinylidene chloride [Ethene, 1,1-dichloro-]	10,000	g
75-37-6	Difluoroethane [Ethane, 1,1-difluoro-]	10,000	f
75-38-7	Vinylidene fluoride [Ethene, 1,1-difluoro-]	10,000	f
75-50-3	Trimethylamine [Methanamine, N, N-dimethyl-]	10,000	f
75-76-3	Tetramethylsilane [Silane, tetramethyl-]	10,000	g
78-78-4	Isopentane [Butane, 2-methyl-]	10,000	g
78-79-5	Isoprene [1,3,-Butadiene, 2-methyl-]	10,000	g
79-38-9	Trifluorochloroethylene [Ethene, chlorotrifluoro-]	10,000	f
106-97-8	Butane	10,000	f
106-98-9	1-Butene	10,000	f
106-99-0	1,3-Butadiene	10,000	f
107-00-6	Ethyl acetylene [1-Butyne]	10,000	f
107-01-7	2-Butene	10,000	f
107-25-5	Vinyl methyl ether [Ethene, methoxy-]	10,000	f
107-31-3	Methyl formate [Formic acid, methyl ester]	10,000	g
109-66-0	Pentane	10,000	g
109-67-1	1-Pentene	10,000	g
109-92-2	Vinyl ethyl ether [Ethene, ethoxy-]	10,000	g
109-95-5	Ethyl nitrite [Nitrous acid, ethyl ester]	10,000	f
115-07-1	Propylene [1-Propene]	10,000	f
115-10-6	Methyl ether [Methane, oxybis-]	10,000	f
115-11-7	2-Methylpropene [1-Propene, 2-methyl-]	10,000	f
116-14-3	Tetrafluoroethylene [Ethene, tetrafluoro-]	10,000	f
124-40-3	Dimethylamine [Methanamine, N-methyl-]	10,000	f
460-19-5	Cyanogen [Ethanedinitrile]	10,000	f
463-49-0	Propadiene [1,2-Propadiene]	10,000	f
463-58-1	Carbon oxysulfide [Carbon oxide sulfide (COS)]	10,000	f
463-82-1	2,2-Dimethylpropane [Propane, 2,2-dimethyl-]	10,000	f
504-60-9	1,3-Pentadiene	10,000	f
557-98-2	2-Chloropropylene [1-Propene, 2-chloro-]	10,000	g
563-45-1	3-Methyl-1-butene	10,000	f
563-46-2	2-Methyl-1-butene	10,000	g
590-18-1	2-Butene-cis	10,000	f
590-21-6	1-Chloropropylene [1-Propene, 1-chloro-]	10,000	g
598-73-2	Bromotrifluorethylene [Ethene, bromotrifluoro-]	10,000	f
624-64-6	2-Butene-trans [2-Butene, (E)]	10,000	f
627-20-3	2-Pentene, (Z)-	10,000	g
646-04-8	2-Pentene, (E)-	10,000	g
689-97-4	Vinyl acetylene [1-Buten-3-yne]	10,000	f
1333-74-0	Hydrogen	10,000	f
4109-96-0	Dichlorosilane [Silane, dichloro-]	10,000	f
7791-21-1	Chlorine monoxide [Chlorine oxide]	10,000	f
7803-62-5	Silane	10,000	f
10025-78-2	Trichlorosilane [Silane, trichloro-]	10,000	g
25167-67-3	Butene	10,000	f
1 A flammable substance when used as a fuel or held for sale as a fuel at a retail facility is excluded from all provisions of this part (see § 68.126).
Note: Basis for Listing:
a Mandated for listing by Congress.
f Flammable gas.
g Volatile flammable liquid.

22. Amend § 68.160 by adding paragraphs (b)(21) and (22) to read as follows:

§ 68.160

Registration.

* * * * *

(b) * * *

(21) Method of communication and location of the notification that chemical hazard information is available to the public, pursuant to § 68.210(c); and

(22) Whether a public meeting has been held following an RMP reportable accident, pursuant to § 68.210(e).

23. Amend § 68.170 by revising paragraphs (i) and (j) to read as follows:

§ 68.170

Prevention program/Program 2.

* * * * *

(i) The date of the most recent compliance audit, the expected date of completion of any changes resulting from the compliance audit, and identify whether the most recent compliance audit was a third-party audit, pursuant to §§ 68.58 and 68.59.

(j) The completion date of the most recent incident investigation and the expected date of completion of any changes resulting from the investigation.

* * * * *

24. Amend § 68.175 by:

a. Revising the introductory text of paragraph (e), and paragraphs (e)(1), (5), and (6);

b. Adding paragraph (e)(7); and

c. Revising paragraphs (k) and (l).

The revisions and addition read as follows:

§ 68.175

Prevention program/Program 3.

* * * * *

(e) The most recent process hazard analysis (PHA) or PHA update and revalidation information, pursuant to § 68.67, including:

(1) The date of completion of the most recent PHA or update and the technique used;

* * * * *

(5) Monitoring and detection systems in use;

(6) Changes since the last PHA; and

(7) Inherently safer technology or design measures implemented since the last PHA, if any, and the technology category (substitution, minimization, simplification and/or moderation).

* * * * *

(k) The date of the most recent compliance audit, the expected date of completion of any changes resulting from the compliance audit, and identify whether the most recent compliance audit was a third-party audit, pursuant to §§ 68.79 and 68.80.

(l) The completion date of the most recent incident investigation and the expected date of completion of any changes resulting from the investigation.

* * * * *

25. Revise § 68.180 to read as follows:

§ 68.180

Emergency response program and exercises.

(a) The owner or operator shall provide in the RMP:

(1) Name, organizational affiliation, phone number, and email address of local emergency planning and response organizations with which the stationary source last coordinated emergency response efforts, pursuant to § 68.10(f)(3) or § 68.93;

(2) The date of the most recent coordination with the local emergency response organizations, pursuant to § 68.93 and

(3) A list of Federal or state emergency plan requirements to which the stationary source is subject.

(b) The owner or operator shall identify in the RMP whether the facility is a responding stationary source or a non-responding stationary source, pursuant to § 68.90.

(1) For non-responding stationary sources, the owner or operator shall identify:

(i) For stationary sources with any regulated toxic substance held in a process above the threshold quantity, whether the stationary source is included in the community emergency response plan developed under 42 U.S.C. 11003, pursuant to § 68.90(b)(1);

(ii) For stationary sources with only regulated flammable substances held in a process above the threshold quantity, the date of the most recent coordination with the local fire department, pursuant to § 68.90(b)(2);

(iii) What mechanisms are in place to notify the public and emergency responders when there is a need for emergency response; and

(iv) The date of the most recent notification exercise, as required in § 68.96(a).

(2) For responding stationary sources, the owner or operator shall identify:

(i) The date of the most recent review and update of the emergency response plan, pursuant to § 68.95(a)(4);

(ii) The date of the most recent notification exercise, as required in § 68.96(a);

(iii) The date of the most recent field exercise, as required in § 68.96(b)(1); and

(iv) The date of the most recent tabletop exercise, as required in § 68.96(b)(2).

26. Amend § 68.190 by adding a sentence at the end of paragraph (c) to read as follows:

§ 68.190

Updates.

* * * * *

(c) * * * Prior to de-registration the owner or operator shall meet applicable reporting and incident investigation requirements in accordance with §§ 68.42, 68.60, and/or 68.81.

* * * * *

27. Revise § 68.200 to read as follows:

§ 68.200

Recordkeeping.

The owner or operator shall maintain records supporting the implementation of this part at the stationary source for five years, unless otherwise provided in subpart D of this part.

28. Revise § 68.210 to read as follows:

§ 68.210

Availability of information to the public.

(a) RMP availability. The RMP required under subpart G of this part shall be available to the public under 42 U.S.C. 7414(c) and 40 CFR part 1400.

(b) Chemical hazard information. The owner or operator of a stationary source shall provide, upon request by any member of the public, the following chemical hazard information for all regulated processes, as applicable:

(1) Regulated substances information. Names of regulated substances held in a process;

(2) Safety data sheets (SDS). SDSs for all regulated substances located at the facility;

(3) Accident history information. Provide the five-year accident history information required to be reported under § 68.42;

(4) Emergency response program. The following summary information concerning the stationary source's compliance with § 68.10(f)(3) or the emergency response provisions of subpart E:

(i) Whether the stationary source is a responding stationary source or a non-responding stationary source;

(ii) Name and phone number of local emergency response organizations with which the owner or operator last coordinated emergency response efforts, pursuant to § 68.180; and

(iii) For stationary sources subject to § 68.95, procedures for informing the public and local emergency response agencies about accidental releases;

(5) Exercises. A list of scheduled exercises required under § 68.96; and

(6) LEPC contact information. Include LEPC name, phone number, and web address as available.

(c) Notification of availability of information. The owner or operator shall provide ongoing notification on a company Web site, social media platforms, or through other publicly accessible means that:

(1) Information specified in paragraph (b) of this section is available to the public upon request. The notification shall:

(i) Specify the information elements, identified in paragraph (b) of this section, that can be requested; and

(ii) Provide instructions for how to request the information (e.g. email, mailing address, and/or telephone or Web site request);

(2) Identify where to access information on community preparedness, if available, including shelter-in-place and evacuation procedures.

(d) Timeframe to provide requested information. The owner or operator shall provide the requested information under paragraph (b) of this section within 45 days of receiving a request from any member of the public.

(e) Public meetings. The owner or operator of a stationary source shall hold a public meeting to provide information required under § 68.42 as well as other relevant chemical hazard information, such as that described in paragraph (b) of this section, no later than 90 days after any accident subject to reporting under § 68.42.

(f) Classified information. The disclosure of information classified by the Department of Defense or other Federal agencies or contractors of such agencies shall be controlled by applicable laws, regulations, or executive orders concerning the release of classified information.

(g) CBI. An owner or operator asserting CBI for information required under this section shall provide a sanitized version to the public. Assertion of claims of CBI and substantiation of CBI claims shall be in the same manner as required in §§ 68.151 and 68.152 for information contained in the RMP required under subpart G of this part. As provided under § 68.151(b)(3), an owner or operator of a stationary source may not claim five-year accident history information as CBI. As provided in § 68.151(c)(2), an owner or operator of a stationary source asserting that a chemical name is CBI shall provide a generic category or class name as a substitute.

Footnotes

1.  See ATF Announces $50,000 Reward in West, Texas Fatality Fire, https://www.atf.gov/​news/​pr/​atf-announces-50000-reward-west-texas-fatality-fire.

2.  For more information on the Executive Order see https://www.whitehouse.gov/​the-press-office/​2013/​08/​01/​executive-order-improving-chemical-facility-safety-and-security.

3.  Note for the purposes of this document the term TEPC can be substituted for LEPC, as appropriate.

4.  A full description of costs and benefits for this final rule can be found in the Regulatory Impact Analysis—Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act, Section 112(r)(7). This document is available in the docket for this rulemaking (Docket ID Number EPA-HQ-OEM-2015-0725).

5.  For descriptions of NAICS codes, see http://www.census.gov/​cgi-bin/​sssd/​naics/​naicsrch.

6.  For more information on the Executive Order see https://www.whitehouse.gov/​the-press-office/​2013/​08/​01/​executive-order-improving-chemical-facility-safety-and-security.

7.  CSB. January 2016. Final Investigation Report, West Fertilizer Company Fire and Explosion, West, TX, April 17, 2013. REPORT 2013-02-I-TX. http://www.csb.gov/​west-fertilizer-explosion-and-fire-/​. On May 11, 2016, ATF ruled that the fire was intentionally set. See ATF Announces $50,000 Reward in West, Texas Fatality Fire, https://www.atf.gov/​news/​pr/​atf-announces-50000-reward-west-texas-fatality-fire.

8.  U.S. Chemical Safety and Hazard Investigation Board (CSB). March 2007. Investigation Report: Refinery Explosion and Fire, BP, Texas City, Texas, March 23, 2005. Report No. 2005-04-I-TX. http://www.csb.gov/​assets/​1/​19/​CSBFinalReportBP.pdf.

9.  CSB. May 2014. Investigation Report: Catastrophic Rupture of Heat Exchanger, Tesoro Anacortes Refinery, Anacortes, Washington, April 2, 2010. Report No. 2010-08-I-WA. http://www.csb.gov/​assets/​1/​7/​Tesoro_​Anacortes_​2014-May-01.pdf.

10.  CSB. January 2014. Regulatory Report: Chevron Richmond Refinery Pipe Rupture and Fire, Chevron Richmond Refinery #4 Crude Unit, Richmond, California, August 6, 2012. Report No. 2012-03-I-CA. http://www.csb.gov/​assets/​1/​19/​CSB_​Chevron_​Richmond_​Refinery_​Regulatory_​Report.pdf.

11.  CSB. October 2016. Case Study: Williams Geismar Olefins Plant Reboiler Rupture and Fire, Geismar, Louisiana. Incident Date: June 13, 2013, No. 2013-03-I-LA. US Chemical Safety and Hazard Investigation Board, Washington, DC http://www.csb.gov/​williams-olefins-plant-explosion-and-fire-/​.

12.  2016. EPA Response to Comments on the 2016 Proposed Rulemaking Amending EPA's Risk Management Program Regulations. This document is available in the docket for this rulemaking.

13.  40 CFR part 68 is titled, “Chemical Accident Prevention Provisions,” but is more commonly known as the “RMP regulation,” the “RMP rule,” or the “Risk Management Program.” This document uses all three terms to refer to 40 CFR part 68. The term “RMP” refers to the document required to be submitted under subpart F of 40 CFR part 68, the Risk Management Plan. See https://www.epa.gov/​rmp for more information on the Risk Management Program.

14.  Documents and information related to development of the list rule can be found in the EPA docket for the rulemaking, docket number A-91-74.

15.  Documents and information related to development of the RMP rule can be found in EPA docket number A-91-73.

16.  40 CFR part 68 applies to owners and operators of stationary sources that have more than a TQ of a regulated substance within a process. The regulations do not apply to chemical hazards other than listed substances held above a TQ within a regulated process.

17.  NAICS codes 325181 and 325188 are now combined and represented as revised NAICS code 325180 in the 2012 and 2017 code versions (other basic inorganic chemical manufacturing). NAICS code 325192 is now revised NAICS code 325194 (cyclic crude, intermediate, and gum and wood chemical manufacturing) in the 2012 and 2017 code versions.

18.  CSB. January 2016. Final Investigation Report, West Fertilizer Company Fire and Explosion, West, TX, April 17, 2013. REPORT 2013-02-I-TX. http://www.csb.gov/​west-fertilizer-explosion-and-fire-/​.

19.  2016. EPA Response to Comments on the 2016 Proposed Rulemaking Amending EPA's Risk Management Program Regulations. This document is available in the docket for this rulemaking.

20.  2016. EPA Response to Comments on the 2016 Proposed Rulemaking Amending EPA's Risk Management Program Regulations. This document is available in the docket for this rulemaking.

21.  EPA, Risk Management Plan Rule: Summary and Response to Comments, Excerpt from Volume 1: Table of Contents, Introduction, and Sections 3, 16 and 17. May 24, 1996, pp 3-11 and 17-4. Document No. EPA-HQ-OEM-2015-0725-0153, https://www.regulations.gov/​document?​D=​EPA-HQ-OEM-2015-0725-0153.

22.  Lees, Frank P. 2012. Loss Prevention in the Process Industries, Fourth Edition. Butterworth-Heinemann. http://www.sciencedirect.com/​science/​book/​9780123971890.

23.   EPA. May 24, 1996. Risk Management Plan Rule, Summary and Response to Comments. Volume 1, p. 16-4. Docket No. A-91-73, Document No. IX-C-1.

24.  CCPS. January 2011. Process Safety Leading and Lagging Metrics—You Don't Improve What You Don't Measure, p. 36. CCPS, American Institute of Chemical Engineers, New York, NY. John Wiley and Sons. http://www.aiche.org/​sites/​default/​files/​docs/​pages/​CCPS_​ProcessSafety_​Lagging_​2011_​2-24.pdf.

25.  CCPS. March 2003. Guidelines for Investigating Chemical Process Incidents, 2nd ed., p. 68.

26.  Senate Committee on Environment and Public Works, Clean Air Act Amendments of 1989, Senate Report No. 228, 101st Congress, 1st Session (1989)—“Senate Report”.

27.  CCPS 2003. Center for Chemical Process Safety, Guidelines for Investigating Chemical Process Incidents, 2nd Edition, NY: AIChE.

28.  “Other personnel” may be facility personnel, personnel from any other facilities owned or controlled by the owner or operator, and/or any non-independent second or third-party consultants or contractors the owners or operators choose to include on the auditing teams they assemble under subparagraph (b)(2). In addition, the auditing teams may include other employees of the third-party auditor firm who meet the independence criteria of subparagraph (c)(2). Such personnel need not individually meet the final rule's third-party auditor competency criteria as long as the independent third-party audit team leader, pursuant to his/her evaluation of audit team member competencies under subparagraph (d)(2), determines that the full audit team includes all of the competencies required to successfully complete the audit pursuant to the requirements in the final rule.

29.  The competency criteria do not apply to other personnel, not employed by the third-party auditor firm, that participate on the auditing team (e.g., facility personnel).

30.  EPA is finalizing auditor responsibilities to ensure that third-party auditors maintain certain responsibilities when audit teams are comprised of both third-party auditor personnel and other personnel. EPA did not propose roles and responsibilities for independent third-party auditors because, in the proposed approach, independent third-party auditors were responsible for conducting all auditing activities.

31.  Note-only third-party auditors must meet the competency criteria of the rule-does not apply to other personnel on an audit team.

32.  EPA retains its authority under Section 114 of the CAA to require regulated entities to make such records available to the Agency, as appropriate, upon request or during inspections. EPA is finalizing recordkeeping requirements under paragraph (g) of the final rule.

33.  This change was made to track the language of Section 113(c)(2)(A) of the CAA which makes it illegal for regulated entities to “make any false material statement, representation, or certification.”

34.  2016. EPA Response to Comments on the 2016 Proposed Rulemaking Amending EPA's Risk Management Program Regulations. This document is available in the docket for this rulemaking.

35.  Senate Committee on Environment and Public Works, Clean Air Act Amendments of 1989, Senate Report No. 228, 101st Congress, 1st Session 211 (1989)—“Senate Report.”

36.  EPA. May 24, 1996. Risk Management Plan Rule, Summary and Response to Comments. Volume 1, p. 15-2. Docket No. A-91-73, Document No. IX-C-1.

37.  The IRFA can be found in Chapter 7 of the Regulatory Impact Analysis for Proposed Revisions to the Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act, Section 112(r)(7). This document is available in the docket for this rulemaking (Docket ID Number EPA-HQ-OEM-2015-0725).

38.  See, e.g., CA UST Regulations (CCR, Title 23, Division 3, Chapter 16), Amended and Effective July 1, 2012) at § 2715 (Certification, Licensing, and Training Requirements for Underground Storage Tank Owners, Operators, Installers, Service Technicians, and Inspectors). http://www.swrcb.ca.gov/​ust/​regulatory/​docs/​title23_​d3_​c16.pdf

39.  EPA conducted a pilot study with the Wharton School of the University of Pennsylvania on the efficacy of voluntary third-party RMP audits. For relevant reports from this pilot, see R. Barrish, R. Antoff, & J. Brabson, Dep't of Natural Resources & Env. Control, Third Party Audit Pilot Project in the State of Delaware, Final Report (June 6, 2000) http://opim.wharton.upenn.edu/​risk/​library/​2000_​RAB,RA,JB_​3rdPartyAudit_​Delaware.pdf and EPA Region 3, Third-Party Pilot Project in the Commonwealth of Pennsylvania, Final Report (February 2001).

40.  See, e.g.: (1) Short, Jodi L., and Michael W. Toffel, The Integrity of Private Third-party Compliance Monitoring, Harvard Kennedy School Regulatory Policy Program Working Paper, No. RPP-2015-20, November 2015. (Revised December 2015) http://www.hbs.edu/​faculty/​Pages/​item.aspx?​num=​50186; (2) Lesley K. McAllister, Regulation by Third-Party Verification, 53 B.C. L. Rev. 1 (2012). http://lawdigitalcommons.bc.edu/​cgi/​viewcontent.cgi?​article=​3182&​context=​bclr; (3) Esther Duflo et al., Truth-Telling by Third-Party Auditors and the Response of Polluting Firms: Experimental Evidence From India, 128 Q.J. Econ. 1499, 1499 (2013) http://qje.oxfordjournals.org/​content/​128/​4/​1499.abstract.

41.  Ball, George and Siemsen, Enno and Shah, Rachna; Inspector Experience and Product Recalls in the Medical Device Industry (June 2, 2014). Available at http://ssrn.com/​abstract=​2445022, http://dx.doi.org/​10.2139/​ssrn.2445022, or http://papers.ssrn.com/​sol3/​papers.cfm?​abstract_​id=​2445022.

42.  See, e.g., Abigail Brown, The Economics of Auditor Capture, Edmond J. Safra Center for Ethics, Harvard University (Nov. 8, 2011) at https://abigailbrown.files.wordpress.com/​2009/​08/​auditor-capture-111108.pdf (“[T]here does not need to be an explicit exchange of bribes to sustain a collusive equilibrium, suggesting that social norms and psychological biases reinforce rational action and allow profitable collusion to occur with little conscious intent.” Id. at Abstract).

43.  Ginger Zhe Jin & Jungmin Lee, A Tale of Repetition: Lessons from Florida Restaurant Inspections, National Bureau of Eco. Research Working Paper No. 20596 (Oct. 2014). http://www.nber.org/​papers/​w20596.

44.  EPA has not formally evaluated these programs and standards or their outcomes. This discussion is not a formal Agency review or endorsement.

45.  ACC. 2012. Responsible Care Product Safety Code. https://responsiblecare.americanchemistry.com/​Product-Safety-Code/​.

46.  ACC Responsible Care Guiding Principles. https://responsiblecare.americanchemistry.com/​ResponsibleCare/​Responsible-Care-Program-Elements/​Guiding-Principles/​.

47.  Certification must be renewed every three years, and companies can choose one of two certification options. RCMS® certification is intended to verify that a company has implemented the Responsible Care Management System. RC14001® certification combines Responsible Care and ISO 14001 certification. See http://responsiblecare.americanchemistry.com/​Responsible-Care-Program-Elements/​Management-System-and-Certification and http://responsiblecare.americanchemistry.com/​Responsible-Care-Program-Elements/​Process-Safety-Code/​Responsible-Care-Process-Safety-Code-PDF.pdf.

48.  ACC Responsible Care Management System. https://responsiblecare.americanchemistry.com/​Management-System-and-Certification/​.

49.  API. 2015. PSSAP. http://www.api.org/​~/​media/​Files/​Certification/​PSSAP/​PSSAP-Brochure.pdf?​la=​en.

50.  API. 2015. PSSAP. http://www.api.org/​certification-programs/​process-safety-site-assessment-programs.

51.  COS. 2013. See http://www.centerforoffshoresafety.org/​auditInfo.html.

52.  COS. 2015. See http://www.centerforoffshoresafety.org/​About.

53.  SOCMA. 2015. See http://www.socma.com/​ChemStewards/​.

54.  SOCMA, 2016. See Benefits of Implementing ChemStewards®. http://www.socma.com/​chemstewards/​about/​benefits.

55.  SOCMA. See http://www.socma.com/​Portals/​0/​Files/​ChemStewards/​ChemStewards_​101_​Training.pdf.

56.  See, esp.: (1) Short, Jodi L., and Michael W. Toffel, The Integrity of Private Third-party Compliance Monitoring, Harvard Kennedy School Regulatory Policy Program Working Paper, No. RPP-2015-20, November 2015. (Revised December 2015) http://www.hbs.edu/​faculty/​Pages/​item.aspx?​num=​50186; (2) Lesley K. McAllister, Regulation by Third-Party Verification, 53 B.C. L. Rev. 1 (2012). http://lawdigitalcommons.bc.edu/​cgi/​viewcontent.cgi?​article=​3182&​context=​bclr; (3) Esther Duflo et al., Truth-Telling by Third-Party Auditors and the Response of Polluting Firms: Experimental Evidence From India, 128 Q.J. Econ. 1499, 1499 (2013) http://qje.oxfordjournals.org/​content/​128/​4/​1499.abstract.

57.  See page 7-7 of EPA's General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR part 68), EPA-550-B-04-001, April 2004 https://www.epa.gov/​rmp/​guidance-facilities-risk-management-programs-rmp; and replacement pages B-21 and B-22 of OSHA 29 CFR 1910.119, Process Safety Management of Highly Hazardous Chemicals—Compliance Guidelines and Enforcement Procedures CPL 2-2.45A CH-1, September 13, 1994 https://www.osha.gov/​OshDoc/​Directive_​pdf/​CPL02-02-045_​CH-1_​20150901.pdf.

58.  “(d) Any application form, report, or compliance certification submitted pursuant to these regulations shall contain certification by a responsible official of truth, accuracy, and completeness. This certification and any other certification required under this part shall state that, based on information and belief formed after reasonable inquiry, the statements and information in the document are true, accurate, and complete.”

59.  Under Section 3(a)(58) of the Exchange Act as added by Section 205 of the Sarbanes-Oxley Act, the term audit committee is defined as “[a] committee (or equivalent body) established by and amongst the board of directors of an issuer for the purpose of overseeing the accounting and financial reporting processes of the issuer and audits of the financial statements of the issuer” (if no such committee exists with respect to an issuer, the entire board of directors of the issuer). See Securities and Exchange Commission, 17 CFR 240.10A-3—Listing standards relating to audit committees (68 FR 18818, April 16, 2003, as amended at 70 FR 1620, January 7, 2005; 73 FR 973, January 4, 2008).

60.  See definition of “promptly,” Cambridge English Dictionary, at http://dictionary.cambridge.org/​us/​dictionary/​english/​promptly.

61.  2016. EPA Response to Comments on the 2016 Proposed Rulemaking Amending EPA's Risk Management Program Regulations. This document is available in the docket for this rulemaking.

62.  An intentionally-caused release through the criminal act of a third-party would be an accidental release because the emission would be unanticipated from the perspective of the owner or operator of the stationary source. Where the location of a water treatment source could expose large populations to regulated substances, we believe it is appropriate for such sources to work with local emergency planners and homeland security officials to reduce the risk. Nevertheless, such isolated cases do not justify a mandate across the industry in place of a case-specific review.

63.  We note that our more extensive discussion of authority for the RMP rule provided in the 1993 proposal focused on CAA 112(r)(7)(B)(i) and (ii), 58 FR 54191-93 (October 20, 1993), which the proposal for the Modernization rule referenced for additional authority discussion.

64.  H. Rep. 101-952, Clean Air Act Amendments of 1990 Conference Report to Accompany S. 1630, 101st Cong., 2d Session, 340-41. October 26, 1990.

65.  EPA chose to incorporate into the prevention program provisions several of the hazard assessment elements mentioned in the conference report and to limit the hazard assessment portions of 40 CFR subpart B to the offsite consequence analysis and accident history in order to better conform the RMP rule to the format of the PSM rule. 58 FR 54194 (October 20, 1993).

66.  Clean Air Act Amendments of 1989, Report of the Committee on Environment and Public Works, U.S. Senate together with Additional and Minority Views to Accompany S. 1630. S. Report No. 101-228. 101st Congress, 1st Session, p. 242, December 20, 1989.

67.  United States Sugar Corp. v. EPA, 830 F.3d 579 (D.C. Cir. 2016).

68.  https://www.epa.gov/​sites/​production/​files/​2015-06/​documents/​alert_​safer_​tech_​alts.pdf.

69.  For more information, see Chapter 6 of the Regulatory Impact Analysis—Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act, Section 112(r)(7). This document is available in the docket for this rulemaking (Docket ID Number EPA-HQ-OEM-2015-0725).

70.  For more information, see EPA, January 27, 2016. Technical Background Document for Notice of Proposed Rulemaking: Risk Management Programs under the Clean Air Act, Section 112(r)(7). This document is available in the docket for this rulemaking (Docket ID Number EPA-HQ-OEM-2015-0725).

71.  EPA. January 27, 2016. Technical Background Document for Notice of Proposed Rulemaking: Risk Management Programs under the Clean Air Act, Section 112(r)(7). This document is available in the docket for this rulemaking (Docket ID Number EPA-HQ-OEM-2015-0725).

72.  Elliott, M.R., Kleindorfer, P.R., and Lowe, R.A., The Role of Hazardousness and Regulatory Practice in the Accidental Release of Chemicals at U.S. Industrial Facilities, Risk Analysis, Vol. 23, No. 5, 2003.

73.  See, e.g., “Nonfatal Occupational Injuries and Illnesses Requiring Days Away from Work, 2014,” U.S. Department of Labor, Bureau of Labor Statistics, November 19, 2015. Available at http://www.bls.gov/​news.release/​osh2.nr0.htm.

74.  Regulatory Impact Analysis—Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act, Section 112(r)(7). This document is available in the docket for this rulemaking (Docket ID Number EPA-HQ-OEM-2015-0725).

75.  According to the CSB, “approximately 15,000 people from the surrounding communities sought medical treatment at nearby medical facilities for ailments including breathing problems, chest pain, shortness of breath, sore throat, and headaches. Approximately 20 of these people were admitted to local hospitals as inpatients for treatment.” CSB, January 2015, Final Investigation Report: Chevron Richmond Refinery Pipe Rupture and Fire, Chevron Richmond Refinery #4 Crude Unit, Richmond, California, August 6, 2012, Report No. 2012-03-I-CA, http://www.csb.gov/​assets/​1/​16/​Chevron_​Final_​Investigation_​Report_​2015-01-28.pdf.

76.  EPA. January 27, 2016. Technical Background Document for Notice of Proposed Rulemaking: Risk Management Programs under the Clean Air Act, Section 112(r)(7). This document is available in the docket for this rulemaking (Docket ID Number EPA-HQ-OEM-2015-0725).

77.  CCPS. 2009. Inherently Safer Chemical Processes: A Life Cycle Approach, 2nd ed., American Institute of Chemical Engineers, CCPS New York, Wiley, p. 25.

78.  http://www.nj.gov/​dep/​enforcement/​tcpa/​downloads/​IST_​guidance.pdf.

79.  81 FR 13667, March 14, 2016.

80.  Draft California Accidental Release Prevention Program (ARP) Regulations, California Governor's Office of Emergency Services. July 5, 2016, p. 83 http://www.caloes.ca.gov/​FireRescueSite/​Documents/​CalARP%20Proposed%20Regs%202016.pdf.

81.  CCPS. 2009, Inherently Safer Chemical Processes: A Life Cycle Approach. 2nd ed., p. 10. https://www.regulations.gov/​document?​D=​EPA-HQ-OEM-2015-0725-0253.

82.  CCPS. 2008, Guidelines for Hazard Evaluation Procedures. 3rd ed., p. 234. http://www.aiche.org/​ccps/​publications/​books/​guidelines-hazard-evaluation-procedures-3rd-edition.

83.  CCPS. 2009, Inherently Safer Chemical Processes: A Life Cycle Approach. 2nd ed., https://www.regulations.gov/​document?​D=​EPA-HQ-OEM-2015-0725-0253.

84.  CCPS. July 2010. Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage, and Use, https://www.regulations.gov/​document?​D=​EPA-HQ-OEM-2015-0725-0274.

85.  NJDEP TCPA. March 29, 2012. NJ Title 7, Chapter 31 TCPA Program Consolidated Rule Document, http://www.nj.gov/​dep/​rules/​rules/​njac7_​31.pdf.

86.  CCPS. 2009. Inherently Safer Chemical Processes: A Life Cycle Approach, 2nd ed., American Institute of Chemical Engineers, CCPS New York, Wiley.

87.  CCPS. 2009. Inherently Safer Chemical Processes: A Life Cycle Approach, 2nd ed., American Institute of Chemical Engineers, CCPS New York, Wiley.

88.  See 61 FR 31699, June 20, 1996.

89.  EPA modified the final rule to replace the term “feasible” defined in § 68.3 with “practicability.” When evaluating the practicability of an IST, the facility owner or operator would determine whether the IST is capable of being successfully accomplished within a reasonable time, accounting for economic, environmental (including consideration of potential transferred risks for new risk reduction measures), legal, social, and technological factors.

90.  Regulatory Impact Analysis, Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act, Section 112(r)(7), using data from Exhibit 7-3 and 7-5.

91.  See 72 FR 17718, April 9, 2007, https://www.gpo.gov/​fdsys/​pkg/​FR-2007-04-09/​pdf/​E7-6363.pdf.

92.  Section 550 has since been replaced by the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, Public Law 113-254. However, the prohibition on DHS disapproving a security plan based on the presence or absence of a particular security measure remains. See 6 U.S.C. 622(c)(1)(B).

93.  CCPS. 2009, Inherently Safer Chemical Processes: A Life Cycle Approach. 2nd ed. American Institute of Chemical Engineers, Center for Chemical Process Safety. pp. 10-11.

94.  CCPS. 2009, Inherently Safer Chemical Processes: A Life Cycle Approach. 2nd ed. American Institute of Chemical Engineers, Center for Chemical Process Safety. pp. 112-113.

95.  ACC. 2016. Responsible Care Process Safety Code https://responsiblecare.americanchemistry.com/​Responsible-Care-Program-Elements/​Process-Safety-Code/​Responsible-Care-Process-Safety-Code-PDF.pdf.

96.  For more information, see the preamble of the proposed rulemaking at 81 FR 13663-13665, March 14, 2016.

97.  For more information, see the preamble of the proposed rulemaking at 81 FR 13665-13666, March 14, 2016.

98.  See 61 FR 31700, June 20, 1996.

99.  https://www.regulations.gov/​document?​D=​EPA-HQ-OEM-2015-0725-0143.

100.  https://www.regulations.gov/​document?​D=​VEPA-HQ-OEM-2015-0725-0147, https://www.regulations.gov/​document?​D=​EPA-HQ-OEM-2015-0725-0148, and https://www.regulations.gov/​document?​D=​EPA-HQ-OEM-2015-0725-0149.

101.  https://www.regulations.gov/​document?​D=​EPA-HQ-OEM-2015-0725-0450.

102.  CCPS. 2009, Inherently Safer Chemical Processes: A Life Cycle Approach. 2nd ed., https://www.regulations.gov/​document?​D=​EPA-HQ-OEM-2015-0725-0253;​ CCPS. July 2010. Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage, and Use, https://www.regulations.gov/​document?​D=​EPA-HQ-OEM-2015-0725-0274;​ Contra Costa Hazardous Materials Program. June 15, 2011. Industrial Safety Ordinance Guidance Document, Attachment C—Inherently Safer Systems Checklist. Contra Costa County Health Services, Martinez, CA, https://www.regulations.gov/​document?​D=​EPA-HQ-OEM-2015-0725-0146;​ NJDEP. January 15, 2015. Guidance for Toxic Catastrophe Prevention Act (TCPA), Inherently Safer Technology (IST), https://www.regulations.gov/​document?​D=​EPA-HQ-OEM-2015-0725-0142.

103.  http://www.hse.gov.uk/​risk/​theory/​alarpglance.htm.

104.  CCPS. 2007. Guidelines for Risk Based Process Safety. American Institute of Chemical Engineers, CCPS, NY, Wiley. Chapter 9—Hazard Identification and Risk Analysis.

105.  National Research Council of the National Academy of Sciences, The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience, 2012. https://www.nap.edu/​catalog/​13385/​the-use-and-storage-of-methyl-isocyanate-mic-at-bayer-cropscience.

106.  National Research Council, The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience, at 4-53 (2012).

107.  https://www.osha.gov/​chemicalexecutiveorder/​LLIS/​index.html.

108.  See ATF Announces $50,000 Reward in West, Texas Fatality Fire, https://www.atf.gov/​news/​pr/​atf-announces-50000-reward-west-texas-fatality-fire.

109.  See preamble discussion in proposed rulemaking, 81 FR 13671, March 14, 2016.

110.  2008 Nationwide Survey of Local Emergency Planning Committees (LEPCs). https://www.epa.gov/​epcra/​nationwide-survey-local-emergency-planning-committees.

111.  Executive Order 13650 Actions to Improve Chemical Facility Safety and Security—A Shared Commitment, May 2014. https://www.osha.gov/​chemicalexecutiveorder/​final_​chemical_​eo_​status_​report.pdf.

112.  CSB. January 2016. Final Investigation Report, West Fertilizer Company Fire and Explosion, West, TX, April 17, 2013. Report 2013-02-I-TX, pgs. 201-203, 242. http://csb.gov/​west-fertilizer-explosion-and-fire-/​.

113.  CSB. January 2011. Investigation Report: Pesticide Chemical Runaway Reaction Pressure Vessel Explosion, Bayer CropScience, LP, Institute, West Virginia, August 28, 2008. Report No. 2008-08-I-WV, http://www.csb.gov/​assets/​1/​19/​Bayer_​Report_​final.pdf.

114.  CSB. July 10, 2007. CSB News Release: CSB Chairman Merritt Describes the Lessons from Five Years of Board Investigations to Senate Committee, Urges Additional Resources and Clearer Authorities for Federal Safety Efforts. http://www.csb.gov/​csb-chairman-merritt-describes-the-lessons-from-five-years-of-board-investigations-to-senate-committee-urges-additional-resources-and-clearer-authorities-for-federal-safety-efforts/​.

115.  Community members can include a wide variety of stakeholders that work or live near an RMP-regulated facility.

116.  https://echo.epa.gov/​?redirect=​echo.

117.  For more information on CBI, see Chapter 9 of the General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR part 68), March 2009. https://www.epa.gov/​sites/​production/​files/​2013-11/​documents/​chap-09-final.pdf.

118.  Chemical Safety Information, Site Security and Fuels Regulatory Relief Act, Public Law 106-40, August 5, 1999. See http://www.gpo.gov/​fdsys/​pkg/​STATUTE-113/​pdf/​STATUTE-113-Pg207.pdf.

119.  OSHA Fact Sheet—Hazard Communication Standard Final Rule. https://www.osha.gov/​dsg/​hazcom/​HCSFactsheet.html.

120.  General Guidance for Facilities on Risk Management Programs for Chemical Accident Prevention (40 CFR part 68), March 2009. https://www.epa.gov/​rmp/​guidance-facilities-risk-management-programs-rmp.

121.  EPA used the term “feasible” rather than “practicability” in the proposed rulemaking.

122.  See ATF Announces $50,000 Reward in West, Texas Fatality Fire, https://www.atf.gov/​news/​pr/​atf-announces-50000-reward-west-texas-fatality-fire.

123.  For more information on the Executive Order see https://www.whitehouse.gov/​the-press-office/​2013/​08/​01/​executive-order-improving-chemical-facility-safety-and-security.

124.  EPA, 2016. Regulatory Impact Analysis—Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act, Section 112(r)(7). Exhibit 7-9.

125.  SERs suggested other accreditations including: degreed chemists, degreed chemical engineers, Certified Safety Professionals (CSP), Certified Industrial Hygienists (CIH), Certified Fire Protection Specialists (CFPS), Certified Hazardous Materials Managers (CHMM), Certified Professional Environmental Auditors (CPEA) or Certified Process Safety Auditors (CPSA).

126.  CCPS. 2009. Inherently Safer Chemical Processes: A Life Cycle Approach, 2nd ed., American Institute of Chemical Engineers, CCPS New York, Wiley, p. 25.

127.  https://www.regulations.gov/​document?​D=​EPA-HQ-OEM-2015-0725-0425.

128.  EPA-HQ-OEM-2015-0725-0419.