[Federal Register Volume 70, Number 52 (Friday, March 18, 2005)]
[Rules and Regulations]
[Pages 13242-13292]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 05-5063]



[[Page 13241]]

-----------------------------------------------------------------------

Part II





Department of Agriculture





-----------------------------------------------------------------------



Animal and Plant Health Inspection Service



-----------------------------------------------------------------------



7 CFR Part 331 and 9 CFR Part 121



Agricultural Bioterrorism Protection Act of 2002; Possession, Use, and 
Transfer of Biological Agents and Toxins; Final Rule

  Federal Register / Vol. 70, No. 52 / Friday, March 18, 2005 / Rules 
and Regulations  

[[Page 13242]]


-----------------------------------------------------------------------

DEPARTMENT OF AGRICULTURE

Animal and Plant Health Inspection Service

7 CFR Part 331 and 9 CFR Part 121

[Docket No. 02-088-4]
RIN 0579-AB47


Agricultural Bioterrorism Protection Act of 2002; Possession, 
Use, and Transfer of Biological Agents and Toxins

AGENCY: Animal and Plant Health Inspection Service, USDA.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: We are adopting as a final rule, with changes, an interim rule 
that established regulations governing the possession, use, and 
transfer of biological agents and toxins that have been determined to 
have the potential to pose a severe threat to public health and safety, 
to animal health, to plant health, or to animal or plant products. This 
action is necessary to protect animal and plant health, and animal and 
plant products.

DATES: Effective Date: The amendments to the list of PPQ select agents 
and toxins in 7 CFR 331.3(b) are effective March 10, 2005. The 
remaining provisions of this final rule are effective April 18, 2005.

FOR FURTHER INFORMATION CONTACT: For information concerning the 
regulations in 7 CFR part 331, contact Dr. Charles L. Divan, Senior 
Agricultural Microbiologist, Pest Permit Evaluations, Biological and 
Technical Services, PPQ, APHIS, 4700 River Road Unit 133, Riverdale, MD 
20737-1236, (301) 734-8758.
    For information concerning the regulations in 9 CFR part 121, 
contact Dr. Lee Ann Thomas, Director, Animals, Organisms and Vectors, 
and Select Agents, VS, APHIS, 4700 River Road Unit 2, Riverdale, MD 
20737-1231, (301) 734-5960.

SUPPLEMENTARY INFORMATION:

Background

    On June 12, 2002, the President signed into law the Public Health 
Security and Bioterrorism Preparedness and Response Act of 2002 (Pub. 
L. 107-188). Title II of Pub. L. 107-188, ``Enhancing Controls on 
Dangerous Biological Agents and Toxins'' (sections 201 through 231), 
provides for the regulation of certain biological agents and toxins by 
the Department of Health and Human Services (subtitle A, sections 201-
204) and the Department of Agriculture (subtitle B, sections 211-213), 
and provides for interagency coordination between the two departments 
regarding overlap agents and toxins (subtitle C, section 221). Subtitle 
D (section 231) provides for criminal penalties regarding certain 
biological agents and toxins. For the Department of Health and Human 
Services, the Centers for Disease Control and Prevention (CDC) has been 
designated as the agency with primary responsibility for implementing 
the provisions of the Act; the Animal and Plant Health Inspection 
Service (APHIS) is the agency fulfilling that role for the Department 
of Agriculture (USDA). The Criminal Justice Information Services (CJIS) 
Division of the Federal Bureau of Investigation has been designated as 
the agency with primary responsibility for implementing the Attorney 
General's responsibilities under the Act (i.e., the security risk 
assessments).
    In subtitle B (which is cited as the ``Agricultural Bioterrorism 
Protection Act of 2002'' and referred to below as the Act ), section 
212(a) provides, in part, that the Secretary of Agriculture (the 
Secretary) must establish by regulation a list of each biological agent 
and each toxin that the Secretary determines has the potential to pose 
a severe threat to animal or plant health, or to animal or plant 
products. The Act further requires (under section 213(b)) that all 
persons in possession of any listed biological agent or toxin must, 
within 60 days of the publication of that regulation, notify the 
Secretary of such possession.
    In accordance with these statutory requirements, on August 12, 
2002, we published in the Federal Register (67 FR 52383-52389, Docket 
No. 02-082-1) an interim rule that established the initial lists of 
biological agents and toxins and set out the manner in which persons in 
possession of listed agents and toxins were to provide notice of such 
possession.
    Section 212 of the Act also required the Secretary to provide by 
regulation for the establishment and enforcement of standards and 
procedures governing the possession, use, and transfer of listed 
biological agents and toxins in order to protect animal and plant 
health, and animal and plant products. Specifically, sections 212(b) 
and (c) required that the Secretary:
     Establish and enforce safety procedures for listed agents 
and toxins, including measures to ensure proper training and 
appropriate skills to handle agents and toxins, and proper laboratory 
facilities to contain and dispose of agents and toxins;
     Establish and enforce safeguard and security measures to 
prevent access to listed agents and toxins for use in domestic or 
international terrorism or for any other criminal purpose;
     Establish procedures to protect animal and plant health, 
and animal and plant products, in the event of a transfer or potential 
transfer of a listed agent or toxin in violation of the safety 
procedures and safeguard and security measures established by the 
Secretary; and
     Ensure appropriate availability of biological agents and 
toxins for research, education, and other legitimate purposes.
    In an interim rule published in the Federal Register on December 
13, 2002 (67 FR 76908-76938, Docket No. 02-088-1) and effective on 
February 11, 2003, we established regulations in 7 CFR part 331 and 9 
CFR part 121 governing the possession, use, and transfer of biological 
agents and toxins that have been determined to have the potential to 
pose a severe threat to both human and animal health, to animal health, 
to plant health, or to animal or plant products. These CFR parts are 
referred to below as the regulations. We solicited comments concerning 
the interim rule for 60 days ending February 11, 2003. We received 36 
written comments. They were from academic institutions, professional 
associations, corporations, nonprofit organizations, individuals, and 
representatives of State and Federal Governments. These comments, as 
well as oral comments presented at a public meeting on December 16, 
2002, are discussed by topic below.
    Also on December 13, 2002, CDC published in the Federal Register 
(67 FR 76886-76905) an interim rule that established the standards and 
procedures governing the possession, use, and transfer of certain 
biological agents and toxins (referred to by CDC as select agents and 
toxins) (42 CFR part 73).
    On November 3, 2003, APHIS and CDC published in the Federal 
Register (68 FR 62218-62221, Docket No. 02-088-3; and 68 FR 62245-
62247) interim rules that amended both agencies' regulations in order 
to allow for the issuance of provisional registration certificates for 
individuals and entities and provisional grants of access to listed 
biological agents and toxins for individuals. These provisional 
measures provided additional time for the Attorney General to complete 
security risk assessments for those individuals and entities for which 
the Attorney General received, by November 12, 2003, all of the 
information required to conduct a security risk assessment. We 
solicited comments concerning the

[[Page 13243]]

interim rules for 60 days ending January 2, 2004. We did not receive 
any comments by that date.
    APHIS and CDC collaborated closely on the December 13, 2002, and 
November 3, 2003, interim rules, as well as on this final rule and 
CDC's final rule also issued in today's Federal Register. Below is a 
summary of the changes we are making to the regulations in this final 
rule. We refer to the regulations in place prior to the effective date 
of this final rule as the ``interim'' regulations, or ``interim'' 7 CFR 
331.4, for example, when we need to distinguish between the regulations 
established by the interim rules of December 2002 and November 2003 and 
this final rule.

Summary of Changes Made in Final Rule

    1. We are revising the format of the regulations in 7 CFR part 331 
and 9 CFR part 121 so that the sections numbers and, to the extent 
possible, the section titles and the information contained in each 
section is the same in 7 CFR part 331, 9 CFR part 121, and 42 CFR part 
73.
    2. We are changing the terms ``biological agents and/or toxins,'' 
``listed agents and/or toxins,'' and ``high consequence livestock 
pathogens'' to ``select agents and toxins'' or ``select agents or 
toxins'' throughout 7 CFR part 331 and 9 CFR part 121. In addition, in 
9 CFR part 121, we are removing the term ``overlap agents'' each time 
it appears and adding ``overlap select agents and/or toxins'' in its 
place.
    3. We are changing the title of 7 CFR part 331 and 9 CFR part 121 
from ``Possession, Use, and Transfer of Biological Agents and Toxins'' 
to ``Possession, Use, and Transfer of Select Agents and Toxins.''
    4. We are removing Phakopsora pachyrhizi and plum pox potyvirus 
from the list of PPQ select agents and toxins.
    5. We are removing Newcastle disease virus (VVND) from the list of 
VS select agents and toxins and adding Newcastle disease virus 
(velogenic) in its place to make it clear that we are regulating all of 
the velogenic strains.
    6. We are removing Clostridium botulinum from the list of overlap 
select agents and toxins but we are continuing to list Botulinum 
neurotoxin producing species of Clostridium.
    7. We are adopting CDC's approach for genetic elements and, 
therefore, we will consider the following to be select agents and 
toxins:
     Nucleic acids that can produce infectious forms of any of 
the select agent viruses listed in either 7 CFR part 331 or 9 CFR part 
121;
     Recombinant nucleic acids that encode for the functional 
forms of any toxin listed in either 7 CFR part 331 or 9 CFR part 121 if 
the nucleic acids: (1) Can be expressed in vivo or in vitro; or (2) are 
in a vector or recombinant host genome and can be expressed in vivo or 
in vitro; and
     Select agents and toxins listed in either 7 CFR part 331 
or 9 CFR part 121 that have been genetically modified.
    8. We are broadening the scope of the overlap toxin exclusion to 
cover overlap toxins under the control of a principal investigator, 
treating physician or veterinarian, or commercial manufacturer or 
distributor.
    9. We are amending the exemption provisions by requiring, as 
another condition of exemption, that the select agent or toxin be 
secured against theft, loss, or release during the period between 
identification of the agent or toxin and transfer or destruction of 
such agent or toxin.
    10. We are amending the exemption provisions in 9 CFR part 121 by 
requiring immediate reporting after identification of specified select 
agents and toxins; identification of the other select agents and toxins 
must be reported within 7 calendar days after identification.
    11. We are amending the exemption provisions to allow the 
Administrator to make exceptions to the timeframes for transfer or 
destruction of a select agent or toxin, as necessary.
    12. We are amending the registration sections to set out a new 
framework for submitting registration applications to APHIS or CDC.
    13. We are amending the registration sections in 7 CFR part 331 and 
9 CFR part 121 to provide:
     Federal, State, or local governmental agencies, including 
public institutions of higher education, are exempt from the security 
risk assessment for the entity and the individual who owns or controls 
such entity.
     For a private institution of higher education, an 
individual will be deemed to own or control the entity if the 
individual is in a managerial or executive capacity with regard to the 
entity's select agents or toxins or with regard to the individuals with 
access to the select agents or toxins possessed, used, or transferred 
by the entity.
     For entities other than institutions of higher education, 
an individual will be deemed to own or control the entity if the 
individual: (1) Owns 50 percent or more of the entity, or is a holder 
or owner of 50 percent or more of its voting stock; or (2) is in a 
managerial or executive capacity with regard to the entity's select 
agents or toxins or with regard to the individuals with access to the 
select agents or toxins possessed, used, or transferred by the entity.
     An entity will be considered to be an institution of 
higher education if it is an institution of higher education as defined 
in section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 
1001(a)), or is an organization described in 501(c)(3) of the Internal 
Revenue Code of 1986, as amended (26 U.S.C. 501(c)(3)).
    14. We are amending the registration sections to provide that a 
certificate of registration will be valid for one physical location (a 
room, a building, or a group of buildings) where the responsible 
official will be able to perform the responsibilities required in this 
part, for specific select agents or toxins, and for specific 
activities.
    15. We are amending the registration sections to require that, 
prior to any change, the responsible official must apply for an 
amendment to a certificate of registration by submitting the relevant 
page(s) of the registration application.
    16. We are amending the registration sections to provide that an 
entity must immediately notify APHIS or CDC if it loses the services of 
its responsible official. An entity may continue to possess or use 
select agents or toxins only if it appoints as the responsible official 
another individual who has been approved by the Administrator or the 
HHS Secretary following a security risk assessment by the Attorney 
General and who meets the requirements of the regulations.
    17. We are amending the sections pertaining to denial, revocation, 
and suspension of registration by requiring that, upon notification of 
suspension or revocation, an individual or entity must:
     Immediately stop all use of each select agent or toxin 
covered by the revocation or suspension order;
     Immediately safeguard and secure each select agent or 
toxin covered by the revocation or suspension order from theft, loss, 
or release; and
     Comply with all disposition instructions issued by the 
Administrator for each select agent or toxin covered by the revocation 
or suspension.
    18. We are amending the responsible official sections to require 
the responsible official to report the identification and final 
disposition of any select agent or toxin contained in a specimen 
presented for diagnosis or verification. We are also amending the 
responsible official section in 9 CFR 121.9 to require the responsible 
official to report the identification and final disposition of any 
select agent or toxin

[[Page 13244]]

contained in a specimen presented for proficiency testing.
    19. We are amending the provisions relating to access approvals to 
state that an individual will be deemed to have access at any point in 
time if the individual has possession of a select agent or toxin (e.g., 
carries, uses, or manipulates) or the ability to gain possession of a 
select agent or toxin.
    20. We are amending the provisions pertaining to access approval to 
provide that an individual's access approval may be revoked if the 
individual is within any of the categories specified in the 
regulations.
    21. We are amending the security sections to clarify that the 
security plan must be sufficient to safeguard the select agent or toxin 
against unauthorized access, theft, loss, or release.
    22. We are adding the provisions for restricted experiments to 7 
CFR part 331 and we are amending these provisions in 7 CFR part 331 and 
9 CFR part 121 to indicate that these experiments must be conducted 
under any conditions prescribed by the Administrator.
    23. We are amending the training sections to require that 
information and training on biocontainment/biosafety and security be 
provided to each individual with access approval from the Administrator 
or the HHS Secretary before he/she has access and to each individual 
not approved for access by the Administrator or the HHS Secretary 
before he/she works in or visits areas where select agents or toxins 
are handled or stored (e.g., laboratories, growth chambers, animal 
rooms, greenhouses, storage areas, etc.).
    24. We are amending the transfer section in 9 CFR 121.16 to set out 
the requirements for transfer of a select agent or toxin contained in a 
specimen for proficiency testing.
    25. We are amending the transfer sections to provide that, on a 
case-by-case basis, the Administrator may authorize a transfer of a 
select agent or toxin not otherwise eligible for transfer under the 
regulations under conditions prescribed by the Administrator.
    26. We are amending the transfer sections to provide that an 
authorization for a transfer shall be valid only for 30 calendar days 
after issuance, except that such an authorization becomes immediately 
null and void if any facts supporting the authorization changes (e.g., 
change in the certificate of registration for the sender or recipient, 
change in the application for transfer).
    27. We are amending the records sections to require the maintenance 
of an accurate, current inventory for each toxin held and for each 
select agent held in long-term storage (placement in a system designed 
to ensure viability for future use, such as in a freezer or lyophilized 
materials).
    28. We are amending the section pertaining to notification of 
theft, loss, or release in 7 CFR part 331 to require that APHIS or CDC 
be notified immediately upon discovery of a release of a select agent 
or toxin outside of the primary barriers of the biocontainment area and 
we are amending this section in 9 CFR part 121 to require that APHIS or 
CDC be notified immediately upon discovery of a release of a select 
agent or toxin causing occupational exposure or a release outside of 
the primary barriers of the biocontainment area.
    29. We are amending the administrative review sections to allow an 
individual to appeal revocation of access approval.

Format of the Regulations

    APHIS and CDC are revising the format of the regulations in the 
final rules so that the section numbers and, to the extent possible, 
the section titles and the information contained in each section is the 
same in 7 CFR part 331, 9 CFR part 121, and 42 CFR part 73. These 
changes should make the regulations easier to use and facilitate 
compliance. The chart below sets out the format of 7 CFR part 331 and 9 
CFR part 121 set by the interim rules (interim regulations) and the new 
format for the regulations in 7 CFR part 331 and 9 CFR part 121 (final 
rule).

------------------------------------------------------------------------
          Interim regulations                       Final rule
------------------------------------------------------------------------
331.0 Effective and applicability dates
121.0 Effective and applicability dates
331.1 Definitions......................  331.1 Definitions.
121.1 Definitions......................  121.1 Definitions.
331.2 Purpose and scope................  331.2 Purpose and scope.
121.2 Purpose and scope................  121.2 Purpose and scope.
331.3 List of biological agents and      331.3 PPQ select agents and
 toxins.                                  toxins.
121.3 List of biological agents and      121.3 VS select agents and
 toxins.                                  toxins.
331.4 Exemptions.......................  331.4 [Reserved].
121.4 Exemptions for overlap agents or   121.4 Overlap select agents and
 toxins.                                  toxins.
331.5 Registration; who must register..  331.5 Exemptions.
121.5 Exemptions for animal agents and   121.5 Exemptions for VS select
 toxins.                                  agents and toxins.
331.6 Registration; general provisions.  331.6 [Reserved]
121.6 Registration; who must register..  121.6 Exemptions for overlap
                                          select agents and toxins.
331.7 Denial, revocation, or suspension  331.7 Registration and related
 of registration.                         security risk assessments.
121.7 Registration; general provisions.  121.7 Registration and related
                                          security risk assessments.
331.8 Registration; how to register....  331.8 Denial, revocation, or
                                          suspension of registration.
121.8 Denial, revocation, or suspension  121.8 Denial, revocation, or
 of registration.                         suspension of registration.
331.9 Responsibilities of the            331.9 Responsible official.
 responsible official.
121.9 Registration; how to register....  121.9 Responsible official.
331.10 Restricting access to biological  331.10 Restricting access to
 agents and toxins.                       select agents and toxins;
                                          security risk assessments.
121.10 Responsibilities of the           121.10 Restricting access to
 responsible official.                    select agents and toxins;
                                          security risk assessments.
331.11 Biocontainment and security plan  331.11 Security.
121.11 Restricting access to biological  121.11 Security.
 agents and toxins.
331.12 Training........................  331.12 Biocontainment.
121.12 Biosafety and security plan.....  121.12 Biosafety.
331.13 Transfer of biological agents     331.13 Restricted experiments.
 and toxins.
121.13 Training........................  121.13 Restricted experiments.
331.14 Records.........................  331.14 Incident response.
121.14 Transfer of biological agents     121.14 Incident response.
 and toxins.
331.15 Inspections.....................  331.15 Training.

[[Page 13245]]

 
121.15 Records.........................  121.15 Training.
331.16 Notification in the event of      331.16 Transfers.
 theft, loss, or release of a
 biological agent or toxin.
121.16 Inspections.....................  121.16 Transfers.
331.17 Administrative review...........  331.17 Records.
121.17 Notification in the event of      121.17 Records.
 theft, loss, or release of a
 biological agent or toxin.
121.18 Administrative review...........  331.18 Inspections.
                                         121.18 Inspections.
                                         331.19 Notification of theft,
                                          loss, or release.
                                         121.19 Notification of theft,
                                          loss, or release.
                                         331.20 Administrative review.
                                         121.20 Administrative review.
------------------------------------------------------------------------

General Comments

    A commenter suggested that APHIS and CDC adopt consistent 
terminology when referring to biological agents and toxins. The 
commenter pointed out that the regulations use the following terms: 
biological agents and toxins, select agents and toxins, overlap agents, 
and high consequence pathogens.
    We agree that APHIS and CDC should use consistent terminology. 
Therefore, in this final rule, we are removing the terms ``biological 
agents and/or toxins,'' ``listed agents and/or toxins,'' and ``high 
consequence livestock pathogens'' each time they appear in 7 CFR part 
331 and/or 9 CFR part 121 and adding ``select agents and/or toxins'' in 
their place. In addition, in 9 CFR part 121, we are removing the term 
``overlap agents'' each time it appears and adding ``overlap select 
agents and/or toxins'' in its place. To reflect this change in 
terminology, we are also changing the title of both parts from 
``Possession, Use, and Transfer of Biological Agents and Toxins'' to 
``Possession, Use, and Transfer of Select Agents and Toxins.'' In 
accordance with these changes, we will be using the term ``select agent 
and/or toxin'' throughout the preamble of this rule. When it is 
necessary to specify the type of select agent or toxin, we will use the 
following terms: ``PPQ select agent and/or toxin'' (for the plant 
agents and toxins), ``VS select agent and/or toxin'' (for the animal 
agents and toxins), or ``overlap select agent and/or toxin.'' Unless 
otherwise specified, the term ``select agent and/or toxin'' will refer 
to all agents or toxins listed by APHIS.
    One commenter stated that APHIS and CDC should harmonize the 
regulations and provide consistent guidance to entities. This commenter 
also recommended close collaboration between the agencies for 
registration, enforcement, and compliance assistance. Another commenter 
recommended that APHIS and CDC establish one regulatory and reporting 
mechanism and one office of compliance assistance and enforcement in 
order to enhance coordination between APHIS and CDC.
    We agree that APHIS and CDC should harmonize the regulations and 
provide consistent guidance to entities. APHIS and CDC have worked 
closely together to identify and resolve differences between the 
regulations. This final rule is consistent with CDC's final rule in 
both structure and substance. APHIS and CDC have also established 
procedures that will allow an entity to interact with only one agency--
either APHIS or CDC--with respect to most matters involving select 
agents and toxins. These changes will ensure the close coordination of 
APHIS and CDC and create a uniform and consistent approach to the 
regulation of select agents and toxins. APHIS and CDC are also 
developing a single shared web-based system that will allow the 
regulated community to conduct transactions electronically with APHIS 
and CDC via a single web portal. By providing a single web portal, 
APHIS and CDC will be able to interact efficiently and effectively with 
the regulated community while reducing the burden on the public. We 
envision that this system will enable the entity to dynamically 
communicate with APHIS and CDC in a digitally secured environment using 
a single web portal. The web portal will provide a platform for 
electronic exchange of information. It will allow entities to access 
data related to their own registration data and allow them to create, 
amend, and submit registration applications; requests for approvals for 
transfers, exemptions, or exclusions; and any other required forms 
without the need to print, mail, or e-mail hard copies. Hard copy 
registration materials and other required forms will still be accepted. 
The single web portal will be available in winter 2005.
    A number of commenters expressed concern about the effect of the 
regulations on the scientific community. Several commenters stated that 
the regulations will limit the free exchange of scientific information 
and make it difficult to recruit foreign researchers and technical 
workers in areas of short supply in the United States. Several 
commenters asserted that the costs of the regulations (especially the 
security requirements) will result in the termination of important 
research projects and the destruction of specimens. One commenter 
stated that research programs will be terminated because researchers 
will not want to deal with the new regulatory requirements or their 
institutions will not want to be liable for violations of the 
regulations. This commenter also noted that the costs of adhering to 
the regulations will limit the money available for the research. 
Another commenter stated that scientists will end up spending more time 
dealing with bureaucratic requirements rather than working in the 
laboratory or supervising their employees.
    The Act requires the Secretary to establish, by regulation, 
standards and procedures governing the possession, use, and transfer of 
listed biological agents and toxins in order to protect animal and 
plant health, and animal and plant products. In an interim rule 
published in the Federal Register on December 13, 2002, and effective 
on February 11, 2003, APHIS established the regulations required under 
the Act. To date, the commenters' concerns about the costs or 
difficulties of complying with the regulations have failed to 
materialize. Accordingly, we are making no changes in response to these 
comments.
    Several commenters requested that APHIS and CDC create a grant 
program to assist entities with the costs of implementing the security 
requirements.
    At this time APHIS is unable to assist entities with the costs of 
implementing the security requirements because

[[Page 13246]]

Congress has not appropriated any funds to establish such a grant 
program. Accordingly, we are making no change based on these comments.
    One commenter requested that APHIS specify in the final rule that 
it is the regulatory agency for the veterinary biologics industry.
    An entity in the veterinary biologics industry may be regulated by 
APHIS and/or CDC, depending on the agent or toxin that it possesses, 
uses, or transfers--overlap select agents and toxins are regulated by 
both APHIS and CDC, while VS select agents and toxins are regulated 
only by APHIS. For this reason, we are making no change in response to 
this comment.
    A commenter stated that the regulations should be revoked and 
replaced with prohibitions on owning, working with, or importing any of 
the agents or products. This commenter recommended that the penalty for 
possession of a select agent be a fine of $500,000 or imprisonment for 
up to 25 years.
    The Act does not authorize APHIS to prohibit the possession, use, 
or transfer of biological agents and toxins. Rather, section 212 of the 
Act directs APHIS to establish, by regulation, standards and procedures 
governing the possession, use, and transfer of biological agents and 
toxins that have been determined to have the potential to pose a severe 
threat to both human and animal health, to animal health, to plant 
health, or to animal or plant products. The Act also sets forth the 
civil and criminal penalties for violations of the Act. For these 
reasons, we are making no changes based on this comment.
    One commenter warned of the potential for international travelers 
to bring biological ``suitcase bombs'' into the United States from 
countries with bovine spongiform encephalopathy, foot-and-mouth 
disease, or other exotic animal disease pathogens.
    This commenter appears to be concerned about the introduction of 
animal disease pathogens into the United States in the luggage of 
international travelers. This comment is outside the scope of this 
rulemaking. However, we note that VS select agents or toxins and 
overlap select agents or toxins may only be imported into the United 
States in accordance with 9 CFR parts 121 and 122. We are making no 
change based on this comment.

Protection of Information Collected by APHIS

    Several commenters expressed concern about APHIS' ability to 
protect the information collected under the regulations. One commenter 
asked how APHIS would store and protect the information collected. 
Another commenter stated that USDA should ensure that the information 
collected is not available through Freedom of Information Act requests.
    Section 212(h) of the Act sets forth the requirements relating to 
the disclosure of information by APHIS and other Federal agencies. 
Specifically, section 212(h)(1) provides that the specified Federal 
agencies may not disclose under 5 U.S.C. 552 any of the following: (1) 
Any registration or transfer documentation, permits issued prior to the 
enactment of the Act, or information derived therefrom to the extent 
that it identifies the agent or toxin possessed, used, or transferred 
by a specific person or discloses the identity or location of a 
specific person; (2) the national database or any other compilation of 
the registration or transfer information to the extent that such 
compilation discloses site-specific registration or transfer 
information; (3) any portion of a record that discloses the site-
specific or transfer-specific safeguard and security measures used by a 
registered person to prevent unauthorized access to agents and toxins; 
(4) any notification of a theft, loss, or release of an agent or toxin; 
and (5) any portion of an evaluation or report of an inspection of a 
specific registered person that identifies the agent or toxin possessed 
by a specific registered person if the agency determines that public 
disclosure of the information would endanger animal or plant health, or 
animal or plant products. We believe the Act provides sufficient 
protection for the information collected under the regulations. 
Accordingly, we are making no changes based on these comments.
    A commenter stated the rule should explicitly state that the 
security risk assessment is confidential.
    As previously noted, we believe the Act provides sufficient 
protection for the information collected under the regulations. We do 
not believe it is necessary to state in the regulations that the 
security risk assessment is confidential. Therefore, we are making no 
change based on this comment.
    Another commenter asserted that the information collected by APHIS 
for the security risk assessment should not be used more broadly than 
to determine who is a ``restricted person.'' The commenter noted that 
California State law prohibits discrimination in employment based upon 
citizenship and prohibits the disclosure of citizenship information to 
a third party in a manner that links that information to the 
individual, except in limited and compelling circumstances. The 
commenter expressed concern that the data collected for registration or 
a security risk assessment might be used inappropriately by a Federal 
agency to assess a proposal for funding. The commenter recommended that 
APHIS, CDC, and the Department of Justice take steps to ensure the 
security and confidentiality of submitted information.
    In accordance with the Act, the information submitted by an 
individual as part of a security risk assessment may only be used to 
determine if an individual is a restricted person under 18 U.S.C. 175b 
or is reasonably suspected by any Federal law enforcement or 
intelligence agency of (1) committing a crime set forth in 18 U.S.C. 
2332b(g)(5), (2) knowing involvement with an organization that engages 
in domestic or international terrorism (as defined in 18 U.S.C. 2331) 
or with any other organization that engages in intentional crimes of 
violence, or (3) being an agent of a foreign power as defined in 50 
U.S.C. 1801. We believe that the Act and other applicable Federal laws, 
such as the Privacy Act, are sufficient to ensure the confidentiality 
of the submitted information. We are making no change in response to 
this comment.
    A commenter asked how APHIS inspectors will mark and protect their 
inspection reports. APHIS inspection reports and related documents will 
be protected in accordance with the Act and agency and departmental 
policies.

Economic Impact

    Several commenters argued that the costs of compliance were grossly 
understated in the economic analysis for the December 2002 interim 
rule. One commenter stated that the one-time cost to retrofit existing 
facilities will easily exceed $1 million and that recurring annual 
costs could top $100,000.
    Although the commenter didn't specify, we believe that the 
commenter is referring to the costs to upgrade security. In our 
December 2002 economic analysis, we provided estimates of the costs of 
the interim security requirements. However, we noted that these 
estimates may not apply to every entity due to the diversity in 
existing security levels and security needs, as well as the various 
methods of meeting the interim security requirements. In the economic 
analysis in this final rule, we reiterate that the costs to comply with 
the security requirements are site specific and will vary accordingly.
    Another commenter stated that the interim rule ignored or grossly 
underestimated financial costs,

[[Page 13247]]

including the costs of verifying the baseline inventory and the costs 
of responding to lost vial reports. The commenter estimated that the 
one-time cost to verify the baseline inventory will be $2 million with 
recurring costs of about $1 million per year. The commenter also 
estimated that it will cost about $5 million per year to respond to 
reports of lost vials of select agents because the response would 
require, at least, a verification of the inventory.
    In response to this comment, the economic analysis in this final 
rule provides more information about the costs of the inventory 
recordkeeping requirements. In this final rule, we estimate that it 
would cost an entity $7,200 to create a baseline inventory (assuming an 
average of 10 freezers and 3 toxin containers per entity). Assuming 
that registered entities would have to re-inventory one-half of their 
freezers each year to maintain an accurate and current inventory, we 
estimate the total yearly inventory cost for all affected entities to 
be $274,000. Finally, in the event of a theft or loss, we expect an 
entity would conduct an inventory of the affected storage freezer or 
toxin container. We estimate that such an inventory would cost $560 per 
occurrence.

Effective and Applicability Dates

    Interim 7 CFR 331.0 and 9 CFR 121.0 provided that the regulations 
in each part became effective on February 11, 2003. To minimize the 
disruption of research or educational projects, both sections also 
provided additional time for individuals and entities to reach full 
compliance with the regulations in each part (i.e., a phase-in period). 
Finally, as established in the November 3, 2003, interim rule, both 
sections provided for the issuance of provisional certificates of 
registration and provisional grants of access for individuals under 
certain conditions.
    A number of commenters requested clarification of the provisions 
for the phase-in period and several commenters requested additional 
time to comply with certain provisions. Given that all of the dates in 
7 CFR 331.0 and 9 CFR 121.0 have passed, the sections are no longer 
applicable and the issues raised by the commenters are moot. 
Accordingly, in this final rule, we are removing 7 CFR 331.0 and 9 CFR 
121.0.

Definitions

    In 7 CFR 331.1 and 9 CFR 121.1, we define the terms used in the 
regulations. We are adding definitions of diagnosis and verification in 
both sections in this final rule. Diagnosis is defined as ``the 
analysis of specimens for the purpose of identifying or confirming the 
presence or characteristics of a select agent or toxin provided that 
such analysis is directly related to protecting the public health or 
safety, animal health or animal products, or plant health or plant 
products.'' Verification is defined as ``the demonstration of obtaining 
established performance (e.g., accuracy, precision, and the analytical 
sensitivity and specificity) specifications for any procedure used for 
diagnosis.'' In addition, in 9 CFR 121.1, we are amending the 
definition of proficiency testing. Proficiency testing is defined as 
``the process of determining the competency of an individual or 
laboratory to perform a specified test or procedure.'' Finally, we are 
deleting the definition for diagnostic laboratory in both sections and 
we are deleting the definition for clinical laboratory in 9 CFR 121.1. 
These changes will clarify the exemption provisions and help to ensure 
that APHIS and CDC consistently apply these provisions.
    To be consistent with CDC's definitions, we are adopting CDC's 
definitions for HHS Secretary and HHS select agent and/or toxin in both 
sections in this final rule. HHS Secretary is defined as ``the 
Secretary of the Department of Health and Human Services or his or her 
designee, unless otherwise specified.'' HHS select agent and/or toxin 
is defined as ``a biological agent or toxin listed in 42 CFR 73.3.''
    A commenter suggested that APHIS and CDC adopt consistent 
terminology when referring to biological agents and toxins. As 
previously noted, in this final rule we are adopting the terms ``select 
agents and/or toxins'' and ``overlap select agents and/or toxins.'' To 
reflect this change in terminology, we are adding several additional 
definitions to the regulations.
    In 7 CFR 331.1 and 9 CFR 121.1, we are adding a definition for the 
term select agent and/or toxin. However, due to differences between the 
plant-related regulations in 7 CFR part 331 and the animal-related 
regulations in 9 CFR part 121, the term select agent and/or toxin is 
defined differently in both parts. In 7 CFR 331.1, select agent and/or 
toxin is defined as ``a biological agent or toxin listed in Sec.  
331.3'' while in 9 CFR 121.1 it is defined as ``unless otherwise 
specified, all of the biological agents and toxins listed in Sec. Sec.  
121.3 and 121.4.'' The latter definition takes into account the fact 
that overlap select agents and toxins are also regulated under 9 CFR 
part 121.
    In 9 CFR 121.1, we are removing the definition for overlap agent or 
toxin and adding a definition for overlap select agent and/or toxin in 
its place. Overlap select agent and/or toxin is defined as ``a 
biological agent or toxin that is listed in 9 CFR 121.4 and 42 CFR 
73.4.'' We are also adding definitions for VS and VS select agent and/
or toxin in Sec.  121.1. VS is defined as ``the Veterinary Services 
Programs of the Animal and Plant Health Inspection Service'' and VS 
select agent and/or toxin is defined as ``a biological agent or toxin 
listed in Sec.  121.3.''
    One commenter claimed that the term ``entity'' is subject to 
interpretation. The commenter stated that it does not make sense for a 
large multi-campus university to base cumulative limits on toxins or 
the designation of the responsible official on the entity when the 
actual labs are separated by hundreds of miles. Another commenter 
stated the definition of ``entity'' should be amended to permit a 
responsible official to discharge his or her responsibilities at 
several adjacent addresses.
    These issues are addressed below in the registration section. We 
are making no change to the definitions section in 7 CFR 331.1 and 9 
CFR 121.1 based on these comments.
    One commenter recommended that APHIS and CDC adopt a common 
definition for the term ``responsible official.'' The commenter noted 
that APHIS defines the term ``responsible official'' but CDC does not. 
The commenter stated that APHIS indicates a responsible manager should 
be the responsible official for an entity, while CDC would allow a 
biosafety officer to assume this role. The commenter stated that, in 
general, a biosafety officer would not have direct control over either 
the affected staff or budgets in order to ensure compliance with the 
regulations.
    We agree that APHIS and CDC should adopt a common definition for 
the term ``responsible official.'' Accordingly, we are amending the 
definition for responsible official in this final rule. In 7 CFR 331.1 
and 9 CFR 121.1, we define responsible official as ``the individual 
designated by an entity with the authority and control to ensure 
compliance with the regulations in this part.'' CDC is adopting the 
same definition in its final rule.
    A commenter stated that APHIS should clarify the term ``facility.'' 
The commenter said the term appears to refer to a complete building or 
complex in some parts of the rule but to an individual laboratory/room 
in other parts of the rule.
    APHIS uses the term ``facility'' in the definition for diagnostic 
laboratory in 7 CFR 331.1 and in the definitions for clinical 
laboratory and diagnostic

[[Page 13248]]

laboratory in 9 CFR 121.1. The term does not appear elsewhere in the 
regulations. Accordingly, we are making no change based on this 
comment.
    A commenter recommended that APHIS define the term ``access'' to 
mean actual, physical contact with the agent or the realistic 
opportunity for same.
    This issue is addressed below in the sections relating to security 
risk assessments and security. We are making no change to the 
definitions in 7 CFR 331.1 or 9 CFR 121.1 based on this comment.
    One commenter stated that 9 CFR 121.1 should define the term 
``exotic'' so that the term can be removed from the list of agents.
    This issue is addressed below in the section relating to the lists 
of VS and overlap select agents and toxins. Therefore, we are making no 
change to the definitions in 9 CFR 121.1 in response to this comment.

Purpose and Scope

    Interim 7 CFR 331.2 and 9 CFR 121.2 set out the purpose and scope 
of the regulations. Specifically, 7 CFR 331.2(a) stated that part 331 
sets forth the requirements for possession, use, and transfer of 
biological agents or toxins that have been determined to have the 
potential to pose a severe threat to plant health or plant products, 
while 9 CFR 121.2(a) stated that part 121 sets forth the requirements 
for possession, use, and transfer of biological agents or toxins that 
have been determined to have the potential to pose a severe threat to 
both human and animal health, or to animal health or animal products. 
Both sections noted that the purpose of the regulations is to ensure 
the safe handling of such agents or toxins, and to protect against the 
use of such agents or toxins in domestic or international terrorism or 
for any other criminal purpose.
    In this final rule, we are amending both sections to clarify that 
each part implements the provisions of the Agricultural Bioterrorism 
Protection Act of 2002. Furthermore, we are amending 9 CFR 121.2 to 
clarify that overlap select agents and toxins are subject to regulation 
by both APHIS and CDC.
    In interim 7 CFR 331.2 and 9 CFR 121.2, paragraphs (b) and (c) 
summarized the regulatory requirements. Since these provisions are 
already set forth in other sections of the regulations, we believe it 
is unnecessary to summarize them in these sections. Therefore, in this 
final rule, we are removing paragraphs (b) and (c) in 7 CFR 331.2 and 9 
CFR 121.2, and removing the paragraph designation for paragraph (a) in 
both sections since it is no longer necessary.

List of Biological Agents and Toxins

    In accordance with the Act, interim 7 CFR 331.3 and 9 CFR 121.3 
listed certain biological agents and toxins.
    Section 212(a)(2) of the Act requires that the lists of biological 
agents and toxins be reviewed and republished biennially, or more often 
as needed, and revised as necessary. In addition, the Act requires 
that, when determining whether to include an agent or toxin, the 
Secretary shall consult with appropriate Federal departments and 
agencies and with scientific experts representing appropriate 
professional groups.
    This final rule serves as APHIS' republication of the lists of 
select agents and toxins in 7 CFR 331.3 and 9 CFR 121.3, and in newly 
designated 9 CFR 121.4. As part of APHIS' review of the lists of agents 
and toxins, we reviewed current scientific information and studies and 
consulted with other Federal agencies. We also reviewed and considered 
the comments to the December 2002 interim rule on the lists of agents 
and toxins.
    As previously noted, in this final rule, we are amending the 
structure of both parts to be consistent with CDC's select agent 
regulations. In 9 CFR part 121, we are creating separate sections for 
the lists of VS select agents and toxins and overlap select agents and 
toxins--Sec. Sec.  121.3 and 121.4, respectively. We are also adding a 
new paragraph (a) to 7 CFR 331.3, containing introductory text, so that 
the format of the section is consistent with the format in 9 CFR 121.3 
and 9 CFR 121.4.
    One commenter recommended that APHIS include in the regulations a 
summary of the risk assessment data that supports the listing of each 
agent and toxin. The commenter stated that the data will heighten 
awareness of the risk characteristics of the listed agents and will 
promote safe practice and proficiency in handling such agents.
    APHIS does not include risk assessment data in the regulations; 
rather, such information is discussed in a rule's preamble. As noted in 
the preamble of the August 2002 interim rule, the Act requires APHIS to 
consider the following criteria in determining whether to list an agent 
or toxin: (1) The effect of exposure to the agent or toxin on animal or 
plant health, and on the production and marketability of animal or 
plant products; (2) the pathogenicity of the agent or the toxicity of 
the toxin and the methods by which the agent or toxin is transferred to 
animals or plants; (3) the availability and effectiveness of 
pharmacotherapies and prophylaxis to treat and prevent any illness 
caused by the agent or toxin; and (4) any other criteria the Secretary 
considers appropriate to protect animal or plant health, or animal or 
plant products.
    We do not believe it is necessary to provide a summary of the risk 
assessment data that supports the listing of each select agent or toxin 
in order to heighten awareness of the risk characteristics of such 
agents and toxins and promote safe practice and proficiency in handling 
of such agents and toxins. Information about the risk characteristics 
of a select agent or toxin and safe handling practices is available in 
scientific literature and other publications (e.g., the CDC/NIH 
publication, ``Biosafety in Microbiological and Biomedical 
Laboratories''). For these reasons, we are making no change based on 
this comment.
    Interim 7 CFR 331.3(a) (newly designated Sec.  331.3(b)) listed the 
biological agents and toxins that have been determined to pose a severe 
threat to plant health or to plant products (PPQ select agents and 
toxins).
    In this final rule, we are removing Phakopsora pachyrhizi, also 
known as Asian soybean rust, from the list of PPQ select agents and 
toxins. Asian soybean rust has been introduced into the United States 
by natural means and now it would have virtually no impact if used as a 
weapon of terrorism. Asian soybean rust was detected in the United 
States in November 2004. All available evidence suggests that spores 
were blown into the United States during a series of hurricanes in 
2004. Detection surveys indicate that it is present in at least nine 
southeastern States; however, USDA is conducting additional surveys to 
determine the full extent of the introduction. Because Asian soybean 
rust has a host range of more than 90 plant species and its spores 
disperse naturally on wind currents, this disease will continue to 
spread naturally and it cannot be controlled effectively. We expect 
that this disease will quickly reach the full extent of its ecological 
range in the United States. As a result, there is an urgent need for 
timely research on effective means to manage the disease in the United 
States. For all of these reasons, we are removing Phakopsora pachyrhizi 
from the list of PPQ select agents and toxins. However, we note that a 
permit will still be required for importation or interstate movement of 
Asian soybean rust (7 CFR part 330).
    A commenter claimed that, pursuant to the rules of the 
International Code of Nomenclature of Bacteria, two bacteria

[[Page 13249]]

have been renamed; thus, Liberobacter africanus should be Candidatus 
Liberobacter africanus, and Liberobacter asiaticus should be Candidatus 
Liberobacter asiaticus.
    We agree. Therefore, in this final rule, we are replacing the entry 
for Liberobacter africanus with Candidatus Liberobacter africanus and 
replacing Liberobacter asiaticus with Candidatus Liberobacter 
asiaticus. In addition, we are placing Candidatus Liberobacter 
africanus and Candidatus Liberobacter asiaticus on separate lines in 
order to make it clear that each one is a select agent.
    One commenter argued that plum pox potyvirus should not be listed 
as a select agent because it is only naturally transmitted by aphids, 
and, without the insect vector to transmit the disease from one plant 
to another, the possibility of the virus being used as a weapon of 
terrorism is extremely small. The commenter stated that laboratory 
research of this agent, in the absence of its natural vector and only 
known means of transmission, poses little to no risk to plant health or 
plant products.
    We agree that plum pox potyvirus (PPV) has limited potential as a 
weapon of terrorism given its biological characteristics. PPV is not 
easily transmitted and does not spread easily. The natural host range 
is limited to plants in the genus Prunus (e.g., plums and other stone 
fruits). The natural spread of the disease requires insect vectors 
(aphids), and is a complex biological process, and artificial spread 
requires grafting, which is labor intensive and time-consuming. PPV is 
not spread by pollen or seed. While systemic treatments are not 
completely effective at mitigating the disease, destruction of infected 
trees mitigates the effects of the disease, removal of the diseased 
trees and other susceptible hosts removes the source of infection, and 
transmission can be halted by removing host material from the area. 
Furthermore, most strains of PPV attack only a few varieties of stone 
fruits, which limits the affect of an outbreak on the production and 
marketability of stone fruits. For these reasons, in this final rule, 
we are removing plum pox potyvirus from the list of PPQ select agents 
and toxins. However, we note that PPV continues to be a quarantine pest 
under the domestic plant regulations (7 CFR 301.74 through 301.74-5).
    Another commenter asserted that Ralstonia solanacearum, race 3, 
biovar 2, should not be listed as a select agent. This commenter stated 
that the bacterium is unlikely to become established in the northern 
United States, where potatoes are commercially grown, because it is 
intolerant of freezing and does not generally survive winters in 
regions with sustained temperatures below 20 [deg]F. The commenter 
claimed that, even if the bacterium became established, it is unlikely 
to cause an economically damaging disease outbreak in the climactic 
conditions characteristic of North America. The commenter went on to 
note that the bacterium has been repeatedly introduced into the United 
States without impact.
    APHIS has determined that Ralstonia solanacearum, race 3, biovar 2, 
has the potential to pose a severe threat to plant health or plant 
products. The bacterium is known to attack a number of economically 
significant hosts (e.g., geraniums and tomatoes), not just potatoes. 
Some of the known hosts are grown in greenhouses (e.g., geraniums), 
which protect them from local climatic conditions, and some hosts are 
grown in fields throughout the United States (e.g., tomatoes and 
potatoes). With regard to potatoes, scientific data indicate the 
potential range of the bacterium would include the potato-growing 
regions in the United States. Ralstonia solanacearum, race 3, biovar 2, 
occurs in Europe as far north as the 56th parallel (southern 
Scandinavia), which parallels regions of Canada. Furthermore, there are 
a number of wild hosts that would contribute to the spread of the 
bacterium if it were introduced into the United States. For these 
reasons, we are making no changes based on this comment.
    Interim 9 CFR 121.3(d) (newly designated Sec.  121.3(b)) listed the 
biological agents and toxins that have been determined to have the 
potential to pose a severe threat to animal health or to animal 
products (VS select agents and toxins).
    A commenter asserted that listing Japanese encephalitis virus (JEV) 
as a select agent will negatively impact research on this disease, as 
well as on West Nile virus and dengue virus. This commenter stated that 
there does not appear to be sufficient justification for making 
Japanese encephalitis virus a select agent.
    We disagree that there is insufficient justification for listing 
Japanese encephalitis virus as a VS select agent. The virus can cause 
severe disease in horses and swine for which there is no effective 
treatment and no domestically available veterinary vaccine. While the 
select agent regulations may affect research on JEV, we expect it will 
have a negligible effect on associated research on West Nile virus and 
dengue virus. For these reasons, we are making no change in response to 
this comment.
    Several commenters questioned the inclusion of malignant catarrhal 
fever virus (exotic) on the list of select agents. One commenter stated 
the disease malignant catarrhal fever virus is caused be a variety of 
herpes viruses, none of which is known as malignant catarrhal fever 
virus. The commenter stated that Alcelaphine herpesvirus type 1 infects 
most wildebeest and spreads to domestic cattle causing malignant 
catarrhal fever in Africa. The commenter argued that malignant 
catarrhal fever virus (exotic) should be replaced with Alcelaphine 
herpesvirus type 1. Another commenter argued that the biological 
features of malignant catarrhal fever viruses prevent them from being 
effective bioterror agents. The commenter noted that Alcelaphine 
herpesvirus type 1 can only be transmitted by parenteral injection and 
cow-to-cow transmission does not occur under natural conditions. This 
commenter also argued that it is misleading to label malignant 
catarrhal fever as ``exotic'' since it is present wherever there are 
wildebeests, from zoos to exotic game farms.
    We agree that clarification is needed with regard to the term 
malignant catarrhal fever virus. Accordingly, in this final rule we are 
replacing the entry for malignant catarrhal fever virus with malignant 
catarrhal fever virus (Alcelaphine herpesevirus type 1). However, we 
disagree that the biological features of malignant catarrhal fever 
viruses prevent them from being effective bioterror agents. Malignant 
catarrhal fever virus (Alcelaphine herpesevirus type 1) causes severe 
disease in cattle, and it may be possible for the virus to be 
transmitted from cow to cow. Currently, this virus is not found in U.S. 
cattle populations, and a widespread outbreak of the disease would 
likely result in widespread animal movement restrictions that could be 
long term, at least with respect to exports. We are making no change in 
response to this comment.
    One commenter suggested that Newcastle disease virus (VVND) be 
replaced with Newcastle disease virus (velogenic). The commenter stated 
the background information indicated that only velogenic strains are to 
be regulated; however, the acronym VVND indicates viscerotropic, 
velogenic Newcastle disease.
    In the December 2002 interim rule, we replaced the entry for 
Newcastle disease virus (exotic) with Newcastle disease virus (VVND) to 
make it clear that we are regulating only velogenic strains. 
Viscerotropic, velogenic Newcastle

[[Page 13250]]

disease (VVND) is a velogenic strain. To ensure that we are regulating 
all of the velogenic strains, in this final rule we are replacing the 
entry for Newcastle disease virus (VVND) with Newcastle disease virus 
(velogenic).
    A commenter stated the distinction between domestic and exotic 
vesicular stomatitis virus cannot be justified scientifically. 
Therefore, it would be more logical to list all vesicular stomatitis 
viruses except specific viruses that are generally recognized as 
attenuated (e.g., the VSV-Indiana Lab strain).
    We do not believe it is necessary to regulate all strains of 
vesicular stomatitis virus, especially those strains that have limited 
morbidity and mortality in the United States. Therefore, we are making 
no change based on this comment.
    Interim 9 CFR 121.3(b) (newly designated Sec.  121.4(b)) listed the 
biological agents and toxins that have been determined to have the 
potential to pose a severe threat to both human and animal health, to 
animal health, or to animal products (overlap select agents and 
toxins).
    Several commenters pointed out that Clostridium botulinum is listed 
in the APHIS regulations but not in the CDC regulations.
    APHIS inadvertently listed both Clostridium botulinum and Botulinum 
neurotoxin producing species of Clostridium as overlap agents in the 
December 2002 interim rule. We always intended to only list Botulinum 
neurotoxin producing species of Clostridium in order to be consistent 
with CDC. Accordingly, we are removing Clostridium botulinum from the 
list of overlap select agents and toxins in this final rule.
    A number of commenters argued that overlap agents that are endemic, 
widespread, and easily isolated from natural sources should not be 
included in the list of overlap select agents. For these reasons, one 
commenter recommended that Francisella tularensis and Coxiella burnetii 
be removed from the list of overlap agents. Several commenters stated 
that Coccidioides immitis should not be included in the list of overlap 
select agents because it is endemic in California's Central Valley and 
is found in many areas of the southwest. Another commenter argued that 
Coxiella burnetii should be removed from the overlap list because ``it 
is so ubiquitous in nature that its identification as a select agent is 
meaningless.'' One commenter argued that Eastern equine encephalitis 
virus should be removed from the overlap list because it is endemic and 
even if it were intentionally introduced into people, horses, or other 
domestic animals, there would be little or no chance of spread to cause 
an adverse agricultural event.
    We agree that Coxiella burnetii, Coccidioides immitis, and 
Francisella tularensis are endemic, widespread, and easily isolated 
from natural sources. However, these factors are not sufficient reason 
to remove these agents from the list of overlap select agents and 
toxins. Furthermore, we disagree that there is little risk of an 
adverse agricultural event involving Eastern equine encephalitis virus 
because it can cause high mortality in horses, and there is no 
mandatory vaccination program in the United States. We are making no 
changes based on this comment.
    A commenter stated that it is pointless to regulate trichothecenes 
such as T-2 toxin as select agents if highly toxigenic strains of the 
toxin-producing organism are not also regulated.
    We are regulating T-2 toxin, and not the organism that produces it, 
because we believe the toxin has the potential to pose a severe threat 
to public health and safety, to animal health, and to animal products. 
Accordingly, we are making no change in response to this comment.
    Interim 7 CFR 331.3(c)(2), 9 CFR 121.3(c), and 9 CFR 121.3(f)(2) 
(newly designated 7 CFR 331.3, 9 CFR 121.3, and 9 CFR 121.4) set out 
the provisions for genetic elements.
    One commenter stated there are differences between the APHIS and 
CDC regulations regarding genetic elements. For example, the 
regulations seem to imply that no bacterial sequences are regulated, 
except those from animal agents.
    We agree. In the interim regulations, CDC provided that infectious 
viral sequences of HHS and overlap select agents are regulated, while 
APHIS provided that infectious viral sequences of overlap agents are 
regulated and infectious viral and bacterial sequences of PPQ and VS 
select agents are regulated. To resolve these differences, in this 
final rule we are adopting CDC's approach for genetic elements. 
Specifically, newly designated 7 CFR 331.3, 9 CFR 121.3, and 9 CFR 
121.4 provide that the following will be considered select agents and 
toxins:
     Nucleic acids that can produce infectious forms of any of 
the select agent viruses listed in either 7 CFR part 331 or 9 CFR part 
121;
     Recombinant nucleic acids that encode for the functional 
forms of any toxin listed in either 7 CFR part 331 or 9 CFR part 121 if 
the nucleic acids: (1) Can be expressed in vivo or in vitro; or (2) are 
in a vector or recombinant host genome and can be expressed in vivo or 
in vitro; and
     Select agents and toxins listed in either 7 CFR part 331 
or 9 CFR part 121 that have been genetically modified.
    Another commenter stated that interim 9 CFR 121.3(c) and 121.3(f) 
conflict--Sec.  121.3(c) seems to include fragments, while Sec.  
121.3(f) exempts them. The commenter pointed out that all genetic 
elements that cause disease can be fragmented into pieces that cannot 
cause disease, but that can be reconstituted simply and quickly.
    We believe the changes in this final rule will address the 
differences identified by this commenter. Accordingly, we are making no 
change based on this comment. However, we note that fragments are not 
subject to the regulations until reconstituted.
    One commenter asked if cDNA is regulated. This commenter also asked 
how sequence data of select agents will be protected, since it can be 
used to make a select agent.
    A cDNA fragment will be subject to the regulations if it can 
produce either an infectious form of toxin or a select agent. Sequence 
data of select agents is already in the public domain, and APHIS cannot 
protect this information. However, we note that an individual or entity 
that uses sequence data to produce an infectious agent or toxin will be 
subject to the select agent regulations. We are making no changes based 
on this comment.
    Interim 7 CFR 331.3(b) and 9 CFR 121.3(e) stated that any 
biological agent or toxin that is in its naturally occurring 
environment will not be subject to the requirements of either part, 
provided that the biological agent or toxin has not been intentionally 
introduced, cultivated, collected, or otherwise extracted from its 
natural source.
    To be consistent with CDC, we are adopting the phrase ``excluded 
from the requirements of this part'' in place of the phrase ``will not 
be subject to the requirements of this part.'' Thus, in this final 
rule, newly designated 7 CFR 331.3(d)(1), 9 CFR 121.3(d)(1), and 9 CFR 
121.4(d)(1) state that a select agent or toxin that is in its naturally 
occurring environment is excluded from the requirements of the 
regulations, provided that the agent or toxin has not been 
intentionally introduced, cultivated, collected, or otherwise extracted 
from its natural source.
    One commenter stated that the naturally occurring environment of a 
virus is its host. The commenter pointed out that Coxiella burnetii can 
be found in milk samples and asked if the truck moving milk to a 
processing plant would be subject to the regulations or if

[[Page 13251]]

the milk sample submitted to a laboratory for mastitis testing would be 
subject to the regulations as the milk sample is being collected.
    Coxiella burnetii that is contained in milk in a truck or in a 
diagnostic sample is considered to be in its naturally occurring 
environment as long as it has not been intentionally introduced, 
cultivated, collected, or otherwise extracted from its natural source. 
We are making no changes in response to these comments.
    Another commenter stated that the regulations suggest that an agent 
found in the lymph node of a slaughtered animal (found on 
histopathology but not cultivated or extracted) is in its naturally 
occurring environment and, therefore, exempt from notification.
    This comment appears to combine the requirements for exclusions and 
exemptions. A select agent or toxin that has not been intentionally 
introduced, cultivated, collected, or otherwise extracted from its 
natural source is considered to be in its naturally occurring 
environment and, therefore, excluded from the requirements of the 
regulations. The exemption provisions for overlap select agents and 
toxins are set forth in newly designated 9 CFR 121.6. Histopathology 
alone is not a definitive identification of a select agent. However, a 
select agent that has been identified by a histopathology method that 
has been validated would need to be reported to APHIS or CDC in 
accordance with the regulations. We are making no changes in response 
to this comment.
    A commenter stated that any naturally occurring organism expressing 
a Shigatoxin should be specifically excluded from the list of select 
agents and toxins.
    As previously noted, we are regulating the toxin and not the 
organisms that produce the toxin. Therefore, it is not necessary to 
exclude from the requirements of the regulations any naturally 
occurring organism expressing a Shigatoxin. However, we note that 
Shigatoxin under the control of a principal investigator, treating 
physician or veterinarian, or commercial manufacturer or distributor is 
excluded from the requirements of 9 CFR part 121 if the aggregate 
amount does not, at any time, exceed 100 mg (newly designated 9 CFR 
121.4(d)(3)).
    Interim 7 CFR 331.3(c)(1) (newly designated 7 CFR 331.3(d)(2)) 
provided that nonviable agents that are, bear, or contain listed agents 
or toxins will not be subject to the requirements of the part because 
they do not have the potential to pose a severe threat to plant health 
or plant products. Similarly, interim 9 CFR 121.3(f) (newly designated 
9 CFR 121.3(d)(2) and 121.4(d)(2)) provided that nonviable agents or 
fixed tissues that are, bear, or contain listed agents or toxins will 
not be subject to the requirements of the part because they do not have 
the potential to pose a severe threat to both human and animal health, 
or to animal health or animal products.
    In this final rule, we are amending both sections to clarify that 
these provisions apply to nonviable agents and nonfunctional toxins. 
These changes will make the provisions in the APHIS and CDC regulations 
consistent.
    A commenter requested clarification of the terms ``nonviable'' and 
``nonfunctional'' select agents or toxins. The commenter noted that 
some organisms can survive in nature, others only under lab conditions, 
and others not under any conditions.
    A nonviable agent is not capable of replicating, infecting a plant 
or animal, or causing disease, while a nonfunctional toxin is not able 
to produce a toxic effect. These terms are generally understood in the 
scientific community, and we do not believe that further clarification 
is needed in the regulations. Therefore, we are making no change in 
response to this comment.
    Footnotes in interim 9 CFR 121.3 stated that the importation and 
interstate movement of nonviable agents and genetic elements are 
subject to the permit requirements under 9 CFR part 122.
    One commenter asked why a permit is needed for nonviable agents and 
genetic elements that are excluded from regulation under 9 CFR part 
121. The commenter argued that nonviable agents and genetic elements 
that are not capable of causing disease do not meet the definition of 
``organism'' in part 122. Another commenter requested clarification of 
the permit requirement for nonviable agents or fixed tissues. The 
commenter stated that the provision seems to suggest that, for as long 
as you retain the tissues, you would need to get yearly interstate 
transport permits even though no further receipt/transport is taking 
place.
    The regulations in 9 CFR part 122 pertain to the movement of 
organisms and vectors. A nonviable agent or genetic material could 
serve as a vector of a disease agent through ineffective or 
insufficient processing methods, and, therefore, require a permit for 
importation or interstate movement. However, since a permit may not 
always be required, in this final rule we are revising the footnotes so 
that, in newly designated 9 CFR 121.3 and 121.4, they state that a 
permit may be needed for nonviable agents and genetic elements. We note 
that permits may contain restrictions that extend beyond the expiration 
of the permit if the agent/genetic element is not destroyed. If so, an 
individual or entity would be required to obtain a new permit as long 
as the nonviable agent or genetic element is possessed by the 
permittee.
    A commenter asked if a positive chain reaction (PCR) test done on 
formalin fixed tissue that detects Eastern equine encephalitis virus 
would be exempt because it is nonviable.
    This comment is not entirely clear. We believe the commenter is 
asking about the reporting requirements for identifications of a select 
agent or toxin. If Eastern equine encephalitis virus is identified from 
formalin tissue, an individual or entity must report the identification 
to APHIS in accordance with either newly designated 9 CFR 121.6 or 
121.9, whichever is applicable. However, nonviable overlap select 
agents or nonfunctional toxins are excluded from the regulations (newly 
designated 9 CFR 121.4(d)(2)). We are making no changes in response to 
this comment.
    Interim 9 CFR 121.3(f)(3) provided an exclusion from the 
regulations for ``[o]verlap toxins under the control of a principal 
investigator (or equivalent), if the total aggregate amount does not, 
at any time, exceed the following amounts: 0.5 mg of Botulinum 
neurotoxins (types A-G), 100 mg of Clostridium perfringens epsilon 
toxin, 100 mg of Shigatoxin, 5 mg of Staphylococcal enterotoxins, and 
1,000 mg of T-2 toxin.
    APHIS and CDC have determined that this exclusion is too narrow and 
has the unintended consequence of requiring treating physicians or 
veterinarians and commercial manufacturers or distributors that 
possess, use, or transfer otherwise excluded toxins to register. 
Accordingly, in this final rule, we are broadening the scope of the 
overlap toxin exclusion to cover overlap toxins under the control of a 
principal investigator, treating physician or veterinarian, or 
commercial manufacturer or distributor (newly designated Sec.  
121.4(d)(3)). To be consistent with CDC, we are also removing the words 
``(types A-G)'' after Botulinum neurotoxins.
    One commenter requested that APHIS clarify that there is no limit 
to the amount of overlap toxins an individual or entity may possess or 
use, as long as the amount of toxin under the control of each principal 
investigator does not exceed the specified amounts.
    We believe that newly designated Sec.  121.4(d)(3) clearly 
indicates that the exclusion is based upon the amount of

[[Page 13252]]

overlap toxin under the control of a principal investigator, treating 
physician or veterinarian, or commercial manufacturer or distributor. 
Therefore, we are making no change based on this comment.
    Another commenter asked if the toxin amounts refer to quantities of 
isolated toxin (i.e., toxin that has been extracted and is separate 
from the cell) or toxin that is in the process of being produced by 
living cells and may increase in quantity. The commenter stated that 
measuring the exact quantities of a toxin can only reasonably be 
achieved if the toxin has been isolated from the cell.
    We agree that an exact measurement of a toxin can only reasonably 
be achieved if the toxin has been isolated from the cell. The amounts 
listed in newly designated Sec.  121.4(d)(3) refer to the amount of 
toxin that has been isolated from the cell, not the amount of toxin 
that is being produced in living cells. We are making no change based 
on this comment.
    Interim 9 CFR 121.3(g) (newly designated Sec. Sec.  121.3(e) and 
121.4(e)) provided a procedure by which an individual or entity may 
request a determination by the Administrator that an attenuated strain 
of a biological agent does not pose a severe threat to both human and 
animal health, or to animal health or animal products.
    In this final rule, we are adding this provision to 7 CFR 331.3 so 
that the regulations in part 331 are consistent with the regulations in 
9 CFR part 121. We are also amending both parts to clarify the 
requirements and streamline the process for excluding an attenuated 
strain of a select agent or toxin. Specifically, paragraph (e) in 7 CFR 
331.3, 9 CFR 121.3, and 9 CFR 121.4 provides that an individual or 
entity may apply for an exclusion by submitting a written request and 
supporting scientific information. A written decision granting or 
denying the request will be issued and the exclusion will be effective 
upon notification of the applicant. Exclusions will be published 
periodically in the notice section of the Federal Register and will be 
listed on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html. Paragraph (e) also provides that, if an 
excluded attenuated strain is subjected to any manipulation that 
restores or enhances its virulence, the resulting select agent or toxin 
will be subject to the requirements of each part. This has always been 
the way the exclusion for attenuated strains has been interpreted; 
however, we are adding this provision to both parts to facilitate 
compliance.
    One commenter claimed that the microbiological community, not just 
government agency representatives, must be involved in the process for 
excluding attenuated strains. The commenter recommended the 
establishment of a broadly representative group to act as an advisory 
body to APHIS and CDC. This commenter also stated that the regulations 
should state that determinations regarding overlap agents require the 
concurrence of APHIS and CDC.
    APHIS may exclude attenuated strains of select agents or toxins 
after consultation with subject matter experts, including those in the 
microbiology community. For overlap select agents and toxins, APHIS may 
exclude attenuated strains after consultation with subject matter 
experts and CDC. We do not believe it is necessary to include these 
administrative procedures in the regulations. Accordingly, we are 
making no change based on this comment.
    A commenter stated that APHIS should specify the criteria for 
exclusion of attenuated strains because the current standard (``poses a 
severe threat'') is insufficiently specific.
    The Act requires APHIS to regulate the possession, use, and 
transfer of biological agents and toxins that have been determined to 
pose a severe threat to public health and safety, to animal health, to 
plant health, or to animal or plant products. Thus, the Act establishes 
the standard by which APHIS may exclude an attenuated strain (i.e., the 
strain does not pose a severe threat). We are making no change to the 
regulations in response to this comment.
    A commenter asserted that the excluded attenuated strains should be 
listed in the regulations so that an entity may be able to determine if 
an agent is excluded before registering the strain and installing any 
additional security.
    APHIS is not including the lists of excluded attenuated strains of 
select agents or toxins in the regulations because any change to the 
lists of exclusions would require rulemaking. To minimize the potential 
delays related to rulemaking, in this final rule we are providing that 
exclusions will be published periodically in the notices section of the 
Federal Register and will be listed on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html. We believe 
these measures will provide sufficient notice to the public.
    A commenter stated that the exclusion for attenuated strains would 
not make agents such as the Sterne strain of Bacillus anthracis and the 
vaccine strain of Brucella abortus available for the critical need of 
quality control, without registration of the laboratory.
    An attenuated strain of a select agent may be excluded from the 
requirements of regulations based upon a determination that the 
attenuated strain does not pose a severe threat to plant health or 
plant products (newly designated 7 CFR 331.3(e)) or to public health 
and safety, to animal health, or animal products (newly designated 9 
CFR 121.3(e) and 121.4(e)). Once an attenuated strain of a select agent 
has been excluded, it may be used for quality control or for other 
purposes, as long as its virulence is not restored or enhanced. To 
date, a number of attenuated strains have been excluded, including 
Bacillus anthracis Sterne, pX01+pX02- and 
Brucella abortus strain RB51 (vaccine strain). For these reasons, we 
are making no change in response to this comment.
    One commenter asked if the TC-83 vaccine strain of Venezuelan 
equine encephalitis is subject to the regulations. The commenter 
pointed out that the CDC regulations specifically exclude this strain 
from regulation but the APHIS regulations do not.
    Both APHIS and CDC have excluded the TC-83 vaccine strain of 
Venezuelan equine encephalitis virus from the requirements of the 
regulations. We note that a current list of exclusions is available on 
the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index/html. We are making no change based on this comment.
    To address concerns raised by Federal law enforcement agencies 
related to seizures (i.e., possession) of select agents or toxins, in 
this final rule we are adding a new paragraph (f) to 7 CFR 331.3, 9 CFR 
121.3, and 9 CFR 121.4 to address situations in which the select agents 
or toxins have been identified prior to seizure. In the event that a 
Federal law enforcement agency seizes a suspected select agent or toxin 
or unknown material, this material will be regarded as a specimen 
presented for diagnosis or verification and, therefore, will not be 
subject to the regulations until it has been identified as a select 
agent or toxin.
    Paragraph (f) provides that any select agent or toxin seized by a 
Federal law enforcement agency will be excluded from the requirements 
of the regulations during the period between seizure of the agent or 
toxin and the transfer or destruction of such agent or toxin provided 
that:
     As soon as practicable, the Federal law enforcement agency 
transfers the

[[Page 13253]]

seized agent or toxin to an entity eligible to receive such agent or 
toxin or destroys the agent or toxin by a recognized sterilization or 
inactivation process;
     The Federal law enforcement agency safeguards and secures 
the seized agent or toxin against theft, loss, or release and reports 
any theft, loss, or release of such agent or toxin; and
     The Federal law enforcement agency reports the seizure of 
the select agent or toxin to APHIS or CDC.
    This provision will allow Federal law enforcement agencies to 
conduct certain law enforcement activities (e.g., collecting evidence 
from a laboratory crime scene) without being in violation of the 
regulations. We note, however, that this provision does not authorize 
the seizure of a select agent or toxin by a Federal law enforcement 
agency; rather, it establishes the conditions under which a Federal law 
enforcement agency may seize a select agent or toxin without violating 
the regulations. Seizure of a select agent or toxin by a Federal law 
enforcement agency would have to be in accord with that agency's 
statutory authority.

Exemptions

    Interim 7 CFR 331.4, 9 CFR 121.4, and 9 CFR 121.5 (newly designated 
7 CFR 331.5, 9 CFR 121.5, and 9 CFR 121.6) set out exemptions.
    Interim 9 CFR 121.4(a) provided that clinical or diagnostic 
laboratories and other entities possessing, using, or transferring 
overlap agents or toxins that are contained in specimens presented for 
diagnosis or verification will be exempt from the requirements of part 
121, provided that the identification of such agents or toxins is 
immediately reported to APHIS or CDC, and to other appropriate 
authorities when required by Federal, State, or local law; and, within 
7 days after identification, such agents or toxins are transferred or 
inactivated, and APHIS Form 2040 is submitted to APHIS or CDC. Interim 
7 CFR 331.4(a) and 9 CFR 121.5(a) contained similar exemption 
provisions for diagnostic laboratories (the term clinical laboratories 
is not applicable to the plant-related regulations in 7 CFR part 331 or 
the animal-related regulations in 9 CFR part 121). Exemption provisions 
for laboratories and other entities that perform proficiency testing 
were set out in interim 9 CFR 121.4(b) and 121.5(b).
    In this final rule, we are amending both parts to clarify the 
exemption provisions related to clinical or diagnostic laboratories and 
other entities (for overlap select agents and toxins) and diagnostic 
laboratories and other entities (for PPQ and VS select agents and 
toxins). Specifically, paragraph (a) in newly designated 7 CFR 331.5 
and paragraphs (a) and (b) in newly designated 9 CFR 121.5 and 121.6 
make clear that laboratories and other entities must meet the exemption 
requirements for each select agent or toxin contained in a specimen 
that it possesses, uses, or transfers. This change takes into account 
situations in which a diagnostic laboratory or other entity could be 
registered for a select agent or toxin but still meet the exemption 
requirements for other select agents or toxins contained in specimens. 
We are also amending both parts to clarify that, as a condition of 
exemption, clinical or diagnostic laboratories and other entities must 
transfer a select agent or toxin in accordance with the transfer 
requirements in each part (newly designated 7 CFR 331.16 and 9 CFR 
121.16, respectively) or destroy the agent or toxin on-site by a 
recognized sterilization or inactivation process.
    In this final rule, we are also deleting in both parts the 
requirement that the identification of a select agent or toxin be 
reported to appropriate authorities when required by Federal, State, or 
local law (interim 7 CFR 331.4, 9 CFR 121.4, and 9 CFR 121.5). Because 
this provision merely indicates that additional reporting requirements 
may exist under Federal, State, or local law, it is not necessary to 
include this provision in the regulations. It is the entity's 
responsibility to be familiar with all legal requirements for select 
agents and toxins.
    In addition, newly designated 9 CFR 121.5 and 121.6 require 
immediate reporting after identification for specified select agents 
and toxins; identification of the other select agents and toxins must 
be reported within 7 calendar days after identification. This change 
will reduce the reporting burden on the public while continuing to 
provide information that will help us to identify outbreaks and to 
monitor activities related to select agents and toxins.
    Finally, we are deleting footnote 1 in interim 7 CFR 331.4 (newly 
designated 7 CFR 331.5) because this information is contained in the 
transfer section in this final rule (newly designated Sec.  331.16). We 
are also deleting the application and contact information contained in 
footnotes in interim 7 CFR 331.4, 9 CFR 121.4, and 9 CFR 121.5 because 
addresses and telephone numbers are subject to change. Information 
about the submission of forms, notices, and requests for exemptions or 
exclusions is available on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index/html.
    A commenter asserted that clinical or diagnostic laboratories 
should be required to secure the agent or toxin prior to transfer or 
destruction.
    We agree. Taking into account the risks posed by select agents and 
toxins and the security requirements for registered entities, it is 
reasonable to require that a clinical or diagnostic laboratory or other 
entity secure the agent or toxin prior to transfer or destruction. 
Furthermore, we believe it is reasonable to require that a clinical or 
diagnostic laboratory or other entity report any theft, loss, or 
release of a select agent or toxin prior to transfer or destruction. 
Therefore, newly designated 7 CFR 331.5, 9 CFR 121.5, and 9 CFR 121.6 
require, as another condition of exemption, that the select agent or 
toxin be secured against theft, loss, or release during the period 
between identification of the agent or toxin and transfer or 
destruction of such agent or toxin, and that any theft, loss, or 
release of such agent or toxin be reported.
    Another commenter argued that the exemptions for clinical and 
diagnostic laboratories should require, at the very least, that 
employees of such labs be subject to security risk assessments by the 
Attorney General.
    The Act does not require security risk assessments for employees of 
entities that are exempt from registration under the regulations 
(section 212(e)). We believe that the conditions for exemption in this 
final rule provide adequate safeguard and security measures to protect 
animal and plant health, and animal and plant products. Accordingly, we 
are making no change based on this comment.
    One commenter requested that APHIS define the term 
``identification.'' The commenter asked if a PCR positive reaction 
constituted identification or simply detection. This commenter also 
wondered if an entity must report an identification done on a nonviable 
organism.
    If a PCR test is recognized in the scientific community as an 
identification method, then a result utilizing this test must be 
reported. If not, reporting is not required. An individual or entity 
must report an identification done on a nonviable organism in 
accordance with the regulations. We require this reporting in order to 
obtain surveillance information about select agents or toxins. We are 
making no changes in response to this comment.
    Several commenters argued that the requirement to transfer an agent 
or toxin

[[Page 13254]]

within 7 calendar days of identification was unrealistic. One commenter 
stated that delays in transfer approval by APHIS or CDC could result in 
delays in shipping the samples. Several commenters expressed concern 
about this deadline due to the unreliability of shippers. Another 
commenter stated that it is unreasonable and counterproductive to 
require diagnostic labs to destroy or transfer select agents within 7 
days after identification. The commenter said that some labs may 
process hundreds or thousands of samples each week and generate large 
numbers of select agent isolates, and transferring these isolates to a 
qualified lab within 1 week will be very difficult and costly. The 
commenter claimed that most labs will simply destroy the isolates and 
that such destruction will result in the loss of valuable scientific 
material.
    Based on information provided by CDC and APHIS' National Veterinary 
Services Laboratories (NVSL), and taking into consideration the risks 
posed by select agents and toxins, we believe that 7 days will provide 
ample time after identification to destroy the agent or toxin, or to 
make transfer arrangements and to transfer the agent or toxin. However, 
in this final rule, we are amending newly designated 7 CFR 331.5(a) and 
9 CFR 121.5(a) to allow the Administrator to make exceptions to these 
timeframes, as necessary. We are also amending newly designated 9 CFR 
121.6(a) to allow the Administrator or the HHS Secretary to make 
exceptions to these timeframes for overlap select agents or toxins, as 
necessary. Finally, we are making similar changes to newly designated 9 
CFR 121.5(b) and 9 CFR 121.6(b) to allow for exceptions to the 
timeframes for proficiency testing, which require that an agent or 
toxin be transferred or destroyed within 90 calendar days of receipt.
    Another commenter recommended a longer holding period for agents 
and toxins before mandatory inactivation--30 to 45 days instead of 7 
days--because the destruction of isolates of select agents after only 7 
days is counter to good quality control in labs, which often specifies 
that isolates and specimens be kept for 30 days, and labs often have 
cases pending for at least 30 days awaiting additional results. The 
commenter went on to note that it is good lab practice to maintain the 
original sample until a case is complete, and labs often maintain 
samples so that additional testing can be done as needed.
    The exemption provisions in interim 7 CFR 331.4(a), 9 CFR 121.4(a), 
and 9 CFR 121.5(a) (newly designated 7 CFR 331.5(a), 9 CFR 121.5(a), 
and 9 CFR 121.6(a)) do not require mandatory inactivation of a select 
agent or toxin. To qualify for an exemption, an individual or entity 
must satisfy the conditions for exemption, including transferring or 
destroying the select agent or toxin within 7 calendar days of 
identification unless directed otherwise by the Administrator or HHS 
Secretary. However, an individual or entity could continue to hold a 
select agent or toxin if it registers with APHIS or, for overlap select 
agents and toxins, if it registers with APHIS and CDC. While we 
recognize that the select agent regulations may have an effect on 
internal quality assurance procedures, lengthening the time that a 
diagnostic laboratory or other entity can possess a sample without 
being registered is inconsistent with the intent of the Act. We are 
making no changes based on this comment.
    One commenter asked if diagnostic facilities could preregister for 
potential isolates they might obtain from future diagnostic cases. The 
commenter stated the regulations suggest that a facility has to have 
the agent before it can register. The commenter stated that, once an 
agent is isolated, it appears that the facility would only have 7 days 
to become registered before it would have to destroy or transfer the 
agent. The commenter noted that even the process to amend a certificate 
of registration would likely take longer than 7 days.
    The regulations do not preclude preregistration for a select agent 
or toxin. A certificate of registration may be issued to an entity as 
long as the entity meets the regulatory requirements for such agent or 
toxin, even if the entity does not currently possess that particular 
agent or toxin.
    The regulations (interim 7 CFR 331.4(b) and 9 CFR 121.5(f); newly 
designated 7 CFR 331.5(b) and 9 CFR 121.5(f)) provide that the 
Administrator may grant exemptions from the requirements of 7 CFR part 
331 and 9 CFR part 121 upon a showing of good cause and a determination 
that such an exemption is consistent with protecting animal or plant 
health or animal or plant products.
    A commenter stated that APHIS should establish timelines for 
responding to requests for exemptions. APHIS is committed to processing 
requests for exemptions in a timely manner. We do not believe it is 
necessary to include in the regulations timelines for responding to 
requests for exemptions. Therefore, we are making no change based on 
this comment.
    Interim 9 CFR 121.4(c) and 121.5(d) provided that, unless the 
Administrator by order determines that additional regulation is 
necessary to protect animal health, or animal products, an individual 
or entity possessing, using, or transferring products that are, bear, 
or contain agents or toxins will be exempt from the requirements of 
this part if the products have been cleared, approved, licensed, or 
registered pursuant to:
    (1) The Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et 
seq.);
    (2) Section 351 of the Public Health Service Act (42 U.S.C. 262);
    (3) The Virus-Serum-Toxin Act (21 U.S.C. 151-159); or
    (4) The Federal Insecticide, Fungicide, and Rodenticide Act (7 
U.S.C. 131 et seq.).
    In this final rule, newly designated Sec. Sec.  121.5(d) and 
121.6(c) clarify that the product is exempt from the requirements of 
the regulations. This change is designed to address those situations in 
which an entity produces an exempt product but conducts other 
activities that would require registration under this part.
    A commenter requested that APHIS and CDC provide a list of agents 
exempted under the Federal laws listed in interim 9 CFR 121.4(c) so 
that investigators would know if the agents they possess or wish to 
study are exempt.
    It is not administratively feasible for APHIS to maintain a list of 
select agents exempted under the Federal laws described above. The 
regulations provide sufficient information for an individual or entity 
to determine if the agents they possess or wish to study are exempt. 
Accordingly, we are making no changes based on this comment.
    In interim 9 CFR 121.5(c), we provided that an individual or entity 
receiving diagnostic reagents and vaccines that are, bear, or contain 
select agents or toxins that are produced at USDA diagnostic facilities 
will be exempt from the requirements of part 121.
    A commenter stated that agents approved by APHIS' Center for 
Veterinary Biologics for use in USDA licensed facilities should be 
exempt from the requirements of the rule.
    We disagree. We included this provision in the regulations in order 
to exempt products, not agents, that would be cleared, approved, 
licensed, or registered pursuant to the Virus-Serum-Toxin Act (21 
U.S.C. 151-159), but for the fact that they are produced by USDA. In 
order to clarify that this exemption applies to products, in this final 
rule, newly designated 9 CFR 121.5(c) provides that diagnostic reagents 
and vaccines that are, bear, or contain VS select agents or toxins that

[[Page 13255]]

are produced at USDA diagnostic facilities will be exempt from the 
requirements of this part.
    The regulations (interim 9 CFR 121.4(e); newly designated Sec.  
121.6(e)) provide that the Administrator may exempt an individual or 
entity from the requirements of the part for 30 days if it is necessary 
to respond to a domestic or foreign agricultural emergency involving an 
overlap agent or toxin. This exemption may be extended for an 
additional 30 days.
    One commenter argued that the 30-day special exemption granted 
during an emergency is insufficient to deal with a foreign animal or 
outbreak emergency. This commenter stated that neither exotic Newcastle 
disease or the low pathogenic avian influenza outbreaks were resolved 
in 60 days.
    Section 212(g)(1)(D) of the Act sets forth the exemption for 
agricultural emergencies involving overlap select agents and toxins. 
The Act specifies that such exemptions may not exceed 60 days. 
Accordingly, we are making no changes based on this comment.

Registration

    Interim 7 CFR 331.5, 331.6, and 331.8 and 9 CFR 121.6, 121.7, and 
121.9 (newly designated 7 CFR 331.7 and 9 CFR 121.7) set out 
registration requirements and procedures.
    One commenter stated that the regulations do not contemplate or 
address a situation where an entity has employees that possess, use, or 
transfer select agents at locations owned and controlled by another 
entity. The commenter stated that it is a nonprofit organization that 
provides medical research personnel to Federal agencies. The commenter 
asserted that the regulations and the registration application should 
be revised to require registration for the entity that owns or controls 
the location where agents and toxins are used and stored.
    This final rule requires that, unless exempted under the 
regulations, an individual or entity that possesses, uses, or transfers 
select agents or toxins must register with APHIS or, for overlap select 
agents or toxins, APHIS and CDC. The regulations provide for both 
individuals and entities, even though we expect that most registrants 
will be entities. Using the example given by the commenter, the Federal 
agency that possesses, uses, or transfers select agents or toxins would 
be required to register and restrict access to such agents or toxins to 
only those individuals approved by the Administrator or HHS Secretary 
following a security risk assessment by the Attorney General. We are 
making no change based on this comment.
    One commenter requested that USDA and CDC consider a single 
clearinghouse for registration of select agents. The commenter said the 
rules require an entity that possesses only human and animal/plant 
agents (no overlaps) to register separately with each agency; however, 
this would place an undue burden on the entity by requiring dual 
registration packages and safety/security plans. Another commenter 
recommended that APHIS indicate what an entity can do to assist or 
mitigate conflict between APHIS and CDC on registration applications 
for overlap agents.
    To simplify the registration process and minimize the burden on the 
public, APHIS and CDC have established a framework by which individuals 
and entities with various combinations of select agents and toxins may 
submit their registration applications to either APHIS or CDC. For 
instance, to apply for a certificate of registration for only PPQ or VS 
select agents or toxins, or for PPQ and VS select agents or toxins, an 
individual or entity must submit the registration application package 
to APHIS. However, to apply for a certificate of registration for 
overlap select agents or toxins, overlap select agents or toxins and 
any combination of PPQ or VS select agents or toxins, or HHS select 
agents or toxins and any combination of PPQ or VS select agents or 
toxins, an individual or entity must submit the registration 
application package to APHIS or CDC, but not both. In this final rule, 
we are amending both sections to set out this new framework for 
submitting registration applications (newly designated 7 CFR 331.7(d) 
and 9 CFR 121.7(d)).
    As previously discussed, APHIS and CDC are also developing a single 
shared web-based system that will allow the regulated community to 
conduct transactions electronically with either agency via a single web 
portal. By providing a single web portal, APHIS and CDC will be able to 
interact efficiently and effectively with the regulated community while 
reducing the burden on the public. We envision that this system will 
enable the entity to dynamically communicate with APHIS and CDC in a 
digitally secured environment using a single web portal. The web portal 
will provide a platform for electronic exchange of information. It will 
allow entities to access data related to their own registration data 
and allow them to create, amend, and submit registration applications; 
requests for approvals for transfers, exemptions, or exclusions; and 
any other required forms without the need to print, mail, or e-mail 
hard copies. Hard copy registration materials and other required forms 
will still be accepted. The single web portal will be available in 
winter 2005.
    Several commenters requested more information about the 
registration process. One commenter asked how long will it take to 
receive a certificate of registration after all the paperwork has been 
submitted. The commenter urged APHIS to promptly process registration 
applications so as not to disrupt valuable research and impede academic 
planning. Another commenter suggested that APHIS add information to the 
final rule to indicate when an entity should submit renewal 
applications (i.e., at least 90 days prior to expiration).
    We are committed to promptly processing initial registration 
applications and renewal applications. The time needed to process a 
registration application and issue a certificate of registration 
depends on the complexity and completeness of the application. However, 
to provide more guidance about the submission of renewal applications, 
we recommend that the registration application and the information 
necessary to conduct the required security risk assessments be 
submitted at least 8 weeks prior to the expiration of the date of the 
certificate of registration.
    Interim 7 CFR 331.6(b)(1) and 9 CFR 121.7(b)(1) (newly designated 7 
CFR 331.7 and 9 CFR 121.7) indicated that, as one of the conditions of 
registration, the owner or controller of an entity must be approved by 
APHIS following a security risk assessment by the Attorney General.
    A commenter asked who would be deemed to own or control the entity 
in the context of an academic institution. Another commenter thought 
the phrase ``individual who controls the facility'' meant the senior 
administrators to whom the responsible official reports and not the 
members of the Board of Trustees.
    The determination of who is an owner or controller of an academic 
institution (i.e., institution of higher education) depends on whether 
it is a public or private institution of higher education. Federal, 
State, or local governmental agencies, including public institutions of 
higher education, are exempt from the security risk assessment for the 
entity and the individual who owns or controls such entity. However, 
for a private institution of higher education, an individual will be 
deemed to own or control the entity if the individual is in a 
managerial or executive capacity with

[[Page 13256]]

regard to the entity's select agents or toxins or with regard to the 
individuals with access to the select agents or toxins possessed, used, 
or transferred by the entity. We consider an entity to be an 
institution of higher education if it is an institution of higher 
education as defined in the Higher Education Act of 1965 (20 U.S.C. 
1001(a)) or an organization described in the Internal Revenue Code of 
1986 (26 U.S.C. 501(c)(3)). Because entities that meet this criteria do 
not have an owner, the individual(s) in control of the entity must be 
approved by the Administrator or the HHS Secretary following a security 
risk assessment by the Attorney General. For all other entities, an 
individual will be deemed to own or control the entity if the 
individual: (1) Owns 50 percent or more of the entity, or is a holder 
or owner of 50 percent or more of its voting stock, or (2) is in a 
managerial or executive capacity with regard to the entity's select 
agents or toxins or with regard to the individuals with access to the 
select agents or toxins possessed, used, or transferred by the entity.
    To clarify the requirements for owners or controllers of an entity, 
we are making several changes to the registration sections in this 
final rule. We are making clear that the individuals must be approved 
by the Administrator or HHS Secretary based on a security risk 
assessment by the Attorney General (7 CFR 331.7(c)(1) and 9 CFR 
121.7(c)(1)). We are also moving the information contained in footnote 
4 in interim 7 CFR 331.6 and footnote 7 in interim 9 CFR 121.7 to a new 
paragraph in both sections, 7 CFR 331.7(c)(2) and 9 CFR 121.7(c)(2), 
which states that Federal, State, or local governmental agencies, 
including public institutions of higher education, are exempt from the 
security risk assessment for the entity and the individual who owns or 
controls such entity. In addition, we are adding the following 
paragraphs to both 7 CFR 331.7 and 9 CFR 121.7 to clarify who will be 
deemed to own or control an entity and to indicate the criteria by 
which an entity will be considered an institution of higher education:
     For a private institution of higher education, an 
individual will be deemed to own or control the entity if the 
individual is in a managerial or executive capacity with regard to the 
entity's select agents or toxins or with regard to the individuals with 
access to the select agents or toxins possessed, used, or transferred 
by the entity.
     For entities other than institutions of higher education, 
an individual will be deemed to own or control the entity if the 
individual: (1) Owns 50 percent or more of the entity, or is a holder 
or owner of 50 percent or more of its voting stock; or (2) is in a 
managerial or executive capacity with regard to the entity's select 
agents or toxins or with regard to the individuals with access to the 
select agents or toxins possessed, used, or transferred by the entity.
     An entity will be considered to be an institution of 
higher education if it is an institution of higher education as defined 
in section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 
1001(a)), or is an organization described in 501(c)(3) of the Internal 
Revenue Code of 1986, as amended (26 U.S.C. 501(c)(3)).
    Finally, we are adding a footnote to 7 CFR 331.7 and 9 CFR 121.7 to 
clarify that more than one individual may meet the criteria for 
ownership or control of an entity.
    Interim 7 CFR 331.6(b)(2) and 9 CFR 121.7(b)(2) provided that APHIS 
may issue a certificate of registration if, among other things, the 
Administrator approves an entity's biosafety, containment, and 
security.
    In drafting this provision, we intended to stress to the regulated 
community the importance of the biosafety, containment, and security 
requirements. However, we did not intend to suggest that an individual 
or entity did not have to meet the other requirements of the 
regulations. Since the issuance of a certificate of registration is an 
administrative action taken by APHIS, it is not necessary to include 
this provision in the regulations. Accordingly, we are deleting this 
provision in both sections.
    Interim 7 CFR 331.6(b)(3) and 9 CFR 121.7(b)(3) provided that APHIS 
may issue a certificate of registration if, among other things, the 
Administrator determines that the individual or entity seeking to 
register has a lawful purpose to possess, use, or transfer agents or 
toxins.
    One commenter stated that it is unclear how APHIS will determine if 
the entity has an unlawful purpose to possess, use, or transfer select 
agents. The commenter asked what information APHIS will use to make 
this determination.
    To determine whether an entity has a lawful purpose to possess, 
use, or transfer select agents or toxins, APHIS will consider the 
information contained in the registration application and any other 
information available to APHIS about the entity. This determination 
will be made on a case-by-case basis. However, since this is an 
administrative action taken by APHIS, it is unnecessary to include this 
provision in the regulations. Accordingly, we are deleting this 
provision in both sections. In addition, we are amending newly 
designated 7 CFR 331.7(f) and 9 CFR 121.7(f) to clarify that the 
issuance of a certificate of registration may be contingent upon 
inspection or submission of additional information, such as the 
security plan, biocontainment/biosafety plan, incident response plan, 
or any other documents required to be prepared under each part. These 
changes will make the APHIS and CDC regulations consistent.
    In interim 7 CFR 331.5(b) and 9 CFR 121.6(b), we provided that each 
entity must designate an individual to be its responsible official and 
that this individual must have the authority and control to ensure 
compliance with the regulations. Furthermore, in interim 7 CFR 331.6(c) 
and 9 CFR 121.7(d), we provided that a certificate of registration will 
be valid for only the specific agents or toxins and specific activities 
and locations listed on the certificate.
    One commenter stated an entity should be able to apply for a single 
certificate of registration to cover activities at all buildings on a 
campus or site under the control and authority of the responsible 
official, which would include both contiguous and dispersed sites 
within a local geographical area. The commenter stated that it is 
overly burdensome to require separate registrations for each general 
physical location (defined as a building or a complex of buildings at a 
single mailing address). The commenter claimed that the administrative 
and control functions at research and academic institutions are 
efficiently managed by a centralized department responsible for more 
than one physical location. Similarly, a commenter stated that the 
provisions concerning location should be amended to cover a single 
administrative organization under a single responsible official. 
Another commenter requested that the final regulations allow campuses 
to designate responsible officials with responsibility for an entire 
campus.
    APHIS designed these provisions to ensure that the responsible 
official has the requisite authority and control to ensure compliance 
with the select agent regulations. We reasoned that a responsible 
official would be better able to ensure compliance with the regulations 
if he/she managed only one general physical location. While we still 
believe that to be true, we recognize that some responsible officials 
will be able to ensure compliance for an entire campus or business 
complex. Therefore, in this final rule, the registration sections 
(newly designated 7 CFR 331.7(g) and 9 CFR 121.7(g)) provide that a 
certificate

[[Page 13257]]

of registration will be valid for one physical location (a room, a 
building, or a group of buildings) where the responsible official will 
be able to perform the responsibilities required in this part, for 
specific select agents or toxins, and for specific activities. We 
believe this change will provide more flexibility and guidance to 
entities seeking to register.
    In interim 7 CFR 331.6(d) and 9 CFR 121.7(e), we provided that a 
certificate of registration may be amended to reflect changed 
circumstances and that the responsible official must immediately notify 
APHIS of such changes in circumstances that occur after submission of 
the application for registration or after receipt of a certificate of 
registration.
    A commenter said that it is unclear how great a change would 
require notification of APHIS or CDC. The commenter suggested that 
investigators should instead submit annual reports of projects done and 
projects planned. Another commenter stated that there is no specific 
information in the regulations about what information must be reported 
and what constitutes immediately (i.e., within 24 hours). The commenter 
indicated that, if the entire registration application must be 
resubmitted, then APHIS should allow a minimum of 7 to 10 business 
days.
    To clarify the requirements for amending a registration application 
and a certificate of registration, in this final rule we are deleting 
the provisions of interim 7 CFR 331.6(d) and 9 CFR 121.7(e). In their 
place, we are adding a new paragraph (e) in newly designated 7 CFR 
331.7 and 9 CFR 121.7 that requires the responsible official to provide 
prompt notification of any changes in the registration application by 
submitting the relevant page(s) of the registration application. In 
addition, we are adding a new paragraph (h) in both sections to require 
that, prior to any change, the responsible official must apply for an 
amendment to a certificate of registration by submitting the relevant 
page(s) of the registration application. Finally, to clarify the 
requirements for when an entity loses the services of its responsible 
official, we are adding a new paragraph (i) in both sections to require 
an entity to immediately notify APHIS or CDC if it loses the services 
of its responsible official. These paragraphs also provide that an 
entity may continue to possess or use select agents or toxins only if 
it appoints as the responsible official another individual who has been 
approved by the Administrator or the HHS Secretary following a security 
risk assessment by the Attorney General and who meets the requirements 
of the regulations.
    Interim 7 CFR 331.6(e) and 9 CFR 121.7(f) stated that a responsible 
official who wishes to discontinue possessing, using, or transferring 
an agent or toxin may inactivate the agent or toxin or he/she may 
transfer the agent or toxin to a registered entity. Both sections 
further provided that APHIS must be notified 5 business days prior to a 
planned inactivation so that APHIS may have the opportunity to observe 
the inactivation.
    One commenter asked when APHIS will observe the destruction of a 
select agent. Another commenter asked if a responsible official for a 
diagnostic laboratory is required to notify APHIS 5 business days prior 
to destroying a select agent or toxin.
    In the final rule, we are deleting these paragraphs and simply 
providing that a certificate of registration will be terminated upon 
the written request of the entity if the entity no longer possesses or 
uses any select agents or toxins and no longer wishes to be registered 
(newly designated 7 CFR 331.7(j) and 9 CFR 121.7(j)). This change 
should eliminate any confusion between this reporting requirement and 
the reporting requirements for diagnostic exemptions.
    The regulations (interim 7 CFR 331.6(f) and 9 CFR 121.7(g); newly 
designated 7 CFR 331.7(k) and 9 CFR 121.7(k)) state that a certificate 
of registration will be valid for a maximum of 3 years.
    A commenter recommended that certificates of registration be valid 
for 5 years to be consistent with the security risk assessments, 
simplify paperwork requirements for the entity, and reduce cost to 
government.
    We believe it is reasonable to provide that a certificate of 
registration will be valid for a maximum of 3 years. A 3-year 
registration period takes into consideration the burden on the public 
and the risks posed by select agents and toxins. In addition, it is 
consistent with APHIS' permit systems and other established programs 
for laboratory certification or registration (e.g., Clinical Laboratory 
Improvement Amendments (CLIA) and the College of American Pathologists 
(CAP)), which are generally valid for 2 to 3 years. Accordingly, we are 
making no change based on this comment.

Denial, Revocation, and Suspension of Registration

    Interim 7 CFR 331.7(a)(3) and 9 CFR 121.8(a)(3) provided that APHIS 
may deny an application for registration or revoke registration if the 
responsible official does not have a lawful purpose to possess, use, or 
transfer listed agents or toxins. In addition, interim 7 CFR 
331.7(a)(4) and 9 CFR 121.8(a)(4) provided that APHIS may deny an 
application for registration or revoke registration if the responsible 
official is an individual who handles or uses listed agents or toxins 
and he/she does not have the necessary training or skills to handle 
such agents or toxins. To be consistent with CDC, we are deleting these 
provisions in this final rule.
    Interim 7 CFR 331.7(a)(5) provided that APHIS may deny an 
application for registration or revoke registration if the entity does 
not meet the containment and security requirements prescribed by the 
Administrator, while interim 9 CFR 121.8(a)(5) provided that APHIS may 
deny an application for registration or revoke registration if the 
entity does not meet the biosafety, containment, and security 
requirements prescribed by the Administrator. In addition, interim 7 
CFR 331.7(a)(6) provided that APHIS may deny an application for 
registration or revoke registration if there are egregious or repeated 
violations of the containment or security requirements, while interim 9 
CFR 121.8(a)(6) provided that APHIS may deny an application for 
registration or revoke registration if there are egregious or repeated 
violations of the biosafety, containment, or security requirements.
    In drafting these provisions, we wished to stress to the regulated 
community the importance of the biosafety, containment, and security 
requirements. However, we never intended to suggest that an entity did 
not have to meet the other requirements of each part. Therefore, we are 
amending these provisions in this final rule to provide that an 
application may be denied or a certificate of registration revoked or 
suspended if the individual or entity does not meet the requirements of 
the applicable part (newly designated 7 CFR 331.8(a)(3) and 9 CFR 
121.8(a)(3)). These changes will clarify the registration requirements 
and make both sections consistent with CDC's regulations.
    In addition, in this final rule, we are clarifying the actions an 
entity must take in the event that APHIS suspends or revokes a 
certificate of registration. Specifically, we are adding a paragraph to 
require that, upon notification of suspension or revocation, an 
individual or entity must: (1) Immediately stop all use of each select 
agent or toxin covered by the revocation or suspension order; (2) 
immediately safeguard and secure each select agent or toxin covered by 
the revocation or suspension order from theft, loss, or release; and 
(3) comply with all disposition instructions issued

[[Page 13258]]

by the Administrator for each select agent or toxin covered by the 
revocation or suspension (newly designated 7 CFR 331.8(b) and 9 CFR 
121.8(b)).
    In a footnote to interim 7 CFR 331.7(a)(5) and 9 CFR 121.8(a)(5), 
we indicated that APHIS may provide technical assistance and guidance 
on the biosafety, containment, and security requirements. A commenter 
requested information on when and to what degree APHIS will provide 
such assistance.
    As discussed below in the biocontainment/biosafety and security 
sections, in this final rule we are providing a list of documents in 
each part that an entity should consider in developing a 
biocontainment/biosafety or security plan. We recommend that an entity 
review these documents before contacting APHIS for technical 
assistance. We will provide technical assistance and guidance upon 
request.
    Interim 7 CFR 331.7(b) and 9 CFR 121.8(b) provided that APHIS may 
summarily revoke or suspend registration for any of the reasons set 
forth in each section.
    To clarify the provisions for denial, suspension, and revocation of 
registration, in this final rule, we are deleting interim paragraph (b) 
in both sections and simply providing that an application may be denied 
or a certificate of registration revoked or suspended for the reasons 
set forth in each section (newly designated 7 CFR 331.8(a) and 9 CFR 
121.8(a)).
    Interim 7 CFR 331.7(d) and 9 CFR 121.9(d) provided that the denial 
of an application for registration, revocation of registration, and 
suspension of registration may be appealed under each part. In this 
final rule, newly designated 7 CFR 331.8(c) and 9 CFR 121.8(c) provide 
that the denial of an application for registration and revocation of 
registration may be appealed under each part. Furthermore, both 
paragraphs provide that any denial of an application for registration 
or revocation of a certificate of registration will remain in effect 
until a final agency decision has been rendered. These changes will 
clarify the status of an application for registration or a certificate 
of registration during the appeal process.

Responsibilities of the Responsible Official

    To facilitate compliance with the regulations, the regulations 
(interim 7 CFR 331.9 and 9 CFR 121.10; newly designated 7 CFR 331.9 and 
9 CFR 121.9) set out the responsibilities of the responsible official.
    One commenter stated that the APHIS and CDC regulations should have 
the same responsibilities for the responsible official and that these 
responsibilities should be better defined.
    We agree that the APHIS and CDC regulations should contain the same 
provisions for the responsible official. Therefore, in this final rule, 
we are amending newly designated 7 CFR 331.9(a) and 9 CFR 121.9(a) to 
require that an individual or entity required to register under each 
part designate an individual to be the responsible official. Paragraph 
(a) further requires that the responsible official:
     Be approved by the Administrator or the HHS Secretary 
following a security risk assessment by the Attorney General;
     Be familiar with the requirements of this part;
     Have the authority and responsibility to act on behalf of 
the entity;
     Ensure compliance with the requirements of this part; and
     Ensure that annual inspections are conducted for each 
laboratory where select agents or toxins are stored or used in order to 
determine compliance with the requirements of this part. The results of 
each inspection must be documented, and any deficiencies identified 
during an inspection must be corrected.
    In addition, we are deleting the provision for the alternate 
responsible official(s) from the registration section and adding it to 
the responsible official section (newly designated 7 CFR 331.9(b) and 9 
CFR 121.9(b)). These changes will make the APHIS and CDC regulations 
consistent.
    A commenter recommended that APHIS add the following language to 
the regulations: ``This does not preclude the assignment of activities 
in Sec. Sec.  121.10(a)(1) through 121.10(a)(8) to other individuals, 
provided the activities are performed or supervised by a person 
approved under Sec.  121.11 and the results are reviewed and approved 
by the Responsible Official or Alternate Responsible Official.'' The 
commenter stated that it would be inappropriate for the responsible 
official to participate in the actual transferring of an agent or to 
perform data entry to maintain records.
    In response to this comment, in this final rule we are amending the 
regulations to provide that the individual or entity required to 
register under each part, and not the responsible official, must 
provide training, maintain records, and provide notice of theft, loss, 
or release of select agents or toxins (newly designated 7 CFR 331.15 
and 9 CFR 121.15, 7 CFR 331.17 and 9 CFR 121.17, and 7 CFR 331.19 and 9 
CFR 121.19). This change will allow the responsible official to 
delegate certain responsibilities. For instance, interim 7 CFR 
331.14(a) and 9 CFR 121.15(a) stated that the responsible official must 
maintain complete, up-to-date records of information necessary to give 
an accounting of all of the activities related to listed agents or 
toxins. In this final rule, we are amending the regulations to require 
the individual or entity to maintain such records (newly designated 7 
CFR 331.17 and 9 CFR 121.17).
    Interim 7 CFR 331.9(b) and 9 CFR 121.10(b) (newly designated 7 CFR 
331.9 and 9 CFR 121.9) required the responsible official for a 
diagnostic laboratory, or other entity possessing, using, or 
transferring listed agents or toxins that are contained in specimens 
presented for diagnosis to immediately report the identification of 
such agents or toxins to the Administrator and to other appropriate 
authorities when required by Federal, State, or local law. Furthermore, 
both paragraphs provided that the Administrator may require less 
frequent reporting during agricultural emergencies or outbreaks, or in 
endemic areas.
    In this final rule, we are amending newly designated 7 CFR 331.9(c) 
and 9 CFR 121.9(c) to require the responsible official to report the 
identification and final disposition of any select agent or toxin 
contained in a specimen for diagnosis or verification. In addition, we 
are adding a new paragraph (d) to 9 CFR 121.9 to require the 
responsible official to report the identification and final disposition 
of any select agent or toxin contained in a specimen presented for 
proficiency testing. This information will help us to identify 
outbreaks and to monitor activities related to select agents and 
toxins.
    We are also amending newly designated 9 CFR 121.9(c) to require the 
responsible official to immediately report the identification of 
specified select agents and toxins with a report of the final 
disposition of the agent or toxin due within 7 calendar days after 
identification. The responsible official must report the identification 
and final disposition of the other select agents and toxins within 7 
calendar days after identification. This will make the reporting 
requirements for registered entities consistent with those in the 
exemption sections (newly designated 9 CFR 121.5 and 121.6). Finally, 
we are deleting in both sections the requirement that the 
identification of a select agent or toxin be reported to appropriate 
authorities when required

[[Page 13259]]

by Federal, State, or local law (interim 7 CFR 331.9(b) and 9 CFR 
121.10(b)). This change corresponds to a similar change made in the 
exemption sections (interim 7 CFR 331.4, 9 CFR 121.4, and 9 CFR 121.5).
    One commenter requested clarification of the diagnostic exemptions 
and the provisions of interim 9 CFR 121.10(b) requiring the responsible 
official for a diagnostic laboratory to report identifications. The 
commenter noted that exempt diagnostic laboratories are not required to 
have a responsible official.
    The reporting requirements in interim 9 CFR 121.10(b) (newly 
designated 7 CFR 331.9(c) and 9 CFR 121.9(c)) pertain to registered 
diagnostic laboratories. The regulations require that both exempt and 
registered entities report the identification of a select agent or 
toxin. We adopted these reporting requirements because this information 
will help us to identify outbreaks and to monitor activities related to 
select agents and toxins. Accordingly, we are making no change in 
response to this comment.

Restricting Access/Security Risk Assessments

    Interim 7 CFR 331.10 and 9 CFR 121.11 stated that an individual may 
not have access to listed agents and toxins unless approved by APHIS 
or, for overlap agents, APHIS or CDC. Both sections provided that APHIS 
will grant, limit, or deny access approval and, interim 9 CFR 121.11, 
provided that APHIS or CDC will make this determination for overlap 
agents or toxins. Interim 7 CFR 331.10 and 9 CFR 121.11 further 
provided that the responsible official is responsible for ensuring that 
only approved individuals within the entity have access to agents or 
toxins.
    In this final rule, we are amending these sections to clarify that 
an individual must be approved for access by the Administrator or the 
HHS Secretary following a security risk assessment by the Attorney 
General (newly designated 7 CFR 331.10 and 9 CFR 121.10). In addition, 
we are deleting the provision that the responsible official is 
responsible for ensuring that only approved individuals have access to 
select agents or toxins. This change will make it clear that the 
registrant and the individual are responsible for ensuring that the 
individual does not have access to any select agent or toxin unless 
approved by the Administrator or the HHS Secretary.
    Several commenters requested information about the security risk 
assessments conducted by the Attorney General.
    To obtain a security risk assessment, an individual or entity must 
submit a completed FBI Form FD-961 and two legible fingerprint cards, 
printed by a local law enforcement agency, to the Criminal Justice 
Information Services (CJIS) Division of the Federal Bureau of 
Investigation. Fingerprint cards and FBI Form FD-961 may be obtained by 
calling (304) 625-4900. FBI Form FD-961 is also available on the 
Internet at http://www.fbi.gov/terrorinfo/bioterrorfd961.htm. It would 
be impractical to include this information in the regulations because 
the Attorney General determines the information and processes required 
for a security risk assessment. Accordingly, we are making no change 
based on these comments.
    One commenter recommended that security risk assessments be 
completed within 2 weeks. Another commenter stated that a person should 
be permitted to work with select agents or toxins under the direct 
supervision of an approved person if the individual subject to the 
background check suffers a delay in excess of 10 working days.
    Security risk assessments are conducted by the Attorney General, 
not APHIS. The time required to complete a security risk assessment 
depends on the completeness of the application and the results of the 
database search. In general, a security risk assessment may be 
completed in 45 days. However, in certain cases, additional time may be 
needed to verify the results of the database search. We are making no 
changes based on these comments.
    A commenter asserted that personnel screening should include, at a 
minimum, a criminal background check, credit check, and random drug 
screening.
    In accordance with the Act, each individual identified by the 
responsible official must undergo a security risk assessment. The Act 
does not require a credit check or random drug screening. However, this 
does not preclude an entity from having more stringent personnel 
screening for individuals with access to select agents or toxins. 
Accordingly, we are making no changes based on this comment.
    Interim 7 CFR 331.10(b) and 9 CFR 121.11(b) required the 
responsible official to request access approval for only those 
individuals who have a legitimate need to handle or use listed agents 
or toxins, and who have the appropriate training and skills to handle 
such agents and toxins.
    APHIS received a number of comments dealing with the term 
``access.'' A commenter stated that judgments about an individual's 
need to handle agents and the adequacy of their training and skills is 
a matter for the responsible official, not APHIS. This commenter 
recommended that APHIS rely upon the responsible official to make 
informed judgments about an individual's need for access and their 
proficiency in handling select agents and toxins. One commenter noted 
the term ``access'' is used to describe two distinct situations--access 
to select agents and toxins by individuals who are authorized to handle 
and use them, and approved entry to an area where select agents or 
toxins are present by individuals who are not authorized to handle or 
use such agents or toxins. Several commenters recommended that APHIS 
define the term ``access'' as the ``ability to gain physical control of 
select agents and toxins.'' Another commenter suggested the word 
``access'' be changed to ``handle or use'' throughout the regulations. 
The commenter noted that many people may have access to a containment 
space but never handle or use agents or toxins. Similarly, one 
commenter argued that the regulations are conceptually flawed because 
they focus on restricting access to the laboratory rather than to the 
select agent or toxin. The commenter said that numerous individuals 
need to access lab space for a variety of reasons and that it is 
unnecessary and burdensome to require that they be continually escorted 
or undergo security risk assessments. Another commenter recommended 
that APHIS define the term ``entry,'' which would refer to admission of 
unapproved individuals into an area where select agents and toxins are 
present.
    In the December 2002 interim rule, we provided that an individual 
may not have access to listed agents or toxins unless approved by APHIS 
or, for overlap agents or toxin, APHIS or CDC. We required access 
approval for each individual with a legitimate need to handle or use 
agents or toxins, and the necessary training and skills to handle such 
agents or toxins. We continue to believe that individuals that handle 
or use select agents or toxins must be approved for such access. 
However, we agree with the commenters that access approval should also 
be required for individuals who have the ability to gain possession. 
Therefore, this final rule provides that an individual will be deemed 
to have access at any point in time if the individual has possession of 
a select agent or toxin (e.g., carries, uses, or manipulates) or the 
ability to gain possession of a select agent or toxin (newly designated 
7 CFR 331.10(b) and 9 CFR 121.10(b)). In addition, we are

[[Page 13260]]

requiring in both sections that each individual with access to select 
agents or toxins have the appropriate education, training, and/or 
experience to handle or use such agents or toxins (newly designated 7 
CFR 331.10(c) and 9 CFR 121.10(c)). However, in this final rule, we are 
removing the requirement that the responsible official submit 
information about an individual's training and skills to APHIS (interim 
7 CFR 331.10(e) and 9 CFR 121.11(e)). These changes will make it clear 
that the registered individual or entity, and not APHIS, is responsible 
for ensuring that an individual with access to select agents or toxins 
has the appropriate education, training, and/or experience to handle 
such agents or toxins.
    Several commenters argued that access approval should be portable 
from entity to entity, from location to location, and from project to 
project for the duration of the valid period. A commenter stated that 
delays in access approval could be avoided if an individual's approval 
was portable. Another commenter asked if an individual will need a new 
security risk assessment if he or she has already been cleared at one 
entity but will visit another entity to conduct research.
    We do not believe it is necessary to make an individual's access 
approval portable in order to avoid delays in such approval. The 
Administrator or the HHS Secretary may grant access approval to an 
individual following a security risk assessment by the Attorney 
General. A security risk assessment may be completed in 45 days unless 
additional time is needed to verify the database search results. 
However, in recognition of the need for flexibility for visiting 
researchers, APHIS, CDC, and the Attorney General have developed 
procedures by which an approved individual may visit another registered 
entity without having to undergo another security risk assessment by 
the Attorney General. Specific guidance on these procedures is 
available on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index/html. We note that an individual who ceases to be 
employed by the entity at which he/she originally received access 
approval must obtain new access approval through his/her new employer. 
We are making no changes to the regulations in response to these 
comments.
    A commenter asserted that the L or Q clearances (or their 
equivalent) granted in Department of Energy laboratories should be 
considered synonymous with the security risk assessment, and, 
therefore, approved.
    Section 212(e) of the Act requires that registered persons provide 
access to select agents and toxins to only those individuals that have 
a legitimate need to handle or use such agents and toxins, and that 
those individuals undergo a security risk assessment by the Attorney 
General. The Act provides no exemption for Federal clearances. 
Accordingly, we are making no change based on this comment.
    The regulations (interim 7 CFR 331.10(f) and 9 CFR 121.11(f); newly 
designated 7 CFR 331.10(e) and 9 CFR 121.10(e)) provide that the access 
approval process for individuals may be expedited upon request by the 
responsible official and a showing of good cause.
    Several commenters stated that APHIS and the Attorney General 
should establish timelines for responding to requests for expedited 
review for security risk assessments.
    We do not believe it is necessary to establish timelines for 
responding to requests for expedited review for security risk 
assessments. In our experience, an expedited security risk assessment 
can be completed within a week, barring any complications. Therefore, 
we are making no change based on this comment.
    Another commenter asked what constituted ``good cause'' for 
expedited review of access approval. This commenter asserted that 
Federal clearances should be a reason for expedited review.
    This final rule cites several examples of good cause to expedite a 
security risk assessment (e.g., public health or agricultural 
emergencies, national security, a short-term visit by a prominent 
researcher). We do not believe that a Federal clearance alone is 
sufficient reason to expedite a security risk assessment. Thus, we are 
making no change in response to this comment.
    Interim 7 CFR 331.10(h) and 9 CFR 121.11(h) provided that APHIS may 
deny or limit access of an individual to agents or toxins if:
     The Attorney General identifies the individual as a 
restricted person under 18 U.S.C. 175b;
     The Attorney General identifies the individual as 
reasonably suspected by any Federal law enforcement or intelligence 
agency of (1) committing a crime set forth in 18 U.S.C. 2332b(g)(5), 
(2) knowing involvement with an organization that engages in domestic 
or international terrorism (as defined in 18 U.S.C. 2331) or with any 
other organization that engages in intentional crimes of violence, or 
(3) being an agent of a foreign power as defined in 50 U.S.C. 1801;
     The Administrator determines that the individual does not 
have a legitimate need to handle listed agents or toxins;
     The individual does not have the necessary training and 
skills to handle listed agents or toxins; or
     The Administrator determines that such action is necessary 
to protect plant health or plant products, or animal health or animal 
products.
    In this final rule, newly designated 7 CFR 331.10(f) and 9 CFR 
121.10(f) provide that an individual's access approval may be denied, 
limited, or revoked if the individual is a restricted person under 18 
U.S.C. 175b or is reasonably suspected by any Federal law enforcement 
or intelligence agency of committing a crime set forth in 18 U.S.C. 
2332b(g)(5), knowing involvement with an organization that engages in 
domestic or international terrorism (as defined in 18 U.S.C. 2331) or 
with any other organization that engages in intentional crimes of 
violence, or being an agent of a foreign power as defined in 50 U.S.C. 
1801. This has always been the way these provisions have been 
interpreted; however, we are making this change to both sections for 
clarification purposes.
    To be consistent with a change made in the section pertaining to 
denial, revocation, or suspension of registration (newly designated 7 
CFR 331.8 and 9 CFR 121.8), in this final rule we are deleting the 
provision that the Administrator may deny, limit, or revoke an 
individual's access approval if the individual does not have a 
legitimate need to handle select agents or toxins. In addition, we are 
deleting the provision pertaining to an individual's training and 
skills to be consistent with CDC's regulations.
    A commenter stated that limited access, whereby the individual can 
only handle or use the agent or toxin under the direct supervision of 
an approved individual, is impractical. The commenter noted that each 
faculty member, postdoctoral fellow, or student who is a member of a 
research team is expected to make significant, independent 
contributions to research; also, it would be too burdensome for 
institutions to track whether individuals have full or limited access. 
The commenter stated that provisions for limited access would be 
unnecessary if the regulations included a precise definition of access.
    Section 212(e)(2) of the Act provides for limited access approval. 
The Administrator will determine what constitutes limited access on a 
case-by-case basis. The determination will take into consideration all 
of the facts at

[[Page 13261]]

hand and be commensurate with the risks posed by the select agent or 
toxin. We are making no change based on this comment.
    One commenter argued that the Attorney General should allow the 
research community to comment on how the definition of ``restricted 
person'' will be interpreted and applied. This commenter stated that, 
while the Attorney General is bound by statutory language in the 
respective categories, interpretation will be required to make the 
definitions operational. For instance, the commenter asked if a 
scientist who has fled political persecution in another country, and 
who may therefore have an outstanding foreign arrest warrant, would be 
considered a restricted person. Another commenter recommended that the 
Administrator reserve the authority, in exceptional circumstances, to 
allow individuals deemed ineligible to have access to select agents and 
toxins for a limited time. The commenter stated that it is in the 
national interest to take a nuanced approach that takes into account 
the contributions the individual may be able to make to the country. 
This commenter stated there should be an opportunity for individuals 
and their sponsoring institutions to make the argument that an 
individual has exceptional talent and insight that should be used to 
advance research, and that an individual does not present a security 
risk, even if he or she meets the criteria for a restricted person.
    The statutory requirements are clear, and it is not necessary for 
the research community to assist in the interpretation and application 
of the term `restricted person.' In accordance with the Act, the 
Administrator may limit or deny access to PPQ and VS select agents and 
toxins to individuals whom the Attorney General has identified as a 
``restricted person'' under 18 U.S.C. 175b. Furthermore, the 
Administrator must deny access to overlap select agents and toxins to 
individuals whom the Attorney General has identified as a ``restricted 
person.'' According to 18 U.S.C. 175b, ``the term ``restricted person'' 
means an individual who:
     Is under indictment for a crime punishable for a term 
exceeding 1 year;
     Has been convicted in any court of a crime punishable by 
imprisonment for a term exceeding 1 year;
     Is a fugitive from justice;
     Is an unlawful user of any controlled substance (as 
defined in section 102 of the Controlled Substances Act (21 U.S.C. 
802));
     Is an alien illegally or unlawfully in the United States;
     Has been adjudicated as a mental defective or has been 
committed to any mental institution;
     Is an alien (other than an alien lawfully admitted for 
permanent residence) who is a national of a country as to which the 
Secretary of State, pursuant to section 6(j) of the Export 
Administration Act of 1979 (50 U.S.C. App. 2405(j), section 620A of 
chapter 1 of part M of the Foreign Assistance Act of 1961 (22 U.S.C. 
2371), or section 40(d) of chapter 3 of the Arms Export Control Act (22 
U.S.C. 2780(d)), has made a determination (that remains in effect) that 
such country has repeatedly provided support for acts of international 
terrorism; or
     Has been discharged from the Armed Services of the United 
States under ``dishonorable conditions.''
    Based on the foregoing, we are making no change in response to this 
comment.
    Interim 7 CFR 331.10(g) and 9 CFR 121.11(g) provided that APHIS 
will notify the responsible official if an individual is granted full 
or limited access, or denied access to listed agents or toxins. Both 
sections further provided that APHIS will notify the individual if he/
she is denied access or is granted only limited access.
    Several commenters recommended that any entities or individuals 
denied access to select agents and toxins be notified of the reasons 
for the denial; otherwise, they are unable to make a meaningful request 
for an administrative review.
    APHIS will provide written notice of any denial, limitation, or 
revocation of access approval, including the reason(s) therefore. 
However, since this is an administrative action ``taken'' by APHIS, it 
is unnecessary to include this information in the regulations. 
Accordingly, we are deleting this paragraph in both sections in this 
final rule.
    The regulations (interim 7 CFR 331.10(j) and 9 CFR 121.11(k); newly 
designated 7 CFR 331.10(h) and 9 CFR 121.10(i)) provide that access 
approval is valid for a maximum of 5 years.
    One commenter recommended that APHIS reconsider the timeframes for 
renewal of registration packages (3 years) and access approval (5 
years). The commenter stated that it would be easier for the regulated 
community if the renewals were concurrent and could be sent at one 
time.
    In establishing the timeframe for registration, we took into 
consideration the risks of the select agents and toxins and the fact 
that APHIS' permits are valid for a similar timeframe, while, in 
establishing the timeframe for access approvals, we took into 
consideration the burden on the public and the fact that the Act allows 
for approvals to be valid for up to 5 years. We believe that these 
timeframes are reasonable and consistent with the requirements of the 
Act. We do not believe that it will be easier for the regulated 
community if the renewals are concurrent and can be sent at one time. 
Access approvals are granted by the Administrator or the HHS Secretary 
on a rolling basis due to frequent staff changes at entities and 
variations in the time it takes for the Attorney General to conduct an 
individual's security risk assessment. If APHIS adopted the same 
timeframe for registration and access approval, it is likely that some 
individuals in an entity would have to renew their access approvals in 
a much shorter timeframe than other individuals in the same entity. We 
believe this would cause undue burden on the public. Accordingly, we 
are making no changes based on this comment.
    The regulations (interim 7 CFR 331.10(k) and 9 CFR 121.11(l); newly 
designated 7 CFR 331.10(i) and 9 CFR 121.10(j)) require immediate 
notification when an individual's access to agents or toxins is 
terminated by the entity and the reasons therefore.
    A commenter requested clarification as to what constitutes 
``immediately.'' The commenter stated that large entities would find it 
difficult to provide written notices within 24 hours. The commenter 
recommended that APHIS require an initial notification by phone or fax 
within 72 hours that is followed up by a written notice within 7 
business days.
    The regulations do not require written notice of a termination of 
access. Notice of a termination of access may be provided by telephone, 
fax, or e-mail. We are making no change in response to this comment.

Security

    Interim 7 CFR 331.11 required that an individual or entity develop 
and implement a Biocontainment and Security Plan. Interim 9 CFR 121.12 
contained similar requirements for a Biosafety and Security Plan. In 
both sections, paragraph (a)(2) stated that the security systems and 
procedures must be designed according to a site-specific risk 
assessment and provide graded protection in accordance with the threat 
posed by the agent or toxin. Both sections also set out the types of 
information that should be contained in the security plan.
    A commenter asserted that biological lab security should be 
administered by only one Federal agency (i.e, the Department of 
Homeland Security) to ensure consistency.

[[Page 13262]]

    Section 212(b) of the Act requires APHIS to establish and enforce 
safeguard and security measure to prevent access to select agents and 
toxins for use in domestic or international terrorism or for any other 
criminal purpose. In addition, the Act provides for interagency 
coordination between APHIS and CDC regarding overlap select agents and 
toxins. As discussed below, APHIS and CDC have amended the regulations 
so that the security requirements are identical and APHIS and CDC have 
established procedures to ensure consistent regulation of select agents 
and toxins. For these reasons, we are making no change in response to 
this comment.
    A commenter recommended that APHIS and CDC adopt identical security 
provisions. Several commenters asked whose security, inspection, and 
compliance standards will be used for overlap agents--APHIS' or CDC's. 
These commenters also asked what will happen if APHIS and CDC do not 
concur.
    Both the APHIS and CDC select agent regulations apply to overlap 
select agents and toxins. To eliminate confusion about whose security 
standards will be used for overlap select agents and toxins, we are 
amending the security sections in this final rule so that the APHIS and 
CDC security requirements are identical (newly designated 7 CFR 331.11 
and 9 CFR 121.11). These changes are discussed in detail below. We 
believe these changes will help to ensure consistent regulation of 
select agents and toxins by APHIS and CDC, including compliance 
inspections. We note that compliance inspections for security will be 
based on the regulations and that inspectors will be looking for 
security that provides graded protection commensurate with the risk of 
the select agent or toxin, given its intended use.
    Several commenters expressed concern that the regulations do not 
provide for preclearance of security plans before an entity invests in 
a security system.
    In this final rule, we recommend that an individual or entity 
consider the following document when developing a security plan--
``Laboratory Security and Emergency Response Guidance for Laboratories 
Working With Select Agents,'' in Morbidity and Mortality Weekly Report. 
An individual or entity should review this document before contacting 
APHIS for technical assistance. We will provide technical assistance 
and guidance upon request. However, in recognition of the commenters' 
concerns, we note that APHIS and CDC are working with interagency 
groups and security experts to draft a document that will provide 
additional guidance about the security required for select agents and 
toxins. This document will be available in spring 2005. We will provide 
this guidance document to the regulated community when it is available.
    A commenter stated that the regulations should clearly distinguish 
between lab security and entity security, especially for large academic 
settings where a secure lab may coexist with educational and research 
labs.
    We disagree. The security regulations are designed to prevent 
unauthorized access, theft, loss, or release of select agents and 
toxins. The regulations require that an entity's security plan be 
designed according to a site-specific risk assessment. Such a risk 
assessment would take into consideration the security needed for a 
select agent lab in a large academic setting. Therefore, we are making 
no change based on this comment.
    One commenter asked what constituted an adequate description of 
safety and security in the required plans. Another commenter asked who 
will judge the adequacy of a security plan.
    A security plan must be sufficient to safeguard the select agent or 
toxin against unauthorized access, theft, loss, or release. APHIS or 
CDC will determine if a security plan is adequate. We are making no 
changes in response to these comments.
    The introductory text in interim 7 CFR 331.11(a)(2) and 9 CFR 
121.12(a)(2) stated that the security systems and procedures must be 
designed according to a site-specific risk assessment and must provide 
graded protection in accordance with the threat posed by the agent or 
toxin. Both sections further provided that the site-specific risk 
assessment should involve a threat assessment and risk analysis in 
which threats are defined, vulnerabilities examined, and risks 
associated with those vulnerabilities identified. Both sections also 
stated that the security systems and procedures must be tailored to 
address site-specific characteristics and requirements, ongoing 
programs, and operational needs and must mitigate the risks identified.
    A commenter suggested replacing the phrase ``in accordance with the 
threat posed by the agent'' with the phrase ``in accordance with the 
consequences posed by the agent or toxin.'' Another commenter pointed 
out that the terms ``risk assessment,'' ``threat assessment,'' 
``vulnerability assessment,'' and ``threats'' are confusing to those 
with little experience in this area and should be clarified. A 
commenter suggested that APHIS replace the phrase ``risks associated 
with those vulnerabilities are mitigated'' with the phrase 
``consequences associated with those vulnerabilities are mitigated.''
    In response to these comments, in this final rule we are deleting 
this text in both sections and adding in its place the requirement that 
an entity's security plan be sufficient to safeguard the select agent 
or toxin against unauthorized access, theft, loss, or release (newly 
designated 7 CFR 331.11(a) and 9 CFR 121.11(a)). In addition, we are 
amending both sections to require that the security plan be designed 
according to a site-specific risk assessment and provide graded 
protection in accordance with the risk of the select agent or toxin, 
given its intended use. We believe these changes will clarify the 
requirements and make the text in this section consistent with other 
sections in the regulations (e.g., biocontainment/biosafety).
    One commenter recommended that entities be required to comply with 
Appendix F of the BMBL as well as the specific USDA manuals cited in 
the rule. The commenter stated that this would mandate the use of 
state-of-the-art approaches for safety and security. A commenter stated 
that the security regulations are inadequate (i.e., key locks and key 
control) and recommended that the pathogens be secured with a modern 
access control system. Another commenter stated that the regulations 
should specify minimum security standards. The commenter recommended 
the following: (1) A minimum of three levels of access control (e.g., 
access to the building, access to the wing of the building, and access 
to the laboratory); (2) a minimum of two levels of access control with 
video surveillance; (3) a minimum of one level of access control with 
security personnel; and (4) a minimum of one level of access control 
with an alarm system with off-site monitoring.
    On the other hand, several commenters recommended a performance 
standard for compliance with the regulations. One commenter stated that 
Appendix F of the BMBL does not provide appropriate guidance for 
developing a performance-based security program because it implies the 
need for a rigorous security program applicable uniformly to all 
biosafety levels. The commenter noted that overly prescriptive 
requirements will impede the development of effective and affordable 
plans and will result in constraining the availability of select agents 
and toxins for the legitimate

[[Page 13263]]

purposes specified in the Act. Another commenter stated that toxins 
should not be subject to the same biocontainment and security measures 
as viruses, bacteria, fungi, and plant pathogens (which are capable of 
replication). The commenter suggested a two-tiered approach, with a 
higher level of security and biocontainment for materials that can be 
propagated. Similarly, a commenter stated the security requirements 
should recognize that not all listed agents are equal from a 
weaponization perspective; therefore, a set of graded protection 
requirements should be established so that the most dangerous pathogens 
and the most likely to be weaponized are protected at higher levels 
than the majority of the select agents.
    Because different select agents and toxins pose differing degrees 
of risk, we believe it would be counterproductive to attempt to prepare 
a detailed list of prescriptive requirements for entities (i.e., a 
``one size fits all'' design standard). Therefore, the regulations 
contain performance standards for biocontainment/biosafety, security, 
and incident response that take into account the risks presented by a 
particular agent or toxin, given its intended use.
    With regard to security, newly designated 7 CFR 331.11 and 9 CFR 
121.11 require each individual or entity required to register under 
each part to develop and implement a written security plan. This 
security plan must be designed according to a site-specific risk 
assessment and must provide graded protection in accordance with the 
risk of the select agent or toxin, given its intended use. In addition, 
newly designated 7 CFR 331.11 and 9 CFR 121.11 require the individual 
or entity to adhere to specified security requirements or implement 
measures to achieve an equivalent or greater level of security. We 
believe these security provisions provide enough flexibility and 
specificity to allow an individual or entity to develop and implement a 
security plan that will safeguard the select agent or toxin against 
unauthorized access, theft, loss, or release.
    However, in recognition of the commenters' concerns, we reiterate 
that APHIS and CDC are working with interagency groups and security 
experts to draft a document that will provide additional guidance about 
the security required for select agents and toxins. This document will 
be available in spring 2005. The 5th edition of the BMBL, which is 
under development, will provide additional guidance on laboratory 
security.
    Interim 7 CFR 331.11(a)(2)(iii) and 9 CFR 121.12(a)(2)(iii) 
required that the security plan describe, among other things, 
cybersecurity.
    One commenter recommended that the term cybersecurity be replaced 
with ``information and cybersecurity.'' The commenter also recommended 
spelling out the assets that should be protected and how they are to be 
protected.
    In this final rule, we are amending these provisions by removing 
the word ``cybersecurity'' and adding in its place the words 
``information systems control'' (newly designated 7 CFR 331.11(c)(1) 
and 9 CFR 121.11(c)(1)). This change is consistent with changes made 
throughout this final rule to ensure that information about select 
agents and toxins is protected.
    Interim 7 CFR 331.11(a)(2)(iv) and 9 CFR 121.12(a)(2)(iv) provided 
that, with respect to areas containing listed agents or toxins, an 
entity or individual must adhere to the specified security requirements 
or implement measures to achieve an equivalent or greater level of 
security.
    Two commenters requested clarification of the term ``area'' with 
regard to large multi-use laboratories. One commenter stated there is 
little benefit in terms of security to require access control, 
specialized training, and personnel background checks for individuals 
who are only sharing lab space with individuals working with select 
agents or toxins. Another commenter suggested that the regulations 
should be flexible enough to allow local solution of this issue (i.e., 
allowing the entity to designate a portion of the lab as a select agent 
area for which use and entry restrictions would be governed by the 
regulations). A commenter recommended that, where labs are used 
intermittently for select agent research, free access be permitted when 
select agents and toxins are not in use and when the agents/toxins are 
secured in a safe or other secured storage.
    As previously noted, the security requirements are designed to 
prevent unauthorized access, theft, loss, or release of select agents 
and toxins. We believe the regulations provide enough flexibility for 
an entity to determine the best way to accomplish this goal. However, 
since the term ``area'' appears to be confusing, in this final rule we 
are deleting the phrase ``with respect to areas containing listed 
agents or toxins'' (newly designated 7 CFR 331.11(d) and 9 CFR 
121.11(d)).
    Interim 7 CFR 331.11(a)(2)(iv)(A) and 9 CFR 121.12(a)(2)(iv)(A) 
stated that an entity must allow unescorted access only to those 
approved individuals who are performing a specifically authorized 
function during hours required to perform that job.
    In its final rule, CDC is amending the comparable provision in its 
rule in response to comments. To be consistent with CDC's regulations, 
we are making a corresponding change in this final rule. Specifically, 
we are amending both sections to provide that an entity may allow 
access only to individuals with access approval from the Administrator 
or the HHS Secretary (newly designated 7 CFR 331.11(d)(1) and 9 CFR 
121.11(d)(1)).
    Interim 7 CFR 331.11(a)(2)(iv)(B) and 9 CFR 121.12(a)(2)(iv)(B) 
required that individuals who are not approved under Sec. Sec.  331.10 
or 121.11, respectively, be allowed to conduct routine cleaning, 
maintenance, repairs, and other non-laboratory functions only when 
escorted and continually monitored.
    A commenter requested clarification of the terms ``escorting'' and 
``continually monitored.''
    These terms are commonly understood and do not require further 
clarification in the regulations. However, upon further review, we are 
amending these provisions to make it clear that an individual who is 
not approved for access by the Administrator or the HHS Secretary may 
conduct routine cleaning, maintenance, repairs, and other activities 
not related to select agents or toxins only when continuously escorted 
by an approved individual (newly designated 7 CFR 331.11(d)(2) and 9 
CFR 121.11(d)(2)).
    Interim 7 CFR 331.11(a)(2)(iv)(C) and 9 CFR 121.12(a)(2)(iv)(C) 
required entities and individuals to control access to containers where 
listed agents and toxins are stored by requiring that such containers 
be locked when not in the direct view of an approved individual and by 
using other monitoring measures, as needed.
    One commenter stated that the phrase, ``when not in direct view of 
an approved individual,'' implies that these areas do not need to be 
secured when an authorized person is present, and that this is 
inappropriate. The commenter said that an area containing select agents 
should be secure at all times and that only authorized persons should 
have access to a freezer. The commenter stated that an individual 
should not bear the burden of being responsible for the security of the 
freezer. Another commenter argued that this requirement is 
unnecessarily stringent and is not feasible in many labs. This 
commenter recommended that the agent or toxin be under the direct 
control of an individual, meaning that an unauthorized person could

[[Page 13264]]

approach the agent or toxin without coming into the view of approved 
staff. A commenter stated there is no need to require locked 
containers. The commenter noted that a freezer that is located outside 
an access-controlled area should be locked, while a freezer that is 
located inside such an area need not be locked.
    We agree that containers where select agents and toxins are stored 
must be secured against unauthorized access at all times. Accordingly, 
we are amending both sections to state that an entity must control 
access to containers by requiring that freezers, refrigerators, 
cabinets, and other containers be secured against unauthorized access 
(newly designated 7 CFR 331.11(d)(3) and 9 CFR 121.11(d)(3)).
    Interim 7 CFR 331.11(a)(2)(iv)(D) and 9 CFR 121.12(a)(2)(iv)(D) 
required the inspection of all packages upon entry and exit.
    Several commenters stated that it is not practical to require 
inspection of all packages upon entry and exit, that doing so provides 
almost no security value, and that doing so may be unsafe. One 
commenter asked if the requirement applied to packages of agents being 
shipped/received or if it applied to briefcases, backpacks, etc. 
Another commenter asked if sharps containers or Petri dishes must be 
inspected.
    We agree that it is not practical to require inspection of all 
packages upon entry and exit. Therefore, in this final rule, we are 
amending both sections to require that an entity inspect all suspicious 
packages before they are brought into or removed from an area where 
select agents or toxins are used or stored (newly designated 7 CFR 
331.11(d)(4) and 9 CFR 121.11(d)(4)).
    Interim 7 CFR 331.11(a)(2)(iv)(E) and 9 CFR 121.12(a)(2)(iv)(E) 
required an entity to establish a protocol for intra-entity transfers, 
including provisions for ensuring that the packaging and movement is 
conducted under the supervision of an approved individual.
    A commenter stated that the requirement for a protocol for intra-
entity transfers is vague and inadequate. The commenter suggested that 
intra-entity movement of select agents should follow a documented chain 
of custody process that minimizes any possibility of diversion.
    We agree. Therefore, in this final rule, we are amending both 
sections to require entities to establish a protocol for intra-entity 
transfers, including chain of custody documentation and provisions for 
ensuring that packaging and movement is conducted under the supervision 
of an individual with access approval from the Administrator or the HHS 
Secretary, including chain-of-custody documents and provisions for 
safeguarding against theft, loss, or release (newly designated 7 CFR 
331.11(d)(5) and 9 CFR 121.11(d)(5)). This change is consistent with 
the recordkeeping requirements in newly designated 7 CFR 331.17 and 9 
CFR 121.17.
    To be consistent with CDC's regulations, we are adding a new 
paragraph (d)(8) in 7 CFR 331.11 and 9 CFR 121.11 that requires an 
individual or entity to separate areas where select agents and toxins 
are stored or used from the public areas of the building.
    One commenter stated that the BMBL and NIH Guidelines require labs 
to post biohazard signs on access doors that list the agents present in 
the lab, which may compromise lab security.
    In this final rule, 9 CFR 121.12 (Biosafety) provides that an 
individual or entity should consider the BMBL and NIH Guidelines when 
developing a biosafety plan. However, it is the entity's responsibility 
to determine if posting biohazard signs on access doors would 
compromise lab security. We are making no change based on this comment.

Biocontainment/Biosafety

    Interim 7 CFR 331.11 required individuals and entities to develop 
and implement a Biocontainment and Security Plan that is commensurate 
with the risk of the agent or toxin, given its intended use. It also 
required that the containment procedures be sufficient to contain the 
agent or toxin (e.g., physical structure and features of entity, and 
operational and procedural safeguards). Interim 9 CFR 121.12 contained 
similar requirements for a Biosafety and Security Plan.
    In this final rule, newly designated 7 CFR 331.12 requires that an 
individual or entity develop and implement a written biocontainment 
plan that is commensurate with the risk of the select agent or toxin, 
given its intended use. Newly designated 9 CFR 121.12 contains similar 
requirements for a biosafety plan. The titles and provisions of the 
plans are different because the select agents and toxins listed in 7 
CFR 331.3 do not pose a severe threat to human health and, therefore, 
it is unnecessary to require that the plant-related plan address 
personnel safety and health.
    Several commenters stated that the biosafety section in the final 
rule should reference existing Department of Health and Human Services 
guidelines and current Occupational Safety and Health Administration 
(OSHA) regulations as authoritative codes of practice that entities 
should consider in developing and implementing a performance-based 
safety plan. On the other hand, several commenters urged APHIS and CDC 
to develop joint biosafety guidelines for select agents that would 
supplant the BMBL and NIH Guidelines.
    In this final rule, we are retaining the existing performance 
standard but we are providing a list of references that an individual 
or entity should consider in developing its biocontainment/biosafety 
plan (newly designated 7 CFR 331.12(c) and 9 CFR 121.12(c)). This 
change should provide more guidance on acceptable biosafety practices.

Restricted Experiments

    In interim 9 CFR 121.10(c), we provided that the responsible 
official must ensure that the following experiments are not conducted 
unless approved by the Administrator, after consultation with experts: 
(1) Experiments utilizing recombinant DNA that involve the deliberate 
transfer of a pathogenic trait or drug resistance trait to biological 
agents that are not known to acquire the trait naturally, if such 
acquisition could compromise the use of the drug to control disease 
agents in humans, veterinary medicine, or agriculture; and (2) 
experiments involving the deliberate formation of recombinant DNA 
containing genes for the biosynthesis of toxins lethal for vertebrates 
at an LD50<100 ng/kg body weight.
    We adopted this provision in the December 2002 interim rule in 
order to be consistent with CDC and to address concerns about 
laboratory manipulation of microbes that alter their characteristics 
(e.g., increased virulence, pathogenicity, or host range; alter mode of 
transmission or route of transmission) and increase the risks to human, 
animal, or plant health. At the time, we did not believe it was 
necessary to require approval for experiments involving recombinant DNA 
of PPQ select agents because these experiments are regulated under 7 
CFR part 340. However, we are adding this provision to 7 CFR part 331 
in this final rule to ensure that these experiments are covered and to 
provide consistency in the select agent regulations.
    To facilitate compliance with these requirements, in this final 
rule we are moving these provisions to a new section in each part 
titled, ``Restricted experiments'' (7 CFR 331.13 and 9 CFR 121.13, 
respectively), and we are adding a footnote to both sections that 
indicates that guidance on the requirements for experiments involving 
recombinant DNA may be obtained from the publication, ``NIH Guidelines 
for

[[Page 13265]]

Research Involving Recombinant DNA Molecules.'' Moreover, 7 CFR 331.13 
provides that these experiments must be conducted under conditions 
prescribed by the Administrator, and that the Administrator may revoke 
approval to conduct these experiments, or suspend or revoke a 
certificate of registration, if the individual or entity fails to 
comply with the requirements of that part. A corresponding provision in 
9 CFR 121.13 provides for consultation with the HHS Secretary. This has 
always been the way we have interpreted all of these requirements; 
however, we are adding these provisions to both sections for clarity.
    One commenter stated that the inclusion of the words ``pathogenic 
trait'' establishes an additional class of experiments that require 
approval from the Administrator. The commenter recommended that the 
APHIS and CDC requirements be identical.
    We agree. Accordingly, we are deleting the words ``pathogenic 
trait'' in both sections of this final rule (newly designated 7 CFR 
331.13(a)(1) and 9 CFR 121.13(a)).
    One commenter stated that the regulations should be amended to 
refer to the NIH Guidelines rather than list the types of experiments 
that are restricted in the regulations. The commenter noted that the 
NIH Guidelines are subject to change and the regulations would not be 
as current as the guidelines and more difficult to amend, if necessary.
    One of the reasons APHIS included these provisions in the 
regulations was to ensure that these categories of experiments are 
conducted only if safe to do so. By including these provisions in the 
regulations, we are providing notice to the public and establishing 
enforceable regulatory requirements. APHIS would have difficulty 
enforcing the provisions of the NIH Guidelines. If it becomes necessary 
to revise the list of restricted experiments, we will initiate 
rulemaking and provide notice and opportunity for public comment. For 
these reasons, we are making no change based on this comment.
    A commenter suggested that the NIH recombinant advisory committee 
be designated to review the restricted experiments.
    We do not believe it is necessary to designate the NIH recombinant 
advisory committee to review applications to conduct restricted 
experiments. The Administrator of APHIS will approve such experiments 
after consultation with subject matter experts and, for overlap select 
agents and toxins, CDC. Accordingly, we are making no changes based on 
this comment.
    One commenter stated that interim 9 CFR 121.10(c)(1) (newly 
designated Sec.  121.13(a)) is open to interpretation and, therefore, 
needs to be more specific. This commenter also suggested that the 
restricted experiment provisions should contain an exception for small 
scale in vitro experiments.
    We disagree that this provision needs to be more specific. However, 
we note that additional guidance on the requirements for experiments 
involving recombinant DNA may be obtained from APHIS or the NIH 
Guidelines. We also disagree that the restricted experiment provisions 
should contain an exemption for small scale in vitro experiments. APHIS 
included these provisions in the regulations to ensure that these 
experiments are conducted only if safe to do so. The commenter provided 
no information to indicate that small scale in vitro experiments are 
safe and, therefore, should be exempted from the restricted experiment 
provisions. Accordingly, we are making no changes in response to this 
comment.
    A commenter stated that an entity utilizes the deliberate formation 
of antibiotic resistance as a common research tool and that the 
restricted experiments provisions will limit this standard research 
practice. The commenter noted that transposon insertion libraries are 
common experimental creations used to generate gene knockouts and study 
the effect on expression and phenotype; however, this often results in 
an array of genomes containing antibiotic resistance markers used for 
selection and screening. The commenter argued that this common practice 
should not need approval and that it is too burdensome on the entity to 
obtain approval for each of several thousand insertional mutants that 
would be created for a single genome.
    As previously noted, APHIS included these provisions in the 
regulations to ensure that these experiments are conducted only if safe 
to do so. We believe the manipulation of a select agent in order to 
create antibiotic resistance increases the risks to human, animal, or 
plant health and, therefore, warrants APHIS' approval. We are making no 
change based on this comment.

Incident Response

    In interim 7 CFR 331.11(a)(3) and 9 CFR 121.12(a)(3), we required 
that the Biocontainment and Security Plan/Biosafety and Security Plan 
include incident response plans for containment breach, security 
breach, inventory violations, non-biological incidents such as 
workplace violence, and cybersecurity breach. These plans were required 
to address personnel safety and health, containment, inventory control, 
and notification of managers and responders. In addition, the plans 
were required to address bomb threats, severe weather (floods, 
hurricanes, tornadoes), earthquakes, power outages, and other natural 
disasters or emergencies.
    A commenter stated that the requirements for APHIS' incident 
response plan and CDC's emergency response plan should be the same.
    We agree. Therefore, the revised incident response sections in this 
final rule (newly designated 7 CFR 331.14 and 9 CFR 121.14) are 
consistent with the incident response section in CDC's final rule. In 
this final rule, we are adding the CDC requirement that an incident 
response plan must be coordinated with any entity-wide plans. To ensure 
that such plans are available for review by an entity's employees, we 
are also requiring that the plans be kept in the workplace and made 
available to employees for review. In addition, as described below in 
response to a request for clarification of the term ``incidents,'' we 
are clarifying the types of incidents and information that must be 
included in the plan. Finally, we are adding the CDC requirement that 
the response procedures account for the hazards associated with the 
select agent or toxin and appropriate actions to contain such agent or 
toxin.
    A commenter requested clarification of the term ``incidents.'' In 
this final rule, newly designated 7 CFR 331.14 and 9 CFR 121.14 require 
that the incident response plan fully describe the entity's response 
procedures for theft, loss, or release of a select agent or toxin, 
inventory discrepancies, security breaches (including information 
systems), severe weather and other natural disasters, workplace 
violence, bomb threats and suspicious packages, and emergencies such as 
fire, gas leak, explosion, power outage, etc.
    One commenter stated that the reference to ``inventory control'' is 
ambiguous and needs to be defined.
    We agree that the term ``inventory control'' is not clear. 
Therefore, we are deleting the reference to inventory control in this 
final rule. However, we are retaining the requirement that an incident 
response plan describe the entity's response procedures for inventory 
discrepancies.

Training

    Interim 7 CFR 331.12 (newly designated Sec.  331.15) required the 
responsible official to provide appropriate training in containment and 
security procedures to all individuals with access to listed agents and 
toxins,

[[Page 13266]]

while interim 9 CFR 121.13 (newly designated Sec.  121.15) required the 
responsible official to provide appropriate training in biosafety, 
containment, and security procedures to all individuals with access to 
listed agents and toxins. Both sections required the responsible 
official to provide information and training to an individual at the 
time the individual is assigned to work with a listed agent and toxin, 
and to provide refresher training annually.
    A commenter requested clarification about the training 
requirements. This commenter wondered what would be considered 
appropriate training, what qualifications an individual would need to 
train others, and who decides if the training is adequate. Another 
commenter recommended that APHIS revise the training provisions to 
require training for approved individuals working with select agents 
and toxins and unapproved individuals working in or visiting areas 
where select agents and toxins are handled or stored. The commenter 
suggested that such training may be modified according to the needs of 
the individual, the work they will do, and their potential exposure. A 
commenter noted that APHIS' training requirements cover fewer staff 
than CDC's training requirements (i.e., only those individuals handling 
the agents or toxins). The commenter recommended that the APHIS and CDC 
requirements be consistent.
    In response to these comments, in this final rule we are amending 
both sections to require that an individual or entity provide 
information and training on biocontainment/biosafety and security to 
each individual with access approval from the Administrator or the HHS 
Secretary before he/she has such access (newly designated 7 CFR 
331.15(a) and 9 CFR 121.15(a)). We are also requiring that an 
individual or entity provide training to each individual not approved 
for access by the Administrator or the HHS Secretary before he/she 
works in or visits areas where select agents or toxins are handled or 
stored (e.g., laboratories, growth chambers, animal rooms, greenhouses, 
storage areas, etc.). The training must address the particular needs of 
the individual, the work they will do, and the risks posed by the 
select agents or toxins. Finally, refresher training must be provided 
annually (newly designated 7 CFR 331.15(b) and 9 CFR 121.15(b)). These 
changes will make the APHIS and CDC regulations consistent. We note the 
training should be provided by an individual who has the appropriate 
training and skills. APHIS will determine if an individual's training 
is adequate.
    One commenter recommended that APHIS adopt the CDC provisions in 
interim 42 CFR 73.13(d) that allows an entity to certify that personnel 
have been trained.
    In interim 42 CFR 73.13(d), CDC provided that, in lieu of initial 
training for those individuals already involved in handling select 
agents or toxins, the responsible official may certify that an 
individual has the required knowledge, skills, and abilities to safely 
carry out the duties and responsibilities. CDC included this provision 
to minimize the disruption of research or educational projects that 
were under way as of the effective date of the December 2002 interim 
rule. CDC is deleting this provision in its final rule. For this 
reason, we are making no change based on this comment.

Transfer of Biological Agents and Toxins

    Interim 7 CFR 331.13 and 9 CFR 121.14 (newly designated 7 CFR 
331.16 and 9 CFR 121.16) set out the transfer requirements and 
procedures. In this final rule, we are amending newly designated 7 CFR 
331.16 and 9 CFR 121.16 to clarify the transfer provisions. 
Specifically, we are amending both sections by providing that, in 
addition to any permit required under the regulations, a transfer of a 
select agent or toxin may be authorized if: (1) The sender has a 
certificate of registration that covers the agent or toxin to be 
transferred and meets the requirements of each part, meets the 
exemption requirements for the select agent or toxin to be transferred, 
or is transferring the select agent or toxin from outside of the United 
States and meets all import requirements, and (2) at the time of 
transfer, the recipient has a certificate of registration that includes 
the select agent or toxin to be transferred and meets all of the 
requirements of each part (newly designated 7 CFR 331.16(b) and 9 CFR 
121.16(b)). This information was contained in the interim rule but the 
final rule more clearly sets out the requirements for the sender and 
recipient. We are also amending the transfer provisions in 9 CFR 121.16 
to provide that a select agent or toxin contained in a specimen for 
proficiency testing may be transferred without prior authorization from 
APHIS or CDC provided that, at least 7 calendar days prior to the 
transfer, the sender reports to APHIS or CDC the select agent or toxin 
to be transferred and the name and address of the recipient. This 
change, in conjunction with the reporting requirements for 
identifications of select agents or toxins in 9 CFR 121.5, 121.6, and 
121.9, will allow us to more effectively monitor proficiency testing 
activities.
    In addition, we are amending both sections to provide that the 
recipient must immediately notify APHIS or CDC if a package containing 
a select agent or toxin has been damaged to the extent that a release 
of the select agent or toxin may have occurred (newly designated 7 CFR 
331.16(f) and 9 CFR 121.16(g)). These changes will make the APHIS and 
CDC regulations consistent.
    Both sections (newly designated 7 CFR 331.16(g) and 9 CFR 
121.16(h)) also provide that an authorization for a transfer shall be 
valid only for 30 calendar days after issuance, except that such an 
authorization becomes immediately null and void if any facts supporting 
the authorization change (e.g., change in the certificate of 
registration for the sender or recipient, change in the application for 
transfer). This change is intended to ensure timely transfers of select 
agents and toxins and provide notice to the public that APHIS may 
terminate a transfer authorization under certain circumstances.
    One commenter stated that the regulations should provide for 
transfer of agents and toxins from an unregistered entity to a 
registered entity to prevent destruction of valuable historical, 
archival, and educational materials.
    We agree. Accordingly, in this final rule, we are amending the 
transfer provisions in interim 7 CFR 331.13 and 9 CFR 121.14 to provide 
that, on a case-by-case basis, the Administrator may authorize a 
transfer of a select agent or toxin, not otherwise eligible for 
transfer under each part, under conditions prescribed by the 
Administrator (newly designated 7 CFR 331.16(c) and 9 CFR 121.16(c)).
    One commenter maintained that APHIS should permit hand-carried 
transfers of select agents or toxins with the same reporting 
requirements already described in the regulations.
    Given the risks posed by select agents and toxins, we do not 
believe that hand-carried transfers of such agents or toxins is 
consistent with the intent of the Act. By prohibiting hand-carried 
transfers, we ensure that select agents or toxins are packaged 
appropriately and that there is documentary evidence of the transfer 
(e.g., tracking numbers, confirmation of delivery, etc). We are making 
no changes based on this comment.
    One commenter stated that the requirement that APHIS or CDC approve 
transfers between entities is highly likely to produce unreasonable 
delays. The commenter suggested that the

[[Page 13267]]

regulations be revised to require that APHIS respond within an 
appropriate interval (e.g., 1 to 2 days).
    We do not expect the transfer requirements in the regulations to 
produce unreasonable delays. The requirement for approval prior to a 
transfer of a select agent or toxin is not a new requirement, nor is it 
unreasonable given the risks posed by select agents or toxins. The 
transfer requirements for select agents and toxins incorporate the 
permit requirements under the plant pest regulations in 7 CFR part 330 
and the organisms and vectors regulations in 9 CFR part 122, which 
require APHIS' approval prior to transfer. We are making no changes 
based on this comment.
    A commenter asserted that the transfer provisions are incompatible 
with biosecurity. The commenter stated that they require the principal 
investigator to prohibit access to the material up to the point of 
shipment, after which the package is handled by a host of individuals 
out of the control of the responsible official or the principal 
investigator. Several commenters expressed concern about the U.S. 
Department of Transportation's labeling requirements for packages 
containing select agents or toxins. These commenters pointed out that 
the labeling requirements clearly indicate which packages should be 
stolen. One commenter recommended eliminating the requirement for 
external labeling. This commenter also recommended adding tamper-
indicating procedures in the packaging so that the recipient would know 
the package had been tampered with.
    These issues are outside the scope of this rulemaking. Accordingly, 
we are making no changes based on these comments.

Records

    Interim 7 CFR 331.14 and 9 CFR 121.15 required the responsible 
official to maintain complete, up-to-date records of information 
necessary to give an accounting of all of the activities related to 
listed agents and toxins. Such records must be maintained for 3 years 
and produced upon request to APHIS inspectors and appropriate Federal, 
State, and local law enforcement authorities.
    A commenter stated that the requirements for inventory records of 
select agents are unclear. The commenter pointed out that research labs 
generate and destroy material on a daily, if not hourly, basis. The 
commenter wondered if the inventory requirement pertained to stock 
collections or to all infectious materials generated. Another commenter 
stated that keeping track of vials is a waste of Federal resources.
    We agree that the requirements for inventory records are unclear. 
To provide clarification and to be consistent with CDC's approach, in 
this final rule the inventory recordkeeping requirements in both parts 
(newly designated 7 CFR 331.17 and 9 CFR 121.17) require the 
maintenance of an accurate, current inventory for each select agent 
held in long-term storage (placement in a system designed to ensure 
viability for future use, such as in a freezer or lyophilized 
materials) and for each toxin held. The provisions for select agents 
and toxins are different to account for the differences between select 
agents and toxins; we do not believe it is feasible to record 
quantities of replicating organisms (i.e., select agents). In addition, 
we are providing more information about the types of information that 
must be included in the inventory records for each select agent or 
toxin. For example, an inventory for a select agent must include the 
name and characteristics of the agent, the quantity acquired from 
another entity, where stored, when moved from storage and by whom, 
purpose of use, transfer records, etc., while an inventory for a toxin 
must include the name and characteristics of the toxin, the quantity 
acquired from another entity, the initial and current quantity, where 
stored, when moved from storage and by whom, transfer records, etc.
    Interim 7 CFR 331.14(a)(4) and 9 CFR 121.15(a)(4) required an 
individual or entity to maintain accurate and current inventory records 
(including source and characterization data).
    One commenter recommended that APHIS define the terms 
``characterization data'' and ``accurate.'' To clarify the term 
``characterization data,'' in this final rule we are providing examples 
of the characterization information that should be maintained by the 
entity for each select agent (e.g., strain designation, GenBank 
Accession number, etc.). The term ``accurate'' is commonly defined as 
free from mistakes or errors. We do not believe it is necessary to 
define this term in the regulations.
    A commenter suggested that all records should be marked and 
protected at the ``Official Use Only'' level.
    To be consistent with CDC's regulations, in this final rule newly 
designated 7 CFR 331.17 and 9 CFR 121.17 require an entity to implement 
a system to ensure that all records and databases created under each 
part are accurate, have controlled access, and can be verified for 
authenticity. We do not believe it is necessary to require that an 
entity mark and protect all of its records at the ``Official Use Only'' 
level to satisfy this requirement. Therefore, we are not implementing 
this suggestion.
    One commenter suggested that all transfer forms be securely stored 
for 5 years, instead of 3 years. Taking into consideration the burden 
on the public and APHIS' investigational needs, we believe that it is 
reasonable to require that all records, including transfer forms, be 
maintained for 3 years. Accordingly, we are making no change based on 
this comment.

Inspections

    Interim 7 CFR 331.15(a) provided that any APHIS inspector must be 
allowed, without previous notification, to enter and inspect the entire 
premises, all materials and equipment, and all records required to be 
maintained by the regulations, while interim 9 CFR 121.16(a) contained 
a similar provision for APHIS or CDC inspectors.
    To be consistent with CDC's regulations, newly designated 7 CFR 
331.18(a) and 9 CFR 121.18(a) provide that APHIS, without prior 
notification, must be allowed to inspect any site at which activities 
regulated under each part are conducted and must be allowed to inspect 
and copy any records relating to the activities covered under each 
part.
    Interim 7 CFR 331.15(b) provided that, prior to issuing a 
certificate of registration, APHIS may inspect and evaluate the 
premises and records to ensure compliance with the regulations and the 
biosafety, containment and security requirements. Interim 9 CFR 
121.16(b) contained a similar provision for APHIS or CDC inspectors.
    In this final rule, we are removing the phrase ``and the 
containment and security requirements'' (newly designated 7 CFR 
331.18(b)) and removing the phrase ``and the biosafety, containment, 
and security requirements'' (newly designated 9 CFR 121.18(b)). These 
phrases are unnecessary since we already state in both sections that, 
prior to issuing a certificate of registration, APHIS may inspect and 
evaluate an entity's premises and records to ensure compliance with the 
regulations.
    A commenter requested additional information about compliance 
inspections. In particular, the commenter asked what level of training 
and security clearances would be required for inspectors and whether 
there would be separate inspectors to

[[Page 13268]]

assess the biosafety and security requirements. The commenter also 
asked what standards will be used by the inspectors to assess 
compliance with the regulations.
    APHIS inspectors will have the appropriate training and security 
clearances (at least a security risk assessment) to inspect and 
evaluate an entity's premises and records to ensure compliance with the 
regulations. APHIS inspectors will use the standards established in the 
regulations and published guidelines (e.g., BMBL) to determine 
compliance. While we expect that, normally, only one inspector will be 
needed to conduct an inspection, occasionally more than one inspector 
may be needed to evaluate an entity's biosafety, containment, and 
security.
    APHIS and CDC will coordinate inspections to minimize the burden on 
the entity. This coordination will ensure that inspections by APHIS and 
CDC are not duplicative. However, additional inspections may be 
required under certain circumstances. For instance, another inspection 
may be required for amendments to a certificate of registration (e.g., 
addition of a laboratory) or to satisfy APHIS' permit requirements.

Notification in the Event of Theft, Loss, or Release

    Interim 7 CFR 331.16(a) and 9 CFR 121.17(a) required the 
responsible official to orally notify APHIS and appropriate Federal, 
State, or local law enforcement agencies immediately upon discovery of 
a theft or loss of listed agents or toxins. We also required that the 
oral notification be followed by a written report within 7 days. In 
this final rule, newly designated 7 CFR 331.19(a) and 9 CFR 121.19(a) 
provide that thefts or losses must be reported to APHIS or CDC. In 
addition, these paragraphs clarify that thefts or losses must be 
reported even if the select agent or toxin is subsequently recovered or 
the responsible parties are identified. These changes will make the 
APHIS and CDC regulations consistent. Finally, we are specifying the 
information that must be reported to APHIS or CDC (newly designated 7 
CFR 331.19(a) and 9 CFR 121.19(a)). We believe this change will clarify 
the requirements for notification of theft or loss of select agents and 
toxins.
    Interim 7 CFR 331.16(b) and 9 CFR 121.17(b) provided that the 
responsible official must orally notify APHIS immediately upon 
discovery that a release of a listed agent or toxin has occurred 
outside the biocontainment area. We also required that the oral 
notification of a release be followed by a written report within 7 
days. The regulations further provided that APHIS will notify relevant 
Federal, State, and local authorities, and the public, if necessary. In 
Sec.  121.17(b), we additionally provided that, if the release involves 
an overlap agent or toxin, we will also notify the Secretary of Health 
and Human Services.
    In this final rule, newly designated 7 CFR 331.19(b) requires that 
APHIS or CDC be notified immediately upon discovery of a release of a 
PPQ select agent or toxin outside the primary barriers of the 
biocontainment area while 9 CFR 121.19(b) requires that APHIS or CDC be 
notified immediately upon discovery of a release of a VS or overlap 
select agent or toxin causing occupational exposure or a release 
outside the primary barriers of the biocontainment area. The 
requirement for notification of a release outside of the primary 
barriers of the biocontainment area is a clarification. This is how we 
have always interpreted the provision regarding release outside the 
biocontainment area; however, we are making this change to make it 
clear to the public. In 9 CFR 121.19(b), we are adding the provision 
for occupational exposure to be consistent with CDC's regulations. We 
did not include this provision in 7 CFR 331.19 because PPQ select 
agents and toxins do not pose a severe threat to human health and, 
therefore, it is unnecessary to address personnel safety and health. In 
both sections, we are also specifying the information that must be 
reported to APHIS or CDC. We believe these changes will clarify the 
requirements for notification of a release.
    Finally, we are deleting the provision that APHIS will notify 
relevant Federal, State, and local authorities, and the public in the 
event a release poses a threat to animal health or animal products. 
This is an administrative action taken by APHIS and it is unnecessary 
to include this information in the regulations.
    A commenter requested clarification of the term ``unintentional 
release.'' The commenter stated that it can be interpreted to include 
any exposure or release at any biosafety level.
    The term ``unintentional release'' is not used in either the 
interim regulations or this final rule. Therefore, we are making no 
change based on this comment.
    Several commenters urged APHIS to exempt from notification those 
accidents (i.e., releases) that take place entirely within biosafety 
labs where the select agent is being handled at the appropriate 
biosafety level. One commenter went on to state that an exposed worker 
may be so concerned about needing to report an accident to APHIS that 
he or she may decide not to inform anyone of a potential exposure, 
resulting in an immediate risk to the person and a possible risk to the 
population.
    Given the risks associated with select agents and toxins, we 
believe it is necessary to be notified of all occupational exposures. 
It is the entity's responsibility to ensure that its employees comply 
with these reporting requirements. For these reasons, we are making no 
changes based on these comments.

Administrative Review

    Interim 7 CFR 331.17 and 9 CFR 121.18 provided that an individual 
or entity may appeal a denial or revocation of registration. In 
addition, these sections provided that an individual who has been 
denied access to listed agents or toxins or who has been granted only 
limited access to listed agents or toxins may appeal that decision. 
Both sections set out the process for an administrative review.
    In this final rule, the administrative review sections also provide 
that an individual or entity may appeal the suspension of registration. 
This provision was included in the sections on denial, revocation, and 
suspension of registration (interim 7 CFR 331.7 and 9 CFR 121.8) but 
was inadvertently not included in interim 7 CFR 331.17 and 9 CFR 121.18 
(newly designated 7 CFR 331.20 and 9 CFR 121.20). In addition, we are 
amending both sections to allow an individual to appeal revocation of 
access approval. This change corresponds to a change in newly 
designated 7 CFR 331.10 and 9 CFR 121.10 that allows revocation of an 
individual's access approval in the event that an individual becomes a 
restricted person under 18 U.S.C. 175b or is reasonably suspected by 
any Federal law enforcement or intelligence agency of committing a 
crime set forth in 18 U.S.C. 2332b(g)(5), knowing involvement with an 
organization that engages in domestic or international terrorism (as 
defined in 18 U.S.C. 2331) or with any other organization that engages 
in intentional crimes of violence, or being an agent of a foreign power 
as defined in 50 U.S.C. 1801.
    A commenter stated that the final rule should include provisions 
for entities and individuals to appeal security risk assessment 
decisions or seek exemptions for legitimate research.
    The regulations already allow an individual who has been denied 
access to select agents or toxins or who has been granted only limited 
access to such

[[Page 13269]]

agents or toxins to appeal that decision (interim 7 CFR 331.17 and 9 
CFR 121.18; newly designated 7 CFR 331.20 and 9 CFR 121.20). However, 
in accordance with the Act, an entity may not appeal the denial or 
limitation of an individual's access to select agents or toxins. The 
regulations do not provide exemptions for research. However, we note 
that an individual's access to PPQ select agents or toxins and VS 
select agents or toxins may be limited or denied if an individual is a 
restricted person under 18 U.S.C. 175b. In addition, an individual's 
access to PPQ select agents or toxins, VS select agents or toxins, or 
overlap select agents or toxins may be limited or denied if an 
individual is reasonably suspected by any Federal law enforcement or 
intelligence agency of committing a crime set forth in 18 U.S.C. 
2332b(g)(5), knowing involvement with an organization that engages in 
domestic or international terrorism (as defined in 18 U.S.C. 2331) or 
with any other organization that engages in intentional crimes of 
violence, or being an agent of a foreign power as defined in 50 U.S.C. 
1801. For these reasons, we are making no changes based on this 
comment.

Miscellaneous

    We are also making minor, nonsubstantive changes to the regulations 
to correct misspellings and internal references, reflect changes to the 
form numbers, ensure a consistent format in both parts, and eliminate 
redundancy.
    Therefore, for the reasons given in the interim rule and in this 
document, we are adopting the interim rule as a final rule, with the 
changes discussed in this document.
    This final rule also affirms the information contained in the 
interim rule concerning Executive Orders 12372 and 12988.

Effective Date

    For the reasons discussed in the Supplementary Information section 
of this rule, we have determined that it is no longer necessary to 
include Phakopsora pachyrhizi (Asian soybean rust) and plum pox 
potyvirus on the list of PPQ select agents and toxins. Therefore, this 
final rule amends 7 CFR 331.3(b) by removing P. pachyrhizi and plum pox 
potyvirus from that list. Making these amendments to 7 CFR 331.3(b) 
effective immediately will relieve restrictions we no longer find 
warranted and aid ongoing research into effective means of managing 
Asian soybean rust in the United States. Pursuant to the provisions of 
5 U.S.C. 553, we have determined that this aspect of the final rule 
relieves restrictions and thus may be made effective less than 30 days 
after publication in the Federal Register. Accordingly, the 
Administrator of the Animal and Plant Health Inspection Service has 
determined that the amendments made to 7 CFR 331.3(b) in this rule 
should be effective upon signature. The remaining provisions of this 
final rule will become effective 30 days after date of the rule's 
publication in the Federal Register.

Executive Order 12866 and Regulatory Flexibility Act

    This rule has been reviewed under Executive Order 12866. The rule 
has been determined to be significant for the purposes of Executive 
Order 12866 and, therefore, has been reviewed by the Office of 
Management and Budget.
    For this rule, we have prepared an economic analysis. The economic 
analysis provides a cost-benefit analysis, as required by Executive 
Order 12866, as well as an analysis on the potential economic effects 
of this final rule on small entities, as required under 5 U.S.C. 603. 
The economic analysis is summarized below. Copies of the full analysis 
are available by contacting the person listed under FOR FURTHER 
INFORMATION CONTACT.

Background

    Certain pathogens or toxins produced by biological organisms that 
are released intentionally or accidentally can result in disease, wide-
ranging and devastating impacts on the economy, disruption to society, 
diminished confidence in public and private institutions, and large-
scale loss of life.
    The Public Health Security and Bioterrorism Preparedness and 
Response Act of 2002 (Pub. L. 107-188), provides for the regulation of 
certain biological agents \1\ and toxins \2\ that have the potential to 
pose a severe threat to public health and safety, to animal health, to 
plant health, or to animal and plant products. The Act also requires 
that the Secretary of Agriculture establish and enforce standards and 
procedures governing the possession and use of the listed biological 
agents and toxins, including the establishment and enforcement of 
safety requirements for the transfer of listed agents and toxins; the 
establishment and enforcement of safeguard and security measures to 
prevent access to listed agents and toxins for use in domestic or 
international terrorism or other criminal purpose; and the 
establishment of procedures to protect animal and plant health, and 
animal and plant products, in the event of a transfer in violation of 
the established safety and security measures. APHIS has the primary 
responsibility for implementing the provisions of the Act within USDA. 
VS select agents and toxins are those that have been determined to have 
the potential to pose a severe threat to animal health or animal 
products. PPQ select agents and toxins are those that have been 
determined to have the potential to pose a severe threat to plant 
health or plant products. Overlap select agents and toxins are those 
that have been determined to pose a severe threat to public health and 
safety, to animal health, or to animal products. Overlap select agents 
and toxins are subject to regulation by both APHIS and CDC, which has 
the primary responsibility for implementing the provisions of the Act 
for the Department of Health and Human Services.
---------------------------------------------------------------------------

    \1\ Any microorganism (including, but not limited to, bacteria, 
viruses, fungi, rickettsiae, or protozoa), or infectious substance, 
or any naturally occurring, bioengineered, or synthesized component 
of any such microorganism or infectious substance, capable of 
causing: (1) Death, disease or other biological malfunction in a 
human, an animal, a plant, or another living organism; (2) 
deterioration of food, water, equipment, supplies, or material of 
any kind; or (3) deleterious alteration of the environment.
    \2\ The toxic material or product of plants, animals, 
microorganisms (including, but not limited to, bacteria, viruses, 
fungi, rickettsiae, or protozoa), or infectious substances, or a 
recombinant or synthesized molecule, whatever their origin and 
method of production, and includes: (1) Any poisonous substance or 
biological product that may be engineered as a result of 
biotechnology produced by a living organism; or (2) any poisonous 
isomer or biological product, homolog, or derivative of such a 
substance.
---------------------------------------------------------------------------

Benefits of the Rule

    This rule will require registration, biocontainment/biosafety, 
incident response and security measures for the possession, use, and 
transfer of the select agents and toxins listed in 7 CFR part 331 and 9 
CFR part 121. This rule is intended to prevent the misuse of those 
select agents and toxins, and will therefore reduce the potential for 
those pathogens to harm humans, animals, animal products, plants or 
plant products in the United States. Should any select agent or toxin 
be intentionally introduced into the United States, the consequences 
would be significant. Some of these select agents have the potential to 
cause ailment and death in humans. Direct losses in agriculture could 
occur as a result of the exposure, such as death or debility of 
affected production animals, or yield loss in plants. Industry could 
also be affected through the imposition of domestic and foreign 
quarantines, which result in a loss of markets. The Federal and State 
Governments would

[[Page 13270]]

also incur costs associated with eradication and quarantine enforcement 
to prevent further spread, and in the case of intentional 
introduction--law enforcement. In addition, there is the potential for 
a disruption in the domestic food supply, whether through 
contamination, consumer perception, or both. Past food safety incidents 
have shown that consumer perceptions (both domestic and international) 
about an implicated food product and about the producing country or 
sector's ability to produce safe food are slow to recover and can have 
a lasting influence on food demand and global trade.\3\ As such, the 
benefits associated with the rule are the avoided losses to the animals 
or plants that could be attacked by these organisms, and their products 
and markets.
---------------------------------------------------------------------------

    \3\ Buzby, J.C. Effects of food-safety perceptions on food 
demand and global trade. Changing Structure of Global Food 
Consumption and Trade/WRS-01-1. Economic Research Service/USDA.
---------------------------------------------------------------------------

    The costs associated with outbreaks can be very high as is 
demonstrated by natural outbreaks associated with select agents that 
have occurred. For example, it has been estimated that the losses to 
agriculture and the food chain from the recent foot-and-mouth disease 
(FMD) outbreak in the United Kingdom (UK), including the costs 
compensated by the government, amount to about [pound]3.1 billion ($4.7 
billion). In 1999, it was estimated that the potential impacts of an 
FMD outbreak in California alone would be between $8.5 and $13.5 
billion.\4\ Also, a bovine spongiform encephalopathy (BSE) crisis 
occurred in the UK (which has a cattle industry about one-tenth the 
size of that in the United States) in 1996. It has been estimated \5\ 
that the total resource costs to the UK economy as a result of BSE in 
the first 12 months after the onset of the 1996 crisis were in the 
range of [pound]740 million to [pound]980 million ($1.2 billion to $1.5 
billion), or just over 0.1 percent of the gross domestic product of the 
United Kingdom. In addition to these losses, the UK lost its entire 
export market for beef following the crisis.
---------------------------------------------------------------------------

    \4\ Ekboir, J.M. Potential impact of foot-and-mouth disease in 
California: the role and contribution of animal health surveillance 
and monitoring services. Davis, CA: Agricultural Issues Center, 
Division of Agriculture and Natural Resources, University of 
California, Davis, 1999.
    \5\ DTZ Pieda Consulting. Economic Impact of BSE on the UK 
economy. A Report commissioned by the UK Agricultural Departments 
and HM Treasury.
---------------------------------------------------------------------------

    The above cited consequences relate to natural or accidental 
introduction. Deliberate introduction greatly increases the probability 
of an agent or toxin becoming established and causing wide-ranging and 
devastating impacts on the economy, disruption to society, diminished 
confidence in public and private institutions, and possible loss of 
life. The perpetrators would have the advantage of controlling the time 
of introduction of the agent, introducing agents into remote or highly 
susceptible areas, multiple introductions of the same agent, or 
simultaneous release of different agents. Intentional introductions 
permit an increased probability of survival of a pathogen, the use of 
highly virulent strains and high concentrations of inoculum, and 
precise timing of release to coincide with maximal colonization 
potential.\6\
---------------------------------------------------------------------------

    \6\ National Research Council.
---------------------------------------------------------------------------

Costs of the Rule

    The rule is intended to ensure that any entity that possesses, uses 
or transfers a select agent or toxin is registered and has safeguard, 
containment, and disposal requirements that are commensurate with the 
risk of that agent or toxin. Affected entities vary widely, and 
therefore, the biosafety/biocontainment, incident response and physical 
security situation will vary widely from one entity to another, as will 
the specific changes that will need to occur at a given entity to 
comply with this rule.

Affected Entities

    Entities that possess, use, or transfer VS, PPQ or overlap select 
agents or toxins will be affected by this rule. Because of the nature 
of some of these entities and some of the select agents or toxins they 
possess, APHIS and CDC share common regulatory authority. However, 
APHIS and CDC have established procedures that will allow an entity to 
interact with only one agency--either APHIS or CDC--with respect to all 
matters involving select agents and toxins. This analysis considers 
only those entities for which APHIS is considered the primary 
regulatory agency.\7\
---------------------------------------------------------------------------

    \7\ Those entities for which the CDC is considered the primary 
regulatory agency are considered in conjunction with the CDC rule.
---------------------------------------------------------------------------

    The affected entities are primarily research and diagnostic 
facilities. They include Federal, State, and university laboratories, 
and private commercial and non-profit enterprises. Currently, there are 
76 \8\ academic, commercial, State and Federal government facilities 
that have applied for a certificate of registration from APHIS for PPQ, 
VS, and/or overlap agents and toxins. Approximately 34 percent of these 
entities are academic, 37 percent are private commercial enterprises, 
28 percent are government, and 1 percent are non-profit.
---------------------------------------------------------------------------

    \8\ Thus far, APHIS has received 148 applications for 
registration or exemption. Of those, 72 were exempt, have been 
shifted to CDC, been withdrawn, or denied.
---------------------------------------------------------------------------

    The level of security at the entities that possess, use or transfer 
select agents and toxins is currently very diverse, ranging from a 
locked freezer to a lock on the door to razor wire perimeter fencing, a 
guard post, locks or coded entry, and visitor escorts.

Exemptions and Exclusions From the Rule

    A number of exclusions and exemptions from the rule exist that 
reduce the number of entities that otherwise might have been affected 
by this rule. For example, nonviable select agents and nonfunctional 
toxins are excluded from the requirements of this rule. Some attenuated 
strains of a select agent or toxin may be excluded based on a 
determination that the strain does not pose a severe threat to animal 
health or to animal products. In addition, overlap toxins are excluded 
if they are under the control of a principal investigator, treating 
physician or veterinarian, or commercial manufacturer or distributor 
and the aggregate amount does not, at any time, exceed certain amounts.
    In addition, a number of exemptions also exist. In particular, 
exemptions cover diagnostic laboratories and others when select agents 
and toxins contained in a specimen are presented for diagnosis or 
verification and proficiency testing. Diagnostic reagents and vaccines 
that are, bear, or contain VS select agents or toxins that are produced 
at USDA diagnostic facilities are also exempt from the requirements. 
For the most part, products that are, bear, or contain VS or overlap 
select agents or toxins are exempt from the requirements if the 
products have been cleared, approved, licensed, or registered under a 
number of Federal statutes. Experimental products and investigational 
products can also be exempted.
    In addition, the Administrator may grant exemptions from the 
applicability of the regulations as they apply to VS or PPQ select 
agents and toxins if the Administrator determines that such exemptions 
are consistent with protecting animal or plant health, or animal or 
plant products. While an entity will not be exempt if it keeps a 
positive control of a select agent or toxin, alternatives will exist. 
If an entity decides to keep a positive control of a select agent or 
toxin, it will have to register and may need to make changes to its 
operations in order to do so.
    Those not specifically exempted have to submit an exemption 
application if

[[Page 13271]]

they wish to become exempt. Thus far, APHIS has received 34 exemption 
applications, and anticipates receiving an additional one per year. It 
is estimated that applying for an exemption requires 1.17 hours (0.17 
managerial hours at $86.09 per hour \9\, and 1 technical hour at $69.34 
per hour), or $84 per exemption application. Based on the number of 
exemption applications received, the total initial cost is estimated to 
have been $2,900, while the yearly cost for new applicants would be 
about $100. Exemptions are valid for a maximum of 3 years; therefore 
the costs of applying for an exemption would recur every 3 years.
---------------------------------------------------------------------------

    \9\ For purposes of this analysis we use estimates of an average 
hourly respondent labor rate (including fringe and overhead) of 
$86.09 for managerial staff, and $69.34 for technical staff. Based 
on the 2000 Occupational Employment Statistics Survey, Bureau of 
Labor Statistics.
---------------------------------------------------------------------------

    Remaining exempt under this rule will require the submission of the 
proper paperwork dealing with identifications and the transfer or 
destruction of select agents and toxins. Registered diagnostic 
laboratories will also be required to report identifications of select 
agents and toxins when presented for diagnosis. The number of these 
identifications can vary widely in a given year, climbing dramatically 
when outbreaks occur. However, during agricultural emergencies or 
outbreaks, or in endemic areas, the Administrator may require less 
frequent reporting. APHIS expects to receive an average of 1,000 
notifications of identifications from diagnostic laboratories in a 
given year. It is estimated that complying with the notification 
requirements will require 1 hour (0.17 managerial hours and 0.83 
technical hours), or $72 per notification. Based on 1,000 
notifications, the estimated total cost is $72,000 per year.

Registration

    Under this rule, unless exempted an individual or entity shall not 
possess, use, or transfer any select agent or toxin without a 
certificate of registration issued by APHIS or CDC. The registration 
process is designed to obtain critical information concerning 
individuals or entities in possession of certain agents or toxins, as 
well as the specific characteristics of the agents and toxins. 
Information to determine that individuals and entities seeking to 
register have a lawful purpose to possess, use, or transfer agents or 
toxins will also be required as part of the registration process. This 
will involve security risk assessments by the Criminal Justice 
Information Services (CJIS) Division of the Federal Bureau of 
Investigation, and collecting and providing the required information. 
The checks will require that individuals provide identifying 
information. In addition, this information will need to include 
fingerprints. It is estimated that this cost will be $5 to $30 per set 
for those done on paper. It may cost up to $50 per set for electronic 
prints, but these could be processed far more quickly. A given entity 
could expect to spend between $50 and $5000 obtaining and submitting 
fingerprints, with between 10 and 100 employees needing fingerprints 
per entity. To the extent that there is staff turnover at an entity, 
these costs could be recurring. With a total of 2,300 security risk 
assessments to be performed initially, and an average fingerprinting 
cost of $27.50 per individual, the total cost of obtaining fingerprints 
would be $63,250. With 1,300 new assessments to be performed yearly, 
the annual cost of obtaining fingerprints could be expected to be 
$37,750. APHIS may request the Attorney General to expedite an 
individual's security risk assessment upon request by the responsible 
official and a showing of good cause. APHIS expects to receive 20 of 
these requests initially and 13 a year thereafter. These requests are 
expected to take 0.5 managerial hours, or $43 per occurrence. This 
gives a total cost of $1,000 in the first year, and $560 a year 
thereafter.
    It is estimated that it will take a total of 3 managerial hours and 
0.75 technical hours for a complete form with one principal 
investigator (PI) plus 0.75 technical hours per additional PI. Affected 
entities have between 1 and 9 PIs.\10\ It is, therefore, estimated to 
take 3 managerial hours and between 0.75 and 6.75 technical hours to 
complete the registration package, at a cost of between $310 and $726 
per entity. Based on the number of PIs at the 76 entities currently 
applying for registration, the total cost of registration is estimated 
to be $29,000. APHIS expects to receive 8 new applications for 
registration in a given year, with a total cost of $3,300 per year. It 
is estimated that 75 percent of entities will amend their registrations 
twice in a given year. These amendments are estimated to take 1 
managerial hour, or $86 per amendment. Based on 76 registrations this 
gives a cost of $9,800. In addition, because registrations will be 
valid for up to 3 years, re-application will be required.\11\ It is 
estimated that re-applying for registration will require 3 hours with 
one PI (2.67 managerial hours and between 0.33 and 2.97 technical 
hours) or $253 to $436 per entity to collect and provide the required 
information. The total cost of re-application is estimated at $21,000 
every 3 years based on the 76 entities currently applying for 
registration, and the number of PIs at the entities.
---------------------------------------------------------------------------

    \10\ Based on information from the registration applications, 40 
percent of the registered entities have 1 PI, 30 percent have 2 PIs, 
11 percent have 3 PIs, 6 percent have 4 PIs, 3 percent have 5 PIs, 3 
percent have 6 PIs, 3 percent have 7 PIs, and 1 percent have 9 PIs.
    \11\ To minimize the administrative burden associated with this 
new registration program, initially APHIS will assign expiration 
dates ranging from 24 to 36 months to stagger the dates for renewing 
registration. Upon renewal, it is expected that all certificates of 
registration will be valid for 3 years.
---------------------------------------------------------------------------

    As a condition of registration, an individual or entity must 
develop and implement a written security plan that provides graded 
protection in accordance with the risk of the select agent or toxin, 
given its intended use. The plan must describe inventory control 
procedures, physical security and information systems control. The 
individual or entity must also develop and implement a written 
biosafety/biocontainment plan that is commensurate with the risk of the 
agent or toxin, given its intended use. It is estimated that the 
development of the biosafety/biocontainment plan may take 20 managerial 
hours and 40 technical hours at a given entity for a cost of $4,500. 
However, many entities will already have this type of plan in place and 
in writing. For example, under the plant pest permit system, standard 
operating procedures at an entity are already required to be submitted. 
Also, university safety officers generally require that safety 
requirements be in writing. If we conservatively assume that one-half 
of the 76 affected entities need to develop these plans the total cost 
would be $171,000. The development of the physical security plan would 
most likely take place as a part of the site-specific entity security 
assessment required under the rule (see Security).
    As a further condition of registration, an individual or entity 
must develop and implement a written incident response plan. The 
incident response plan must fully describe the entity's response 
procedures for releases, theft or loss of a select agent or toxin, 
inventory discrepancies, security breaches (including information 
systems), severe weather and other natural disasters, workplace 
violence, bomb threats and suspicious packages, and emergencies such as 
fire, gas leak, explosion, power outage, etc. The response procedures 
must account for hazards associated with the select agent

[[Page 13272]]

or toxin and appropriate actions to contain such agent or toxin. It is 
estimated that the development of the incident response plan may take 
10 managerial hours and 25 technical hours at a given entity for a cost 
of $2,600. However, many entities will already have similar plans in 
place and in writing, i.e., as part of compliance with health and 
safety regulations. If we conservatively assume that one-half of the 76 
affected entities need to develop these plans, the total cost would be 
$99,000.

Transfer

    Under this rule, select agents and toxins may only be transferred 
to individuals or entities registered to possess, use, or transfer that 
particular agent or toxin. However, the sender may be an individual or 
entity exempt from the requirements of this rule, or an individual or 
entity located outside the United States. In addition, APHIS may 
authorize transfers for select agents or toxins that would not 
otherwise be eligible for transfer. Transfer must occur only with prior 
authorization, notification of receipt by the recipient, and 
notification of overdue or damaged shipments. APHIS expects there to be 
a total of 130 transfers in a given year. It is estimated that 
complying with the transfer requirements will require 1.75 hours (0.17 
managerial hours and 1.58 technical hours), or $124 for each transfer. 
This gives a total cost of $16,000 per year.

Biosafety/Biocontainment

    Biosafety and containment requirements ensure that the combination 
of work practices and physical containment are designed to reduce the 
risks of working with infectious material and the degree of protection 
is proportional to the risk associated with the agent. Higher biosafety 
levels (BSL) correspond to greater degrees of protection. For example, 
at a BSL-3 laboratory, more emphasis is placed on primary and secondary 
barriers to protect personnel in contiguous areas, the community, and 
the environment from exposure to potentially infectious aerosols. Also, 
because there is special concern for reducing the risk of environmental 
exposure to pathogens of concern to agriculture, BSL-3-Ag adds 
filtration of supply and exhaust air, sewage decontamination, exit 
personnel showers, and entity integrity testing. While the BSL 
terminology is not formally used in relation to laboratories working 
with plant agents or toxins, a parallel philosophy of matching pest 
risk to biocontainment is used in the plant pest permit system. Under 
this rule, the biosafety and containment procedures at an entity must 
be sufficient to contain the agent or toxin (e.g., physical structure 
and features of the entity, and operational and procedural safeguards).
    Acquiring adequate biosafety and containment measures can be 
costly. For example, as a result of work related to anthrax testing at 
APHIS' National Veterinary Services Laboratories, a portion of the 
laboratories' air handling system had to be replaced at a cost of 
$75,000. However, the biosafety and containment requirements contained 
in this rule should require little change at affected entities. USDA 
permits \12\ cover the importation and interstate movement of agents 
and toxins. Prior to the implementation of the December 2002 interim 
rule, these permits already required the biosafety and containment 
level to be commensurate with the risk associated with the pathogen 
covered in the permit. Therefore, to the extent that affected entities 
are already permittees, the biosafety and containment requirements in 
this rule will have already been required at those entities. Before the 
enactment of the Act, there may have been entities operating legally 
outside the permit system, but who are not exempt from this rule. The 
rule may involve additional biosafety or containment burdens for those 
entities, but the extent of these burdens cannot be estimated.
---------------------------------------------------------------------------

    \12\ Prior to the enactment of the Public Health Security and 
Bioterrorism Response Act of 2002, USDA issued permits for 
importation and interstate movement of agents and toxins, including 
those now listed in 7 CFR part 331 and 9 CFR part 121.
---------------------------------------------------------------------------

Security

    The rule will require that any entity where select agents and 
toxins are held adequately provide for the physical security of the 
premises. These requirements are intended to ensure the appropriate 
levels of protection against, theft or loss of select agents or toxins, 
and other acts that may cause unacceptable adverse impacts on national 
security or on the health of the public or the environment. The 
security systems and standard operating procedures must be sufficient 
to safeguard the select agent or toxin against unauthorized access, 
theft, or loss. The security systems and standard operating procedures 
must be designed according to a site-specific risk assessment and must 
provide graded protection in accordance with the risk of the select 
agent or toxin, given its intended use.
    The costs of providing security at entities where the select toxins 
and agents are held can be considerable. USDA has recently upgraded, or 
is currently upgrading, security at a number of its own entities, 
including laboratories. While these costs are not a result of this 
rule, they are illustrative of the spending that can be necessary to 
upgrade security. By department policy, all USDA biosafety level 3 
(BSL-3) laboratories are required to meet physical security 
requirements. The level of security mandated in this policy meets or 
exceeds the levels required in this rule. For example, upgrades at NVSL 
in Ames, IA were completed in 2002 at a cost of $550,077 ($6.63/ft2, 
83,000ft 2 total area). Installations of electronic security 
components can include closed circuit television (CCTV) (cameras, VCR, 
and control equipment), intrusion detection system (IDS) (access-
control card-readers, card-keys, operating computer and software), all 
cabling associated with the security system, and integrating the system 
with the off-site monitoring. Other security related expenses that 
could be needed at a given entity following an entity security 
assessment include entry control equipment (x-ray, metal detectors). 
Other features would entail yearly recurring costs (i.e., off-site 
monitoring, an equipment maintenance agreement, and guard service).
    The security systems and standard operating procedures must be 
designed according to a site-specific risk assessment. This site-
specific risk assessment is completed to determine the existing 
security status and needs of a specific entity. The cost of a security 
assessment of a laboratory is based largely on the required expertise 
and would be somewhat dependant on the size of the entity. At APHIS 
laboratories these assessments have ranged from $17,000 to $25,000 per 
location.\13\ Many affected entities will have had entity security 
assessments done in another context prior to the interim rule on select 
agents and toxins, or will need far less extensive and therefore 
expensive assessments.
---------------------------------------------------------------------------

    \13\ Robert Rice, Security Manager, APHIS select agent program.
---------------------------------------------------------------------------

    Electronic security may need to be a major part an entity's 
physical security. Based on average actual security system 
installations for APHIS facilities, a cost per square foot for 
electronic security upgrades was developed.\14\ The security needs and 
existing systems at these entities varied. The matrix cost per square 
foot includes: CCTV; IDS; integration; perimeter protection; design; 
construction; and construction

[[Page 13273]]

management, but not biometric technology. The cost per square foot 
assumes single story entities and has been adjusted for laboratory type 
entities. For buildings under 80,000 ft2 the average cost/ft 
2 is $8.71. In addition, there is an adjustment factor for 
retrofitting existing buildings. It should be noted that for very small 
entities, the cost/ft 2 can be considerably higher.\15\ It 
should also be noted that these costs per ft 2 are based on 
security installations of state-of-the-art technology. In addition to 
the entity security assessment and access control discussed above, a 
given entity could need none, some, or all of the following to maintain 
its physical security. Entry control equipment includes x-ray--small 
unit ($28,000 per unit), x-ray--large unit ($40,000 per unit), and 
metal detector(s) ($20,000 per unit). Other features would entail 
yearly recurring costs. Off-site monitoring ($10,000 to $45,000 per 
year); an equipment maintenance agreement ($12,000 to $30,000 per 
year); and guard service--unarmed ($30.00/hr per security post), armed 
($35.00/hr per security post), and a supervisor ($40.00/hr).\16\ 
Following September 11, 2001, more comprehensive security packages have 
been (or will be) added to APHIS facilities including many of these 
additional features. There are, however, alternatives to the specific 
services that can greatly reduce costs and could be acceptable 
depending on the security needs of a given entity, e.g., remote 
monitoring and response to alarms instead of on-site guard service. 
Also, an entity may have some or all of the services already included 
in an overall facility operational and maintenance plan. An example 
would be a laboratory holding select agents or toxins that is part of 
an academic institution where support services are already incurred by 
the academic institution, e.g., campus police for security response.
---------------------------------------------------------------------------

    \14\ Robert Rice, Security Manager, APHIS select agent program.
    \15\ Equivalent security needs at two buildings can have 
significant differences in cost per ft 2. For example, 
the need for one $1000 video camera would add $1 to the ft 
2 cost of a 1000 ft 2 facility, but only $0.1 
to a 10,000 ft 2 one.
    \16\ Robert Rice, Security Manager, APHIS select agent program.
---------------------------------------------------------------------------

    Because security needs are site-specific and the rule allows for 
site-specific security solutions, the approaches and applications will 
be varied. The above physical security components, and others, may have 
to be added in various quantities (including none) to meet the specific 
security needs of an entity. The entities covered in this rule can and 
do vary from a small laboratory contained within a larger facility to 
large dedicated buildings to large groups of buildings and land. Small 
laboratories in larger buildings are unlikely to need access controlled 
gates, a security fence, or even guard service (although a university 
or commercial entity may already have a security force which would be 
considered in assessing security needs). Larger entities will 
inevitably have more and different security needs than small ones. 
These entities naturally have more points of access and are more likely 
to need features such as fences or gates to control access. In 
addition, the costs themselves are very site specific; there can be 
literally hundreds of variables that will influence cost at a specific 
site. The variation begins with the needs of the individual entity 
(views of which can differ from administration, scientist, and physical 
security points of view) and is influenced by the characteristics of 
the site--for example, linked areas are in different buildings, on 
opposite sides of a fire wall, etc. Generally labor for installation 
(approximately $96/hour in Washington, DC for installation work on 
electronic access control) \17\ is the most expensive and variable cost 
of these systems.
---------------------------------------------------------------------------

    \17\ Christian Lee, Physical Security Specialist, USDA-APHIS-
FMD-ESB. Personal communication.
---------------------------------------------------------------------------

    A review of 20 security plans of registered entities gives an 
indication of the nature of security present at affected entities. It 
also gives an indication of the nature of improvements to security that 
have occurred since the implementation of the interim rule, or are 
planned, or will need to occur at affected entities. All showed a good 
base of security. In fact, a number require no improvement under this 
rule. Improvements that have already occurred or have been recommended 
include installing intrusion detection systems, installing or expanding 
CCTV surveillance, card-key access control and standard locks. Often an 
entity's standard operating procedures for security sufficiently serve 
in place of a limited number or lack of electronic controls. Because 
many of the affected entities deal with select agents or toxins in an 
area that is fully contained in a larger structure, the lack of entry 
control equipment may not affect the level of graded protection. It 
should also be noted that only that portion of a given entity affected 
by select agent or toxin operations is required to be secured under 
this rule. On average, academic entities had 5,560 square feet, 
commercial entities 2,894 square feet, and government entities 4,848 
square feet to be secured.\18\
---------------------------------------------------------------------------

    \18\ Based on a review of 20 security plans for select agents or 
toxins submitted to APHIS. The review covered a broad spectrum of 
security plans, and type of entity. Plans were reviewed at random. 
Robert Rice, Security Manager, APHIS select agent program.
---------------------------------------------------------------------------

    This rule will require that all information resources related to 
select agents and toxins have an appropriate level of protection in the 
system that is used to acquire, store, manipulate, manage, move, 
control, display, switch, interchange, receive or transmit that 
information. Most affected entities have a variety of compelling 
reasons, including regulatory requirements,\19\ for already protecting 
information.
---------------------------------------------------------------------------

    \19\ Among others: Presidential Decision Directive 63, Critical 
Infrastructure Protection; the Computer Security Act of 1987 (Public 
Law (PL) 100-235); the Computer Fraud and Abuse Act (18 U.S.C. Sec. 
1030 [1993]); Office of Management and Budget (OMB) Circular No. A-
123, Management Accountability and Control; Appendix III of OMB 
Circular No. A-130, Management of Federal Information Resources; 
FED-STD-1037A, ``An Electronic Means for Communicating Information; 
and the Electronic Communications Privacy Act (18 U.S.C. 2701).
---------------------------------------------------------------------------

Other Costs

    All individuals with access to select agents or toxins are required 
to have the appropriate education, training and/or experience to handle 
or use such agents or toxins. In addition, additional training may be 
needed to familiarize staff with changes resulting from the rule. This 
requirement may necessitate that affected entities provide additional 
training. It is not known the extent to which training may be needed at 
affected entities, and therefore the cost of providing that training is 
not known. However, the National Center for Import and Export (NCIE) 
within APHIS Veterinary Services has a laboratory biosafety class to 
train inspectors. In FY 2002, APHIS spent $35,480 on participant and 
speaker travel, speaker honoraria, and equipment and supplies to train 
18 inspectors, or about $2,000 each. If we assume that each of affected 
entities will have similar expenditures, and must train 25 individuals 
\20\ the training cost would be $50,000 per entity or $3.8 million for 
all 76 entities. It should be noted that most of the APHIS training 
cost is in travel. To the extent that training at affected entities can 
occur on-site, the cost per individual could be reduced.
---------------------------------------------------------------------------

    \20\ The average number of individuals needing security risk 
assessments per entity.
---------------------------------------------------------------------------

    The rule requires that a registered entity maintain complete 
records concerning activities related to select agents or toxins. This 
includes an accurate, current inventory for each select agent held in 
long-term storage. It is estimated that it would take eight technical 
hours to complete an inventory of a freezer containing select agents or 
a toxin container. Assuming that there are on average 10 freezers,

[[Page 13274]]

and 3 toxin containers at a given registered entity, it would cost 
$7,200 per entity to create this baseline inventory. Based on 76 
registered entities, the baseline inventory would cost a total of 
$548,000. The inventory will have to be verified periodically. Assuming 
that the registered entities would have to re-inventory one-half of 
their freezers each year to maintain an accurate and current inventory, 
yields a yearly inventory cost of $274,000.
    Other record keeping includes copies of the biosafety/
biocontainment, security and incident response plans, a list of 
individuals with access to select agents and toxins, training records, 
inventory records, permits and transfer documents, security records, 
and incident reports. It is estimated that complying with the record 
keeping requirements will require 10 hours per PI (3 managerial and 7 
technical hours per PI), between 10 and 90 hours per entity per year or 
$745 to $6,700 per entity. The total cost of yearly record keeping is 
estimated to be $132,000 based on the current number of affected 
entities, and the number of PIs at those entities.
    The rule also requires oral notification immediately upon discovery 
of the theft or loss of select agents or toxins, followed by a written 
report within 7 days. This is also the requirement for the discovery 
that a release of a select agent or toxin has occurred outside of the 
containment area of the entity. APHIS expects there to be two 
notifications of theft, loss or release in a given year. It is 
estimated that complying with these theft, loss and release 
notification requirements will require one hour (0.17 managerial hours 
and 0.83 technical hours), or $72 for each occurrence, for a total cost 
of $144 per year. It is assumed that an incident of theft or loss will 
also require a thorough inventory of the affected storage freezer or 
toxin container, at a cost of $560 per occurrence, for a yearly total 
of $1,120.
    An individual or entity may appeal a denial, revocation, or 
suspension of registration under this part. An individual may appeal a 
denial, limitation, or revocation of access approval under this part. 
APHIS expects there to be one appeal in a given year. It is estimated 
that complying with the appeal requirements will require 2 managerial 
hours and 2 technical hours, or $311 for each occurrence.
    Another potential cost of the rule is on the pace and quantity of 
research on select agents and toxins. If an entity chooses not to 
continue work with select agents or toxins to avoid the expenditures 
that will be required as a result of this rule, the impact on the 
progress of scientific knowledge is unknown and likely unknowable. 
However, the consequences of not securing select agents and toxins 
could be extreme.

Costs to APHIS

    The rule will also involve costs to APHIS. The rule will require 
the government to process entity registrations, notifications of 
identification of agents and toxins, exemption applications, transfer 
applications, theft/loss notifications and appeals, perform inspection 
and compliance activities, provide technical assistance for compliance 
to affected entities, develop and maintain a database covering select 
agents and toxins, develop and maintain a secure space for the 
database, and obtain security clearances. The FY2004 budget for the 
APHIS select agent and toxin program is $4.3 million. User fees to 
offset government costs will not be collected by APHIS under this rule.

Potential Impact of This Rule

    Approximately 70 percent of research & development (commercial and 
non-profit laboratories dealing with human, animal and/or plant 
agents), biological (except diagnostic) manufacturing, diagnostic 
manufacturing, pharmaceutical manufacturing, and other private 
establishments affected by this rule have fewer than 20 employees, and 
another 15 percent have between 20 and 49 employees.\21\ Plant 
laboratories (Federal, commercial, State, and academic) tend to be very 
small, with fewer than 10 individuals having access to select agents or 
toxins. Veterinary diagnostic laboratories (commercial, State or 
university) and university research laboratories likely have fewer than 
100 employees.\22\ Federal entities covered by the rule will be 
affected by the registration requirements but should not have to make 
alterations due to the biosafety, containment and security requirements 
of the rule.
---------------------------------------------------------------------------

    \21\ 1997 Economic Census. Department of Commerce, Census 
Bureau.
    \22\ AAVLD provided information on 10 veterinary diagnostic 
laboratories. These laboratories ranged in size form 11 to 100 
employees including faculty, staff (part- and full-time), and 
students. In addition, the AAVLD president estimated that diagnostic 
laboratories in general would likely have between 6 and 80 
employees. According to Dr. Denise Spenser, USDA-APHIS, university 
research on select agents likely involves fewer than 100 individuals 
(3 to 5 principal investigators out of about 25 faculty members in 
each of 3 or 4 departments--microbiology (veterinary microbiology), 
chemistry, and physiology, 3 to 5 (20 at most) investigators, 
technicians, and students in each laboratory).
---------------------------------------------------------------------------

    The portion of an affected entity where select agents or toxins are 
handled and that needs to be secure tends to be small. A review of 20 
security plans of registered entities show an average of 4,449 
ft2 to be secured. Seventy percent of the entities have less 
than 5,000 ft2 to be secured, 20 percent between 5,000 and 
10,000 ft2 to be secured, and 10 percent more than 10,000 
ft2 to be secured.\23\
---------------------------------------------------------------------------

    \23\ Based on a review of 20 security plans of affected 
entities.
---------------------------------------------------------------------------

    For the purpose of assessing the impact of the security 
requirements of the rule, we make the following assumptions based on 
the available information:
     70 percent of affected entities have an area to be secured 
of approximately 5,000 ft2,
     20 percent of affected entities have an area to be secured 
of approximately 7,500 ft2,
     10 percent of affected entities have an area to be secured 
of approximately 15,000 ft2, and
     Because entities will have varying levels of existing 
security, security needs, and methods of meeting those needs, the 
average security upgrades in APHIS facilities is used as a proxy for 
upgrades at these entities. (The proxy is based on upgrading to state-
of-the-art equipment, which may or may not be used at a given entity).
    Using an average budget estimate for upgrading the electronic 
portion of a security system and the average area to secure by type of 
entity, we get estimates of the budget necessary to make these 
upgrades. Based on a budget estimate of $10.25/square foot,\24\ an 
entity with 5,000 ft2 to secure by installing electronic 
security countermeasures would need to budget $51,250, an entity with 
7,500 ft2 to secure would need to budget $76,875, and one 
with 15,000 ft2 to secure would need to budget $153,750.
---------------------------------------------------------------------------

    \24\ The baseline estimated cost/ft2 of $8.71/
ft2 for facilities less than 30,000 ft2 in size, plus an 
adjustment of 17.7% for retrofitting existing structures.
---------------------------------------------------------------------------

    To obtain an aggregate cost estimate we apply these budget 
estimates based the size distribution of those entities. Applying a 
budget cost of $51,250 to the 70 percent of affected entities that have 
5,000 ft2 to secure gives a cost of $2.7 million. Applying a 
budget cost of $76,875 to the 20 percent of affected entities that have 
7,500 ft2 to secure gives a cost of $1.2 million. Applying a 
budget cost of $153,750 to the 10 percent of affected entities that 
have 15,000 ft2 to secure gives a cost of $1.2 million.

[[Page 13275]]

    It should be noted that as indicated above, utilizing APHIS'' costs 
as a proxy implies that all entities have baseline levels of electronic 
security similar to that of APHIS facilities and will upgrade to state-
of-the-art technology. However, a review of security plans at affected 
entities shows that an upgrade state-of-the-art systems is not 
necessary or likely in most cases. Therefore, this proxy likely 
overstates the true cost of electronic security at these entities.
    In addition to electronic security, an entity could need none, 
some, or all of the following:
     Entity security assessment, including developing a 
security plan as per the rule. Assuming that the 70 percent of entities 
with less than 5,000 ft2 to secure spend $17,000, the 20 
percent with between 5,000 and 10,000 ft2 to secure spend 
$21,000, and the 10 percent with more than 10,000 ft2 to 
secure spend $25,000 on these assessments gives a total cost of $1.4 
million.
     Entry control equipment; includes x-ray--small unit 
($28,000 per unit), x-ray--large unit ($40,000 per unit), and metal 
detector(s) ($20,000 per unit). Based on available information, we 
assume that 8 affected entities would need to add entry control 
equipment as a result of this rule. We further assume that each of 
those entities would spend an average of $30,000 on that equipment for 
a total cost of $240,000.
     Off-site monitoring can range from $10,000 to $45,000 per 
year. Assuming that the 70 percent of entities with less than 5,000 
ft2 to secure spend $10,000, the 20 percent with between 
5,000 and 10,000 ft2 to secure spend $27,500, and the 10 
percent with more than 10,000 ft2 to secure spend $45,000 on 
this off-site monitoring gives a total cost of $1.3 million.
     Equipment maintenance agreements can range in cost from 
$12,000 to $30,000 per year. Assuming that the 70 percent of entities 
with less than 5,000 ft2 to secure spend $12,000, the 20 
percent with between 5,000 and 10,000 ft2 to secure spend 
$21,000, and the 10 percent with more than 10,000 ft2 to 
secure spend $30,000 on these maintenance agreements gives a total cost 
of $1.2 million.
     Guard Service. Unarmed ($30.00/hr per security post), 
armed ($35.00/hr per security post), and a supervisor ($40.00/hr). When 
the site-specific security needs call for guards, it is the presence of 
a guard that is the most important factor. Therefore, unarmed guards 
would most likely be used. At most, a given entity would need a single 
unarmed guard on duty 24 hours a day. The majority of affected entities 
will rely on off-site monitoring, campus or local police, or existing 
guard presence. Therefore, we assume that the 70 percent of entities 
with less than 5,000 ft2 to secure would add no additional 
guard service, the 20 percent with between 5,000 and 10,000 
ft2 to secure would add an additional guard 12 hours per day 
at a cost of $135,050 per year, and the 10 percent with more than 
10,000 ft2 to secure would add an additional guard 24 hours 
per day at a cost of $270,100 per year, giving a total annual cost of 
$814,000.\25\
---------------------------------------------------------------------------

    \25\ Robert Rice, Security Manager, APHIS select agent program.
---------------------------------------------------------------------------

    This rule will involve other costs to the regulated community. It 
is estimated that complying with the exemption and notification 
requirements will have a total cost of $75,000 per year, $84 for each 
exemption application and $72 for each notification of identification. 
The rule will also involve the costs associated with the registration 
requirements. It is estimated that it will cost each entity $380 to 
collect and provide the required information, for a total cost of 
$29,000. Registration amendments are expected to cost $10,000 per year, 
$172 per occurrence. In addition, it is estimated that it will cost 
each entity $277 for a total of $21,000 to collect and provide the 
required information for re-application. Complying with the 
requirements concerning the transfer of select agents and toxins could 
cost $248 per occurrence or $16,000 per year. The rule could also 
entail costs for any needed upgrades to biosafety and containment, and 
information systems control. These costs are expected to be small. To 
the extent that affected entities are already permittees, the biosafety 
and containment requirements of the new act will have already been 
required at those entities. Affected entities have a variety of 
compelling reasons, including legislation, for already protecting 
information. The rule also requires that biosafety/biocontainment, 
security, and incident response plans be developed. It is estimated 
that the development of the biosafety/biocontainment plan could cost 
$4,500 per plan or a total of $171,000 if one-half of the affected 
entities need to develop new plans. The security plan would be 
developed as part of the entity security assessment discussed above. It 
is estimated that developing an incident response plan will cost $2,500 
per plan for a total of $99,000 if one-half of the affected entities 
need to develop new plans. The cost to registrants associated with the 
individual security risk assessments is in obtaining fingerprints of 
individuals in the entity needing security screening. The average 
entity could expect to spend $825 obtaining fingerprints initially with 
a total for all entities of $63,250, and $470 annually for a total of 
$35,750. It is estimated that developing a baseline inventory of select 
agents and toxins at affected entities would cost $7,200 per entity for 
a total of $548,000, and the yearly inventory cost will be $3,600 per 
entity for a total of $274,000. Other recordkeeping is estimated at 
$1,742 per entity for a total of $132,000 per year. The estimated cost 
associated with training is $50,000 per entity for a total of $3.8 
million. The estimated total cost associated with notifications of 
theft, loss and release of select agents or toxins is $72 per 
occurrence for a total of $144 per year. In addition, it is assumed 
that an incident of theft or loss will also require a thorough 
inventory of the affected storage freezer or toxin container, $560 per 
occurrence at a yearly total cost of $1,120. The estimated total cost 
associated with appeals under this rule is estimated to be $311 per 
year. The estimated cost associated with expedited reviews under this 
rule is estimated to be $43 per occurrence for a total of $1,000 
initially and $560 per year thereafter.
    The costs to APHIS include processing entity registrations, 
notifications of identification of agents and toxins, exemption 
applications, transfer applications, theft/loss notifications, appeals, 
performing entity inspections and providing technical assistance for 
compliance to affected entities, developing and maintaining a database 
covering select agents and toxins, developing and maintaining a secure 
space to house the database, and obtaining security clearances. The FY 
2004 budget for the APHIS select agent and toxin program is $4.3 
million.
    Costs of the various components associated with the rule are 
summarized in the following table.

[[Page 13276]]



                                                        Table 1.--Summary of Potential Costs \1\
--------------------------------------------------------------------------------------------------------------------------------------------------------
                  Costs                                        One-time costs                                         Recurring costs
--------------------------------------------------------------------------------------------------------------------------------------------------------
Exemptions from the Rule:
    Application..........................  $2,900.                                                 .....................................................
    Re-application.......................  ......................................................  $2,900.
    Notifications of identification......  ......................................................  $72,000/yr.
Registration:
    Application..........................  $29,000.
    Re-application.......................  ......................................................  $21,000 every 3 yrs.
    Amendments...........................  ......................................................  $10,000/yr.
    Biosafety/Biocontainment Plan........  $171,000.                                               .....................................................
    Incident Response plan...............  $99,000.                                                .....................................................
    Fingerprinting associated with SRAs..  $63,250...............................................  $35,750/yr.
    Security plan/entity security          $17,000 to $25,000 per entity.                          .....................................................
     assessment.                           $1.4 million..........................................
Transfer.................................  ......................................................  $16,000/yr.
Physical security procedures: \2\
    Electronic Security (cameras, card-    $51,250 for 5,000 ft \2\.
     readers, etc.).                       $76,875 for 7,500 ft \2\..............................
                                           $153,750 for 15,000 ft \2\............................
                                           $5.1 million..........................................
    Entry control (x-ray, metal detector)  $30,000 each.                                           .....................................................
                                           $240,000..............................................
    Off-site monitoring..................  ......................................................  $10,000 to $45,000 per entity.
                                                                                                   $1.3 million/yr.
    Maintenance agreement................  ......................................................  $12,000 to $30,000 per entity.
                                                                                                   $1.2 million/yr.
    Guard service........................  ......................................................  $0 to $270,100 per entity.
                                                                                                   $814,000/yr.
Other costs:
    Training.............................  $3.8 million.                                           .....................................................
    Baseline inventory...................  $548,000.                                               .....................................................
    Periodic inventory...................  ......................................................  $274,000/yr.
    Recordkeeping........................  ......................................................  $132,000/yr.
    Theft/loss/release                                                                             .....................................................
    Notification.........................  ......................................................  $144/yr.
    Additional inventory.................  ......................................................  1,120/yr.
    Appeals..............................  ......................................................  $311/yr.
    Expedited reviews....................  $1,000................................................  $560/yr.
                                          ---------------------------------------------------------
        Total............................  $11.5 million.........................................  $3.9 million.
Costs to APHIS:
    Budget for select agent program......  ......................................................  $4.3 million.
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ Unless otherwise noted, these are total costs for all affected entities.
\2\ Because security needs are site-specific and the rule allows for site-specific security solutions, the approaches and applications will be varied.
  Actual additional physical security measures added will vary (including none) based on the current level of security and the specific security needs
  of a given entity. The electronic security costs assumes 70 percent of facilities are 5,000 ft \2\, 20 percent of facilities are 7,500 ft \2\, and 10
  percent of facilities are 15,000 ft \2\. The entry control equipment cost assumes 8 entities need such equipment. The off-site monitoring and
  maintenance agreement costs assume all affected entities need some monitoring. The guard service cost assumes entities would need, on average, from 0
  to 24 additional hours daily of unarmed guard service.

    For all affected entities, estimates of the various one-time costs 
associated with this rule total $11.5 million and the estimates of the 
annual recurring costs total $3.9 million. The above is given to 
provide perspective on the magnitude of the potential costs associated 
with this rule. The costs shown here are likely overstated, however, 
due to conservative assumptions used in the absence of better 
information. The entities covered in this rule can and do vary from a 
small laboratory contained within a larger facility to large dedicated 
buildings to large groups of buildings and land. Because security needs 
are site-specific and the rule allows for site-specific security 
solutions, the approaches and applications will be varied. Physical 
security measures may have to be added in various quantities (including 
none) to meet the specific security needs of an entity. In fact, the 
security plans submitted under the December 2002 interim rule shows 
that the need for additional security measures is limited in many 
cases. Also, some of the impacts of the rule are somewhat offset by 
previous requirements, such as permit requirements in place prior to 
the implementation of the December 2002 interim rule. The flexibility 
in the rule also allows for site-specific needs to be met in the most 
cost effective manner possible.

Regulatory Flexibility Analysis

    The Regulatory Flexibility Act requires that the Agency 
specifically consider the economic impact of rules on small entities. 
Those entities most likely to be impacted by the rule are those 
laboratories and other institutions conducting research and related 
activities that involve the use of select agents and toxins. Most 
affected entities (other than Federal or State governmental entities) 
would be considered part of NAICS code 541710, ``Research and 
Development in the Physical, Engineering, and Life Sciences.'' Some 
affected entities would be considered part of NAICS 541940, 
``Veterinary Services,'' NAICS 611310, ``Colleges, Universities and 
Professional Schools,'' NAICS 325412 ``Pharmaceutical Preparation 
Manufacturing,'' NAICS 325413 ``In-Vitro Diagnostic Substance

[[Page 13277]]

Manufacturing,'' and NAICS 325414, ``Biological Product (except 
Diagnostic) Manufacturing.''
    The Small Business Administration (SBA) has established guidelines 
for determining when establishments are to be considered small under 
the Regulatory Flexibility Act. An entity in NAICS 541710, 325413 or 
325414 is considered small with 500 or fewer employees, in 325412 with 
750 or fewer employees. An entity in NAICS 611310 is considered small 
with annual receipts/revenues of $6 million or less.
    While the establishment size breakdown in the Economic Census does 
not precisely fit the SBA guidelines, it still shows that the vast 
majority (more than 90 percent) of life sciences research & development 
establishments can be considered small. More than 99 percent of 
biological (except diagnostic) manufacturing, more than 98 percent of 
diagnostic manufacturing, and at least 94 percent of pharmaceutical 
manufacturing are considered small. The economic census does not 
contain information on the establishment size of veterinary service 
entities. According to data from the U.S. Department of Education, 
about 31 percent of reporting postsecondary institutions had revenue of 
less than $6 million in fiscal year 1995-96.\26\
---------------------------------------------------------------------------

    \26\ IPEDS.
---------------------------------------------------------------------------

    Based on the available information, this rule is not anticipated to 
have a substantial impact on a significant number of small entities.

Alternatives Considered

    This rule has been prompted by the need to prevent the misuse of 
select agents and toxins and thereby reduce the potential for those 
pathogens to harm humans, animals, animal products, plants or plant 
products in the United States. In assessing the need for this rule, we 
considered several alternatives to the chosen course of action.
    One alternative would be to maintain the status quo, where we rely 
on our authority to issue permits for the importation and interstate 
movement of agents and toxins as a basis for any actions we take to 
regulate select agents and toxins. We rejected this option. The Public 
Health Security and Bioterrorism Preparedness and Response Act of 2002 
(Pub. L. 107-188), requires that the Secretary of Agriculture establish 
and enforce standards and procedures governing the possession and use 
of the listed biological agents and toxins, including the establishment 
and enforcement of safety requirements for the transfer of listed 
agents and toxins; the establishment and enforcement of safeguard and 
security measures to prevent access to listed agents and toxins for use 
in domestic or international terrorism or other criminal purpose; and 
the establishment of procedures to protect animal and plant health, and 
animal and plant products, in the event of a transfer in violation of 
the established safety and security measures.
    Another alternative would involve variations to the chosen 
regulatory scheme. For example, we could have chosen prescriptive 
requirements for meeting the need for security around select agents and 
toxins. We rejected this option. Because different agents and toxins 
pose differing degrees risk, depending on factors such as their escape 
potential and availability of a suitable habitat (for plant-related 
agents) and transmission and effect of exposure to the agent or toxin 
(for overlap and animal agents or toxins), we believe that it would be 
counterproductive to attempt to prepare a detailed list of prescriptive 
requirements for entities (i.e., a ``one size fits all'' design 
standard). Rather, we prepared a brief set of performance standards 
that we will consider to the degree to which they are appropriate to 
the risks presented by a particular agent or toxin, given its intended 
use and the location of the entity. In addition, these performance 
based standards allow for site-specific needs to be met in the most 
cost effective manner possible.

Conclusion

    This rule is intended to prevent the misuse of select agents and 
toxins, and thereby reduce the potential for those pathogens to harm 
humans, animals, animal products, plants or plant products in the 
United States. Should any select agent or toxin be intentionally 
introduced into the United States, the consequences would be 
significant. Consequences could include disruption of markets, 
difficulties in sustaining an adequate food and fiber supply, and the 
potential spread of disease infestations over large areas. In any 
animal or plant disease outbreak, the government would incur the costs 
of eradication. Industry would be affected through the imposition of 
domestic and foreign quarantines, which would result in a loss of 
markets and destruction of animals/plants if commercial properties are 
found to be infected with the disease. Even though compensation can be 
paid for the destroyed property, repopulating (flocks, herds, fields, 
etc.) may be time consuming with additional losses from idle capital 
and lost markets. In addition, there is the potential for a disruption 
in the domestic food supply, whether through contamination, consumer 
perception, or both. Such a disruption can have a lasting influence on 
food demand and global trade.
    While the costs associated with this rule could be considerable, 
some of those impacts are somewhat offset. For example, requirements 
such as USDA permit requirements for biosafety and containment and the 
mandate to update security at USDA facilities were in place prior to 
the implementation of the December 2002 interim rule. The flexibility 
in the rule also allows for site-specific needs to be met in the most 
cost effective manner possible. In addition, these costs are greatly 
outweighed by the benefits of preventing an unintentional or deliberate 
introduction of a select agent or toxin into the United States. The 
cost associated with outbreaks can be very high as is demonstrated by 
natural outbreaks that have occurred. Deliberate introduction greatly 
increases the probability of a select agent or toxin becoming 
established and causing wide-ranging and devastating impacts on the 
economy, disruption to society, diminished confidence in public and 
private institutions, and possible loss of life.

Paperwork Reduction Act

    The December 2002 interim rule established regulations governing 
the possession, use, and transfer of biological agents and toxins that 
have been determined to have the potential to pose a severe threat to 
public health and safety, to animal health, to plant health, or to 
animal or plant products. This final rule includes certain regulatory 
provisions that differ from those included in the December 2002 interim 
rule. Some of those provisions involve changes from the information 
collection requirements set out in the December 2002 interim rule, 
which were approved by the Office of Management and Budget (OMB) under 
OMB control number 0579-0213 (expires May 31, 2005).
    In a separate notice in today's issue of the Federal Register, 
APHIS is announcing that the information collection and recordkeeping 
requirements included in this final rule have been submitted for 
emergency approval to OMB.

Government Paperwork Elimination Act Compliance

    The Animal and Plant Health Inspection Service is committed to 
compliance with the Government Paperwork Elimination Act (GPEA),

[[Page 13278]]

which requires Government agencies in general to provide the public the 
option of submitting information or transacting business electronically 
to the maximum extent possible. For information pertinent to GPEA 
compliance related to this rule, please contact Mrs. Celeste Sickles, 
APHIS' Information Collection Coordinator, at (301) 734-7477.

List of Subjects

7 CFR Part 331

    Agricultural research, Laboratories, Plant diseases and pests, 
Reporting and recordkeeping requirements.

9 CFR Part 121

    Agricultural research, Animal diseases, Laboratories, Medical 
research, Reporting and recordkeeping requirements.


0
Accordingly, 7 CFR part 331 and 9 CFR part 121 are revised to read as 
follows:

Title 7--Agriculture

0
1. Revise part 331 to read as follows:

PART 331--POSSESSION, USE, AND TRANSFER OF SELECT AGENTS AND TOXINS

Sec.
331.1 Definitions.
331.2 Purpose and scope.
331.3 PPQ select agents and toxins.
331.4 [Reserved]
331.5 Exemptions.
331.6 [Reserved]
331.7 Registration and related security risk assessments.
331.8 Denial, revocation, or suspension of registration.
331.9 Responsible official.
331.10 Restricting access to select agents and toxins; security risk 
assessments.
331.11 Security.
331.12 Biocontainment.
331.13 Restricted experiments.
331.14 Incident response.
331.15 Training.
331.16 Transfers.
331.17 Records.
331.18 Inspections.
331.19 Notification of theft, loss, or release.
331.20 Administrative review.

    Authority: 7 U.S.C. 8401; 7 CFR 2.22, 2.80, and 371.3.


Sec.  331.1  Definitions.

    Administrator. The Administrator, Animal and Plant Health 
Inspection Service, or any person authorized to act for the 
Administrator.
    Animal and Plant Health Inspection Service (APHIS). The Animal and 
Plant Health Inspection Service of the U.S. Department of Agriculture.
    Attorney General. The Attorney General of the United States or any 
person authorized to act for the Attorney General.
    Biological agent. Any microorganism (including, but not limited to, 
bacteria, viruses, fungi, rickettsiae, or protozoa), or infectious 
substance, or any naturally occurring, bioengineered, or synthesized 
component of any such microorganism or infectious substance, capable of 
causing:
    (1) Death, disease, or other biological malfunction in a human, an 
animal, a plant, or another living organism;
    (2) Deterioration of food, water, equipment, supplies, or material 
of any kind; or
    (3) Deleterious alteration of the environment.
    Centers for Disease Control and Prevention (CDC). The Centers for 
Disease Control and Prevention of the U.S. Department of Health and 
Human Services.
    Diagnosis. The analysis of specimens for the purpose of identifying 
or confirming the presence or characteristics of a select agent or 
toxin, provided that such analysis is directly related to protecting 
the public health or safety, animal health or animal products, or plant 
health or plant products.
    Entity. Any government agency (Federal, State, or local), academic 
institution, corporation, company, partnership, society, association, 
firm, sole proprietorship, or other legal entity.
    HHS Secretary. The Secretary of the Department of Health and Human 
Services or his or her designee, unless otherwise specified.
    HHS select agent and/or toxin. A biological agent or toxin listed 
in 42 CFR 73.3.
    Import. To move into, or the act of movement into, the territorial 
limits of the United States.
    Interstate. From one State into or through any other State, or 
within the District of Columbia, Guam, the Virgin Islands of the United 
States, or any other territory or possession of the United States.
    Permit. A written authorization by the Administrator to import or 
move interstate select agents or toxins, under conditions prescribed by 
the Administrator.
    PPQ. The Plant Protection and Quarantine Programs of the Animal and 
Plant Health Inspection Service.
    Responsible official. The individual designated by an entity with 
the authority and control to ensure compliance with the regulations in 
this part.
    Select agent and/or toxin. A biological agent or toxin listed in 
Sec.  331.3.
    Specimen. Samples of material from humans, animals, plants, or the 
environment, or isolates or cultures from such samples, for diagnosis, 
verification, or proficiency testing.
    State. Any of the several States of the United States, the 
Commonwealth of the Northern Mariana Islands, the Commonwealth of 
Puerto Rico, the District of Columbia, Guam, the Virgin Islands of the 
United States, or any other territory or possession of the United 
States.
    Toxin. The toxic material or product of plants, animals, 
microorganisms (including, but not limited to, bacteria, viruses, 
fungi, rickettsiae, or protozoa), or infectious substances, or a 
recombinant or synthesized molecule, whatever their origin and method 
of production, and includes:
    (1) Any poisonous substance or biological product that may be 
engineered as a result of biotechnology produced by a living organism; 
or
    (2) Any poisonous isomer or biological product, homolog, or 
derivative of such a substance.
    United States. All of the States.
    USDA. The U.S. Department of Agriculture.
    Verification. The demonstration of obtaining established 
performance (e.g., accuracy, precision, and the analytical sensitivity 
and specificity) specifications for any procedure used for diagnosis.


Sec.  331.2  Purpose and scope.

    This part implements the provisions of the Agricultural 
Bioterrorism Protection Act of 2002 setting forth the requirements for 
possession, use, and transfer of select agents and toxins. The 
biological agents and toxins listed in this part have the potential to 
pose a severe threat to plant health or plant products.


Sec.  331.3  PPQ select agents and toxins.

    (a) Except as provided in paragraphs (d) and (e) of this section, 
the Administrator has determined that the biological agents and toxins 
listed in this section have been determined to have the potential to 
pose a severe threat to plant health or to plant products.
    (b) PPQ select agents and toxins:
    Candidatus Liberobacter africanus;
    Candidatus Liberobacter asiaticus;
    Peronosclerospora philippinensis;
    Ralstonia solanacearum, race 3, biovar 2;
    Sclerophthora rayssiae var. zeae;
    Synchytrium endobioticum;
    Xanthomonas oryzae pv. oryzicola;
    Xylella fastidiosa (citrus variegated chlorosis strain).
    (c) Genetic elements, recombinant nucleic acids, and recombinant 
organisms:

[[Page 13279]]

    (1) Nucleic acids that can produce infectious forms of any of the 
select agent viruses listed in paragraph (b) of this section.
    (2) Recombinant nucleic acids that encode for the functional forms 
of any toxin listed in paragraph (b) of this section if the nucleic 
acids:
    (i) Can be expressed in vivo or in vitro; or
    (ii) Are in a vector or recombinant host genome and can be 
expressed in vivo or in vitro.
    (3) Select agents and toxins listed in paragraph (b) of this 
section that have been genetically modified.
    (d) Select agents or toxins that meet any of the following criteria 
are excluded from the requirements of this part:
    (1) Any select agent or toxin that is in its naturally occurring 
environment, provided that the agent or toxin has not been 
intentionally introduced, cultivated, collected, or otherwise extracted 
from its natural source.
    (2) Nonviable select agents or nonfunctional toxins.
    (e) An attenuated strain of a select agent or toxin may be excluded 
from the requirements of this part based upon a determination that the 
attenuated strain does not pose a severe threat to plant health or 
plant products.
    (1) To apply for an exclusion, an individual or entity must submit 
a written request and supporting scientific information. A written 
decision granting or denying the request will be issued. An exclusion 
will be effective upon notification of the applicant. Exclusions will 
be published periodically in the notice section of the Federal Register 
and will be listed on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html.
    (2) If an excluded attenuated strain is subjected to any 
manipulation that restores or enhances its virulence, the resulting 
select agent or toxin will be subject to the requirements of this part.
    (3) An individual or entity may make a written request to the 
Administrator for reconsideration of a decision denying an exclusion 
application. The written request for reconsideration must state the 
facts and reasoning upon which the individual or entity relies to show 
the decision was incorrect. The Administrator will grant or deny the 
request for reconsideration as promptly as circumstances allow and will 
state, in writing, the reasons for the decision.
    (f) Any select agent or toxin seized by a Federal law enforcement 
agency will be excluded from the requirements of this part during the 
period between seizure of the agent or toxin and the transfer or 
destruction of such agent or toxin provided that:
    (1) As soon as practicable, the Federal law enforcement agency 
transfers the seized agent or toxin to an entity eligible to receive 
such agent or toxin or destroys the agent or toxin by a recognized 
sterilization or inactivation process.
    (2) The Federal law enforcement agency safeguards and secures the 
seized agent or toxin against theft, loss, or release, and reports any 
theft, loss, or release of such agent or toxin.
    (3) The Federal law enforcement agency reports the seizure of the 
select agent or toxin to APHIS or CDC. The seizure must be reported 
within 24 hours by telephone, facsimile, or e-mail. This report must be 
followed by submission of APHIS/CDC Form 4 within 7 calendar days after 
seizure of the select agent or toxin. A copy of the completed form must 
be maintained for 3 years.
    (4) The Federal law enforcement agency reports the final 
disposition of the select agent or toxin to APHIS or CDC by submission 
of APHIS/CDC Form 4. A copy of the completed form must be maintained 
for 3 years.


Sec.  331.4  [Reserved]


Sec.  331.5  Exemptions.

    (a) Diagnostic laboratories and other entities that possess, use, 
or transfer a select agent or toxin that is contained in a specimen 
presented for diagnosis or verification will be exempt from the 
requirements of this part for such agent or toxin contained in the 
specimen, provided that:
    (1) Unless directed otherwise by the Administrator, within 7 
calendar days after identification, the agent or toxin is transferred 
in accordance with Sec.  331.16 or destroyed on-site by a recognized 
sterilization or inactivation process;
    (2) The agent or toxin is secured against theft, loss, or release 
during the period between identification of the agent or toxin and 
transfer or destruction of such agent or toxin, and any theft, loss, or 
release of such agent or toxin is reported; and
    (3) The identification of the agent or toxin is immediately 
reported to APHIS or CDC by telephone, facsimile, or e-mail. This 
report must be followed by submission of APHIS/CDC Form 4 within 7 
calendar days after identification. Less stringent reporting may be 
required during agricultural emergencies or outbreaks, or in endemic 
areas. A copy of APHIS/CDC Form 4 must be maintained for 3 years.
    (b) In addition to the exemption provided in paragraph (a) of this 
section, the Administrator may grant a specific exemption upon a 
showing of good cause and upon his or her determination that such 
exemption is consistent with protecting plant health or plant products. 
An individual or entity may request in writing an exemption from the 
requirements of this part. If granted, such exemptions are valid for a 
maximum of 3 years; thereafter, an individual or entity must request a 
new exemption. If a request for exemption is denied, an individual or 
entity may request reconsideration in writing to the Administrator. The 
request for reconsideration must state all of the facts and reasons 
upon which the individual or entity relies to show that the exemption 
was wrongfully denied. The Administrator will grant or deny the request 
for reconsideration as promptly as circumstances allow and will state, 
in writing, the reasons for the decision.


Sec.  331.6  [Reserved]


Sec.  331.7  Registration and related security risk assessments.

    (a) Unless exempted under Sec.  331.5, an individual or entity 
shall not possess, use, or transfer any select agent or toxin without a 
certificate of registration issued by the Administrator.
    (b) As a condition of registration, each entity must designate an 
individual to be its responsible official. While most registrants are 
likely to be entities, in the event that an individual applies for and 
is granted a certificate of registration, the individual will be 
considered the responsible official.
    (c)(1) As a condition of registration, the following must be 
approved by the Administrator or the HHS Secretary based on a security 
risk assessment by the Attorney General:
    (i) The individual or entity;
    (ii) The responsible official; and
    (iii) Unless otherwise exempted under this section, any individual 
who owns or controls the entity.
    (2) Federal, State, or local governmental agencies, including 
public accredited academic institutions, are exempt from the security 
risk assessments for the entity and the individual who owns or controls 
such entity.
    (3) An individual will be deemed to own or control an entity under 
the following conditions: \1\
---------------------------------------------------------------------------

    \1\ These conditions may apply to more than one individual.
---------------------------------------------------------------------------

    (i) For a private institution of higher education, an individual 
will be deemed to own or control the entity if the individual is in a 
managerial or executive capacity with regard to the

[[Page 13280]]

entity's select agents or toxins or with regard to the individuals with 
access to the select agents or toxins possessed, used, or transferred 
by the entity.
    (ii) For entities other than institutions of higher education, an 
individual will be deemed to own or control the entity if the 
individual:
    (A) Owns 50 percent or more of the entity, or is a holder or owner 
of 50 percent or more of its voting stock; or
    (B) Is in a managerial or executive capacity with regard to the 
entity's select agents or toxins or with regard to the individuals with 
access to the select agents or toxins possessed, used, or transferred 
by the entity.
    (4) An entity will be considered to be an institution of higher 
education if it is an institution of higher education as defined in 
section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)), 
or is an organization described in 501(c)(3) of the Internal Revenue 
Code of 1986, as amended (26 U.S.C. 501(c)(3)).
    (5) To obtain a security risk assessment, an individual or entity 
must submit the information necessary to conduct a security risk 
assessment to the Attorney General.
    (d) To apply for a certificate of registration for only PPQ select 
agents or toxins, or for PPQ and VS select agents or toxins, an 
individual or entity must submit the information requested in the 
registration application package (APHIS/CDC Form 1) to APHIS. To apply 
for a certificate of registration for overlap select agents or toxins, 
overlap select agents or toxins and any combination of PPQ or VS select 
agents or toxins, or HHS select agents or toxins and any combination of 
PPQ or VS select agents or toxins, an individual or entity must submit 
the information requested in the registration application package 
(APHIS/CDC Form 1) to APHIS or CDC, but not both.
    (e) Prior to the issuance of a certificate of registration, the 
responsible official must promptly provide notification of any changes 
to the application for registration by submitting the relevant page(s) 
of the registration application.
    (f) The issuance of a certificate of registration may be contingent 
upon inspection or submission of additional information, such as the 
security plan, biosafety plan, incident response plan, or any other 
documents required to be prepared under this part.
    (g) A certificate of registration will be valid for one physical 
location (a room, a building, or a group of buildings) where the 
responsible official will be able to perform the responsibilities 
required in this part, for specific select agents or toxins, and for 
specific activities.
    (h) A certificate of registration may be amended to reflect changes 
in circumstances (e.g., replacement of the responsible official or 
other personnel changes, changes in ownership or control of the entity, 
changes in the activities involving any select agents or toxins, or the 
addition or removal of select agents or toxins).
    (1) Prior to any change, the responsible official must apply for an 
amendment to a certificate of registration by submitting the relevant 
page(s) of the registration application.\2\
---------------------------------------------------------------------------

    \2\ Depending on the change, a security risk assessment by the 
Attorney General may also be required (e.g., replacement of the 
responsible official, changes in ownership or control of the entity, 
new researchers or graduate students, etc.).
---------------------------------------------------------------------------

    (2) The responsible official will be notified in writing if an 
application to amend a certificate of registration has been approved. 
Approval of an amendment may be contingent upon an inspection or 
submission of additional information, such as the security plan, 
biosafety plan, incident response plan, or any other documents required 
to be prepared under this part.
    (3) No change may be made without such approval.
    (i) An entity must immediately notify APHIS or CDC if it loses the 
services of its responsible official. In the event that an entity loses 
the services of its responsible official, an entity may continue to 
possess or use select agents or toxins only if it appoints as the 
responsible official another individual who has been approved by the 
Administrator or the HHS Secretary following a security risk assessment 
by the Attorney General and who meets the requirements of this part.
    (j) A certificate of registration will be terminated upon the 
written request of the entity if the entity no longer possesses or uses 
any select agents or toxins and no longer wishes to be registered.
    (k) A certificate of registration will be valid for a maximum of 3 
years.


Sec.  331.8  Denial, revocation, or suspension of registration.

    (a) An application may be denied or a certificate of registration 
revoked or suspended if:
    (1) The individual or entity, the responsible official, or an 
individual who owns or controls the entity is within any of the 
categories described in 18 U.S.C. 175b;
    (2) The individual or entity, the responsible official, or an 
individual who owns or controls the entity is reasonably suspected by 
any Federal law enforcement or intelligence agency of:
    (i) Committing a crime set forth in 18 U.S.C. 2332b(g)(5); or
    (ii) Knowing involvement with an organization that engages in 
domestic or international terrorism (as defined in 18 U.S.C. 2331) or 
with any other organization that engages in intentional crimes of 
violence; or
    (iii) Being an agent of a foreign power as defined in 50 U.S.C. 
1801;
    (3) The individual or entity does not meet the requirements of this 
part; \3\ or
---------------------------------------------------------------------------

    \3\ If registration is denied for this reason, we may provide 
technical assistance and guidance.
---------------------------------------------------------------------------

    (4) It is determined that such action is necessary to protect plant 
health or plant products.
    (b) Upon revocation or suspension of a certificate of registration, 
the individual or entity must:
    (1) Immediately stop all use of each select agent or toxin covered 
by the revocation or suspension order;
    (2) Immediately safeguard and secure each select agent or toxin 
covered by the revocation or suspension order from theft, loss, or 
release; and
    (3) Comply with all disposition instructions issued by the 
Administrator for each select agent or toxin covered by the revocation 
or suspension.
    (c) Denial of an application for registration and revocation or 
suspension of registration may be appealed under Sec.  331.20. However, 
any denial of an application for registration or revocation or 
suspension of a certificate of registration will remain in effect until 
a final agency decision has been rendered.


Sec.  331.9  Responsible official.

    (a) An individual or entity required to register under this part 
must designate an individual to be the responsible official. The 
responsible official must:
    (1) Be approved by the Administrator or the HHS Secretary following 
a security risk assessment by the Attorney General;
    (2) Be familiar with the requirements of this part;
    (3) Have authority and responsibility to act on behalf of the 
entity;
    (4) Ensure compliance with the requirements of this part; and
    (5) Ensure that annual inspections are conducted of each laboratory 
where select agents or toxins are stored or used in order to ensure 
compliance with the requirements of this part. The results of each 
inspection must be documented, and any deficiencies identified during 
an inspection must be corrected.
    (b) An entity may designate one or more individuals to be an 
alternate

[[Page 13281]]

responsible official, who may act for the responsible official in his/
her absence. These individuals must have the authority and control to 
ensure compliance with the regulations when acting as the responsible 
official.
    (c) The responsible official must report the identification and 
final disposition of any select agent or toxin contained in a specimen 
for diagnosis or verification.
    (1) The identification of the select agent or toxin must be 
immediately reported by telephone, facsimile, or e-mail. The final 
disposition of the agent or toxin must be reported by submission of 
APHIS/CDC Form 4 within 7 calendar days after identification. A copy of 
the completed form must be maintained for 3 years.
    (2) Less stringent reporting may be required during agricultural 
emergencies or outbreaks, or in endemic areas.


Sec.  331.10  Restricting access to select agents and toxins; security 
risk assessments.

    (a) An individual or entity required to register under this part 
may not provide an individual access to a select agent or toxin, and an 
individual may not access a select agent or toxin, unless the 
individual is approved by the Administrator or the HHS Secretary 
following a security risk assessment by the Attorney General.
    (b) An individual will be deemed to have access at any point in 
time if the individual has possession of a select agent or toxin (e.g., 
carries, uses, or manipulates) or the ability to gain possession of a 
select agent or toxin.
    (c) Each individual with access to select agents or toxins must 
have the appropriate education, training, and/or experience to handle 
or use such agents or toxins.
    (d) To apply for access approval, each individual must submit the 
information necessary to conduct a security risk assessment to the 
Attorney General.
    (e) An individual's security risk assessment may be expedited upon 
written request by the responsible official and a showing of good cause 
(e.g., agricultural emergencies, national security, or a short-term 
visit by a prominent researcher). A written decision granting or 
denying the request will be issued.
    (f) An individual's access approval may be denied, limited, or 
revoked if:
    (1) The individual is within any of the categories described in 18 
U.S.C. 175b;
    (2) The individual is reasonably suspected by any Federal law 
enforcement or intelligence agency of committing a crime set forth in 
18 U.S.C. 2332b(g)(5); knowing involvement with an organization that 
engages in domestic or international terrorism (as defined in 18 U.S.C. 
2331) or with any other organization that engages in intentional crimes 
of violence; or being an agent of a foreign power as defined in 50 
U.S.C. 1801; or
    (3) It is determined that such action is necessary to protect plant 
health or plant products.
    (g) An individual may appeal the Administrator's decision to deny, 
limit, or revoke access approval under Sec.  331.20.
    (h) Access approval is valid for a maximum of 5 years.
    (i) The responsible official must immediately notify APHIS or CDC 
when an individual's access to select agents or toxins is terminated by 
the entity and the reasons therefore.


Sec.  331.11  Security.

    (a) An individual or entity required to register under this part 
must develop and implement a written security plan. The security plan 
must be sufficient to safeguard the select agent or toxin against 
unauthorized access, theft, loss, or release.
    (b) The security plan must be designed according to a site-specific 
risk assessment and must provide graded protection in accordance with 
the risk of the select agent or toxin, given its intended use. The 
security plan must be submitted upon request.
    (c) The security plan must:
    (1) Describe procedures for physical security, inventory control, 
and information systems control;
    (2) Contain provisions for the control of access to select agents 
and toxins;
    (3) Contain provisions for routine cleaning, maintenance, and 
repairs;
    (4) Establish procedures for removing unauthorized or suspicious 
persons;
    (5) Describe procedures for addressing loss or compromise of keys, 
passwords, combinations, etc. and protocols for changing access numbers 
or locks following staff changes;
    (6) Contain procedures for reporting unauthorized or suspicious 
persons or activities, loss or theft of select agents or toxins, 
release of select agents or toxins, or alteration of inventory records; 
and
    (7) Contain provisions for ensuring that all individuals with 
access approval from the Administrator or the HHS Secretary understand 
and comply with the security procedures.
    (d) An individual or entity must adhere to the following security 
requirements or implement measures to achieve an equivalent or greater 
level of security:
    (1) Allow access only to individuals with access approval from the 
Administrator or the HHS Secretary;
    (2) Allow individuals not approved for access by the Administrator 
or the HHS Secretary to conduct routine cleaning, maintenance, repairs, 
and other activities not related to select agents or toxins only when 
continuously escorted by an approved individual;
    (3) Provide for the control of select agents and toxins by 
requiring freezers, refrigerators, cabinets, and other containers where 
select agents or toxins are stored to be secured against unauthorized 
access (e.g., card access system, lock boxes);
    (4) Inspect all suspicious packages before they are brought into or 
removed from an area where select agents or toxins are used or stored;
    (5) Establish a protocol for intra-entity transfers under the 
supervision of an individual with access approval from the 
Administrator or the HHS Secretary, including chain-of-custody 
documents and provisions for safeguarding against theft, loss, or 
release; and
    (6) Require that individuals with access approval from the 
Administrator or the HHS Secretary refrain from sharing with any other 
person their unique means of accessing a select agent or toxin (e.g., 
keycards or passwords);
    (7) Require that individuals with access approval from the 
Administrator or the HHS Secretary immediately report any of the 
following to the responsible official:
    (i) Any loss or compromise of keys, passwords, combinations, etc.;
    (ii) Any suspicious persons or activities;
    (iii) Any loss or theft of select agents or toxins;
    (iv) Any release of a select agent or toxin; and
    (v) Any sign that inventory or use records for select agents or 
toxins have been altered or otherwise compromised; and
    (8) Separate areas where select agents and toxins are stored or 
used from the public areas of the building.
    (e) In developing a security plan, an individual or entity should 
consider the document entitled, ``Laboratory Security and Emergency 
Response Guidance for Laboratories Working with Select Agents,'' in 
Morbidity and Mortality Weekly Report (December 6, 2002); 51 (No. RR-
19):1-6. This document is available on the Internet at http://www.cdc.gov/mmwr.
    (f) The plan must be reviewed annually and revised as necessary. 
Drills or exercises must be conducted at least annually to test and 
evaluate the

[[Page 13282]]

effectiveness of the plan. The plan must be reviewed and revised, as 
necessary, after any drill or exercise and after any incident.


Sec.  331.12  Biocontainment.

    (a) An individual or entity required to register under this part 
must develop and implement a written biocontainment plan that is 
commensurate with the risk of the select agent or toxin, given its 
intended use.\4\ The biocontainment plan must contain sufficient 
information and documentation to describe the containment procedures.
---------------------------------------------------------------------------

    \4\ Technical assistance and guidance may be obtained by 
contacting APHIS.
---------------------------------------------------------------------------

    (b) The biocontainment procedures must be sufficient to contain the 
select agent or toxin (e.g., physical structure and features of the 
entity, and operational and procedural safeguards).
    (c) In developing a biocontainment plan, an individual or entity 
should consider the following:
    (1) ``Containment Facilities and Safeguards for Exotic Plant 
Pathogens and Pests'' (Robert P. Kahn and S.B. Mathur eds., 1999); and
    (2) ``A Practical Guide to Containment: Greenhouse Research with 
Transgenic Plants and Microbes'' (Patricia L. Traynor ed., 2001).
    (d) The plan must be reviewed annually and revised as necessary. 
Drills or exercises must be conducted at least annually to test and 
evaluate the effectiveness of the plan. The plan must be reviewed and 
revised, as necessary, after any drill or exercise and after any 
incident.


Sec.  331.13  Restricted experiments.5
---------------------------------------------------------------------------

    \5\ For guidance, see the NIH publication, ``NIH Guidelines for 
Research Involving Recombinant DNA Molecules.'' This document is 
available on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html.
---------------------------------------------------------------------------

    (a) An individual or entity may not conduct the following 
experiments unless approved by and conducted in accordance with the 
conditions prescribed by the Administrator:
    (1) Experiments utilizing recombinant DNA that involve the 
deliberate transfer of a drug resistance trait to select agents that 
are not known to acquire the trait naturally, if such acquisition could 
compromise the use of the drug to control disease agents in humans, 
veterinary medicine, or agriculture.
    (2) Experiments involving the deliberate formation of recombinant 
DNA containing genes for the biosynthesis of toxins lethal for 
vertebrates at an LD50<100 ng/kg body weight.
    (b) The Administrator may revoke approval to conduct any of the 
experiments in paragraph (a) of this section, or revoke or suspend a 
certificate of registration, if the individual or entity fails to 
comply with the requirements of this part.
    (c) To apply for approval to conduct any of the experiments in 
paragraph (a) of this section, an individual or entity must submit a 
written request and supporting scientific information to the 
Administrator. A written decision granting or denying the request will 
be issued.


Sec.  331.14  Incident response.6
---------------------------------------------------------------------------

    \6\ Nothing in this section is meant to supersede or preempt 
incident response requirements imposed by other statutes or 
regulations.
---------------------------------------------------------------------------

    (a) An individual or entity required to register under this part 
must develop and implement a written incident response plan.\7\ The 
incident response plan must be coordinated with any entity-wide plans, 
kept in the workplace, and available to employees for review.
---------------------------------------------------------------------------

    \7\ Technical assistance and guidance may be obtained by 
contacting APHIS.
---------------------------------------------------------------------------

    (b) The incident response plan must fully describe the entity's 
response procedures for the theft, loss, or release of a select agent 
or toxin; inventory discrepancies; security breaches (including 
information systems); severe weather and other natural disasters; 
workplace violence; bomb threats and suspicious packages; and 
emergencies such as fire, gas leak, explosion, power outage, etc. The 
response procedures must account for hazards associated with the select 
agent or toxin and appropriate actions to contain such agent or toxin.
    (c) The incident response plan must also contain the following 
information:
    (1) The name and contact information (e.g., home and work) for the 
individual or entity (e.g., responsible official, alternate responsible 
official(s), biosafety officer, etc.);
    (2) The name and contact information for the building owner and/or 
manager, where applicable;
    (3) The name and contact information for tenant offices, where 
applicable;
    (4) The name and contact information for the physical security 
official for the building, where applicable;
    (5) Personnel roles and lines of authority and communication;
    (6) Planning and coordination with local emergency responders;
    (7) Procedures to be followed by employees performing rescue or 
medical duties;
    (8) Emergency medical treatment and first aid;
    (9) A list of personal protective and emergency equipment, and 
their locations;
    (10) Site security and control;
    (11) Procedures for emergency evacuation, including type of 
evacuation, exit route assignments, safe distances, and places of 
refuge; and
    (12) Decontamination procedures.
    (d) The plan must be reviewed annually and revised as necessary. 
Drills or exercises must be conducted at least annually to test and 
evaluate the effectiveness of the plan. The plan must be reviewed and 
revised, as necessary, after any drill or exercise and after any 
incident.


Sec.  331.15  Training.

    (a) An individual or entity required to register under this part 
must provide information and training on biocontainment and security to 
each individual with access approval from the Administrator or the HHS 
Secretary before he/she has such access. In addition, an individual or 
entity must provide information and training on biocontainment and 
security to each individual not approved for access by the 
Administrator or the HHS Secretary before he/she works in or visits 
areas where select agents or toxins are handled or stored (e.g., 
laboratories, growth chambers, animal rooms, greenhouses, storage 
areas, etc.). The training must address the particular needs of the 
individual, the work they will do, and the risks posed by the select 
agents or toxins.
    (b) Refresher training must be provided annually.
    (c) A record of the training provided to each individual must be 
maintained. The record must include the name of the individual, the 
date of training, a description of the training provided, and the means 
used to verify that the employee understood the training.


Sec.  331.16  Transfers.

    (a) Except as provided in paragraph (c) of this section, a select 
agent or toxin may only be transferred to an individual or entity 
registered to possess, use, or transfer that agent or toxin. A select 
agent or toxin may only be transferred under the conditions of this 
section and must be authorized by APHIS or CDC prior to the 
transfer.\8\
---------------------------------------------------------------------------

    \8\ The requirements of this section do not apply to transfers 
within a registered entity (i.e., the sender and the recipient are 
covered by the same certificate of registration).
---------------------------------------------------------------------------

    (b) In addition to any permit required under part 330 of this 
chapter, a transfer may be authorized if:
    (1) The sender:

[[Page 13283]]

    (i) Has at the time of transfer a certificate of registration that 
covers the particular select agent or toxin to be transferred and meets 
all the requirements of this part;
    (ii) Meets the exemption requirements for the particular select 
agent or toxin to be transferred; or
    (iii) Is transferring the select agent or toxin from outside of the 
United States and meets all import requirements.
    (2) At the time of transfer, the recipient has a certificate of 
registration that includes the particular select agent or toxin to be 
transferred and meets all of the requirements of this part.
    (c) On a case-by-case basis, the Administrator may authorize a 
transfer of a select agent or toxin not otherwise eligible for transfer 
under this part under conditions prescribed by the Administrator.
    (d) To obtain authorization for a transfer, APHIS/CDC Form 2 must 
be submitted.
    (e) The recipient must submit a completed APHIS/CDC Form 2 within 2 
business days of receipt of a select agent or toxin.
    (f) The recipient must immediately notify APHIS or CDC if the 
select agent or toxin has not been received within 48 hours after the 
expected delivery time or if the package containing the select agent or 
toxin has been damaged to the extent that a release of the select agent 
or toxin may have occurred.
    (g) An authorization for a transfer shall be valid only for 30 
calendar days after issuance, except that such an authorization becomes 
immediately null and void if any facts supporting the authorization 
change (e.g., change in the certificate of registration for the sender 
or recipient, change in the application for transfer).
    (h) The sender must comply with all applicable laws governing 
packaging and shipping.


Sec.  331.17  Records.

    (a) An individual or entity required to register under this part 
must maintain complete records relating to the activities covered by 
this part. Such records must include:
    (1) An accurate, current inventory for each select agent (including 
viral genetic elements, recombinant nucleic acids, and recombinant 
organisms) held in long-term storage (placement in a system designed to 
ensure viability for future use, such as in a freezer or lyophilized 
materials), including:
    (i) The name and characteristics (e.g., strain designation, GenBank 
Accession number, etc.);
    (ii) The quantity acquired from another individual or entity (e.g., 
containers, vials, tubes, etc.), date of acquisition, and the source;
    (iii) Where stored (e.g., building, room, and freezer);
    (iv) When moved from storage and by whom and when returned to 
storage and by whom;
    (v) The select agent used and purpose of use;
    (vi) Records created under Sec.  331.16 (Transfers);
    (vii) For intra-entity transfers (sender and the recipient are 
covered by the same certificate of registration), the select agent, the 
quantity transferred, the date of transfer, the sender, and the 
recipient; and
    (viii) Records created under Sec.  331.19 (Notification of theft, 
loss, or release);
    (2) An accurate, current inventory for each toxin held, including:
    (i) The name and characteristics;
    (ii) The quantity acquired from another individual or entity (e.g., 
containers, vials, tubes, etc.), date of acquisition, and the source;
    (iii) The initial and current quantity amount (e.g., milligrams, 
milliliters, grams, etc.);
    (iv) The toxin used and purpose of use, quantity, date(s) of the 
use and by whom;
    (v) Where stored (e.g., building, room, and freezer);
    (vi) When moved from storage and by whom and when returned to 
storage and by whom, including quantity amount;
    (vii) Records created under Sec.  331.16 (Transfers);
    (viii) For intra-entity transfers (sender and the recipient are 
covered by the same certificate of registration), the toxin, the 
quantity transferred, the date of transfer, the sender, and the 
recipient;
    (ix) Records created under Sec.  331.19 (Notification of theft, 
loss, or release);
    (x) If destroyed, the quantity of toxin destroyed, the date of such 
action, and by whom.
    (3) A current list of all individuals that have been granted access 
approval by the Administrator or the HHS Secretary;
    (4) Information about all entries into areas containing select 
agents or toxins, including the name of the individual, name of the 
escort (if applicable), and the date and time of entry;
    (5) Accurate, current records created under Sec.  331.9(c) 
(Responsible official), Sec.  331.11 (Security), Sec.  331.12 
(Biocontainment), Sec.  331.14 (Incident response), and Sec.  331.15 
(Training); and
    (6) A written explanation of any discrepancies.
    (b) The individual or entity must implement a system to ensure that 
all records and databases created under this part are accurate, have 
controlled access, and can be verified for authenticity.
    (c) All records created under this part must be maintained for 3 
years and promptly produced upon request.


Sec.  331.18  Inspections.

    (a) Without prior notification, APHIS must be allowed to inspect 
any site at which activities regulated under this part are conducted 
and must be allowed to inspect and copy any records relating to the 
activities covered by this part.
    (b) Prior to issuing a certificate of registration to an individual 
or entity, APHIS may inspect and evaluate their premises and records to 
ensure compliance with this part.


Sec.  331.19  Notification of theft, loss, or release.

    (a) An individual or entity must immediately notify APHIS or CDC 
upon discovery of the theft or loss of a select agent or toxin. Thefts 
or losses must be reported even if the select agent or toxin is 
subsequently recovered or the responsible parties are identified.
    (1) The theft or loss of a select agent or toxin must be reported 
by telephone, facsimile, or e-mail. The following information must be 
provided:
    (i) The name of the select agent or toxin and any identifying 
information (e.g., strain or other characterization information);
    (ii) An estimate of the quantity stolen or lost;
    (iii) An estimate of the time during which the theft or loss 
occurred;
    (iv) The location (building, room) from which the theft or loss 
occurred; and
    (v) The list of Federal, State, or local law enforcement agencies 
to which the individual or entity reported, or intends to report, the 
theft or loss.
    (2) A completed APHIS/CDC Form 3 must be submitted within 7 
calendar days.
    (b) An individual or entity must notify APHIS or CDC immediately 
upon discovery of a release of a select agent or toxin outside of the 
primary barriers of the biocontainment area.
    (1) The release of a select agent or toxin must be reported by 
telephone, facsimile, or e-mail. The following information must be 
provided:
    (i) The name of the select agent or toxin and any identifying 
information (e.g., strain or other characterization information);
    (ii) An estimate of the quantity released;
    (iii) The time and duration of the release;
    (iv) The environment into which the release occurred (e.g., in 
building or outside of building, waste system);

[[Page 13284]]

    (v) The location (building, room) from which the release occurred; 
and
    (vi) The number of individuals potentially exposed at the entity;
    (vii) Actions taken to respond to the release; and
    (viii) Hazards posed by the release.
    (2) A completed APHIS/CDC Form 3 must be submitted within 7 
calendar days.


Sec.  331.20  Administrative review.

    An individual or entity may appeal a denial, revocation, or 
suspension of registration under this part. An individual may appeal a 
denial, limitation, or revocation of access approval under this 
part.\9\ The appeal must be in writing, state the factual basis for the 
appeal, and be submitted to the Administrator within 30 calendar days 
of the decision. Where the denial, revocation, or suspension of 
registration or the denial, limitation, or revocation of an 
individual's access approval is based upon an identification by the 
Attorney General, the request for review will be forwarded to the 
Attorney General. The Administrator's decision constitutes final agency 
action.
---------------------------------------------------------------------------

    \9\ An entity may not appeal the denial or limitation of an 
individual's access to select agents or toxins.
---------------------------------------------------------------------------

Title 9--Animals and Animal Products

0
2. Revise part 121 to read as follows:

PART 121--POSSESSION, USE, AND TRANSFER OF SELECT AGENTS AND TOXINS

Sec.
121.1 Definitions.
121.2 Purpose and scope.
121.3 VS select agents and toxins.
121.4 Overlap select agents and toxins.
121.5 Exemptions for VS select agents and toxins.
121.6 Exemptions for overlap select agents and toxins.
121.7 Registration and related security risk assessments.
121.8 Denial, revocation, or suspension of registration.
121.9 Responsible official.
121.10 Restricting access to select agents and toxins; security risk 
assessments.
121.11 Security.
121.12 Biosafety.
121.13 Restricted experiments.
121.14 Incident response.
121.15 Training.
121.16 Transfers.
121.17 Records.
121.18 Inspections.
121.19 Notification of theft, loss, or release.
121.20 Administrative review.

    Authority: 7 U.S.C. 8401; 7 CFR 2.22, 2.80, and 371.4.


Sec.  121.1  Definitions.

    Administrator. The Administrator, Animal and Plant Health 
Inspection Service, or any person authorized to act for the 
Administrator.
    Animal and Plant Health Inspection Service (APHIS). The Animal and 
Plant Health Inspection Service of the U.S. Department of Agriculture.
    Attorney General. The Attorney General of the United States or any 
person authorized to act for the Attorney General.
    Biological agent. Any microorganism (including, but not limited to, 
bacteria, viruses, fungi, rickettsiae, or protozoa), or infectious 
substance, or any naturally occurring, bioengineered, or synthesized 
component of any such microorganism or infectious substance, capable of 
causing:
    (1) Death, disease, or other biological malfunction in a human, an 
animal, a plant, or another living organism;
    (2) Deterioration of food, water, equipment, supplies, or material 
of any kind; or
    (3) Deleterious alteration of the environment.
    Centers for Disease Control and Prevention (CDC). The Centers for 
Disease Control and Prevention of the U.S. Department of Health and 
Human Services.
    Diagnosis. The analysis of specimens for the purpose of identifying 
or confirming the presence or characteristics of a select agent or 
toxin, provided that such analysis is directly related to protecting 
the public health or safety, animal health or animal products, or plant 
health or plant products.
    Entity. Any government agency (Federal, State, or local), academic 
institution, corporation, company, partnership, society, association, 
firm, sole proprietorship, or other legal entity.
    HHS Secretary. The Secretary of the Department of Health and Human 
Services or his or her designee, unless otherwise specified.
    HHS select agent and/or toxin. A biological agent or toxin listed 
in 42 CFR 73.3.
    Import. To move into, or the act of movement into, the territorial 
limits of the United States.
    Interstate. From one State into or through any other State, or 
within the District of Columbia, Guam, the Virgin Islands of the United 
States, or any other territory or possession of the United States.
    Overlap select agent and/or toxin. A biological agent or toxin that 
is listed in Sec.  121.4 and 42 CFR 73.4.
    Permit. A written authorization by the Administrator to import or 
move interstate select agents or toxins, under conditions prescribed by 
the Administrator.
    Proficiency testing. The process of determining the competency of 
an individual or laboratory to perform a specified test or procedure.
    Responsible official. The individual designated by an entity with 
the authority and control to ensure compliance with the regulations in 
this part.
    Select agent and/or toxin. Unless otherwise specified, all of the 
biological agents or toxins listed in Sec. Sec.  121.3 and 121.4.
    Specimen. Samples of material from humans, animals, plants, or the 
environment, or isolates or cultures from such samples, for diagnosis, 
verification, or proficiency testing.
    State. Any of the several States of the United States, the 
Commonwealth of the Northern Mariana Islands, the Commonwealth of 
Puerto Rico, the District of Columbia, Guam, the Virgin Islands of the 
United States, or any other territory or possession of the United 
States.
    Toxin. The toxic material or product of plants, animals, 
microorganisms (including, but not limited to, bacteria, viruses, 
fungi, rickettsiae, or protozoa), or infectious substances, or a 
recombinant or synthesized molecule, whatever their origin and method 
of production, and includes:
    (1) Any poisonous substance or biological product that may be 
engineered as a result of biotechnology produced by a living organism; 
or
    (2) Any poisonous isomer or biological product, homolog, or 
derivative of such a substance.
    United States. All of the States.
    USDA. The U.S. Department of Agriculture.
    Verification. The demonstration of obtaining established 
performance (e.g., accuracy, precision, and the analytical sensitivity 
and specificity) specifications for any procedure used for diagnosis.
    VS. The Veterinary Services Programs of the Animal and Plant Health 
Inspection Service.
    VS select agent and/or toxin. A biological agent or toxin listed in 
Sec.  121.3.


Sec.  121.2  Purpose and scope.

    This part implements the provisions of the Agricultural 
Bioterrorism Protection Act of 2002 setting forth the requirements for 
possession, use, and transfer of select agents and toxins. The 
biological agents and toxins listed in this part have the potential to 
pose a severe threat to public health and safety,

[[Page 13285]]

to animal health, or to animal products. Overlap select agents and 
toxins are subject to regulation by both APHIS and CDC.


Sec.  121.3  VS select agents and toxins.

    (a) Except as provided in paragraphs (d) and (e) of this section, 
the Administrator has determined that the biological agents and toxins 
listed in this section have the potential to pose a severe threat to 
animal health or to animal products.
    (b) VS select agents and toxins:
    African horse sickness virus;
    African swine fever virus;
    Akabane virus;
    Avian influenza virus (highly pathogenic);
    Bluetongue virus (exotic);
    Bovine spongiform encephalopathy agent;
    Camel pox virus;
    Classical swine fever virus;
    Cowdria ruminantium (Heartwater);
    Foot-and-mouth disease virus;
    Goat pox virus;
    Japanese encephalitis virus;
    Lumpy skin disease virus;
    Malignant catarrhal fever virus (Alcelaphine herpesvirus type 1);
    Menangle virus;
    Mycoplasma capricolum/M. F38/M. mycoides capri (contagious caprine 
pleuropneumonia);
    Mycoplasma mycoides mycoides (contagious bovine pleuropneumonia);
    Newcastle disease virus (velogenic);
    Peste des petits ruminants virus;
    Rinderpest virus;
    Sheep pox virus;
    Swine vesicular disease virus;
    Vesicular stomatitis virus (exotic).
    (c) Genetic elements, recombinant nucleic acids, and recombinant 
organisms:
    (1) Nucleic acids that can produce infectious forms of any of the 
select agent viruses listed in paragraph (b) of this section.\1\
---------------------------------------------------------------------------

    \1\ The importation and interstate movement of VS select agents 
or toxins listed in paragraphs (c)(1) through (c)(3) of this section 
may be subject to the permit requirements under part 122 of this 
subchapter.
---------------------------------------------------------------------------

    (2) Recombinant nucleic acids that encode for the functional forms 
of any toxin listed in paragraph (b) of this section if the nucleic 
acids:
    (i) Can be expressed in vivo or in vitro; or
    (ii) Are in a vector or recombinant host genome and can be 
expressed in vivo or in vitro.
    (3) VS select agents and toxins listed in paragraph (b) of this 
section that have been genetically modified.
    (d) VS select agents or toxins that meet any of the following 
criteria are excluded from the requirements of this part:
    (1) Any VS select agent or toxin that is in its naturally occurring 
environment, provided that the agent or toxin has not been 
intentionally introduced, cultivated, collected, or otherwise extracted 
from its natural source.
    (2) Nonviable VS select agents or nonfunctional VS toxins.\2\
---------------------------------------------------------------------------

    \2\ However, the importation and interstate movement of these 
nonviable select agents may be subject to the permit requirements 
under part 122 of this subchapter.
---------------------------------------------------------------------------

    (e) An attenuated strain of a VS select agent or toxin may be 
excluded from the requirements of this part based upon a determination 
that the attenuated strain does not pose a severe threat to animal 
health or to animal products.
    (1) To apply for an exclusion, an individual or entity must submit 
a written request and supporting scientific information. A written 
decision granting or denying the request will be issued. An exclusion 
will be effective upon notification of the applicant. Exclusions will 
be published periodically in the notice section of the Federal Register 
and will be listed on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html.
    (2) If an excluded attenuated strain is subjected to any 
manipulation that restores or enhances its virulence, the resulting 
select agent or toxin will be subject to the requirements of this part.
    (3) An individual or entity may make a written request to the 
Administrator for reconsideration of a decision denying an exclusion 
application. The written request for reconsideration must state the 
facts and reasoning upon which the individual or entity relies to show 
the decision was incorrect. The Administrator will grant or deny the 
request for reconsideration as promptly as circumstances allow and will 
state, in writing, the reasons for the decision.
    (f) Any VS select agent or toxin seized by a Federal law 
enforcement agency will be excluded from the requirements of this part 
during the period between seizure of the agent or toxin and the 
transfer or destruction of such agent or toxin provided that:
    (1) As soon as practicable, the Federal law enforcement agency 
transfers the seized agent or toxin to an entity eligible to receive 
such agent or toxin or destroys the agent or toxin by a recognized 
sterilization or inactivation process.
    (2) The Federal law enforcement agency safeguards and secures the 
seized agent or toxin against theft, loss, or release, and reports any 
theft, loss, or release of such agent or toxin.
    (3) The Federal law enforcement agency reports the seizure of the 
select agent or toxin to APHIS or CDC.
    (i) The seizure of any of the following VS select agents and toxins 
must be reported within 24 hours by telephone, facsimile, or e-mail: 
African horse sickness virus, African swine fever virus, avian 
influenza virus (highly pathogenic), bovine spongiform encephalopathy 
agent, classical swine fever virus, foot-and-mouth disease virus, 
Newcastle disease virus (velogenic), rinderpest virus, and swine 
vesicular disease virus. This report must be followed by submission of 
APHIS/CDC Form 4 within 7 calendar days after seizure of the select 
agent or toxin.
    (ii) For all other VS select agents or toxins, APHIS/CDC Form 4 
must be submitted within 7 calendar days after seizure of the agent or 
toxin.
    (iii) A copy of APHIS/CDC Form 4 must be maintained for 3 years.
    (4) The Federal law enforcement agency reports the final 
disposition of the select agent or toxin by submission of APHIS/CDC 
Form 4. A copy of the completed form must be maintained for 3 years.


Sec.  121.4  Overlap select agents and toxins.

    (a) Except as provided in paragraphs (d) and (e) of this section, 
the Administrator has determined that the biological agents and toxins 
listed in this section have the potential to pose a severe threat to 
public health and safety, to animal health, or to animal products.
    (b) Overlap select agents and toxins:
    Bacillus anthracis;
    Botulinum neurotoxins;
    Botulinum neurotoxin producing species of Clostridium;
    Brucella abortus;
    Brucella melitensis;
    Brucella suis;
    Burkholderia mallei;
    Burkholderia pseudomallei;
    Clostridium perfringens epsilon toxin;
    Coccidioides immitis;
    Coxiella burnetii;
    Eastern equine encephalitis virus;
    Francisella tularensis;
    Hendra virus;
    Nipah virus;
    Rift Valley fever virus;
    Shigatoxin;
    Staphylococcal enterotoxins;
    T-2 toxin;
    Venezuelan equine encephalitis virus.
    (c) Genetic elements, recombinant nucleic acids, and recombinant 
organisms:
    (1) Nucleic acids that can produce infectious forms of any of the 
overlap

[[Page 13286]]

select agent viruses listed in paragraph (b) of this section.\3\
---------------------------------------------------------------------------

    \3\ The importation and interstate movement of overlap select 
agents or toxins listed in paragraphs (c)(1) through (c)(3) of this 
section may be subject to the permit requirements under part 122 of 
this subchapter.
---------------------------------------------------------------------------

    (2) Recombinant nucleic acids that encode for the functional forms 
of any overlap toxin listed in paragraph (b) of this section if the 
nucleic acids:
    (i) Can be expressed in vivo or in vitro; or
    (ii) Are in a vector or recombinant host genome and can be 
expressed in vivo or in vitro.
    (3) Overlap select agents and toxins listed in paragraph (b) of 
this section that have been genetically modified.
    (d) Overlap select agents or toxins that meet any of the following 
criteria are excluded from the requirements of this part:
    (1) Any overlap select agent or toxin that is in its naturally 
occurring environment, provided that the agent or toxin has not been 
intentionally introduced, cultivated, collected, or otherwise extracted 
from its natural source.
    (2) Nonviable overlap select agents or nonfunctional overlap 
toxins.\4\
---------------------------------------------------------------------------

    \4\ However, the importation and interstate movement of these 
nonviable overlap select agents may be subject to the permit 
requirements under part 122 of this subchapter.
---------------------------------------------------------------------------

    (3) Overlap toxins under the control of a principal investigator, 
treating physician or veterinarian, or commercial manufacturer or 
distributor, if the aggregate amount does not, at any time, exceed the 
following amounts: 0.5 mg of Botulinum neurotoxins, 100 mg of 
Clostridium perfringens epsilon toxin, 100 mg of Shigatoxin, 5 mg of 
Staphylococcal enterotoxins, and 1,000 mg of T-2 toxin.
    (e) An attenuated strain of an overlap select agent or toxin may be 
excluded from the requirements of this part based upon a determination 
that the attenuated strain does not pose a severe threat to public 
health and safety, to animal health, or to animal products.
    (1) To apply for an exclusion, an individual or entity must submit 
a written request and supporting scientific information. A written 
decision granting or denying the request will be issued. An exclusion 
will be effective upon notification of the applicant. Exclusions will 
be published periodically in the notice section of the Federal Register 
and will be listed on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html.
    (2) If an excluded attenuated strain is subjected to any 
manipulation that restores or enhances its virulence, the resulting 
overlap select agent or toxin will be subject to the requirements of 
this part.
    (3) An individual or entity may make a written request to the 
Administrator for reconsideration of a decision denying an exclusion 
application. The written request for reconsideration must state the 
facts and reasoning upon which the individual or entity relies to show 
the decision was incorrect. The Administrator will grant or deny the 
request for reconsideration as promptly as circumstances allow and will 
state, in writing, the reasons for the decision.
    (f) Any overlap select agent or toxin seized by a Federal law 
enforcement agency will be excluded from the requirements of this part 
during the period between seizure of the agent or toxin and the 
transfer or destruction of such agent or toxin provided that:
    (1) As soon as practicable, the Federal law enforcement agency 
transfers the seized agent or toxin to an entity eligible to receive 
such agent or toxin or destroys the agent or toxin by a recognized 
sterilization or inactivation process.
    (2) The Federal law enforcement agency safeguards and secures the 
seized agent or toxin against theft, loss, or release, and reports any 
theft, loss, or release of such agent or toxin.
    (3) The Federal law enforcement agency reports the seizure of the 
overlap select agent or toxin to APHIS or CDC.
    (i) The seizure of any of the following overlap select agents and 
toxins must be reported within 24 hours by telephone, facsimile, or e-
mail: Bacillus anthracis, Botulinum neurotoxins, Brucella melitensis, 
Francisella tularensis, Hendra virus, Nipah virus, Rift Valley fever 
virus, and Venezuelan equine encephalitis virus. This report must be 
followed by submission of APHIS/CDC Form 4 within 7 calendar days after 
seizure of the overlap select agent or toxin.
    (ii) For all other overlap select agents or toxins, APHIS/CDC Form 
4 must be submitted within 7 calendar days after seizure of the agent 
or toxin.
    (iii) A copy of APHIS/CDC Form 4 must be maintained for 3 years.
    (4) The Federal law enforcement agency reports the final 
disposition of the overlap select agent or toxin by submission of 
APHIS/CDC Form 4. A copy of the completed form must be maintained for 3 
years.


Sec.  121.5  Exemptions for VS select agents and toxins.

    (a) Diagnostic laboratories and other entities that possess, use, 
or transfer a VS select agent or toxin that is contained in a specimen 
presented for diagnosis or verification will be exempt from the 
requirements of this part for such agent or toxin contained in the 
specimen, provided that:
    (1) Unless directed otherwise by the Administrator, within 7 
calendar days after identification, the agent or toxin is transferred 
in accordance with Sec.  121.16 or destroyed on-site by a recognized 
sterilization or inactivation process;
    (2) The agent or toxin is secured against theft, loss, or release 
during the period between identification of the agent or toxin and 
transfer or destruction of such agent or toxin, and any theft, loss, or 
release of such agent or toxin is reported; and
    (3) The identification of the agent or toxin is reported to APHIS 
or CDC.
    (i) The identification of any of the following select agents and 
toxins must be immediately reported by telephone, facsimile, or e-mail: 
African horse sickness virus, African swine fever virus, avian 
influenza virus (highly pathogenic), bovine spongiform encephalopathy 
agent, classical swine fever virus, foot-and-mouth disease virus, 
Newcastle disease virus (velogenic), rinderpest virus, and swine 
vesicular disease virus. This report must be followed by submission of 
APHIS/CDC Form 4 within 7 calendar days after identification.
    (ii) For all other VS select agents or toxins, APHIS/CDC Form 4 
must be submitted within 7 calendar days after identification.
    (iii) Less stringent reporting may be required during agricultural 
emergencies or outbreaks, or in endemic areas.
    (iv) A copy of APHIS/CDC Form 4 must be maintained for 3 years.
    (b) Diagnostic laboratories and other entities that possess, use, 
or transfer a VS select agent or toxin that is contained in a specimen 
presented for proficiency testing will be exempt from the requirements 
of this part for such agent or toxin contained in the specimen, 
provided that:
    (1) Unless directed otherwise by the Administrator, within 90 
calendar days of receipt, the agent or toxin is transferred in 
accordance with Sec.  121.16 or destroyed on-site by a recognized 
sterilization or inactivation process;
    (2) The agent or toxin is secured against theft, loss, or release 
during the period between identification of the agent or toxin and 
transfer or destruction of such agent or toxin, and any theft, loss, or 
release of such agent or toxin is reported; and
    (3) The identification of the agent or toxin, and its derivative, 
is reported to APHIS or CDC. To report the

[[Page 13287]]

identification of a select agent or toxin, APHIS/CDC Form 4 must be 
submitted within 90 days of receipt of the agent or toxin. A copy of 
the completed form must be maintained for 3 years.
    (c) Diagnostic reagents and vaccines that are, bear, or contain VS 
select agents or toxins that are produced at USDA diagnostic facilities 
will be exempt from the requirements of this part.
    (d) Unless the Administrator by order determines that additional 
regulation is necessary to protect animal health or animal products, 
products that are, bear, or contain VS select agents or toxins will be 
exempt from the requirements of this part if the products have been 
cleared, approved, licensed, or registered pursuant to:
    (1) The Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et 
seq.);
    (2) Section 351 of Public Health Service Act (42 U.S.C. 262);
    (3) The Virus-Serum-Toxin Act (21 U.S.C. 151-159); or
    (4) The Federal Insecticide, Fungicide, and Rodenticide Act (7 
U.S.C. 131 et seq.).
    (e) The Administrator may exempt from the requirements of this part 
an experimental product that is, bears, or contains a VS select agent 
or toxin if such product is being used in an investigation authorized 
by any Federal law and the Administrator determines that additional 
regulation under this part is not necessary to protect animal health or 
animal products. To apply for an exemption, an individual or entity 
must submit APHIS/CDC Form 5. A written decision granting or denying 
the exemption will be issued. The applicant must notify APHIS when an 
authorization for an investigation no longer exists. This exemption 
automatically terminates when such authorization is no longer in 
effect.
    (f) In addition to the exemptions provided in paragraphs (a) 
through (e) of this section, the Administrator may grant a specific 
exemption upon a showing of good cause and upon his or her 
determination that such exemption is consistent with protecting animal 
health or animal products. An individual or entity may request in 
writing an exemption from the requirements of this part. If granted, 
such exemptions are valid for a maximum of 3 years; thereafter, an 
individual or entity must request a new exemption. If a request for 
exemption is denied, an individual or entity may request 
reconsideration in writing to the Administrator. The request for 
reconsideration must state all of the facts and reasons upon which the 
individual or entity relies to show that the exemption was wrongfully 
denied. The Administrator will grant or deny the request for 
reconsideration as promptly as circumstances allow and will state, in 
writing, the reasons for the decision.


Sec.  121.6  Exemptions for overlap select agents and toxins.

    (a) Clinical or diagnostic laboratories and other entities that 
possess, use, or transfer an overlap select agent or toxin that is 
contained in a specimen presented for diagnosis or verification will be 
exempt from the requirements of this part for such agent or toxin 
contained in the specimen, provided that:
    (1) Unless directed otherwise by the Administrator or the HHS 
Secretary, within 7 calendar days after identification, the agent or 
toxin is transferred in accordance with Sec.  121.16 or 42 CFR 73.16 or 
destroyed on-site by a recognized sterilization or inactivation 
process;
    (2) The agent or toxin is secured against theft, loss, or release 
during the period between identification of the agent or toxin and 
transfer or destruction of such agent or toxin, and any theft, loss, or 
release of such agent or toxin is reported; and
    (3) The identification of the agent or toxin is reported to APHIS 
or CDC.
    (i) The identification of any of the following overlap select 
agents and toxins must be immediately reported by telephone, facsimile, 
or e-mail: Bacillus anthracis, Botulinum neurotoxins, Brucella 
melitensis, Francisella tularensis, Hendra virus, Nipah virus, Rift 
Valley fever virus, and Venezuelan equine encephalitis virus. This 
report must be followed by submission of APHIS/CDC Form 4 within 7 
calendar days after identification.
    (ii) For all other overlap select agents or toxins, APHIS/CDC Form 
4 must be submitted within 7 calendar days after identification.
    (iii) Less stringent reporting may be required during agricultural 
emergencies or outbreaks, or in endemic areas.
    (iv) A copy of APHIS/CDC Form 4 must be maintained for 3 years.
    (b) Clinical or diagnostic laboratories and other entities that 
possess, use, or transfer an overlap select agent or toxin that is 
contained in a specimen presented for proficiency testing will be 
exempt from the requirements of this part for such agent or toxin 
contained in the specimen, provided that:
    (1) Unless directed otherwise by the Administrator or the HHS 
Secretary, within 90 days of receipt, the agent or toxin is transferred 
in accordance with Sec.  121.16 or 42 CFR 73.16 or destroyed on-site by 
a recognized sterilization or inactivation process;
    (2) The agent or toxin is secured against theft, loss, or release 
during the period between identification of the agent or toxin and 
transfer or destruction of such agent or toxin, and any theft, loss, or 
release of such agent or toxin is reported; and
    (3) The identification of the agent or toxin, and its derivative, 
is reported to APHIS or CDC. To report the identification of an overlap 
select agent or toxin, APHIS/CDC Form 4 must be submitted within 90 
calendar days of receipt of the agent or toxin. A copy of the completed 
form must be maintained for 3 years.
    (c) Unless the Administrator by order determines that additional 
regulation of a specific product is necessary to protect animal health 
or animal products, products that are, bear, or contain overlap select 
agents or toxins will be exempt from the requirements of this part if 
the products have been cleared, approved, licensed, or registered 
pursuant to:
    (1) The Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et 
seq.);
    (2) Section 351 of Public Health Service Act (42 U.S.C. 262);
    (3) The Virus-Serum-Toxin Act (21 U.S.C. 151-159); or
    (4) The Federal Insecticide, Fungicide, and Rodenticide Act (7 
U.S.C. 131 et seq.).
    (d) After consultation with the HHS Secretary, the Administrator 
may exempt from the requirements of this part an investigational 
product that is, bears, or contains an overlap select agent or toxin if 
such product is being used in an investigation authorized by any 
Federal law and the Administrator determines that additional regulation 
under this part is not necessary to protect animal health or animal 
products.
    (1) To apply for an exemption, an individual or entity must submit 
APHIS/CDC Form 5.
    (2) The Administrator will make a determination regarding an 
exemption within 14 calendar days after receipt of the application and 
notification that the investigation has been authorized under a Federal 
law. A written decision granting or denying the exemption will be 
issued.
    (3) The applicant must notify APHIS or CDC when an authorization 
for an investigation no longer exists. This exemption automatically 
terminates when such authorization is no longer in effect.
    (e) The Administrator may exempt an individual or entity from the

[[Page 13288]]

requirements of this part for 30 calendar days if it is necessary to 
respond to a domestic or foreign agricultural emergency involving an 
overlap select agent or toxin. The Administrator may extend the 
exemption once for an additional 30 days. An individual or entity may 
apply for this exemption by submitting APHIS/CDC Form 5. A written 
decision granting or denying the exemption will be issued.
    (f) Upon request of the Secretary of Health and Human Services, the 
Administrator may exempt an individual or entity from the requirements 
of this part for 30 calendar days if the Secretary of Health and Human 
Services has granted an exemption for a public health emergency 
involving an overlap select agent or toxin. The Administrator may 
extend the exemption once for an additional 30 days.


Sec.  121.7  Registration and related security risk assessments.

    (a) Unless exempted under Sec.  121.5, an individual or entity 
shall not possess, use, or transfer any VS select agent or toxin 
without a certificate of registration issued by the Administrator. 
Unless exempted under Sec.  121.6 or 42 CFR 73.6, an individual or 
entity shall not possess, use, or transfer any overlap select agent or 
toxin without a certificate of registration issued by the Administrator 
and the HHS Secretary.
    (b) As a condition of registration, each entity must designate an 
individual to be its responsible official. While most registrants are 
likely to be entities, in the event that an individual applies for and 
is granted a certificate of registration, the individual will be 
considered the responsible official.
    (c)(1) As a condition of registration, the following must be 
approved by the Administrator or the HHS Secretary based on a security 
risk assessment by the Attorney General:
    (i) The individual or entity;
    (ii) The responsible official; and
    (iii) Unless otherwise exempted under this section, any individual 
who owns or controls the entity.
    (2) Federal, State, or local governmental agencies, including 
public accredited academic institutions, are exempt from the security 
risk assessments for the entity and the individual who owns or controls 
such entity.
    (3) An individual will be deemed to own or control an entity under 
the following conditions: \5\
---------------------------------------------------------------------------

    \5\ These conditions may apply to more than one individual.
---------------------------------------------------------------------------

    (i) For a private institution of higher education, an individual 
will be deemed to own or control the entity if the individual is in a 
managerial or executive capacity with regard to the entity's select 
agents or toxins or with regard to the individuals with access to the 
select agents or toxins possessed, used, or transferred by the entity.
    (ii) For entities other than institutions of higher education, an 
individual will be deemed to own or control the entity if the 
individual:
    (A) Owns 50 percent or more of the entity, or is a holder or owner 
of 50 percent or more of its voting stock; or
    (B) Is in a managerial or executive capacity with regard to the 
entity's select agents or toxins or with regard to the individuals with 
access to the select agents or toxins possessed, used, or transferred 
by the entity.
    (4) An entity will be considered to be an institution of higher 
education if it is an institution of higher education as defined in 
section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)), 
or is an organization described in 501(c)(3) of the Internal Revenue 
Code of 1986, as amended (26 U.S.C. 501(c)(3)).
    (5) To obtain a security risk assessment, an individual or entity 
must submit the information necessary to conduct a security risk 
assessment to the Attorney General.
    (d) To apply for a certificate of registration for only VS select 
agents or toxins, or for VS and PPQ select agents or toxins, an 
individual or entity must submit the information requested in the 
registration application package (APHIS/CDC Form 1) to APHIS. To apply 
for a certificate of registration for overlap select agents or toxins, 
overlap select agents or toxins and any combination of PPQ or VS select 
agents or toxins, or HHS select agents or toxins and any combination of 
PPQ or VS select agents or toxins, an individual or entity must submit 
the information requested in the registration application package 
(APHIS/CDC Form 1) to APHIS or CDC, but not both.
    (e) Prior to the issuance of a certificate of registration, the 
responsible official must promptly provide notification of any changes 
to the application for registration by submitting the relevant page(s) 
of the registration application.
    (f) The issuance of a certificate of registration may be contingent 
upon inspection or submission of additional information, such as the 
security plan, biosafety plan, incident response plan, or any other 
documents required to be prepared under this part.
    (g) A certificate of registration will be valid for one physical 
location (a room, a building, or a group of buildings) where the 
responsible official will be able to perform the responsibilities 
required in this part, for specific select agents or toxins, and for 
specific activities.
    (h) A certificate of registration may be amended to reflect changes 
in circumstances (e.g., replacement of the responsible official or 
other personnel changes, changes in ownership or control of the entity, 
changes in the activities involving any select agents or toxins, or the 
addition or removal of select agents or toxins).
    (1) Prior to any change, the responsible official must apply for an 
amendment to a certificate of registration by submitting the relevant 
page(s) of the registration application.\6\
---------------------------------------------------------------------------

    \6\ Depending on the change, a security risk assessment by the 
Attorney General may also be required (e.g., replacement of the 
responsible official, changes in ownership or control of the entity, 
new researchers or graduate students, etc.)
---------------------------------------------------------------------------

    (2) The responsible official will be notified in writing if an 
application to amend a certificate of registration has been approved. 
Approval of an amendment may be contingent upon an inspection or 
submission of additional information, such as the security plan, 
biosafety plan, incident response plan, or any other documents required 
to be prepared under this part.
    (3) No change may be made without such approval.
    (i) An entity must immediately notify APHIS or CDC if it loses the 
services of its responsible official. In the event that an entity loses 
the services of its responsible official, an entity may continue to 
possess or use select agents or toxins only if it appoints as the 
responsible official another individual who has been approved by the 
Administrator or the HHS Secretary following a security risk assessment 
by the Attorney General and who meets the requirements of this part.
    (j) A certificate of registration will be terminated upon the 
written request of the entity if the entity no longer possesses or uses 
any select agents or toxins and no longer wishes to be registered.
    (k) A certificate of registration will be valid for a maximum of 3 
years.


Sec.  121.8  Denial, revocation, or suspension of registration.

    (a) An application may be denied or a certificate of registration 
revoked or suspended if:
    (1) The individual or entity, the responsible official, or an 
individual who owns or controls the entity is within any of the 
categories described in 18 U.S.C. 175b;
    (2) The individual or entity, the responsible official, or an 
individual

[[Page 13289]]

who owns or controls the entity is reasonably suspected by any Federal 
law enforcement or intelligence agency of:
    (i) Committing a crime set forth in 18 U.S.C. 2332b(g)(5); or
    (ii) Knowing involvement with an organization that engages in 
domestic or international terrorism (as defined in 18 U.S.C. 2331) or 
with any other organization that engages in intentional crimes of 
violence; or
    (iii) Being an agent of a foreign power as defined in 50 U.S.C. 
1801;
    (3) The individual or entity does not meet the requirements of this 
part; \7\ or
---------------------------------------------------------------------------

    \7\ If registration is denied for this reason, we may provide 
technical assistance and guidance.
---------------------------------------------------------------------------

    (4) It is determined that such action is necessary to protect 
animal health or animal products.
    (b) Upon revocation or suspension of a certificate of registration, 
the individual or entity must:
    (1) Immediately stop all use of each select agent or toxin covered 
by the revocation or suspension order;
    (2) Immediately safeguard and secure each select agent or toxin 
covered by the revocation or suspension order from theft, loss, or 
release; and
    (3) Comply with all disposition instructions issued by the 
Administrator for each select agent or toxin covered by the revocation 
or suspension.
    (c) Denial of an application for registration and revocation of 
registration may be appealed under Sec.  121.20. However, any denial of 
an application for registration or revocation of a certificate of 
registration will remain in effect until a final agency decision has 
been rendered.


Sec.  121.9  Responsible official.

    (a) An individual or entity required to register under this part 
must designate an individual to be the responsible official. The 
responsible official must:
    (1) Be approved by the Administrator or the HHS Secretary following 
a security risk assessment by the Attorney General;
    (2) Be familiar with the requirements of this part;
    (3) Have authority and responsibility to act on behalf of the 
entity;
    (4) Ensure compliance with the requirements of this part; and
    (5) Ensure that annual inspections are conducted for each 
laboratory where select agents or toxins are stored or used in order to 
determine compliance with the requirements of this part. The results of 
each inspection must be documented, and any deficiencies identified 
during an inspection must be corrected.
    (b) An entity may designate one or more individuals to be an 
alternate responsible official, who may act for the responsible 
official in his/her absence. These individuals must have the authority 
and control to ensure compliance with the regulations when acting as 
the responsible official.
    (c) The responsible official must report the identification and 
final disposition of any select agent or toxin contained in a specimen 
presented for diagnosis or verification.
    (1) The identification of any of the following select agents or 
toxins must be immediately reported by telephone, facsimile, or e-mail: 
African horse sickness virus, African swine fever virus, avian 
influenza virus (highly pathogenic), Bacillus anthracis, Botulinum 
neurotoxins, bovine spongiform encephalopathy agent, Brucella 
melitensis, classical swine fever virus, foot-and-mouth disease virus, 
Francisella tularensis, Hendra virus, Newcastle disease virus 
(velogenic), Nipah virus, Rift Valley fever virus, rinderpest virus, 
swine vesicular disease virus, and Venezuelan equine encephalitis 
virus. The final disposition of the agent or toxin must be reported by 
submission of APHIS/CDC Form 4 within 7 calendar days after 
identification. A copy of the completed form must be maintained for 3 
years.
    (2) To report the identification and final disposition of any other 
select agent or toxin, APHIS/CDC Form 4 must be submitted within 7 
calendar days after identification. A copy of the completed form must 
be maintained for 3 years.
    (3) Less stringent reporting may be required during agricultural 
emergencies or outbreaks, or in endemic areas.
    (d) The responsible official must report the identification and 
final disposition of any select agent or toxin contained in a specimen 
presented for proficiency testing. To report the identification and 
final disposition of a select agent or toxin, APHIS/CDC Form 4 must be 
submitted within 90 calendar days of receipt of the agent or toxin. A 
copy of the completed form must be maintained for 3 years.


Sec.  121.10  Restricting access to select agents and toxins; security 
risk assessments.

    (a) An individual or entity required to register under this part 
may not provide an individual access to a select agent or toxin, and an 
individual may not access a select agent or toxin, unless the 
individual is approved by the Administrator or the HHS Secretary 
following a security risk assessment by the Attorney General.
    (b) An individual will be deemed to have access at any point in 
time if the individual has possession of a select agent or toxin (e.g., 
carries, uses, or manipulates) or the ability to gain possession of a 
select agent or toxin.
    (c) Each individual with access to select agents or toxins must 
have the appropriate education, training, and/or experience to handle 
or use such agents or toxins.
    (d) To apply for access approval, each individual must submit the 
information necessary to conduct a security risk assessment to the 
Attorney General.
    (e) An individual's security risk assessment may be expedited upon 
written request by the responsible official and a showing of good cause 
(e.g., public health or agricultural emergencies, national security, or 
a short-term visit by a prominent researcher). A written decision 
granting or denying the request will be issued.
    (f) An individual's access approval for VS select agents or toxins 
may be denied, limited, or revoked if:
    (1) The individual is within any of the categories described in 18 
U.S.C. 175b;
    (2) The individual is reasonably suspected by any Federal law 
enforcement or intelligence agency of committing a crime set forth in 
18 U.S.C. 2332b(g)(5); knowing involvement with an organization that 
engages in domestic or international terrorism (as defined in 18 U.S.C. 
2331) or with any other organization that engages in intentional crimes 
of violence; or being an agent of a foreign power as defined in 50 
U.S.C. 1801; or
    (3) It is determined that such action is necessary to protect 
animal health or animal products.
    (g) For overlap select agents or toxins, an individual's access 
approval will be denied or revoked if the individual is within any of 
the categories described in 18 U.S.C. 175b. An individual's access 
approval may be denied, limited, or revoked for the reasons set forth 
in paragraphs (f)(2) through (f)(3) of this section.
    (h) An individual may appeal the Administrator's decision to deny, 
limit, or revoke access approval under Sec.  121.20.
    (i) Access approval is valid for a maximum of 5 years.
    (j) The responsible official must immediately notify APHIS or CDC 
when an individual's access to select agents or toxins is terminated by 
the entity and the reasons therefore.


Sec.  121.11  Security.

    (a) An individual or entity required to register under this part 
must develop

[[Page 13290]]

and implement a written security plan. The security plan must be 
sufficient to safeguard the select agent or toxin against unauthorized 
access, theft, loss, or release.
    (b) The security plan must be designed according to a site-specific 
risk assessment and must provide graded protection in accordance with 
the risk of the select agent or toxin, given its intended use. The 
security plan must be submitted upon request.
    (c) The security plan must:
    (1) Describe procedures for physical security, inventory control, 
and information systems control;
    (2) Contain provisions for the control of access to select agents 
and toxins;
    (3) Contain provisions for routine cleaning, maintenance, and 
repairs;
    (4) Establish procedures for removing unauthorized or suspicious 
persons;
    (5) Describe procedures for addressing loss or compromise of keys, 
passwords, combinations, etc. and protocols for changing access numbers 
or locks following staff changes;
    (6) Contain procedures for reporting unauthorized or suspicious 
persons or activities, loss or theft of select agents or toxins, 
release of select agents or toxins, or alteration of inventory records; 
and
    (7) Contain provisions for ensuring that all individuals with 
access approval from the Administrator or the HHS Secretary understand 
and comply with the security procedures.
    (d) An individual or entity must adhere to the following security 
requirements or implement measures to achieve an equivalent or greater 
level of security:
    (1) Allow access only to individuals with access approval from the 
Administrator or the HHS Secretary;
    (2) Allow individuals not approved for access by the Administrator 
or the HHS Secretary to conduct routine cleaning, maintenance, repairs, 
and other activities not related to select agents or toxins only when 
continuously escorted by an approved individual;
    (3) Provide for the control of select agents and toxins by 
requiring freezers, refrigerators, cabinets, and other containers where 
select agents or toxins are stored to be secured against unauthorized 
access (e.g., card access system, lock boxes);
    (4) Inspect all suspicious packages before they are brought into or 
removed from an area where select agents or toxins are used or stored;
    (5) Establish a protocol for intra-entity transfers under the 
supervision of an individual with access approval from the 
Administrator or the HHS Secretary, including chain-of-custody 
documents and provisions for safeguarding against theft, loss, or 
release; and
    (6) Require that individuals with access approval from the 
Administrator or the HHS Secretary refrain from sharing with any other 
person their unique means of accessing a select agent or toxin (e.g., 
keycards or passwords);
    (7) Require that individuals with access approval from the 
Administrator or the HHS Secretary immediately report any of the 
following to the responsible official:
    (i) Any loss or compromise of keys, passwords, combinations, etc.;
    (ii) Any suspicious persons or activities;
    (iii) Any loss or theft of select agents or toxins;
    (iv) Any release of a select agent or toxin; and
    (v) Any sign that inventory or use records for select agents or 
toxins have been altered or otherwise compromised; and
    (8) Separate areas where select agents and toxins are stored or 
used from the public areas of the building.
    (e) In developing a security plan, an individual or entity should 
consider the document entitled, ``Laboratory Security and Emergency 
Response Guidance for Laboratories Working with Select Agents,'' in 
Morbidity and Mortality Weekly Report (December 6, 2002); 51 (No. RR-
19):1-6. This document is available on the Internet at http://www.cdc.gov/mmwr.
    (f) The plan must be reviewed annually and revised as necessary. 
Drills or exercises must be conducted at least annually to test and 
evaluate the effectiveness of the plan. The plan must be reviewed and 
revised, as necessary, after any drill or exercise and after any 
incident.


Sec.  121.12  Biosafety.

    (a) An individual or entity required to register under this part 
must develop and implement a written biosafety plan that is 
commensurate with the risk of the select agent or toxin, given its 
intended use.\8\ The biosafety plan must contain sufficient information 
and documentation to describe the biosafety and containment procedures.
---------------------------------------------------------------------------

    \8\ Technical assistance and guidance may be obtained by 
contacting APHIS.
---------------------------------------------------------------------------

    (b) The biosafety and containment procedures must be sufficient to 
contain the select agent or toxin (e.g., physical structure and 
features of the entity, and operational and procedural safeguards).
    (c) In developing a biosafety plan, an individual or entity should 
consider the following:
    (1) The CDC/NIH publication, ``Biosafety in Microbiological and 
Biomedical Laboratories.'' This document may be obtained from the U.S. 
Government Printing Office. It is also available on the Internet at 
http://www.aphis.usda.gov/programs/ag_selectagent/index.html.
    (2) The Occupational Safety and Health Administration (OSHA) 
regulations in 29 CFR 1910.1200 and 1910.1450.
    (3) The ``NIH Guidelines for Research Involving Recombinant DNA 
Molecules.'' This document is available on the Internet at http://www.aphis.usda.gov./programs/ag--selectagent/index.html.
    (d) The plan must be reviewed annually and revised as necessary. 
Drills or exercises must be conducted at least annually to test and 
evaluate the effectiveness of the plan. The plan must be reviewed and 
revised, as necessary, after any drill or exercise and after any 
incident.


Sec.  121.13  Restricted experiments.\9\
---------------------------------------------------------------------------

    \9\ For guidance, see the NIH publication, ``NIH Guidelines for 
Research Involving Recombinant DNA Molecules.'' This document is 
available on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html.
---------------------------------------------------------------------------

    (a) An individual or entity may not conduct a restricted experiment 
with a VS select agent or toxin unless approved by and conducted in 
accordance with any conditions prescribed by the Administrator. In 
addition, an individual or entity may not conduct a restricted 
experiment with an overlap select agent or toxin unless approved by and 
conducted in accordance with any conditions prescribed by the 
Administrator and the HHS Secretary.
    (b) Restricted experiments:
    (1) Experiments utilizing recombinant DNA that involve the 
deliberate transfer of a drug resistance trait to select agents that 
are not known to acquire the trait naturally, if such acquisition could 
compromise the use of the drug to control disease agents in humans, 
veterinary medicine, or agriculture.
    (2) Experiments involving the deliberate formation of recombinant 
DNA containing genes for the biosynthesis of toxins lethal for 
vertebrates at an LD50 <100 ng/kg body weight.
    (c) The Administrator may revoke approval to conduct any of the 
experiments in paragraph (b) of this section, or revoke or suspend a 
certificate of registration, if the individual or entity fails to 
comply with the requirements of this part.
    (d) To apply for approval to conduct any of the experiments in 
paragraph (b) of this section, an individual or entity must submit a 
written request and

[[Page 13291]]

supporting scientific information. A written decision granting or 
denying the request will be issued.


Sec.  121.14  Incident response.\10\
---------------------------------------------------------------------------

    \10\ Nothing in this section is meant to supersede or preempt 
incident response requirements imposed by other statutes or 
regulations.
---------------------------------------------------------------------------

    (a) An individual or entity required to register under this part 
must develop and implement a written incident response plan.\11\ The 
incident response plan must be coordinated with any entity-wide plans, 
kept in the workplace, and available to employees for review.
---------------------------------------------------------------------------

    \11\ Technical assistance and guidance may be obtained by 
contacting APHIS.
---------------------------------------------------------------------------

    (b) The incident response plan must fully describe the entity's 
response procedures for the theft, loss, or release of a select agent 
or toxin; inventory discrepancies; security breaches (including 
information systems); severe weather and other natural disasters; 
workplace violence; bomb threats and suspicious packages; and 
emergencies such as fire, gas leak, explosion, power outage, etc. The 
response procedures must account for hazards associated with the select 
agent or toxin and appropriate actions to contain such agent or toxin.
    (c) The incident response plan must also contain the following 
information:
    (1) The name and contact information (e.g., home and work) for the 
individual or entity (e.g., responsible official, alternate responsible 
official(s), biosafety officer, etc.);
    (2) The name and contact information for the building owner and/or 
manager, where applicable;
    (3) The name and contact information for tenant offices, where 
applicable;
    (4) The name and contact information for the physical security 
official for the building, where applicable;
    (5) Personnel roles and lines of authority and communication;
    (6) Planning and coordination with local emergency responders;
    (7) Procedures to be followed by employees performing rescue or 
medical duties;
    (8) Emergency medical treatment and first aid;
    (9) A list of personal protective and emergency equipment, and 
their locations;
    (10) Site security and control;
    (11) Procedures for emergency evacuation, including type of 
evacuation, exit route assignments, safe distances, and places of 
refuge; and
    (12) Decontamination procedures.
    (d) The plan must be reviewed annually and revised as necessary. 
Drills or exercises must be conducted at least annually to test and 
evaluate the effectiveness of the plan. The plan must be reviewed and 
revised, as necessary, after any drill or exercise and after any 
incident.


Sec.  121.15  Training.

    (a) An individual or entity required to register under this part 
must provide information and training on biosafety and security to each 
individual with access approval from the Administrator or the HHS 
Secretary before he/she has such access. In addition, an individual or 
entity must provide information and training on biosafety and security 
to each individual not approved for access by the Administrator or the 
HHS Secretary before he/she works in or visits areas where select 
agents or toxins are handled or stored (e.g., laboratories, growth 
chambers, animal rooms, greenhouses, storage areas, etc.). The training 
must address the particular needs of the individual, the work they will 
do, and the risks posed by the select agents or toxins.\12\
---------------------------------------------------------------------------

    \12\ For guidance, see the CDC/NIH publication, ``Biosafety in 
Microbiological and Biomedical Laboratories.'' This document is 
available on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html.
---------------------------------------------------------------------------

    (b) Refresher training must be provided annually.
    (c) A record of the training provided to each individual must be 
maintained. The record must include the name of the individual, the 
date of training, a description of the training provided, and the means 
used to verify that the employee understood the training.


Sec.  121.16  Transfers.

    (a) Except as provided in paragraphs (c) and (d) of this section, a 
select agent or toxin may only be transferred to individuals or 
entities registered to possess, use, or transfer that agent or toxin. A 
select agent or toxin may only be transferred under the conditions of 
this section and must be authorized by APHIS or CDC prior to the 
transfer.\13\
---------------------------------------------------------------------------

    \13\ The requirements of this section do not apply to transfers 
within a registered entity (i.e., the sender and the recipient are 
covered by the same certificate of registration).
---------------------------------------------------------------------------

    (b) In addition to any permit required under part 122 of this 
subchapter, a transfer may be authorized if:
    (1) The sender:
    (i) Has at the time of transfer a certificate of registration that 
covers the particular select agent or toxin to be transferred and meets 
all the requirements of this part;
    (ii) Meets the exemption requirements for the particular select 
agent or toxin to be transferred; or
    (iii) Is transferring the select agent or toxin from outside of the 
United States and meets all import requirements.
    (2) At the time of transfer, the recipient has a certificate of 
registration that includes the particular select agent or toxin to be 
transferred and meets all of the requirements of this part.
    (c) A select agent or toxin that is contained in a specimen for 
proficiency testing may be transferred without prior authorization from 
APHIS or CDC provided that, at least 7 calendar days prior to the 
transfer, the sender reports to APHIS or CDC the select agent or toxin 
to be transferred and the name and address of the recipient.
    (d) On a case-by-case basis, the Administrator may authorize a 
transfer of a select agent or toxin not otherwise eligible for transfer 
under this part under conditions prescribed by the Administrator.
    (e) To obtain authorization for a transfer, APHIS/CDC Form 2 must 
be submitted.
    (f) The recipient must submit a completed APHIS/CDC Form 2 within 2 
business days of receipt of a select agent or toxin.
    (g) The recipient must immediately notify APHIS or CDC if the 
select agent or toxin has not been received within 48 hours after the 
expected delivery time or if the package containing the select agent or 
toxin has been damaged to the extent that a release of the select agent 
or toxin may have occurred.
    (h) An authorization for a transfer shall be valid only for 30 
calendar days after issuance, except that such an authorization becomes 
immediately null and void if any facts supporting the authorization 
change (e.g., change in the certificate of registration for the sender 
or recipient, change in the application for transfer).
    (i) The sender must comply with all applicable laws governing 
packaging and shipping.


Sec.  121.17  Records.

    (a) An individual or entity required to register under this part 
must maintain complete records relating to the activities covered by 
this part. Such records must include:
    (1) An accurate, current inventory for each select agent (including 
viral genetic elements, recombinant nucleic acids, and recombinant 
organisms) held in long-term storage (placement in a system designed to 
ensure viability for future use, such as in a freezer or lyophilized 
materials), including:
    (i) The name and characteristics (e.g., strain designation, GenBank 
Accession number, etc.);

[[Page 13292]]

    (ii) The quantity acquired from another individual or entity (e.g., 
containers, vials, tubes, etc.), date of acquisition, and the source;
    (iii) Where stored (e.g., building, room, and freezer);
    (iv) When moved from storage and by whom and when returned to 
storage and by whom;
    (v) The select agent used and purpose of use;
    (vi) Records created under Sec.  121.16 or 42 CFR 73.16 
(Transfers);
    (vii) For intra-entity transfers (sender and the recipient are 
covered by the same certificate of registration), the select agent, the 
quantity transferred, the date of transfer, the sender, and the 
recipient; and
    (viii) Records created under Sec.  121.19 or 42 CFR 73.19 
(Notification of theft, loss, or release);
    (2) An accurate, current inventory for each toxin held, including:
    (i) The name and characteristics;
    (ii) The quantity acquired from another individual or entity (e.g., 
containers, vials, tubes, etc.), date of acquisition, and the source;
    (iii) The initial and current quantity amount (e.g., milligrams, 
milliliters, grams, etc.);
    (iv) The toxin used and purpose of use, quantity, date(s) of the 
use and by whom;
    (v) Where stored (e.g., building, room, and freezer);
    (vi) When moved from storage and by whom and when returned to 
storage and by whom, including quantity amount;
    (vii) Records created under Sec.  121.16 or 42 CFR 73.16 
(Transfers);
    (viii) For intra-entity transfers (sender and the recipient are 
covered by the same certificate of registration), the toxin, the 
quantity transferred, the date of transfer, the sender, and the 
recipient;
    (ix) Records created under Sec.  121.19 or 42 CFR 73.19 
(Notification of theft, loss, or release);
    (x) If destroyed, the quantity of toxin destroyed, the date of such 
action, and by whom.
    (3) A current list of all individuals that have been granted access 
approval by the Administrator or the HHS Secretary;
    (4) Information about all entries into areas containing select 
agents or toxins, including the name of the individual, name of the 
escort (if applicable), and the date and time of entry;
    (5) Accurate, current records created under Sec.  121.9 or 42 CFR 
73.9 (Responsible official), Sec.  121.11 or 42 CFR 73.11 (Security), 
Sec.  121.12 or 42 CFR 73.12 (Biosafety), Sec.  121.14 or 42 CFR 73.14 
(Incident response), and Sec.  121.15 or 42 CFR 73.15 (Training); and
    (6) A written explanation of any discrepancies.
    (b) The individual or entity must implement a system to ensure that 
all records and databases created under this part are accurate, have 
controlled access, and that their authenticity may be verified.
    (c) All records created under this part must be maintained for 3 
years and promptly produced upon request.


Sec.  121.18  Inspections.

    (a) Without prior notification, APHIS must be allowed to inspect 
any site at which activities regulated under this part are conducted 
and must be allowed to inspect and copy any records relating to the 
activities covered by this part.
    (b) Prior to issuing a certificate of registration to an individual 
or entity, APHIS may inspect and evaluate the premises and records to 
ensure compliance with this part.


Sec.  121.19  Notification of theft, loss, or release.

    (a) An individual or entity must immediately notify APHIS or CDC 
upon discovery of the theft or loss of a select agent or toxin. Thefts 
or losses must be reported even if the select agent or toxin is 
subsequently recovered or the responsible parties are identified.
    (1) The theft or loss of a select agent or toxin must be reported 
by telephone, facsimile, or e-mail. The following information must be 
provided:
    (i) The name of the select agent or toxin and any identifying 
information (e.g., strain or other characterization information);
    (ii) An estimate of the quantity stolen or lost;
    (iii) An estimate of the time during which the theft or loss 
occurred;
    (iv) The location (building, room) from which the theft or loss 
occurred; and
    (v) The list of Federal, State, or local law enforcement agencies 
to which the individual or entity reported, or intends to report, the 
theft or loss.
    (2) A completed APHIS/CDC Form 3 must be submitted within 7 
calendar days.
    (b) An individual or entity must immediately notify APHIS or CDC 
upon discovery of a release of a select agent or toxin causing 
occupational exposure or a release of a select agent or toxin outside 
of the primary barriers of the biocontainment area.
    (1) The release of a select agent or toxin must be reported by 
telephone, facsimile, or e-mail. The following information must be 
provided:
    (i) The name of the select agent or toxin and any identifying 
information (e.g., strain or other characterization information);
    (ii) An estimate of the quantity released;
    (iii) The time and duration of the release;
    (iv) The environment into which the release occurred (e.g., in 
building or outside of building, waste system);
    (v) The location (building, room) from which the release occurred; 
and
    (vi) The number of individuals potentially exposed at the entity;
    (vii) Actions taken to respond to the release; and
    (viii) Hazards posed by the release.
    (2) A completed APHIS/CDC Form 3 must be submitted within 7 
calendar days.


Sec.  121.20  Administrative review.

    An individual or entity may appeal a denial, revocation, or 
suspension of registration under this part. An individual may appeal a 
denial, limitation, or revocation of access approval under this 
part.\14\ The appeal must be in writing, state the factual basis for 
the appeal, and be submitted to the Administrator within 30 calendar 
days of the decision. Where the denial, revocation, or suspension of 
registration or the denial, limitation, or revocation of an 
individual's access approval is based upon an identification by the 
Attorney General, the request for review will be forwarded to the 
Attorney General. The Administrator's decision constitutes final agency 
action.
---------------------------------------------------------------------------

    \14\ An entity may not appeal the denial or limitation of an 
individual's access to select agents or toxins.

    Done in Washington, DC, this 10th day of March, 2005.
Bill Hawks,
Under Secretary for Marketing and Regulatory Programs.
[FR Doc. 05-5063 Filed 3-17-05; 8:45 am]
BILLING CODE 3410-34-P