[Federal Register Volume 70, Number 52 (Friday, March 18, 2005)]
[Rules and Regulations]
[Pages 13294-13325]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 05-5216]



[[Page 13293]]

-----------------------------------------------------------------------

Part III





Department of Health and Human Services





-----------------------------------------------------------------------



42 CFR Parts 72 and 73



-----------------------------------------------------------------------



Office of Inspector General

42 CFR Part 1003



Possession, Use, and Transfer of Select Agents and Toxins; Final Rule

  Federal Register / Vol. 70, No. 52 / Friday, March 18, 2005 / Rules 
and Regulations  

[[Page 13294]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

42 CFR Parts 72 and 73

Office of Inspector General

42 CFR Part 1003

RIN 0920-AA09


Possession, Use, and Transfer of Select Agents and Toxins

AGENCY: Centers for Disease Control and Prevention, Office of Inspector 
General, Department of Health Human Services (HHS).

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This document establishes a final rule regarding possession, 
use, and transfer of select agents and toxins. The final rule 
implements provisions of the Public Health Security and Bioterrorism 
Preparedness and Response Act of 2002 and is designed to protect public 
health and safety.
    In a companion document published in this issue of the Federal 
Register, the United States Department of Agriculture has established 
corresponding final rules designed to protect animal and plant health 
and animal and plant products.

DATES: The final rule is effective April 18, 2005.

FOR FURTHER INFORMATION CONTACT: Mark Hemphill, Chief of Policy, Select 
Agent Program, Centers For Disease Control and Prevention, 1600 Clifton 
Rd., MS E-79, Atlanta, GA 30333. Telephone: (404) 498-2255.

SUPPLEMENTARY INFORMATION: This document establishes a final rule 
regarding possession, use, and transfer of select agents and toxins. 
The final rule is based on the interim final rule, as amended (amended 
interim final rule). The initial interim final rule was published in 
the Federal Register on December 13, 2002 (67 FR 76886). It was amended 
by a second interim final rule published in the Federal Register on 
November 3, 2003 (68 FR 62245). The initial interim final rule 
established a comprehensive set of regulations that included 
requirements concerning registration and security risk assessments. The 
second interim final rule amended the first interim final rule by 
allowing for the issuance of provisional certificates of registration 
and provisional grants of access to select agents and toxins, subject 
to completion of security risk assessments, and compliance with all of 
the requirements of the initial interim final rule. The final rule, 
which is set forth at 42 FR part 73, implements provisions of the 
Public Health Security and Bioterrorism Preparedness and Response Act 
of 2002 (the Act) and is designed to protect public health and safety.
    In general, this final rule contains provisions that apply to 
academic institutions and biomedical centers; commercial manufacturing 
facilities; federal, state, and local laboratories, including clinical 
and diagnostic laboratories; and research facilities.
    For the initial interim final rule, we provided for a 60-day 
comment period for written comments that ended February 11, 2003. We 
also held a public meeting on December 16, 2002. Relevant issues raised 
by the comments (oral comments made at the public meeting and 110 
written comments) are discussed below. For the second interim final 
rule, we provided for a 60-day comment period for written comments that 
ended January 2, 2004. We received no comments in response to the 
second interim final rule. Based on the rationale set forth in the 
initial interim final rule, the second interim final rule, and this 
document, we are affirming the provisions of the amended interim final 
rule as a final rule with changes discussed below.
    The final rule is designed to implement authorities under the Act 
to protect public health and safety. The United States Department of 
Agriculture (USDA) has established corresponding sets of regulations 
designed to protect animal and plant health and animal and plant 
products (9 CFR part 121 and 7 CFR part 331).

42 CFR Part 1003

    The initial interim final rule amended 42 CFR part 1003 to 
establish delegations of authority and other provisions involving the 
Office of Inspector General (OIG) of HHS. In addition to adding a new 
paragraph (b)(16) to Sec.  1003.102 to authorize the imposition of 
civil money penalties for violations of the regulatory provisions, the 
interim final rule also sought public comments on the possible 
inclusion of specific factors that might be used to assess specific 
penalty amounts. The amended interim final rule had no effect on the 
OIG amendments and we received no comments regarding these amendments. 
However, since amendatory language to the OIG regulations addressing 
determinations regarding the amount of a penalty was not originally 
included in the initial interim final rule, we are now revising Sec.  
1003.106(a)(1) to reference the newly codified Sec.  1003.102(b)(16) 
and the factors to be taken into account when the OIG assesses civil 
money penalties. We are affirming all other amendments set forth in the 
interim final rule.

42 CFR 72.6 and Its Accompanying Appendix A

    The provisions of the final rule supersede all of the provisions at 
42 CFR 72.6 (captioned ``Additional requirements for facilities 
transferring or receiving select agents'') and its accompanying 
Appendix A. However, the provisions of 18 U.S.C. 175b include 
prohibitions that are based on the list of select agents in Appendix A 
of 42 CFR part 72 and exemptions to such list in Sec.  72.6(h). 
Accordingly, we have deleted the superseded provisions and in their 
place have added language to indicate that for purposes of 18 U.S.C. 
175b the list of select agents are set forth in Sec. Sec.  73.3 and 
73.4 and the exemptions are set forth in Sec. Sec.  73.5 and 73.6.

Changes in Structure in Part 73

    With respect to the sections in part 73, we changed the final rule 
to make the structure and format of the HHS regulations and the USDA 
regulations at 9 CFR part 121 more similar. The following chart shows 
the changes.

------------------------------------------------------------------------
       Amended interim final rule                   Final rule
------------------------------------------------------------------------
73.1 Definitions.......................  73.1 Definitions.
73.2 Purpose and scope.................  73.2 Purpose and scope.
73.3 General prohibition...............  73.3 HHS select agents and
                                          toxins.
73.4 HHS select agents and toxins......  73.4 Overlap select agents and
                                          toxins.
73.5 Overlap select agents and toxins..  73.5 Exemptions for HHS select
                                          agents and toxins.
73.6 Exemptions from requirements under  73.6 Exemptions for overlap
 this part.                               select agents and toxins.
73.71 Registration.....................  73.7 Registration and related
                                          security risk assessments.
73.8 Security Risk Assessments.........  73.8 Denial, revocation, or
                                          suspension of registration.
73.9 Responsible Official..............  73.9 Responsible Official.

[[Page 13295]]

 
73.10 Safety...........................  73.10 Restricting access to
                                          select agents and toxins;
                                          security risk assessments.
73.11 Security.........................  73.11 Security.
73.12 Emergency response...............  73.12 Biosafety.
73.13 Training.........................  73.13 Restricted experiments.
73.14 Transfers........................  73.14 Incident response.
73.15 Records..........................  73.15 Training.
73.16 Inspections......................  73.16 Transfers.
73.17 Notification for theft, loss, or   73.17 Records.
 release.
73.18 Administrative review............  73.18 Inspections.
73.19 Civil money penalties............  73.19 Notification of theft,
                                          loss, or release.
73.20 Criminal penalties...............  73.20 Administrative review.
73.21 Submissions and forms............  73.21 Civil money penalties.
------------------------------------------------------------------------

Section 73.0 Applicability and Related Requirements

    Under the provisions of Sec.  73.0 of the initial interim final 
rule, a number of the provisions became applicable on February 7, 2003, 
while other provisions became applicable at subsequent scheduled times 
on or before November 12, 2003. A number of commenters requested that 
different applicability dates be established, but no commenters 
requested that applicability dates be later than November 12, 2003. As 
noted above, the interim final rule was amended allowing, subject to 
completion of security risk assessments and compliance with all other 
requirements set forth in the initial interim final rule, for the 
issuance of provisional certificates of registration and provisional 
grants of access to select agents and toxins. These security risk 
assessments have been completed.
    Accordingly, we are removing all of the provisions of Sec.  73.0. 
They have served their purpose by implementing the statutorily mandated 
principles of protecting public health and safety while minimizing 
disruption or termination of research or educational projects.
``Access'' and ``Area''
    Commenters argued that the terms ``area'' and ``access'' are 
unclear. In response, we have eliminated references to area and used it 
in the regulations only when we believe it is clear in context. Also, 
consistent with many suggestions by commenters, we have provided 
language in Sec.  73.10(b) to clarify that ``An individual will be 
deemed to have access at any point in time if the individual has 
possession of a select agent or toxin (e.g., ability to carry, use, or 
manipulate) or the ability to gain possession of a select agent or 
toxin.'' In addition, we clarified the language that an individual with 
``access approval from the HHS Secretary or Administrator'' is an 
individual who has been granted access to select agents or toxins from 
the HHS Secretary or Administrator following a security risk 
assessment.

Section 73.1 Definitions

    We added definitions of ``Administrator'', ``Animal and Plant 
Health Inspection Service (APHIS)'', ``Attorney General'', 
``Responsible Official'' and ``State'', made corrections to the 
definitions of ``HHS Secretary'', ``Proficiency testing'', and ``United 
States'', and deleted the definition of ``USDA Secretary.'' Also, we 
changed the definitions of ``diagnosis'' and ``verification'' to more 
fully reflect their common meanings in the regulated community. 
Moreover, we added a definition of ``specimen'' to reflect its common 
meaning in the regulated community. All terms not defined in this 
section shall have the meaning that is commonly understood in the 
scientific community based on the context in which those terms appear 
in this part.
Entity
    One commenter stated the definition of ``entity'' does not include 
``person'' or ``individual.'' To prevent legal confusion and arguments, 
the commenter recommended that in ``Sec.  73.1--Definitions the term 
`entity' be redefined to include a `person' and/or an `individual' and 
that the same defined term(s) be used in all section''. We made no 
changes in the definition section based on this comment. However, for 
clarification purposes, we have added ``individual or entity'' language 
throughout the document.
    Another commenter claimed that the term ``entity'' is subject to 
interpretation. The commenter stated that it does not make sense for a 
large multi-campus university to base cumulative limits on toxins or 
the designation of the Responsible Official on the entity when the 
actual labs are separated by hundreds of miles. We made no changes in 
the definition section based on this comment. The issue is addressed 
below in the registration section.
Responsible Official
    Commenters recommended that CDC add the APHIS definition for 
Responsible Official, which reads, ``The individual designated by an 
entity to act on its behalf. This individual must have the authority 
and control to ensure compliance with the regulations in this Part.'' 
We agreed with the commenters that CDC and APHIS adopt a common 
definition for the term ``Responsible Official.'' Accordingly, we are 
adding the definition for ``Responsible Official''.

Section 73.2 Purpose and Scope and Sec.  73.3 General Prohibition

    We received no comments concerning Sec. Sec.  73.2 and 73.3. Since 
the language in Sec.  73.3 is consistently addressed throughout the 
document, we deleted this section.

Section 73.3 HHS Select Agents and Toxins and Sec.  73.4 Overlap Select 
Agents and Toxins

    Some of the select agents and toxins regulated by HHS under part 73 
are also regulated by USDA under 9 CFR part 121. The select agents and 
toxins subject to regulation by both agencies are identified as 
``overlap select agents and toxins'' and those regulated solely by HHS 
are identified as ``HHS select agents and toxins.''
General
    Commenters recommended that the final rule include an appendix that 
would provide a summary of the risk assessment data that supports the 
listing of each select agent and toxin. Commenters argued that ``These 
data will heighten the awareness of individuals who possess and use a 
listed agent to the most important risk characteristics of the listed 
agents' and ``This knowledge will promote safe practices and 
proficiency in the handling of a listed agent.''

[[Page 13296]]

    Commenters also argued that this will help affected entities make 
assessments for the future. CDC did not include risk assessment data in 
the regulations but did provide such information in the rule's 
preamble. We do not believe it is necessary to provide a summary of the 
risk assessment data that supports the listing of each select agent or 
toxin in order to heighten awareness of the risk characteristics of 
such agents and toxins and promote safe practice and proficiency in 
handling of such agents and toxins. Information about the risk 
characteristics of a select agent or toxin and safe handling practices 
is available in scientific literature and other publications (e.g., the 
CDC/NIH publication, ``Biosafety in Microbiological and Biomedical 
Laboratories''). As noted in the preamble of the August 2002 interim 
rule, the Act requires the HHS Secretary to consider the following 
criteria in determining whether to list an agent or toxin: (1) The 
effect on human health of exposure to the agent or toxin; (2) the 
degree of contagiousness of the agent or toxin and the methods by which 
the agent or toxin is transferred to humans; (3) the availability and 
effectiveness of pharmacotherapies and immunizations to treat and 
prevent any illness resulting from infection by the agent or toxin; and 
(4) any other criteria, including the needs of children and other 
vulnerable populations, that the Secretary considers appropriate. The 
Secretary directed the CDC to convene an inter-agency working group to 
determine which biological agents and toxins required regulation based 
on the criteria noted above. In June 2002, CDC convened an interagency 
working group to review the current list of select agents and toxins 
and develop recommendations for a select agent list. Members of the 
working group included representatives from the Department of Health 
and Human Services/Office of the Secretary (DHHS/OS), the Centers for 
Disease Control and Prevention (CDC), the National Institutes of Health 
(NIH), the Food and Drug Administration (FDA), the Department of the 
Army (DoD/Army), the Department of the Navy (DoD/Navy), the Department 
of the Air Force (DoD/AF), the U.S. Department of Agriculture (USDA), 
the Environmental Protection Agency (EPA), the Agency for Toxic 
Substances and Disease Registry (ATSDR), the Department of Labor/
Occupational Safety and Health Administration (OSHA), the National 
Institute of Occupational Safety and Health (CDC/NIOSH), the Department 
of Transportation (DoT), the Department of Commerce (DoC), the 
Department of Energy (DoE), the Department of Justice (DoJ), the 
Federal Bureau of Investigation (FBI), the Central Intelligence Agency 
(CIA), the Defense Intelligence Agency (DoD/DIA), and the U.S. Postal 
Service (USPS). For these reasons, we are making no change based on 
this comment.
Prion Agents
    One commenter asserted that the Creutzfeldt-Jacob Disease and Kuru 
agents should be added to the list of HHS select agents and toxins. The 
commenter noted that the ``Arguments for omission include the 
difficulty of obtaining these agents, the extreme difficulty of 
replicating them, low infectivity by the oral route, and the absence of 
person-to-person infectivity.'' The commenter then argued that they 
should be included based on the conclusions ``that a single real or 
claimed incident of contaminating a childhood vaccine with a prion 
would cause indescribable anguish'' and that ``The difficulty of 
confirming or refuting a claim that prions had been added to a vaccine 
would cripple most legitimate public health programs and result in 
epidemics of preventable diseases.'' The commenter concluded by stating 
that ``In my judgment, the remote but extreme risk fully justifies the 
cost of including prions that are infectious to humans.'' We made no 
changes based on this comment. Based upon the criteria that the HHS 
Secretary must consider, it was the consensus of the Secretary's Select 
Agent and Toxin Working Group that Creutzfeldt-Jacob Disease (CJD) and 
Kuru agents should not be added to the list because the degree of 
contagiousness of prions are too low to pose a significant mass 
casualty threat. While they are infectious under some circumstances, 
such as cannibalism in New Guinea causing Kuru or Creutzfeldt-Jacob 
Disease by the consumption of infected bovine central nervous system 
tissue, there is no evidence of contact or aerosol transmission of 
prions from one human to another.
Viruses
    The amended interim final rule included Cercopithecine herpesvirus 
1 (Herpes B virus) on the list of viruses designated as HHS select 
agents and toxins. Commenters acknowledged that the virus naturally 
infects many species of macaques and can produce a serious, often 
fatal, infection in humans when not treated. Commenters argued that 
Herpes B virus should not be included as a select agent based on the 
following assertions:
     ``The inclusion of the virus on the list will produce no 
significant improvements in safety for the American public.
     Human infections are extremely rare--this is evidenced by 
the finding that of the literally hundreds of thousands of people who 
have worked with macaques over the past seventy years, there have been 
at most 50 human cases establishing infections with 23 documented 
deaths (one commenter argued that the low number of human cases may 
reflect infrequent shedding in macaque hosts or difficulty in the 
transmission of the agent to humans).
     The virus is capable of being treated with several 
available antiviral compounds.
     The inclusion of the virus on the list will significantly 
complicate transport for biomedical and biodefense research of macaques 
that are healthy, but chronically infected with B virus.
     The virus does not present a sufficient risk of infection 
by the aerosol route.
     The virus is a highly unlikely candidate for a 
bioterrorism agent.''
    Commenters further stated that if the intent of inclusion is to 
monitor laboratories that cultivate large volumes of the virus in vitro 
then the rule should only cover this aspect.
    We made no changes based on these comments. We have concluded that 
Cercopithecine herpesvirus 1 (Herpes B virus) has high morbidity, can 
be replicated in large concentrations, and can cause infections via the 
aerosol route. The regulations exclude ``any select agent or toxin that 
is in its naturally occurring environment provided that it has not been 
intentionally introduced, cultivated, collected, or otherwise extracted 
from its natural source.'' This would include species of macaques that 
have been naturally infected with Cercopithecine herpesvirus 1 (Herpes 
B virus) as long as the virus has not been intentionally introduced, 
cultivated, collected, or otherwise extracted from its natural source.
    The amended interim final rule included Eastern Equine Encephalitis 
virus on the list of viruses designated as overlap select agents and 
toxins. One commenter asserted that the South/Central American subtypes 
of the virus should be deleted from the list. This was based on the 
finding that ``The Naval Medical Research Center Detachment (Lima, 
Peru) has studied over 6,600 cases of febrile illness in Iquitos [sic] 
and surrounding areas since 1994, but has never detected a single case 
of human EEE despite repeated isolations of the virus (two of the three

[[Page 13297]]

South American subtypes) from mosquitoes in the same locations (Douglas 
Watts, UTMB, unpublished).'' The commenters concluded that ``therefore, 
the South/Central American subtypes are probably completely avirulent 
for people and not a bioterrorism risk.'' We made no changes based on 
this comment. There are no published data supporting the commenters' 
assertion. Further, a literature search indicated that there are 
examples of South American EEE strains that are lethal in humans and 
studies of animal models have produced conflicting results.
Fungi
    The list of select agents includes Coccidioides posadasii and 
Coccidioides immitis. One commenter questioned whether either of these 
should be included on the list of select agents and toxins. We made no 
changes based on this comment. These agents cause high morbidity in 
humans, are highly infectious via the aerosol route, and sporulate 
easily in culture. Also, there is no vaccine available.
Toxins
    One commenter recommended that Mistletoe lectin I, Modeccin, and 
Volkensin be reviewed for inclusion in the list of select agents and 
toxins. The commenter argued that ``These toxins are toxicologically 
similar (LD50 and medical affect) to Ricin and Abrin [both are included 
as select toxins] and are readily available since they freely grow 
without cultivation.'' We made no changes based on this comment. Like 
ricin, these toxins have only moderate toxicity compared to other 
toxins on the list. However, unlike ricin, these toxins are not readily 
available in partially purified forms in sufficient quantities to pose 
a significant public health threat.
    The amended interim final rule included Diacetoxyscirpenol and T-2 
toxin on the list of select agents and toxins. One commenter asserted 
that it is pointless to include them on the list because they can 
easily be produced using readily available materials. The amended 
interim final rule also included conotoxins, saxitoxin, and 
tetrodotoxin on the list of select agents and toxins. One commenter 
asserted that the list of select agents should not include ``chemically 
fragile, small molecule/peptide neurotoxins (tetrodotoxin, saxitoxin, 
end u-conotoxin [sic]), that exhibit limited stability at room 
temperature.'' The commenter argued that ``conotoxins and agatoxins 
are, for example, very rapidly degraded in water because they are 
triple-disulfide bonded polypeptides that require reducing agents (beta 
mercaptoethanol or dithicthreitol [sic] on the bench, glutethione [sic] 
in the organism) to retain their proper folded, disulfide-bonded 
structure.'' The commenter further argued that ``The disulfide bonds 
are very readily oxidized and the oxidized toxin molecules have no 
toxic activity whatsoever'' and that ``Indeed, one of our headaches 
with these toxins is that shipments are sometimes useless because the 
toxin has become oxidized.'' We made no changes based on these 
comments. These toxins pose a significant public health threat because 
they have acute toxicity, could be produced in large quantities, and 
can be transferred by an aerosol method. We agreed with the commenter 
that once those toxins have been degraded, oxidized, or in any other 
form in which the toxic has become nonfunctional, they would be 
excluded from regulation under this part.
    The amended interim final rule included Staphylococcal enterotoxins 
on the list of select agents and toxins. One commenter asserted that it 
should be removed from the list based on the conclusion that even 
though ``Staph. food intoxication can make you wish you were dead for 
24 to 48 hours'' the ``general public death rate is only 0.03% and for 
the very young and very old it is 4.4%.'' We made no changes based on 
this comment. These toxins pose a significant public health threat 
because they have acute toxicity, could be produced in large 
quantities, and can be transferred by an aerosol method.
    The amended interim final rule included Botulinum neurotoxins on 
the list of select agents and toxins. However, under the amended 
interim final rule, botulinum neurotoxins are not regulated if the 
aggregate amount under the control of a principal investigator does 
not, at any time, exceed 0.5 mg. One commenter asserted that there 
should be no exemption for botulinum neurotoxins. The commenter argued 
that ``based on primate studies, the human lethal amount of botulinum 
toxin by intravenous exposure is 0.10 microgram, by aerosol exposure 
(inhalation) is 0.75 microgram, and by oral exposure (ingestion) is 
75.0 micrograms'' and concluded that ``the proposed 500 microgram 
amount of unregistered and unregulated botulinum toxin represents, 
respectively, 5000 intravenous lethal doses, 667 inhalational lethal 
doses, and 6.7 oral lethal doses.'' The commenter further asserted that 
Botulism Research Coordinating Committee and National Institute of 
Allergy and Infectious Disease's Blue Ribbon Technical Advisory Panel 
on Botulinum Toxin concluded without dissent that an exclusion should 
not be in effect. The commenter also argued ``increased funding for 
biodefense work may attract newcomers to the field, who lack previous 
experience in working with botulinum toxin and therefore are at greater 
risk of laboratory accident'' and that it might be possible for a 
``front laboratory or institution to order just under 500 micrograms of 
botulinum toxin from each of the several commercial vendors 
simultaneously and accumulate a cache of toxin that a terrorist might 
access.'' We made no changes based on this comment. This final rule 
represents a legislative mandate to balance the regulatory oversight of 
agents and toxins that have the potential to pose a severe threat to 
public health and safety while maintaining availability of these agents 
and toxins for research and educational activities. The amount of each 
toxin that could be possessed without regulation by a principal 
investigator, a treating physician or veterinarian, or a commercial 
manufacture or distributor was determined on the basis of toxin potency 
and how much one could safely possess without constituting a potential 
threat to public safety or raising concerns about use as a weapon that 
would have a widespread effect. The level specified in the rule was 
determined after consultation with subject matter experts on this 
toxin. The determination that a toxin posed a severe public health 
threat was based on the ability for the mass distribution of the toxin 
for mass casualty purposes.
    To address the commenter's concerns, the lethal amounts cited 
represent theoretical amounts extrapolated from primate studies based 
upon optimal conditions. The value of ``5,000 intravenous lethal 
doses'' requires a mode of delivery that is impractical for inflicting 
mass casualties. The value of ``667 aerosol lethal doses'' assumes 100% 
dissemination efficiency for a protein aerosol which is highly unlikely 
and does not take into consideration that botulinum neurotoxin is not 
very stable under ambient conditions. The public comment estimates that 
there are less than 7 oral human lethal doses in 0.5 mg of botulinum 
neurotoxin. However, the excluded amount of botulinum neurotoxin would 
have to be optimally disseminated to cause the estimated number of 
fatalities.
    As noted above, with certain exceptions, the amended interim final 
rule included Botulinum neurotoxins on the list of select agents and 
toxins. One commenter questioned whether there are Botulinum toxins 
that are not

[[Page 13298]]

neurotoxins and asserted that if the answer is yes the name should be 
changed to ``Botulinum toxins'' and if the answer is no the name should 
be changed to ``Botulinum neurotoxins only.'' We made no changes based 
on this comment. We are regulating the neurotoxins and the organism 
that produces the neurotoxin.
    The amended interim final rule states that the list of HHS select 
toxins subject to regulation ``does not include the following toxins 
(in the purified form or in combinations of pure and impure forms) if 
the aggregate amount under the control of a principal investigator does 
not, at any time, exceed the amount specified: 100 mg of abrin; 100 mg 
of conotoxins; 1,000 mg of diacetoxyscirpenol; 100 mg of ricin; 100 mg 
of saxitoxin; 100 mg of shiga-like ribosome inactivating proteins; or 
100 mg of tetrodotoxin.'' The amended interim final rule states that 
the list of overlap select toxins subject to regulation ``does not 
include the following toxins (in the purified form or in combinations 
of pure and impure forms) if the aggregate amount under the control of 
a principal investigator does not, at any time, exceed the amount 
specified: 0.5 mg of botulinum neurotoxins; 5 mg of Staphylococcal 
enterotoxins; 100 mg of Clostridium perfringens epsilon toxin; 100 mg 
of shigatoxin; or 1,000 mg of T-2 toxin.''
    One commenter asserted that the regulations should not provide 
exemptions for any toxins based on an aggregate amount. We made no 
changes based on this comment. The quantity amounts exempted have been 
determined by subject matter experts and would not pose a significant 
public health threat.
    Also, as noted above, for toxins to be excluded they must be 
``under the control of a principal investigator.'' The term ``principal 
investigator'' is defined as ``the one individual who is designated by 
the entity to direct a project or program and who is responsible to the 
entity for the scientific and technical direction of that project or 
program.'' We are retaining these provisions but are broadening the 
list of those eligible to exercise such control to include not only 
principal investigators, but also treating physicians and 
veterinarians, and commercial manufacturers or distributors.
    Although the language of the exclusion provisions in the amended 
interim final rule focused on principal investigators, we did not 
intend to cause the possession or transport of otherwise excluded 
toxins to be covered by the amended interim final rule if the entity 
has a legitimate use for the toxin such as would be the case for 
treating physicians and veterinarians (including those providing off-
label use) or commercial manufacturers or distributors. In any event, 
we believe that the specified toxins at levels below the threshold 
levels do not meet the Act's criteria for inclusion as select agents or 
toxins (having the potential to pose a severe threat to public health 
and safety) regardless of whether they are under the control of a 
principal investigator, a treating physician or veterinarian, or a 
commercial manufacturer or distributor. To attempt to regulate these de 
minimus quantities would impose an unreasonable regulatory burden on 
the public. Accordingly, we changed the regulations to provide that the 
exclusions would apply if under the control of a principal 
investigator, a treating physician or veterinarian, or a commercial 
manufacturer or distributor.
Genetic Elements, Recombinant Nucleic Acids, and Recombinant Organisms
    The provisions of the amended interim final rule concerning genetic 
elements, recombinant nucleic acids, and recombinant organisms include 
as select agents and toxins:
    (1) Select agent viral nucleic acids (synthetic or naturally 
derived, contiguous or fragmented, in host chromosomes or in expression 
vectors) that can encode infectious and/or replication competent forms 
of any of the select agent viruses.
    (2) Nucleic acids (synthetic or naturally derived) that encode for 
the functional form(s) of any of the toxins listed in paragraph (d) of 
this section if the nucleic acids:
    (i) Are in a vector or host chromosome;
    (ii) Can be expressed in vivo or in vitro; or
    (iii) Are in a vector or host chromosome and can be expressed in 
vivo or in vitro.
    (3) Viruses, bacteria, fungi, and toxins listed in paragraphs (a) 
through (d) of this section that have been genetically modified.
    Commenters recommended that for purposes of clarity paragraph (1) 
should state: ``Nucleic acids that can encode infectious and/or 
replication competent forms of any of the select agent viruses.'' One 
commenter recommended that the following should be added at the end of 
paragraph (1) in both Sec. Sec.  73.3 (e) and 73.4 (e): ``or a nucleic 
acid (synthetic or naturally derived) comprising at least 15% of the 
genome of a select agent.'' We agreed that clarification was needed and 
changed the language in paragraph (1) accordingly. The regulation now 
states that only nucleic acids (regardless of size) or replication 
competent forms of any select agent viruses that are subject to these 
regulations are those nucleic acids that can produce infectious select 
agent viruses.
    One commenter asserted that subparagraphs (i), (ii), and (iii) 
should be deleted from paragraph (2) based on the argument that nucleic 
acids in paragraph (2) covers all forms that encode for the functional 
forms. In response, we changed paragraph (2) to cover: ``Recombinant 
nucleic acids that encode for the functional form(s) of any HHS or 
overlap toxins listed in paragraph (b) of this section if the nucleic 
acids:
    (i) Can be expressed in vivo or in vitro; or
    (ii) Are in a vector or recombinant host genome and can be 
expressed in vivo or in vitro.''
    We believe this covers all of the functional forms.
    Commenters asserted that ``the government should require that 
service providers test for Select Agent sequences'' before they are 
made and transferred. The commenters argued that ``Although the Select 
Agent program covers transfer and possession of Select Agents, if DNA 
synthesis companies do not check the sequences they could inadvertently 
synthesize and transfer a Select Agent.'' We made no changes based on 
these comments. It is incumbent upon the entities that manufacture 
substances to know what they are manufacturing and to ensure that they 
comply with the provisions of the regulations in part 73 and 9 CFR part 
121.
    One commenter asserted that a database listing regulated genetic 
sequences should be created for the regulated community. We made no 
changes based on this comment. We believe that a database listing all 
the genetic sequences that can produce infectious forms of any of the 
select agent viruses or that can encode for the functional forms of any 
of the toxins listed is not practicable. However, the National Center 
for Biotechnology Information maintains a publicly available database 
(http://www.ncbi.nlm.nih.gov/) of nucleic acid sequence information 
that the regulated community could use as a resource in determining if 
the genetic sequence to be created is subject to this regulation.
Exclusions
    The amended interim final rule states that the list of select 
agents and toxins does not include any select agent or toxin that is 
``in its naturally occurring

[[Page 13299]]

environment provided it has not been intentionally introduced, 
cultivated, collected, or otherwise extracted from its natural 
source.'' One commenter requested clarification regarding what was 
meant by ``natural environment.'' The commenter asked ``For example, 
are milk samples that contain Coxiella burnetii, or macque [sic] tissue 
with Herpes B virus a natural environment?'' and ``Is an entity 
required to report the ``identification'' of a select agent from these 
samples, or is the entity exempted based on natural environment?'' 
Consistent with this comment, commenters asserted that naturally 
occurring wild-type shiga toxin-producing E. coli strains should not be 
included in the list of select agents and toxins. We made no changes 
based on these comments. Wild-type shiga toxin-producing E. coli 
strains are not subject to this part. However, Shigatoxin and Shiga-
like ribosome inactivating proteins produced by this agent are subject 
to this part. Select agents in their naturally occurring environment 
could include animals that are naturally infected with a select agent 
or toxin (e.g., macaques that are naturally infected with 
Cercopithecine herpesvirus 1 or milk samples that contain Coxiella 
burnetti). However, a select agent or toxin that has been intentionally 
introduced, cultivated, collected, or otherwise extracted from its 
natural source, including tissues from animals or agents or toxins 
obtained from milk samples that have been naturally infected with a 
select agent or toxin, is subject to this part and in such a case the 
entity is required to report the select agent or toxin upon 
identification.
    One commenter asserted that the regulations should exclude fixed 
tissues that are, bear, or contain select agents or toxins. We made no 
changes based on this comment. The amended interim final rule excluded 
non-viable select agents and nonfunctional toxins. This includes such 
fixed tissues provided the agents that may be present are rendered non-
viable.
    Under the amended interim final rule, non-viable select agents or 
nonfunctional toxins are excluded from regulation. One commenter 
requested that we add definitions of ``non-viable'' and 
``nonfunctional'' based on the assertion that ``Some organisms can 
survive in nature, others only with laboratory conditions, while others 
will not grow under any conditions.'' We made no changes based on this 
comment. Regardless of the environment in which an organism can or 
cannot survive, the standard established by the regulations is whether 
the organism is viable, or whether the toxin is functional, based on 
the plain meaning of the words. Further, the regulations are clear in 
that they exclude ``any select agent or toxin that is in its naturally 
occurring environment provided that it has not been intentionally 
introduced, cultivated, collected, or otherwise extracted from its 
natural source.'' The regulations also exclude ``non-viable select 
agents or nonfunctional toxins.''
    The amended interim final rule excluded from the regulation certain 
toxins (in the purified form or in combinations of pure and impure 
forms) if the aggregate amount under the control of a principal 
investigator does not, at any time, exceed specified amounts. One 
commenter asserted that the term ``aggregate amount'' is unclear and 
questioned whether it means ``weight of pure plus weight of impure'' or 
``weight of pure plus weight of pure in impure''? The commenter 
recommended that it be defined to mean the latter. For clarification 
purposes, we have deleted the language ``in the purified form or in 
combinations of pure and impure forms'' so that it is clear that the 
regulations are dealing with the total amount of the toxins regardless 
of the form.
    The amended interim final rule provided that the HHS Secretary may 
exclude attenuated strains of select agents or toxins upon a 
determination that they do not pose a severe threat to public health 
and safety. The amended interim final rule also provided that in 
response to an application submitted to the HHS Secretary, the HHS 
Secretary will provide a written decision granting the request, in 
whole or in part, or denying the request. It further stated that an 
exclusion will be effective upon notification to the applicant and that 
exclusions would be published in the notice section of the Federal 
Register and listed on the CDC Web site at http://www.cdc.gov/. In 
addition, it stated that the list would be included in the rule.
    After consultations with subject matter experts, review of relevant 
published studies, and review of information provided by the 
applicants, a number of attenuated strains have been excluded from the 
list of select agents and toxins based on the criteria that these 
agents do not pose a severe threat to public health and safety. One 
commenter asserted that ``Given the cost of compliance with these 
regulations, the appropriate list of select agents, including a list of 
exempted [sic] strains, should be in place at the time the regulations 
are implemented.'' In response, we note that a number of excluded 
attenuated strains are identified on the CDC Web site. We also listed 
them in the amended interim final rule. To minimize the potential 
delays related to rulemaking, in this final rule we are providing that 
excluded attenuated strains of select agents or toxins will be 
periodically published in the Federal Register notice and maintained on 
the Internet at http://www.cdc.gov. We believe these measures will 
provide sufficient notice to the public. Therefore, we are making no 
change based on this comment.
    Commenters asserted that specific criteria for evaluating 
exclusions for attenuated strains of select agents and toxins should be 
added to the regulations and further asserted that the broad 
microbiological community, not just government agency representatives, 
must be involved in this process. We made no changes based on these 
comments. The Act sets the criteria for excluding attenuated strains, 
i.e., they may be excluded if they do not pose a severe threat to 
public health and safety, (42 U.S.C. 262a(a)). We will consult with 
appropriate Federal departments and agencies and with scientific 
experts representing appropriate professional groups depending on the 
attenuated strain being considered.
    A number of commenters asserted that the government should ensure 
that prompt determinations are made in response to applications for 
exclusions. One commenter suggested that a timeline for responses be 
established. We made no changes based on these comments. We will do our 
best to make prompt determinations, but the highest priority is to 
protect public health and safety.
    For clarification, we added the language that if an excluded 
attenuated strain is subjected to any manipulation that restores or 
enhances its virulence, the resulting select agent or toxin will be 
subject to the requirements of this part.
    In addition, in this final rule, we are adding a new paragraph (f) 
to 42 CFR 73.3 and 73.4 to address concerns raised by Federal law 
enforcement agencies related to seizures (i.e., possession) of known 
select agents or toxins. Paragraph (f) provides that any known select 
agent or toxin seized by a Federal law enforcement agency will be 
excluded from the requirements of the regulations during the period 
between seizure of the agent or toxin and the transfer or destruction 
of such agent or toxin provided that (1) as soon as practicable, the 
Federal law enforcement agency transfers the seized agent or toxin to 
an entity eligible to receive such agent or toxin or destroys

[[Page 13300]]

the agent or toxin by a recognized sterilization or inactivation 
process; (2) the Federal law enforcement agency safeguards and secures 
the seized agent or toxin against theft, loss, or release and reports 
any theft, loss, or release of such agent or toxin; and (3) the Federal 
law enforcement agency reports the seizure of the select agent or toxin 
by submitting the APHIS/CDC Form 4.
    This provision will allow Federal law enforcement agencies to 
conduct certain law enforcement activities (e.g., collecting evidence 
from a laboratory crime scene) without being in violation of the 
regulations. We note, however, that this provision does not authorize 
the seizure of a select agent or toxin by a Federal law enforcement 
agency; rather, it establishes the conditions under which a Federal law 
enforcement agency may seize a known select agent or toxin without 
violating the regulations. Any seizure of a known select agent or toxin 
by a Federal law enforcement agency must be conducted in accordance 
with all applicable laws and regulations.
    To address concerns raised by Federal law enforcement agencies 
related to seizures (i.e., possession) of select agents or toxins, in 
this final rule we are adding a new paragraph (f) to Sec. Sec.  73.6(a) 
and 73.7(a) to address situations in which the select agents or toxins 
have been identified prior to seizure. In the event that a Federal law 
enforcement agency seizes a suspected select agent or toxin or unknown 
material, this material will be regarded as a specimen presented for 
diagnosis or verification and, therefore, will not be subject to the 
regulations until it has been identified as a select agent or toxin.

Sections 73.5 and 73.6 Exemptions for HHS and Overlap Select Agents and 
Toxins and Diagnosis, Verification, or Proficiency Testing

    The amended interim final rule provided that an individual or 
entity is exempt from the provisions of part 73, other than transfer 
provisions, if the entity only conducted activities with select agents 
or toxins that were contained in specimens presented for diagnosis, 
verification, or proficiency testing. We clarified the language to 
state ``Clinical or diagnostic laboratories and other entities that 
possess, use, or transfer a select agent or toxin that is contained in 
a specimen presented for diagnosis or verification will be exempt from 
the requirements of this part for such agent or toxin contained in the 
specimen''. This clarification was made in recognition that in certain 
cases regulated individuals and entities may also be conducting non-
regulated activities.
    The exemption provisions apply only if, among other things, the 
individual or entity within specified time periods (seven calendar days 
after identification of select agents and toxins used for diagnosis or 
verification; within 90 calendar days after receipt of select agents or 
toxins used for proficiency testing) submits a completed form regarding 
the disposition of the select agents or toxins. We have added language 
stating that less stringent reporting may be required based on 
extraordinary circumstances, such as a widespread outbreak. This will 
help prevent large numbers of reports in those instances when such 
reports would not be useful for taking action to protect the public's 
health and safety. In addition, CDC and APHIS have combined their 
immediate notification list for overlap select agents and toxins 
(Bacillus anthracis, Botulinum neurotoxins, Francisella tularensis, 
Brucella melitensis, Hendra virus, Nipah virus, Rift Valley fever 
virus, and Venezuelan equine encephalitis virus). Therefore, entities 
will be able to immediately notify either agency.
    One commenter asserted that the exemption provisions should not 
exist based on the argument that select agents and toxins may be 
obtained from the environment and those conducting diagnosis, 
verification, or proficiency testing are capable of isolating and 
growing them. The commenter further asserted that at the very least all 
clinical and diagnostic laboratory employees should be subject to the 
security risk assessments. We made no changes based on this comment. 
Such changes would be contrary to the exemption provisions mandated by 
the Act (42 U.S.C. 262a).
    Commenters argued that the exemption provisions should contain 
safeguarding requirements that would apply to select agents and toxins 
from the time they are identified until they are transferred or 
destroyed. One commenter argued that the safeguarding requirements 
should be the same as those that would apply if they were not subject 
to the exemption provisions. In response, we agree that the entity must 
take measures to safeguard the select agents or toxins. Accordingly, we 
have included a provision in the regulations to require the entity to 
secure the specimens or isolates containing a select agent or toxin 
during the period from identification until transfer or destruction. In 
addition, we added the provisions that the individual or entity must 
also meet the requirements of Sec.  73.19 (Notification of theft, loss, 
or release). We believe that any theft, loss, or release of a select 
agent or toxin must be reported to protect public health and safety.
    Commenters opposed the exemption provisions concerning diagnosis or 
testing that require an entity to transfer or destroy select agents or 
toxins. The commenters opposed the destruction option by asserting that 
by encouraging diagnostic laboratories such as state health facilities 
to destroy all isolates, the ability to deal with future outbreaks and 
terrorist events would be undermined. More specifically, they argued:
     ``Destruction will result in the loss of valuable 
scientific material since much of our knowledge of the ecology and 
epidemiology of emerging and select agents, and our future ability to 
identify the source of a terrorist introduction, depend on having 
collections of reference agents available for genetic and phenotypic 
analyses.
     If an agent is introduced by a terrorist group in a failed 
attempt to cause an outbreak, and the samples are all destroyed, 
retrospective analyses of activities preceding a significant 
bioterrorist event will be hampered by the loss of information.''
    One commenter also asserted that the final rule should require CDC 
to consult with the state public health laboratory director or other 
appropriate contact such as the state health officer before destroying 
a select agent or toxin based on the conclusion that ``There may be 
circumstances in which a state public health laboratory director would 
want such specimens or isolates preserved to support epidemiologic 
investigations in the state * * * such as isolated cases of Yersinia 
pestis infection in the Southwest, but for which state-based infection 
control activities must proceed.'' One commenter suggested that a team 
from the Department of Justice could ``arrive and monitor the 
situation, and safeguard the isolate.''
    The regulations require that a diagnostic or testing entity 
transfer or destroy a select agent or toxin if, and only if, such an 
entity does not want to be registered pursuant to the Select Agent 
regulations. If any entity has a legitimate need to keep possession of 
a select agent or toxin it may do so once it has become registered. We 
have added a provision to allow a diagnostic or testing entity to 
retain possession of a select agent or toxin in situations where it has 
been determined that such action is necessary to protect public health 
and safety.
    Commenters argued that the seven day requirement for transferring 
or destroying select agents or toxins used for diagnosis or testing is 
too short a

[[Page 13301]]

time limit. We made no changes based on these comments. Based on input 
from technical experts and risks posed by select agents and toxins, we 
believe seven calendar days provides a sufficient amount of time for 
the entity to destroy or transfer the select agents or toxins after 
identification. However, as noted above, we have included language for 
special allowance of these provisions when necessary to protect public 
health and safety.
    One commenter asserted that the final rule should not require an 
entity to submit to CDC a record of destruction of select agents or 
toxins or as an alternative should require ``entities to maintain a 
record of destruction, which would be subject to inspection by CDC and/
or APHIS.'' The commenter argued that ``This action would reduce the 
associated paperwork burden and maintain consistency with the intent of 
the regulations.'' The commenter further stated that ``Unlike transfers 
from other regulated entities, a transfer record does not precede 
isolation through diagnostic procedures.'' We made no changes based on 
this comment. The Act requires a report of the identification of select 
agents or toxins (42 U.S.C. 262a(g)(1)(a)). We need to be advised of 
the disposition to ensure compliance with the requirements of the 
regulations and to ensure the protection of public health and safety.
Exempted Products
    The amended interim final rule provides for exemption from the 
regulations under certain circumstances for products that are, bear, or 
contain listed select agents or toxins that are cleared, approved, 
licensed, or registered under any of the specified laws, insofar as 
their use is only for the approved purpose and meets the requirements 
of such laws. Commenters asserted that the requirement that the use be 
limited to approved purposes be deleted because of the allowance of 
off-label use. In response, we agree and have deleted the ``approved 
purpose'' language. We see no reason to distinguish between products 
that are used for off-label, but in a manner that doesn't violate the 
law, and products that are used in accordance with the approved 
labeling.
    One commenter recommended that the regulations list the exempted 
products. We made no changes based on this comment. The regulations 
provide the criteria for determining which products are exempt and it 
would be impracticable for the maintenance of such a list.
    The amended interim final rule provided that the HHS Secretary on a 
case-by-case basis may exempt from the requirements of the part 73 
regulations an investigational product that is, bears, or contains a 
select agent or toxin, when such product is being used in an 
investigation authorized under any of four specified Federal acts and 
additional regulation is not necessary to protect public health and 
safety. The final rule allows such an exemption under any Federal act 
since the statutory authority allows exemptions for investigational 
products under any Federal act.

Section 73.7 Registration and Related Security Risk Assessments, Sec.  
73.8 Denial, Revocation, or Suspension of Registration, and Sec.  73.10 
Restricting Access to Select Agents and Toxins; Security Risk 
Assessments

[These Subjects Are in Sec. Sec.  73.7 and 73.8 in the Amended Interim 
Final Rule]
General
    We have revised the provisions regarding registration and security 
risk assessments and, as noted above, have placed these provisions in 
three sections: Sec.  73.7 (Registration and related security risk 
assessments), Sec.  73.8 (Denial, revocation, or suspension of 
registration), and Sec.  73.10 (Restricting access to select agents and 
toxins; security risk assessments). To conduct certain activities 
regulated under part 73, the revised provisions, consistent with the 
provisions of the amended interim final rule, require that the 
individual or entity obtain a certificate of registration and that the 
following must have an approval from the HHS Secretary or Administrator 
following a security risk assessment by the Attorney General: the 
individual or entity, any individual who owns or controls the entity, 
the Responsible Official of the entity, and any individual who is to 
access select agents or toxins under the entity's certificate of 
registration.
    One commenter, a private, non-profit organization that provides 
medical research personnel to work at government entities for the 
purpose of performing work covered by the regulations, requested that 
the regulations be changed to state that such a private non-profit 
organization would not be subject to any requirements imposed by the 
regulations. We made no changes based on this comment. The entity 
conducting regulated activities must obtain a certificate of 
registration and otherwise comply with the Part 73 regulation. Also, 
any individuals having access to select agents or toxins on behalf of 
an entity must meet the requirements for such activities, regardless of 
the type of entity.
    One commenter asserted that the regulations should specifically 
``prohibit HHS, USDA or other federal agencies from using the 
information collected through the registration process to evaluate the 
merit of proposals involving research on select agents or toxins.'' We 
made no changes based on this comment. The regulations contain 
provisions to implement the intent of the Act which is to provide 
protection against the effects of misuse of select agents and toxins 
whether inadvertent or the result of terrorist acts against the United 
States homeland or other criminal acts. The part 73 regulations contain 
no provisions for evaluating the merits of research proposals and are 
not intended to cover such activities.
    One commenter asserted that the approval process for security risk 
assessments should include requirements for credit checks and random 
drug screening. We made no changes based on this comment. With respect 
to security risk assessments, the Act provides that the Attorney 
General shall use criminal, immigration, national security, and other 
electronic databases available to the Federal Government, as 
appropriate for the purpose of identifying restricted persons and for 
identifying those reasonably suspected of committing certain crimes, 
being involved with an organization that engages in domestic or 
international terrorism, or being an agent of a foreign power. The Act 
does not provide for credit checks or random drug screening.
    Commenters asserted that the regulations should explicitly provide 
that the clearance process is confidential. We made no changes based on 
these comments. Information obtained as a result of the security risk 
assessment process will be protected in accordance with the provisions 
of the Privacy Act.
Individual Who Owns or Controls the Entity
    Commenters asserted that provisions requiring a security risk 
assessment approval for an individual who ``owns or controls the 
entity'' should not apply to educational institutions. One commenter 
asserted that ``under most state laws governing the organization of 
nonprofit entities such as a university, there are no owners of the 
entity, i.e., no stockholders or partners, because the entity is 
organized for the good of the public, not for the good of the 
`stockholders' or `investors.' '' They expressed concern regarding 
possible delays if these provisions were broadly interpreted to include 
members of the board of trustees or other similar officials. One 
commenter asserted that

[[Page 13302]]

``the interpretation of ``control'' should be limited to those 
individuals who will have actual access to the select agents.'' One 
commenter recommended that we define ``ownership or control'' to mean 
the right to exercise control of an entity ``regardless whether such 
right results from a substantial economic interest or contractual or 
other right to manage an entity.''
    In response, we have added the following language:
    (2) Federal, State, or local governmental agencies, including 
public institutions of higher education, are exempt from the security 
risk assessments for the entity and the individual who owns or controls 
such entity.
    (3) An individual will be deemed to own or control an entity under 
the following conditions: \1\
---------------------------------------------------------------------------

    \1\ These conditions may apply to more than one individual.
---------------------------------------------------------------------------

    (i) For a private institution of higher education, an individual 
will be deemed to own or control the entity if the individual is in a 
managerial or executive capacity with regard to the entity's select 
agents or toxins or with regard to the individuals with access to the 
select agents or toxins possessed, used, or transferred by the entity.
    (ii) For entities other than institutions of higher education, an 
individual will be deemed to own or control the entity if the 
individual:
    (A) Owns 50 percent or more of the entity, or is a holder or owner 
of 50 percent or more of its voting stock, or
    (B) Is in a managerial or executive capacity with regard to the 
entity's select agents or toxins or with regard to the individuals with 
access to the select agents or toxins possessed, used, or transferred 
by the entity.
    (4) An entity will be considered to be an institution of higher 
education if it is an institution of higher education as defined in 
section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)), 
or is an organization described in 501(c)(3) of the Internal Revenue 
Code of 1986, as amended (26 U.S.C. 501(c)(3)).''
    We believe the language is consistent with the statutory language 
in section 351 A(e)(6)(B) from the Act which exempts Federal, State, or 
local governmental agencies including public institutions of higher 
education from the security risk assessments for the entity and the 
individual who owns or controls such entity. However, the Act does not 
exempt other individuals or entities even those nonprofit entities from 
the security risk assessment provisions. In addition, we believe those 
individuals that own or control the entity relevant to the entity's 
possession, use, or transfer of select agents or toxins should be 
required to undergo a security risk assessment. However, we determined 
that not all owners or controllers of an entity were relevant to an 
entity's possession, use, or transfer of a select agent and added 
language to identify those individuals who were in a ``managerial or 
executive capacity with regard to the entity's select agents or 
toxins'' such as laboratory directors.
    One commenter asserted that the security risk assessment provisions 
should apply to entities that own or control entities possessing or 
transferring select agents. We made no changes based on this comment. 
The Act requires a security risk assessment for an entity (at any 
level) that conducts regulated activities and for individuals who own 
or control such entity.
Coordination of Activities
    Commenters recommended that CDC and APHIS coordinate their 
activities regarding select agents and toxins through a single office. 
The commenters argued that such coordination through one office would 
decrease regulatory burdens, ensure consistency in agency decision 
making, and ultimately promote compliance. They also argued that 
without a single office, entities conducting activities regulated 
solely by USDA and solely by HHS would be required to submit dual 
registrations, obtain dual security risk assessments, and prepare other 
dual packages, such as safety plans and security plans. One commenter 
argued that such duplication is contrary to the statutory requirements.
    In order to minimize the burden to the public required to register 
to possess, use or transfer select agents and toxins, a single point of 
contact has been developed. This single point of contact is responsible 
for coordinating all activities and communications with respect to the 
entity's registration, including coordination with both the non-lead 
agency and with Federal Bureau of Investigations, Criminal Justice 
Information Services Division. This single point of contact will retain 
responsibility for the application for the life of the registration 
certificate (2-3 years). In addition, a single shared web-based system 
is under development that will allow the regulated community to conduct 
transactions electronically via a single web portal. We envision that 
this system will enable the entity to dynamically communicate in a 
digitally secured environment using a single web portal. The web portal 
will provide a platform for electronic exchange of information. It will 
allow entities to access data related to their own registration data 
and allow them to create, amend, and submit registration applications; 
requests for approvals for transfers, exemptions, or exclusions; and 
any other required forms without the need to print, mail, or e-mail 
hard copies. Hard copy registration materials and other required forms 
will still be accepted. The single web portal will be available in 
winter 2005.
Changes
    The amended interim final rule stated that the Responsible Official 
must promptly notify the HHS Secretary if a change occurs in any 
information submitted to the HHS Secretary in the application for the 
certificate of registration or amendments. This included modifications 
to the list of individuals with approvals for security risk 
assessments, changes in area of work, or changes in protocols or 
objectives of studies. Commenters recommended deleting the word 
``protocol'' based on the argument that prior approval before 
implementing the protocol change would hinder research. They also 
argued that ``Protocols can change frequently in active research 
programs without altering the relevant biosafety and laboratory 
information or the objectives of the work.'' In response, we have 
deleted the word ``protocol'' and clarified the regulations to state 
that an entity may take regulated actions concerning select agents or 
toxins, activities, locations, or personnel only to the extent that 
such actions are specifically approved under a certificate of 
registration, including any amendments.
Timely Decision-Making
    Commenters expressed concern regarding the absence of time limits 
for determinations of registration and security risk assessments and 
recommended that the regulations include a process by which an entity 
can begin or continue its research with select agents and toxins until 
such time as the relevant government agencies complete their respective 
reviews and respond to the entity's applications for security risk 
assessments and registrations. Some commenters requested that the 
regulations ``be amended to provide that if the person subject to the 
background check suffers a delay in excess of 10 work days, that person 
should be permitted to work with select agents under the direct 
supervision of an approved person (provided that all other requirements 
are met).'' Another commenter suggested

[[Page 13303]]

that the regulations should allow an individual access to select agents 
and toxins if ``escorted'' during the waiting period. We made no 
changes based on these comments. The amended interim final rule did 
provide for a phase-in of the security risk assessment requirement to 
allow ongoing research to continue pending the completion of a records 
check by the FBI. However, as explained above, the phase-in provisions 
have been removed because they have served their purpose. Entities and 
individuals have had time to come into compliance without compromising 
research or educational projects. The Act is clear that individuals 
should not be allowed access to select agents and toxins until after 
completion of the security risk assessment.
    Under the registration provisions, a certificate of registration 
concerning overlap agents will only be issued if both the HHS Secretary 
and Administrator concur. One commenter suggested that language be 
added to discuss ``what the entity is to do to assist or mitigate the 
conflict between the two regulatory agencies or, for example, how to 
appeal for resolution.'' We made no changes based on this comment. As 
discussed above, a single point of contact has been implemented in 
order to minimize the burden to the public required to register in 
order to possess, use or transfer select agents and toxins. Therefore, 
the responsibility for resolving such conflicts rests with CDC and 
APHIS and the agencies are prepared to take action to resolve any 
conflicts as quickly as possible.
Coverage of Certificate of Registration
    The amended interim final rule provided that ``A certificate of 
registration will cover activities at only one general physical 
location (a building or a complex of buildings at a single mailing 
address).''
    Commenters recommended that an entity have the option to apply for 
a single certificate of registration to cover activities at all 
buildings on a campus or site under the control and authority of the 
Responsible Official. The commenters indicated that this would include 
both contiguous and dispersed sites within a local geographical area. 
The commenters argued that separate registrations for each general 
physical location (defined as ``a building or a complex of buildings at 
a single mailing address'') is overly burdensome in terms of staffing, 
training, and naming of Responsible Officials, and record keeping. They 
also argued that the amended interim final rule ``authorizes the 
Responsible Official to identify one or more alternate Responsible 
Officials to provide coverage for and assist the Responsible Official 
and that this nullifies the argument that separate registrations are 
necessary to ensure against over-extending the Responsible Official.'' 
In addition, they argued that ``administrative and control functions at 
research and academic institutions, including environmental health and 
safety and security programs, are efficiently managed by a centralized 
department responsible for more than one physical location.''
    One commenter asserted that this provision should be changed to 
state that a certificate of registration will cover activities of a 
single administrative organization under a single Responsible Official 
provided that all buildings are contained within a circle of 25 miles 
diameter. The commenter noted that ``each building on a university 
campus may have a different mailing address even though the campus is 
under a single administration.'' The commenter asserted that this would 
allow ``a university to include a detached medical school or research 
park in its registration, simplifying paperwork for all concerned'' 
while still allowing ``full government inspection in a single visit'' 
and provide ``a realistic commuting distance for the Responsible 
Official.''
    One commenter indicated that a certificate of registration should 
allow a Responsible Official to discharge his/her responsibilities at 
several adjacent addresses. The commenter asserted that ``Addresses are 
generally used to facilitate mail deliveries, not to establish areas of 
responsibility.''
    In response, we note that our goal is to set forth a standard to 
ensure that the Responsible Official will not be overextended and will 
be able to perform the activities required for that position. Moreover, 
we believe that in some cases a Responsible Official may be able to 
meet these criteria even if the area were larger than set forth in the 
amended interim final rule. Therefore, we have changed the rule to 
allow a certificate of registration to cover activities at one physical 
location (room, building, or group of buildings) where the Responsible 
Official will be able to perform the responsibilities required for that 
position.
    However, we made no changes concerning the responsibilities of 
Responsible Officials and alternate Responsible Officials. The 
regulations were designed to place responsibility for ensuring 
compliance with the part 73 regulations in one position. Also, the 
regulations provide that an alternate Responsible Official could act 
only if the Responsible Official were unavailable. We believe that 
placing responsibility in one position will help achieve a higher level 
of compliance than would be obtained from a system of shared 
responsibility.
Periods of Validity and Reapplication
    The amended interim final rule provided, with exceptions, that a 
certificate of registration is valid for up to three years. The amended 
interim final rule also provided that an approval based on a security 
risk assessment is valid for five years. Commenters recommended that 
the certificate of registration be valid for up to five years. They 
argued that this would make the registration provisions consistent with 
the security risk assessment provisions and that this ``would simplify 
paperwork logistics for the entity and reduce the cost to the 
government for the registration process.'' One commenter asserted that 
an approval based on a security risk assessment should be valid for the 
same time period as the certificate of registration so that the 
approval period would coincide with the timing for resubmittals of the 
registration application package. We made no changes based on these 
comments. We believe it is reasonable to provide that a certificate of 
registration will be valid for a maximum of three years. A three year 
registration period takes into consideration the burden on the public 
and the risks posed by select agents and toxins. In addition, it is 
consistent with APHIS' permit systems and other established programs 
for laboratory certification or registration (e.g., Clinical Laboratory 
Improvement Amendments (CLIA) and the College of American Pathologists 
(CAP)), which are generally valid for two to three years. The validity 
period of five years for an individual's security risk assessment was 
established based on a Department of Justice determination that five 
years was the appropriate period. Even though it appears that the two 
different timeframes would increase the burden on the public, as a 
practical matter the registration of an entity and the completion of 
most individual security risk assessments are not connected, with the 
exceptions being only the Responsible Official, Alternate Responsible 
Official, and any individual who owns or controls the entity. Although 
both seem to have happened at once as the Program became established 
and the regulations became effective, in fact the Select Agent Program 
has observed a significant ``turn over'' in the individuals from 
registered entities. Therefore at the time an entity begins its 
submissions for re-registration, it could have individuals

[[Page 13304]]

that have approved security risk assessments from anywhere from almost 
three years to one day. Therefore, changing the validity of an 
individual security risk assessment to be consistent with the 
registration period would cause undue burden on the public.
    With respect to reapplications, one commenter asserted that 
resubmittal schedules should be ``well defined'' (e.g., resubmit at 
least 90 calendar days prior to expiration). Although we cannot provide 
a specific timeframe, we recommend the individual or entity reapply at 
least eight weeks prior to the expiration date of the existing 
certificate of registration.
    Moreover, we have added provisions to help prevent an unnecessary 
lapse in a certificate of registration when the Responsible Official of 
an entity leaves and the entity is left with no individual to serve as 
the Responsible Official. In this regard, we added provisions to allow 
an entity to continue to possess or use select agents or toxins only if 
it appoints as the Responsible Official another individual who has been 
approved by the HHS Secretary or Administrator following a security 
risk assessment by the Attorney General and who meets the requirements 
of this part.
    The amended interim final rule stated that an entity must provide 
written notice at least five business days before destroying a select 
agent or toxin, if the destruction would be for the purpose of 
discontinuing activities with a select agent or toxin covered by a 
certificate of registration. The amended interim final rule further 
stated that ``This will allow the HHS Secretary and/or the USDA 
Secretary to observe the destruction or take other action as 
appropriate.'' We are deleting this provision. Under the registration 
provisions, the Responsible Official must provide prompt notification 
in writing, if a change occurs in any information submitted in the 
application for the certificate of registration or amendments. If the 
entity has not yet received a certificate of registration then the 
Responsible Official must provide updated information in writing; if 
the entity has received a certificate of registration then the 
Responsible Official must promptly provide an amendment to their 
certificate of registration. This would include adding or removing a 
select agent or toxin. However, there is no need to impose a five-day 
notification requirement.
    In addition, in this final rule, we are adding the language that a 
certificate of registration will be denied, revoked, or suspended if it 
is determined that such action is necessary to protect public health 
and safety. We are also clarifying the actions an entity must take in 
the event that the certificate of registration is suspended or revoked. 
Specifically, we are adding a paragraph to require that, upon 
notification of revocation or suspension, the individual or entity 
must: (1) Immediately stop all use of each select agent or toxin 
covered by the revocation or suspension order; (2) immediately 
safeguard and secure each select agent or toxin covered by the 
revocation or suspension order from theft, loss, or release; and (3) 
comply with all disposition instructions issued by the HHS Secretary 
for each select agent or toxin covered by the revocation or suspension.
Security Risk Assessments
    Commenters recommended that the Final Rule define the information 
the entity must submit to the Attorney General for the security risk 
assessments. Currently, the individual completes the FBI form (FD-961) 
and then mails the FD-961 form and fingerprint cards as one package 
directly to the Federal Bureau of Investigation (FBI), Criminal Justice 
Information Services Division (CJIS). Since this process could change, 
the specific information for submission was not included in the 
regulatory text. Specific guidance on the process has been made 
available on the Internet at http://www.cdc.gov.
    Commenters asserted that the regulations should allow security risk 
assessment approvals for individuals to be portable from entity to 
entity, from location to location, and from project to project. One 
commenter recommended that an individual's clearance remain valid if 
the scientist moves to another institution as long as the scientist's 
new employer amends its registration document promptly to include the 
individual. The commenter also recommended ``that the Department 
clarify that an individual's clearance will continue to be valid if his 
or her laboratory is relocated among any of the facilities under the 
oversight of the entity's Responsible Official'' and added that ``The 
change in location should, of course, be reflected in a timely 
amendment of the entity's registration.'' We made no changes based on 
these comments. However, CDC, APHIS, and the Attorney General have 
agreed to and have already implemented a policy that an additional 
security risk assessment is not needed in cases where an individual has 
a current security risk assessment and will be merely visiting another 
entity. If a registered entity wants a visiting individual to have 
access to select agents or toxins, the RO of home entity will have to 
send to the RO of host entity a letter stating that the individual is 
currently identified on the home entity's Select Agent registration and 
that the individual has a current SRA approval. The host entity RO can 
then submit this letter and an amendment to their registration. Once 
the visit is complete, the host entity would then amend their 
registration to remove the visiting individual's name. In some 
circumstances the host entity may decide to leave the individual on the 
registration, if the same individual will be visiting the entity again. 
Specific guidance on the process has been made available to the public 
on the Select Agent Program web site.
    In addition, in this final rule, we have added the requirement that 
an individual with access to select agents or toxins must have the 
appropriate education, training, and/or experience to handle or use 
such agents or toxins. We believe this requirement is necessary to 
ensure that the individual has the appropriate education, training, 
and/or experience to handle such agents or toxins.
    One commenter in a discussion concerning national Department of 
Energy (DOE) laboratories requested that language be added ``that would 
allow the L or Q clearance granted in DOE laboratories (or equivalent) 
to be considered synonymous with the security risk assessment process 
for the purposes of this regulation and that individuals with a current 
L or Q clearance be considered approved.'' We made no changes based on 
this comment. The Act requires the Attorney General to determine 
whether an individual is a restricted person; or reasonably suspected 
of committing an act of terror, being involved in a terrorist 
organization, or being an agent of a foreign power. The Attorney 
General may not be able to make such a determination based solely on 
the existence of an L or Q clearance.
    One commenter asserted that we should take into consideration the 
conclusion that ``It is unlikely that an entity can provide information 
for a security risk assessment, other than the name of an individual, 
since many institutions have privacy policies that preclude their 
seeking certain personal information'' and ``Institutions are also 
subject to state laws on privacy, which vary widely.'' We made no 
changes based on this comment. Entity policy and State laws do not 
preempt the Act and the part 73 regulations. Accordingly, an entity 
must comply with the part 73 regulations to be eligible to conduct 
regulated activities concerning select agents and toxins.

[[Page 13305]]

    The amended interim final rule provided that the HHS Secretary will 
deny or revoke access to any select agent or toxin to an entity or 
individual identified by the Attorney General as a ``restricted 
person'' under 18 U.S.C. 175b. Under this statutory provision, a 
``restricted person'' is a person who:
     Is under indictment for a crime punishable by imprisonment 
for a term exceeding one year,
     Has been convicted in any court of a crime punishable by 
imprisonment for a term exceeding one year,
     Is a fugitive from justice,
     Is an unlawful user of any controlled substance (as 
defined in section 102 of the Controlled Substances Act (21 U.S.C. 
802)),
     Is an alien illegally or unlawfully in the United States,
     Has been adjudicated as a mental defective or has been 
committed to any mental institution,
     Is an alien (other than an alien lawfully admitted for 
permanent residence) who is a national of a country as to which the 
Secretary of State has made a determination (that remains in effect) 
that such country has repeatedly provided support for acts of 
international terrorism, or
     Has been discharged from the Armed Services of the United 
States under dishonorable conditions.
    Commenters expressed concern ``that these broad classifications 
will hinder legitimate research'' and are contrary to the requirement 
in the Act to ``ensure the appropriate availability of biological 
agents and toxins for research, education, and other legitimate 
purposes.'' They argued that the term ``restricted person'' would cover 
an individual who received a dishonorable discharge from the U.S. 
military for homosexuality and could not understand how precluding such 
individual from ever working on select agents would protect the 
security of the United States. Commenters also argued that ``it is 
predictable that some individuals who are currently productive, 
respected members of the scientific community and who have performed 
work with select agents or toxins meet one or more of the definitions 
of a `restricted person.' '' We made no changes based on these 
comments. The provisions regarding ``restricted persons'' restate 
statutory requirements.
    Commenters asserted that the regulations should contain a 
description of the process for limited approvals. We made no changes 
based on this comment. The Act and the part 73 regulations provide for 
the application of a security risk assessment approval. An individual 
or entity may obtain review of a decision denying or revoking a 
security risk assessment approval. Based on this review the HHS 
Secretary may, under certain circumstances, provide for a limited 
approval for a specified time based upon the finding that circumstances 
warrant such action in the interest of public health and safety or 
national security.
    The amended interim final rule set forth a mechanism for obtaining 
an expedited review of an application for a security risk assessment. 
One commenter asserted that the ``DOE clearance process parallels (and 
in many cases exceeds) the efforts that will be reviewed by the 
Attorney General.'' The commenter argued that ``Hence, DOE and DOE 
subcontractor staff (or other federal agency staff) that have federal 
clearances should be among those to be considered for expedited 
review.'' We made no changes based on this comment. The Act allows for 
such an expedited review based on ``good cause'' and we do not believe 
that having a security clearance is relevant regarding whether the 
``good cause'' standard would be met.

Section 73.9 Responsible Official

[This Subject Is in Sec.  73.9 in the Amended Interim Final Rule]
    The APHIS interim final rule included provisions stating that the 
Responsible Official is ``The individual designated by an entity to act 
on its behalf'' and that ``This individual must have the authority and 
control to ensure compliance with the regulations in this part.'' 
Commenters asserted that the part 73 regulations should include these 
provisions. They argued that the APHIS provisions provide the ``clarity 
needed in order to provide the expected accountability at sites 
registered by the CDC Select Agent program.'' We agreed with commenters 
and CDC and APHIS have included identical provisions for the 
Responsible Official.
    Also, to ensure that all of the requirements of the regulations are 
met, we have clarified the language regarding the Responsible 
Official's annual inspection. The language previously located in Sec.  
73.10 Safety section of the amended interim final rule has been moved 
to the Responsible Official (Sec.  73.9) section stating that the 
Responsible Official must ensure that annual inspections are conducted 
for each laboratory where select agents and toxins are stored or used 
in order to determine compliance with requirements in this part. 
Further, we have included provisions requiring that deficiencies be 
corrected.
    Commenters noted that the preamble to the initial interim final 
rule ``recommended that that the Responsible Official and alternate 
Responsible Officials are either biosafety officers or senior 
management officials of the entity, or both.'' Commenters suggested 
that we ``emphasize that it is the entity's responsibility to designate 
the appropriate individual to be the responsible official (i.e., an 
individual who has the authority and control to ensure compliance with 
the regulations)'' and that ``To satisfy this requirement, a university 
may choose to designate the Dean of Agriculture to be the responsible 
official rather than the biosafety officer because the Dean of 
Agriculture may have better oversight and authority to ensure 
compliance with the regulations.'' Some suggested that duties may even 
be separated by having the biosafety officer or an individual who has a 
higher-level management position for ensuring overall compliance, 
responsible for day-to-day operations. One commenter suggested that the 
duties be shared between the Responsible Official and the Principal 
Investigator with the Principal Investigator responsible for those 
activities that required daily hands-on knowledge of the laboratory. We 
made no changes based on these comments. The Responsible Official 
should be an individual who can perform all of the duties required for 
that position. As we noted above, the regulations were designed to 
place responsibility for ensuring compliance with the part 73 
regulations in one position because we believe that doing so will help 
achieve a higher level of compliance than would be obtained from a 
system of shared responsibility.
    Commenters recommended revision of language throughout the 
regulations to change the emphasis regarding Responsible Officials from 
responsibility ``for'' complying with requirements to responsibility 
``for ensuring'' compliance with requirements. They argued that the 
amended interim final rule implies that only the Responsible Official 
or alternate Responsible Official may perform actions intended to be 
performed by others detailed under their supervision. In addition, one 
commenter recommended that laboratory inspections be performed by a 
Biosafety Officer designated by and reporting to the Responsible 
Official rather than by the Responsible Official. In response, we have 
made changes as necessary to state when the Responsible

[[Page 13306]]

Official must conduct activities and when the Responsible Official is 
required to ``ensure'' compliance with requirements in the regulations. 
This change will allow the Responsible Official the flexibility to 
delegate certain responsibilities.
    Since the reporting requirements of Sec. Sec.  73.5 and 73.6 
(Exemptions for HHS and overlap select agents and toxins) may pertain 
to regulated individuals and entities, we have clarified the language 
by adding the reporting requirements to the RO section. This reporting 
requirement will help us with monitoring activities related to select 
agents and toxins.

Section 73.11 Security

[This Subject Is in Sec.  73.11 in the Amended Interim Final Rule]
Coordination With USDA
    Commenters recommended that security plans established for 
compliance with the CDC rule should be sufficient to meet the 
requirements for a security plan under the APHIS regulations. They 
argued that otherwise an entity must prepare two security plans. We 
agreed with the commenters and CDC and APHIS made their language in the 
security section identical to ensure consistency between the 
regulations. In addition, we note that compliance inspections for 
security will be based on the regulations and that the inspectors will 
be looking for security that provides graded protection commensurate 
with the risk of the select agent or toxin, given its intended use.
    A commenter asserted that biological laboratory security should be 
administered by only one Federal agency (e.g., Department of Homeland 
Security) to ensure consistency. We made no changes based on this 
comment. Section 201(b) of the Act requires the HHS Secretary to 
establish and enforce safeguard and security measures to prevent the 
access to select agents and toxins for use in domestic or international 
terrorism or for any other criminal purpose. In addition, the Act 
provides for the interagency coordination between the HHS Secretary and 
Administrator regarding overlap select agents and toxins. CDC and APHIS 
have established procedures to ensure consistent regulation of select 
agents and toxins.
Performance Based
    Some commenters asserted that the security requirements are too 
stringent based on the argument that they could hamper research. We 
made no changes based on this comment. Although the Act requires us to 
do what we can to allow research, the first duty under the Act is to 
protect public health and safety. The security requirements are 
designed to prevent unauthorized access, theft, loss, or release of 
select agents or toxins. The regulations require that an entity's 
security plan be designed according to a site-specific risk assessment. 
Such a risk assessment would take into consideration the security 
needed for a select agent laboratory in an academic setting.
    Some commenters asserted that the security provisions should be 
prescriptive rather than performance based to prevent ``wide variation 
in the evaluation of threats and consequences, and a wide 
interpretation of what constitutes adequate security.'' Other 
commenters asserted that the security provisions are highly 
prescriptive and should be changed to provide only a general 
performance standard. These commenters pointed out difficulties in the 
amended interim final rule by arguing that requirements, such as a 
requirement that freezers containing select agents and toxins be locked 
may not always be appropriate (the whole room could be secure).
    Because different select agents and toxins pose differing degrees 
of risk, we believe it would be counterproductive to attempt to prepare 
a detailed list of prescriptive requirements for entities (i.e., a 
``one size fits all'' design standard). Therefore, the regulations 
contain performance standards for biosafety, security, and incident 
response that take into account the risks presented by a particular 
select agent or toxin, given its intended use.
    With regard to security, newly designated 42 CFR 73.11 requires 
each individual or entity required to register under this part to 
develop and implement a written security plan. This security plan must 
be designed according to a site-specific risk assessment and must 
provide graded protection in accordance with the risk of the select 
agent or toxin, given its intended use. In addition, newly designated 
42 CFR 73.11 requires the individual or entity to adhere to specified 
security requirements or implement measures to achieve an equivalent or 
greater level of security. We believe these security provisions provide 
enough flexibility and specificity to allow an individual or entity to 
develop and implement a security plan that will safeguard the select 
agent or toxin against unauthorized access, theft, loss, or release.
    However, in recognition of the commenters' concerns, we reiterate 
that CDC and APHIS are working with interagency groups and security 
experts to draft a document that will provide additional guidance about 
the security required for select agents and toxins. This document will 
be available in spring 2005. The 5th edition of the BMBL, which is 
under development, will also provide additional guidance on laboratory 
security.
    The interim final rule stated that freezers containing select 
agents and toxins must be locked or must be in the direct view of 
approved staff. Commenters asserted that these provisions may not be 
appropriate (the whole room could be secure). We agreed and have 
changed the language to require the entity to ``Provide for the control 
of select agents and toxins by requiring freezers, refrigerators, 
cabinets, and other containers where select agents and toxins are 
stored to be secured against unauthorized access (e.g., card access 
system, lock boxes).''
    One commenter stated the BMBL and NIH guidelines require labs to 
post biohazard signs on access doors that list the agents present in 
the laboratory, which may compromise laboratory security. We made no 
changes based on this comment. In this final rule, 42 CFR 73.12 
(Biosafety) provides that an individual or entity should consider the 
BMBL and NIH Guidelines when developing a biosafety plan. However, it 
is the entity's responsibility to determine if posting biohazardous 
signs on access doors would compromise laboratory security.
    A commenter pointed out that the terms ``risk assessment,'' 
``threat assessment,'' and ``vulnerability assessment,'' are confusing 
to those with little experience in this area and should be clarified. A 
commenter suggested that the phrase ``risks associated with those 
vulnerabilities are mitigated'' be replaced with ``consequences 
associated with those vulnerabilities are mitigated.'' We agreed with 
the commenters and have deleted the text. In addition, we clarified the 
language to state that an entity's security plan must be sufficient to 
safeguard the select agent or toxin against unauthorized access, theft, 
loss, or release; must be designed according to a site-specific risk 
assessment; and must provide graded protection in accordance with the 
risk of the select agent or toxin, given its intended use.
BMBL
    One commenter asserted that the security provisions should mandate 
compliance with the BMBL, specifically Appendix F. We made no changes 
based on this comment. The security provisions contain guidelines 
similar to

[[Page 13307]]

that published in Appendix F of the 4th edition of the BMBL.
Security and Individuals
    Commenters asserted that the amended interim final rule incorrectly 
indicated that special provisions would be required for all individuals 
providing routine cleaning, maintenance, and repairs and objected to 
such language based on the conclusion that some might obtain security 
risk assessment approvals. In response, we note that these provisions 
were intended to apply when the cleaning, maintenance, or repairs were 
performed by individuals without security risk assessment approvals. We 
have clarified the regulations accordingly.
    Commenters asserted that the security provisions of the amended 
interim final rule indicate that they ``must develop a security plan 
that, among other requirements, establishes a procedure for reporting 
and removing unauthorized persons'' and requested clarification as to 
the meaning of the phrase ``unauthorized persons'' and the ``areas from 
which they must be removed.'' We made no changes based on these 
comments. In context, unauthorized persons are those unescorted 
individuals who do not have access approval from the HHS Secretary or 
Administrator and who are in areas where they could gain access to 
select agents or toxins.
    Commenters argued that security provisions of the amended interim 
final rule would hinder collaboration among scientists. They asserted 
that ``A productive research program likely includes many scientists 
and technicians working collaboratively but with only a few actually 
handling infectious agents'' and that ``Isolating scientists who handle 
infectious agents will be detrimental to the program'' because ``The 
security requirements must enable unauthorized individuals to work 
together within the same physical space with [authorized] scientists.'' 
We made no changes based on these comments. We would defeat the purpose 
of the Act if we were to waive the security provisions. Those with 
access to select agents and toxins must meet the requirements of the 
regulations, including those requirements concerning security risk 
assessments. This would not prohibit escorted activities as long as the 
escorted scientists and technicians do not have access to select agents 
or toxins. We considered the potential cost of reduced collaboration 
among scientists, along with other non-quantifiable costs, as discussed 
in the section addressing ``Economic Impact.''
    Commenters asserted that the security provisions should be changed 
to ``allow people who are not approved * * * to enter the area without 
escort provided that (1) All select agents and toxins have been secured 
in locked cabinets, rooms or other containers, (2) The containers 
cannot be forced open without tools and without visible signs of 
damage; (3) Rooms are secure against entry by unauthorized personnel; 
(4) Keys, combinations, etc. are controlled as presently required; (5) 
Access to the area is limited to employees of the entity.'' Commenters 
argued that this approach ``is consistent with requirements [such as 
those in 10 CFR 95.25] for handling classified documents under which 
people without clearance may enter rooms without escort provided the 
documents are secured in cabinets. In addition, commenters argued that 
this approach would ``also reduce the burden on the Attorney General's 
office, allowing it to perform more extensive checks on a smaller 
number of individuals.'' Similarly, commenters asserted that the final 
rule should provide that when ``laboratories are used intermittently 
for select agent research, free access [should] be permitted when 
select agents and toxins are not in use and when the select agents and 
toxins are secured in a safe or other secured storage. We made no 
changes based on these comments. The security requirements are designed 
to prevent unauthorized access, theft, loss, or release of select 
agents and toxins. We believe the regulations already are consistent 
with commenter's approach.
    Commenters recommend the final rule distinguish between laboratory 
security and entity security. One commenter argued that ``In large 
academic settings it is possible for a fully secure laboratory facility 
to coexist with a functioning educational and research laboratory 
entity'' and ``Placing full security restrictions on a building 
primarily devoted to educational functions compromises an educational 
institution's ability to fulfill its primary functions.'' The commenter 
further argued that ``This, in turn, may force laboratories working 
with select agents to shut their biodefense studies or move 
elsewhere.'' We made no changes based on these comments. As discussed 
earlier, the security provisions are designed to prevent unauthorized 
access, theft, loss, or release of select agents and toxins. In most 
cases the security provisions would have little or no effect on the 
educational activities. The regulations require that an entity's 
security plan be designed according to a site-specific risk assessment. 
Such a risk assessment would take into consideration the security 
needed for a select agent laboratory in a large academic setting. 
However, we would defeat the purpose of the Act if we were to waive the 
security provisions to eliminate an impact on educational research 
conducted in the same laboratory that contains select agents and 
toxins.
Packages
    The amended interim final rule required the inspection of all 
packages upon entry to and exit from an area containing select agents 
or toxins. Commenters asserted that such a requirement is not practical 
because of the number of packages of laboratory supplies, autoclaved 
waste, etc. that enter and exit a select agent laboratory every day. 
Some argued that the inspection provisions should apply only for 
packages received after shipment or transfer. Some commenters argued 
that only random inspections should be conducted. Some commenters 
argued that more detail should be provided. After further review, we 
have determined that the security purpose would be met if entities were 
required to inspect only suspicious packages. We have changed the rule 
to reflect this determination.
    Commenters questioned who should be responsible for conducting the 
inspections of packages. Some commenters argued that the Responsible 
Official should be the one responsible for the inspections. We made no 
changes based on these comments. The final rule allows the entity to 
determine who should conduct the inspections of packages since the 
entity would be best able to determine the most appropriate and 
qualified individual for this activity.
Intra-Entity Transfers
    The amended interim final rule provided that an entity must 
establish a protocol for intra-entity transfers, including provisions 
for ensuring that the packaging, and movement from a laboratory to 
another laboratory or from a laboratory to a shipping place, is 
conducted under the supervision of an individual with a security risk 
assessment approval. Based on questions by commenters, we have changed 
this language to clarify that the requirements apply only to intra-
entity transfers of select agents and toxins. Commenters also argued 
that these provisions are not sufficiently restrictive since they could 
``allow an individual to leave a package of select agents temporarily 
unattended in an open air

[[Page 13308]]

lock: that is not security.'' They further asserted that ``Intra-entity 
movement of select agents, when outside access-controlled laboratory 
areas, should follow a documented chain of custody process that 
minimizes any possibility of diversion.'' In response, based on the 
reasons provided by the commenters, we changed these provisions to 
require that the select agents and toxins must be secured against 
theft, loss, or release during intra-entity transfer and the entity 
must provide for chain of custody documentation. The provisions of 
renumbered Sec.  73.17 (Records) already require recordkeeping that 
would establish the chain of custody.
Reporting
    The amended interim final rule required that suspicious persons or 
activities be reported to the Responsible Official. Commenters asserted 
that the finding of suspicious persons or activities should be reported 
to the local law enforcement agency, followed by notification to the 
RO.'' They argued that ``Local law enforcement agencies are staffed 24/
7/365 and they are equipped to deal with potential criminal aspects of 
suspicious activities.'' We made no changes based on this comment. We 
agree with the commenters that law enforcement agencies should be 
notified, but we believe the responsibility for reporting to the 
appropriate law enforcement agencies should be maintained by the 
Responsible Official.
Records
    The amended interim final rule required the security plan to 
describe cyber security. Commenters asserted that ``The data related to 
the select agents, in many cases, are almost as valuable as the select 
agents themselves'' and requested clarification regarding the assets 
intended to be covered by the term ``cyber security.'' Commenters also 
asserted that the term ``cyber security'' should be replaced with 
``information and cyber security.'' In response, we changed the 
language to require the security plan to contain procedures for 
``information systems control'' and thereby more clearly indicate what 
was intended.
Review
    The amended interim final rule states that ``The security plan must 
be reviewed by the RO at least annually and after any incident.'' 
Commenters recommended that this paragraph be revised to state ``The 
security plan must be reviewed, performance tested, and updated 
annually.'' We believe performance testing will help to ensure that the 
plan works and have changed the regulations to include these concepts.
Pre-Clearance
    A commenter expressed concerns that the regulations do not provide 
for preclearance of security plans before an entity invests in a 
security system. We made no changes based on the comment. The 
provisions in the Final Rule clearly set forth what must be included 
regarding the security requirements. However, those entities needing 
additional technical assistance may reference the BMBL or contact the 
Select Agent Program.
Administrative
    Commenters asserted that the final rule should designate who in the 
federal government is responsible for making determinations concerning 
the adequacy of the security plans. We made no changes based on this 
comment. The security plan must be sufficient to safeguard the select 
agent or toxin against unauthorized access, theft, loss, or release. 
The regulations allow for the delegation of authority of this function 
to the Select Agent staff or other appropriate office.
    Commenters argued that security plans, and all information related 
to the security systems, be protected at the ``Official Use Only'' 
level. We made no changes based on this comment. The protection of all 
information held by the Select Agent Program is an operational 
responsibility and not a matter appropriate for inclusion in Part 73. 
However, as a matter of both policy and practice, the information is 
protected at the ``Sensitive But Unclassified'' level.

Section 73.12 Biosafety

[This Subject Is in Sec.  73.10 in the Amended Interim Final Rule]
    The amended interim final rule provided that an entity subject to 
the part 73 regulations must develop and implement a safety plan and in 
developing a safety plan, an entity should consider:
    ``(1) The biosafety standards and requirements for BSL 2, 3, or 4 
operations, as they pertain to the respective select agents, that are 
contained in the CDC/NIH publication, ``Biosafety in Microbiological 
and Biomedical Laboratories,'' including all appendices except Appendix 
F.
    (2) The specific requirements for handling toxins found in 29 CFR 
part 1910.1450, ``Occupational Exposure to Hazardous Chemicals in 
Laboratories'' and/or 29 CFR part 1910.1200, ``Hazard Communication,'' 
whichever applies and specific requirements for handling toxins found 
in Appendix I in the CDC/NIH publication, ``Biosafety in 
Microbiological and Biomedical Laboratories.''
    (3) For provisions of the safety plan relating to genetic elements, 
recombinant nucleic acids and recombinant organisms, the ``NIH 
Guidelines for Research Involving Recombinant DNA Molecules,'' (NIH 
Guidelines). This includes, among other things, provisions regarding 
risk assessment, physical containment, biological containment, and 
local review and applies to all recombinant DNA research, regardless of 
funding.
    Commenters argued that we should retain the provisions concerning 
the safety plan without change. One commenter suggested that compliance 
with the documents listed in the preceding paragraph should be made 
mandatory for all entities subject to the rule. Other commenters 
asserted that we should adopt performance-based standards. The safety 
provisions were intended to avoid the creation of a ``one size fits 
all'' set of safety standards due to the vast diversity of both 
entities and the reasons why they possess, use, and transfer select 
agents and toxins. However, we amended the language of the final rule 
to establish performance-based safety provisions. Accordingly, under 
the final rule, entities must not only develop and implement a safety 
plan, but must develop a plan that is commensurate with the risk of the 
agent or toxin, given its intended use. Further, the biosafety plan 
must contain sufficient information and documentation to describe the 
biosafety and containment procedures. These provisions are designed to 
help ensure that the safety plan is effective.
    Commenters recommended that safety plans established for compliance 
with the HHS rule should be sufficient to meet the requirements for a 
safety plan under the USDA regulations. They argued that otherwise an 
entity must issue two safety plans. Commenters further asserted that 
USDA and HHS should develop joint safety requirements for select agents 
and toxins to supplant the BMBL and NIH Guidelines. We agreed with the 
commenters and HHS and USDA made this section identical to ensure 
consistency between the regulations.

Section 73.13 Restricted Experiments

[This Subject Is in Sec.  73.10 in the Amended Interim Final Rule]
    The amended interim final rule stated that an entity may not 
conduct certain experiments unless approved by the

[[Page 13309]]

HHS Secretary after consultation with experts. Commenters suggested 
that the following be considered for providing such consultation: The 
National Research Council, the NIH Recombinant DNA Advisory Committee, 
and the Select Agent Advisory Committee. One commenter argued that ``It 
is critical that this review committee comprise appropriate experts in 
microbiology, highly pathogenic microorganisms and laboratory safety to 
ensure the best possible science advice.'' We made no changes based on 
these comments. We agree that we should obtain advice from experts as 
needed for decision making and will consult with subject matter experts 
as necessary.
    One commenter expressed concern that the amended interim final rule 
did not contain a process for expert review and oversight of 
``dangerous experiments.'' We made no changes based on this comment. 
Under the regulations, we will review applications to determine whether 
the experiments can be safely conducted, will require whatever 
conditions are necessary for safety, and will consult with subject 
matter experts as necessary. Also, under the regulations, we have 
authority to conduct inspections as necessary to ensure that the 
conditions are met.
    One commenter raised issues regarding the deliberate formation of 
antibiotic resistance as a common research tool. The commenter asserted 
that if strictly imposed, the restricted experiment provisions would 
limit this standard research practice and provided an example 
concerning antibiotic resistance application. The commenter stated 
``Transposon insertion libraries are common experimental creations used 
to generate gene knockouts and study the effect on expression and 
phenotype'' and ``this often results in an array of genomes containing 
antibiotic resistance markers used for selection and screening.'' The 
commenter then argued that ``The method is common enough not to need 
approval from a cabinet level position and too burdensome if approval 
is needed for each of several thousand insertional mutants that would 
be created for a single genome.'' We made no changes based on this 
comment. It is important that researchers consider the possible 
unintended effects from the deliberate formation of antibiotic 
resistance. The restricted experiment provisions apply only if the 
activities ``could compromise the use of the drug to control disease 
agents in humans, veterinary medicine, or agriculture.'' We believe 
that the majority of research involving antibiotic resistant markers 
that are commonly used for selection and screening will not meet this 
criteria and therefore, will not require additional approval. Further, 
we believe that activities meeting this threshold should require such 
approval as has been the case for those entities subject to the ``NIH 
Guidelines for Research Involving Recombinant DNA Molecules''.
    The preamble to the initial interim final rule stated that we 
reserved a paragraph for possible future specification of additional 
types of experiments that might warrant stringent scrutiny in the 
interest of safety. One commenter argued that the following experiments 
should be added to the reserved paragraph based on the conclusion that 
they warrant such stringent scrutiny (i.e., should be allowed only if 
approved by the HHS Secretary after consultation with experts):
    (1) Experiments involving construction of vaccine-resistant select 
agents or toxins.
    (2) Experiments involving increasing the environmental stability of 
select agents or toxins.
    (3) Experiments involving powder or aerosol production of select 
agents or toxins (other than preparation of lyophilized reference 
specimen <10 mg).
    (4) Experiments involving powder or aerosol dispersal of select 
agents or toxins.
    We made no changes based on this comment. We are studying whether 
these and other types of experiments should be added to Sec.  73.13. 
Experiments will be proposed for addition to the listing of restricted 
experiments, as warranted, through the publication of a proposed 
amendment for public comment.
    Commenters argued that the regulations should not list types of 
experiments that require approval because of the difficulty of amending 
regulations as needs change. Instead, commenters argued that the list 
should be included in the NIH Guidelines. We made no changes based on 
these comments. Publishing such information in the regulations will 
ensure that the public, including affected entities, are provided 
adequate notice concerning the list of experiments requiring approval 
requirements.
    Commenters questioned whether the HHS Secretary should be involved 
in approving experiments. One commenter specifically questioned whether 
HHS has authority to proscribe experiments. We made no changes based on 
these comments. We believe we have such authority. In this regard, the 
Act at 42 U.S.C. 262a(c) states that the ``Secretary shall by 
regulation provide for the establishment and enforcement of standards 
and procedures governing possession and use of listed agents and toxins 
* * * in order to protect public health and safety.''
    We added provisions for how applicants are to submit a written 
request for approval.

Section 73.14 Incident Response

[This Subject Is in Sec.  73.12 in the Amended Interim Final Rule]
    The amended interim final rule provided that an entity required to 
register must develop and implement an emergency response plan that 
meets the requirements of OSHA Hazardous waste operations and emergency 
response standard at 29 CFR part 1910.120. With respect to these OSHA 
standards, paragraph (a) addresses scope, application, and definitions 
and paragraph (q) addresses emergency responses to hazardous substance 
releases. The provisions of 40 CFR part 311 make 29 CFR part 1910.120 
applicable to State and local government employees. The OSHA 
regulations also reference 29 CFR part 1910.38 which concerns the 
development and implementation of an emergency action plan.
    In the final rule, we have eliminated references to the OSHA 
provisions and have set forth the provisions from the OSHA regulations 
that would apply for an incident response plan. The OSHA regulations at 
29 CFR part 1910.120(q) include provisions for assisting in the 
handling of an emergency. Although entities handling select agents and 
toxins are subject to the OSHA regulations, our regulations are not 
intended to cover clean up operations but rather to ensure that 
entities are prepared to take whatever other action is necessary to 
respond to an incident. Also, we note that an entity may use all or a 
portion of a document prepared under other authorities as long as it 
meets the requirements of the incident response provisions of the part 
73 regulations.
    Commenters recommended that the incident response section of the 
final rule reference 29 CFR part 1910.1450 which concerns occupational 
exposure to hazardous chemicals in a laboratory. We made no changes 
based on this comment. Although entities may need to become familiar 
with the provisions of this section, it does not provide the basis for 
requirements under the part 73 regulations and we see no reason for 
referencing it in this section.
    One commenter asserted that the incident response provisions are 
``too stringent for select agents and toxins not

[[Page 13310]]

mandated for control within maximum containment facilities.'' The 
commenter asserted that ``These provisions are based in part on a GAO 
report that promotes threat and risk assessments in the planning of 
emergency responses to an actual domestic terrorist incident involving 
weapons of mass destruction and on OSHA regulations relating to 
hazardous waste sites'' and ``have little relevance to the inadvertent 
release or theft of select agents and toxins from biomedical research 
laboratories.'' We made no changes based on this comment. The commenter 
did not provide any specifics to support the general comment. We 
believe the incident response provisions are necessary to help ensure 
that entities plan ahead to be ready to take appropriate action to 
respond to any hazard that could arise.

Section 73.15 Training

[This Subject Is in Sec.  73.13 in the Amended Interim Final Rule]
    The training section in the amended interim final rule provided 
that a registered entity that falls outside of the OSHA Bloodborne 
Pathogen Standard (29 CFR part 1910.1030(a)) must provide safety and 
security information to any individual working in or visiting areas 
where select agents and toxins are handled or stored. Also, this 
section stated that: ``In lieu of initial training for those 
individuals already involved in handling select agents, the Responsible 
Official may certify in writing that the individual has the required 
knowledge, skills, and abilities to safely carry out the duties and 
responsibilities.'' Commenters argued against certification based on 
the conclusion that each facility is different and facility specific 
training must be required regardless of knowledge, skills, or ability. 
Also, commenters argued that Bloodborne Pathogen training would not be 
a suitable substitute for training specific to the use of select 
agents. To address these issues, commenters recommended the following 
wording: ``An entity required to register under this part must provide 
information and training on safety and security for working with select 
agents and toxins to each individual approved for access and each 
individual not approved for access from the HHS Secretary or 
Administrator working in or visiting areas where select agents and 
toxins are handled or stored. The training may be modified according to 
the needs of the individual, the work they will do and their potential 
exposure. The training need not duplicate training provided under the 
OSHA Bloodborne Pathogen Standard 29 CFR 1910.1030.'' We agree with the 
substance of these comments, including the reasons given for them. 
Accordingly, we made changes in Sec.  73.15 to clearly reflect the 
intent of the regulations.

Section 73.16 Transfers

[This Subject Is in Sec.  73.14 in the Amended Interim Final Rule]
    One commenter argued that ``receipt of select agents and toxins by 
the Responsible Official is a valuable procedural control to ensure 
that all required compliance measures are in place prior to final 
delivery of the agent to the Investigator'' and further asserted that 
``This procedure parallels the common and effective practice of 
requiring receipt of radionuclides by the Radiation Safety Officer 
prior to their distribution to the Principal Investigator.'' We made no 
changes based on this comment. The Responsible Official must approve 
the transfer and ultimately is responsible for compliance matters. 
However, we do not believe that it is necessary to require the 
Responsible Official to be the recipient. If a problem were to arise, 
the person having access and receiving the select agents or toxins 
would be the logical person to discover any issues or concerns related 
to the receipt of the select agents or toxins and advise the 
Responsible Official of such.
    The part 73 regulations do not impose requirements on the 
transportation in commerce or exportation of select agents or toxins. 
However, requirements are imposed by the government on the 
transportation in commerce and exportation of select agents and toxins, 
including the following:
     Agriculture (9 CFR parts 92, 94, 95 96, 121, 122 and 130),
     Commerce (15 CFR parts 730 to 799),
     Health and Human Services (42 CFR parts 71 and 72),
     Occupational Health and Safety Administration (29 CFR part 
1910.1030),
     Transportation (49 CFR parts 171 through 180), and
     Postal Service (39 CFR part 111).
    Commenters asserted that Sec.  73.11 should ``address the security 
of shipments while in transit between entities'' and that ``The current 
DOT requirement for external labeling on select agent packages should 
be eliminated.'' One commenter argued that ``transportation security 
needs to be addressed and required to be just as rigorous as security 
requirements for the labs.'' Another commenter argued that ``The fact 
that registered entities must comply with all applicable laws 
concerning packaging and labeling significantly increases the risk that 
select agents could be easily identified and diverted for illegal 
purposes during transportation by common carrier.'' Another commenter 
argued that ``The absence of requirements for registration, security 
risk assessments, and physical security for the common carriers that 
will be handling and transporting select agents between registered 
entities is cause for concern.'' Commenters also argued that ``Both the 
shipping and receiving entities should document a chain of custody for 
transfers of select agents'' and ``These chain of custody documents 
should be securely stored with the EA-101 form at both the shipping and 
receiving entities.'' Commenters also argued that ``tamper-indicating 
procedures should be included in the packaging so that the recipient 
would immediately know that the package he/she has received had been 
tampered with; this event should trigger an immediate report to HHS.'' 
We made no changes based on these comments. These issues are outside 
the scope of this rulemaking. However, we believe the provisions set 
forth in Sec.  73.16, in addition to the other Federal laws regulating 
the transportation of hazardous materials in commerce and exportation 
of select agents and toxins, sufficiently protect public health and 
safety.
    One commenter asserted that ``Intra-entity movement of select 
agents, when outside access-controlled laboratory areas, should follow 
a documented chain of custody process that minimizes any possibility of 
diversion.'' We made no changes based on this comment. The provisions 
of renumbered Sec.  73.17 (Records) already require recordkeeping that 
would establish the chain of custody.
    One commenter asserted that the transfer provisions should allow a 
non-registered entity to transfer a select agent or toxin to a 
registered entity based on the need to prevent destruction of valuable 
historical, archival or educational materials containing select agents 
or toxins. We agreed. Accordingly, we have added provisions to allow, 
on a case-by-case basis, the transfer of a select agent or toxin, not 
otherwise eligible for transfer.
    One commenter asserted that a unique identifier should be assigned 
to each Transfer of Select Agent Form (APHIS/CDC Form 2) based on the 
argument that they are necessary to track and audit transfers. We made 
no changes based on this comment. We already add a unique authorization 
number to each approved transfer form.

[[Page 13311]]

    One commenter recommended that the final rule require a response to 
a transfer request within an appropriate interval, e.g., 1-2 business 
days. We made no changes based on these comments. It is impractical to 
specify a time interval for the approval of a transfer request since 
the authorization of the request is dependent upon the review of 
appropriate records that confirm the individuals and entities currently 
meet all the requirements to transfer the select agents or toxins.
    The amended interim final rule provided that an entity must 
maintain transfer records for three years. Commenters asserted that the 
regulations should require that EA-101 forms be kept for five years. We 
made no changes based on these comments. Entities may wish to retain 
records for longer for three years. In keeping with the three year 
registration period, we did not extend the required time to keep 
records.
    The amended interim final rule did not set a time limit for 
transfers. We are adding a provision stating that a transfer 
authorization is valid only for 30 calendar days. This is necessary to 
efficiently manage the transfer authorization system and ensure timely 
resolution of outstanding transfer activities.
    The amended interim final rule stated that when the select agents 
or toxins are consumed or destroyed after a transfer, an entity must 
provide written notice within five business days of such action. We are 
deleting this provision. As noted above, under the registration 
provisions the Responsible Official must provide prompt notification in 
writing if a change occurs in any information submitted in the 
application for the certificate of registration or amendments. Since 
this would include adding or removing a select agent or toxin, there is 
no need for otherwise imposing a five-day notification requirement.
    The amended interim final rule required the submission of an 
immediate report by the recipient if ``the package received containing 
select agents or toxins had been leaking or was otherwise damaged.'' We 
clarified these provisions to require the submission of an immediate 
report by the recipient if the package had ``been damaged to the extent 
that a release of the select agent or toxin may have occurred'' because 
leaking may not be apparent (e.g., toxins). In addition, a damaged 
secondary container may not result in a compromised container to the 
extent that a release of the select agent or toxin may not have 
occurred. This more clearly expresses the intent and will help prevent 
a reader from concluding that an innocuous dent in a package must be 
reported.
    In addition, we have added the provisions that ``A select agent or 
toxin that is contained in a specimen for proficiency testing may be 
transferred without prior authorization from CDC or APHIS provided 
that, within 7 calendar days prior to the transfer, the sender reports 
to CDC or APHIS the select agent or toxin to be transferred and the 
name and address of the recipient'' for the tracking of select agents 
or toxins including those contained in a specimen presented for 
proficiency testing.

Section 73.17 Records

[This Subject Is Covered in Sec.  73.15 in the Amended Interim Final 
Rule]
    Commenters recommended that this section be revised to be 
performance based. We made no changes based on these comments. 
Performance-based requirements are appropriate when differing 
circumstances require flexibility in approach. The records section sets 
forth specific requirements which we believe apply fairly to all 
entities required to be registered.
    Commenters asserted that ``It is not feasible to record quantities 
(i.e., actual real-time numbers) of replicating organisms.'' Commenters 
recommended ``functional or performance based approaches to documenting 
replicating agents, such as using a logbook/data entry system to record 
information typically gathered during a research protocol as part of 
standard practice or GLP (i.e., quantity of material inoculated, 
quantity of media added during the work, quantity material used/
destroyed, final cell count, etc).'' In response to the comment, we 
clarified the language that ``accurate, current inventory for each 
select agent (including viral genetic elements, recombinant nucleic 
acids, and recombinant organisms) held in long-term storage (placement 
in a system designed to ensure viability for future use, such as in a 
freezer or lyophilized materials)'' must be maintained.
    One commenter argued that ``It will be difficult to maintain real 
time/current records * * * for internal transfers of select agents 
until badge readers or bar code readers (with data accessible by the 
RO) are installed for each laboratory and for each storage area'' and 
stated further that ``Until we are able to install these access 
controls, we request flexibility regarding access control.'' We made no 
changes based on this comment. An accurate and current inventory must 
be maintained in order to ensure accuracy of records.
    One commenter requested clarification regarding the phrase 
``certain records and databases.'' For clarification purposes, we 
specified that the ``certain records and databases'' are those records 
and databases required to be created under this part.
    The amended interim final rule stated ``for access to the area 
where select agents are used or stored that a record of the date and 
time the individual entered and left the area must be maintained.'' We 
are deleting the exiting record-keeping provision. We believe the 
requirements that entities maintain records of all entries into areas 
containing select agents or toxins, including the name of the 
individual, name of the escort (if applicable), the date and time of 
entry is sufficient in maintaining records of access into areas 
containing select agents and toxins.

Section 73.18 Inspections

[This Subject Is in Sec.  73.16 in the Amended Interim Final Rule]
    One commenter argued that for inspections ``a background in 
financial auditing alone is insufficient to review and critique the 
scientific practices and procedures involved'' and that ``Biosafety and 
biosecurity inspection teams should include professionals who have been 
educated and trained in, and have significant experience in, these 
multidisciplinary fields.'' We made no changes based on this comment. 
However, we agree with the commenter and our inspection teams include 
individuals who meet the criteria suggested by the commenter.
    APHIS and CDC will coordinate inspections to minimize the burden on 
the entity. This coordination will ensure that inspections by APHIS and 
CDC are not duplicative. However, additional inspections may be 
required under certain circumstances. For instance, another inspection 
may be required for amendments to a certificate of registration (e.g., 
addition of a laboratory) or to satisfy APHIS' permit requirements.

Section 73.19 Notification of Theft, Loss, or Release

[This Subject Is in Sec.  73.17 in the Amended Interim Final Rule]
    The amended interim final rule required reporting of theft, loss, 
or release of select agents or toxins. It required reporting of any 
``release of a select agent or toxin causing occupational exposure or 
release outside of the primary containment barriers.'' Commenters 
asserted that reporting should not be required for a release unless 
there was an occupational

[[Page 13312]]

exposure outside of the biocontainment area of a registered entity. 
Similarly, one commenter recommended that the term ``release'' be 
defined ``as an escape of a select agent or toxin to the external 
environment (outside the building), outside of the select agent/toxin 
laboratory (or restricted area) or a spill or other exposure in the 
laboratory resulting in an OSHA recordable injury or illness.'' 
Commenters argued that entities would have appropriate procedures for 
safely responding to and managing spills within biocontainment areas of 
a facility. They also argued that without such a change there would be 
a waste of resources, disruption of research, and avoidance of 
reporting. We believe that all occupational exposures should be 
reported since exposures have the potential to adversely affect the 
public health and safety. In addition, we clarified the language to 
require notification ``upon discovery of a release of an agent or toxin 
causing occupational exposure or release of select agent or toxin 
outside of the primary barriers of the biocontainment area.''
    One commenter opposed the reporting requirements for theft or loss 
of select agents and toxins based on the following assertions:
     Because of the improved recordkeeping requirements, 
illegal diversion of a select agent will most likely be done by 
subculturing an agent out of a vial without removing the vial or a 
detectable amount of material.
     It is likely that the unexplained disappearance of 
individual vials will not be noticed at the time of loss but days, 
weeks, months, years, or decades later making reconstruction of the 
circumstances virtually impossible.
     The unexplained absence of a vial of a select agent will 
most likely result from errors in the original inventory, or failure to 
adjust the inventory when vials are used legitimately.
    We made no changes based on these assertions. To take no action 
when select agents or toxins are unaccounted for would reduce the 
ability of the HHS Secretary to respond in a timely matter to protect 
public health and safety.
    One commenter noted that the amended interim final rule required 
safety and security ``incident'' reports but did not define events that 
constitute ``incidents.'' The commenter questioned ``Is any failure to 
comply with the regulations an ``incident''?'' and indicated that an 
``incident'' should be limited to ``any occurrence or event which 
results, or threatens to result, in the unlawful transfer, possession, 
or use of a select agent or in the loss, theft, or other unauthorized 
transfer, use, or release of a select agent.'' In response to this 
comment, we clarified the regulations to require reporting of thefts, 
losses, or releases.
    An entity must notify immediately CDC, APHIS, and appropriate 
Federal, State, or local law enforcement agencies upon discovery of the 
theft or loss of a select agent or toxin. In addition to other 
information required to be submitted, we have added the requirement 
that advises the entity to report the list of Federal, State, or local 
law enforcement agencies that the entity reported or intends to report 
the theft or loss. This will help coordinate the response effort.

Section 73.20 Administrative Review

[This Subject Is in Sec.  73.18 in the Amended Interim Final Rule]
    Commenters argued that the appeal provisions should have more 
detail. We made no changes based on these comments. Any additional 
appeal procedures will be provided, as necessary at the time of an 
appeal.
    Commenters argued that the regulations should impose timeframes for 
making appeal decisions. We made no changes based on these comments. We 
will act to make decisions as quickly as possible. However, our first 
concern must be to make appropriate decisions that help to protect 
public health and safety.
    Commenters asserted that the part 73 regulations should contain an 
administrative appeals procedure for researchers to request review of a 
designation as a ``restricted person'' or provide an exemption process 
for legitimate research. Commenters asserted that ``the absence of an 
appeals or exemption process is troubling given the possible 
inaccuracies in the information contained in the databases that are 
available to the Federal Government and others.'' We made no changes 
based on these comments. The Act prohibits a person designated as a 
restricted person from obtaining approval to have access to select 
agents or toxins and we have no authority to act contrary to the Act. 
However, individuals may challenge factual mistakes as described in the 
administrative appeal process for Section 73.20 (Administrative 
review).

Submissions and Forms

[This Subject Is in Sec.  73.21 in the Amended Interim Final Rule]
    We received no comments concerning submissions and forms section. 
Since addresses and telephone numbers are subject to change, we deleted 
this section. Specific guidance on the submissions and forms is 
available to the public on the Select Agent Program web site.
    In addition, we recognize that the different form numbers for 
identical forms may be confusing to the regulated community. 
Accordingly, CDC and APHIS will be adopting a shared numbering system 
for the identical forms that uses the prefix ``APHIS/CDC Form''.

------------------------------------------------------------------------
                                                          APHIS/CDC form
   CDC form No.    APHIS form No.      Title of form            No.
------------------------------------------------------------------------
0.1319...........            2040  Application for                     1
                                    Laboratory
                                    Registration for
                                    Possession, Use, and
                                    Transfer of Select
                                    Agents and Toxins.
EA-101...........            2041  Report of Transfer of               2
                                    Select Agents and
                                    Toxins.
0.1316...........            2043  Report of Theft,                    3
                                    Loss, or Release of
                                    Select Agents and
                                    Toxins.
0.1318...........            2044  Report of                           4
                                    Identification of a
                                    Select Agents or
                                    Toxin in a Clinical
                                    or Diagnostic
                                    Laboratory.
0.1317...........            2042  Request for Exemption               5
                                    of Select Agents and
                                    Toxins for Public
                                    Health or
                                    Agricultural
                                    Emergency or
                                    Investigational/
                                    Experimental Product.
------------------------------------------------------------------------

Section 73.21 Civil Money Penalties

[This Subject Is in Sec.  73.19 in the Amended Interim Final Rule]
    One commenter recommended that entities be subjected to much higher 
maximum civil money penalties than individuals. We made no changes 
based on this comment. The maximum amounts for civil monetary 
penalties, set by statute, are in fact higher for entities than for 
individuals. As indicated earlier, however, we are making one technical 
revision to 42 CFR part 1003 by adding amendatory language in the 
introductory paragraph for Sec.  1003.106(a)(1) to reference OIG's

[[Page 13313]]

newly codified penalty authority set forth in Sec.  1003.102(b)(16).

Criminal Penalties

[This Subject Is in Sec.  73.20 in the Amended Interim Final Rule]
    We received no comments concerning criminal penalties. Since this 
section restates the provisions of the Act, we deleted this section.
Miscellaneous
    We made nonsubstantive changes throughout the regulations for 
purposes of clarity. In addition, CDC and APHIS made the language 
similar to ensure consistency between the regulations.
Economic Impact
    A dozen commenters addressed issues relevant to the rule's 
Regulatory Impact Analysis (RIA). Nearly all of these comments were 
submitted by universities or related organizations.
    One commenter agreed with HHS's regulatory benefits analysis, i.e., 
that adequate security for select agents is crucial to protect health 
and safety, and that the potential costs of accidental or intentional 
release of a select agent or toxin could far exceed the costs 
institutions will incur to implement the new regulations.
    Approximately eight commenters stated that the cost of the rule 
would be significantly greater than estimated by CDC. Several 
university commenters reported estimated costs higher than CDC's 
estimates. These comments reported first year costs ranging from $1 
million to $4 million, with annual maintenance costs thereafter from 
nearly $100,000 to up to $700,000 (compared to CDC's estimated 
annualized cost of $153,000). One university reported an estimate of 
$300,000 in security improvements, including electronic card access, 
alarm systems, and security cameras, all of which are suggested in the 
rule, but excluding recordkeeping and other personnel requirements.\2\ 
For these same items, another university reported an estimate of 
$400,000 for a single university BSL-3 select agent lab, excluding 
other select agent labs at the same university. Another commenter 
reported that several large universities have estimated that their 
costs will greatly exceed CDC's estimates. Some commenters argued that 
the full cost of implementing the rule will not be known until CDC 
reviews and approves of individual safety and security plans.
---------------------------------------------------------------------------

    \2\ Other requirements described as contributing significantly 
to costs include recordkeeping, additional staff, and cyber/
information security and training.
---------------------------------------------------------------------------

    One commenter stated that the rule would have been found to have a 
significant overall effect, far exceeding $100 million annually, if 
factors such as lost research productivity and indirect institutional 
costs had been considered. In addition, several commenters stated that 
the requirements would reduce the number of institutions and locations 
where select agent research will be performed. One stated that the 
requirements may be too costly and difficult for smaller entities and 
may cause them to forego work with select agents and toxins. One 
commenter cautioned against the loss of specimens, which comprise a 
``library of infectious diseases.'' Several commenters felt that non-
quantifiable impacts such as these, in turn, would impede the 
accumulation of knowledge, decrease the level of talent studying select 
agents, and shift knowledge outside of the U.S.
    Several commenters questioned whether universities would be able to 
recover the costs of the rule given cost recovery practices, 
requirements, and caps. Other commenters asked or suggested that grant 
money be made available to cover the cost of the rule, either through 
current grant programs or new select agent infrastructure support 
grants. Others requested more generally that the final rule address 
mechanisms by which universities would recover the cost of compliance. 
One stated than an exemption of the minimum cost cap would be 
appropriate to ensure compliance. Some commenters (including State 
universities) cited already significant budget constraints. A few 
commenters stated that the costs of the rule represent an unfunded 
mandate unless a means of cost recovery is made available.
    We carefully considered each of the comments that addressed the 
RIA, including the issues raised regarding non-quantifiable and 
indirect costs of the rule and the data presented. Based on this 
review, we determined that it was not necessary to revise the economic 
analysis to address the comments, although we did revise the RIA based 
on rule changes and newly-available data, as described later in this 
section. In passing the Public Health Security and Bioterrorism 
Preparedness and Response Act of 2002, Congress recognized that it was 
an important matter of national security to ensure that entities that 
possess, use, or transfer biological agents and toxins with the 
potential to pose a severe threat to humans met their responsibilities 
to keep these agents and toxins safe and secure. Development of both 
the amended interim final rule and the final rule took into 
consideration the potential economic impact of compliance with the 
biosecurity and physical security requirements. These costs and 
benefits were addressed in detail in the Regulatory Impact Analysis 
done for both the amended interim final rule and the final rule.
    Although some commenters cited figures to support their assertion 
that the RIA understated the cost of the rule, the information provided 
within these comments generally did not contradict the conclusions 
presented in the RIA. For example, we believe the $4 million first-year 
cost and $700,000 annual maintenance cost that was reported by one of 
the commenters actually is consistent with the RIA, because the 
commenter represents a State-wide university system containing 10 
schools; if the reported figures are divided across even five or six of 
the system's schools, then the reported costs are similar to those 
estimated in the RIA. Similarly, various comments estimated one-time 
costs at $400,000 for partial upgrades at one lab, and at $300,000 for 
partial upgrades at a different lab. Absent further details regarding 
the specific types of labs involved and the need for other upgrades, 
however, these figures appear to fall within the estimated RIA values.
    The comments, in general, did not contain sufficient information to 
call the RIA's conclusions into questions. For example, one university 
estimated its one-time cost to be in excess of $1 million, which would 
appear to exceed the RIA's model facility estimate by 40 percent. In 
this case, however, the comment did not contain any additional 
information that would allow CDC to either validate the university's 
estimate or evaluate whether the particular lab might be an outlier 
with respect to costs.
    We agree that the RIA has not attempted to quantify the value of 
lost research and other indirect institutional effects. We considered 
such effects, however, and for several reasons, we disagree with the 
contention that indirect effects would lead to overall impacts 
exceeding $100 million annually. First, based on our experience with 
the pre-notification and registration process, we believe there will be 
few instances where universities abandon lines of research in response 
to the rule. Out of the 200 or so entities that transferred or 
destroyed their select agents rather than registering under the rule, 
we believe that the majority did so for reasons that do not threaten 
future research, as suggested by the following three typical examples: 
(1) Researchers who already have completed efforts

[[Page 13314]]

under past research grants; (2) universities that continue their select 
agent research but at fewer locations within the university system; and 
(3) hospitals that had used select agents for purposes other than 
research (e.g., quality assurance testing) but which can readily 
substitute other agents. Second, even if an institution did discontinue 
its research, we expect that this research would not be ``lost.'' 
Instead, other universities likely would pick up these research lines, 
particularly research efforts funded through grants. Therefore, any 
research effects are likely to be small including, in particular, any 
shift of knowledge on select agents to outside of the U.S. Third, to 
the extent that any net reduction in research or other negative 
institutional effects were to occur, quantification of these effects 
would be highly speculative.
    In conjunction with the development of the revised final rule, we 
revised the RIA in a number of respects and reduced the estimated cost 
of the rule to an annualized total of $16 million. The economic 
analysis were estimated based on the actual costs incurred by 
registering entities implementing the interim final rule that became 
fully applicable on November 12, 2003. This estimate reflects the cost 
of all incremental activities required by the final rule, which for the 
most part are the same activities as were initially required by the 
2002 interim final rule. (Very few of the changes made by the final 
rule have any bearing on cost relative to the interim final rule.) \3\ 
Nevertheless, the $16 million cost represents a substantial decrease 
relative to the $41 million figure estimated in 2002 for the interim 
final rule. The decline is due almost entirely to the availability of 
new data showing that (1) fewer entities registered with CDC than had 
been estimated, (2) fewer individuals required security risk 
assessments, and (3) a smaller number of transfers occur each year than 
was estimated.
---------------------------------------------------------------------------

    \3\ First, the final rule eliminates an interim final rule 
provision (along with the associated costs) requiring laboratories 
to notify the HHS Secretary when destroying select agents or toxins 
for the purpose of discontinuing activities with the select agent or 
toxin. Second, the final rule adds a provision that laboratories 
test and evaluate the effectiveness of their biosafety, security, 
and incident response plans annually.
---------------------------------------------------------------------------

    We considered the possibility that the smaller numbers reflected in 
the actual data (relative to earlier estimates) might be the result of 
indirect impacts of the rule (e.g., entities abandoning research rather 
than undertaking the registration process). Our experience during the 
pre-notification and registration process suggests, however, that this 
is not the case. Instead, we believe the original estimates were 
overstated as a result of the over-inclusive notification process we 
used to help ensure that all potentially affected entities would be 
made aware of the rule. Most of the overestimates reflect entities that 
have since notified us that they are not affected by the rule (e.g., 
users of Botox) or that they are exempt entities. Others possess agents 
that would be considered excluded from the regulation. While we believe 
that 200 or so entities did transfer or destroy their select agents 
rather than register under the rule, we believe that the majority did 
so for reasons that do not threaten future research, as discussed 
previously.
    With respect to the comments concerning any ``unfunded mandate'' 
imposed by the rule, we note that while the rule imposes certain costs 
on the regulated community, to reduce the burden of these new 
regulations the biosecurity and physical security requirements 
contained in this rule are based on guidance provided by the 
``Biosafety in Microbioloical and Biomedical Laboratories,'' 4th 
Edition, published jointly by the CDC and the National Institutes of 
Health. Whether the federal government should provide funding for 
enhanced biosafety and physical security at facilities using select 
agents and toxins is beyond the scope of the regulations mandated by 
the Public Health Security and Bioterrorism Preparedness and Response 
Act of 2002.

Paperwork Reduction Act

    In accordance with section 3507(d) of the Paperwork Reduction Act 
of 1995 (44 U.S.C. 3501 et seq.), the information collection or 
recordkeeping requirements included in this final rule have been 
approved by the Office of Management and Budget (OMB) under OMB control 
number 0920-0576. However, CDC is requesting an emergency clearance 
from OMB regarding this data collection with a 10 day public comment 
period. The emergency clearance is based on a revision of this data 
collection as a result of this final rule.
    Please send written comments on the new information collection 
contained in this final rule to Seleda M. Perryman, CDC Assistant 
Reports Clearance Officer, 1600 Clifton Road, MS-D24, Atlanta, GA 
30333. Written comments should be received within 10 days of this 
notice.
    Copies of this information collection may be obtained from Seleda 
M. Perryman, CDC Assistant Reports Clearance Officer, at (404) 371-
5973.
    CDC is requesting continued OMB approval to collect this 
information through the use of five separate forms. These forms are: 
(1) Application for Registration, (2) Transfer of Select Agent or Toxin 
Form, (3) Facility Notification of Theft, Loss, or Release Form, (4) 
Clinical and Diagnostic Laboratory Reporting Form, and (5) Request for 
Exemption.

Reductions in Burden of Data Collection

    The amended interim final rule stated that an entity must provide 
written notice at least five business days before destroying a select 
agent or toxin, if the destruction would be for the purpose of 
discontinuing activities with a select agent or toxin covered by a 
certificate of registration. The amended interim final rule further 
stated that ``This will allow the HHS Secretary and/or the USDA 
Secretary to observe the destruction or take other action as 
appropriate.'' We are deleting this provision. Under the registration 
provisions, the Responsible Official must provide prompt notification 
in writing, if a change occurs in any information submitted in the 
application for the certificate of registration or amendments. This 
would include adding or removing a select agent or toxin and it was 
determined that to impose an additional five-day notification 
requirement was not necessary. Therefore, there is a decrease in burden 
that was previously reported by the estimated time of 30 minutes to 
gather the information and submit this notification.
    The amended interim final rule stated that when the select agents 
or toxins are consumed or destroyed after a transfer, an entity must 
provide written notice within five business days of such action. We are 
deleting this provision. As noted above, under the registration 
provisions the Responsible Official must provide prompt notification in 
writing if a change occurs in any information submitted in the 
application for the certificate of registration or amendments. Since 
this would include removing a select agent or toxin from a registration 
due to it being consumed or destroyed after a transfer, it was 
determined that there is no need to impose this additional five-day 
notification requirement. Therefore, there is a decrease in burden that 
was previously reported by the estimated time of 15 minutes to gather 
the information and submit this notification.

[[Page 13315]]

Potential Increases in Burden of Data Collection

    The amended interim final rule stated entities required to register 
under this part must immediately notify a theft, loss, or release of 
select agent or toxin. We added the provisions that exempted clinical 
or diagnostic laboratories and other entities that possess, use, or 
transfer a select agent or toxin that is contained in a specimen 
presented for diagnosis, verification, or proficiency testing must also 
meet the requirements of Sec.  73.19 (Notification of theft, loss, or 
release). We believe that any theft, loss, or release of a select agent 
or toxin must be reported to protect public health and safety. Based 
upon the small number of reports received during the implementation of 
the Interim Final Rule, we believe that this would not result in a 
change in burden.
    The amended interim final rule stated entities were required to 
report immediate notification to CDC for any of the following overlap 
select agents: Bacillus anthracis, Botulinum neurotoxins, and 
Francisella tularensis and immediately notify APHIS of all overlap 
select agents and toxins. In this final rule, CDC and APHIS have 
combined their immediate notification list for overlap select agents 
and toxins (Bacillus anthracis, Botulinum neurotoxins, Brucella 
melitensis, Francisella tularensis, Hendra virus, Nipah virus, Rift 
Valley fever virus, and Venezuelan equine encephalitis virus). 
Therefore, entities will be able to immediately notify either agency. 
Since entities were required to immediately notify both agencies in 
regards to overlap select agents and toxins and now only have to notify 
one agency, we believe that due to the small number of such reports 
received this would not result in a change in burden, but a change in 
process for the regulated community.
    In addition, we have added the provisions in Sec.  73.16 
(Transfers) section that ``A select agent or toxin that is contained in 
a specimen for proficiency testing may be transferred without prior 
authorization from CDC or APHIS provided that, within seven calendar 
days prior to the transfer, the sender reports to CDC or APHIS the 
select agent or toxin to be transferred and the name and address of the 
recipient'' for the tracking of select agents or toxins including those 
contained in a specimen presented for proficiency testing. Due to the 
small number of the ``Report of Identification of a Select Agents or 
Toxin in a Clinical or Diagnostic Laboratory'' forms received regarding 
proficiency testing specimens that were required to report under the 
current Interim Final Rule, we believe that this notification 
requirement would not result in a change in burden.

Executive Order 12866 and Regulatory Flexibility Act

    This document has been reviewed by the Office of Management and 
Budget under Executive Order 12866. In the course of developing the 
rule, CDC considered the rule's costs and benefits. CDC's analysis is 
summarized below.
    Affected Entities. To date, 451 entities have submitted an 
application for registration and 350 have been determined by CDC to 
require registration. The remaining 101 applications were not processed 
primarily because CDC determined that the entities sought to register 
for something other than a select agent. The 350 registered entities 
fall within six groups:
     Academic/University: 105 (approximately 30 percent);
     Government--State/Local: 104 (approximately 30 percent);
     Government--Federal: 61 (approximately 17 percent);
     Commercial: 39 (approximately 11 percent);
     Private non-profit/Research Institutions: 35 
(approximately 10 percent); and
     Other: 6 (approximately 2 percent).
    Approximately 8,394 staff has received a security risk assessment 
approval since the requirement to submit information to the Attorney 
General became effective on April 12, 2003. The number of employees 
with access to select agents or toxins ranges from approximately five 
individuals at smaller facilities to one hundred or more at some large 
universities and commercial facilities.
    Costs. The estimation of the long term cost of implementing the 
select agent regulations was based on the actual costs incurred by 
registering entities implementing the interim final rule that became 
fully applicable on November 12, 2003. Additionally, before the interim 
final rule was issued in December 2002, CDC contacted a number of 
entities to assess existing practices. Because many of the laboratories 
that will register under this rule are already substantially in 
compliance with the practices required, the costs of the rule are 
relatively limited.
    In combining the estimated impact of the interim final rule with 
any new impacts in the final rule, CDC estimates the total annualized 
cost of the final rule at $16 million,\4\ with annualized costs per 
facility ranging from $15,300 to $170,000. CDC had originally estimated 
the total annualized cost of the interim final rule at $40 million. The 
revised estimate of $16 million incorporates improved estimates of the 
number of registered entities. We estimate that the costs of the rule 
will not exceed $100 million in any single year; therefore the rule is 
not economically significant under Executive Order 12866. We estimate 
the first-year costs of the rule for all affected entities to total $36 
million (compared to the previous estimate for the interim final rule 
of $106 million), with subsequent annual costs totaling $14 million 
(compared to the previous estimate for the interim final rule of $30 
million). On a per facility basis, the average costs of the rule range 
from $15,300 to $170,000 per facility, slightly higher on average than 
those estimated for the interim final rule ($9,000 to $198,000). This 
increase is due to the net effect of a few particular changes in the 
final rule,\5\ but the costs may be overstated due to conservative 
assumptions used in the absence of better information. These cost 
estimates exclude the cost of any indirect impacts resulting from the 
rule, although, as previously discussed, we believe that any indirect 
impacts are likely to be minimal.
---------------------------------------------------------------------------

    \4\ Costs are annualized over 20 years at a 7 percent discount 
rate.
    \5\ First, the final rule eliminates an interim final rule 
provision (along with the associated costs) requiring laboratories 
to notify the HHS Secretary when destroying select agents or toxins 
for the purpose of discontinuing activities with the select agent or 
toxin. Second, the final rule adds a provision that laboratories 
test and evaluate the effectiveness of their biosafety, security, 
and incident response plans annually.
---------------------------------------------------------------------------

    Benefits. The benefits to public health and safety from 
implementation of the rule are clear, although difficult to quantify. 
The benefits of the final rule will be the decreased risk of accidental 
or intentional release of a select agent or toxin derived from the 
establishment of Federal standards for biosafety, security, training, 
and personnel surety. The cost of such an event in human life could be 
very high. The release of a select agent or toxin could result in a 
public health emergency requiring an extensive and expensive response. 
This effort could include extensive public health measures, such as 
quarantine, preventative treatment and health testing for large numbers 
of potentially exposed persons, and extensive decontamination. 
Substantial costs could be incurred by hospitals and other medical 
facilities and institutions of government at all levels. A release, or 
widespread fear of one, also would

[[Page 13316]]

create significant secondary effects. It could disrupt business, 
transportation, and many other aspects of normal behavior, on both a 
short-term and potentially a long-term basis.
    The impacts resulting from the October 2001 anthrax attacks provide 
an example of the costs that a release could incur. The anthrax attacks 
caused five fatalities and 17 illnesses, disrupted business and 
government activities, and caused widespread apprehension and changes 
in behavior. Costs included more than $23 million to decontaminate one 
Senate office building; approximately $2 billion in revenues lost to 
the postal service, and as much as $3 billion in additional costs to 
the postal service for cleanup of contamination and procurement of 
mailsanitizing equipment. Substantial costs due to lost productivity 
throughout the economy and from ongoing costs of the investigations 
into the incident are additional impacts.
    Implementation of the final rule will continue to provide a means 
for the registration of those who possess select agents and toxins; 
ensure that their transfer, storage, and use can be tracked; provide 
for the screening of personnel with access to such agents or toxins; 
and require that entities in possession of such agents or toxins 
develop and implement effective means of biosafety and physical 
security. The benefit of these provisions is a reduced likelihood of 
either an accidental or intentional release of select agents and toxins 
and the consequent avoidance of costs associated with such a release.
    Impacts resulting from the costs of the rule should not be 
significant. The annualized cost on small entities would not exceed one 
percent of sales or revenue stream and the initial cost would not 
exceed three percent of sales or revenue stream. A copy of the economic 
analysis, ``Regulatory Impact Analysis, 42 CFR part 73, Possession, 
Use, and Transfer of Select Biological Agents and Toxins Final Rule,'' 
is available from on the CDC Web site at http://www.cdc.gov. The HHS 
Secretary hereby certifies that the final rule will not have a 
significant economic impact on a substantial number of small entities.
    One commenter stated the rule did not adequately address the cost 
of compliance and believed that the interim final rule had created an 
unfunded mandate. We made no changes based on this comment. In passing 
the Public Health Security and Bioterrorism Preparedness and Response 
Act of 2002, Congress recognized that it was an important matter of 
national security to ensure that entities that possess, use, or 
transfer biological agents and toxins with the potential to pose a 
severe threat to humans met their responsibilities to keep these agents 
and toxins safe and secure. Development of both the amended interim 
final rule and the final rule took into consideration the potential 
economic impact of compliance with the biosecurity and physical 
security requirements. These costs and benefits were addressed in 
detail in the Regulatory Impact Analysis done for both the amended 
interim final rule and the final rule. We do not believe that the 
select agent regulations created an unfunded mandate. Since each entity 
is unique depending on the select agents and toxins in its possession, 
use of those agents and toxins, and the laboratory facility and 
physical plants, we stated biosecurity and physical security 
requirements in performance standards that we believe were already 
industry standards. For example, the biosecurity standards rely on the 
guidance provided by the Biosafety in Microbiological and Biomedical 
Laboratories, 4th Edition jointly published by the CDC and the National 
Institutes of Health. Whether the federal government should provide 
funding for enhanced biosafety and physical security at facilities 
using select agents and toxins is beyond the scope of the regulations 
mandated by the Public Health Security and Bioterrorism Preparedness 
and Response Act of 2002.

Unfunded Mandates

    The Unfunded Mandates Reform Act requires, at 2 U.S.C. 1532 that 
agencies prepare an assessment of anticipated costs and benefits before 
developing any rule that may result in an expenditure by State, local, 
or tribal governments, in the aggregate, or by the private sector of 
$100 million or more in any given year. This rule does not result in 
such an expenditure.

Executive Order 12988

    This rule has been reviewed under Executive Order 12988, Civil 
Justice Reform. This rule: (1) Preempts all State and local laws and 
regulations that are inconsistent with this rule; (2) has no 
retroactive effect; and (3) does not require administrative proceedings 
before parties may file suit in court challenging this rule.

List of Subjects

42 CFR Part 72

    Biologics, Packaging and containers, Penalties, Reporting and 
recordkeeping requirements, Transportation.

42 CFR Part 73

    Biologics, Incorporation by reference, Packaging and containers, 
Penalties, Reporting and recordkeeping requirements, Transportation.

42 CFR Part 1003

    Administrative practice and procedure, Fraud, Grant programs--
health, Health facilities, Health professions, Maternal and child 
health, Medicaid, Medicare, Penalties, Social security.

    Dated: March 10, 2005.
Michael O. Leavitt,
Secretary.

42 CFR Chapter I--Public Health Service, Department of Health and Human 
Services


Sec.  72.4  Notice of delivery; failure to receive.

0
For the reasons stated in the preamble, 42 CFR Chapter I is amended as 
follows:

PART 72--[AMENDED]

0
1. The authority citation for part 72 continues to read as follows:

    Authority: 42 U.S.C. 264, 271; 31 U.S.C. 9701; 18 U.S.C. 3559, 
3571; 42 U.S.C. 262 note.


0
2. Add the following sentence at the end of Sec.  72.4: * * * This 
section does not apply to select agents and toxins that are subject to 
requirements under the provisions of 42 CFR 73.16 concerning transfers 
of select agents and toxins.

0
3. Revise Sec.  72.6 to read as follows:


Sec.  72.6  Exemptions.


    (a) through (g) [Reserved].
    (h) For purposes of 18 U.S.C. 175b, the exemptions to the list 
referred to in Appendix A constitute the exemptions set forth at 42 CFR 
73.5 and 73.6.

0
4. Revise Appendix A to part 72 to read as follows:

Appendix A to Part 72--Select Agents

    For purposes of 18 U.S.C. 175b, the list of select agents 
constitutes the list of select agents and toxins set forth at 42 CFR 
73.3 and 73.4.

0
5. For the reasons stated in the preamble, 42 CFR part 73 is revised to 
read as follows:

PART 73--SELECT AGENTS AND TOXINS

Sec.
73.1 Definitions.
73.2 Purpose and scope.
73.3 HHS select agents and toxins.
73.4 Overlap select agents and toxins.
73.5 Exemptions for HHS select agents and toxins.

[[Page 13317]]

73.6 Exemptions for overlap select agents and toxins.
73.7 Registration and related security risk assessments.
73.8 Denial, revocation, or suspension of registration.
73.9 Responsible Official.
73.10 Restricting access to select agents and toxins; security risk 
assessments.
73.11 Security.
73.12 Biosafety.
73.13 Restricted experiments.
73.14 Incident response.
73.15 Training.
73.16 Transfers.
73.17 Records.
73.18 Inspections.
73.19 Notification of theft, loss, or release.
73.20 Administrative review.
73.21 Civil money penalties.

    Authority: 42 U.S.C. 262a; sections 201-204, 221 and 231 of 
Title II of Public Law 107-188, 116 Stat. 637 (42 U.S.C. 262a).


Sec.  73.1  Definitions.

    For purposes of this part:
    Administrator means the Administrator, Animal and Plant Health 
Inspection Service, or any person authorized to act for the 
Administrator.
    Animal and Plant Health Inspection Service (APHIS) means the Animal 
and Plant Health Inspection Service of the U.S. Department of 
Agriculture.
    Attorney General means the Attorney General of the United States or 
any person authorized to act for the Attorney General.
    Biological agent means any microorganism (including, but not 
limited to, bacteria, viruses, fungi, rickettsiae, or protozoa), or 
infectious substance, or any naturally occurring, bioengineered, or 
synthesized component of any such microorganism or infectious 
substance, capable of causing death, disease, or other biological 
malfunction in a human, an animal, a plant, or another living organism; 
deterioration of food, water, equipment, supplies, or material of any 
kind; or deleterious alteration of the environment.
    CDC means Centers for Disease Control and Prevention of the 
Department of Health and Human Services.
    Diagnosis means the analysis of specimens for the purpose of 
identifying or confirming the presence or characteristics of a select 
agent or toxin provided that such analysis is directly related to 
protecting the public health or safety, animal health or animal 
products, or plant health or plant products.
    Entity means any government agency (Federal, State, or local), 
academic institution, corporation, company, partnership, society, 
association, firm, sole proprietorship, or other legal entity.
    HHS means the Department of Health and Human Services.
    HHS Secretary means the Secretary of the Department of Health and 
Human Services or his or her designee, unless otherwise specified.
    HHS select agent and/or toxin means a biological agent or toxin 
included in Sec.  73.3.
    Overlap select agent and/or toxin means a biological agent or toxin 
listed in Sec.  73.4 and 9 CFR part 121.4.
    Principal investigator means the one individual who is designated 
by the entity to direct a project or program and who is responsible to 
the entity for the scientific and technical direction of that project 
or program.
    Proficiency testing means the process of determining the competency 
of an individual or laboratory to perform a specified test or 
procedure.
    Responsible Official means the individual designated by an entity 
with the authority and control to ensure compliance with the 
regulations in this part.
    Select agent and/or toxin means unless otherwise specified, all of 
the biological agents or toxins listed in Sec. Sec.  73.3 and 73.4.
    Specimen means samples of material from humans, animals, plants or 
the environment or isolates or cultures from such samples for the 
diagnosis, verification, or proficiency testing.
    State means any of the several States of the United States, the 
Commonwealth of the Northern Mariana Islands, the Commonwealth of 
Puerto Rico, the District of Columbia, Guam, the Virgin Islands of the 
United States, or any other territory or possession of the United 
States.
    Toxin means the toxic material or product of plants, animals, 
microorganisms (including, but not limited to, bacteria, viruses, 
fungi, rickettsiae, or protozoa), or infectious substances, or a 
recombinant or synthesized molecule, whatever their origin and method 
of production, and includes any poisonous substance or biological 
product that may be engineered as a result of biotechnology, produced 
by a living organism; or any poisonous isomer or biological product, 
homolog, or derivative of such a substance.
    United States means all of the States.
    USDA means the United States Department of Agriculture.
    Verification means the demonstration of obtaining established 
performance (e.g., accuracy, precision, and the analytical sensitivity 
and specificity) specifications for any procedure used for diagnosis.


Sec.  73.2  Purpose and scope.

    This part implements the provisions of the Public Health Security 
and Bioterrorism Preparedness and Response Act of 2002 setting forth 
the requirements for possession, use, and transfer of select agents and 
toxins. The biological agents and toxins listed in this part have the 
potential to pose a severe threat to public health and safety, to 
animal health, or to animal products. Overlap select agents and toxins 
are subject to regulation by both CDC and APHIS.


Sec.  73.3  HHS select agents and toxins.

    (a) Except for exclusions under paragraphs (d) and (e) of this 
section, the HHS Secretary has determined that the biological agents 
and toxins listed in this section have the potential to pose a severe 
threat to public health and safety.
    (b) HHS select agents and toxins:

Abrin
Cercopithecine herpesvirus 1 (Herpes B virus)
Coccidioides posadasii
Conotoxins
Crimean-Congo haemorrhagic fever virus
Diacetoxyscirpenol
Ebola viruses
Lassa fever virus
Marburg virus
Monkeypox virus
Ricin
Rickettsia prowazekii
Rickettsia rickettsii
Saxitoxin
Shiga-like ribosome inactivating proteins
South American Haemorrhagic Fever viruses (Junin, Machupo, Sabia, 
Flexal, Guanarito)
Tetrodotoxin
Tick-borne encephalitis complex (flavi) viruses (Central European 
Tick-borne encephalitis, Far Eastern Tick-borne encephalitis 
[Russian Spring and Summer encephalitis, Kyasanur Forest disease, 
Omsk Hemorrhagic Fever])
Variola major virus (Smallpox virus) and Variola minor virus 
(Alastrim)
Yersinia pestis

    (c) Genetic Elements, Recombinant Nucleic Acids, and Recombinant 
Organisms:
    (1) Nucleic acids that can produce infectious forms of any of the 
select agent viruses listed in paragraph (b) of this section.
    (2) Recombinant nucleic acids that encode for the functional 
form(s) of any of the toxins listed in paragraph (b) of this section if 
the nucleic acids:
    (i) Can be expressed in vivo or in vitro, or
    (ii) Are in a vector or recombinant host genome and can be 
expressed in vivo or in vitro.
    (3) HHS select agents and toxins listed in paragraph (b) of this 
section that have been genetically modified.

[[Page 13318]]

    (d) HHS select agents or toxins that meet any of the following 
criteria are excluded from the requirements of this part:
    (1) Any HHS select agent or toxin that is in its naturally 
occurring environment provided the select agent or toxin has not been 
intentionally introduced, cultivated, collected, or otherwise extracted 
from its natural source.
    (2) Non-viable HHS select agents or nonfunctional HHS toxins.
    (3) HHS toxins under the control of a principal investigator, 
treating physician or veterinarian, or commercial manufacturer or 
distributor, if the aggregate amount does not, at any time, exceed the 
following amounts: 100 mg of Abrin; 100 mg of Conotoxins; 1,000 mg of 
Diacetoxyscirpenol; 100 mg of Ricin; 100 mg of Saxitoxin; 100 mg of 
Shiga-like ribosome inactivating proteins; or 100 mg of Tetrodotoxin.
    (e) An attenuated strain of a HHS select agent or toxin may be 
excluded from the requirements of this part based upon a determination 
that the attenuated strain does not pose a severe threat to public 
health and safety.
    (1) To apply for an exclusion, an individual or entity must submit 
a written request and supporting scientific information. A written 
decision granting or denying the request will be issued. An exclusion 
will be effective upon notification to the applicant. Exclusions will 
be published periodically in the notice section of the Federal Register 
and will be listed on the CDC Web site at http://www.cdc.gov/.
    (2) If an excluded attenuated strain is subjected to any 
manipulation that restores or enhances its virulence, the resulting 
select agent or toxin will be subject to the requirements of this part.
    (3) An individual or entity may make a written request to the HHS 
Secretary for reconsideration of a decision denying an exclusion 
application. The written request for reconsideration must state the 
facts and reasoning upon which the individual or entity relies to show 
the decision was incorrect. The HHS Secretary will grant or deny the 
request for reconsideration as promptly as circumstances allow and will 
state, in writing, the reasons for the decision.
    (f) Any HHS select agent or toxin seized by a Federal law 
enforcement agency will be excluded from the requirements of this part 
during the period between seizure of the select agent or toxin and the 
transfer or destruction of such agent or toxin provided that:
    (1) As soon as practicable, the Federal law enforcement agency 
transfers the seized select agent or toxin to an entity eligible to 
receive such agent or toxin or destroys the agent or toxin by a 
recognized sterilization or inactivation process,
    (2) The Federal law enforcement agency safeguards and secures the 
seized select agent or toxin against theft, loss, or release, and 
reports any theft, loss, or release of such agent or toxin, and
    (3) The Federal law enforcement agency reports the seizure of the 
select agent or toxin to CDC or APHIS.
    (i) The seizure of Ebola viruses, Lassa fever virus, Marburg virus, 
South American Haemorrhagic Fever virus (Junin, Machupo, Sabia, Flexal, 
Guanarito), Variola major virus (Smallpox virus), Variola minor 
(Alastrim), or Yersinia pestis must be reported within 24 hours by 
telephone, facsimile, or e-mail. This report must be followed by 
submission of APHIS/CDC Form 4 within seven calendar days after seizure 
of the select agent or toxin.
    (ii) For all other HHS select agents or toxins, APHIS/CDC Form 4 
must be submitted within seven calendar days after seizure of the agent 
or toxin.
    (iii) A copy of APHIS/CDC Form 4 must be maintained for three 
years.
    (4) The Federal law enforcement agency reports the final 
disposition of the select agent or toxin by submission of APHIS/CDC 
Form 4. A copy of the completed form must be maintained for three 
years.


Sec.  73.4  Overlap select agents and toxins.

    (a) Except for exclusions under paragraphs (d) and (e) of this 
section, the HHS Secretary has determined that the biological agents 
and toxins listed in this section have the potential to pose a severe 
threat to public health and safety, to animal health, or to animal 
products.
    (b) Overlap select agents and toxins:

Bacillus anthracis
Botulinum neurotoxins
Botulinum neurotoxin producing species of Clostridium
Brucella abortus
Brucella melitensis
Brucella suis
Burkholderia mallei (formerly Pseudomonas mallei)
Burkholderia pseudomallei (formerly Pseudomonas pseudomallei)
Clostridium perfringens epsilon toxin
Coccidioides immitis
Coxiella burnetii
Eastern Equine Encephalitis virus
Francisella tularensis
Hendra virus
Nipah virus
Rift Valley fever virus
Shigatoxin
Staphylococcal enterotoxins
T-2 toxin
Venezuelan Equine Encephalitis virus

    (c) Genetic Elements, Recombinant Nucleic Acids, and Recombinant 
Organisms:
    (1) Nucleic acids that can produce infectious forms of any of the 
overlap select agent viruses listed in paragraph (b) of this section.
    (2) Recombinant nucleic acids that encode for the functional 
form(s) of any overlap toxins listed in paragraph (b) of this section 
if the nucleic acids:
    (i) Can be expressed in vivo or in vitro, or
    (ii) Are in a vector or recombinant host genome and can be 
expressed in vivo or in vitro.
    (3) Overlap select agents and toxins listed in paragraph (b) of 
this section that have been genetically modified.
    (d) Overlap select agents or toxins that meet any of the following 
criteria are excluded from the requirements of this part:
    (1) Any overlap select agent or toxin that is in its naturally 
occurring environment provided that the select agent or toxin has not 
been intentionally introduced, cultivated, collected, or otherwise 
extracted from its natural source.
    (2) Non-viable overlap select agents or nonfunctional overlap 
toxins.
    (3) Overlap toxins under the control of a principal investigator, 
treating physician or veterinarian, or commercial manufacturer or 
distributor, if the aggregate amount does not, at any time, exceed the 
following amounts: 0.5 mg of Botulinum neurotoxins; 100 mg of 
Clostridium perfringens epsilon toxin; 100 mg of Shigatoxin; 5 mg of 
Staphylococcal enterotoxins; or 1,000 mg of T-2 toxin.
    (e) An attenuated strain of an overlap select agent or toxin may be 
excluded from the requirements of this part based upon a determination 
that the attenuated strain does not pose a severe threat to public 
health and safety, to animal health, or to animal products.
    (1) To apply for an exclusion, an individual or entity must submit 
a written request and supporting scientific information. A written 
decision granting or denying the request will be issued. An exclusion 
will be effective upon notification to the applicant. Exclusions will 
be published periodically in the notice section of the Federal Register 
and will be listed on the CDC Web site at http://www.cdc.gov/.
    (2) If an excluded attenuated strain is subjected to any 
manipulation that restores or enhances its virulence, the resulting 
overlap select agent or toxin will be subject to the requirements of 
this part.

[[Page 13319]]

    (3) An individual or entity may make a written request to the HHS 
Secretary for reconsideration of a decision denying an exclusion 
application. The written request for reconsideration must state the 
facts and reasoning upon which the individual or entity relies to show 
the decision was incorrect. The HHS Secretary will grant or deny the 
request for reconsideration as promptly as circumstances allow and will 
state, in writing, the reasons for the decision.
    (f) Any overlap select agent or toxin seized by a Federal law 
enforcement agency will be excluded from the requirements of this part 
during the period between seizure of the select agent or toxin and the 
transfer or destruction of such agent or toxin provided that:
    (1) As soon as practicable, the Federal law enforcement agency 
transfers the seized select agent or toxin to an entity eligible to 
receive such agent or toxin or destroys the agent or toxin by a 
recognized sterilization or inactivation process,
    (2) The Federal law enforcement agency safeguards and secures the 
seized select agent or toxin against theft, loss, or release, and 
reports any theft, loss, or release of such agent or toxin, and
    (3) The Federal law enforcement agency reports the seizure of the 
overlap select agent or toxin to CDC or APHIS.
    (i) The seizure of Bacillus anthracis, Botulinum neurotoxins, 
Brucella melitensis, Francisella tularensis, Hendra virus, Nipah virus, 
Rift Valley fever virus, or Venezuelan equine encephalitis virus must 
be reported within 24 hours by telephone, facsimile, or e-mail. This 
report must be followed by submission of APHIS/CDC Form 4 within seven 
calendar days after seizure of the select agent or toxin.
    (ii) For all other overlap select agents or toxins, APHIS/CDC Form 
4 must be submitted within seven calendar days after seizure of the 
select agent or toxin.
    (iii) A copy of APHIS/CDC Form 4 must be maintained for three 
years.
    (4) The Federal law enforcement agency reports the final 
disposition of the overlap select agent or toxin by the submission of 
APHIS/CDC Form 4. A copy of the completed form must be maintained for 
three years.


Sec.  73.5  Exemptions for HHS select agents and toxins.

    (a) Clinical or diagnostic laboratories and other entities that 
possess, use, or transfer a HHS select agent or toxin that is contained 
in a specimen presented for diagnosis or verification will be exempt 
from the requirements of this part for such agent or toxin contained in 
the specimen, provided that:
    (1) Unless directed otherwise by the HHS Secretary, within seven 
calendar days after identification, the select agent or toxin is 
transferred in accordance with Sec.  73.16 or destroyed on-site by a 
recognized sterilization or inactivation process,
    (2) The select agent or toxin is secured against theft, loss, or 
release during the period between identification of the select agent or 
toxin and transfer or destruction of such agent or toxin, and any 
theft, loss, or release of such agent or toxin is reported, and
    (3) The identification of the select agent or toxin is reported to 
CDC or APHIS and to other appropriate authorities when required by 
Federal, State, or local law.
    (i) The identification of any of the following HHS select agents or 
toxins must be immediately reported by telephone, facsimile, or e-mail: 
Ebola viruses, Lassa fever virus, Marburg virus, South American 
Haemorrhagic Fever viruses (Junin, Machupo, Sabia, Flexal, Guanarito), 
Variola major virus (Smallpox virus), Variola minor (Alastrim), or 
Yersinia pestis. This report must be followed by submission of APHIS/
CDC Form 4 within seven calendar days after identification.
    (ii) For all other HHS select agents or toxins, APHIS/CDC Form 4 
must be submitted within seven calendar days after identification.
    (iii) Less stringent reporting may be required based on 
extraordinary circumstances, such as a widespread outbreak.
    (iv) A copy of APHIS/CDC Form 4 must be maintained for three years.
    (b) Clinical or diagnostic laboratories and other entities that 
possess, use, or transfer a HHS select agent or toxin that is contained 
in a specimen presented for proficiency testing will be exempt from the 
requirements of this part for such agent or toxin contained in the 
specimen, provided that:
    (1) Unless directed otherwise by the HHS Secretary, within 90 
calendar days of receipt, the select agent or toxin is transferred in 
accordance with Sec.  73.16 or destroyed on-site by a recognized 
sterilization or inactivation process,
    (2) The select agent or toxin is secured against theft, loss, or 
release during the period between identification of the select agent or 
toxin and transfer or destruction of such agent or toxin, and the 
theft, loss, or release of such agent or toxin is reported, and
    (3) The identification of the select agent or toxin, and its 
derivative, is reported to CDC or APHIS and to other appropriate 
authorities when required by Federal, State, or local law. To report 
the identification of a select agent or toxin, APHIS/CDC Form 4 must be 
submitted within 90 calendar days of receipt of the select agent or 
toxin. A copy of the completed form must be maintained for three years.
    (c) Unless the HHS Secretary issues an order making specific 
provisions of this part applicable to protect public health and safety, 
products that are, bear, or contain listed select agents or toxins that 
are cleared, approved, licensed, or registered under any of the 
following laws, are exempt from the provisions of this part insofar as 
their use meets the requirements of such laws:
    (1) The Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et 
seq.),
    (2) Section 351 of the Public Health Service Act pertaining to 
biological products (42 U.S.C. 262),
    (3) The Act commonly known as the Virus-Serum-Toxin Act (21 U.S.C. 
151-159), or
    (4) The Federal Insecticide, Fungicide, and Rodenticide Act (7 
U.S.C. 136 et seq.).
    (d) The HHS Secretary may exempt from the requirements of this part 
an investigational product that is, bears, or contains a select agent 
or toxin, when such product is being used in an investigation 
authorized under any Federal Act and additional regulation under this 
part is not necessary to protect public health and safety.
    (1) To apply for an exemption, an individual or entity must submit 
a completed APHIS/CDC Form 5.
    (2) The HHS Secretary shall make a determination regarding the 
application within 14 calendar days after receipt, provided the 
application meets all of the requirements of this section and the 
application establishes that the investigation has been authorized 
under the cited Act. A written decision granting or denying the request 
will be issued.
    (3) The applicant must notify CDC or APHIS when an authorization 
for an investigation no longer exists. This exemption automatically 
terminates when such authorization is no longer in effect.
    (e) The HHS Secretary may temporarily exempt an individual or 
entity from the requirements of this part based on a determination that 
the exemption is necessary to provide for the timely participation of 
the individual or entity in response to a domestic or foreign public 
health emergency. With respect to the emergency involved, the exemption 
may not exceed 30 calendar days, except that one extension of an 
additional 30

[[Page 13320]]

calendar days may be granted. To apply for an exemption or an extension 
of an exemption, an individual or entity must submit a completed APHIS/
CDC Form 5 establishing the need to provide for the timely 
participation of the individual or entity in a response to a domestic 
or foreign public health emergency. A written decision granting or 
denying the request will be issued.


Sec.  73.6  Exemptions for overlap select agents and toxins.

    (a) Clinical or diagnostic laboratories and other entities that 
possess, use, or transfer an overlap select agent or toxin that is 
contained in a specimen presented for diagnosis or verification will be 
exempt from the requirements of this part for such agent or toxin 
contained in the specimen, provided that:
    (1) Unless directed otherwise by the HHS Secretary or 
Administrator, within seven calendar days after identification, the 
select agent or toxin is transferred in accordance with Sec.  73.16 or 
9 CFR part 121.16 or destroyed on-site by a recognized sterilization or 
inactivation process,
    (2) The select agent or toxin is secured against theft, loss, or 
release during the period between identification of the select agent or 
toxin and transfer or destruction of such agent or toxin, and any 
theft, loss, or release of such agent or toxin is reported, and
    (3) The identification of the select agent or toxin is reported to 
CDC or APHIS and to other appropriate authorities when required by 
Federal, State, or local law.
    (i) The identification of any of the following overlap select 
agents or toxins must be immediately reported by telephone, facsimile, 
or e-mail: Bacillus anthracis, Botulinum neurotoxins, Brucella 
melitensis, Francisella tularensis, Hendra virus, Nipah virus, Rift 
Valley fever virus, or Venezuelan equine encephalitis virus. This 
report must be followed by submission of APHIS/CDC Form 4 within seven 
calendar days after identification.
    (ii) For all other overlap select agents or toxins, APHIS/CDC Form 
4 must be submitted within seven calendar days after identification.
    (iii) Less stringent reporting may be required based on 
extraordinary circumstances, such as a widespread outbreak.
    (iv) A copy of APHIS/CDC Form 4 must be maintained for three years.
    (b) Clinical or diagnostic laboratories and other entities that 
possess, use, or transfer an overlap select agent or toxin that is 
contained in a specimen presented for proficiency testing will be 
exempt from the requirements of this part for such agent or toxin 
contained in the specimen, provided that:
    (1) Unless directed otherwise by the HHS Secretary or 
Administrator, within 90 calendar days of receipt, the select agent or 
toxin is transferred in accordance with Sec.  73.16 or 9 CFR part 
121.16 or destroyed on-site by a recognized sterilization or 
inactivation process,
    (2) The select agent or toxin is secured against theft, loss, or 
release during the period between identification of the select agent or 
toxin and transfer or destruction of such agent or toxin, and the 
theft, loss, or release of such agent or toxin is reported, and
    (3) The identification of the select agent or toxin, and its 
derivative, is reported to CDC or APHIS and to other appropriate 
authorities when required by Federal, State, or local law. To report 
the identification of an overlap select agent or toxin, APHIS/CDC Form 
4 must be submitted within 90 calendar days of receipt of the select 
agent or toxin. A copy of the completed form must be maintained for 
three years.
    (c) Unless the HHS Secretary issues an order making specific 
provisions of this part applicable to protect public health and safety, 
products that are, bear, or contain listed select agents or toxins that 
are cleared, approved, licensed, or registered under any of the 
following laws, are exempt from the provisions of this part insofar as 
their use meets the requirements of such laws:
    (1) The Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et 
seq.),
    (2) Section 351 of the Public Health Service Act pertaining to 
biological products (42 U.S.C. 262),
    (3) The Act commonly known as the Virus-Serum-Toxin Act (21 U.S.C. 
151-159), or
    (4) The Federal Insecticide, Fungicide, and Rodenticide Act (7 
U.S.C. 136 et seq.).
    (d) The HHS Secretary, after consultation with Administrator, may 
exempt from the requirements of this part an investigational product 
that is, bears, or contains an overlap select agent or toxin, may be 
exempted when such product is being used in an investigation authorized 
under any Federal Act and additional regulation under this part is not 
necessary to protect public health and safety.
    (1) To apply for an exemption, an individual or entity must submit 
a completed APHIS/CDC Form 5.
    (2) The HHS Secretary shall make a determination regarding the 
application within 14 calendar days after receipt, provided the 
application meets all of the requirements of this section and the 
application establishes that the investigation has been authorized 
under the cited Act. A written decision granting or denying the request 
will be issued.
    (3) The applicant must notify CDC or APHIS when an authorization 
for an investigation no longer exists. This exemption automatically 
terminates when such authorization is no longer in effect.
    (e) The HHS Secretary may temporarily exempt an individual or 
entity from the requirements of this part based on a determination that 
the exemption is necessary to provide for the timely participation of 
the individual or entity in response to a domestic or foreign public 
health emergency. With respect to the emergency involved, the exemption 
may not exceed 30 calendar days, except that one extension of an 
additional 30 calendar days may be granted. To apply for an exemption 
or an extension of an exemption, an individual or entity must submit a 
completed APHIS/CDC Form 5 establishing the need to provide for the 
timely participation of the individual or entity in a response to a 
domestic or foreign public health emergency. A written decision 
granting or denying the request will be issued.
    (f) Upon request of the Administrator, the HHS Secretary may exempt 
an individual or entity from the requirements of this part, for 30 
calendar days if the Administrator has granted the exemption for 
agricultural emergency. The HHS Secretary may extend the exemption once 
for an additional 30 calendar days.


Sec.  73.7  Registration and related security risk assessments.

    (a) Unless exempted under Sec.  73.5, an individual or entity shall 
not possess, use, or transfer any HHS select agent or toxin without a 
certificate of registration issued by the HHS Secretary. Unless 
exempted under Sec.  73.6 or 9 CFR part 121.6, an individual or entity 
shall not possess, use, or transfer overlap select agents or toxins, 
without a certificate of registration issued by the HHS Secretary and 
Administrator.
    (b) As a condition of registration, each entity must designate an 
individual to be its Responsible Official. While most registrants are 
likely to be entities, in the event that an individual applies for and 
is granted a certificate of registration, the individual will be 
considered the Responsible Official.
    (c)(1) As a condition of registration, the following must be 
approved by the HHS Secretary or Administrator based

[[Page 13321]]

on a security risk assessment by the Attorney General:
    (i) The individual or entity,
    (ii) The Responsible Official, and
    (iii) Unless otherwise exempted under this section, any individual 
who owns or controls the entity.
    (2) Federal, State, or local governmental agencies, including 
public accredited academic institutions, are exempt from the security 
risk assessments for the entity and the individual who owns or controls 
such entity.
    (3) An individual will be deemed to own or control an entity under 
the following conditions: \1\
---------------------------------------------------------------------------

    \1\ These conditions may apply to more than one individual.
---------------------------------------------------------------------------

    (i) For a private institution of higher education, an individual 
will be deemed to own or control the entity if the individual is in a 
managerial or executive capacity with regard to the entity's select 
agents or toxins or with regard to the individuals with access to the 
select agents or toxins possessed, used, or transferred by the entity.
    (ii) For entities other than institutions of higher education, an 
individual will be deemed to own or control the entity if the 
individual:
    (A) Owns 50 percent or more of the entity, or is a holder or owner 
of 50 percent or more of its voting stock, or
    (B) Is in a managerial or executive capacity with regard to the 
entity's select agents or toxins or with regard to the individuals with 
access to the select agents or toxins possessed, used, or transferred 
by the entity.
    (4) An entity will be considered to be an institution of higher 
education if it is an institution of higher education as defined in 
section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)), 
or is an organization described in 501(c)(3) of the Internal Revenue 
Code of 1986, as amended (26 U.S.C. 501(c)(3)).
    (5) To obtain a security risk assessment, an individual or entity 
must submit the information necessary to conduct a security risk 
assessment to the Attorney General.
    (d) To apply for a certificate of registration that covers only HHS 
select agents or toxins, an individual or entity must submit the 
information requested in the registration application package (APHIS/
CDC Form 1) to CDC. To apply for a certificate of registration that 
does not cover only HHS select agents or toxins (i.e., covers at least 
one overlap select agent and/or toxin, or covers any combination of HHS 
select agents and/or toxins and USDA select agents and/or toxins), an 
individual or entity must submit the information requested in the 
registration application package (APHIS/CDC Form 1) to CDC or APHIS, 
but not both.
    (e) Prior to the issuance of a certificate of registration, the 
Responsible Official must promptly provide notification of any changes 
to the application for registration by submitting the relevant page(s) 
of the registration application.
    (f) The issuance of a certificate of registration may be contingent 
upon inspection or submission of additional information, such as the 
security plan, biosafety plan, incident response plan, or any other 
documents required to be prepared under this part.
    (g) A certificate of registration will be valid for one physical 
location (a room, a building, or a group of buildings) where the 
Responsible Official will be able to perform the responsibilities 
required in this part, for specific select agents or toxins, and for 
specific activities.
    (h) A certificate of registration may be amended to reflect changes 
in circumstances (e.g., replacement of the Responsible Official or 
other personnel changes, changes in ownership or control of the entity, 
changes in the activities involving any select agents or toxins, or the 
addition or removal of select agents or toxins).
    (1) Prior to any change, the Responsible Official must apply for an 
amendment to a certificate of registration by submitting the relevant 
page(s) of the registration application.
    (2) The Responsible Official will be notified in writing if an 
application to amend a certificate of registration has been approved. 
Approval of the amendment may be contingent upon an inspection or 
submission of additional information, such as the security plan, 
biosafety plan, incident response plan, or any other documents required 
to be prepared under this part.
    (3) No change may be made without such approval.
    (i) An entity must immediately notify CDC or APHIS if it loses the 
services of its Responsible Official. In the event that an entity loses 
the services of its Responsible Official, an entity may continue to 
possess or use select agents or toxins only if it appoints as the 
Responsible Official another individual who has been approved by the 
HHS Secretary or Administrator following a security risk assessment by 
the Attorney General and who meets the requirements of this part.
    (j) A certificate of registration will be terminated upon the 
written request of the entity if the entity no longer possesses or uses 
any select agents or toxins and no longer wishes to be registered.
    (k) A certificate of registration will be valid for a maximum of 
three years.


Sec.  73.8  Denial, revocation, or suspension of registration.

    (a) An application may be denied or a certificate of registration 
revoked or suspended if:
    (1) The individual or entity, the Responsible Official, or an 
individual who owns or controls the entity is within any of the 
categories described in 18 U.S.C. 175b,
    (2) The individual or entity, the Responsible Official, or an 
individual who owns or controls the entity as reasonably suspected by 
any Federal law enforcement or intelligence agency of:
    (i) Committing a crime specified in 18 U.S.C. 2332b(g)(5),
    (ii) Knowing involvement with an organization that engages in 
domestic or international terrorism (as defined in 18 U.S.C. 2331) or 
with any other organization that engages in intentional crimes of 
violence, or
    (iii) Being an agent of a foreign power (as defined in 50 U.S.C. 
1801).
    (3) The individual or entity does not meet the requirements of this 
part, or
    (4) It is determined that such action is necessary to protect 
public health and safety.
    (b) Upon revocation or suspension of a certificate of registration, 
the individual or entity must:
    (1) Immediately stop all use of each select agent or toxin covered 
by the revocation or suspension order,
    (2) Immediately safeguard and secure each select agent or toxin 
covered by the revocation or suspension order from theft, loss, or 
release, and
    (3) Comply with all disposition instructions issued by the HHS 
Secretary for the select agent or toxin covered by the revocation or 
suspension.
    (c) Denial of an application for registration and revocation of 
registration may be appealed under Sec.  73.20. However, any denial of 
an application for registration or revocation of a certificate of 
registration will remain in effect until a final agency decision has 
been rendered.


Sec.  73.9  Responsible Official.

    (a) An individual or entity required to register under this part 
must designate an individual to be the Responsible Official. The 
Responsible Official must:
    (1) Be approved by the HHS Secretary or Administrator following a 
security risk assessment by the Attorney General,
    (2) Be familiar with the requirements of this part,

[[Page 13322]]

    (3) Have authority and responsibility to act on behalf of the 
entity,
    (4) Ensure compliance with the requirements of this part, and
    (5) Ensure that annual inspections are conducted for each 
laboratory where select agents or toxins are stored or used in order to 
determine compliance with the requirements of this part. The results of 
each inspection must be documented, and any deficiencies identified 
during an inspection must be corrected.
    (b) An entity may designate one or more individuals to be an 
alternate Responsible Official, who may act for the Responsible 
Official in his/her absence. These individuals must have the authority 
and control to ensure compliance with the regulations when acting as 
the Responsible Official.
    (c) The Responsible Official must report the identification and 
final disposition of any select agent or toxin contained in a specimen 
presented for diagnosis or verification.
    (1) The identification of any of the following select agents or 
toxins must be immediately reported by telephone, facsimile, or e-mail: 
Bacillus anthracis, Botulinum neurotoxins, Brucella melitensis, 
Francisella tularensis, Ebola viruses, Hendra virus, Marburg virus, 
Lassa fever virus, Nipah virus, Rift Valley fever virus, South American 
Haemorrhagic Fever viruses (Junin, Machupo, Sabia, Flexal, Guanarito), 
Variola major virus (Smallpox virus), Variola minor (Alastrim), 
Venezuelan equine encephalitis virus, or Yersinia pestis. The final 
disposition of the agent or toxin must be reported by submission of 
APHIS/CDC Form 4 within seven calendar days after identification. A 
copy of the completed form must be maintained for three years.
    (2) To report the identification and final disposition of any other 
select agent or toxin, APHIS/CDC Form 4 must be submitted within seven 
calendar days after identification. A copy of the completed form must 
be maintained for three years.
    (3) Less stringent reporting may be required based on extraordinary 
circumstances, such as a widespread outbreak.
    (d) The Responsible Official must report the identification and 
final disposition of any select agent or toxin contained in a specimen 
presented for proficiency testing. To report the identification and 
final disposition of a select agent or toxin, APHIS/CDC Form 4 must be 
submitted within 90 calendar days of receipt of the agent or toxin. A 
copy of the completed form must be maintained for three years.


Sec.  73.10  Restricting access to select agents and toxins; security 
risk assessments.

    (a) An individual or entity required to register under this part 
may not provide an individual access to a select agent or toxin, and an 
individual may not access a select agent or toxin, unless the 
individual is approved by the HHS Secretary or Administrator, following 
a security risk assessment by the Attorney General.
    (b) An individual will be deemed to have access at any point in 
time if the individual has possession of a select agent or toxin (e.g., 
ability to carry, use, or manipulate) or the ability to gain possession 
of a select agent or toxin.
    (c) Each individual with access to select agents or toxins must 
have the appropriate education, training, and/or experience to handle 
or use such agents or toxins.
    (d) To apply for access approval, each individual must submit the 
information necessary to conduct a security risk assessment to the 
Attorney General.
    (e) An individual's security risk assessment may be expedited upon 
written request by the Responsible Official and a showing of good cause 
(e.g., public health or agricultural emergencies, national security, or 
a short term visit by a prominent researcher). A written decision 
granting or denying the request will be issued.
    (f) An individual's access approval will be denied or revoked if 
the individual is within any of the categories described in 18 U.S.C. 
175b,
    (g) An individual's access approval may be denied, limited, or 
revoked if:
    (1) The individual is reasonably suspected by any Federal law 
enforcement or intelligence agency of committing a crime specified in 
18 U.S.C. 2332b(g)(5), knowing involvement with an organization that 
engages in domestic or international terrorism (as defined in 18 U.S.C. 
2331) or with any other organization that engages in intentional crimes 
of violence, or being an agent of a foreign power (as defined in 50 
U.S.C. 1801), or
    (2) It is determined such action is necessary to protect public 
health and safety.
    (h) An individual may appeal the HHS Secretary's decision to deny, 
limit, or revoke access approval under Sec.  73.20.
    (i) Access approval is valid for a maximum of five years.
    (j) The Responsible Official must immediately notify CDC or APHIS 
when an individual's access to select agents or toxins is terminated by 
the entity and the reasons therefore.


Sec.  73.11  Security.

    (a) An individual or entity required to register under this part 
must develop and implement a written security plan. The security plan 
must be sufficient to safeguard the select agent or toxin against 
unauthorized access, theft, loss, or release.
    (b) The security plan must be designed according to a site-specific 
risk assessment and must provide graded protection in accordance with 
the risk of the select agent or toxin, given its intended use. The 
security plan must be submitted upon request.
    (c) The security plan must:
    (1) Describe procedures for physical security, inventory control, 
and information systems control,
    (2) Contain provisions for the control of access to select agents 
and toxins,
    (3) Contain provisions for routine cleaning, maintenance, and 
repairs,
    (4) Establish procedures for removing unauthorized or suspicious 
persons,
    (5) Describe procedures for addressing loss or compromise of keys, 
passwords, combinations, etc. and protocols for changing access numbers 
or locks following staff changes,
    (6) Contain procedures for reporting unauthorized or suspicious 
persons or activities, loss or theft of select agents or toxins, 
release of select agents or toxins, or alteration of inventory records, 
and
    (7) Contain provisions for ensuring that all individuals with 
access approval from the HHS Secretary or Administrator understand and 
comply with the security procedures.
    (d) An individual or entity must adhere to the following security 
requirements or implement measures to achieve an equivalent or greater 
level of security:
    (1) Allow access only to individuals with access approval from the 
HHS Secretary or Administrator,
    (2) Allow individuals not approved for access from the HHS 
Secretary or Administrator to conduct routine cleaning, maintenance, 
repairs, or other activities not related to select agents or toxins 
only when continuously escorted by an approved individual,
    (3) Provide for the control of select agents and toxins by 
requiring freezers, refrigerators, cabinets, and other containers where 
select agents or toxins are stored to be secured against unauthorized 
access (e.g., card access system, lock boxes),
    (4) Inspect all suspicious packages before they are brought into or 
removed from the area where select agents or toxins are used or stored,
    (5) Establish a protocol for intra-entity transfers under the 
supervision of an individual with access approval from the HHS 
Secretary or Administrator, including chain-of-custody documents

[[Page 13323]]

and provisions for safeguarding against theft, loss, or release,
    (6) Require that individuals with access approval from the HHS 
Secretary or Administrator refrain from sharing with any other person 
their unique means of accessing a select agent or toxin (e.g., keycards 
or passwords),
    (7) Require that individuals with access approval from the HHS 
Secretary or Administrator immediately report any of the following to 
the Responsible Official:
    (i) Any loss or compromise of keys, passwords, combination, etc.,
    (ii) Any suspicious persons or activities,
    (iii) Any loss or theft of select agents or toxins,
    (iv) Any release of a select agent or toxin, and
    (v) Any sign that inventory or use records for select agents or 
toxins have been altered or otherwise compromised, and
    (8) Separate areas where select agents and toxins are stored or 
used from the public areas of the building.
    (e) In developing a security plan, an entity or individual should 
consider, the document entitled ``Laboratory Security and Emergency 
Response Guidance for Laboratories Working with Select Agents. 
Morbidity and Mortality Weekly Report December 6, 2002; 51:RR-19:1-6.'' 
The document is available on the Internet at: http://www.cdc.gov/mmwr.
    (f) The plan must be reviewed annually and revised as necessary. 
Drills or exercises must be conducted at least annually to test and 
evaluate the effectiveness of the plan. The plan must be reviewed and 
revised, as necessary, after any drill or exercise and after any 
incident.


Sec.  73.12  Biosafety.

    (a) An individual or entity required to register under this part 
must develop and implement a written biosafety plan that is 
commensurate with the risk of the agent or toxin, given its intended 
use. The biosafety plan must contain sufficient information and 
documentation to describe the biosafety and containment procedures.
    (b) The biosafety and containment procedures must be sufficient to 
contain the select agent or toxin (e.g., physical structure and 
features of the entity, and operational and procedural safeguards).
    (c) In developing a biosafety plan, an individual or entity should 
consider:
    (1) The CDC/NIH publication, ``Biosafety in Microbiological and 
Biomedical Laboratories'', including all appendices. Copies may be 
obtained from the Superintendent of Documents, U.S. Government Printing 
Office, Post Office Box 371954, Pittsburgh, Pennsylvania, 75250-7954 or 
from the CDC Web site at http://www.cdc.gov/. Copies may be inspected 
at the Centers for Disease Control and Prevention, 1600 Clifton Road, 
Mail Stop E-79, Atlanta, Georgia.
    (2) The Occupational Safety and Health Administration (OSHA) 
regulations in 29 CFR parts 1910.1200 and 1910.1450.
    (3) The ``NIH Guidelines for Research Involving Recombinant DNA 
Molecules,'' (NIH Guidelines). Copies may be obtained from the Centers 
for Disease Control and Prevention, 1600 Clifton Road, Mail Stop E-79, 
Atlanta, Georgia, 30333 or from the CDC Web site at http://www.cdc.gov/. Copies may be inspected at the Centers for Disease 
Control and Prevention, 1600 Clifton Road, Mail Stop E-79, Atlanta, 
Georgia.
    (d) The plan must be reviewed annually and revised as necessary. 
Drills or exercises must be conducted at least annually to test and 
evaluate the effectiveness of the plan. The plan must be reviewed and 
revised, as necessary, after any drill or exercise and after any 
incident.


Sec.  73.13  Restricted experiments.

    (a) An individual or entity may not conduct a restricted experiment 
with a HHS select agent or toxin unless approved by and conducted in 
accordance with any conditions prescribed by the HHS Secretary. In 
addition, an individual or entity may not conduct a restricted 
experiment with an overlap select agent or toxin unless approved by and 
conducted in accordance with any conditions prescribed by the HHS 
Secretary, after consultation with Administrator.
    (b) Restricted experiments:
    (1) Experiments utilizing recombinant DNA that involve the 
deliberate transfer of a drug resistance trait to select agents that 
are not known to acquire the trait naturally, if such acquisition could 
compromise the use of the drug to control disease agents in humans, 
veterinary medicine, or agriculture.
    (2) Experiments involving the deliberate formation of recombinant 
DNA containing genes for the biosynthesis of select toxins lethal for 
vertebrates at an LD50 < 100 ng/kg body weight.
    (c) The HHS Secretary may revoke approval to conduct any of the 
experiments in paragraph (b) of this section, or revoke or suspend a 
certificate of registration, if the individual or entity fails to 
comply with the requirements of this part.
    (d) To apply for approval to conduct any of the experiments in 
paragraph (a) of this section, an individual or entity must submit a 
written request and supporting scientific information. A written 
decision granting or denying the request will be issued.


Sec.  73.14  Incident response.

    (a) An individual or entity required to register under this part 
must develop and implement a written incident response plan.\2\ The 
incident response plan must be coordinated with any entity-wide plans, 
kept in the workplace, and available to employees for review.
---------------------------------------------------------------------------

    \2\ Nothing in this section is meant to supersede or preempt 
incident response requirements imposed by other statutes or 
regulations.
---------------------------------------------------------------------------

    (b) The incident response plan must fully describe the entity's 
response procedures for the theft, loss, or release of a select agent 
or toxin, inventory discrepancies, security breaches (including 
information systems), severe weather and other natural disasters, 
workplace violence, bomb threats, suspicious packages, and emergencies 
such as fire, gas leak, explosion, power outage, etc. The response 
procedures must account for hazards associated with the select agent 
and toxin and appropriate actions to contain such select agent or 
toxin.
    (c) The incident response plan must also contain the following 
information:
    (1) The name and contact information (e.g., home and work) for the 
individual or entity (e.g., responsible official, alternate responsible 
official(s), biosafety officer, etc.),
    (2) The name and contact information for the building owner and/or 
manager, where applicable,
    (3) The name and contact information for tenant offices, where 
applicable,
    (4) The name and contact information for the physical security 
official for the building, where applicable,
    (5) Personnel roles and lines of authority and communication,
    (6) Planning and coordination with local emergency responders,
    (7) Procedures to be followed by employees performing rescue or 
medical duties,
    (8) Emergency medical treatment and first aid,
    (9) A list of personal protective and emergency equipment, and 
their locations,
    (10) Site security and control,
    (11) Procedures for emergency evacuation, including type of 
evacuation, exit route assignments, safe distances, and places of 
refuge, and
    (12) Decontamination procedures.
    (d) The plan must be reviewed annually and revised as necessary.

[[Page 13324]]

Drills or exercises must be conducted at least annually to test and 
evaluate the effectiveness of the plan. The plan must be reviewed and 
revised, as necessary, after any drill or exercise and after any 
incident.


Sec.  73.15  Training.

    (a) An individual or entity required to register under this part 
must provide information and training on biosafety and security to each 
individual with access approval from the HHS Secretary or Administrator 
before he/she has such access.\3\ In addition, an individual or entity 
must provide information and training on biosafety and security to each 
individual not approved for access from the HHS Secretary or 
Administrator before he/she works in or visits areas where select 
agents or toxins are handled or stored (e.g., laboratories, growth 
chambers, animal rooms, greenhouses, storage areas, etc.). The training 
must address the particular needs of the individual, the work they will 
do, and the risks posed by the select agents or toxins.
---------------------------------------------------------------------------

    \3\ The training need not duplicate training provided under the 
OSHA Bloodborne Pathogen Standard set forth at 29 CFR 1910.1030.
---------------------------------------------------------------------------

    (b) Refresher training must be provided annually.
    (c) A record of the training provided to each individual must be 
maintained. The record must include the name of the individual, the 
date of the training, a description of the training provided, and the 
means used to verify that the employee understood the training.


Sec.  73.16  Transfers.

    (a) Except as provided in paragraphs (c) and (d) of this section, a 
select agent or toxin may only be transferred to individuals or 
entities registered to possess, use, or transfer that agent or toxin. A 
select agent or toxin may only be transferred under the conditions of 
this section and must be authorized by CDC or APHIS prior to the 
transfer.\4\
---------------------------------------------------------------------------

    \4\ This section does not cover transfers within an entity when 
the sender and the recipient are covered by the same certificate of 
registration.
---------------------------------------------------------------------------

    (b) A transfer may be authorized if:
    (1) The sender:
    (i) Has at the time of transfer a certificate of registration that 
covers the particular select agent or toxin to be transferred and meets 
all requirements in this part,
    (ii) Meets the exemption requirements for the particular select 
agent or toxin to be transferred, or
    (iii) Is transferring the select agent or toxin from outside the 
United States and meets all import requirements.
    (2) At the time of transfer, the recipient has a certificate of 
registration that includes the particular select agent or toxin to be 
transferred and meets all of the requirements of this part.
    (c) A select agent or toxin that is contained in a specimen for 
proficiency testing may be transferred without prior authorization from 
CDC or APHIS provided that, at least seven calendar days prior to the 
transfer, the sender reports to CDC or APHIS the select agent or toxin 
to be transferred and the name and address of the recipient.
    (d) On a case-by-case basis, the HHS Secretary may authorize a 
transfer of a select agent or toxin, not otherwise eligible for 
transfer under this part under conditions prescribed by the HHS 
Secretary.
    (e) To obtain authorization for transfer, APHIS/CDC Form 2 must be 
submitted.
    (f) The recipient must submit a completed APHIS/CDC Form 2 within 
two business days of receipt of a select agent or toxin.
    (g) The recipient must immediately notify CDC or APHIS if the 
select agent or toxin has not been received within 48 hours after the 
expected delivery time, or if the package containing select agents or 
toxins has been damaged to the extent that a release of the select 
agent or toxin may have occurred.
    (h) An authorization for a transfer shall be valid only for 30 
calendar days after issuance, except that such an authorization becomes 
immediately null and void if any facts supporting the authorization 
change (e.g., change in the certificate of registration for the sender 
or recipient, change in the application for transfer).
    (i) The sender must comply with all applicable laws concerning 
packaging and shipping.


Sec.  73.17  Records.

    (a) An individual or entity required to register under this part 
must maintain complete records relating to the activities covered by 
this part. Such records must include:
    (1) Accurate, current inventory for each select agent (including 
viral genetic elements, recombinant nucleic acids, and recombinant 
organisms) held in long-term storage (placement in a system designed to 
ensure viability for future use, such as in a freezer or lyophilized 
materials), including:
    (i) The name and characteristics (e.g., strain designation, GenBank 
Accession number, etc.),
    (ii) The quantity acquired from another individual or entity (e.g., 
containers, vials, tubes, etc.), date of acquisition, and the source,
    (iii) Where stored (e.g., building, room, and freezer),
    (iv) When moved from storage and by whom and when returned to 
storage and by whom,
    (v) The select agent used and purpose of use,
    (vi) Records created under Sec.  73.16 and 9 CFR 121.16 
(Transfers),
    (vii) For intra-entity transfers (sender and the recipient are 
covered by the same certificate of registration), the select agent, the 
quantity transferred, the date of transfer, the sender, and the 
recipient, and
    (viii) Records created under Sec.  73.19 and 9 CFR part 121.19 
(Notification of theft, loss, or release),
    (2) Accurate, current inventory for each toxin held, including:
    (i) The name and characteristics,
    (ii) The quantity acquired from another individual or entity (e.g., 
containers, vials, tubes, etc.), date of acquisition, and the source,
    (iii) The initial and current quantity amount (e.g., milligrams, 
milliliters, grams, etc.),
    (iv) The toxin used and purpose of use, quantity, date(s) of the 
use and by whom,
    (v) Where stored (e.g., building, room, and freezer),
    (vi) When moved from storage and by whom and when returned to 
storage and by whom including quantity amount,
    (vii) Records created under Sec.  73.16 and 9 CFR part 121.16 
(Transfers),
    (viii) For intra-entity transfers (sender and the recipient are 
covered by the same certificate of registration), the toxin, the 
quantity transferred, the date of transfer, the sender, and the 
recipient,
    (ix) Records created under Sec.  73.19 and 9 CFR part 121.19 
(Notification of theft, loss, or release), and
    (x) If destroyed, the quantity of toxin destroyed, the date of such 
action, and by whom,
    (3) A current list of all individuals that have been granted access 
approval from the HHS Secretary or Administrator,
    (4) Information about all entries into areas containing select 
agents or toxins, including the name of the individual, name of the 
escort (if applicable), and date and time of entry,
    (5) Accurate, current records created under Sec.  73.9 and 9 CFR 
part 121.9 (Responsible Official), Sec.  73.11 and 9 CFR part 121.11 
(Security), Sec.  73.12 and 9 CFR part 121.12 (Biosafety), Sec.  73.14 
and 9 CFR part 121. 14 (Incident response), and Sec.  73.15 and 9 CFR 
part 121.15 (Training), and
    (6) A written explanation of any discrepancies.
    (b) The individual or entity must implement a system to ensure that 
all records and data bases created under

[[Page 13325]]

this part are accurate, have controlled access, and that their 
authenticity may be verified.
    (c) All records created under this part must be maintained for 
three years and promptly produced upon request.


Sec.  73.18  Inspections.

    (a) Without prior notification, the HHS Secretary, shall be allowed 
to inspect any site at which activities regulated by this part are 
conducted and shall be allowed to inspect and copy any records relating 
to the activities covered by this part.
    (b) Prior to issuing a certificate of registration to an individual 
or entity, the HHS Secretary may inspect and evaluate the premises and 
records to ensure compliance with this part.


Sec.  73.19  Notification of theft, loss, or release.

    (a) Upon discovery of the theft or loss of a select agent or toxin, 
an individual or entity must immediately notify CDC or APHIS and 
appropriate Federal, State, or local law enforcement agencies. Thefts 
or losses must be reported even if the select agent or toxin is 
subsequently recovered or the responsible parties are identified.
    (1) The theft or loss of a select agent or toxin must be reported 
immediately by telephone, facsimile, or e-mail. The following 
information must be provided:
    (i) The name of the select agent or toxin and any identifying 
information (e.g., strain or other characterization information),
    (ii) An estimate of the quantity lost or stolen,
    (iii) An estimate of the time during which the theft or loss 
occurred,
    (iv) The location (building, room) from which the theft or loss 
occurred, and
    (v) The list of Federal, State, or local law enforcement agencies 
to which the individual or entity reported, or intends to report the 
theft or loss.
    (2) A completed APHIS/CDC Form 3 must submitted within seven 
calendar days.
    (b) Upon discovery of a release of an agent or toxin causing 
occupational exposure or release of a select agent or toxin outside of 
the primary barriers of the biocontainment area, an individual or 
entity must immediately notify CDC or APHIS.
    (1) The release of a select agent or toxin must be reported by 
telephone, facsimile, or e-mail. The following information must be 
provided:
    (i) The name of the select agent or toxin and any identifying 
information (e.g., strain or other characterization information),
    (ii) An estimate of the quantity released,
    (iii) The time and duration of the release,
    (iv) The environment into which the release occurred (e.g., in 
building or outside of building, waste system),
    (v) The location (building, room) from which the release occurred,
    (vi) The number of individuals potentially exposed at the entity,
    (vii) Actions taken to respond to the release, and
    (viii) Hazards posed by the release.
    (2) A completed APHIS/CDC Form 3 must be submitted within seven 
calendar days.


Sec.  73.20  Administrative review.

    An individual or entity may appeal a denial, revocation, or 
suspension of registration under this part. An individual may appeal a 
denial, limitation, or revocation of access approval under this part. 
The appeal must be in writing, state the factual basis for the appeal, 
and be submitted to the HHS Secretary within 30 calendar days of the 
decision. Where the denial, revocation, or suspension of registration 
or the denial, limitation, or revocation of an individual's access 
approval is based upon an identification by the Attorney General, the 
request for review will be forwarded to the Attorney General. The HHS 
Secretary's decision constitutes final agency action.


Sec.  73.21  Civil money penalties.

    (a) The Inspector General of the Department of Health and Human 
Services is delegated authority to conduct investigations and to impose 
civil money penalties against any individual or entity in accordance 
with regulations in 42 CFR part 1003 for violations of the regulations 
in this part, as authorized by the Public Health Security and 
Bioterrorism Preparedness and Response Act of 2002 (Pub. L. 107-188). 
The delegation of authority includes all powers contained in section 6 
of the Inspector General Act of 1978 (5 U.S.C. App.).
    (b) The administrative law judges in, assigned to, or detailed to 
the Departmental Appeals Board have been delegated authority to conduct 
hearings and to render decisions in accordance with 42 CFR part 1005 
with respect to the imposition of civil money penalties, as authorized 
by the Public Health Security and Bioterrorism Preparedness and 
Response Act of 2002 (Pub. L. 107-188). This delegation includes, but 
is not limited to, the authority to administer oaths and affirmations, 
to subpoena witnesses and documents, to examine witnesses, to exclude 
or receive and give appropriate weight to materials and testimony 
offered as evidence, to make findings of fact and conclusions of law, 
and to determine the civil money penalties to be imposed.
    (c) The Departmental Appeals Board of the Department of Health and 
Human Services is delegated authority to make final determinations with 
respect to the imposition of civil money penalties for violations of 
the regulations of this part.

42 CFR Chapter V--Office of Inspector General--Health Care, Department 
of Health and Human Services

PART 1003--CIVIL MONEY PENALTIES, ASSESSMENTS AND EXCLUSIONS

0
1. The authority citation for part 1003 continues to read as follows:

    Authority: 42 U.S.C. 262a, 1302, 1320-7,1320a-7a, 1320b-10, 
1395u(j), 1395u(k), 1395cc(j), 1395dd(d)(1), 1395mm, 1395nn(g), 
1395ss(d), 1396b(m), 11131(c), and 11137(b)(2).

0
2. Section 1003.106 is amended by revising introductory paragraph 
(a)(1) to read as follows:


Sec.  1003.106  Determinations regarding the amount of the penalty and 
assessment.

    (a) Amount of penalty. (1) In determining the amount of any penalty 
or assessment in accordance with Sec.  1003.102(a), (b)(1), (b)(4), and 
(b)(9) through (b)(16) of this part, the Department will take into 
account--
* * * * *
[FR Doc. 05-5216 Filed 3-17-05; 8:45 am]
BILLING CODE 4160-17-P